From patchwork Mon Feb 14 12:50:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745519 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E4923C433EF for ; Mon, 14 Feb 2022 12:52:05 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271503.465983 (Exim 4.92) (envelope-from ) id 1nJape-0004Uu-Un; Mon, 14 Feb 2022 12:51:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271503.465983; Mon, 14 Feb 2022 12:51:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJape-0004U6-Pt; Mon, 14 Feb 2022 12:51:54 +0000 Received: by outflank-mailman (input) for mailman id 271503; Mon, 14 Feb 2022 12:51:53 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapd-0003jk-Dh for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:51:53 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e113971b-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:51:51 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e113971b-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843111; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=OM1G6c/BDHwKCEjd4XaBXduFB7GfRa2QTRUE5y+VtvI=; b=I9b5R5jBLFqhk5tgOpGizR7lsaaH5Hbb7S5/Kgqmce23ynZTM8y2xA8b PnYOch9sXd5SZn0UE4Ms2T0ZavPIiDMqMCxun/WAnkTigOlgw5qvCkt2f GRIY3eS/0XAoqDIWz9wrzoFqfLhRAxy0tnJIq8NlDHKp3UzZCnNIkG97U U=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: bMVoiWl/SqiephNQZZdM0jr+KyVglX9h9DTAuRNTCIiLqueZt+NbwSDLC87RExF/DKY0E2LLi7 VxNv0TYS77xL+lUtl9j3Y/DsmlH3DzjAJqcI0FcNBQQhZQtlKVTYqBS9B8+y7YJR2RIIiHJA/q mktrqta4Pj4xG51lZmNUM/ExSMtTMBbdvtGjLVx0nh63fsdOvpBE6cL6yd9iaB5c4BEf9WtDEV OHFI7Q+50beCDZeLXEx9+F+8cwlUdkGy5+80Y9YeYDwvc6MjDM8Uh2OBOG4LWszVFJZwM642Pp T9E7rXgPS10tsEwL5uUY3kZa X-SBRS: 5.1 X-MesageID: 64148317 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:HX3pta0YVdWs3LQelvbD5cx2kn2cJEfYwER7XKvMYLTBsI5bp2AGz jEWWGHVb/3ZYDT3e9sjPo62/EsEsZ+ByoVmGws/pC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhrvshx 4tm5JyLFlkrZuqcur8SDRlVHHQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u2pkSTa2HO KL1bxJJMC3nZBkfB24eUrdg29+XmXPSbR9X/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWTkNLphRCVCtJkd BIWom1+j/M9qkymQYyoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3mH5unz6PLX05pjz+uYejiLeuYe9tGDOzgioRtctoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:f2vcC66UM7Gkg5Ht3APXwMzXdLJyesId70hD6qkXc20zTiX4rb HLoB1/73TJYVkqNE3I9eruBEDiexPhHPxOj7X5VI3KNGOKhILCFuBfxLqn7zr8GzDvss5xvJ 0QFpSW0eeAbmSSW/yKgjWFLw== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64148317" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 01/70] xen/domain: Improve pirq handling Date: Mon, 14 Feb 2022 12:50:18 +0000 Message-ID: <20220214125127.17985-2-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 free_pirq_struct() has no external users, so shouldn't be exposed. Making it static necessistates moving the function as domain_destroy() uses it. Rework pirq_get_info() to have easier-to-follow logic. The one functional change is to the insertion failure path; we should not be using a full call_rcu() chain to free an otherwise local structure we failed to insert into the radix tree to begin with. Signed-off-by: Andrew Cooper --- v2: * Drop likely/unlikey --- xen/common/domain.c | 62 ++++++++++++++++++++++++++---------------------- xen/include/xen/domain.h | 1 - 2 files changed, 33 insertions(+), 30 deletions(-) diff --git a/xen/common/domain.c b/xen/common/domain.c index 2048ebad86ff..571ef4fe615e 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -365,6 +365,39 @@ static int __init parse_extra_guest_irqs(const char *s) } custom_param("extra_guest_irqs", parse_extra_guest_irqs); +static void _free_pirq_struct(struct rcu_head *head) +{ + xfree(container_of(head, struct pirq, rcu_head)); +} + +static void free_pirq_struct(void *ptr) +{ + struct pirq *pirq = ptr; + + call_rcu(&pirq->rcu_head, _free_pirq_struct); +} + +struct pirq *pirq_get_info(struct domain *d, int pirq) +{ + struct pirq *info = pirq_info(d, pirq); + + if ( info ) + return info; + + info = alloc_pirq_struct(d); + if ( !info ) + return NULL; + + info->pirq = pirq; + if ( radix_tree_insert(&d->pirq_tree, pirq, info) == 0 ) + return info; /* Success. */ + + /* Don't use call_rcu() to free a struct we failed to insert. */ + _free_pirq_struct(&info->rcu_head); + + return NULL; +} + /* * Release resources held by a domain. There may or may not be live * references to the domain, and it may or may not be fully constructed. @@ -1780,35 +1813,6 @@ long do_vm_assist(unsigned int cmd, unsigned int type) } #endif -struct pirq *pirq_get_info(struct domain *d, int pirq) -{ - struct pirq *info = pirq_info(d, pirq); - - if ( !info && (info = alloc_pirq_struct(d)) != NULL ) - { - info->pirq = pirq; - if ( radix_tree_insert(&d->pirq_tree, pirq, info) ) - { - free_pirq_struct(info); - info = NULL; - } - } - - return info; -} - -static void _free_pirq_struct(struct rcu_head *head) -{ - xfree(container_of(head, struct pirq, rcu_head)); -} - -void free_pirq_struct(void *ptr) -{ - struct pirq *pirq = ptr; - - call_rcu(&pirq->rcu_head, _free_pirq_struct); -} - struct migrate_info { long (*func)(void *data); void *data; diff --git a/xen/include/xen/domain.h b/xen/include/xen/domain.h index 160c8dbdab33..b4d202fda9fd 100644 --- a/xen/include/xen/domain.h +++ b/xen/include/xen/domain.h @@ -44,7 +44,6 @@ void free_vcpu_struct(struct vcpu *v); #ifndef alloc_pirq_struct struct pirq *alloc_pirq_struct(struct domain *); #endif -void free_pirq_struct(void *); /* * Initialise/destroy arch-specific details of a VCPU. From patchwork Mon Feb 14 12:50:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A5032C433EF for ; Mon, 14 Feb 2022 12:52:07 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271500.465949 (Exim 4.92) (envelope-from ) id 1nJapb-0003jx-Vf; Mon, 14 Feb 2022 12:51:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271500.465949; Mon, 14 Feb 2022 12:51:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapb-0003jq-Se; Mon, 14 Feb 2022 12:51:51 +0000 Received: by outflank-mailman (input) for mailman id 271500; Mon, 14 Feb 2022 12:51:50 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapa-0003jd-Dm for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:51:50 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id dd86c4bb-8d94-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 13:51:47 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: dd86c4bb-8d94-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843108; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=aXXIf+NNN0QNk4zfqFs4eP6IyzxPbQMRw4LdRyX5iLE=; b=DLn+ya2af5u4QtUc1x13c/XqDhf1fGdxxiGJLYCSVLlpICWC9mY+NXz0 Mk7wcVXLuwbteeOLN11tIq18UWYPnWwz6+CPiMgy4zV63LBpKFnzGjvsn SMXKeAc2PzvtztRjVkjOO+PQD6OyDvfyji6WmcmkR4PcFLqIlUPTn2VDT Q=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: JUo4Vd3pfWa8T/jVOep+89YwoUs2d7+ivu7Rcedm30U9L93QAmJj3deGVoZiN3Fe8jL8JI5s3u 4/puwCUfVqCWZSy/P3twSEYNjYwy9njJhXFAeG0lQRXpTuovLJCb04Th2Oh0eCFmzyokEO359f SDQrj1MO4Cs1CdWigft0Bnjq7kPZgNV5E+hqLoMqAzfSfnPHnRUtgk8z0oLbVJayvGqcZhC6J7 5sqCCY2kVV0v8THKKOGgIFXXTyrPUCSjgHBimhX1rUPeW0RP49WwsAtDgOlh5oraD5EilFIWQy 8EftccNWIhriLpMoDfdvkJBn X-SBRS: 5.1 X-MesageID: 64148059 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:rOj1sKsrj3R06oxB0P+t65vbz+fnVMtZMUV32f8akzHdYApBsoF/q tZmKWiOPq7YY2r0L90lO462/RsDvMLVn943TQdlryBkFSwV+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Nplioa9WRoTOIT2qv03VzhjCxlleqJL0eqSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AO 5NFOWIyPXwsZTVvKBQPEZAbwdyLh3zjXSF/knnNv5c4tj27IAtZj+G2bYu9lsaxbcdImkeVo ErW8mK/BQsVXPShzj6C/mOpl/X4tyrxU4IPF5W17vdvxlaUwwQ7AhAMSUGyp/X/j0ekQs9eM GQd4C9opq83nGS0SvHtUhv+p2SL1jYMVtwVH+Ak5QWlzqvP/x3fFmUCViRGatEtqIkxXzNC/ n2jks7tBDdvmKaIUn/b/bCRxRupIjQcJ2IGYS4CTCMG7sPlrYV1iQjAJuuPC4bs0IezQ2uph WnX8m5u3N3/kPLnyY2E513Xngiqj6L7VyQxxz7PZnni4Q5QMdvNi5OT1XDX6vNJLYC8R1aHv WQZl8X20N3iHa1hhwTWHrxTQejBC+KtdWSF3AUxR8VJGyGFpib7Fb289g2SM6uA3iwsXTbyK HHetgpKjHO4FCv7NPQnC25d5ilD8EQBKTgHfq2OBjatSsIoHONiwM2JTRTOt10BaGB2zckC1 W6zKK5A90oyB6V91yaRTOwAy7ItzS1W7TqNGcykn0T6jOLHPyT9pVI53LymNL5R0U95iF+Nr 4Y32zWil32zr9ESkgGIqNVOfDjm3FAwBIzsqtw/SwJwClEOJY3VMNeImelJU9U8x8x9z76Ul lngCh4w4Aeu3hXvdFTVAk2PnZuyBP6TW1pgZndyVbtpslB+CbuSAFA3KcdmI+l/rLY7pRO2J tFcE/i97j10Ymyv01wggVPV9uSOrTyn2lCDOTSLej86c8IyTgDF4Ia8LADu6DMPHmy8ss5n+ ++s0QbSQJwiQQV+DZmJNKLzng3p5XVNyvhvW0boI8VIfBm++oZdNCGs3OQ8JNsBKEufy2LCh RqWGxoRucLEv5QxrIvSnamBoorwS7l+E0NWEnP197GzMSWGrGOvzZUZCLSDfCzHVXOy86KnP L0Hw/b5OfwBvVBLr4sjTOo7kfNgv4Pi/uYIwB5lEXPHa0WQJolhenTWj9NSsqBtx6NCvVfkU Ey45dQHa66CP9noEQBNKVN9PPiDz/wdhhLb8e8xfBfh/CZy8beKDRdSMh2LhHAPJbd5Ktp4k +IoucpQ4A2jkBs6dN2Bi3kMpWiLK3UBVYQht40bX9C32lZ6lAkabMyOEDLy7bGOd85IYxsjL TKjjabfg6hRmxjZeH0pGHmRhedQiPziYvyRIIPu87hRpuf4uw== IronPort-HdrOrdr: A9a23:l6iu4qsnagOUOA9OLGPnExlv7skDTtV00zEX/kB9WHVpmszxra 6TdZMgpGbJYVcqKRcdcL+7WJVoLUmxyXcx2/h1AV7AZniAhILLFvAA0WKK+VSJcEeSygce79 YFT0EXMqyJMbEQt6fHCWeDfOrIuOP3kpyVuQ== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64148059" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu , Stefano Stabellini , Julien Grall , Volodymyr Babchuk , Bertrand Marquis Subject: [PATCH v2 02/70] xen/sort: Switch to an extern inline implementation Date: Mon, 14 Feb 2022 12:50:19 +0000 Message-ID: <20220214125127.17985-3-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 There are exactly 3 callers of sort() in the hypervisor. Callbacks in a tight loop like this are problematic for performance, especially with Spectre v2 protections, which is why extern inline is used commonly by libraries. Both ARM callers pass in NULL for the swap function, and while this might seem like an attractive option at first, it causes generic_swap() to be used, which forced a byte-wise copy. Provide real swap functions so the compiler can optimise properly, which is very important for ARM downstreams where milliseconds until the system is up matters. No functional change. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Reviewed-by: Bertrand Marquis Nacked-by: Julien Grall Signed-off-by: Andrew Cooper Signed-off-by: Stefano Stabellini Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu CC: Stefano Stabellini CC: Julien Grall CC: Volodymyr Babchuk CC: Bertrand Marquis v2: * Adjust commit message --- xen/arch/arm/bootfdt.c | 9 +++++- xen/arch/arm/io.c | 9 +++++- xen/include/xen/sort.h | 55 +++++++++++++++++++++++++++++++++- xen/lib/sort.c | 80 ++------------------------------------------------ 4 files changed, 72 insertions(+), 81 deletions(-) diff --git a/xen/arch/arm/bootfdt.c b/xen/arch/arm/bootfdt.c index afaa0e249b71..e318ef960386 100644 --- a/xen/arch/arm/bootfdt.c +++ b/xen/arch/arm/bootfdt.c @@ -448,6 +448,13 @@ static int __init cmp_memory_node(const void *key, const void *elem) return 0; } +static void __init swap_memory_node(void *_a, void *_b, size_t size) +{ + struct membank *a = _a, *b = _b; + + SWAP(*a, *b); +} + /** * boot_fdt_info - initialize bootinfo from a DTB * @fdt: flattened device tree binary @@ -472,7 +479,7 @@ size_t __init boot_fdt_info(const void *fdt, paddr_t paddr) * the banks sorted in ascending order. So sort them through. */ sort(bootinfo.mem.bank, bootinfo.mem.nr_banks, sizeof(struct membank), - cmp_memory_node, NULL); + cmp_memory_node, swap_memory_node); early_print_info(); diff --git a/xen/arch/arm/io.c b/xen/arch/arm/io.c index 729287e37c59..1a066f9ae502 100644 --- a/xen/arch/arm/io.c +++ b/xen/arch/arm/io.c @@ -80,6 +80,13 @@ static int cmp_mmio_handler(const void *key, const void *elem) return 0; } +static void swap_mmio_handler(void *_a, void *_b, size_t size) +{ + struct mmio_handler *a = _a, *b = _b; + + SWAP(*a, *b); +} + static const struct mmio_handler *find_mmio_handler(struct domain *d, paddr_t gpa) { @@ -170,7 +177,7 @@ void register_mmio_handler(struct domain *d, /* Sort mmio handlers in ascending order based on base address */ sort(vmmio->handlers, vmmio->num_entries, sizeof(struct mmio_handler), - cmp_mmio_handler, NULL); + cmp_mmio_handler, swap_mmio_handler); write_unlock(&vmmio->lock); } diff --git a/xen/include/xen/sort.h b/xen/include/xen/sort.h index a403652948e7..01479ea44606 100644 --- a/xen/include/xen/sort.h +++ b/xen/include/xen/sort.h @@ -3,8 +3,61 @@ #include +/* + * sort - sort an array of elements + * @base: pointer to data to sort + * @num: number of elements + * @size: size of each element + * @cmp: pointer to comparison function + * @swap: pointer to swap function or NULL + * + * This function does a heapsort on the given array. You may provide a + * swap function optimized to your element type. + * + * Sorting time is O(n log n) both on average and worst-case. While + * qsort is about 20% faster on average, it suffers from exploitable + * O(n*n) worst-case behavior and extra memory requirements that make + * it less suitable for kernel use. + */ +#ifndef SORT_IMPLEMENTATION +extern gnu_inline +#endif void sort(void *base, size_t num, size_t size, int (*cmp)(const void *, const void *), - void (*swap)(void *, void *, size_t)); + void (*swap)(void *, void *, size_t)) +{ + /* pre-scale counters for performance */ + size_t i = (num / 2) * size, n = num * size, c, r; + + /* heapify */ + while ( i > 0 ) + { + for ( r = i -= size; r * 2 + size < n; r = c ) + { + c = r * 2 + size; + if ( (c < n - size) && (cmp(base + c, base + c + size) < 0) ) + c += size; + if ( cmp(base + r, base + c) >= 0 ) + break; + swap(base + r, base + c, size); + } + } + + /* sort */ + for ( i = n; i > 0; ) + { + i -= size; + swap(base, base + i, size); + for ( r = 0; r * 2 + size < i; r = c ) + { + c = r * 2 + size; + if ( (c < i - size) && (cmp(base + c, base + c + size) < 0) ) + c += size; + if ( cmp(base + r, base + c) >= 0 ) + break; + swap(base + r, base + c, size); + } + } +} #endif /* __XEN_SORT_H__ */ diff --git a/xen/lib/sort.c b/xen/lib/sort.c index 35ce0d7abdec..b7e78cc0e8d2 100644 --- a/xen/lib/sort.c +++ b/xen/lib/sort.c @@ -4,81 +4,5 @@ * Jan 23 2005 Matt Mackall */ -#include - -static void u32_swap(void *a, void *b, size_t size) -{ - uint32_t t = *(uint32_t *)a; - - *(uint32_t *)a = *(uint32_t *)b; - *(uint32_t *)b = t; -} - -static void generic_swap(void *a, void *b, size_t size) -{ - char t; - - do { - t = *(char *)a; - *(char *)a++ = *(char *)b; - *(char *)b++ = t; - } while ( --size > 0 ); -} - -/* - * sort - sort an array of elements - * @base: pointer to data to sort - * @num: number of elements - * @size: size of each element - * @cmp: pointer to comparison function - * @swap: pointer to swap function or NULL - * - * This function does a heapsort on the given array. You may provide a - * swap function optimized to your element type. - * - * Sorting time is O(n log n) both on average