[PATCH 0/5] x86: More misc MISRA fixes

[PATCH 0/5] x86: More misc MISRA fixes

[Andrew Cooper]

Andrew Cooper (5):
  x86/pv: Address MISRA C:2012 Rule 4.1
  x86/pv: Change type of do_update_descriptor()'s desc parameter
  x86: Address MIRSA R8.3 (declaration/definition mismatch) issues
  x86: Address MIRSA R8.4 (declaration visibility) issues
  RFC x86/shadow: Deviate multi.h as being included multiple times

 xen/arch/x86/include/asm/hypercall.h |  4 ++--
 xen/arch/x86/include/asm/pv/mm.h     |  4 ++--
 xen/arch/x86/include/asm/shadow.h    |  2 +-
 xen/arch/x86/mm.c                    |  4 ++--
 xen/arch/x86/mm/shadow/common.c      |  8 ++++----
 xen/arch/x86/mm/shadow/multi.h       |  6 ++++--
 xen/arch/x86/mm/shadow/private.h     | 10 +++++-----
 xen/arch/x86/pv/descriptor-tables.c  | 10 ++++------
 xen/arch/x86/pv/emul-inv-op.c        |  2 +-
 xen/arch/x86/pv/traps.c              |  4 ++--
 xen/arch/x86/setup.c                 |  4 ++--
 xen/common/kimage.c                  |  2 +-
 xen/common/livepatch.c               | 14 +++++++-------
 xen/include/hypercall-defs.c         |  2 +-
 xen/include/xen/livepatch.h          |  2 +-
 15 files changed, 39 insertions(+), 39 deletions(-)

-- 
2.39.5

[PATCH 1/5] x86/pv: Address MISRA C:2012 Rule 4.1

[Andrew Cooper]

MISRA doesn't like mixing hexadecimal escape sequences with ASCII text.  Use
the same workaround as in commit cd5048353725 ("xen: address MISRA C:2012 Rule
4.1").

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
 xen/arch/x86/pv/emul-inv-op.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/pv/emul-inv-op.c b/xen/arch/x86/pv/emul-inv-op.c
index 314ebd01cb34..346ac1124d7b 100644
--- a/xen/arch/x86/pv/emul-inv-op.c
+++ b/xen/arch/x86/pv/emul-inv-op.c
@@ -26,7 +26,7 @@ static int emulate_forced_invalid_op(struct cpu_user_regs *regs)
         pv_inject_page_fault(0, eip + sizeof(sig) - rc);
         return EXCRET_fault_fixed;
     }
-    if ( memcmp(sig, "\xf\xbxen", sizeof(sig)) )
+    if ( memcmp(sig, "\xf\xb" "xen", sizeof(sig)) )
         return 0;
     eip += sizeof(sig);
 
-- 
2.39.5

Re: [PATCH 1/5] x86/pv: Address MISRA C:2012 Rule 4.1

[Nicola Vetrini]

On 2025-12-12 23:20, Andrew Cooper wrote:
> MISRA doesn't like mixing hexadecimal escape sequences with ASCII text. 
>  Use
> the same workaround as in commit cd5048353725 ("xen: address MISRA 
> C:2012 Rule
> 4.1").
> 
> No functional change.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: consulting@bugseng.com <consulting@bugseng.com>
> CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
> ---
>  xen/arch/x86/pv/emul-inv-op.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/xen/arch/x86/pv/emul-inv-op.c 
> b/xen/arch/x86/pv/emul-inv-op.c
> index 314ebd01cb34..346ac1124d7b 100644
> --- a/xen/arch/x86/pv/emul-inv-op.c
> +++ b/xen/arch/x86/pv/emul-inv-op.c
> @@ -26,7 +26,7 @@ static int emulate_forced_invalid_op(struct 
> cpu_user_regs *regs)
>          pv_inject_page_fault(0, eip + sizeof(sig) - rc);
>          return EXCRET_fault_fixed;
>      }
> -    if ( memcmp(sig, "\xf\xbxen", sizeof(sig)) )
> +    if ( memcmp(sig, "\xf\xb" "xen", sizeof(sig)) )
>          return 0;
>      eip += sizeof(sig);

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

[PATCH 2/5] x86/pv: Change type of do_update_descriptor()'s desc parameter

[Andrew Cooper]

The automatically generated hypercall dispatch logic looks like:

    case __HYPERVISOR_update_descriptor: \
        ret = do_update_descriptor((uint64_t)(a1), (seg_desc_t)(a2)); \
        break; \

but seg_desc_t is a union and Eclair considers this to be a violation of MISRA
Rule 1.1.  There's also a Rule 8.3 violation for the parameter name mismatch.

Instead of playing games trying to change seg_desc_t to be a struct, or to
alter the AWK generator to know that seg_desc_t is magic and needs braces
rather than brackets, just switch the type to be a plain uint64_t.

