Commit e927ac974c for qemu.org

commit e927ac974c94ce98c36ba3e84563a94ca8237358
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Mon Nov 9 13:52:08 2026 +0000

    hw/intc/hex-l2vic: avoid shift into sign bit

    In fastl2vic_write() we do:
       val = 1 << (irq % 32);

    Because '1' is a signed integer, this can shift into the sign bit of
    'int'; the cast to uint64_t to assign to 'val' then results in all
    the high bits being set.  This happens to cause no visible problems
    because l2vic_write never looks at those bits, but it's obviously not
    intended.  Use 1ULL so that we do the shift as 64 bits unsigned.

    Resolves: Coverity CID 1685261
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Tommaso Califano <tcalifano@redhat.com>
    Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
    Message-id: 20261023084624.1063258-1-peter.maydell@linaro.org

diff --git a/hw/intc/hex-l2vic.c b/hw/intc/hex-l2vic.c
index 2335236f83..93fbb7449e 100644
--- a/hw/intc/hex-l2vic.c
+++ b/hw/intc/hex-l2vic.c
@@ -392,7 +392,7 @@ static void fastl2vic_write(void *opaque, hwaddr offset, uint64_t val,
         uint32_t cmd = (val >> 16) & 0x3;
         uint32_t irq = val & 0x3ff;
         uint32_t slice = (irq / 32) * 4;
-        val = 1 << (irq % 32);
+        val = 1ULL << (irq % 32);

         if (cmd == FASTL2VIC_ENABLE) {
             l2vic_write(opaque, L2VIC_INT_ENABLE_SETn + slice, val, size);