Commit 4588ef5176 for qemu.org

commit 4588ef5176f461bd27ba26bc894d0643f12464b4
Author: BALATON Zoltan <balaton@eik.bme.hu>
Date:   Sat Mar 21 17:30:15 2026 +0100

    ati-vga: Avoid warnings about sign extension

    Coverity reports several possible sign extension errors (latest is CID
    1645615). These cannot happen because the values are limited when
    writing the registers and only 32 bits of the return value matter but
    change type of the variable storing the return value to uint32_t to
    avoid these warnings. Also change DEFAULT_SC_BOTTOM_RIGHT register
    read to match what other similar registers do for consistency.

    Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Message-ID: <9a3263a06bc72aa5a56bafe0a11ad189d5f60528.1774110169.git.balaton@eik.bme.hu>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

diff --git a/hw/display/ati.c b/hw/display/ati.c
index 1a6a5ad4fd..a070f7af29 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -265,7 +265,7 @@ static void ati_vga_vblank_irq(void *opaque)
     ati_vga_update_irq(s);
 }

-static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs,
+static inline uint32_t ati_reg_read_offs(uint32_t reg, int offs,
                                          unsigned int size)
 {
     if (offs == 0 && size == 4) {
@@ -278,7 +278,7 @@ static inline uint64_t ati_reg_read_offs(uint32_t reg, int offs,
 static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
 {
     ATIVGAState *s = opaque;
-    uint64_t val = 0;
+    uint32_t val = 0;

     switch (addr) {
     case MM_INDEX:
@@ -513,8 +513,8 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
         val |= s->regs.default_tile << 16;
         break;
     case DEFAULT_SC_BOTTOM_RIGHT:
-        val = (s->regs.default_sc_bottom << 16) |
-              s->regs.default_sc_right;
+        val = s->regs.default_sc_right;
+        val |= s->regs.default_sc_bottom << 16;
         break;
     case SC_TOP:
         val = s->regs.sc_top;