fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ppc/xive2: Fix integer overflow warning in xive2_redistribute()

Browse source 
Coverity reported an integer overflow warning in xive2_redistribute()
where the code does a left shift operation "0xffffffff << crowd". Fix the
warning by using a 64 byte integer type. Also refactor the calculation
into dedicated routines.

Resolves: Coverity CID 1612608
Fixes: 555e446019 ("ppc/xive2: Support redistribution of group interrupts")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250811074912.162774-1-gautam@linux.ibm.com
Message-ID: <20250811074912.162774-1-gautam@linux.ibm.com>
This commit is contained in:
Gautam Menghani 2025-08-11 13:19:11 +05:30 • committed by Harsh Prateek Bora
parent 6285eebd3a
commit 936a0f2088
No known key found for this signature in database
GPG key ID: 4544E994F9D68FBB
1 changed files with 31 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

45
hw/intc/xive2.c
View file

@ -95,6 +95,35 @@ static void xive2_nvgc_set_backlog(Xive2Nvgc *nvgc, uint8_t priority,
}
}
static uint32_t xive2_nvgc_get_idx(uint32_t nvp_idx, uint8_t group)
{
uint32_t nvgc_idx;
if (group > 0) {
nvgc_idx = (nvp_idx & (0xffffffffULL << group)) |
((1 << (group - 1)) - 1);
} else {
nvgc_idx = nvp_idx;
}
return nvgc_idx;
}
static uint8_t xive2_nvgc_get_blk(uint8_t nvp_blk, uint8_t crowd)
{
uint8_t nvgc_blk;
if (crowd > 0) {
crowd = (crowd == 3) ? 4 : crowd;
nvgc_blk = (nvp_blk & (0xffffffffULL << crowd)) |
((1 << (crowd - 1)) - 1);
} else {
nvgc_blk = nvp_blk;
}
return nvgc_blk;
}
uint64_t xive2_presenter_nvgc_backlog_op(XivePresenter *xptr,
bool crowd,
uint8_t blk, uint32_t idx,
@ -638,20 +667,8 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
/* convert crowd/group to blk/idx */
if (group > 0) {
nvgc_idx = (nvp_idx & (0xffffffff << group)) |
((1 << (group - 1)) - 1);
} else {
nvgc_idx = nvp_idx;
}
if (crowd > 0) {
crowd = (crowd == 3) ? 4 : crowd;
nvgc_blk = (nvp_blk & (0xffffffff << crowd)) |
((1 << (crowd - 1)) - 1);
} else {
nvgc_blk = nvp_blk;
}
nvgc_idx = xive2_nvgc_get_idx(nvp_idx, group);
nvgc_blk = xive2_nvgc_get_blk(nvp_blk, crowd);
/* Use blk/idx to retrieve the NVGC */
if (xive2_router_get_nvgc(xrtr, crowd, nvgc_blk, nvgc_idx, &nvgc)) {