The size is fixed by the x86 architecture, so it is never going to change.
This even lets us simplify compat_update_descriptor() a little.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
 xen/arch/x86/pv/descriptor-tables.c | 10 ++++------
 xen/include/hypercall-defs.c        |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/pv/descriptor-tables.c b/xen/arch/x86/pv/descriptor-tables.c
index 26f7d18b11b5..8a32b9ae5ced 100644
--- a/xen/arch/x86/pv/descriptor-tables.c
+++ b/xen/arch/x86/pv/descriptor-tables.c
@@ -179,11 +179,8 @@ int compat_set_gdt(
 int compat_update_descriptor(
     uint32_t pa_lo, uint32_t pa_hi, uint32_t desc_lo, uint32_t desc_hi)
 {
-    seg_desc_t d;
-
-    d.raw = ((uint64_t)desc_hi << 32) | desc_lo;
-
-    return do_update_descriptor(pa_lo | ((uint64_t)pa_hi << 32), d);
+    return do_update_descriptor(pa_lo | ((uint64_t)pa_hi << 32),
+                                desc_lo | ((uint64_t)desc_hi << 32));
 }
 
 #endif /* CONFIG_PV32 */
@@ -288,9 +285,10 @@ int validate_segdesc_page(struct page_info *page)
     return i == 512 ? 0 : -EINVAL;
 }
 
-long do_update_descriptor(uint64_t gaddr, seg_desc_t d)
+long do_update_descriptor(uint64_t gaddr, uint64_t desc)
 {
     struct domain *currd = current->domain;
+    seg_desc_t d = { .raw = desc };
     gfn_t gfn = gaddr_to_gfn(gaddr);
     mfn_t mfn;
     seg_desc_t *entry;
diff --git a/xen/include/hypercall-defs.c b/xen/include/hypercall-defs.c
index cef08eeec1b8..5782cdfd1496 100644
--- a/xen/include/hypercall-defs.c
+++ b/xen/include/hypercall-defs.c
@@ -184,7 +184,7 @@ mca(xen_mc_t *u_xen_mc)
 set_trap_table(const_trap_info_t *traps)
 set_gdt(xen_ulong_t *frame_list, unsigned int entries)
 set_callbacks(unsigned long event_address, unsigned long failsafe_address, unsigned long syscall_address)
-update_descriptor(uint64_t gaddr, seg_desc_t desc)
+update_descriptor(uint64_t gaddr, uint64_t desc)
 update_va_mapping(unsigned long va, uint64_t val64, unsigned long flags)
 update_va_mapping_otherdomain(unsigned long va, uint64_t val64, unsigned long flags, domid_t domid)
 #endif
-- 
2.39.5

[PATCH 3/5] x86: Address MIRSA R8.3 (declaration/definition mismatch) issues

[Andrew Cooper]

These are mostly name mismatches, but a couple have type alias mismatches too.

For shadow_put_top_level() and is_patch(), the declaration name is the better
choice so change the name in the function.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
 xen/arch/x86/include/asm/hypercall.h |  4 ++--
 xen/arch/x86/include/asm/pv/mm.h     |  4 ++--
 xen/arch/x86/include/asm/shadow.h    |  2 +-
 xen/arch/x86/mm.c                    |  4 ++--
 xen/arch/x86/mm/shadow/common.c      |  8 ++++----
 xen/arch/x86/mm/shadow/multi.h       |  4 ++--
 xen/arch/x86/mm/shadow/private.h     | 10 +++++-----
 xen/common/kimage.c                  |  2 +-
 xen/common/livepatch.c               | 14 +++++++-------
 xen/include/xen/livepatch.h          |  2 +-
 10 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/xen/arch/x86/include/asm/hypercall.h b/xen/arch/x86/include/asm/hypercall.h
index f6e9e2313b3c..bf2f0e169aef 100644
--- a/xen/arch/x86/include/asm/hypercall.h
+++ b/xen/arch/x86/include/asm/hypercall.h
@@ -22,8 +22,8 @@
 void pv_hypercall(struct cpu_user_regs *regs);
 #endif
 
-void pv_ring1_init_hypercall_page(void *ptr);
-void pv_ring3_init_hypercall_page(void *ptr);
+void pv_ring1_init_hypercall_page(void *p);
+void pv_ring3_init_hypercall_page(void *p);
 
 /*
  * Both do_mmuext_op() and do_mmu_update():
diff --git a/xen/arch/x86/include/asm/pv/mm.h b/xen/arch/x86/include/asm/pv/mm.h
index 182764542c1f..a5745908206a 100644
--- a/xen/arch/x86/include/asm/pv/mm.h
+++ b/xen/arch/x86/include/asm/pv/mm.h
@@ -18,7 +18,7 @@ int pv_set_gdt(struct vcpu *v, const unsigned long frames[],
                unsigned int entries);
 void pv_destroy_gdt(struct vcpu *v);
 