and worst-case. While - * qsort is about 20% faster on average, it suffers from exploitable - * O(n*n) worst-case behavior and extra memory requirements that make - * it less suitable for kernel use. - */ - -void sort(void *base, size_t num, size_t size, - int (*cmp)(const void *, const void *), - void (*swap)(void *, void *, size_t size)) -{ - /* pre-scale counters for performance */ - size_t i = (num / 2) * size, n = num * size, c, r; - - if ( !swap ) - swap = (size == 4 ? u32_swap : generic_swap); - - /* heapify */ - while ( i > 0 ) - { - for ( r = i -= size; r * 2 + size < n; r = c ) - { - c = r * 2 + size; - if ( (c < n - size) && (cmp(base + c, base + c + size) < 0) ) - c += size; - if ( cmp(base + r, base + c) >= 0 ) - break; - swap(base + r, base + c, size); - } - } - - /* sort */ - for ( i = n; i > 0; ) - { - i -= size; - swap(base, base + i, size); - for ( r = 0; r * 2 + size < i; r = c ) - { - c = r * 2 + size; - if ( (c < i - size) && (cmp(base + c, base + c + size) < 0) ) - c += size; - if ( cmp(base + r, base + c) >= 0 ) - break; - swap(base + r, base + c, size); - } - } -} +#define SORT_IMPLEMENTATION +#include From patchwork Mon Feb 14 12:50:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745518 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3A44BC433F5 for ; Mon, 14 Feb 2022 12:52:05 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271501.465961 (Exim 4.92) (envelope-from ) id 1nJapd-0003zk-9Q; Mon, 14 Feb 2022 12:51:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271501.465961; Mon, 14 Feb 2022 12:51:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapd-0003zd-6Q; Mon, 14 Feb 2022 12:51:53 +0000 Received: by outflank-mailman (input) for mailman id 271501; Mon, 14 Feb 2022 12:51:51 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapb-0003jk-Lc for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:51:51 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id defbff4d-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:51:49 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: defbff4d-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843109; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=pkih7ZsMQp5X2IhcDlZLwpA1su4gAvfwPCKXwyjRwo8=; b=RBu5lWIflALOdDtAcjiIrp27xqBqWk4RURdPc2etHdjNH4hxn1QFQ45b e8gDoMK9epKixAl1w4ks6Lm3nwEVFgYDnEnKQsA/qjpn8BccMMYJ/bgER zCfFIDGEx8KxBLGk7Nwx1IFPJMaopuYMgY9MMoSFhqvcyJnQ12eApgCtN g=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: laa0lK+0JjaWzClqAAaAldTnDTe1D9EinE+gsidtVsx+0tM8A419Q6TNow1WxzBGMUyfgzu709 423ZM5mSYKngLY7UPC3rY0S5u72Xhg/OwP1p6uA2t0wo9SqDjkRGDH8Cz75WI6PmZ96F0ls3km ZHCrJLYCL+CvzsapoCu4dWjVPKbgaGr32tNmLy2DFTMOYbXSHwKSOxMx+xozbCGF/M9dB0NbnJ OItCR/WWYkQVPifTChW/nJ6i2zYXBAm9nm9uaslefP9XOEYZZy+h4K1Gp9awtN02dHGcWf0cgQ g1JS2YjxOeiAk/TkzowbPPb1 X-SBRS: 5.1 X-MesageID: 63591037 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Mo1cOqoX1Qa+BZ11yenAXQEvu05eBmLNYhIvgKrLsJaIsI4StFCzt garIBmGbv2NYmf3et91Ptu3pxsDv5SDmNQyGgo4rnxnE3kXp5uZCYyVIHmrMnLJJKUvbq7GA +byyDXkBJppJpMJjk71atANlZT4vE2xbuKU5NTsY0idfic5Dndx4f5fs7Rh2NQw24HlW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCnceeGBoVI/HIpM86ShtGHCghP6Fn/KCSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O ZFEOGM3N0uojxtnCAk0V70ulcmUt3jYd3pdtlPJmu0Syj2GpOB2+Oe0a4eEEjCQfu1Zhl2dp 37G123hDwsGKceEzj6Y7nOrgPSJliT+MKoeG7G1+eRjqEGCzWwUThsNXB20pufRol6zXZdTJ lIZ/gIqrLMu7wq7Q9/lRRq6rXWY+BkGVLJt//YSsV/XjPCOukDAWzZCHmUphMEaWNEeHhJ7y 2OUw9fVLht2sqOaQC2f+paQsmbnUcQKFlMqaSgBRAoDxtDspoAvkx7CJupe/L6JYs7dQm+pn W3TxMQqr/BK1JNQif3nlbzSq2/0/vD0ohgJChI7t45Pxidwf8abaoOh8jA3Bt4Qfd/CHjFtU JXp8vVyDdzi77nQzkRho81XRdlFAspp1xWG3zZS82EJrWjFxpJaVdk4DMtCDEloKN0YXjTif VXevwhcjLcKYif2Mv8nPt/pUp9wpUQFKTgCfqqKBuein7ArLFPXlM2QTRL4M5/RfLgEzvhkZ MbznTeEBncGE6V3pAdatM9GuYLHMhsWnDuJLbiilkzP+ePHOBa9FOdUWHPTP7tRxP7V/23oH yN3apLiJ+N3C7alPEE6MOc7cDg3EJTMLc6q+pIHLrbZemKL2ggJUpfs/F/oQKQ994w9qwsC1 ivVtpZwxAWtiHvZBx+Nb3w/OrrjUYwm9SAwPDA2PEbu0H8mON794KAafpoxXL8m6O08kqIkE 6hbI52NUqZVVzDK2zUBdp2h/oZsQwum2FCVNC2/bTlhI5M5H17V+sXpdxfE/TUVCnblrtM3p rCtj1uJQZcKSwl4ItzRbfajkwG4sXQHwbogVErUONhDPk7r9dEyeSD2i/Y2JeAKKAnCmWTGh 1rHX09AqLCU8YEv8dTPiaSVlKuTErNzThhAAm3WzbeqLi2GrGCt9pBNDbSTdjfHWWKqpKj7P bdJz+vxOeEslUpRt9YuCK5iyK8z6oe9p7JeyQg4TnzHY07yV+FlK3iCm8JOqrdM1vlSvg7vA hCD/dxTOLOoPsL5EQFOeFp5P7rbjfxEyCPP6fkVIVnh4H4l9bWKZkxeIh2QhXEPN7ByKo4kn b8stcN+B9ZTUfb23gJqVhxpylk= IronPort-HdrOrdr: A9a23:trI3O6+l3qfOOfUeqKJuk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63591037" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Daniel De Graaf , Daniel Smith Subject: [PATCH v2 03/70] xen/xsm: Move {do,compat}_flask_op() declarations into a header Date: Mon, 14 Feb 2022 12:50:20 +0000 Message-ID: <20220214125127.17985-4-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Declaring sideways like this is unsafe, because the compiler can't check that the implementaton in flask_op.c still has the same type. Signed-off-by: Andrew Cooper Reviewed-by: Daniel P. Smith --- CC: Daniel De Graaf CC: Daniel Smith v2: * Rework in the face of no useful progress on the better fix. --- xen/xsm/flask/flask_op.c | 1 + xen/xsm/flask/hooks.c | 4 +--- xen/xsm/flask/private.h | 9 +++++++++ 3 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 xen/xsm/flask/private.h diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c index 221ff00fd3cc..bb3bebc30e01 100644 --- a/xen/xsm/flask/flask_op.c +++ b/xen/xsm/flask/flask_op.c @@ -21,6 +21,7 @@ #include #include #include +#include "private.h" #define ret_t long #define _copy_to_guest copy_to_guest diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 3b29f7fde372..6ff1be28e4a4 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -36,6 +36,7 @@ #include #include #include +#include "private.h" static u32 domain_sid(const struct domain *dom) { @@ -1742,9 +1743,6 @@ static int flask_argo_send(const struct domain *d, const struct domain *t) #endif -long do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); -int compat_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); - static const struct xsm_ops __initconstrel flask_ops = { .security_domaininfo = flask_security_domaininfo, .domain_create = flask_domain_create, diff --git a/xen/xsm/flask/private.h b/xen/xsm/flask/private.h new file mode 100644 index 000000000000..73b0de87245a --- /dev/null +++ b/xen/xsm/flask/private.h @@ -0,0 +1,9 @@ +#ifndef XSM_FLASK_PRIVATE +#define XSM_FLASK_PRIVATE + +#include + +long do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); +int compat_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); + +#endif /* XSM_FLASK_PRIVATE */ From patchwork Mon Feb 14 12:50:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745520 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 28468C433FE for ; Mon, 14 Feb 2022 12:52:07 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271502.465966 (Exim 4.92) (envelope-from ) id 1nJapd-00042w-M7; Mon, 14 Feb 2022 12:51:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271502.465966; Mon, 14 Feb 2022 12:51:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapd-00042C-Ft; Mon, 14 Feb 2022 12:51:53 +0000 Received: by outflank-mailman (input) for mailman id 271502; Mon, 14 Feb 2022 12:51:52 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapc-0003jk-Dh for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:51:52 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id deb652d9-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:51:49 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: deb652d9-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843109; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=J9m3axxGB3YzDKMm3KiRlCtcpIXM6a9lXiT912knQRU=; b=C0LN7lOZaZokznpIJGwtMXW4HOaYfkhat9gqyiUSjzpzdrpb2lANUQYD D2J6v447sqHHRjsXz3dponQz37M63MiUkrOPBa4X7nFmbNIkllPJPbWcd cGVjQHPhBpzAYpPmCPNZXpTbwmKF3UvbfngyIfor6RxTPtDyoqmUB1fvb 8=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: BICKEwSReIH9eKmvBo1CRZ9hxo4Da6Hik5VETf0yI/mn9LqrA8Izd43jktE8HFjvDSqyIJw48N 63A2GHtGC2m/pwqvKv7gip4KKW+Mb015Xzr4XymjNNyVfcFraUpL+YXKwkW9krvO8c9X/eaggd 1c0RjsJF9gBK01/v/fEb4BuaZ5QUqKm761Od2YvicIks++DpI9E0gSsLivtvpPmVFeSJQGl8qe /gIZi21dliI72pJ7VEC0mhMeaVBOQhwg/quX30LrT5Qm0ktHOLzmSn2YphvDRhOaxTmu/r99SB J4uU9l28uFRE/OvEjnQP8paS X-SBRS: 5.1 X-MesageID: 64148314 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:VgrLkq7kD8T3EMb2ajxFVgxRtBbAchMFZxGqfqrLsTDasY5as4F+v mUXDG2DP/2IM2D2fo0jbdi29UgCupbUy4BmGwtlri0xHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z6 /B86ICuUV8QG4rXm94NbQkDCD4gBPgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQa+CN 5FANVKDajzgXAV0KgsOAqkdmeyuonPFfSVVun2K8P9fD2/7k1UqjemF3MDuUt6FX8JOhW6Du 3nLuW/+B3kyJNGZjDaI7H+oruvOhj/gHpIfEqWi8fxni0HVwXYcYCD6TnPi/6P/0BTnHYsCd QpEoULCsJTe6mSIa+igQwOg+EehmQUfYcpuA7Yh91+0n/+8DxmiOkAISTtIadoDvcAwRCA32 lLho+4FFQCDo5XOFyvDq+78QSeafHFMcDRcPXNsoR4tvoG7yLzfmC4jWTqK/ESdqtTuUQ/9z DmRxMTVr+VC1JVbv0lXEL2uvt5NmnQrZlNvjuk0djj8hu+cWGJCT9b2gWU3Fd4acO6koqCp5 RDoYfS24uEUFo2qnyeQWugLF7zBz6/bbGGD0Q4yQsF4rG7FF5ufkWd4um8WGauUGpxcJW+Bj LH75Wu9G6O/zFP1NPQqMupd+uwhzLT6FMSNaxwnRoEmX3SFTyfepHsGTRfJhwjFyRFw+Ylia cbzWZv9Vh4yVPU4pAdass9AiNfHMAhlnjiNLX06pjz6uYejiIm9F+tbbgvUM7xRAWHtiFy9z uuz/vCik313ONASqAGNmWLKBVxVf3U9G77srMlbKryKLgZ8QTlzAP7N27IxPYdimv0NxOvP+ 3i8XG5eyUb+2iKbeVnbNCg7ZeO9R4t7oFI6ITcoYQSi1U88bNv996wYbZY2I+UqrbQx0f5uQ vAZUMycGfATGC/f8jEQYMCl/oxvfRimnyyUOC+hbGRtdpJsXVWRqNTlYhHu5G8FCS/u7Zkyp Lip1wX6R5sfRls9UJaKOaz3l17o5CoTguN/WUfMM+J/QkS0/dg4MTH1g982P9oIdUfJyAyF2 lvEGhwfv+TM/dM4qYGbmaCeoo61OOJiBU4GTXLD5LO7OCSGrGquxYhMDLSBcTzHDT6m/ayjY aNezu3mMe1Bl1FP6tIuH7FuxKM4xt3uu74FkVg0QCSVNwymWuF6P32L/chTrakclLZWtDy/V l+L5tQHa66CP9noEQJJKQcoBghZOSr4RtUGASwJHXjH IronPort-HdrOrdr: A9a23:ssub/qNNZ3p9EcBcTvKjsMiBIKoaSvp037B87TEJdfU1SL38qy jN9M5w6faQslsssR4b9exoVJPufZq+z+8W3WByB9eftVLdyQ2VxehZhOOI/9SHIUPDH4VmpM RdmsZFaeEZojJB/L7HCKXTKadF/DEnmprY4tvj8w== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64148314" From: Andrew Cooper To: Xen-devel CC: Juergen Gross , Andrew Cooper Subject: [PATCH v2 04/70] x86/pv-shim: Don't modify the hypercall table Date: Mon, 14 Feb 2022 12:50:21 +0000 Message-ID: <20220214125127.17985-5-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 From: Juergen Gross When running as pv-shim the hypercall is modified today in order to replace the functions for __HYPERVISOR_event_channel_op and __HYPERVISOR_grant_table_op hypercalls. Change this to call the related functions from the normal handlers instead when running as shim. The performance implications are not really relevant, as a normal production hypervisor will not be configured to support shim mode, so the related calls will be dropped due to optimization of the compiler. Note that for the CONFIG_PV_SHIM_EXCLUSIVE case there is a dummy wrapper do_grant_table_op() needed, as in this case grant_table.c isn't being built. Signed-off-by: Juergen Gross Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/include/asm/hypercall.h | 4 ++- xen/arch/x86/include/asm/pv/shim.h | 3 ++ xen/arch/x86/pv/hypercall.c | 2 +- xen/arch/x86/pv/shim.c | 54 ++++++++++++++++---------------- xen/arch/x86/x86_64/platform_hypercall.c | 2 +- xen/common/compat/multicall.c | 3 +- xen/common/event_channel.c | 9 ++++++ xen/common/grant_table.c | 9 ++++++ 8 files changed, 54 insertions(+), 32 deletions(-) diff --git a/xen/arch/x86/include/asm/hypercall.h b/xen/arch/x86/include/asm/hypercall.h index 5d394d492318..f004824f16b6 100644 --- a/xen/arch/x86/include/asm/hypercall.h +++ b/xen/arch/x86/include/asm/hypercall.h @@ -145,6 +145,7 @@ do_set_segment_base( #include #include +#include extern int compat_physdev_op( @@ -161,8 +162,9 @@ extern int compat_mmuext_op( XEN_GUEST_HANDLE_PARAM(uint) pdone, unsigned int foreigndom); +DEFINE_XEN_GUEST_HANDLE(compat_platform_op_t); extern int compat_platform_op( - XEN_GUEST_HANDLE_PARAM(void) u_xenpf_op); + XEN_GUEST_HANDLE_PARAM(compat_platform_op_t) u_xenpf_op); extern long compat_callback_op( int cmd, XEN_GUEST_HANDLE(void) arg); diff --git a/xen/arch/x86/include/asm/pv/shim.h b/xen/arch/x86/include/asm/pv/shim.h index 8a91f4f9dfbf..6415f8068e5c 100644 --- a/xen/arch/x86/include/asm/pv/shim.h +++ b/xen/arch/x86/include/asm/pv/shim.h @@ -19,6 +19,7 @@ #ifndef __X86_PV_SHIM_H__ #define __X86_PV_SHIM_H__ +#include #include #if defined(CONFIG_PV_SHIM_EXCLUSIVE) @@ -45,6 +46,8 @@ domid_t get_initial_domain_id(void); uint64_t pv_shim_mem(uint64_t avail); void pv_shim_fixup_e820(struct e820map *e820); const struct platform_bad_page *pv_shim_reserved_pages(unsigned int *size); +typeof(do_event_channel_op) pv_shim_event_channel_op; +typeof(do_grant_table_op) pv_shim_grant_table_op; #else diff --git a/xen/arch/x86/pv/hypercall.c b/xen/arch/x86/pv/hypercall.c index ecdd58deea69..50cd219c18fc 100644 --- a/xen/arch/x86/pv/hypercall.c +++ b/xen/arch/x86/pv/hypercall.c @@ -64,7 +64,7 @@ const pv_hypercall_table_t pv_hypercall_table[] = { COMPAT_CALL(xen_version), HYPERCALL(console_io), COMPAT_CALL(physdev_op_compat), -#ifdef CONFIG_GRANT_TABLE +#if defined(CONFIG_GRANT_TABLE) || defined(CONFIG_PV_SHIM) COMPAT_CALL(grant_table_op), #endif HYPERCALL(vm_assist), diff --git a/xen/arch/x86/pv/shim.c b/xen/arch/x86/pv/shim.c index d9704121a739..7e891fe2f7a4 100644 --- a/xen/arch/x86/pv/shim.c +++ b/xen/arch/x86/pv/shim.c @@ -56,11 +56,6 @@ static DEFINE_SPINLOCK(balloon_lock); static struct platform_bad_page __initdata reserved_pages[2]; -static long pv_shim_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -static long pv_shim_grant_table_op(unsigned int cmd, - XEN_GUEST_HANDLE_PARAM(void) uop, - unsigned int count); - /* * By default give the shim 1MB of free memory slack. Some users may wish to * tune this constants for better memory utilization. This can be achieved @@ -203,7 +198,6 @@ void __init pv_shim_setup_dom(struct domain *d, l4_pgentry_t *l4start, start_info_t *si) { bool compat = is_pv_32bit_domain(d); - pv_hypercall_table_t *rw_pv_hypercall_table; uint64_t param = 0; long rc; @@ -249,23 +243,6 @@ void __init pv_shim_setup_dom(struct domain *d, l4_pgentry_t *l4start, consoled_set_ring_addr(page); } - /* - * Locate pv_hypercall_table[] (usually .rodata) in the directmap (which - * is writeable) and insert some shim-specific hypercall handlers. - */ - rw_pv_hypercall_table = __va(__pa(pv_hypercall_table)); - rw_pv_hypercall_table[__HYPERVISOR_event_channel_op].native = - (hypercall_fn_t *)pv_shim_event_channel_op; - rw_pv_hypercall_table[__HYPERVISOR_grant_table_op].native = - (hypercall_fn_t *)pv_shim_grant_table_op; - -#ifdef CONFIG_PV32 - rw_pv_hypercall_table[__HYPERVISOR_event_channel_op].compat = - (hypercall_fn_t *)pv_shim_event_channel_op; - rw_pv_hypercall_table[__HYPERVISOR_grant_table_op].compat = - (hypercall_fn_t *)pv_shim_grant_table_op; -#endif - guest = d; /* @@ -435,7 +412,7 @@ int pv_shim_shutdown(uint8_t reason) return 0; } -static long pv_shim_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +long pv_shim_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct domain *d = current->domain; struct evtchn_close close; @@ -683,9 +660,9 @@ void pv_shim_inject_evtchn(unsigned int port) # define compat_handle_okay guest_handle_okay #endif -static long pv_shim_grant_table_op(unsigned int cmd, - XEN_GUEST_HANDLE_PARAM(void) uop, - unsigned int count) +long pv_shim_grant_table_op(unsigned int cmd, + XEN_GUEST_HANDLE_PARAM(void) uop, + unsigned int count) { struct domain *d = current->domain; long rc = 0; @@ -845,6 +822,29 @@ static long pv_shim_grant_table_op(unsigned int cmd, return rc; } +#ifndef CONFIG_GRANT_TABLE +/* Thin wrapper(s) needed. */ +long do_grant_table_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, + unsigned int count) +{ + if ( !pv_shim ) + return -ENOSYS; + + return pv_shim_grant_table_op(cmd, uop, count); +} + +#ifdef CONFIG_PV32 +int compat_grant_table_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, + unsigned int count) +{ + if ( !pv_shim ) + return -ENOSYS; + + return pv_shim_grant_table_op(cmd, uop, count); +} +#endif +#endif + long pv_shim_cpu_up(void *data) { struct vcpu *v = data; diff --git a/xen/arch/x86/x86_64/platform_hypercall.c b/xen/arch/x86/x86_64/platform_hypercall.c index fbba893a47cb..966fd27b5f22 100644 --- a/xen/arch/x86/x86_64/platform_hypercall.c +++ b/xen/arch/x86/x86_64/platform_hypercall.c @@ -6,8 +6,8 @@ EMIT_FILE; #include #include +#include -DEFINE_XEN_GUEST_HANDLE(compat_platform_op_t); #define xen_platform_op compat_platform_op #define xen_platform_op_t compat_platform_op_t #define do_platform_op(x) compat_platform_op(_##x) diff --git a/xen/common/compat/multicall.c b/xen/common/compat/multicall.c index a0e9918f4805..b17739d21829 100644 --- a/xen/common/compat/multicall.c +++ b/xen/common/compat/multicall.c @@ -5,7 +5,7 @@ EMIT_FILE; #include -#include +#include #include #define COMPAT @@ -19,7 +19,6 @@ static inline void xlat_multicall_entry(struct mc_state *mcs) mcs->compat_call.args[i] = mcs->call.args[i]; } -DEFINE_XEN_GUEST_HANDLE(multicall_entry_compat_t); #define multicall_entry compat_multicall_entry #define multicall_entry_t multicall_entry_compat_t #define do_multicall_call compat_multicall_call diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index da88ad141a69..c9912122d1e5 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -31,6 +31,10 @@ #include #include +#ifdef CONFIG_PV_SHIM +#include +#endif + #define ERROR_EXIT(_errno) \ do { \ gdprintk(XENLOG_WARNING, \ @@ -1189,6 +1193,11 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { int rc; +#ifdef CONFIG_PV_SHIM + if ( unlikely(pv_shim) ) + return pv_shim_event_channel_op(cmd, arg); +#endif + switch ( cmd ) { case EVTCHNOP_alloc_unbound: { diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 3d92fee59285..925ed7d6bee2 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -44,6 +44,10 @@ #include #include +#ifdef CONFIG_PV_SHIM +#include +#endif + /* Per-domain grant information. */ struct grant_table { /* @@ -3561,6 +3565,11 @@ do_grant_table_op( long rc; unsigned int opaque_in = cmd & GNTTABOP_ARG_MASK, opaque_out = 0; +#ifdef CONFIG_PV_SHIM + if ( unlikely(pv_shim) ) + return pv_shim_grant_table_op(cmd, uop, count); +#endif + if ( (int)count < 0 ) return -EINVAL; From patchwork Mon Feb 14 12:50:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745523 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 99CC9C4332F for ; Mon, 14 Feb 2022 12:52:10 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271505.466005 (Exim 4.92) (envelope-from ) id 1nJapj-0005D0-Sk; Mon, 14 Feb 2022 12:51:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271505.466005; Mon, 14 Feb 2022 12:51:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapj-0005Ch-O1; Mon, 14 Feb 2022 12:51:59 +0000 Received: by outflank-mailman (input) for mailman id 271505; Mon, 14 Feb 2022 12:51:58 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapi-0003jk-OP for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:51:58 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e494dfa9-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:51:57 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e494dfa9-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843117; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=buQ4vU5zrwUnxyg9VsKbyngF1+pXb0VGwNc+MlpJ+mM=; b=bRtiKHd1uW9uN1ZelZttxi1VxjSGrZJ49jRDL2sBh0LTWHqrttE3d7Kz M+gQGwE8j9yupKbZWrpXcN0gCnIooy8jpKFRPwc89MZe6Yx/MQ9CV0hO1 2jMnoSm18AhA+9dY1XakQI6crYEZlK3zKYyyC6KPdC32e7UHu5Ka1vo5I k=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: uAzcBEHgs19KlcXxNtoAvTZkwZ39kwU1m9GZ9FRn48W4ZaiXUIaaipYVtaEw3ruaz5uP0Jtg4N SnJJ07QGeQob/LUubRxfxMc5/P4hg/FRyqkSfhiu/XYR7be/bjuLxn+UV3ln+EfVvPLw+eXj7V D/knoMag1kbEvJ++VjLcb1DQiSnSJkv9H3p+8e28kAXnHbD49GfHB5xDVWUeNJrbvkOmFPyVY5 2fYTPHWKMY0Y1wEzKsJFpkknnkjKcHe8Ry/3FczqUw8sygsaRrn/Z4EStq2O05qZ17gF+sPQBD DRNft9JDcj11+w2Qs7aR816/ X-SBRS: 5.1 X-MesageID: 63591047 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:jQSZzKuY9vLYwld9Kw/5VP2hwefnVH9ZMUV32f8akzHdYApBsoF/q tZmKT+GOazeMGPxLdpzbYmy8hkH7cLWmoVkHAVs/i5nQ34U+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ NplrIeKGTgJJ4z1keEAdBVqVHxvHLRd0eqSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AP JdIMGIzM3wsZTVKMFUrULFildutgyG4TR1qrgLNt7Q4tj27IAtZj+G2bYu9lsaxbcdahEGDv Urd4n/0RBodMbS32TeDt36hmOLLtSf6Q54JUq218OZwh1+ezXBVDwcZPWZXutHg1BT4AYgGb RVJpGx+9sDe6XBHUPHkRCfon16dnycVXsd3H999tRCs07H9tlPx6nc/chZNb9kvtckTTDMs1 0OUk96BOQGDoIF5WlrGqO7K8Gra1Tw9aDZbOHRaFVdtD8zL/dlr5i8jWOqPB0JcYjfdPTjri w6HoyEl71n4pZ5ajv7rlbwrbt/Fm3QocuLXzliNNo5GxlkgDGJAW2BPwQKFhcus1K7DEjG8U IEswqByFtwmA5CXjzCqS+4QBryv7PvtGGSC3QIwT8l8qmz0oCTLkWVsDNZWfhkBDyr5UWWxP B+7Vf15uPe/w0dGnYcoOtnsWqzGPIDrFMj/V+C8Uza9SsMZSeNzxwk3PRT49zm0yCAEyPhjU b/GIZfEJStLUsxPkWvpL9rxJJd2n0jSM0uIHsulp/lmuJLDDEOopUAtbgffMLBhtPncyOgXm v4GX/a3J9xkeLWWSkHqHUQ7dzjm9FA3WsL7rdJ5bOmGLlY0EW0tEaaJk7ggZ5Zkj+JekeKRp iOxXUpRyVzeg3zbKFrVNiA/Oe23BZsv/2gmOSEMPEqz3yRxa4iY86pCJYA8eqMq9bI/wKcsH eUFYciJHt9GVi/Dp2YGdZD4oYE7LEariAuCMjCLej86e5I8FQXF9sW9Jlnk9TUUDzrxvsw7+ uXy2gTeSJsFZgJjEMeJN67/kwLv5SAQwbsgUVHJL99ffFTX3LJrcyGh3OUqJ8wsKAnYwmfI3 QihHhpF9/LGpJU48YeViPnc/ZupCeZ3AmFTA3LfseStLSDf82eund1AXeKPcWyPXW/44vz/N +BczvW6O/wbhlda9YF7Fu8zn6454tLuoZ5czxhlQyqXPwj6VOs4LynUx9RLu41M2qRd6Fm/V U+489VHPamEZZH+G1kLKQt5NumO2Jn4QNUJASjZ9Kki2BJKwQ== IronPort-HdrOrdr: A9a23:6W+QAq9A7d3sZRss+UNuk+DcI+orL9Y04lQ7vn2ZLiYlFfBw9v re+MjzsCWetN9/Yh0dcLy7V5VoIkm9yXcW2+cs1N6ZNWGN1VdAR7sC0aLShxHmBi3i5qp8+M 5bAs1D4QTLfDtHZBDBkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63591047" From: Andrew Cooper To: Xen-devel CC: Juergen Gross Subject: [PATCH v2 05/70] x86: Don't use the hypercall table for calling compat hypercalls Date: Mon, 14 Feb 2022 12:50:22 +0000 Message-ID: <20220214125127.17985-6-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 From: Juergen Gross Today the *_op_compat hypercalls call the modern handler functions by using the entries from the hypercall table. This is resulting in a not needed indirect function call which can be avoided by using the correct handler function directly. This is basically a revert of commit 1252e282311734 ("86/pv: Export pv_hypercall_table[] rather than working around it in several ways"), which reasoning no longer applies, as shim no longer modifies the hypercall table. The hypercall table can now be made static as there is no external reference to it any longer. Commit 834cb8761051f7 ("x86/PV32: fix physdev_op_compat handling") can be reverted, too, as using the direct call of the correct handler is already handled fine without that patch. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich --- xen/arch/x86/compat.c | 14 ++++---------- xen/arch/x86/include/asm/hypercall.h | 8 -------- xen/arch/x86/pv/hypercall.c | 9 ++++++++- xen/arch/x86/x86_64/compat.c | 1 - 4 files changed, 12 insertions(+), 20 deletions(-) diff --git a/xen/arch/x86/compat.c b/xen/arch/x86/compat.c index 58b202f701d5..939b449dec29 100644 --- a/xen/arch/x86/compat.c +++ b/xen/arch/x86/compat.c @@ -17,14 +17,12 @@ typedef long ret_t; /* Legacy hypercall (as of 0x00030202). */ ret_t do_physdev_op_compat(XEN_GUEST_HANDLE_PARAM(physdev_op_t) uop) { - typeof(do_physdev_op) *fn = - (void *)pv_hypercall_table[__HYPERVISOR_physdev_op].native; struct physdev_op op; if ( unlikely(copy_from_guest(&op, uop, 1) != 0) ) return -EFAULT; - return fn(op.cmd, guest_handle_from_ptr(&uop.p->u, void)); + return do_physdev_op(op.cmd, guest_handle_from_ptr(&uop.p->u, void)); } #ifndef COMPAT @@ -32,14 +30,11 @@ ret_t do_physdev_op_compat(XEN_GUEST_HANDLE_PARAM(physdev_op_t) uop) /* Legacy hypercall (as of 0x00030101). */ long do_sched_op_compat(int cmd, unsigned long arg) { - typeof(do_sched_op) *fn = - (void *)pv_hypercall_table[__HYPERVISOR_sched_op].native; - switch ( cmd ) { case SCHEDOP_yield: case SCHEDOP_block: - return fn(cmd, guest_handle_from_ptr(NULL, void)); + return do_sched_op(cmd, guest_handle_from_ptr(NULL, void)); case SCHEDOP_shutdown: TRACE_3D(TRC_SCHED_SHUTDOWN, @@ -57,8 +52,6 @@ long do_sched_op_compat(int cmd, unsigned long arg) /* Legacy hypercall (as of 0x00030202). */ long do_event_channel_op_compat(XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop) { - typeof(do_event_channel_op) *fn = - (void *)pv_hypercall_table[__HYPERVISOR_event_channel_op].native; struct evtchn_op op; if ( unlikely(copy_from_guest(&op, uop, 1) != 0) ) @@ -76,7 +69,8 @@ long do_event_channel_op_compat(XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop) case EVTCHNOP_bind_ipi: case EVTCHNOP_bind_vcpu: case EVTCHNOP_unmask: - return fn(op.cmd, guest_handle_from_ptr(&uop.p->u, void)); + return do_event_channel_op(op.cmd, + guest_handle_from_ptr(&uop.p->u, void)); default: return -ENOSYS; diff --git a/xen/arch/x86/include/asm/hypercall.h b/xen/arch/x86/include/asm/hypercall.h index f004824f16b6..eb3aed3bf70e 100644 --- a/xen/arch/x86/include/asm/hypercall.h +++ b/xen/arch/x86/include/asm/hypercall.h @@ -16,13 +16,6 @@ typedef unsigned long hypercall_fn_t( unsigned long, unsigned long); typedef struct { - hypercall_fn_t *native; -#ifdef CONFIG_PV32 - hypercall_fn_t *compat; -#endif -} pv_hypercall_table_t; - -typedef struct { uint8_t native; #ifdef CONFIG_COMPAT uint8_t compat; @@ -32,7 +25,6 @@ typedef struct { extern const hypercall_args_t hypercall_args_table[NR_hypercalls]; #ifdef CONFIG_PV -extern const pv_hypercall_table_t pv_hypercall_table[]; void pv_hypercall(struct cpu_user_regs *regs); #endif diff --git a/xen/arch/x86/pv/hypercall.c b/xen/arch/x86/pv/hypercall.c index 50cd219c18fc..e8fbee7bbbc0 100644 --- a/xen/arch/x86/pv/hypercall.c +++ b/xen/arch/x86/pv/hypercall.c @@ -27,6 +27,13 @@ #include #include +typedef struct { + hypercall_fn_t *native; +#ifdef CONFIG_PV32 + hypercall_fn_t *compat; +#endif +} pv_hypercall_table_t; + #ifdef CONFIG_PV32 #define HYPERCALL(x) \ [ __HYPERVISOR_ ## x ] = { (hypercall_fn_t *) do_ ## x, \ @@ -42,7 +49,7 @@ #define do_arch_1 paging_domctl_continuation -const pv_hypercall_table_t pv_hypercall_table[] = { +static const pv_hypercall_table_t pv_hypercall_table[] = { COMPAT_CALL(set_trap_table), HYPERCALL(mmu_update), COMPAT_CALL(set_gdt), diff --git a/xen/arch/x86/x86_64/compat.c b/xen/arch/x86/x86_64/compat.c index fcbc1cc0d780..0e4c71f2aa17 100644 --- a/xen/arch/x86/x86_64/compat.c +++ b/xen/arch/x86/x86_64/compat.c @@ -12,7 +12,6 @@ EMIT_FILE; #define physdev_op_t physdev_op_compat_t #define do_physdev_op compat_physdev_op #define do_physdev_op_compat(x) compat_physdev_op_compat(_##x) -#define native compat #define COMPAT #define _XEN_GUEST_HANDLE(t) XEN_GUEST_HANDLE(t) From patchwork Mon Feb 14 12:50:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745524 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C210EC433EF for ; Mon, 14 Feb 2022 12:52:13 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271506.466015 (Exim 4.92) (envelope-from ) id 1nJapn-0005b4-5T; Mon, 14 Feb 2022 12:52:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271506.466015; Mon, 14 Feb 2022 12:52:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapn-0005ap-1x; Mon, 14 Feb 2022 12:52:03 +0000 Received: by outflank-mailman (input) for mailman id 271506; Mon, 14 Feb 2022 12:52:01 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapl-0003jd-8V for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:52:01 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id e4836a4a-8d94-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 13:51:59 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e4836a4a-8d94-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843119; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9InvRPHFIdzqh83XB2chSO1PILFwtwPb/Bgms+iLNm0=; b=N3ylDT5YZGajxf+RzUwGQFQ14Xnu7T1R0wE+Sfd9he4MAESlqNtsyPbM ut/wOFYnulKp17KRJlj/lDpwoo0DIQ81AWbXrVwWxxNdADjdPnzkYALbt DXXrJ84XQr8GDB/24G9Nakwra+IA1TWiLMIfzSKl5JVelikWEIqKp+kVb 4=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 6UWwk60Ynj3vZcjN/RSwXI0H3ofMc4YpZw3PGz2Ob2ypecmVK4fAByPgTJqiGSoYvZQ5jTI0eH bqMCvBvJqSWO5eo3ke5Ox0DZWILx6+iC/d+kG48fQeIXqLqAsChUY8BS2Q91zEQFzpKcLTNEBi fc8lLYzSV9QMqQdGUp9ELd5+wItaaaJdjpiyPYmAsYrhCY0gLZb1rxOesKJqulwkNNhql05YTN JD+9ZRGBrrTEroh/lN60PHSfaMVXasArKdTcoAyyAQu+5BRz4buWpGnORTRI7IUnBkPM3yWOAJ 5BT5zpVoT8tUbh3c72eKWH+o X-SBRS: 5.1 X-MesageID: 64148330 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:MUR3G6B+1aXM/xVW/xbkw5YqxClBgxIJ4kV8jS/XYbTApDgm0mYPm 2scWm+HbK2KMzfwLtt1PIq/80NVu8TXx9IwQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/0BLRgPtQk PN0mbOPRggRA4jJsuEGXEwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgG5s1psVRZ4yY eITSAhCVi/4TSZdIwkcD50Bns2smzrwJmgwRFW9+vNsvjm7IBZK+KfpGMrYfJqNX8o9tmSyq 3/C/m/5KgoHL9HZwj2Amlq8i+mKkS7lVYY6ELyj6uUskFCV3nYUChAdSR28u/bRt6Klc4sBc QpOoHNo9PVsshzwJjXgY/GmiCWj5gE3eoJ2KsEV1w6C8pfx5iycHWdRG1atd+canMMxQDUr0 HqAkNXoGSFjvdWpdJ6NyluHhWjsYHZIdAfucQdBFFJYuIe7/OnfmzqSFo4LLUKjsjHi9dgcK RiupTN2ubgchNVjO06TrQGe2GLESnQko2cICuTrsoCNs1kRiG2NPdXABb3nARFodtjxc7V5l CJY8/VyFchXZX13qASDQf8WAJai7OufPTvXjDZHRsd9q2v9qyP+JdkLulmSwXuF1e5eJ1fUj LL741sNtPe/wlP2BUOIX25BI5tzlvWxfTgUfvvVcsBPcvBMmPyvp0lTibqr9zm1yiAEyPhnU b/CKJrEJStKWMxPkWvtL89AgOBD+8zL7T6KLXwN50/8iuT2ib/8YeptDWZimchnsPLa8F2Nq Y432gnj40w3bdASqxL/qeY7RW3m51BhbXwvg8AIJOOFPCR8H2QtV63Yzb87ItQ3lKVJjObYu Hq6XxYAmlb4gHTGLySMa2xiN+yzDcou8ypjMHx+J0us1lgifZ2rsPUVeawocOR17+dk1/N1E aUIIp3SHvRVRz3b0D0Bdp2h/pd6fRGmiFvWbSqoaTQyZbB6QAnN9oO2dwfj7nBWXCG2qdE/s /ur0QaCGcgPQAFrDcD3bvOzzgzu4ShBybwqB0aRe4tdYkTh9oRuOhfdtP5vLpFeMwjHyxuby x2SXUUSq97SrtJn69LOn62F8dukSrMsAkpAEmDHxr+qLi2GrHG7yIpNXevULzDQUGT4pPera elPlqyuNfQGmBBBspZmEqYtxqU7voO9q7hfxwViPXPKc1X0Ve8wfijYhZFC5v9X27tUmQqqQ UbeqNBVNIKANN7hDFNMdhEuaf6O1K1MlzTfhRjvzJ4WOMOjEGK7bHhv IronPort-HdrOrdr: A9a23:J5ECuKOSIEHWEMBcTsWjsMiBIKoaSvp037BN7TEXdfU1SL39qy nKpp8mPHDP5Ar5NEtOpTniAsm9qBHnm6KdiLN5Vd3OYOCMggqVBbAnwYz+wyDxXw3Sn9QtsJ uIqpIOa+EY22IK7/rH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64148330" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 06/70] x86: Introduce support for CET-IBT Date: Mon, 14 Feb 2022 12:50:23 +0000 Message-ID: <20220214125127.17985-7-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 CET Indirect Branch Tracking is a hardware feature designed to provide forward-edge control flow integrity, protecting against jump/call oriented programming. IBT requires the placement of ENDBR{32,64} instructions at the target of every indirect call/jmp, and every entrypoint. However, the default -fcf-protection=branch places an ENDBR on every function which far more than necessary, and reduces the quantity of protection afforded. Therefore, we use manual placement using the cf_check attribute. