@samitouri / QOSamiQemu / commits / 49fbc03be1

target/riscv: Fix size of gei fields

geilen takes the values 31 or 63, fix it to 8 bits. hgeie and hgeip are at most 64 bits in size, fix to 64. Update relevant function arguments and uses of hgeie and hgeip. Note, masking is widened to 64-bit as geilen is already verified to be smaller than the target long size, and an out-of-bounds shift would be UB anyway. Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260520125406.28693-14-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Anton Johansson committed May 20, 2026 at 14:53 UTC 49fbc03be18f8c133386edf7ff5b5112ab179512

5 files changed +13 -13

target/riscv/cpu.c

+2 -2

@@ -1084,9 +1084,9 @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)

1084 }

1085

1086 /* Update HGEIP CSR */

1087 - env->hgeip &= ~((target_ulong)1 << irq);

1087 + env->hgeip &= ~(1ULL << irq);

1088 if (level) {

1089 - env->hgeip |= (target_ulong)1 << irq;

1089 + env->hgeip |= 1ULL << irq;

1090 }

1091

1092 /* Update mip.SGEIP bit */

target/riscv/cpu.h

+5 -5

@@ -280,7 +280,7 @@ struct CPUArchState {

280 #ifndef CONFIG_USER_ONLY

281 /* This contains QEMU specific information about the virt state. */

282 bool virt_enabled;

283 - target_ulong geilen;

283 + uint8_t geilen;

284 uint64_t resetvec;

285

286 uint64_t mhartid;

@@ -357,8 +357,8 @@ struct CPUArchState {

357 uint64_t htval;

358 uint64_t htinst;

359 uint64_t hgatp;

360 - target_ulong hgeie;

361 - target_ulong hgeip;

360 + uint64_t hgeie;

361 + uint64_t hgeip;

362 uint64_t htimedelta;

363 uint64_t hvien;

364

@@ -611,8 +611,8 @@ int riscv_cpu_mirq_pending(CPURISCVState *env);

611 int riscv_cpu_sirq_pending(CPURISCVState *env);

612 int riscv_cpu_vsirq_pending(CPURISCVState *env);

613 bool riscv_cpu_fp_enabled(CPURISCVState *env);

614 -target_ulong riscv_cpu_get_geilen(CPURISCVState *env);

615 -void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);

614 +uint8_t riscv_cpu_get_geilen(CPURISCVState *env);

615 +void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen);

616 bool riscv_cpu_vector_enabled(CPURISCVState *env);

617 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);

618 int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);

target/riscv/cpu_helper.c

+2 -2

@@ -712,7 +712,7 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)

712 }

713 }

714

715 -target_ulong riscv_cpu_get_geilen(CPURISCVState *env)

715 +uint8_t riscv_cpu_get_geilen(CPURISCVState *env)

716 {

717 if (!riscv_has_ext(env, RVH)) {

718 return 0;

@@ -721,7 +721,7 @@ target_ulong riscv_cpu_get_geilen(CPURISCVState *env)

721 return env->geilen;

722 }

723

724 -void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen)

724 +void riscv_cpu_set_geilen(CPURISCVState *env, uint8_t geilen)

725 {

726 if (!riscv_has_ext(env, RVH)) {

727 return;

target/riscv/csr.c

+2 -2

@@ -3786,7 +3786,7 @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,

3786

3787 if (csrno != CSR_HVIP) {

3788 gin = get_field(env->hstatus, HSTATUS_VGEIN);

3789 - old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;

3789 + old_mip |= (env->hgeip & (1ULL << gin)) ? MIP_VSEIP : 0;

3790 old_mip |= env->vstime_irq ? MIP_VSTIP : 0;

3791 }

3792

@@ -4971,7 +4971,7 @@ static RISCVException write_hgeie(CPURISCVState *env, int csrno,

4971 target_ulong val, uintptr_t ra)

4972 {

4973 /* Only GEILEN:1 bits implemented and BIT0 is never implemented */

4974 - val &= ((((target_ulong)1) << env->geilen) - 1) << 1;

4974 + val &= ((1ULL << env->geilen) - 1) << 1;

4975 env->hgeie = val;

4976 /* Update mip.SGEIP bit */

4977 riscv_cpu_update_mip(env, MIP_SGEIP,

target/riscv/machine.c

+2 -2

@@ -92,8 +92,8 @@ static const VMStateDescription vmstate_hyper = {

92 VMSTATE_UINT64(env.htval, RISCVCPU),

93 VMSTATE_UINT64(env.htinst, RISCVCPU),

94 VMSTATE_UINT64(env.hgatp, RISCVCPU),

95 - VMSTATE_UINTTL(env.hgeie, RISCVCPU),

96 - VMSTATE_UINTTL(env.hgeip, RISCVCPU),

95 + VMSTATE_UINT64(env.hgeie, RISCVCPU),

96 + VMSTATE_UINT64(env.hgeip, RISCVCPU),

97 VMSTATE_UINT64(env.hvien, RISCVCPU),

98 VMSTATE_UINT64(env.hvip, RISCVCPU),

99 VMSTATE_UINT64(env.htimedelta, RISCVCPU),