-bool pv_map_ldt_shadow_page(unsigned int off);
+bool pv_map_ldt_shadow_page(unsigned int offset);
 bool pv_destroy_ldt(struct vcpu *v);
 
 int validate_segdesc_page(struct page_info *page);
@@ -40,7 +40,7 @@ static inline int pv_set_gdt(struct vcpu *v, const unsigned long frames[],
 { ASSERT_UNREACHABLE(); return -EINVAL; }
 static inline void pv_destroy_gdt(struct vcpu *v) { ASSERT_UNREACHABLE(); }
 
-static inline bool pv_map_ldt_shadow_page(unsigned int off) { return false; }
+static inline bool pv_map_ldt_shadow_page(unsigned int offset) { return false; }
 static inline bool pv_destroy_ldt(struct vcpu *v)
 { ASSERT_UNREACHABLE(); return false; }
 
diff --git a/xen/arch/x86/include/asm/shadow.h b/xen/arch/x86/include/asm/shadow.h
index 9a8d1b8353cd..60589c3cacee 100644
--- a/xen/arch/x86/include/asm/shadow.h
+++ b/xen/arch/x86/include/asm/shadow.h
@@ -63,7 +63,7 @@ int shadow_enable(struct domain *d, u32 mode);
 
 /* Enable VRAM dirty bit tracking. */
 int shadow_track_dirty_vram(struct domain *d,
-                            unsigned long first_pfn,
+                            unsigned long begin_pfn,
                             unsigned int nr_frames,
                             XEN_GUEST_HANDLE(void) guest_dirty_bitmap);
 
diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index b929d15d0050..0d0d5292953b 100644
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -4566,7 +4566,7 @@ static int __do_update_va_mapping(
 }
 
 long do_update_va_mapping(
-    unsigned long va, u64 val64, unsigned long flags)
+    unsigned long va, uint64_t val64, unsigned long flags)
 {
     int rc = __do_update_va_mapping(va, val64, flags, current->domain);
 
@@ -4578,7 +4578,7 @@ long do_update_va_mapping(
 }
 
 long do_update_va_mapping_otherdomain(
-    unsigned long va, u64 val64, unsigned long flags, domid_t domid)
+    unsigned long va, uint64_t val64, unsigned long flags, domid_t domid)
 {
     struct domain *pg_owner;
     int rc;
diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index f2aee5be46a7..f9310d008de6 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -751,7 +751,7 @@ void shadow_promote(struct domain *d, mfn_t gmfn, unsigned int type)
     TRACE_SHADOW_PATH_FLAG(TRCE_SFLAG_PROMOTE);
 }
 
-void shadow_demote(struct domain *d, mfn_t gmfn, u32 type)
+void shadow_demote(struct domain *d, mfn_t gmfn, unsigned int type)
 {
     struct page_info *page = mfn_to_page(gmfn);
 
@@ -2615,11 +2615,11 @@ pagetable_t sh_set_toplevel_shadow(struct vcpu *v,
  * Helper invoked when releasing of a top-level shadow's reference was
  * deferred in sh_set_toplevel_shadow() above.
  */
-void shadow_put_top_level(struct domain *d, pagetable_t old_entry)
+void shadow_put_top_level(struct domain *d, pagetable_t old)
 {
-    ASSERT(!pagetable_is_null(old_entry));
+    ASSERT(!pagetable_is_null(old));
     paging_lock(d);
-    sh_put_ref(d, pagetable_get_mfn(old_entry), 0);
+    sh_put_ref(d, pagetable_get_mfn(old), 0);
     paging_unlock(d);
 }
 
diff --git a/xen/arch/x86/mm/shadow/multi.h b/xen/arch/x86/mm/shadow/multi.h
index 0e938594345a..fc86d7a8d9cd 100644
--- a/xen/arch/x86/mm/shadow/multi.h
+++ b/xen/arch/x86/mm/shadow/multi.h
@@ -89,11 +89,11 @@ SHADOW_INTERNAL_NAME(sh_paging_mode, GUEST_LEVELS);
 #if SHADOW_OPTIMIZATIONS & SHOPT_OUT_OF_SYNC
 extern void
 SHADOW_INTERNAL_NAME(sh_resync_l1, GUEST_LEVELS)
-     (struct vcpu *v, mfn_t gmfn, mfn_t snpmfn);
+     (struct vcpu *v, mfn_t gl1mfn, mfn_t snpmfn);
 
 extern int
 SHADOW_INTERNAL_NAME(sh_safe_not_to_sync, GUEST_LEVELS)
-     (struct vcpu*v, mfn_t gmfn);
+     (struct vcpu*v, mfn_t gl1mfn);
 
 extern int
 SHADOW_INTERNAL_NAME(sh_rm_write_access_from_sl1p, GUEST_LEVELS)
diff --git a/xen/arch/x86/mm/shadow/private.h b/xen/arch/x86/mm/shadow/private.h
index bc99e00100f7..12cfb52f095b 100644
--- a/xen/arch/x86/mm/shadow/private.h
+++ b/xen/arch/x86/mm/shadow/private.h
@@ -364,11 +364,11 @@ bool  shadow_hash_delete(struct domain *d,
                          unsigned long n, unsigned int t, mfn_t smfn);
 