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu Clang/LLVM support for -mmanual-endbr is in progress: https://reviews.llvm.org/D118355 v2: * Correct CONFIG_HAS_CC_CET_IBT to CONFIG_XEN_IBT in some places * Move cf_check compatibility into tools/tests/x86_emulator/x86-emulate.h --- Config.mk | 1 - tools/firmware/Makefile | 2 ++ tools/libs/guest/xg_dom_decompress_unsafe.h | 2 ++ tools/tests/x86_emulator/x86-emulate.h | 2 ++ xen/arch/x86/Kconfig | 17 +++++++++++++++++ xen/arch/x86/arch.mk | 6 ++++++ xen/arch/x86/include/asm/asm-defns.h | 6 ++++++ xen/arch/x86/include/asm/cpufeature.h | 1 + xen/arch/x86/include/asm/cpufeatures.h | 1 + xen/include/xen/compiler.h | 6 ++++++ 10 files changed, 43 insertions(+), 1 deletion(-) diff --git a/Config.mk b/Config.mk index 95c053212ec3..f56f7dc33468 100644 --- a/Config.mk +++ b/Config.mk @@ -190,7 +190,6 @@ APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i)) EMBEDDED_EXTRA_CFLAGS := -nopie -fno-stack-protector -fno-stack-protector-all EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables -EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none XEN_EXTFILES_URL ?= http://xenbits.xen.org/xen-extfiles # All the files at that location were downloaded from elsewhere on diff --git a/tools/firmware/Makefile b/tools/firmware/Makefile index 345037b93b7f..53ed4f161edb 100644 --- a/tools/firmware/Makefile +++ b/tools/firmware/Makefile @@ -6,6 +6,8 @@ TARGET := hvmloader/hvmloader INST_DIR := $(DESTDIR)$(XENFIRMWAREDIR) DEBG_DIR := $(DESTDIR)$(DEBUG_DIR)$(XENFIRMWAREDIR) +EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none + SUBDIRS-y := SUBDIRS-$(CONFIG_OVMF) += ovmf-dir SUBDIRS-$(CONFIG_SEABIOS) += seabios-dir diff --git a/tools/libs/guest/xg_dom_decompress_unsafe.h b/tools/libs/guest/xg_dom_decompress_unsafe.h index 4e0bf23aa587..3bce0cfefb88 100644 --- a/tools/libs/guest/xg_dom_decompress_unsafe.h +++ b/tools/libs/guest/xg_dom_decompress_unsafe.h @@ -8,6 +8,8 @@ typedef int decompress_fn(unsigned char *inbuf, unsigned int len, void (*error)(const char *x)); #endif +#define cf_check + int xc_dom_decompress_unsafe( decompress_fn fn, struct xc_dom_image *dom, void **blob, size_t *size) __attribute__((visibility("internal"))); diff --git a/tools/tests/x86_emulator/x86-emulate.h b/tools/tests/x86_emulator/x86-emulate.h index 7f60ef9e89ba..c6819a417d05 100644 --- a/tools/tests/x86_emulator/x86-emulate.h +++ b/tools/tests/x86_emulator/x86-emulate.h @@ -54,6 +54,8 @@ #define likely(x) __builtin_expect(!!(x), true) #define unlikely(x) __builtin_expect(!!(x), false) +#define cf_check + #define container_of(ptr, type, member) ({ \ typeof(((type *)0)->member) *mptr__ = (ptr); \ (type *)((char *)mptr__ - offsetof(type, member)); \ diff --git a/xen/arch/x86/Kconfig b/xen/arch/x86/Kconfig index b4abfca46f6a..8b7ad0145b29 100644 --- a/xen/arch/x86/Kconfig +++ b/xen/arch/x86/Kconfig @@ -39,6 +39,11 @@ config HAS_AS_CET_SS # binutils >= 2.29 or LLVM >= 6 def_bool $(as-instr,wrssq %rax$(comma)0;setssbsy) +config HAS_CC_CET_IBT + # GCC >= 9 and binutils >= 2.29 + # Retpoline check to work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93654 + def_bool $(cc-option,-fcf-protection=branch -mmanual-endbr -mindirect-branch=thunk-extern) && $(as-instr,endbr64) + menu "Architecture Features" source "arch/Kconfig" @@ -124,6 +129,18 @@ config XEN_SHSTK When CET-SS is active, 32bit PV guests cannot be used. Backwards compatiblity can be provided via the PV Shim mechanism. +config XEN_IBT + bool "Supervisor Indirect Branch Tracking" + depends on HAS_CC_CET_IBT + default y + help + Control-flow Enforcement Technology (CET) is a set of features in + hardware designed to combat Return-oriented Programming (ROP, also + call/jump COP/JOP) attacks. Indirect Branch Tracking is one CET + feature designed to provide function pointer protection. + + This option arranges for Xen to use CET-IBT for its own protection. + config SHADOW_PAGING bool "Shadow Paging" default !PV_SHIM_EXCLUSIVE diff --git a/xen/arch/x86/arch.mk b/xen/arch/x86/arch.mk index fa7cf3844362..8b88f0240e85 100644 --- a/xen/arch/x86/arch.mk +++ b/xen/arch/x86/arch.mk @@ -47,6 +47,12 @@ CFLAGS-$(CONFIG_INDIRECT_THUNK) += -mindirect-branch=thunk-extern CFLAGS-$(CONFIG_INDIRECT_THUNK) += -mindirect-branch-register CFLAGS-$(CONFIG_INDIRECT_THUNK) += -fno-jump-tables +ifdef CONFIG_XEN_IBT +CFLAGS += -fcf-protection=branch -mmanual-endbr +else +$(call cc-option-add,CFLAGS,CC,-fcf-protection=none) +endif + # If supported by the compiler, reduce stack alignment to 8 bytes. But allow # this to be overridden elsewhere. $(call cc-option-add,CFLAGS_stack_boundary,CC,-mpreferred-stack-boundary=3) diff --git a/xen/arch/x86/include/asm/asm-defns.h b/xen/arch/x86/include/asm/asm-defns.h index 505f39ad5f76..8bd9007731d5 100644 --- a/xen/arch/x86/include/asm/asm-defns.h +++ b/xen/arch/x86/include/asm/asm-defns.h @@ -57,6 +57,12 @@ INDIRECT_BRANCH jmp \arg .endm +#ifdef CONFIG_XEN_IBT +# define ENDBR64 endbr64 +#else +# define ENDBR64 +#endif + .macro guest_access_mask_ptr ptr:req, scratch1:req, scratch2:req #if defined(CONFIG_SPECULATIVE_HARDEN_GUEST_ACCESS) /* diff --git a/xen/arch/x86/include/asm/cpufeature.h b/xen/arch/x86/include/asm/cpufeature.h index a0ab6d7d78ea..f2c6f255ace9 100644 --- a/xen/arch/x86/include/asm/cpufeature.h +++ b/xen/arch/x86/include/asm/cpufeature.h @@ -152,6 +152,7 @@ #define cpu_has_nscb boot_cpu_has(X86_FEATURE_NSCB) #define cpu_has_xen_lbr boot_cpu_has(X86_FEATURE_XEN_LBR) #define cpu_has_xen_shstk boot_cpu_has(X86_FEATURE_XEN_SHSTK) +#define cpu_has_xen_ibt boot_cpu_has(X86_FEATURE_XEN_IBT) #define cpu_has_msr_tsc_aux (cpu_has_rdtscp || cpu_has_rdpid) diff --git a/xen/arch/x86/include/asm/cpufeatures.h b/xen/arch/x86/include/asm/cpufeatures.h index b10154fc44bb..7413febd7ad8 100644 --- a/xen/arch/x86/include/asm/cpufeatures.h +++ b/xen/arch/x86/include/asm/cpufeatures.h @@ -39,6 +39,7 @@ XEN_CPUFEATURE(SC_VERW_PV, X86_SYNTH(23)) /* VERW used by Xen for PV */ XEN_CPUFEATURE(SC_VERW_HVM, X86_SYNTH(24)) /* VERW used by Xen for HVM */ XEN_CPUFEATURE(SC_VERW_IDLE, X86_SYNTH(25)) /* VERW used by Xen for idle */ XEN_CPUFEATURE(XEN_SHSTK, X86_SYNTH(26)) /* Xen uses CET Shadow Stacks */ +XEN_CPUFEATURE(XEN_IBT, X86_SYNTH(27)) /* Xen uses CET Indirect Branch Tracking */ /* Bug words follow the synthetic words. */ #define X86_NR_BUG 1 diff --git a/xen/include/xen/compiler.h b/xen/include/xen/compiler.h index 696c7eb89e4c..933aec09a92d 100644 --- a/xen/include/xen/compiler.h +++ b/xen/include/xen/compiler.h @@ -37,6 +37,12 @@ # define nocall #endif +#ifdef CONFIG_XEN_IBT +# define cf_check __attribute__((__cf_check__)) +#else +# define cf_check +#endif + #if (!defined(__clang__) && (__GNUC__ == 4) && (__GNUC_MINOR__ < 5)) #define unreachable() do {} while (1) #else From patchwork Mon Feb 14 12:50:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745526 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3530FC433EF for ; Mon, 14 Feb 2022 12:52:18 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271509.466038 (Exim 4.92) (envelope-from ) id 1nJapr-0006Ny-Bx; Mon, 14 Feb 2022 12:52:07 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271509.466038; Mon, 14 Feb 2022 12:52:07 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapr-0006NK-43; Mon, 14 Feb 2022 12:52:07 +0000 Received: by outflank-mailman (input) for mailman id 271509; Mon, 14 Feb 2022 12:52:05 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapp-0003jk-Hz for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:52:05 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e7d49223-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:52:04 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e7d49223-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843124; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=oxJaFnzRqRx4KksSzKdm9U/GeHdsnrwelajX2UNO1Ws=; b=QWiTa+KJGTp3Ol0d5YAtgCRtnzxPfBUgVnXUp5JZwSnWb2U/p7g3NX6B dABX5IFCTBNC4kF72yyLtowF/AuG0EQEzWCdxAOEQtsCOMMHGecoFecF2 1wWbTv3SS5NIvDr/iNK9Bvq0z7/F7JflbgTTiCa+HydrPjn0nY2QPbKCI c=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: xsBF8hEax4w9v1BBDx5lBacOYqJkw1ZtbWPKGqe3M74rDPMUYHUwo4NUX65uOjv8NjT9PxHecG cSMSVGRJWv5YkhU0C9cZNM5hkj+toofGDFUNpWrnO6cYIxpSzEDVhndGhBoBkFVMUZOB2m+2sK /M8Yo/4460TajJqgOsVrwt63Kiu89raAL5mQP/4TbkCJN6t7Ou/EAEhX1htranQBAxyk2R0BVP YO6qkiNL1+cfeFYDuDnwxZUCNLx+4ZsrauR6dfviqssZeCB8y1OyWYqwfgHKBGiVIDkiiFpNfS 1RFlJboZXgXCy7EAi/DR8PoE X-SBRS: 5.1 X-MesageID: 64553121 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:nJyemqk0CKoYXB36bu28rk7o5gy/IURdPkR7XQ2eYbSJt1+Wr1Gzt xIaDWrVb66JYGX0c4sgbd/i900HsZPUyYUwQFM4rC9mHyMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 Ndykq2vTUArB47nsc46Dl5nKHtbOYQTrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qDO pFAM2MHgBLoODhNZVUXE70Hoeb3uVr5Ly9VugmZqv9ii4TU5FMoi+W8WDbPQfSPTN9Ql1yVp UrH+Xr4GRAQMNGDyTuD/Wmoj+WJliT+MKoCGbv9+vN0jVm7wm0IFAZQRVa9ueO+iEO1R5RYM UN8x8Y1hfFsrgrxFIC7BkDm5i7f1vIBZzZOO+8FzzCSzu3W2iWyL0IjE3l+U4YDsOZjEFTGy WS1t9/uADVutpicRnSc6qqYoFuOBMQFEYMRTXRaFFVYurEPtKl210uSFYg7TMZZm/WoQWmY/ tyckMQpa1z/Z+Yv3r7zw13IiinESnPhHl9svVW/so5IA2pEiG+Zi26AtAKzARVodt/xory9U J8swZb20Qz2JcvR/BFhuc1UdF1T296LMSfHnXlkFIQ7+jKm9haLJN4MvG4udBo0ap9fI1cFh XM/XisLuvdu0IaCN/crM+pd9ex2pUQfKTgVfq+NNYcfCnSAXASG4DtvdSatM5PFyyARfVUEE c7DK66EVC9CYYw+lWbeb7pNgNcDm3FlrUuOFM+T8vhS+efHDJJjYexeawXmgyFQxP7snTg5B P4Ba5XUm08CDIUToED/qOYuELzDFlBjbbieliCdXrXrztNOFD5zBvnP76kmfoA5za1Zmv2Rp iO2W1NCyUq5jnrCcF3YZndmYbLpfJB+sXNkYnB8YQf2gyAuMdS18aMSV5orZr17puZt+uF5E qsecMKaD/URFjmeo2YBbYPwpZBJfQiwgV7cJDKsZTUyJsYyRwHA9tL+UBHo8S0CUni+ucck+ uXy3QLHW5sTAQ9lCZ+OOv6oylqwu1kbmf5zABSUcoUCJh20/dEzeSLrj/IxL8UdEjn5x2OXh 1SMHBMVhejRuItpotPHsr+J8tWyGOxkE0sEQ2SCteSqNTPX93aIyJNbVLraZijUUW759fnwZ ehRyP2gYvQLkEwT7th5Grdvi6k/+8Hut/lRyQE9RCfHaFGiC7VBJHia3JYQ6v0Rl+EB4QbmC FiS/tR6OKmSPJK3GVEcEwMpc+Cf2KxGgTLV9/k0fB336SIfEGBriqmO081gUBBgEYY= IronPort-HdrOrdr: A9a23:70og06kttIZ1SWNHzmotKXlgjgDpDfIf3DAbv31ZSRFFG/Fwwf re5cjztCWE7Qr4Ohkb8+xoXZPsfZqyz/JICOUqUotKPzOW2ldATrsD0WK4+UyHJ8SWzIc0vp uIFZIRNDSaNykYsS+V2miF+3lL+qj+zEgF792uq0uE7GtRGsZd0zs= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64553121" From: Andrew Cooper To: Xen-devel CC: =?utf-8?q?Marek_Marczykowski-G=C3=B3recki?= , Andrew Cooper Subject: [PATCH v2 07/70] x86: Build check for embedded endbr64 instructions Date: Mon, 14 Feb 2022 12:50:24 +0000 Message-ID: <20220214125127.17985-8-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 From: Marek Marczykowski-Górecki Embedded endbr64 instructions mark legal indirect branches as far as the CPU is concerned, which aren't legal as far as the logic is concerned. When CET-IBT is active, check for embedded byte sequences. Example failures look like: Fail: Found 2 embedded endbr64 instructions 0xffff82d040325677: test_endbr64 at /local/xen.git/xen/arch/x86/x86_64/entry.S:28 0xffff82d040352da6: init_done at /local/xen.git/xen/arch/x86/setup.c:675 Signed-off-by: Marek Marczykowski-Górecki Signed-off-by: Andrew Cooper --- v2: * New --- xen/arch/x86/Makefile | 3 ++ xen/tools/check-endbr.sh | 76 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100755 xen/tools/check-endbr.sh diff --git a/xen/arch/x86/Makefile b/xen/arch/x86/Makefile index 9fc884813cb5..f15a984aacc2 100644 --- a/xen/arch/x86/Makefile +++ b/xen/arch/x86/Makefile @@ -155,6 +155,9 @@ $(TARGET)-syms: prelink.o xen.lds $(MAKE) -f $(BASEDIR)/Rules.mk $(@D)/.$(@F).1.o $(LD) $(XEN_LDFLAGS) -T xen.lds -N prelink.o $(build_id_linker) \ $(@D)/.$(@F).1.o -o $@ +ifeq ($(CONFIG_XEN_IBT),y) + $(SHELL) $(BASEDIR)/tools/check-endbr.sh $@ +endif $(NM) -pa --format=sysv $(@D)/$(@F) \ | $(BASEDIR)/tools/symbols --all-symbols --xensyms --sysv --sort \ >$(@D)/$(@F).map diff --git a/xen/tools/check-endbr.sh b/xen/tools/check-endbr.sh new file mode 100755 index 000000000000..3d96e02bdf93 --- /dev/null +++ b/xen/tools/check-endbr.sh @@ -0,0 +1,76 @@ +#!