[PATCH 03/12] xen/argo: Fix MISRA violations around function parameters

Andrew Cooper posted 12 patches 1 week, 3 days ago
[PATCH 03/12] xen/argo: Fix MISRA violations around function parameters
Posted by Andrew Cooper 1 week, 3 days ago
For the ARM build only, Eclair reports a R8.4 violation because do_argo_op()
cannot see its declaration.  This means that x86 is picking hypercall-defs.h
up transitively while ARM is not.  Include xen/hypercall.h explicitly.

Eclair also reports a R8.3 violation because of arg3 and arg4 differing in
name with a raw_ prefix.  Because hypercall-defs.h generates both do_argo_op()
and compat_argo_op() from a single description, it's not possible to simply
rename to raw_ in the declaration, as that would force doing the same rename
in compat_argo_op().

In do_argo_op(), drop the split parameter handling, and perform the 32bit
range check via an explicit cast.  While adjusting the surrounding logic, drop
unnecessary casts to void * for already pointer arguments in argo_printk().

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Julien Grall <julien@xen.org>
CC: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
CC: Bertrand Marquis <bertrand.marquis@arm.com>
CC: Michal Orzel <michal.orzel@amd.com>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
 xen/common/argo.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/xen/common/argo.c b/xen/common/argo.c
index 029a82825ba8..28626e00a8cb 100644
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -21,6 +21,7 @@
 #include <xen/errno.h>
 #include <xen/event.h>
 #include <xen/guest_access.h>
+#include <xen/hypercall.h>
 #include <xen/lib.h>
 #include <xen/nospec.h>
 #include <xen/param.h>
@@ -2084,18 +2085,17 @@ sendv(struct domain *src_d, xen_argo_addr_t *src_addr,
 
 long
 do_argo_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1,
-           XEN_GUEST_HANDLE_PARAM(void) arg2, unsigned long raw_arg3,
-           unsigned long raw_arg4)
+           XEN_GUEST_HANDLE_PARAM(void) arg2, unsigned long arg3,
+           unsigned long arg4)
 {
     struct domain *currd = current->domain;
     long rc;
-    unsigned int arg3 = raw_arg3, arg4 = raw_arg4;
 
     argo_dprintk("->do_argo_op(%u,%p,%p,%lu,0x%lx)\n", cmd,
-                 (void *)arg1.p, (void *)arg2.p, raw_arg3, raw_arg4);
+                 arg1.p, arg2.p, arg3, arg4);
 
     /* Reject numeric hypercall args outside 32-bit range */
-    if ( (arg3 != raw_arg3) || (arg4 != raw_arg4) )
+    if ( (arg3 != (uint32_t)arg3) || (arg4 != (uint32_t)arg4) )
         return -EINVAL;
 
     if ( unlikely(!opt_argo) )
@@ -2248,7 +2248,7 @@ compat_argo_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1,
         return rc;
 
     argo_dprintk("->compat_argo_op(%u,%p,%p,%lu,0x%lx)\n", cmd,
-                 (void *)arg1.p, (void *)arg2.p, arg3, arg4);
+                 arg1.p, arg2.p, arg3, arg4);
 
     send_addr_hnd = guest_handle_cast(arg1, xen_argo_send_addr_t);
     /* arg2: iovs, arg3: niov, arg4: message_type */
-- 
2.39.5


Re: [PATCH 03/12] xen/argo: Fix MISRA violations around function parameters
Posted by Jan Beulich 1 week ago
On 20.02.2026 22:46, Andrew Cooper wrote:
> For the ARM build only, Eclair reports a R8.4 violation because do_argo_op()
> cannot see its declaration.  This means that x86 is picking hypercall-defs.h
> up transitively while ARM is not.  Include xen/hypercall.h explicitly.
> 
> Eclair also reports a R8.3 violation because of arg3 and arg4 differing in
> name with a raw_ prefix.  Because hypercall-defs.h generates both do_argo_op()
> and compat_argo_op() from a single description, it's not possible to simply
> rename to raw_ in the declaration, as that would force doing the same rename
> in compat_argo_op().
> 
> In do_argo_op(), drop the split parameter handling, and perform the 32bit
> range check via an explicit cast.  While adjusting the surrounding logic, drop
> unnecessary casts to void * for already pointer arguments in argo_printk().
> 
> No functional change.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

> ---
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: Julien Grall <julien@xen.org>
> CC: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
> CC: Bertrand Marquis <bertrand.marquis@arm.com>
> CC: Michal Orzel <michal.orzel@amd.com>
> CC: consulting@bugseng.com <consulting@bugseng.com>
> CC: Nicola Vetrini <nicola.vetrini@bugseng.com>

Further Cc-ing Argo maintainer / reviewer.

Jan