From: Andrew Cooper <andrew.cooper3@citrix.com>
To: Eslam Elnikety <elnikety@amazon.com>, <xen-devel@lists.xenproject.org>
Cc: "Roger Pau Monné" <roger.pau@citrix.com>, "Wei Liu" <wl@xen.org>,
"Jan Beulich" <jbeulich@suse.com>,
"Paul Durrant" <pdurrant@amazon.co.uk>
Subject: Re: [PATCH] x86/vhpet: Fix type size in timer_int_route_valid
Date: Tue, 28 Jul 2020 10:26:03 +0100 [thread overview]
Message-ID: <a55fba45-a008-059e-ea8c-b7300e2e8b7d@citrix.com> (raw)
In-Reply-To: <20200728083357.77999-1-elnikety@amazon.com>
On 28/07/2020 09:33, Eslam Elnikety wrote:
> The macro timer_int_route_cap evalutes to a 64 bit value. Extend the
> size of left side of timer_int_route_valid to match.
>
> This bug was discovered and resolved using Coverity Static Analysis
> Security Testing (SAST) by Synopsys, Inc.
>
> Signed-off-by: Eslam Elnikety <elnikety@amazon.com>
> ---
> xen/arch/x86/hvm/hpet.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c
> index ca94e8b453..9afe6e6760 100644
> --- a/xen/arch/x86/hvm/hpet.c
> +++ b/xen/arch/x86/hvm/hpet.c
> @@ -66,7 +66,7 @@
> MASK_EXTR(timer_config(h, n), HPET_TN_INT_ROUTE_CAP)
>
> #define timer_int_route_valid(h, n) \
> - ((1u << timer_int_route(h, n)) & timer_int_route_cap(h, n))
> + ((1ULL << timer_int_route(h, n)) & timer_int_route_cap(h, n))
>
> static inline uint64_t hpet_read_maincounter(HPETState *h, uint64_t guest_time)
> {
Does this work?
diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c
index ca94e8b453..638f6174de 100644
--- a/xen/arch/x86/hvm/hpet.c
+++ b/xen/arch/x86/hvm/hpet.c
@@ -62,8 +62,7 @@
#define timer_int_route(h, n) MASK_EXTR(timer_config(h, n),
HPET_TN_ROUTE)
-#define timer_int_route_cap(h, n) \
- MASK_EXTR(timer_config(h, n), HPET_TN_INT_ROUTE_CAP)
+#define timer_int_route_cap(h, n) (h)->hpet.timers[(n)].route
#define timer_int_route_valid(h, n) \
((1u << timer_int_route(h, n)) & timer_int_route_cap(h, n))
diff --git a/xen/include/asm-x86/hvm/vpt.h b/xen/include/asm-x86/hvm/vpt.h
index f0e0eaec83..a41fc443cc 100644
--- a/xen/include/asm-x86/hvm/vpt.h
+++ b/xen/include/asm-x86/hvm/vpt.h
@@ -73,7 +73,13 @@ struct hpet_registers {
uint64_t isr; /* interrupt status reg */
uint64_t mc64; /* main counter */
struct { /* timers */
- uint64_t config; /* configuration/cap */
+ union {
+ uint64_t config; /* configuration/cap */
+ struct {
+ uint32_t _;
+ uint32_t route;
+ };
+ };
uint64_t cmp; /* comparator */
uint64_t fsb; /* FSB route, not supported now */
} timers[HPET_TIMER_NUM];
next prev parent reply other threads:[~2020-07-28 9:26 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-28 8:33 [PATCH] x86/vhpet: Fix type size in timer_int_route_valid Eslam Elnikety
2020-07-28 8:58 ` Roger Pau Monné
2020-07-28 9:14 ` Eslam Elnikety
2020-07-28 9:26 ` Andrew Cooper [this message]
2020-07-28 11:09 ` Eslam Elnikety
2020-07-28 13:46 ` Andrew Cooper
2020-07-28 13:55 ` Eslam Elnikety
2020-07-28 17:51 ` Jan Beulich
2020-07-31 8:38 ` Eslam Elnikety
2020-07-31 9:53 ` Jan Beulich
2020-07-31 12:35 ` Julien Grall
2020-07-31 12:38 ` Jan Beulich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a55fba45-a008-059e-ea8c-b7300e2e8b7d@citrix.com \
--to=andrew.cooper3@citrix.com \
--cc=elnikety@amazon.com \
--cc=jbeulich@suse.com \
--cc=pdurrant@amazon.co.uk \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).