@samitouri / QOSamiQemu / commits / 8bb514f373

hw/intc/mips_gic: Avoid Coverity complaint in VP writes

The MIPS GIC does a check for a guest error in the write path for the SH_MAP*_VP registers which triggers a Coverity complaint because it assigns -1 to a uint64_t. The code doesn't misbehave because the -1 case will be caught by the following OFFSET_CHECK(), but the code could be improved: * there is no need to special case to avoid passing 0 to ctz64(), because (unlike the compiler builtins) QEMU defines that this has a specific behaviour, returning 64 * the OFFSET_CHECK() macro will go to the "bad_offset" label and print an error implying that the guest wrote to an invalid register offset. This is misleading about the actual problem, which is that the guest wrote a bogus value to a valid register offset Make the error check print a better log message, and avoid the special casing on ctz64(); in passing, this should also make Coverity happier. CID: 1547545 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20260512111536.3437645-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Peter Maydell committed May 12, 2026 at 12:15 UTC 8bb514f373fa9c378675dc0b5f5d5e717c20d855
1 file changed +7 -3
hw/intc/mips_gic.c
+7 -3
@@ -317,9 +317,13 @@ static void gic_write(void *opaque, hwaddr addr, uint64_t data, unsigned size)
317 /* up to 32 bytes per a pin */
318 irq_src = (addr - GIC_SH_MAP0_VP_OFS) / 32;
319 OFFSET_CHECK(irq_src < gic->num_irq);
320 - data = data ? ctz64(data) : -1;
321 - OFFSET_CHECK(data < gic->num_vps);
322 - gic->irq_state[irq_src].map_vp = data;
320 + if (ctz64(data) >= gic->num_vps) {
321 + qemu_log_mask(LOG_GUEST_ERROR, "Bad data value 0x%" PRIx64
322 + " at MAP VP register offset 0x%" PRIx64 "\n",
323 + data, addr);
324 + break;
325 + }
326 + gic->irq_state[irq_src].map_vp = ctz64(data);
327 break;
328 case VP_LOCAL_SECTION_OFS ... (VP_LOCAL_SECTION_OFS + GIC_VL_BRK_GROUP):
329 gic_write_vp(gic, vp_index, addr - VP_LOCAL_SECTION_OFS, data, size);