Re: [PATCH] hw/misc/iotkit-secctl: Fix writing to 'PPC Interrupt Clear' register

[Philippe Mathieu-Daudé]

On Mon, Feb 17, 2020 at 11:22 AM Peter Maydell <address@hidden> wrote:
>
> On Sat, 15 Feb 2020 at 16:19, Philippe Mathieu-Daudé <address@hidden> wrote:
> >
> > Fix warning reported by Clang static code analyzer:
> >
> >     CC      hw/misc/iotkit-secctl.o
> >   hw/misc/iotkit-secctl.c:343:9: warning: Value stored to 'value' is never 
> > read
> >           value &= 0x00f000f3;
> >           ^        ~~~~~~~~~~
> >
> > Fixes: b3717c23e1c
> > Reported-by: Clang Static Analyzer
> > Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
> > ---
> >  hw/misc/iotkit-secctl.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
> > index 609869821a..0d5556dd17 100644
> > --- a/hw/misc/iotkit-secctl.c
> > +++ b/hw/misc/iotkit-secctl.c
> > @@ -340,7 +340,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, 
> > hwaddr addr,
> >          qemu_set_irq(s->sec_resp_cfg, s->secrespcfg);
> >          break;
> >      case A_SECPPCINTCLR:
> > -        value &= 0x00f000f3;
> > +        s->secppcintstat = ~value & 0x00f000f3;
>
> This is (obviously) a bug, but I don't think your fix is right.
> This register has bits which are write-one-to-clear,
> (plus some other bits that are reserved and RAZ/WI)
> so we want:
>   s->secppcintstat &= ~(value & 0x00f000f3);
>
> (In particular bitwise-not has higher precedence than
> bitwise-and, so your expression will end up writing zero
> to s->specppcintstat for any valid guest write.)

Oops indeed :)

> My guess is that when I originally wrote the code I meant
> to write something like
>    value &= 0x00f000f3;
>    s->secppcintstat &= ~value;
> and forgot the second line.
>
> thanks
> -- PMM