 /* shadow promotion */
-void shadow_promote(struct domain *d, mfn_t gmfn, u32 type);
-void shadow_demote(struct domain *d, mfn_t gmfn, u32 type);
+void shadow_promote(struct domain *d, mfn_t gmfn, unsigned int type);
+void shadow_demote(struct domain *d, mfn_t gmfn, unsigned int type);
 
 /* Shadow page allocation functions */
-bool __must_check shadow_prealloc(struct domain *d, unsigned int shadow_type,
+bool __must_check shadow_prealloc(struct domain *d, unsigned int type,
                                   unsigned int count);
 mfn_t shadow_alloc(struct domain *d,
                     u32 shadow_type,
@@ -392,11 +392,11 @@ int sh_validate_guest_entry(struct vcpu *v, mfn_t gmfn, void *entry, u32 size);
  * Returns non-zero if we need to flush TLBs.
  * level and fault_addr desribe how we found this to be a pagetable;
  * level==0 means we have some other reason for revoking write access. */
-extern int sh_remove_write_access(struct domain *d, mfn_t readonly_mfn,
+extern int sh_remove_write_access(struct domain *d, mfn_t gmfn,
                                   unsigned int level,
                                   unsigned long fault_addr);
 #else
-static inline int sh_remove_write_access(struct domain *d, mfn_t readonly_mfn,
+static inline int sh_remove_write_access(struct domain *d, mfn_t gmfn,
                                          unsigned int level,
                                          unsigned long fault_addr)
 {
diff --git a/xen/common/kimage.c b/xen/common/kimage.c
index 9961eac187e9..e1aec5a18a54 100644
--- a/xen/common/kimage.c
+++ b/xen/common/kimage.c
@@ -66,7 +66,7 @@
 static int kimage_is_destination_range(struct kexec_image *image,
                                        paddr_t start, paddr_t end);
 static struct page_info *kimage_alloc_page(struct kexec_image *image,
-                                           paddr_t dest);
+                                           paddr_t destination);
 
 static struct page_info *kimage_alloc_zeroed_page(unsigned memflags)
 {
diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c
index d0da2aa28132..7446533c8cfb 100644
--- a/xen/common/livepatch.c
+++ b/xen/common/livepatch.c
@@ -107,7 +107,7 @@ static int verify_payload(const struct xen_sysctl_livepatch_upload *upload, char
     return 0;
 }
 
-bool is_patch(const void *ptr)
+bool is_patch(const void *addr)
 {
     const struct payload *data;
     bool r = false;
@@ -115,12 +115,12 @@ bool is_patch(const void *ptr)
     rcu_read_lock(&rcu_payload_lock);
     list_for_each_entry_rcu ( data, &payload_list, list )
     {
-        if ( (ptr >= data->rw_addr &&
-              ptr < (data->rw_addr + data->rw_size)) ||
-             (ptr >= data->ro_addr &&
-              ptr < (data->ro_addr + data->ro_size)) ||
-             (ptr >= data->text_addr &&
-              ptr < (data->text_addr + data->text_size)) )
+        if ( (addr >= data->rw_addr &&
+              addr < (data->rw_addr + data->rw_size)) ||
+             (addr >= data->ro_addr &&
+              addr < (data->ro_addr + data->ro_size)) ||
+             (addr >= data->text_addr &&
+              addr < (data->text_addr + data->text_size)) )
         {
             r = 1;
             break;
diff --git a/xen/include/xen/livepatch.h b/xen/include/xen/livepatch.h
index 3f5ad01f1bdd..45c8924f3412 100644
--- a/xen/include/xen/livepatch.h
+++ b/xen/include/xen/livepatch.h
@@ -89,7 +89,7 @@ enum va_type {
  * Function to secure the allocate pages (from arch_livepatch_alloc_payload)
  * with the right page permissions.
  */
-int arch_livepatch_secure(const void *va, unsigned int pages, enum va_type types);
+int arch_livepatch_secure(const void *va, unsigned int pages, enum va_type type);
 
 void arch_livepatch_init(void);
 