/bin/sh + +# +# Usage ./$0 xen-syms +# + +set -e + +OBJCOPY="${OBJCOPY:-objcopy} -j .text $1" +OBJDUMP="${OBJDUMP:-objdump} -j .text $1" + +D=$(mktemp -d) +trap "rm -rf $D" EXIT + +TEXT_BIN=$D/xen-syms.text +VALID=$D/valid-addrs +ALL=$D/all-addrs +BAD=$D/bad-addrs + +# +# First, look for all the valid endbr64 instructions. +# A worst-case disassembly, viewed through cat -A, may look like: +# +# ffff82d040337bd4 :$ +# ffff82d040337bd4:^If3 0f 1e fa ^Iendbr64 $ +# ffff82d040337bd8:^Ieb fe ^Ijmp ffff82d040337bd8 $ +# ffff82d040337bda:^Ib8 f3 0f 1e fa ^Imov $0xfa1e0ff3,%eax$ +# +# Want to grab the address of endbr64 instructions only, ignoring function +# names/jump labels/etc, so look for 'endbr64' preceeded by a tab and with any +# number of trailing spaces before the end of the line. +# +${OBJDUMP} -d | grep ' endbr64 *$' | cut -f 1 -d ':' > $VALID & + +# +# Second, look for any endbr64 byte sequence +# This has a couple of complications: +# +# 1) Grep binary search isn't VMA aware. Copy .text out as binary, causing +# the grep offset to be from the start of .text. +# +# 2) AWK can't add 64bit integers, because internally all numbers are doubles. +# When the upper bits are set, the exponents worth of precision is lost in +# the lower bits, rounding integers to the nearest 4k. +# +# Instead, use the fact that Xen's .text is within a 1G aligned region, and +# split the VMA in half so AWK's numeric addition is only working on 32 bit +# numbers, which don't lose precision. +# +eval $(${OBJDUMP} -h | awk '$2 == ".text" {printf "vma_hi=%s\nvma_lo=%s\n", substr($4, 1, 8), substr($4, 9, 16)}') + +${OBJCOPY} -O binary $TEXT_BIN +grep -aob "$(printf '\363\17\36\372')" $TEXT_BIN | + awk -F':' '{printf "%s%x\n", "'$vma_hi'", strtonum(0x'$vma_lo') + $1}' > $ALL + +# Wait for $VALID to become complete +wait + +# Sanity check $VALID and $ALL, in case the string parsing bitrots +val_sz=$(stat -c '%s' $VALID) +all_sz=$(stat -c '%s' $ALL) +[ "$val_sz" -eq 0 ] && { echo "Error: Empty valid-addrs" >&2; exit 1; } +[ "$all_sz" -eq 0 ] && { echo "Error: Empty all-addrs" >&2; exit 1; } +[ "$all_sz" -lt "$val_sz" ] && { echo "Error: More valid-addrs than all-addrs" >&2; exit 1; } + +# $BAD = $ALL - $VALID +join -v 2 $VALID $ALL > $BAD +nr_bad=$(wc -l < $BAD) + +# Success +[ "$nr_bad" -eq 0 ] && exit 0 + +# Failure +echo "Fail: Found ${nr_bad} embedded endbr64 instructions" >&2 +addr2line -afip -e $1 < $BAD >&2 +exit 1 From patchwork Mon Feb 14 12:50:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745525 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8E391C433F5 for ; Mon, 14 Feb 2022 12:52:14 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271507.466020 (Exim 4.92) (envelope-from ) id 1nJapn-0005fS-Pe; Mon, 14 Feb 2022 12:52:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271507.466020; Mon, 14 Feb 2022 12:52:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapn-0005dd-Df; Mon, 14 Feb 2022 12:52:03 +0000 Received: by outflank-mailman (input) for mailman id 271507; Mon, 14 Feb 2022 12:52:02 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapl-0003jk-Kh for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:52:01 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e4ac43fb-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:51:58 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e4ac43fb-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843118; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=LDFys9qkWZQwimW2LVFGkIq2g5umxCHwhtWsKzFzSd8=; b=GTe66ceLkHNYQ6GDecdgKbd7CynQeAaI4UA35WnamC2l2rs9wH8uPM40 9pzUloFcuBN+rhdJKy6qacNQzfOvXLssz0FFHVSawxGn0Rf0gWeq6Ycx7 tWS4k0jwDtfYzeRYg1XZ1HAvbEf3RHcRlWiogMw5Y4eZWbVRTml2Il5R8 s=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: oPRjvKs0pPrCMLv66khxI8jrMLdUSvMEhCYgCdFBfWfwtzmJlUVZnGGr5MPCtIjwqdh+e/snZO pozZIg8KlLawPZMHZ4/Y3naBq795WABEYAAYdGwVwlVZGAhbibsIuGZnUrYSrq+UAwFHoTeFNu +8Wz2REqp7obneg1RjfW4+L8MHLz4ybD0Texd+/5SVWgXXK7uWrUViR2drHMJ/Cg3PnogzXP8V 9SBQK3yI1dH/SjstRp8zFTdfvI02QS1/FYc+eMFCWcVv9S+qaH5YXTwfZjlvZewG2jUj+lRIJm CNGcx8dJbScEfDZSkQuwJwND X-SBRS: 5.1 X-MesageID: 64048979 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:0RL5e6+cYBGhNKtWBEapDrUDnnmTJUtcMsCJ2f8bNWPcYEJGY0x3n 2ZMXzuHPv+JZTagf9okbd7g800D6JXVyodqTVA+qnw8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPhql utSl7GaGDsFN/zvwac7ehdDHwxHaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SRaqON pVIAdZpRAj/aFoUO2gqNJ4Roe7ypFL0bmdorl3A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9Gi1HChef91e nA483sN9OsU3UKwQvTECkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+m05K v5TaJmHzQtxSur7bnWF+IIfNwlSf3M6GYr3u4pccevaelhqH2QoCvnwx7I9etM6w/QJx7mQp nztCFVFzFffhGHcLVnYYH5Ud76yD410qmg2PHJwMA/wiWQje4um8IwWa4AzIes87OVmwPMtF 6sFdsyMD+5hUDPC/zhBP5DxoJY7LEaghB6UPjrjaz86JsYySwvM897iXw3u6ChRUXbn6Zpg+ +Wtj1qJT4ACSgJuCNftRMiul17h72IAnO9SXlfTJoUBckvb74U3eTf6ieU6Ip9QJEyblCeaz QufHTwRufLJ/90u6NDMiK2J89WpHu95EhYIFmXX9+/rZyzT/27lyo5cSueYOzvaUTqsqqmlY OxUydD6MeEGwwkW49YtTe4zwPJs/cbrqp9b0h9gTSfCYFmcA799JmWLgJtUvapXy74F4Qa7V ypjIDWB1Wll7C89LGMsGQ== IronPort-HdrOrdr: A9a23:ky84r66UKIx0ubM9kQPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64048979" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 08/70] xen: CFI hardening for x86 hypercalls Date: Mon, 14 Feb 2022 12:50:25 +0000 Message-ID: <20220214125127.17985-9-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/compat.c | 7 ++-- xen/arch/x86/cpu/mcheck/mce.c | 2 +- xen/arch/x86/cpu/vpmu.c | 3 +- xen/arch/x86/hvm/dm.c | 5 ++- xen/arch/x86/hvm/hvm.c | 2 +- xen/arch/x86/hvm/hypercall.c | 5 +-- xen/arch/x86/include/asm/hypercall.h | 69 +++++++++++++++++++----------------- xen/arch/x86/include/asm/paging.h | 2 +- xen/arch/x86/mm.c | 23 ++++++------ xen/arch/x86/mm/paging.c | 3 +- xen/arch/x86/physdev.c | 2 +- xen/arch/x86/platform_hypercall.c | 3 +- xen/arch/x86/pv/callback.c | 25 +++++++------ xen/arch/x86/pv/descriptor-tables.c | 14 ++++---- xen/arch/x86/pv/iret.c | 4 +-- xen/arch/x86/pv/misc-hypercalls.c | 10 +++--- xen/arch/x86/pv/shim.c | 8 ++--- xen/arch/x86/x86_64/compat/mm.c | 7 ++-- xen/common/argo.c | 4 +-- xen/common/compat/domain.c | 3 +- xen/common/compat/grant_table.c | 5 ++- xen/common/compat/kernel.c | 2 +- xen/common/compat/memory.c | 3 +- xen/common/dm.c | 6 ++-- xen/common/domain.c | 5 +-- xen/common/domctl.c | 2 +- xen/common/event_channel.c | 2 +- xen/common/grant_table.c | 2 +- xen/common/hypfs.c | 6 ++-- xen/common/kernel.c | 2 +- xen/common/kexec.c | 4 +-- xen/common/memory.c | 2 +- xen/common/multicall.c | 2 +- xen/common/sched/compat.c | 2 +- xen/common/sched/core.c | 4 +-- xen/common/sysctl.c | 2 +- xen/common/xenoprof.c | 2 +- xen/drivers/char/console.c | 4 +-- xen/include/xen/hypercall.h | 69 ++++++++++++++++++------------------ xen/xsm/xsm_core.c | 4 +-- 40 files changed, 169 insertions(+), 162 deletions(-) diff --git a/xen/arch/x86/compat.c b/xen/arch/x86/compat.c index 939b449dec29..28281a262a3c 100644 --- a/xen/arch/x86/compat.c +++ b/xen/arch/x86/compat.c @@ -15,7 +15,7 @@ typedef long ret_t; #endif /* Legacy hypercall (as of 0x00030202). */ -ret_t do_physdev_op_compat(XEN_GUEST_HANDLE_PARAM(physdev_op_t) uop) +ret_t cf_check do_physdev_op_compat(XEN_GUEST_HANDLE_PARAM(physdev_op_t) uop) { struct physdev_op op; @@ -28,7 +28,7 @@ ret_t do_physdev_op_compat(XEN_GUEST_HANDLE_PARAM(physdev_op_t) uop) #ifndef COMPAT /* Legacy hypercall (as of 0x00030101). */ -long do_sched_op_compat(int cmd, unsigned long arg) +long cf_check do_sched_op_compat(int cmd, unsigned long arg) { switch ( cmd ) { @@ -50,7 +50,8 @@ long do_sched_op_compat(int cmd, unsigned long arg) } /* Legacy hypercall (as of 0x00030202). */ -long do_event_channel_op_compat(XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop) +long cf_check do_event_channel_op_compat( + XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop) { struct evtchn_op op; diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index 7f433343bca3..eae08caa07cd 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -1351,7 +1351,7 @@ CHECK_mcinfo_recovery; # endif /* CONFIG_COMPAT */ /* Machine Check Architecture Hypercall */ -long do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc) +long cf_check do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc) { long ret = 0; struct xen_mc curop, *op = &curop; diff --git a/xen/arch/x86/cpu/vpmu.c b/xen/arch/x86/cpu/vpmu.c index 8ec4547bedf4..598291f4ece9 100644 --- a/xen/arch/x86/cpu/vpmu.c +++ b/xen/arch/x86/cpu/vpmu.c @@ -671,7 +671,8 @@ void vpmu_dump(struct vcpu *v) alternative_vcall(vpmu_ops.arch_vpmu_dump, v); } -long do_xenpmu_op(unsigned int op, XEN_GUEST_HANDLE_PARAM(xen_pmu_params_t) arg) +long cf_check do_xenpmu_op( + unsigned int op, XEN_GUEST_HANDLE_PARAM(xen_pmu_params_t) arg) { int ret; struct vcpu *curr; diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c index b60b9f3364a8..d80975efcf45 100644 --- a/xen/arch/x86/hvm/dm.c +++ b/xen/arch/x86/hvm/dm.c @@ -654,9 +654,8 @@ CHECK_dm_op_relocate_memory; CHECK_dm_op_pin_memory_cacheattr; CHECK_dm_op_nr_vcpus; -int compat_dm_op(domid_t domid, - unsigned int nr_bufs, - XEN_GUEST_HANDLE_PARAM(void) bufs) +int cf_check compat_dm_op( + domid_t domid, unsigned int nr_bufs, XEN_GUEST_HANDLE_PARAM(void) bufs) { struct dmop_args args; unsigned int i; diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index c4ddb8607d9c..4e685c1b0c1b 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -5015,7 +5015,7 @@ static int hvmop_get_mem_type( return rc; } -long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg) +long cf_check do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg) { long rc = 0; diff --git a/xen/arch/x86/hvm/hypercall.c b/xen/arch/x86/hvm/hypercall.c index 384724ec41a3..030243810e48 100644 --- a/xen/arch/x86/hvm/hypercall.c +++ b/xen/arch/x86/hvm/hypercall.c @@ -31,7 +31,8 @@ #include #include -static long hvm_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +static long cf_check hvm_memory_op( + unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { long rc; @@ -51,7 +52,7 @@ static long hvm_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) } #ifdef CONFIG_GRANT_TABLE -static long hvm_grant_table_op( +static long cf_check hvm_grant_table_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count) { switch ( cmd ) diff --git a/xen/arch/x86/include/asm/hypercall.h b/xen/arch/x86/include/asm/hypercall.h index eb3aed3bf70e..16d8418b5774 100644 --- a/xen/arch/x86/include/asm/hypercall.h +++ b/xen/arch/x86/include/asm/hypercall.h @@ -38,97 +38,97 @@ void pv_ring3_init_hypercall_page(void *ptr); */ #define MMU_UPDATE_PREEMPTED (~(~0U>>1)) -extern long +extern long cf_check do_event_channel_op_compat( XEN_GUEST_HANDLE_PARAM(evtchn_op_t) uop); /* Legacy hypercall (as of 0x00030202). */ -extern long do_physdev_op_compat( +extern long cf_check do_physdev_op_compat( XEN_GUEST_HANDLE(physdev_op_t) uop); /* Legacy hypercall (as of 0x00030101). */ -extern long do_sched_op_compat( +extern long cf_check do_sched_op_compat( int cmd, unsigned long arg); -extern long +extern long cf_check do_set_trap_table( XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps); -extern long +extern long cf_check do_mmu_update( XEN_GUEST_HANDLE_PARAM(mmu_update_t) ureqs, unsigned int count, XEN_GUEST_HANDLE_PARAM(uint) pdone, unsigned int foreigndom); -extern long +extern long cf_check do_set_gdt( XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list, unsigned int entries); -extern long +extern long cf_check do_stack_switch( unsigned long ss, unsigned long esp); -extern long +extern long cf_check do_fpu_taskswitch( int set); -extern long +extern long cf_check do_set_debugreg( int reg, unsigned long value); -extern unsigned long +extern unsigned long cf_check do_get_debugreg( int reg); -extern long +extern long cf_check do_update_descriptor( uint64_t gaddr, seg_desc_t desc); -extern long +extern long cf_check do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc); -extern long +extern long cf_check do_update_va_mapping( unsigned long va, u64 val64, unsigned long flags); -extern long +extern long cf_check do_physdev_op( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_update_va_mapping_otherdomain( unsigned long va, u64 val64, unsigned long flags, domid_t domid); -extern long +extern long cf_check do_mmuext_op( XEN_GUEST_HANDLE_PARAM(mmuext_op_t) uops, unsigned int count, XEN_GUEST_HANDLE_PARAM(uint) pdone, unsigned int foreigndom); -extern long do_callback_op( +extern long cf_check do_callback_op( int cmd, XEN_GUEST_HANDLE_PARAM(const_void) arg); -extern unsigned long +extern unsigned long cf_check do_iret( void); -extern long +extern long cf_check do_set_callbacks( unsigned long event_address, unsigned long failsafe_address, unsigned long syscall_address); -extern long +extern long cf_check do_set_segment_base( unsigned int which, unsigned long base); @@ -139,7 +139,7 @@ do_set_segment_base( #include #include -extern int +extern int cf_check compat_physdev_op( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); @@ -148,44 +148,47 @@ extern int arch_compat_vcpu_op( int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int compat_mmuext_op( +extern int cf_check compat_mmuext_op( XEN_GUEST_HANDLE_PARAM(void) arg, unsigned int count, XEN_GUEST_HANDLE_PARAM(uint) pdone, unsigned int foreigndom); DEFINE_XEN_GUEST_HANDLE(compat_platform_op_t); -extern int compat_platform_op( +extern int cf_check compat_platform_op( XEN_GUEST_HANDLE_PARAM(compat_platform_op_t) u_xenpf_op); -extern long compat_callback_op( +extern long cf_check compat_callback_op( int cmd, XEN_GUEST_HANDLE(void) arg); -extern int compat_update_va_mapping( +extern int cf_check compat_update_va_mapping( unsigned int va, u32 lo, u32 hi, unsigned int flags); -extern int compat_update_va_mapping_otherdomain( +extern int cf_check compat_update_va_mapping_otherdomain( unsigned int va, u32 lo, u32 hi, unsigned int flags, domid_t domid); DEFINE_XEN_GUEST_HANDLE(trap_info_compat_t); -extern int compat_set_trap_table(XEN_GUEST_HANDLE(trap_info_compat_t) traps); +extern int cf_check compat_set_trap_table( + XEN_GUEST_HANDLE(trap_info_compat_t) traps); -extern int compat_set_gdt( +extern int cf_check compat_set_gdt( XEN_GUEST_HANDLE_PARAM(uint) frame_list, unsigned int entries); -extern int compat_update_descriptor( +extern int cf_check compat_update_descriptor( u32 pa_lo, u32 pa_hi, u32 desc_lo, u32 desc_hi); -extern unsigned int compat_iret(void); +extern unsigned int cf_check compat_iret(void); -extern int compat_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); +extern int cf_check compat_nmi_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long compat_set_callbacks( +extern long cf_check compat_set_callbacks( unsigned long event_selector, unsigned long event_address, unsigned long failsafe_selector, unsigned long failsafe_address); DEFINE_XEN_GUEST_HANDLE(physdev_op_compat_t); -extern int compat_physdev_op_compat(XEN_GUEST_HANDLE(physdev_op_compat_t) uop); +extern int cf_check compat_physdev_op_compat( + XEN_GUEST_HANDLE(physdev_op_compat_t) uop); #endif /* CONFIG_COMPAT */ diff --git a/xen/arch/x86/include/asm/paging.h b/xen/arch/x86/include/asm/paging.h index 2ddcfb022c7b..f0b4efc66e2d 100644 --- a/xen/arch/x86/include/asm/paging.h +++ b/xen/arch/x86/include/asm/paging.h @@ -235,7 +235,7 @@ int paging_domctl(struct domain *d, struct xen_domctl_shadow_op *sc, bool_t resuming); /* Helper hypercall for dealing with continuations. */ -long paging_domctl_continuation(XEN_GUEST_HANDLE_PARAM(xen_domctl_t)); +long cf_check paging_domctl_continuation(XEN_GUEST_HANDLE_PARAM(xen_domctl_t)); /* Call when destroying a vcpu/domain */ void paging_vcpu_teardown(struct vcpu *v); diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index b80e4ab9c564..6484c3b97bbc 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -3377,7 +3377,7 @@ static int vcpumask_to_pcpumask( } } -long do_mmuext_op( +long cf_check do_mmuext_op( XEN_GUEST_HANDLE_PARAM(mmuext_op_t) uops, unsigned int