[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [XEN PATCH v2] x86: p2m-pod: address violation of MISRA C Rule 2.1
- To: Jan Beulich <jbeulich@xxxxxxxx>
- From: Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>
- Date: Tue, 10 Sep 2024 11:53:42 +0200
- Cc: sstabellini@xxxxxxxxxx, michal.orzel@xxxxxxx, xenia.ragiadakou@xxxxxxx, ayan.kumar.halder@xxxxxxx, consulting@xxxxxxxxxxx, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
- Delivery-date: Tue, 10 Sep 2024 09:53:46 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 2024-09-10 11:08, Jan Beulich wrote:
On 10.09.2024 10:56, Nicola Vetrini wrote:
On 2024-07-01 10:36, Jan Beulich wrote:
On 28.06.2024 08:30, Nicola Vetrini wrote:
This being about unreachable code, why are the domain_crash() not the
crucial points of "unreachability"? And even if they weren't there,
why
wouldn't it be the goto or ...
--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -1040,6 +1040,7 @@ out_unmap:
* Something went wrong, probably crashing the domain. Unmap
* everything and return.
*/
+ /* SAF-8-safe Rule 2.1: defensive programming */
for ( i = 0; i < count; i++ )
if ( map[i] )
unmap_domain_page(map[i]);
... the label (just out of context) where the comment needs to go?
Because of the way this rule's configuration work, deviations are
placed
on the construct that ends up being the target of the unreachability,
What's "target" here? What if this loop was removed from the function?
Then both the label and the domain_crash() invocations would still be
unreachable in debug builds. Are you telling me that this then wouldn't
be diagnosed by Eclair? Or that it would then consider the closing
figure brace of the function "the target of the unreachability"?
Exactly, the end brace is a target to which the "function end" construct
is associated.
It would be kind of strange, though: why not just doing "domain_crash();
return;" in that case?
rather than (one of) the causes of such unreachability. Putting the
comment on the label works for ECLAIR by offsetting its target
statement, but not for other tools afaik.
I don't recall whether I ever saw a Coverity report to this effect,
and hence I wouldn't be able to tell how that would want silencing if
so desired.
Jan
--
Nicola Vetrini, BSc
Software Engineer, BUGSENG srl (https://bugseng.com)
|