-- 
2.39.5

Re: [PATCH 3/5] x86: Address MIRSA R8.3 (declaration/definition mismatch) issues

[Nicola Vetrini]

s/MIRSA/MISRA/ in the subject, here and in patch 4

On 2025-12-12 23:20, Andrew Cooper wrote:
> These are mostly name mismatches, but a couple have type alias 
> mismatches too.
> 
> For shadow_put_top_level() and is_patch(), the declaration name is the 
> better
> choice so change the name in the function.
> 
> No functional change.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: consulting@bugseng.com <consulting@bugseng.com>
> CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
> ---
>  xen/arch/x86/include/asm/hypercall.h |  4 ++--
>  xen/arch/x86/include/asm/pv/mm.h     |  4 ++--
>  xen/arch/x86/include/asm/shadow.h    |  2 +-
>  xen/arch/x86/mm.c                    |  4 ++--
>  xen/arch/x86/mm/shadow/common.c      |  8 ++++----
>  xen/arch/x86/mm/shadow/multi.h       |  4 ++--
>  xen/arch/x86/mm/shadow/private.h     | 10 +++++-----
>  xen/common/kimage.c                  |  2 +-
>  xen/common/livepatch.c               | 14 +++++++-------
>  xen/include/xen/livepatch.h          |  2 +-
>  10 files changed, 27 insertions(+), 27 deletions(-)
> 
> diff --git a/xen/arch/x86/include/asm/hypercall.h 
> b/xen/arch/x86/include/asm/hypercall.h
> index f6e9e2313b3c..bf2f0e169aef 100644
> --- a/xen/arch/x86/include/asm/hypercall.h
> +++ b/xen/arch/x86/include/asm/hypercall.h
> @@ -22,8 +22,8 @@
>  void pv_hypercall(struct cpu_user_regs *regs);
>  #endif
> 
> -void pv_ring1_init_hypercall_page(void *ptr);
> -void pv_ring3_init_hypercall_page(void *ptr);
> +void pv_ring1_init_hypercall_page(void *p);
> +void pv_ring3_init_hypercall_page(void *p);
> 
>  /*
>   * Both do_mmuext_op() and do_mmu_update():
> diff --git a/xen/arch/x86/include/asm/pv/mm.h 
> b/xen/arch/x86/include/asm/pv/mm.h
> index 182764542c1f..a5745908206a 100644
> --- a/xen/arch/x86/include/asm/pv/mm.h
> +++ b/xen/arch/x86/include/asm/pv/mm.h
> @@ -18,7 +18,7 @@ int pv_set_gdt(struct vcpu *v, const unsigned long 
> frames[],
>                 unsigned int entries);
>  void pv_destroy_gdt(struct vcpu *v);
> 
> -bool pv_map_ldt_shadow_page(unsigned int off);
> +bool pv_map_ldt_shadow_page(unsigned int offset);
>  bool pv_destroy_ldt(struct vcpu *v);
> 
>  int validate_segdesc_page(struct page_info *page);
> @@ -40,7 +40,7 @@ static inline int pv_set_gdt(struct vcpu *v, const 
> unsigned long frames[],
>  { ASSERT_UNREACHABLE(); return -EINVAL; }
>  static inline void pv_destroy_gdt(struct vcpu *v) { 
> ASSERT_UNREACHABLE(); }
> 
> -static inline bool pv_map_ldt_shadow_page(unsigned int off) { return 
> false; }
> +static inline bool pv_map_ldt_shadow_page(unsigned int offset) { 
> return false; }
>  static inline bool pv_destroy_ldt(struct vcpu *v)
>  { ASSERT_UNREACHABLE(); return false; }
> 
> diff --git a/xen/arch/x86/include/asm/shadow.h 
> b/xen/arch/x86/include/asm/shadow.h
> index 9a8d1b8353cd..60589c3cacee 100644
> --- a/xen/arch/x86/include/asm/shadow.h
> +++ b/xen/arch/x86/include/asm/shadow.h
> @@ -63,7 +63,7 @@ int shadow_enable(struct domain *d, u32 mode);
> 
>  /* Enable VRAM dirty bit tracking. */
>  int shadow_track_dirty_vram(struct domain *d,
> -                            unsigned long first_pfn,
> +                            unsigned long begin_pfn,
>                              unsigned int nr_frames,
>                              XEN_GUEST_HANDLE(void) 
> guest_dirty_bitmap);
> 
> diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
> index b929d15d0050..0d0d5292953b 100644
> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -4566,7 +4566,7 @@ static int __do_update_va_mapping(
>  }
> 
>  long do_update_va_mapping(
> -    unsigned long va, u64 val64, unsigned long flags)
> +    unsigned long va, uint64_t val64, unsigned long flags)
>  {
>      int rc = __do_update_va_mapping(va, val64, flags, 
> current->domain);
> 
> @@ -4578,7 +4578,7 @@ long do_update_va_mapping(
>  }
> 
>  long do_update_va_mapping_otherdomain(
> -    unsigned long va, u64 val64, unsigned long flags, domid_t domid)
> +    unsigned long va, uint64_t val64, unsigned long flags, domid_t 
> domid)
>  {
>      struct domain *pg_owner;
>      int rc;
> diff --git a/xen/arch/x86/mm/shadow/common.c 
> b/xen/arch/x86/mm/shadow/common.c
> index f2aee5be46a7..f9310d008de6 100644
> --- a/xen/arch/x86/mm/shadow/common.c
> +++ b/xen/arch/x86/mm/shadow/common.c
> @@ -751,7 +751,7 @@ void shadow_promote(struct domain *d, mfn_t gmfn, 
> unsigned int type)
>      TRACE_SHADOW_PATH_FLAG(TRCE_SFLAG_PROMOTE);
>  }
> 
> -void shadow_demote(struct domain *d, mfn_t gmfn, u32 type)
> +void shadow_demote(struct domain *d, mfn_t gmfn, unsigned int type)
>  {
>      struct page_info *page = mfn_to_page(gmfn);
> 
> @@ -2615,11 +2615,11 @@ pagetable_t sh_set_toplevel_shadow(struct vcpu 
> *v,
>   * Helper invoked when releasing of a top-level shadow's reference was
>   * deferred in sh_set_toplevel_shadow() above.
>   */
> -void shadow_put_top_level(struct domain *d, pagetable_t old_entry)
> +void shadow_put_top_level(struct domain *d, pagetable_t old)
>  {
> -    ASSERT(!pagetable_is_null(old_entry));
> +    ASSERT(!pagetable_is_null(old));