count, XEN_GUEST_HANDLE_PARAM(uint) pdone, @@ -3916,7 +3916,7 @@ long do_mmuext_op( return rc; } -long do_mmu_update( +long cf_check do_mmu_update( XEN_GUEST_HANDLE_PARAM(mmu_update_t) ureqs, unsigned int count, XEN_GUEST_HANDLE_PARAM(uint) pdone, @@ -4501,8 +4501,8 @@ static int __do_update_va_mapping( return rc; } -long do_update_va_mapping(unsigned long va, u64 val64, - unsigned long flags) +long cf_check do_update_va_mapping( + unsigned long va, u64 val64, unsigned long flags) { int rc = __do_update_va_mapping(va, val64, flags, current->domain); @@ -4513,9 +4513,8 @@ long do_update_va_mapping(unsigned long va, u64 val64, return rc; } -long do_update_va_mapping_otherdomain(unsigned long va, u64 val64, - unsigned long flags, - domid_t domid) +long cf_check do_update_va_mapping_otherdomain( + unsigned long va, u64 val64, unsigned long flags, domid_t domid) { struct domain *pg_owner; int rc; @@ -4537,8 +4536,8 @@ long do_update_va_mapping_otherdomain(unsigned long va, u64 val64, #endif /* CONFIG_PV */ #ifdef CONFIG_PV32 -int compat_update_va_mapping(unsigned int va, uint32_t lo, uint32_t hi, - unsigned int flags) +int cf_check compat_update_va_mapping( + unsigned int va, uint32_t lo, uint32_t hi, unsigned int flags) { int rc = __do_update_va_mapping(va, ((uint64_t)hi << 32) | lo, flags, current->domain); @@ -4550,9 +4549,9 @@ int compat_update_va_mapping(unsigned int va, uint32_t lo, uint32_t hi, return rc; } -int compat_update_va_mapping_otherdomain(unsigned int va, - uint32_t lo, uint32_t hi, - unsigned int flags, domid_t domid) +int cf_check compat_update_va_mapping_otherdomain( + unsigned int va, uint32_t lo, uint32_t hi, unsigned int flags, + domid_t domid) { struct domain *pg_owner; int rc; diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c index dc3a4a0b4bb1..1f0b94ad212a 100644 --- a/xen/arch/x86/mm/paging.c +++ b/xen/arch/x86/mm/paging.c @@ -759,7 +759,8 @@ int paging_domctl(struct domain *d, struct xen_domctl_shadow_op *sc, return shadow_domctl(d, sc, u_domctl); } -long paging_domctl_continuation(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) +long cf_check paging_domctl_continuation( + XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) { struct xen_domctl op; struct domain *d; diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c index ea38be8b797a..2ddcf44f33a4 100644 --- a/xen/arch/x86/physdev.c +++ b/xen/arch/x86/physdev.c @@ -174,7 +174,7 @@ int physdev_unmap_pirq(domid_t domid, int pirq) } #endif /* COMPAT */ -ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +ret_t cf_check do_physdev_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { int irq; ret_t ret; diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index bf4090c94201..84566bbfaa3d 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -213,7 +213,8 @@ void resource_access(void *info) } #endif -ret_t do_platform_op(XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op) +ret_t cf_check do_platform_op( + XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op) { ret_t ret; struct xen_platform_op curop, *op = &curop; diff --git a/xen/arch/x86/pv/callback.c b/xen/arch/x86/pv/callback.c index 42a6aa0831b7..55148c7f9e50 100644 --- a/xen/arch/x86/pv/callback.c +++ b/xen/arch/x86/pv/callback.c @@ -140,7 +140,7 @@ static long unregister_guest_callback(struct callback_unregister *unreg) return ret; } -long do_callback_op(int cmd, XEN_GUEST_HANDLE_PARAM(const_void) arg) +long cf_check do_callback_op(int cmd, XEN_GUEST_HANDLE_PARAM(const_void) arg) { long ret; @@ -178,9 +178,9 @@ long do_callback_op(int cmd, XEN_GUEST_HANDLE_PARAM(const_void) arg) return ret; } -long do_set_callbacks(unsigned long event_address, - unsigned long failsafe_address, - unsigned long syscall_address) +long cf_check do_set_callbacks( + unsigned long event_address, unsigned long failsafe_address, + unsigned long syscall_address) { struct callback_register event = { .type = CALLBACKTYPE_event, @@ -283,7 +283,7 @@ static long compat_unregister_guest_callback( return ret; } -long compat_callback_op(int cmd, XEN_GUEST_HANDLE(void) arg) +long cf_check compat_callback_op(int cmd, XEN_GUEST_HANDLE(void) arg) { long ret; @@ -321,10 +321,9 @@ long compat_callback_op(int cmd, XEN_GUEST_HANDLE(void) arg) return ret; } -long compat_set_callbacks(unsigned long event_selector, - unsigned long event_address, - unsigned long failsafe_selector, - unsigned long failsafe_address) +long cf_check compat_set_callbacks( + unsigned long event_selector, unsigned long event_address, + unsigned long failsafe_selector, unsigned long failsafe_address) { struct compat_callback_register event = { .type = CALLBACKTYPE_event, @@ -349,7 +348,7 @@ long compat_set_callbacks(unsigned long event_selector, #endif /* CONFIG_PV32 */ -long do_set_trap_table(XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps) +long cf_check do_set_trap_table(XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps) { struct trap_info cur; struct vcpu *curr = current; @@ -395,7 +394,7 @@ long do_set_trap_table(XEN_GUEST_HANDLE_PARAM(const_trap_info_t) traps) } #ifdef CONFIG_PV32 -int compat_set_trap_table(XEN_GUEST_HANDLE(trap_info_compat_t) traps) +int cf_check compat_set_trap_table(XEN_GUEST_HANDLE(trap_info_compat_t) traps) { struct vcpu *curr = current; struct compat_trap_info cur; @@ -438,7 +437,7 @@ int compat_set_trap_table(XEN_GUEST_HANDLE(trap_info_compat_t) traps) } #endif -long do_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +long cf_check do_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct xennmi_callback cb; long rc = 0; @@ -464,7 +463,7 @@ long do_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) } #ifdef CONFIG_PV32 -int compat_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +int cf_check compat_nmi_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct compat_nmi_callback cb; int rc = 0; diff --git a/xen/arch/x86/pv/descriptor-tables.c b/xen/arch/x86/pv/descriptor-tables.c index 5e847044009b..653a61d0b518 100644 --- a/xen/arch/x86/pv/descriptor-tables.c +++ b/xen/arch/x86/pv/descriptor-tables.c @@ -124,8 +124,8 @@ int pv_set_gdt(struct vcpu *v, const unsigned long frames[], return -EINVAL; } -long do_set_gdt(XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list, - unsigned int entries) +long cf_check do_set_gdt( + XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list, unsigned int entries) { unsigned int nr_frames = DIV_ROUND_UP(entries, 512); unsigned long frames[16]; @@ -151,8 +151,8 @@ long do_set_gdt(XEN_GUEST_HANDLE_PARAM(xen_ulong_t) frame_list, #ifdef CONFIG_PV32 -int compat_set_gdt(XEN_GUEST_HANDLE_PARAM(uint) frame_list, - unsigned int entries) +int cf_check compat_set_gdt( + XEN_GUEST_HANDLE_PARAM(uint) frame_list, unsigned int entries) { struct vcpu *curr = current; unsigned int i, nr_frames = DIV_ROUND_UP(entries, 512); @@ -187,8 +187,8 @@ int compat_set_gdt(XEN_GUEST_HANDLE_PARAM(uint) frame_list, return ret; } -int compat_update_descriptor(uint32_t pa_lo, uint32_t pa_hi, - uint32_t desc_lo, uint32_t desc_hi) +int cf_check compat_update_descriptor( + uint32_t pa_lo, uint32_t pa_hi, uint32_t desc_lo, uint32_t desc_hi) { seg_desc_t d; @@ -299,7 +299,7 @@ int validate_segdesc_page(struct page_info *page) return i == 512 ? 0 : -EINVAL; } -long do_update_descriptor(uint64_t gaddr, seg_desc_t d) +long cf_check do_update_descriptor(uint64_t gaddr, seg_desc_t d) { struct domain *currd = current->domain; gfn_t gfn = gaddr_to_gfn(gaddr); diff --git a/xen/arch/x86/pv/iret.c b/xen/arch/x86/pv/iret.c index 29a2f7cc452b..dd2965d8f08d 100644 --- a/xen/arch/x86/pv/iret.c +++ b/xen/arch/x86/pv/iret.c @@ -48,7 +48,7 @@ static void async_exception_cleanup(struct vcpu *curr) curr->arch.async_exception_state(trap).old_mask; } -unsigned long do_iret(void) +unsigned long cf_check do_iret(void) { struct cpu_user_regs *regs = guest_cpu_user_regs(); struct iret_context iret_saved; @@ -105,7 +105,7 @@ unsigned long do_iret(void) } #ifdef CONFIG_PV32 -unsigned int compat_iret(void) +unsigned int cf_check compat_iret(void) { struct cpu_user_regs *regs = guest_cpu_user_regs(); struct vcpu *v = current; diff --git a/xen/arch/x86/pv/misc-hypercalls.c b/xen/arch/x86/pv/misc-hypercalls.c index 5dade2472687..5649aaab4436 100644 --- a/xen/arch/x86/pv/misc-hypercalls.c +++ b/xen/arch/x86/pv/misc-hypercalls.c @@ -23,12 +23,12 @@ #include -long do_set_debugreg(int reg, unsigned long value) +long cf_check do_set_debugreg(int reg, unsigned long value) { return set_debugreg(current, reg, value); } -unsigned long do_get_debugreg(int reg) +unsigned long cf_check do_get_debugreg(int reg) { unsigned long val; int res = x86emul_read_dr(reg, &val, NULL); @@ -36,7 +36,7 @@ unsigned long do_get_debugreg(int reg) return res == X86EMUL_OKAY ? val : -ENODEV; } -long do_fpu_taskswitch(int set) +long cf_check do_fpu_taskswitch(int set) { struct vcpu *v = current; @@ -171,7 +171,7 @@ long set_debugreg(struct vcpu *v, unsigned int reg, unsigned long value) return 0; } -long do_stack_switch(unsigned long ss, unsigned long esp) +long cf_check do_stack_switch(unsigned long ss, unsigned long esp) { fixup_guest_stack_selector(current->domain, ss); current->arch.pv.kernel_ss = ss; @@ -180,7 +180,7 @@ long do_stack_switch(unsigned long ss, unsigned long esp) return 0; } -long do_set_segment_base(unsigned int which, unsigned long base) +long cf_check do_set_segment_base(unsigned int which, unsigned long base) { struct vcpu *v = current; long ret = 0; diff --git a/xen/arch/x86/pv/shim.c b/xen/arch/x86/pv/shim.c index 7e891fe2f7a4..4c710ad8913f 100644 --- a/xen/arch/x86/pv/shim.c +++ b/xen/arch/x86/pv/shim.c @@ -824,8 +824,8 @@ long pv_shim_grant_table_op(unsigned int cmd, #ifndef CONFIG_GRANT_TABLE /* Thin wrapper(s) needed. */ -long do_grant_table_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, - unsigned int count) +long cf_check do_grant_table_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count) { if ( !pv_shim ) return -ENOSYS; @@ -834,8 +834,8 @@ long do_grant_table_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, } #ifdef CONFIG_PV32 -int compat_grant_table_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, - unsigned int count) +int cf_check compat_grant_table_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count) { if ( !pv_shim ) return -ENOSYS; diff --git a/xen/arch/x86/x86_64/compat/mm.c b/xen/arch/x86/x86_64/compat/mm.c index 215e96aba032..b3da8fafbb0c 100644 --- a/xen/arch/x86/x86_64/compat/mm.c +++ b/xen/arch/x86/x86_64/compat/mm.c @@ -176,10 +176,9 @@ int compat_arch_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) #ifdef CONFIG_PV DEFINE_XEN_GUEST_HANDLE(mmuext_op_compat_t); -int compat_mmuext_op(XEN_GUEST_HANDLE_PARAM(void) arg, - unsigned int count, - XEN_GUEST_HANDLE_PARAM(uint) pdone, - unsigned int foreigndom) +int cf_check compat_mmuext_op( + XEN_GUEST_HANDLE_PARAM(void) arg, unsigned int count, + XEN_GUEST_HANDLE_PARAM(uint) pdone, unsigned int foreigndom) { unsigned int i, preempt_mask; int rc = 0; diff --git a/xen/common/argo.c b/xen/common/argo.c index eaea7ba8885a..1448faf65731 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -2069,7 +2069,7 @@ sendv(struct domain *src_d, xen_argo_addr_t *src_addr, return ( ret < 0 ) ? ret : len; } -long +long cf_check do_argo_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1, XEN_GUEST_HANDLE_PARAM(void) arg2, unsigned long raw_arg3, unsigned long raw_arg4) @@ -2207,7 +2207,7 @@ do_argo_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1, } #ifdef CONFIG_COMPAT -long +long cf_check compat_argo_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1, XEN_GUEST_HANDLE_PARAM(void) arg2, unsigned long arg3, unsigned long arg4) diff --git a/xen/common/compat/domain.c b/xen/common/compat/domain.c index 98b8c15cea7f..afae27eeba02 100644 --- a/xen/common/compat/domain.c +++ b/xen/common/compat/domain.c @@ -38,7 +38,8 @@ CHECK_vcpu_hvm_context; #endif -int compat_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) +int cf_check compat_vcpu_op( + int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) { struct domain *d = current->domain; struct vcpu *v; diff --git a/xen/common/compat/grant_table.c b/xen/common/compat/grant_table.c index ff1d678f01c7..c6199e89188d 100644 --- a/xen/common/compat/grant_table.c +++ b/xen/common/compat/grant_table.c @@ -55,9 +55,8 @@ CHECK_gnttab_swap_grant_ref; CHECK_gnttab_cache_flush; #undef xen_gnttab_cache_flush -int compat_grant_table_op(unsigned int cmd, - XEN_GUEST_HANDLE_PARAM(void) cmp_uop, - unsigned int count) +int cf_check compat_grant_table_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) cmp_uop, unsigned int count) { int rc = 0; unsigned int i, cmd_op; diff --git a/xen/common/compat/kernel.c b/xen/common/compat/kernel.c index 804b919bdc72..8e8c413bf1d0 100644 --- a/xen/common/compat/kernel.c +++ b/xen/common/compat/kernel.c @@ -37,7 +37,7 @@ CHECK_TYPE(capabilities_info); CHECK_TYPE(domain_handle); -#define DO(fn) int compat_##fn +#define DO(fn) int cf_check compat_##fn #define COMPAT #include "../kernel.c" diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index c43fa97cf15f..ec8ba54bb66e 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -53,7 +53,8 @@ static int get_reserved_device_memory(xen_pfn_t start, xen_ulong_t nr, } #endif -int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat) +int cf_check compat_memory_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat) { struct vcpu *curr = current; struct domain *currd = curr->domain; diff --git a/xen/common/dm.c b/xen/common/dm.c index 2d1d98ca583e..fcb3a1aa0557 100644 --- a/xen/common/dm.c +++ b/xen/common/dm.c @@ -19,9 +19,9 @@ #include #include -long do_dm_op(domid_t domid, - unsigned int nr_bufs, - XEN_GUEST_HANDLE_PARAM(xen_dm_op_buf_t) bufs) +long cf_check do_dm_op( + domid_t domid, unsigned int nr_bufs, + XEN_GUEST_HANDLE_PARAM(xen_dm_op_buf_t) bufs) { struct dmop_args args; int rc; diff --git a/xen/common/domain.c b/xen/common/domain.c index 571ef4fe615e..e58c0bd4ddc4 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1603,7 +1603,8 @@ int default_initialise_vcpu(struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg) return rc; } -long do_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) +long cf_check do_vcpu_op( + int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) { struct domain *d = current->domain; struct vcpu *v; @@ -1790,7 +1791,7 @@ long do_vcpu_op(int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg) } #ifdef arch_vm_assist_valid_mask -long do_vm_assist(unsigned int cmd, unsigned int type) +long cf_check do_vm_assist(unsigned int