@samitouri / QOSamiQemu / commits / 4ef00a9fc4

target/arm: GICv5 cpuif: gicr_cdia_read() ppibit should be 64 bits

In gicr_cdia_read() we turn a PPI interrupt ID into a register index and a bit mask with a 1 for the bit we want to change: ppireg = id / 64; ppibit = 1ULL << (id % 64); However, we used the wrong type for ppibit, making it a uint32_t. If 'id' is too large we'll shift off the end, so we won't ever update the state of PPIs with indexes above 31. This didn't have any visible effects because the currently allocated architected PPIs are indexes 0..31, so you'd only see this if for some reason a guest was manually marking as pending a PPI in 32..63. Fix the type of ppibit to the intended 64 bit width. Fixes: 3f79212abae89 ("target/arm: GICv5 cpuif: Implement GICR CDIA command") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260714091806.3568281-2-peter.maydell@linaro.org

Peter Maydell committed Jul 20, 2026 at 19:05 UTC 4ef00a9fc4a4e77d007c94d779f041b74adff951
1 file changed +2 -1
target/arm/tcg/gicv5-cpuif.c
+2 -1
@@ -633,7 +633,8 @@ static uint64_t gicr_cdia_read(CPUARMState *env, const ARMCPRegInfo *ri)
633 switch (type) {
634 case GICV5_PPI:
635 {
636 - uint32_t ppireg, ppibit;
636 + uint32_t ppireg;
637 + uint64_t ppibit;
638
639 assert(id < GICV5_NUM_PPIS);
640 ppireg = id / 64;