[PATCH 0/2] Fix and add warning of misuse of type##_replace_bits()

[PATCH 0/2] Fix and add warning of misuse of type##_replace_bits()

[Ben Horgan]

By inspection there is one mistake in the use of u64_replace_bits(). Fix
this and while I'm here add a __must_check annotation to help avoid the
same mistake happening again.

Ben Horgan (2):
  KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN
  bitfield: Ensure the return value of type##_replace_bits() is checked

 arch/arm64/kvm/sys_regs.c | 2 +-
 include/linux/bitfield.h  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.43.0

[PATCH 1/2] KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN

[Ben Horgan]

Previously, u64_replace_bits() was used to no effect as the return value
was ignored. Convert to u64p_replace_bits() so the value is updated in
place.

Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Fixes: efff9dd2fee7 ("KVM: arm64: Handle out-of-bound write to MDCR_EL2.HPMN")
Cc: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
---
 arch/arm64/kvm/sys_regs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 76c2f0da821f..c20bd6f21e60 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -2624,7 +2624,7 @@ static bool access_mdcr(struct kvm_vcpu *vcpu,
 	 */
 	if (hpmn > vcpu->kvm->arch.nr_pmu_counters) {
 		hpmn = vcpu->kvm->arch.nr_pmu_counters;
-		u64_replace_bits(val, hpmn, MDCR_EL2_HPMN);
+		u64p_replace_bits(&val, hpmn, MDCR_EL2_HPMN);
 	}
 
 	__vcpu_assign_sys_reg(vcpu, MDCR_EL2, val);
-- 
2.43.0

[PATCH 2/2] bitfield: Ensure the return value of type##_replace_bits() is checked

[Ben Horgan]

As type##_replace_bits() has no side effects it is only useful if its
return value is checked. Add __must_check to enforce this usage. To have
the bits replaced in-place typep##_replace_bits() can be used instead.

Signed-off-by: Ben Horgan <ben.horgan@arm.com>
---
 include/linux/bitfield.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 6d9a53db54b6..39333b80d22b 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -195,8 +195,8 @@ static __always_inline __##type type##_encode_bits(base v, base field)	\
 		__field_overflow();					\
 	return to((v & field_mask(field)) * field_multiplier(field));	\
 }									\
-static __always_inline __##type type##_replace_bits(__##type old,	\
-					base val, base field)		\
+static __always_inline __##type __must_check type##_replace_bits(__##type old,	\
+							base val, base field)	\
 {									\
 	return (old & ~to(field)) | type##_encode_bits(val, field);	\
 }									\
-- 
2.43.0

Re: [PATCH 1/2] KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN

[Zenghui Yu]

On 2025/7/3 21:57, Ben Horgan wrote:
> Previously, u64_replace_bits() was used to no effect as the return value
> was ignored. Convert to u64p_replace_bits() so the value is updated in
> place.
> 
> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
> Fixes: efff9dd2fee7 ("KVM: arm64: Handle out-of-bound write to MDCR_EL2.HPMN")
> Cc: Marc Zyngier <maz@kernel.org>
> Cc: stable@vger.kernel.org
> ---
>  arch/arm64/kvm/sys_regs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 76c2f0da821f..c20bd6f21e60 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -2624,7 +2624,7 @@ static bool access_mdcr(struct kvm_vcpu *vcpu,
>  	 */
>  	if (hpmn > vcpu->kvm->arch.nr_pmu_counters) {
>  		hpmn = vcpu->kvm->arch.nr_pmu_counters;
> -		u64_replace_bits(val, hpmn, MDCR_EL2_HPMN);
> +		u64p_replace_bits(&val, hpmn, MDCR_EL2_HPMN);
>  	}
>  
>  	__vcpu_assign_sys_reg(vcpu, MDCR_EL2, val);

Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>

Thanks!

Re: [PATCH 2/2] bitfield: Ensure the return value of type##_replace_bits() is checked

[Yury Norov]

Hi Ben,

On Thu, Jul 03, 2025 at 02:57:29PM +0100, Ben Horgan wrote:
> As type##_replace_bits() has no side effects it is only useful if its
> return value is checked. Add __must_check to enforce this usage. To have
> the bits replaced in-place typep##_replace_bits() can be used instead.
> 
> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
> ---
>  include/linux/bitfield.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> index 6d9a53db54b6..39333b80d22b 100644
> --- a/include/linux/bitfield.h
> +++ b/include/linux/bitfield.h
> @@ -195,8 +195,8 @@ static __always_inline __##type type##_encode_bits(base v, base field)	\
>  		__field_overflow();					\
>  	return to((v & field_mask(field)) * field_multiplier(field));	\
>  }									\
> -static __always_inline __##type type##_replace_bits(__##type old,	\
> -					base val, base field)		\
> +static __always_inline __##type __must_check type##_replace_bits(__##type old,	\
> +							base val, base field)	\
>  {									\
>  	return (old & ~to(field)) | type##_encode_bits(val, field);	\
>  }									\

So, would it make sense to mark _encode_bits() and _get_bits() as
__must_check as well? At least from the point of unification, it
would.

How would we move this - with my bitmap-for next or with arm branch?

