[PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Jan Beulich]

... ("Conversions shall not be performed between a pointer to an
incomplete type and any other type"): Add an intermediate cat to void *.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/14351897188
(covering more than just this)

--- a/xen/arch/x86/cpu/mcheck/mce.c
+++ b/xen/arch/x86/cpu/mcheck/mce.c
@@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
 
 #if BITS_PER_LONG == 64
 
-#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
+#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))
 #define COOKIE2ID(c) ((uint64_t)(c))
 
 #elif defined(BITS_PER_LONG)

Re: [PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Andrew Cooper]

On 13/05/2026 3:03 pm, Jan Beulich wrote:
> ... ("Conversions shall not be performed between a pointer to an
> incomplete type and any other type"): Add an intermediate cat to void *.

cast

> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> ---
> https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/14351897188
> (covering more than just this)
>
> --- a/xen/arch/x86/cpu/mcheck/mce.c
> +++ b/xen/arch/x86/cpu/mcheck/mce.c
> @@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
>  
>  #if BITS_PER_LONG == 64
>  
> -#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
> +#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))

The interface here is horrible, because we're passing a pointer to a
uint64_t to userspace and back.

But, can't we just cast through unsigned long instead?  The compiler is
happy, and that feels safer than using a pointer type.

~Andrew

Re: [PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Jan Beulich]

On 13.05.2026 19:00, Andrew Cooper wrote:
> On 13/05/2026 3:03 pm, Jan Beulich wrote:
>> --- a/xen/arch/x86/cpu/mcheck/mce.c
>> +++ b/xen/arch/x86/cpu/mcheck/mce.c
>> @@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
>>  
>>  #if BITS_PER_LONG == 64
>>  
>> -#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
>> +#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))
> 
> The interface here is horrible, because we're passing a pointer to a
> uint64_t to userspace and back.

Indeed.

> But, can't we just cast through unsigned long instead?  The compiler is
> happy, and that feels safer than using a pointer type.
I can check if that also helps. Casting to void * let's us, aiui, get away
without leveraging any custom deviations that we have.

Jan

Re: [PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Nicola Vetrini]

On 2026-05-13 16:03, Jan Beulich wrote:
> ... ("Conversions shall not be performed between a pointer to an
> incomplete type and any other type"): Add an intermediate cat to void 
> *.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> ---
> https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/14351897188
> (covering more than just this)
> 
> --- a/xen/arch/x86/cpu/mcheck/mce.c
> +++ b/xen/arch/x86/cpu/mcheck/mce.c
> @@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
> 
>  #if BITS_PER_LONG == 64
> 
> -#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
> +#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))

Notwithstanding the comment from Andrew, I think a comment here could be 
nice to explain what it going on, otherwise the double cast looks quite 
odd.

Unrelated: why not contextually marking this rule as clean to prevent 
regressions?

>  #define COOKIE2ID(c) ((uint64_t)(c))
> 
>  #elif defined(BITS_PER_LONG)

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253

Re: [PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Jan Beulich]

On 13.05.2026 22:47, Nicola Vetrini wrote:
> On 2026-05-13 16:03, Jan Beulich wrote:
>> ... ("Conversions shall not be performed between a pointer to an
>> incomplete type and any other type"): Add an intermediate cat to void 
>> *.
>>
>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
>> ---
>> https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/14351897188
>> (covering more than just this)
>>
>> --- a/xen/arch/x86/cpu/mcheck/mce.c
>> +++ b/xen/arch/x86/cpu/mcheck/mce.c
>> @@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
>>
>>  #if BITS_PER_LONG == 64
>>
>> -#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
>> +#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))
> 
> Notwithstanding the comment from Andrew, I think a comment here could be 
> nice to explain what it going on, otherwise the double cast looks quite 
> odd.

I've added

/* Two layers of casting to cover Misra C:2012 rule 11.2. */

> Unrelated: why not contextually marking this rule as clean to prevent 
> regressions?

Isn't this rule (and the others my patches were targeting) marked as clean
already, hence why the allcode job fails?

Jan

Re: [PATCH] x86/MCE: adjust ID2COOKIE() for Misra C:2012 rule 11.2

[Nicola Vetrini]

On 2026-05-15 08:28, Jan Beulich wrote:
> On 13.05.2026 22:47, Nicola Vetrini wrote:
>> On 2026-05-13 16:03, Jan Beulich wrote:
>>> ... ("Conversions shall not be performed between a pointer to an
>>> incomplete type and any other type"): Add an intermediate cat to void
>>> *.
>>> 
>>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
>>> ---
>>> https://gitlab.com/xen-project/hardware/xen-staging/-/jobs/14351897188
>>> (covering more than just this)
>>> 
>>> --- a/xen/arch/x86/cpu/mcheck/mce.c
>>> +++ b/xen/arch/x86/cpu/mcheck/mce.c
>>> @@ -1264,7 +1264,7 @@ static void cf_check __maybe_unused x86_
>>> 
>>>  #if BITS_PER_LONG == 64
>>> 
>>> -#define ID2COOKIE(id) ((mctelem_cookie_t)(id))
>>> +#define ID2COOKIE(id) ((mctelem_cookie_t)(void *)(id))
>> 
>> Notwithstanding the comment from Andrew, I think a comment here could 
>> be
>> nice to explain what it going on, otherwise the double cast looks 
>> quite
>> odd.
> 
> I've added
> 
> /* Two layers of casting to cover Misra C:2012 rule 11.2. */
> 

Sounds good

>> Unrelated: why not contextually marking this rule as clean to prevent
>> regressions?
> 
> Isn't this rule (and the others my patches were targeting) marked as 
> clean
> already, hence why the allcode job fails?
> 

Oh, you are right, I didn't check.

-- 
Nicola Vetrini, B.Sc.
Software Engineer
BUGSENG (https://bugseng.com)
LinkedIn: https://www.linkedin.com/in/nicola-vetrini-a42471253