>      paging_lock(d);
> -    sh_put_ref(d, pagetable_get_mfn(old_entry), 0);
> +    sh_put_ref(d, pagetable_get_mfn(old), 0);
>      paging_unlock(d);
>  }
> 
> diff --git a/xen/arch/x86/mm/shadow/multi.h 
> b/xen/arch/x86/mm/shadow/multi.h
> index 0e938594345a..fc86d7a8d9cd 100644
> --- a/xen/arch/x86/mm/shadow/multi.h
> +++ b/xen/arch/x86/mm/shadow/multi.h
> @@ -89,11 +89,11 @@ SHADOW_INTERNAL_NAME(sh_paging_mode, GUEST_LEVELS);
>  #if SHADOW_OPTIMIZATIONS & SHOPT_OUT_OF_SYNC
>  extern void
>  SHADOW_INTERNAL_NAME(sh_resync_l1, GUEST_LEVELS)
> -     (struct vcpu *v, mfn_t gmfn, mfn_t snpmfn);
> +     (struct vcpu *v, mfn_t gl1mfn, mfn_t snpmfn);
> 
>  extern int
>  SHADOW_INTERNAL_NAME(sh_safe_not_to_sync, GUEST_LEVELS)
> -     (struct vcpu*v, mfn_t gmfn);
> +     (struct vcpu*v, mfn_t gl1mfn);
> 
>  extern int
>  SHADOW_INTERNAL_NAME(sh_rm_write_access_from_sl1p, GUEST_LEVELS)
> diff --git a/xen/arch/x86/mm/shadow/private.h 
> b/xen/arch/x86/mm/shadow/private.h
> index bc99e00100f7..12cfb52f095b 100644
> --- a/xen/arch/x86/mm/shadow/private.h
> +++ b/xen/arch/x86/mm/shadow/private.h
> @@ -364,11 +364,11 @@ bool  shadow_hash_delete(struct domain *d,
>                           unsigned long n, unsigned int t, mfn_t smfn);
> 
>  /* shadow promotion */
> -void shadow_promote(struct domain *d, mfn_t gmfn, u32 type);
> -void shadow_demote(struct domain *d, mfn_t gmfn, u32 type);
> +void shadow_promote(struct domain *d, mfn_t gmfn, unsigned int type);
> +void shadow_demote(struct domain *d, mfn_t gmfn, unsigned int type);
> 
>  /* Shadow page allocation functions */
> -bool __must_check shadow_prealloc(struct domain *d, unsigned int 
> shadow_type,
> +bool __must_check shadow_prealloc(struct domain *d, unsigned int type,
>                                    unsigned int count);
>  mfn_t shadow_alloc(struct domain *d,
>                      u32 shadow_type,
> @@ -392,11 +392,11 @@ int sh_validate_guest_entry(struct vcpu *v, mfn_t 
> gmfn, void *entry, u32 size);
>   * Returns non-zero if we need to flush TLBs.
>   * level and fault_addr desribe how we found this to be a pagetable;
>   * level==0 means we have some other reason for revoking write access. 
> */
> -extern int sh_remove_write_access(struct domain *d, mfn_t 
> readonly_mfn,
> +extern int sh_remove_write_access(struct domain *d, mfn_t gmfn,
>                                    unsigned int level,
>                                    unsigned long fault_addr);
>  #else
> -static inline int sh_remove_write_access(struct domain *d, mfn_t 
> readonly_mfn,
> +static inline int sh_remove_write_access(struct domain *d, mfn_t gmfn,
>                                           unsigned int level,
>                                           unsigned long fault_addr)
>  {
> diff --git a/xen/common/kimage.c b/xen/common/kimage.c
> index 9961eac187e9..e1aec5a18a54 100644
> --- a/xen/common/kimage.c
> +++ b/xen/common/kimage.c
> @@ -66,7 +66,7 @@
>  static int kimage_is_destination_range(struct kexec_image *image,
>                                         paddr_t start, paddr_t end);
>  static struct page_info *kimage_alloc_page(struct kexec_image *image,
> -                                           paddr_t dest);
> +                                           paddr_t destination);
> 
>  static struct page_info *kimage_alloc_zeroed_page(unsigned memflags)
>  {
> diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c
> index d0da2aa28132..7446533c8cfb 100644
> --- a/xen/common/livepatch.c
> +++ b/xen/common/livepatch.c
> @@ -107,7 +107,7 @@ static int verify_payload(const struct 
> xen_sysctl_livepatch_upload *upload, char
>      return 0;
>  }
> 
> -bool is_patch(const void *ptr)
> +bool is_patch(const void *addr)
>  {
>      const struct payload *data;
>      bool r = false;
> @@ -115,12 +115,12 @@ bool is_patch(const void *ptr)
>      rcu_read_lock(&rcu_payload_lock);
>      list_for_each_entry_rcu ( data, &payload_list, list )
>      {
> -        if ( (ptr >= data->rw_addr &&
> -              ptr < (data->rw_addr + data->rw_size)) ||
> -             (ptr >= data->ro_addr &&
> -              ptr < (data->ro_addr + data->ro_size)) ||
> -             (ptr >= data->text_addr &&
> -              ptr < (data->text_addr + data->text_size)) )
> +        if ( (addr >= data->rw_addr &&
> +              addr < (data->rw_addr + data->rw_size)) ||
> +             (addr >= data->ro_addr &&
> +              addr < (data->ro_addr + data->ro_size)) ||
> +             (addr >= data->text_addr &&
> +              addr < (data->text_addr + data->text_size)) )
>          {
>              r = 1;
>              break;
> diff --git a/xen/include/xen/livepatch.h b/xen/include/xen/livepatch.h
> index 3f5ad01f1bdd..45c8924f3412 100644
> --- a/xen/include/xen/livepatch.h
> +++ b/xen/include/xen/livepatch.h
> @@ -89,7 +89,7 @@ enum va_type {
>   * Function to secure the allocate pages (from 
> arch_livepatch_alloc_payload)
>   * with the right page permissions.
>   */
> -int arch_livepatch_secure(const void *va, unsigned int pages, enum 
> va_type types);
> +int arch_livepatch_secure(const void *va, unsigned int pages, enum 
> va_type type);
> 
>  void arch_livepatch_init(void);