Thanks,
Yury

Re: [PATCH 2/2] bitfield: Ensure the return value of type##_replace_bits() is checked

[Ben Horgan]

Hi Yury,

On 7/7/25 17:31, Yury Norov wrote:
> Hi Ben,
> 
> On Thu, Jul 03, 2025 at 02:57:29PM +0100, Ben Horgan wrote:
>> As type##_replace_bits() has no side effects it is only useful if its
>> return value is checked. Add __must_check to enforce this usage. To have
>> the bits replaced in-place typep##_replace_bits() can be used instead.
>>
>> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
>> ---
>>   include/linux/bitfield.h | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
>> index 6d9a53db54b6..39333b80d22b 100644
>> --- a/include/linux/bitfield.h
>> +++ b/include/linux/bitfield.h
>> @@ -195,8 +195,8 @@ static __always_inline __##type type##_encode_bits(base v, base field)	\
>>   		__field_overflow();					\
>>   	return to((v & field_mask(field)) * field_multiplier(field));	\
>>   }									\
>> -static __always_inline __##type type##_replace_bits(__##type old,	\
>> -					base val, base field)		\
>> +static __always_inline __##type __must_check type##_replace_bits(__##type old,	\
>> +							base val, base field)	\
>>   {									\
>>   	return (old & ~to(field)) | type##_encode_bits(val, field);	\
>>   }									\
> 
> So, would it make sense to mark _encode_bits() and _get_bits() as
> __must_check as well? At least from the point of unification, it
> would.
Could do. It seems less important as there are no obvious foot-guns that 
these would guards against. Would you like me to add this in a v2?
> 
> How would we move this - with my bitmap-for next or with arm branch?

I'm not familiar with the branch machinery so can't comment on this.
> 
> Thanks,
> Yury
> 

Thanks,

Ben

Re: [PATCH 2/2] bitfield: Ensure the return value of type##_replace_bits() is checked

[Marc Zyngier]

On Tue, 08 Jul 2025 10:42:06 +0100,
Ben Horgan <ben.horgan@arm.com> wrote:
> 
> Hi Yury,
> 
> On 7/7/25 17:31, Yury Norov wrote:
> > Hi Ben,
> > 
> > On Thu, Jul 03, 2025 at 02:57:29PM +0100, Ben Horgan wrote:
> >> As type##_replace_bits() has no side effects it is only useful if its
> >> return value is checked. Add __must_check to enforce this usage. To have
> >> the bits replaced in-place typep##_replace_bits() can be used instead.
> >> 
> >> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
> >> ---
> >>   include/linux/bitfield.h | 4 ++--
> >>   1 file changed, 2 insertions(+), 2 deletions(-)
> >> 
> >> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> >> index 6d9a53db54b6..39333b80d22b 100644
> >> --- a/include/linux/bitfield.h
> >> +++ b/include/linux/bitfield.h
> >> @@ -195,8 +195,8 @@ static __always_inline __##type type##_encode_bits(base v, base field)	\
> >>   		__field_overflow();					\
> >>   	return to((v & field_mask(field)) * field_multiplier(field));	\
> >>   }									\
> >> -static __always_inline __##type type##_replace_bits(__##type old,	\
> >> -					base val, base field)		\
> >> +static __always_inline __##type __must_check type##_replace_bits(__##type old,	\
> >> +							base val, base field)	\
> >>   {									\
> >>   	return (old & ~to(field)) | type##_encode_bits(val, field);	\
> >>   }									\
> > 
> > So, would it make sense to mark _encode_bits() and _get_bits() as
> > __must_check as well? At least from the point of unification, it
> > would.
> Could do. It seems less important as there are no obvious foot-guns
> that these would guards against. Would you like me to add this in a
> v2?
> > 
> > How would we move this - with my bitmap-for next or with arm branch?
> 
> I'm not familiar with the branch machinery so can't comment on this.

The first patch will definitely go in via the KVM/arm64 tree, probably
as a fix for 6.16.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH 2/2] bitfield: Ensure the return value of type##_replace_bits() is checked

[Yury Norov]

On Tue, Jul 08, 2025 at 10:45:50AM +0100, Marc Zyngier wrote:
> On Tue, 08 Jul 2025 10:42:06 +0100,
> Ben Horgan <ben.horgan@arm.com> wrote:
> > 
> > Hi Yury,
> > 
> > On 7/7/25 17:31, Yury Norov wrote:
> > > Hi Ben,
> > > 
> > > On Thu, Jul 03, 2025 at 02:57:29PM +0100, Ben Horgan wrote:
> > >> As type##_replace_bits() has no side effects it is only useful if its
> > >> return value is checked. Add __must_check to enforce this usage. To have
> > >> the bits replaced in-place typep##_replace_bits() can be used instead.
> > >> 
> > >> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
> > >> ---
> > >>   include/linux/bitfield.h | 4 ++--
> > >>   1 file changed, 2 insertions(+), 2 deletions(-)
> > >> 
> > >> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> > >> index 6d9a53db54b6..39333b80d22b 100644
> > >> --- a/include/linux/bitfield.h
> > >> +++ b/include/linux/bitfield.h
> > >> @@ -195,8 +195,8 @@ static __always_inline __##type type##_encode_bits(base v, base field)	\
> > >>   		__field_overflow();					\
> > >>   	return to((v & field_mask(field)) * field_multiplier(field));	\
> > >>   }									\
> > >> -static __always_inline __##type type##_replace_bits(__##type old,	\
> > >> -					base val, base field)		\
> > >> +static __always_inline __##type __must_check type##_replace_bits(__##type old,	\
> > >> +							base val, base field)	\
> > >>   {									\
> > >>   	return (old & ~to(field)) | type##_encode_bits(val, field);	\
> > >>   }									\
> > > 
> > > So, would it make sense to mark _encode_bits() and _get_bits() as
> > > __must_check as well? At least from the point of unification, it
> > > would.
> > Could do. It seems less important as there are no obvious foot-guns
> > that these would guards against. Would you like me to add this in a
> > v2?

Yes please.
 
> > > How would we move this - with my bitmap-for next or with arm branch?
> > 
> > I'm not familiar with the branch machinery so can't comment on this.
> 
> The first patch will definitely go in via the KVM/arm64 tree, probably
> as a fix for 6.16.

OK. Then I'll take patch #2 v2 by myself.

Thanks,
Yury