In update_itlb_use() the variables or_mask and and_mask are uint8_t,
which means that in expressions like "and_mask << 24" the usual C
arithmetic conversions will result in the shift being done as a
signed int type, and so we will shift into the sign bit. For QEMU
this isn't undefined behaviour because we use -fwrapv; but we can
avoid it anyway by using uint32_t types for or_mask and and_mask.

Resolves: Coverity CID 1547628
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/sh4/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 67029106277..9659c695504 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -187,7 +187,7 @@ void superh_cpu_do_interrupt(CPUState *cs)
 
 static void update_itlb_use(CPUSH4State * env, int itlbnb)
 {
-    uint8_t or_mask = 0, and_mask = (uint8_t) - 1;
+    uint32_t or_mask = 0, and_mask = 0xff;
 
     switch (itlbnb) {
     case 0:
-- 
2.34.1

On Tue, 23 Jul 2024 at 18:24, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> In update_itlb_use() the variables or_mask and and_mask are uint8_t,
> which means that in expressions like "and_mask << 24" the usual C
> arithmetic conversions will result in the shift being done as a
> signed int type, and so we will shift into the sign bit. For QEMU
> this isn't undefined behaviour because we use -fwrapv; but we can
> avoid it anyway by using uint32_t types for or_mask and and_mask.
>
> Resolves: Coverity CID 1547628
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

I'll take this via my target-arm queue since I'm doing a
pullreq anyway.

thanks
-- PMM

On Wed, 24 Jul 2024 02:24:31 +0900,
Peter Maydell wrote:
> 
> In update_itlb_use() the variables or_mask and and_mask are uint8_t,
> which means that in expressions like "and_mask << 24" the usual C
> arithmetic conversions will result in the shift being done as a
> signed int type, and so we will shift into the sign bit. For QEMU
> this isn't undefined behaviour because we use -fwrapv; but we can
> avoid it anyway by using uint32_t types for or_mask and and_mask.
> 
> Resolves: Coverity CID 1547628
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  target/sh4/helper.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/sh4/helper.c b/target/sh4/helper.c
> index 67029106277..9659c695504 100644
> --- a/target/sh4/helper.c
> +++ b/target/sh4/helper.c
> @@ -187,7 +187,7 @@ void superh_cpu_do_interrupt(CPUState *cs)
>  
>  static void update_itlb_use(CPUSH4State * env, int itlbnb)
>  {
> -    uint8_t or_mask = 0, and_mask = (uint8_t) - 1;
> +    uint32_t or_mask = 0, and_mask = 0xff;
>  
>      switch (itlbnb) {
>      case 0:
> -- 
> 2.34.1
> 

Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>

-- 
Yosinori Sato

On 7/24/24 03:24, Peter Maydell wrote:
> In update_itlb_use() the variables or_mask and and_mask are uint8_t,
> which means that in expressions like "and_mask << 24" the usual C
> arithmetic conversions will result in the shift being done as a
> signed int type, and so we will shift into the sign bit. For QEMU
> this isn't undefined behaviour because we use -fwrapv; but we can
> avoid it anyway by using uint32_t types for or_mask and and_mask.
> 
> Resolves: Coverity CID 1547628
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>
> ---
>   target/sh4/helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

On 23/7/24 19:24, Peter Maydell wrote:
> In update_itlb_use() the variables or_mask and and_mask are uint8_t,
> which means that in expressions like "and_mask << 24" the usual C
> arithmetic conversions will result in the shift being done as a
> signed int type, and so we will shift into the sign bit. For QEMU
> this isn't undefined behaviour because we use -fwrapv; but we can
> avoid it anyway by using uint32_t types for or_mask and and_mask.
> 
> Resolves: Coverity CID 1547628
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   target/sh4/helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>