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

[PATCH 4/5] x86: Address MIRSA R8.4 (declaration visibility) issues

[Andrew Cooper]

set_guest_*_trapbounce() are only called from assembly so gain asmlinkage to
identify them.

xen_msr_s_cet_value() is called by assembly and C, so asmlinkage isn't
appropriate.  Make the declaration unconditional, which silences the
complaint.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
---
 xen/arch/x86/pv/traps.c | 4 ++--
 xen/arch/x86/setup.c    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/xen/arch/x86/pv/traps.c b/xen/arch/x86/pv/traps.c
index c3c0976c440f..26a468108a77 100644
--- a/xen/arch/x86/pv/traps.c
+++ b/xen/arch/x86/pv/traps.c
@@ -99,7 +99,7 @@ void pv_inject_event(const struct x86_event *event)
  * Called from asm to set up the MCE trapbounce info.
  * Returns false no callback is set up, else true.
  */
-bool set_guest_machinecheck_trapbounce(void)
+bool asmlinkage set_guest_machinecheck_trapbounce(void)
 {
     struct vcpu *curr = current;
     struct trap_bounce *tb = &curr->arch.pv.trap_bounce;
@@ -114,7 +114,7 @@ bool set_guest_machinecheck_trapbounce(void)
  * Called from asm to set up the NMI trapbounce info.
  * Returns false if no callback is set up, else true.
  */
-bool set_guest_nmi_trapbounce(void)
+bool asmlinkage set_guest_nmi_trapbounce(void)
 {
     struct vcpu *curr = current;
     struct trap_bounce *tb = &curr->arch.pv.trap_bounce;
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 44da5efa1d20..27c63d1d97c9 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -877,6 +877,8 @@ static void noreturn init_done(void)
     startup_cpu_idle_loop();
 }
 
+unsigned int xen_msr_s_cet_value(void); /* To avoid ifdefary, and placate MISRA */
+
 #if defined(CONFIG_XEN_SHSTK) || defined(CONFIG_XEN_IBT)
 /*
  * Used by AP and S3 asm code to calcualte the appropriate MSR_S_CET setting.
@@ -888,8 +890,6 @@ unsigned int xen_msr_s_cet_value(void)
     return ((cpu_has_xen_shstk ? CET_SHSTK_EN | CET_WRSS_EN : 0) |
             (cpu_has_xen_ibt   ? CET_ENDBR_EN : 0));
 }
-#else
-unsigned int xen_msr_s_cet_value(void); /* To avoid ifdefary */
 #endif
 
 /* Reinitalise all state referring to the old virtual address of the stack. */
-- 
2.39.5

[PATCH RFC 5/5] x86/shadow: Deviate multi.h as being included multiple times

[Andrew Cooper]

This resolves the Eclair complaint about a MISRA D4.10 violation.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Roger Pau Monné <roger.pau@citrix.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: consulting@bugseng.com <consulting@bugseng.com>
CC: Nicola Vetrini <nicola.vetrini@bugseng.com>

RFC - this doesn't actually squash the violation, despite being the requisite
magic string.  I suspect the Eclair config needs tweaking to allow the magic
anchor string to be after the SDPX tag.
---
 xen/arch/x86/mm/shadow/multi.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/arch/x86/mm/shadow/multi.h b/xen/arch/x86/mm/shadow/multi.h
index fc86d7a8d9cd..b4a6cf1362a6 100644
--- a/xen/arch/x86/mm/shadow/multi.h
+++ b/xen/arch/x86/mm/shadow/multi.h
@@ -2,6 +2,8 @@
 /******************************************************************************
  * arch/x86/mm/shadow/multi.h
  *
+ * This file is intended to be included multiple times.
+ *
  * Shadow declarations which will be multiply compiled.
  * Parts of this code are Copyright (c) 2006 by XenSource Inc.
  * Parts of this code are Copyright (c) 2006 by Michael A Fetterman
-- 
2.39.5

Re: [PATCH RFC 5/5] x86/shadow: Deviate multi.h as being included multiple times

[Nicola Vetrini]

On 2025-12-12 23:20, Andrew Cooper wrote:
> This resolves the Eclair complaint about a MISRA D4.10 violation.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Roger Pau Monné <roger.pau@citrix.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: consulting@bugseng.com <consulting@bugseng.com>
> CC: Nicola Vetrini <nicola.vetrini@bugseng.com>
> 
> RFC - this doesn't actually squash the violation, despite being the 
> requisite
> magic string.  I suspect the Eclair config needs tweaking to allow the 
> magic
> anchor string to be after the SDPX tag.
> ---

I think it's just a matter of positioning. The location of the violation 
is at line 11 (the first non-comment statement of the file, and the 
string is matched in a range of -4 lines from that point:

-config=MC3A2.D4.10,reports+={safe, "first_area(text(^/\\* This file is 
intended to be included multiple times\\. \\*/$, begin-4))"}

so I think moving it just below the copyright lines or increasing the 
range should do the trick.

>  xen/arch/x86/mm/shadow/multi.h | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/xen/arch/x86/mm/shadow/multi.h 
> b/xen/arch/x86/mm/shadow/multi.h
> index fc86d7a8d9cd..b4a6cf1362a6 100644
> --- a/xen/arch/x86/mm/shadow/multi.h
> +++ b/xen/arch/x86/mm/shadow/multi.h
> @@ -2,6 +2,8 @@
>  
> /******************************************************************************
>   * arch/x86/mm/shadow/multi.h
>   *
> + * This file is intended to be included multiple times.
> + *
>   * Shadow declarations which will be multiply compiled.
>   * Parts of this code are Copyright (c) 2006 by XenSource Inc.
>   * Parts of this code are Copyright (c) 2006 by Michael A Fetterman

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

Re: [PATCH 0/5] x86: More misc MISRA fixes

[Jan Beulich]

On 12.12.2025 23:20, Andrew Cooper wrote:
> Andrew Cooper (5):
>   x86/pv: Address MISRA C:2012 Rule 4.1
>   x86/pv: Change type of do_update_descriptor()'s desc parameter
>   x86: Address MIRSA R8.3 (declaration/definition mismatch) issues
>   x86: Address MIRSA R8.4 (declaration visibility) issues

Acked-by: Jan Beulich <jbeulich@suse.com>
(with the title typos taken care of, preferably)

Jan