Skip to contentSkip to conversation

xen/sched: resolve MISRA R18.3 pointer comparison

PATCH In review Dmytro Prokopchuk1 2 participants 2 messages Nov 10

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 xen/sched: resolve MISRA R18.3 pointer comparison

MISRA C Rule 18.3 states: "The relational operators >, >=, < and <= shall not be applied to objects of pointer type except where they point into the same object".

sched_spin_lock_double() takes the lock at the lower address first. The two spinlock_t pointers are not required to point into the same object, so compare the addresses as integers.

unsigned long is the right integer type here. It is pointer-sized on every architecture Xen supports, so the cast keeps the full address, and an unsigned comparison still means "lower address first". A signed long would interpret an address with the high bit set as negative, so the order would no longer follow that rule.

No functional change.

---
Test CI pipeline:
https://gitlab.com/xen-project/people/dimaprkp4k/xen/-/pipelines/3048801945

---
 xen/common/sched/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
xen/common/sched/core.c +1 -1
index 88ae40f954..10b6eecccd 100644
@@ -377,7 +377,7 @@ static always_inline void sched_spin_lock_double(
     {
         *flags = _spin_lock_irqsave(lock1);
     }
-    else if ( lock1 < lock2 )
+    else if ( (unsigned long)lock1 < (unsigned long)lock2 )
     {
         *flags = _spin_lock_irqsave(lock1);
         _spin_lock(lock2);
Signature · 1 line
2.43.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 14 lines · On 10.11.26 10:59, Dmytro Prokopchuk1 wrote:

MISRA C Rule 18.3 states: "The relational operators >, >=, < and <= shall not be applied to objects of pointer type except where they point into the same object".

sched_spin_lock_double() takes the lock at the lower address first. The two spinlock_t pointers are not required to point into the same object, so compare the addresses as integers.

unsigned long is the right integer type here. It is pointer-sized on every architecture Xen supports, so the cast keeps the full address, and an unsigned comparison still means "lower address first". A signed long would interpret an address with the high bit set as negative, so the order would no longer follow that rule.

Quoted 3 lines

No functional change.

Juergen