1. Patchew
  2. EDK2
  3. [edk2] [PATCH 0/6] Resolve undefined behaviours in left shift OPs
  4. View patch

[edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift

Hao Wu posted 6 patches 7 years, 3 months ago
There is a newer version of this series
[edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift
Posted by Hao Wu 7 years, 3 months ago 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=695

Within function CoreRestoreTpl(), left shift a negative value -2 is used
in:
"while (((-2 << NewTpl) & gEventPending) != 0) {"

which involves undefined behavior.

According to the C11 spec, Section 6.5.7:
> 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
>   bits are filled with zeros. If E1 has an unsigned type, the value
>   of the result is E1 * 2^E2 , reduced modulo one more than the
>   maximum value representable in the result type. If E1 has a signed
>   type and nonnegative value, and E1 * 2^E2 is representable in the
>   result type, then that is the resulting value; otherwise, the
>   behavior is undefined.

This commit explicitly cast '-2' with UINTN to resolve this issue.

Cc: Steven Shi <steven.shi@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
---
 MdeModulePkg/Core/Dxe/Event/Tpl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MdeModulePkg/Core/Dxe/Event/Tpl.c b/MdeModulePkg/Core/Dxe/Event/Tpl.c
index 8ad0a33701..8c50f61117 100644
--- a/MdeModulePkg/Core/Dxe/Event/Tpl.c
+++ b/MdeModulePkg/Core/Dxe/Event/Tpl.c
@@ -123,7 +123,7 @@ CoreRestoreTpl (
   //
   // Dispatch any pending events
   //
-  while (((-2 << NewTpl) & gEventPending) != 0) {
+  while (((((UINTN)-2) << NewTpl) & gEventPending) != 0) {
     gEfiCurrentTpl = (UINTN) HighBitSet64 (gEventPending);
     if (gEfiCurrentTpl < TPL_HIGH_LEVEL) {
       CoreSetInterruptState (TRUE);
-- 
2.12.0.windows.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift
Posted by Paolo Bonzini 7 years, 3 months ago 
On 19/09/2017 13:43, Hao Wu wrote:
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=695
> 
> Within function CoreRestoreTpl(), left shift a negative value -2 is used
> in:
> "while (((-2 << NewTpl) & gEventPending) != 0) {"
> 
> which involves undefined behavior.
> 
> According to the C11 spec, Section 6.5.7:
>> 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
>>   bits are filled with zeros. If E1 has an unsigned type, the value
>>   of the result is E1 * 2^E2 , reduced modulo one more than the
>>   maximum value representable in the result type. If E1 has a signed
>>   type and nonnegative value, and E1 * 2^E2 is representable in the
>>   result type, then that is the resulting value; otherwise, the
>>   behavior is undefined.
> 
> This commit explicitly cast '-2' with UINTN to resolve this issue.
> 
> Cc: Steven Shi <steven.shi@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Hao Wu <hao.a.wu@intel.com>
> ---
>  MdeModulePkg/Core/Dxe/Event/Tpl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Core/Dxe/Event/Tpl.c b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> index 8ad0a33701..8c50f61117 100644
> --- a/MdeModulePkg/Core/Dxe/Event/Tpl.c
> +++ b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> @@ -123,7 +123,7 @@ CoreRestoreTpl (
>    //
>    // Dispatch any pending events
>    //
> -  while (((-2 << NewTpl) & gEventPending) != 0) {
> +  while (((((UINTN)-2) << NewTpl) & gEventPending) != 0) {
>      gEfiCurrentTpl = (UINTN) HighBitSet64 (gEventPending);
>      if (gEfiCurrentTpl < TPL_HIGH_LEVEL) {
>        CoreSetInterruptState (TRUE);
> 

Maybe:

  for (;;) {
    PendingTpl = (UINTN) HighBitSet64 (gEventPending);
    if (NewTpl >= PendingTpl) {
      break;
    }
    gEfiCurrentTpl = PendingTpl;
  }

This is much more readable, and HighBitSet64 should be efficient on most
modern processors.

Paolo
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift
Posted by Zeng, Star 7 years, 3 months ago 
There is a case must be considered that gEventPending is 0, HighBitSet64 will return -1, then the code will be wrong.
The code maybe:

  while (gEventPending != 0) {
    PendingTpl = (UINTN) HighBitSet64 (gEventPending);
    if (NewTpl >= PendingTpl) {
      break;
    }
    gEfiCurrentTpl = PendingTpl;

    ...

  }


Thanks,
Star
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Paolo Bonzini
Sent: Wednesday, September 20, 2017 1:03 AM
To: Wu, Hao A <hao.a.wu@intel.com>; edk2-devel@lists.01.org
Cc: Dong, Eric <eric.dong@intel.com>; Zeng, Star <star.zeng@intel.com>
Subject: Re: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift

On 19/09/2017 13:43, Hao Wu wrote:
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=695
> 
> Within function CoreRestoreTpl(), left shift a negative value -2 is 
> used
> in:
> "while (((-2 << NewTpl) & gEventPending) != 0) {"
> 
> which involves undefined behavior.
> 
> According to the C11 spec, Section 6.5.7:
>> 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
>>   bits are filled with zeros. If E1 has an unsigned type, the value
>>   of the result is E1 * 2^E2 , reduced modulo one more than the
>>   maximum value representable in the result type. If E1 has a signed
>>   type and nonnegative value, and E1 * 2^E2 is representable in the
>>   result type, then that is the resulting value; otherwise, the
>>   behavior is undefined.
> 
> This commit explicitly cast '-2' with UINTN to resolve this issue.
> 
> Cc: Steven Shi <steven.shi@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Eric Dong <eric.dong@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Hao Wu <hao.a.wu@intel.com>
> ---
>  MdeModulePkg/Core/Dxe/Event/Tpl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Core/Dxe/Event/Tpl.c 
> b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> index 8ad0a33701..8c50f61117 100644
> --- a/MdeModulePkg/Core/Dxe/Event/Tpl.c
> +++ b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> @@ -123,7 +123,7 @@ CoreRestoreTpl (
>    //
>    // Dispatch any pending events
>    //
> -  while (((-2 << NewTpl) & gEventPending) != 0) {
> +  while (((((UINTN)-2) << NewTpl) & gEventPending) != 0) {
>      gEfiCurrentTpl = (UINTN) HighBitSet64 (gEventPending);
>      if (gEfiCurrentTpl < TPL_HIGH_LEVEL) {
>        CoreSetInterruptState (TRUE);
> 

Maybe:

  for (;;) {
    PendingTpl = (UINTN) HighBitSet64 (gEventPending);
    if (NewTpl >= PendingTpl) {
      break;
    }
    gEfiCurrentTpl = PendingTpl;
  }

This is much more readable, and HighBitSet64 should be efficient on most modern processors.

Paolo
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Re: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left shift
Posted by Wu, Hao A 7 years, 3 months ago 
Star and Paolo,

Thanks for the feedbacks. I will refine the patch according to your suggestions.


Best Regards,
Hao Wu


> -----Original Message-----
> From: Zeng, Star
> Sent: Thursday, September 21, 2017 10:57 AM
> To: Paolo Bonzini; Wu, Hao A; edk2-devel@lists.01.org
> Cc: Dong, Eric; Zeng, Star
> Subject: RE: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left
> shift
> 
> There is a case must be considered that gEventPending is 0, HighBitSet64 will
> return -1, then the code will be wrong.
> The code maybe:
> 
>   while (gEventPending != 0) {
>     PendingTpl = (UINTN) HighBitSet64 (gEventPending);
>     if (NewTpl >= PendingTpl) {
>       break;
>     }
>     gEfiCurrentTpl = PendingTpl;
> 
>     ...
> 
>   }
> 
> 
> Thanks,
> Star
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Paolo
> Bonzini
> Sent: Wednesday, September 20, 2017 1:03 AM
> To: Wu, Hao A <hao.a.wu@intel.com>; edk2-devel@lists.01.org
> Cc: Dong, Eric <eric.dong@intel.com>; Zeng, Star <star.zeng@intel.com>
> Subject: Re: [edk2] [PATCH 3/6] MdeModulePkg/Tpl: Fix negative value left
> shift
> 
> On 19/09/2017 13:43, Hao Wu wrote:
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=695
> >
> > Within function CoreRestoreTpl(), left shift a negative value -2 is
> > used
> > in:
> > "while (((-2 << NewTpl) & gEventPending) != 0) {"
> >
> > which involves undefined behavior.
> >
> > According to the C11 spec, Section 6.5.7:
> >> 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
> >>   bits are filled with zeros. If E1 has an unsigned type, the value
> >>   of the result is E1 * 2^E2 , reduced modulo one more than the
> >>   maximum value representable in the result type. If E1 has a signed
> >>   type and nonnegative value, and E1 * 2^E2 is representable in the
> >>   result type, then that is the resulting value; otherwise, the
> >>   behavior is undefined.
> >
> > This commit explicitly cast '-2' with UINTN to resolve this issue.
> >
> > Cc: Steven Shi <steven.shi@intel.com>
> > Cc: Star Zeng <star.zeng@intel.com>
> > Cc: Eric Dong <eric.dong@intel.com>
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Hao Wu <hao.a.wu@intel.com>
> > ---
> >  MdeModulePkg/Core/Dxe/Event/Tpl.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/MdeModulePkg/Core/Dxe/Event/Tpl.c
> > b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> > index 8ad0a33701..8c50f61117 100644
> > --- a/MdeModulePkg/Core/Dxe/Event/Tpl.c
> > +++ b/MdeModulePkg/Core/Dxe/Event/Tpl.c
> > @@ -123,7 +123,7 @@ CoreRestoreTpl (
> >    //
> >    // Dispatch any pending events
> >    //
> > -  while (((-2 << NewTpl) & gEventPending) != 0) {
> > +  while (((((UINTN)-2) << NewTpl) & gEventPending) != 0) {
> >      gEfiCurrentTpl = (UINTN) HighBitSet64 (gEventPending);
> >      if (gEfiCurrentTpl < TPL_HIGH_LEVEL) {
> >        CoreSetInterruptState (TRUE);
> >
> 
> Maybe:
> 
>   for (;;) {
>     PendingTpl = (UINTN) HighBitSet64 (gEventPending);
>     if (NewTpl >= PendingTpl) {
>       break;
>     }
>     gEfiCurrentTpl = PendingTpl;
>   }
> 
> This is much more readable, and HighBitSet64 should be efficient on most
> modern processors.
> 
> Paolo
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Patchew 2.1-devel-8c64711

© 2016 - 2024 Red Hat, Inc.