Re: [PATCH v8 for-4.9 3/5] hvm/dmop: Implement copy_{to, from}_guest_buf() in terms of raw accessors

From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Jan Beulich <JBeulich@suse.com>,
	Jennifer Herbert <Jennifer.Herbert@citrix.com>
Cc: Julien Grall <julien.grall@arm.com>,
	Paul Durrant <paul.durrant@citrix.com>,
	Xen-devel <xen-devel@lists.xen.org>
Subject: Re: [PATCH v8 for-4.9 3/5] hvm/dmop: Implement copy_{to, from}_guest_buf() in terms of raw accessors
Date: Fri, 21 Apr 2017 17:10:19 +0100	[thread overview]
Message-ID: <9d78b09d-7582-8f03-f796-0b7615c4be06@citrix.com> (raw)
In-Reply-To: <58FA4527020000780015310E@prv-mh.provo.novell.com>

On 21/04/17 16:45, Jan Beulich wrote:
>>>> On 21.04.17 at 16:05, <jennifer.herbert@citrix.com> wrote:
>> +#define COPY_FROM_GUEST_BUF(dst, args, buf_idx) \
>> +    _raw_copy_from_guest_buf(&dst, args, buf_idx, sizeof(dst))
>> +
>> +#define COPY_TO_GUEST_BUF(args, buf_idx, src) \
>> +    _raw_copy_to_guest_buf(args, buf_idx, &src, sizeof(src))
> Why all caps all of the sudden?

This is the start of some code improvements, given the fallout from XSA-212.

This macro is not a C function and doesn't behave like one
(specifically, capturing src by name rather than value).  Therefore, it
gets ALL_CAPS() (which is actually traditional for any macro in C) to
make it more obvious to people reading the code that it *is not* a C
function and doesn't behave like one.

It is getting embarrassing how many security vulnerability we are seeing
because macros look like they are doing one thing, yet actually do
something else, and improving the quality of the code is the only way
this is going to get better.

Therefore, I am going to insist that they stay like this.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel