[PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

[PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

[Philippe Mathieu-Daudé]

Fix warning reported by Clang static code analyzer:

    CC      hw/misc/iotkit-secctl.o
  hw/misc/iotkit-secctl.c:343:9: warning: Value stored to 'value' is never read
          value &= 0x00f000f3;
          ^        ~~~~~~~~~~

Fixes: b3717c23e1c
Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/misc/iotkit-secctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 609869821a..0d5556dd17 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -340,7 +340,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
         qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
         break;
     case A_SECPPCINTCLR:
-        value &= 0x00f000f3;
+        s->secppcintstat = ~value & 0x00f000f3;
         foreach_ppc(s, iotkit_secctl_ppc_update_irq_clear);
         break;
     case A_SECPPCINTEN:
-- 
2.21.1

Re: [PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

[Peter Maydell]

On Sat, 15 Feb 2020 at 16:19, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> Fix warning reported by Clang static code analyzer:
>
>     CC      hw/misc/iotkit-secctl.o
>   hw/misc/iotkit-secctl.c:343:9: warning: Value stored to 'value' is never read
>           value &= 0x00f000f3;
>           ^        ~~~~~~~~~~
>
> Fixes: b3717c23e1c
> Reported-by: Clang Static Analyzer
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/misc/iotkit-secctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
> index 609869821a..0d5556dd17 100644
> --- a/hw/misc/iotkit-secctl.c
> +++ b/hw/misc/iotkit-secctl.c
> @@ -340,7 +340,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
>          qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
>          break;
>      case A_SECPPCINTCLR:
> -        value &= 0x00f000f3;
> +        s->secppcintstat = ~value & 0x00f000f3;

This is (obviously) a bug, but I don't think your fix is right.
This register has bits which are write-one-to-clear,
(plus some other bits that are reserved and RAZ/WI)
so we want:
  s->secppcintstat &= ~(value & 0x00f000f3);

(In particular bitwise-not has higher precedence than
bitwise-and, so your expression will end up writing zero
to s->specppcintstat for any valid guest write.)

My guess is that when I originally wrote the code I meant
to write something like
   value &= 0x00f000f3;
   s->secppcintstat &= ~value;
and forgot the second line.

thanks
-- PMM

Re: [PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

[Philippe Mathieu-Daudé]

On Mon, Feb 17, 2020 at 11:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Sat, 15 Feb 2020 at 16:19, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >
> > Fix warning reported by Clang static code analyzer:
> >
> >     CC      hw/misc/iotkit-secctl.o
> >   hw/misc/iotkit-secctl.c:343:9: warning: Value stored to 'value' is never read
> >           value &= 0x00f000f3;
> >           ^        ~~~~~~~~~~
> >
> > Fixes: b3717c23e1c
> > Reported-by: Clang Static Analyzer
> > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> > ---
> >  hw/misc/iotkit-secctl.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
> > index 609869821a..0d5556dd17 100644
> > --- a/hw/misc/iotkit-secctl.c
> > +++ b/hw/misc/iotkit-secctl.c
> > @@ -340,7 +340,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
> >          qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
> >          break;
> >      case A_SECPPCINTCLR:
> > -        value &= 0x00f000f3;
> > +        s->secppcintstat = ~value & 0x00f000f3;
>
> This is (obviously) a bug, but I don't think your fix is right.
> This register has bits which are write-one-to-clear,
> (plus some other bits that are reserved and RAZ/WI)
> so we want:
>   s->secppcintstat &= ~(value & 0x00f000f3);
>
> (In particular bitwise-not has higher precedence than
> bitwise-and, so your expression will end up writing zero
> to s->specppcintstat for any valid guest write.)

Oops indeed :)

> My guess is that when I originally wrote the code I meant
> to write something like
>    value &= 0x00f000f3;
>    s->secppcintstat &= ~value;
> and forgot the second line.
>
> thanks
> -- PMM