cmd, unsigned int type) { struct domain *currd = current->domain; const unsigned long valid = arch_vm_assist_valid_mask(currd); diff --git a/xen/common/domctl.c b/xen/common/domctl.c index 879a2adcbeb0..9606fa4f1aed 100644 --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -274,7 +274,7 @@ static struct vnuma_info *vnuma_init(const struct xen_domctl_vnuma *uinfo, return ERR_PTR(ret); } -long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) +long cf_check do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl) { long ret = 0; bool_t copyback = 0; diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index c9912122d1e5..a5ee8b8ebf76 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -1189,7 +1189,7 @@ static int evtchn_set_priority(const struct evtchn_set_priority *set_priority) return ret; } -long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +long cf_check do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { int rc; diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 925ed7d6bee2..153332b7bfbe 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -3558,7 +3558,7 @@ gnttab_cache_flush(XEN_GUEST_HANDLE_PARAM(gnttab_cache_flush_t) uop, return 0; } -long +long cf_check do_grant_table_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count) { diff --git a/xen/common/hypfs.c b/xen/common/hypfs.c index e71f7df47958..1526bcc52810 100644 --- a/xen/common/hypfs.c +++ b/xen/common/hypfs.c @@ -671,9 +671,9 @@ static int hypfs_write(struct hypfs_entry *entry, return entry->funcs->write(l, uaddr, ulen); } -long do_hypfs_op(unsigned int cmd, - XEN_GUEST_HANDLE_PARAM(const_char) arg1, unsigned long arg2, - XEN_GUEST_HANDLE_PARAM(void) arg3, unsigned long arg4) +long cf_check do_hypfs_op( + unsigned int cmd, XEN_GUEST_HANDLE_PARAM(const_char) arg1, + unsigned long arg2, XEN_GUEST_HANDLE_PARAM(void) arg3, unsigned long arg4) { int ret; struct hypfs_entry *entry; diff --git a/xen/common/kernel.c b/xen/common/kernel.c index e119e5401f9d..752c2e0dae44 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -451,7 +451,7 @@ static int __init param_init(void) __initcall(param_init); #endif -# define DO(fn) long do_##fn +# define DO(fn) long cf_check do_##fn #endif diff --git a/xen/common/kexec.c b/xen/common/kexec.c index c63db618a707..8471590aeea2 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -1265,13 +1265,13 @@ static int do_kexec_op_internal(unsigned long op, return ret; } -long do_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg) +long cf_check do_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg) { return do_kexec_op_internal(op, uarg, 0); } #ifdef CONFIG_COMPAT -int compat_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg) +int cf_check compat_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg) { return do_kexec_op_internal(op, uarg, 1); } diff --git a/xen/common/memory.c b/xen/common/memory.c index 0d7c413df820..38732dde6fd7 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1367,7 +1367,7 @@ static int acquire_resource( return rc; } -long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +long cf_check do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct domain *d, *curr_d = current->domain; long rc; diff --git a/xen/common/multicall.c b/xen/common/multicall.c index 794638392b40..e48f46dbe011 100644 --- a/xen/common/multicall.c +++ b/xen/common/multicall.c @@ -32,7 +32,7 @@ static void trace_multicall_call(multicall_entry_t *call) __trace_multicall_call(call); } -ret_t +ret_t cf_check do_multicall( XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list, uint32_t nr_calls) { diff --git a/xen/common/sched/compat.c b/xen/common/sched/compat.c index 040b4caca2c4..66ba0fe88f2e 100644 --- a/xen/common/sched/compat.c +++ b/xen/common/sched/compat.c @@ -39,7 +39,7 @@ static int compat_poll(struct compat_sched_poll *compat) #include "core.c" -int compat_set_timer_op(u32 lo, s32 hi) +int cf_check compat_set_timer_op(u32 lo, s32 hi) { return do_set_timer_op(((s64)hi << 32) | lo); } diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 8f4b1ca10d1c..0f527024ba2e 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -1862,7 +1862,7 @@ typedef long ret_t; #endif /* !COMPAT */ -ret_t do_sched_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) +ret_t cf_check do_sched_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { ret_t ret = 0; @@ -1999,7 +1999,7 @@ ret_t do_sched_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) #ifndef COMPAT /* Per-vcpu oneshot-timer hypercall. */ -long do_set_timer_op(s_time_t timeout) +long cf_check do_set_timer_op(s_time_t timeout) { struct vcpu *v = current; s_time_t offset = timeout - NOW(); diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c index 1ad3c29351db..fc4a0b31d6f0 100644 --- a/xen/common/sysctl.c +++ b/xen/common/sysctl.c @@ -29,7 +29,7 @@ #include #include -long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) +long cf_check do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl) { long ret = 0; int copyback = -1; diff --git a/xen/common/xenoprof.c b/xen/common/xenoprof.c index 1926a92fe481..af617f1d0b83 100644 --- a/xen/common/xenoprof.c +++ b/xen/common/xenoprof.c @@ -721,7 +721,7 @@ static int xenoprof_op_get_buffer(XEN_GUEST_HANDLE_PARAM(void) arg) || (op == XENOPROF_disable_virq) \ || (op == XENOPROF_get_buffer)) -ret_t do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg) +ret_t cf_check do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg) { int ret = 0; diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 7d0a603d0311..a043e9521afd 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -675,8 +675,8 @@ static long guest_console_write(XEN_GUEST_HANDLE_PARAM(char) buffer, return 0; } -long do_console_io(unsigned int cmd, unsigned int count, - XEN_GUEST_HANDLE_PARAM(char) buffer) +long cf_check do_console_io( + unsigned int cmd, unsigned int count, XEN_GUEST_HANDLE_PARAM(char) buffer) { long rc; unsigned int idx, len; diff --git a/xen/include/xen/hypercall.h b/xen/include/xen/hypercall.h index 07b10ec2303b..4dfd64cf716c 100644 --- a/xen/include/xen/hypercall.h +++ b/xen/include/xen/hypercall.h @@ -18,12 +18,12 @@ #include #include -extern long +extern long cf_check do_sched_op( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_domctl( XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl); @@ -32,7 +32,7 @@ arch_do_domctl( struct xen_domctl *domctl, struct domain *d, XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl); -extern long +extern long cf_check do_sysctl( XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl); @@ -41,7 +41,7 @@ arch_do_sysctl( struct xen_sysctl *sysctl, XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl); -extern long +extern long cf_check do_platform_op( XEN_GUEST_HANDLE_PARAM(xen_platform_op_t) u_xenpf_op); @@ -62,47 +62,47 @@ pci_physdev_op( #define MEMOP_EXTENT_SHIFT 6 /* cmd[:6] == start_extent */ #define MEMOP_CMD_MASK ((1 << MEMOP_EXTENT_SHIFT) - 1) -extern long +extern long cf_check do_memory_op( unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_multicall( XEN_GUEST_HANDLE_PARAM(multicall_entry_t) call_list, unsigned int nr_calls); -extern long +extern long cf_check do_set_timer_op( s_time_t timeout); -extern long +extern long cf_check do_event_channel_op( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_xen_version( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_console_io( unsigned int cmd, unsigned int count, XEN_GUEST_HANDLE_PARAM(char) buffer); -extern long +extern long cf_check do_grant_table_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count); -extern long +extern long cf_check do_vm_assist( unsigned int cmd, unsigned int type); -extern long +extern long cf_check do_vcpu_op( int cmd, unsigned int vcpuid, @@ -114,27 +114,27 @@ arch_do_vcpu_op(int cmd, struct vcpu *v, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_nmi_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_hvm_op( unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_kexec_op( unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg); -extern long +extern long cf_check do_xsm_op( XEN_GUEST_HANDLE_PARAM(void) u_xsm_op); #ifdef CONFIG_ARGO -extern long do_argo_op( +extern long cf_check do_argo_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1, XEN_GUEST_HANDLE_PARAM(void) arg2, @@ -142,20 +142,20 @@ extern long do_argo_op( unsigned long arg4); #endif -extern long +extern long cf_check do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg); -extern long +extern long cf_check do_xenpmu_op(unsigned int op, XEN_GUEST_HANDLE_PARAM(xen_pmu_params_t) arg); -extern long +extern long cf_check do_dm_op( domid_t domid, unsigned int nr_bufs, XEN_GUEST_HANDLE_PARAM(xen_dm_op_buf_t) bufs); #ifdef CONFIG_HYPFS -extern long +extern long cf_check do_hypfs_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(const_char) arg1, @@ -166,53 +166,54 @@ do_hypfs_op( #ifdef CONFIG_COMPAT -extern int +extern int cf_check compat_memory_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int +extern int cf_check compat_grant_table_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) uop, unsigned int count); -extern int +extern int cf_check compat_vcpu_op( int cmd, unsigned int vcpuid, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int +extern int cf_check compat_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int +extern int cf_check compat_xen_version( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int +extern int cf_check compat_sched_op( int cmd, XEN_GUEST_HANDLE_PARAM(void) arg); -extern int +extern int cf_check compat_set_timer_op( u32 lo, s32 hi); -extern int compat_xsm_op( +extern int cf_check compat_xsm_op( XEN_GUEST_HANDLE_PARAM(void) op); -extern int compat_kexec_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg); +extern int cf_check compat_kexec_op( + unsigned long op, XEN_GUEST_HANDLE_PARAM(void) uarg); DEFINE_XEN_GUEST_HANDLE(multicall_entry_compat_t); -extern int compat_multicall( +extern int cf_check compat_multicall( XEN_GUEST_HANDLE_PARAM(multicall_entry_compat_t) call_list, uint32_t nr_calls); #ifdef CONFIG_ARGO -extern long compat_argo_op( +extern long cf_check compat_argo_op( unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg1, XEN_GUEST_HANDLE_PARAM(void) arg2, @@ -220,7 +221,7 @@ extern long compat_argo_op( unsigned long arg4); #endif -extern int +extern int cf_check compat_dm_op( domid_t domid, unsigned int nr_bufs, diff --git a/xen/xsm/xsm_core.c b/xen/xsm/xsm_core.c index 14d98f1f725f..5fc3a5f75478 100644 --- a/xen/xsm/xsm_core.c +++ b/xen/xsm/xsm_core.c @@ -219,13 +219,13 @@ bool __init has_xsm_magic(paddr_t start) #endif -long do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) +long cf_check do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) { return xsm_do_xsm_op(op); } #ifdef CONFIG_COMPAT -int compat_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) +int cf_check compat_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) { return xsm_do_compat_op(op); } From patchwork Mon Feb 14 12:50:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745527 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 49011C433EF for ; Mon, 14 Feb 2022 12:52:21 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271517.466049 (Exim 4.92) (envelope-from ) id 1nJapu-00075k-P5; Mon, 14 Feb 2022 12:52:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271517.466049; Mon, 14 Feb 2022 12:52:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJapu-00075U-LS; Mon, 14 Feb 2022 12:52:10 +0000 Received: by outflank-mailman (input) for mailman id 271517; Mon, 14 Feb 2022 12:52:09 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJaps-0003jk-Uz for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 12:52:09 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e979f1c8-8d94-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 13:52:05 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e979f1c8-8d94-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843125; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=rK4VCi93KFKBnJQ5QLYsQgt3WnHUX2SPT8tUAOdYGog=; b=IrbeiJticmChzmCxMqogUUahafKWaZ/inwfIFLjVAX3+Jm4zXmmR/eqQ OdRyV1tXIDI6zX5DLlC1PLiqTw8AYe32GkveCpjecVderVruQh82z4pZW Q+cNWum9OX40NPy1LTrNFAgvTUMK9f8jL2Ltdo+cOy3fJZapH2vMMc70P k=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: dFFB1oS3HxDtLGaDaGUQO4z3R+i4Yy465nNZjrLABHNH9HeVtBATEP6kas6Q1YbNVzd09T5v6w B2HHN7WhmgVfk5oC+tJotqaRghbejqZp3CbnpqoCBzdwKTBlxfT3MI3xpCiiRqfpNtkv/cEBXY HOupXji8cT9wTxhAbRs0QfLCwsKHK48l0e25d/8jGIG8rwFntH7XlXOAu4lN22XPeq6KAcTAit OrSSv468zj8rMrMbI+stEweAw+BZQ/mkxUtQi11LbvofuoN1kAcupPWqvUf8fQqtP6vkDTxUw5 OLdPCP1w4inC0aW+taLb4peo X-SBRS: 5.1 X-MesageID: 64553120 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:0I7lr6Dly1DjixVW/zbkw5YqxClBgxIJ4kV8jS/XYbTApDsqhjADy 2MdDTjSPfyJYTemf4x0bYqw8RwDv5Tcx9YwQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/iQqurs91j 9d0lreZYyB0eZL3wsEZekwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgGpt3ZkURZ4yY eIFOQhEQlfCPSZFM1wyGop9zOf5uyTgJmgwRFW9+vNsvjm7IBZK+KjgNp/Zd8KHQe1Rn12Ev STW8mLhGBYYOdeDjz2f/RqRavTnxH2hHthITfvhq6As0Ab7KnEv5AM+V2SckOa9zUyHePl2A WtJvRUV94023Rn+JjXiZCGQrHmBtx8aftNfFewm9Q2AopbpDxal6nssFWAYNoF/3CMibXlzj wLSwYu1bdB6mODNERqgGqGoQSRe0MT/BUsLfmc6QAQM+LEPS6lj30uUHr6P/ENY5+AZ+A0cI RjX9kDSZJ1J1KbnMplXGnid3VqRSmDhFFJd2+kudjvNAvlFTICkfZe0zlPQ8OxNKo2UJnHY4 iRYxJjOsb1WVMrX/MBofAnqNOv3j8tpzRWG2QI/d3Xf32jFF4GfkXB4v2gleRYB3jcscj71e k7D0T69F7cIVEZGmZRfOtrrY+xzlPCIPY28Cpj8M4ofCrAsJVTv1Hw/OiatM5XFzRFEfVcXY szAL65BzB8yVMxa8dZBb7lBj+F7nH1irY4RLLiipymaPXOlTCb9Yd843JGmNYjVNYuI/1fY9 chxLcyPx0kNWeHyeHCPo4USMUoLPT4wApWv855bceuKIwxHHmA9CqCOneN9KtI9x6kFxP3V+ nydW1NDzAatj3PwNgjXOGtob6niXMgjoCtjbzAsJ1uhx1MqfZ2rsPUEb5IycLR+rL5jwPd4Q uMrYcKFBvgTGD3L9y5ENcv2rZB4dQTtjgWLZnL3bD86dp9mZgrI5t67IVe/qHhQVnK67JJsr aeh2wXXRYs4az5jVMuGOuiyy16RvGQGnL4gVUX/PdQOKl7n95JnKnKtg6Zvcd0MMxjK2hCTy x2SXUUDveDIroI4rIvJiKSDo9v7GudyBBMHTWzS7LLwPijG5Guzh4RHVb/QLzzaUWr1/oSkZ PlUkK6gYKFWwg4SvtouCatvwII/+8Dr9u1TwQlTFXnWa0imV+F7KX6c0MgT7qBAy9e1Y+dtt p5jLjWCBYi0BQ== IronPort-HdrOrdr: A9a23:DVMhu6BSaOvK/XzlHemf55DYdb4zR+YMi2TDgXoBMCC9E/bo8v xH/pwgvyMc7Qx9ZJhOo7y90cW7Lk80lqQFg7X5X43DYOC8ghrPEGgK1+KLqAEIfReRygc379 YCT0ERMrzN5fcRt7eD3OEVeexQpOVuUcqT9IDj80s= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64553120" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 09/70] xen: CFI hardening for custom_param() Date: Mon, 14 Feb 2022 12:50:26 +0000 Message-ID: <20220214125127.17985-10-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. The "watchdog_timeout" and "cpu_type" handlers were missing __init. The "numa", "acpi", "irq_vector_map" and "flask" handlers can skip forward declarations by altering the custom_param() position. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 2 +- xen/arch/x86/acpi/power.c | 2 +- xen/arch/x86/apic.c | 4 ++-- xen/arch/x86/cpu/mcheck/mce.c | 2 +- xen/arch/x86/cpu/microcode/core.c | 2 +- xen/arch/x86/cpu/vpmu.c | 2 +- xen/arch/x86/cpuid.c | 8 ++++---- xen/arch/x86/dom0_build.c | 8 ++++---- xen/arch/x86/genapic/probe.c | 2 +- xen/arch/x86/hpet.c | 2 +- xen/arch/x86/hvm/viridian/viridian.c | 2 +- xen/arch/x86/hvm/vmx/vmcs.c | 8 ++++---- xen/arch/x86/io_apic.c | 2 +- xen/arch/x86/irq.c | 6 ++---- xen/arch/x86/mm.c | 2 +- xen/arch/x86/nmi.c | 4 ++-- xen/arch/x86/numa.c | 6 ++---- xen/arch/x86/oprofile/nmi_int.c | 2 +- xen/arch/x86/psr.c | 2 +- xen/arch/x86/pv/domain.c | 8 ++++---- xen/arch/x86/pv/shim.c | 2 +- xen/arch/x86/setup.c | 11 +++++------ xen/arch/x86/shutdown.c | 2 +- xen/arch/x86/spec_ctrl.c | 6 +++--- xen/arch/x86/time.c | 2 +- xen/arch/x86/tsx.c | 2 +- xen/arch/x86/x86_64/mmconfig-shared.c | 2 +- xen/common/argo.c | 2 +- xen/common/core_parking.c | 2 +- xen/common/debugtrace.c | 2 +- xen/common/domain.c | 2 +- xen/common/efi/boot.c | 2 +- xen/common/grant_table.c | 14 +++++++------- xen/common/kexec.c | 6 +++--- xen/common/memory.c | 2 +- xen/common/page_alloc.c | 2 +- xen/common/sched/cpupool.c | 2 +- xen/common/sched/credit2.c | 2 +- xen/drivers/acpi/tables.c | 2 +- xen/drivers/char/console.c | 18 +++++++++--------- xen/drivers/cpufreq/cpufreq.c | 2 +- xen/drivers/passthrough/amd/iommu_acpi.c | 6 +++--- xen/drivers/passthrough/iommu.c | 4 ++-- xen/drivers/passthrough/pci.c | 4 ++-- xen/drivers/passthrough/vtd/dmar.c | 2 +- xen/drivers/passthrough/vtd/quirks.c | 2 +- xen/drivers/video/vesa.c | 2 +- xen/xsm/flask/flask_op.c | 5 ++--- xen/xsm/xsm_core.c | 2 +- 49 files changed, 92 insertions(+), 98 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index d788c8bffc84..5d73eb5917af 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -106,7 +106,7 @@ void (*__read_mostly pm_idle_save)(void); unsigned int max_cstate __read_mostly = UINT_MAX; unsigned int max_csubstate __read_mostly = UINT_MAX; -static int __init parse_cstate(const char *s) +static int __init cf_check parse_cstate(const char *s) { max_cstate = simple_strtoul(s, &s, 0); if ( *s == ',' ) diff --git a/xen/arch/x86/acpi/power.c b/xen/arch/x86/acpi/power.c index 5eaa77f66a28..912d4c4d62f4 100644 --- a/xen/arch/x86/acpi/power.c +++ b/xen/arch/x86/acpi/power.c @@ -35,7 +35,7 @@ uint32_t system_reset_counter = 1; -static int __init parse_acpi_sleep(const char *s) +static int __init cf_check parse_acpi_sleep(const char *s) { const char *ss; unsigned int flag = 0; diff --git a/xen/arch/x86/apic.c b/xen/arch/x86/apic.c index 583656158532..68e4d870c749 100644 --- a/xen/arch/x86/apic.c +++ b/xen/arch/x86/apic.c @@ -775,7 +775,7 @@ int lapic_resume(void) * Original code written by Keir Fraser. */ -static int __init lapic_disable(const char *str) +static int __init cf_check lapic_disable(const char *str) { enable_local_apic = -1; setup_clear_cpu_cap(X86_FEATURE_APIC); @@ -784,7 +784,7 @@ static int __init lapic_disable(const char *str) custom_param("nolapic", lapic_disable); boolean_param("lapic", enable_local_apic); -static int __init apic_set_verbosity(const char *str) +static int __init cf_check apic_set_verbosity(const char *str) { if (strcmp("debug", str) == 0) apic_verbosity = APIC_DEBUG; diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index eae08caa07cd..ea86d84481b2 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -63,7 +63,7 @@ struct mca_banks *mca_allbanks; #endif int mce_verbosity; -static int __init mce_set_verbosity(const char *str) +static int __init cf_check mce_set_verbosity(const char *str) { if ( strcmp("verbose", str) == 0 ) mce_verbosity = MCE_VERBOSE; diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index ac3ceb567c41..95d35ca0f3f7 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -111,7 +111,7 @@ void __init microcode_set_module(unsigned int idx) * optional. If the EFI has forced which of the multiboot payloads is to be * used, only nmi= is parsed. */ -static int __init parse_ucode(const char *s) +static int __init cf_check parse_ucode(const char *s) { const char *ss; int val, rc = 0; diff --git a/xen/arch/x86/cpu/vpmu.c b/xen/arch/x86/cpu/vpmu.c index 598291f4ece9..b10d6e2eb458 100644 --- a/xen/arch/x86/cpu/vpmu.c +++ b/xen/arch/x86/cpu/vpmu.c @@ -56,7 +56,7 @@ static unsigned vpmu_count; static DEFINE_PER_CPU(struct vcpu *, last_vcpu); -static int __init parse_vpmu_params(const char *s) +static int __init cf_check parse_vpmu_params(const char *s) { const char *ss; int rc = 0, val; diff --git a/xen/arch/x86/cpuid.c b/xen/arch/x86/cpuid.c index e24dd283e761..7632b8344f87 100644 --- a/xen/arch/x86/cpuid.c +++ b/xen/arch/x86/cpuid.c @@ -101,7 +101,7 @@ static int __init always_inline parse_cpuid( return rc; } -static void __init _parse_xen_cpuid(unsigned int feat, bool val) +static void __init cf_check _parse_xen_cpuid(unsigned int feat, bool val) { if ( !val ) setup_clear_cpu_cap(feat); @@ -110,7 +110,7 @@ static void __init _parse_xen_cpuid(unsigned int feat, bool val) setup_force_cpu_cap(X86_FEATURE_RDRAND); } -static int __init parse_xen_cpuid(const char *s) +static int __init cf_check parse_xen_cpuid(const char *s) { return parse_cpuid(s, _parse_xen_cpuid); } @@ -120,13 +120,13 @@ static bool __initdata dom0_cpuid_cmdline; static uint32_t __initdata dom0_enable_feat[FSCAPINTS]; static uint32_t __initdata dom0_disable_feat[FSCAPINTS]; -static void __init _parse_dom0_cpuid(unsigned int feat, bool val) +static void __init cf_check _parse_dom0_cpuid(unsigned int feat, bool val) { __set_bit (feat, val ? dom0_enable_feat : dom0_disable_feat); __clear_bit(feat, val ? dom0_disable_feat : dom0_enable_feat ); } -static int __init parse_dom0_cpuid(const char *s) +static int __init cf_check parse_dom0_cpuid(const char *s) { dom0_cpuid_cmdline = true; diff --git a/xen/arch/x86/dom0_build.c b/xen/arch/x86/dom0_build.c index a7fec05956c1..4d1c5c60e407 100644 --- a/xen/arch/x86/dom0_build.c +++ b/xen/arch/x86/dom0_build.c @@ -115,7 +115,7 @@ static int __init parse_amt(const char *s, const char **ps, struct memsize *sz) return 0; } -static int __init parse_dom0_mem(const char *s) +static int __init cf_check parse_dom0_mem(const char *s) { int ret; @@ -144,7 +144,7 @@ custom_param("dom0_mem", parse_dom0_mem); static unsigned int __initdata opt_dom0_max_vcpus_min = 1; static unsigned int __initdata opt_dom0_max_vcpus_max = UINT_MAX; -static int __init parse_dom0_max_vcpus(const char *s) +static int __init cf_check parse_dom0_max_vcpus(const char *s) { if ( *s == '-' ) /* -M */ opt_dom0_max_vcpus_max = simple_strtoul(s + 1, &s, 0); @@ -168,7 +168,7 @@ static __initdata unsigned int dom0_pxms[MAX_NUMNODES] = { [0 ... MAX_NUMNODES - 1] = ~0 }; bool __initdata dom0_affinity_relaxed; -static int __init parse_dom0_nodes(const char *s) +static int __init cf_check parse_dom0_nodes(const char *s) { const char *ss; int rc = 0; @@ -266,7 +266,7 @@ bool __initdata opt_dom0_pvh = !IS_ENABLED(CONFIG_PV); bool __initdata opt_dom0_verbose = IS_ENABLED(CONFIG_VERBOSE_DEBUG); bool __initdata opt_dom0_msr_relaxed; -static int __init parse_dom0_param(const char *s) +static int __init cf_check parse_dom0_param(const char *s) { const char *ss; int rc = 0; diff --git a/xen/arch/x86/genapic/probe.c b/xen/arch/x86/genapic/probe.c index 66bc5ce072dc..ad57912f506b 100644 --- a/xen/arch/x86/genapic/probe.c +++ b/xen/arch/x86/genapic/probe.c @@ -43,7 +43,7 @@ void __init generic_bigsmp_probe(void) } } -static int __init genapic_apic_force(const char *str) +static int __init cf_check genapic_apic_force(const char *str) { int i, rc = -EINVAL; diff --git a/xen/arch/x86/hpet.c b/xen/arch/x86/hpet.c index afe104dc93c2..7b009a930498 100644 --- a/xen/arch/x86/hpet.c +++ b/xen/arch/x86/hpet.c @@ -65,7 +65,7 @@ u8 __initdata hpet_flags; static bool __initdata force_hpet_broadcast; boolean_param("hpetbroadcast", force_hpet_broadcast); -static int __init parse_hpet_param(const char *s) +static int __init cf_check parse_hpet_param(const char *s) { const char *ss; int val, rc = 0; diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c index 8986b8e03c2e..7ebcaa1c899f 100644 --- a/xen/arch/x86/hvm/viridian/viridian.c +++ b/xen/arch/x86/hvm/viridian/viridian.c @@ -1186,7 +1186,7 @@ static int viridian_load_vcpu_ctxt(struct domain *d, HVM_REGISTER_SAVE_RESTORE(VIRIDIAN_VCPU, viridian_save_vcpu_ctxt, viridian_load_vcpu_ctxt, 1, HVMSR_PER_VCPU); -static int __init parse_viridian_version(const char *arg) +static int __init cf_check parse_viridian_version(const char *arg) { const char *t; unsigned int n[3]; diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index 7ab15e07a0b2..f72a7db0453d 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -71,7 +71,7 @@ static bool __read_mostly opt_ept_pml = true; static s8 __read_mostly opt_ept_ad = -1; int8_t __read_mostly opt_ept_exec_sp = -1; -static int __init parse_ept_param(const char *s) +static int __init cf_check parse_ept_param(const char *s) { const char *ss; int val, rc = 0; @@ -107,16 +107,16 @@ static void update_ept_param(void) opt_ept_exec_sp); } -static void __init init_ept_param(struct param_hypfs *par) +static void __init cf_check init_ept_param(struct param_hypfs *par) { update_ept_param(); custom_runtime_set_var(par, opt_ept_setting); } -static int parse_ept_param_runtime(const char *s); +static int cf_check parse_ept_param_runtime(const char *s); custom_runtime_only_param("ept", parse_ept_param_runtime, init_ept_param); -static int parse_ept_param_runtime(const char *s) +static int cf_check parse_ept_param_runtime(const char *s) { struct domain *d; int val; diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c index 1c49a0fe1478..4135a9c06052 100644 --- a/xen/arch/x86/io_apic.c +++ b/xen/arch/x86/io_apic.c @@ -1601,7 +1601,7 @@ static unsigned int startup_level_ioapic_irq(struct irq_desc *desc) return 0; /* don't check for pending */ } -static int __init setup_ioapic_ack(const char *s) +static int __init cf_check setup_ioapic_ack(const char *s) { if ( !strcmp(s, "old") ) { diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index 67cbf6b979dc..84b174d0f51f 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -28,8 +28,6 @@ #include #include -static int parse_irq_vector_map_param(const char *s); - /* opt_noirqbalance: If true, software IRQ balancing/affinity is disabled. */ bool __read_mostly opt_noirqbalance; boolean_param("noirqbalance", opt_noirqbalance); @@ -40,7 +38,6 @@ integer_param("nr_irqs", nr_irqs); /* This default may be changed by the AMD IOMMU code */ int __read_mostly opt_irq_vector_map = OPT_IRQ_VECTOR_MAP_DEFAULT; -custom_param("irq_vector_map", parse_irq_vector_map_param); /* Max number of guests IRQ could be shared with */ static unsigned char __read_mostly irq_max_guests; @@ -66,7 +63,7 @@ static struct timer irq_ratelimit_timer; static unsigned int __read_mostly irq_ratelimit_threshold = 10000; integer_param("irq_ratelimit", irq_ratelimit_threshold); -static int __init parse_irq_vector_map_param(const char *s) +static int __init cf_check parse_irq_vector_map_param(const char *s) { const char *ss; int rc = 0; @@ -90,6 +87,7 @@ static int __init parse_irq_vector_map_param(const char *s) return rc; } +custom_param("irq_vector_map", parse_irq_vector_map_param); /* Must be called when irq disabled */ void lock_vector_lock(void) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 6484c3b97bbc..3b8bc3dda977 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -189,7 +189,7 @@ static uint32_t base_disallow_mask; static s8 __read_mostly opt_mmio_relax; -static int __init parse_mmio_relax(const char *s) +static int __init cf_check parse_mmio_relax(const char *s) { if ( !*s ) opt_mmio_relax = 1; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index ab94a96c4d03..1a225d499295 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -48,7 +48,7 @@ bool __initdata opt_watchdog; /* watchdog_force: If true, process unknown NMIs when running the watchdog. */ bool watchdog_force; -static int __init parse_watchdog(const char *s) +static int __init cf_check parse_watchdog(const char *s) { if ( !*s ) { @@ -78,7 +78,7 @@ custom_param("watchdog", parse_watchdog); /* opt_watchdog_timeout: Number of seconds to wait before panic. */ static unsigned int opt_watchdog_timeout = 5; -static int parse_watchdog_timeout(const char *s) +static int __init cf_check parse_watchdog_timeout(const char *s) { const char *q; diff --git a/xen/arch/x86/numa.c b/xen/arch/x86/numa.c index ce79ee44cefe..6be5a0c93322 100644 --- a/xen/arch/x86/numa.c +++ b/xen/arch/x86/numa.c @@ -19,9 +19,6 @@ #include #include -static int numa_setup(const char *s); -custom_param("numa", numa_setup); - #ifndef Dprintk #define Dprintk(x...) #endif @@ -294,7 +291,7 @@ void numa_set_node(int cpu, nodeid_t node) } /* [numa=off] */ -static __init int numa_setup(const char *opt) +static int __init cf_check numa_setup(const char *opt) { if ( !strncmp(opt,"off",3) ) numa_off = true; @@ -321,6 +318,7 @@ static __init int numa_setup(const char *opt) return 0; } +custom_param("numa", numa_setup); /* * Setup early cpu_to_node. diff --git a/xen/arch/x86/oprofile/nmi_int.c b/xen/arch/x86/oprofile/nmi_int.c index a13bd82915ac..7842d95b95ea 100644 --- a/xen/arch/x86/oprofile/nmi_int.c +++ b/xen/arch/x86/oprofile/nmi_int.c @@ -340,7 +340,7 @@ static int __init p4_init(char ** cpu_type) static int force_arch_perfmon; -static int force_cpu_type(const char *str) +static int __init cf_check force_cpu_type(const char *str) { if (!strcmp(str, "arch_perfmon")) { force_arch_perfmon = 1; diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c index d805b85dc60b..56916344cb1d 100644 --- a/xen/arch/x86/psr.c +++ b/xen/arch/x86/psr.c @@ -573,7 +573,7 @@ static bool __init parse_psr_bool(const char *s, const char *delim, return false; } -static int __init parse_psr_param(const char *s) +static int __init cf_check parse_psr_param(const char *s) { const char *ss, *val_delim; const char *q; diff --git a/xen/arch/x86/pv/domain.c b/xen/arch/x86/pv/domain.c index 6ad533183bcd..125c4561a7ea 100644 --- a/xen/arch/x86/pv/domain.c +++ b/xen/arch/x86/pv/domain.c @@ -20,7 +20,7 @@ int8_t __read_mostly opt_pv32 = -1; #endif -static __init int parse_pv(const char *s) +static int __init cf_check parse_pv(const char *s) { const char *ss; int val, rc = 0; @@ -63,16 +63,16 @@ static const char opt_pcid_2_string[][7] = { [PCID_NOXPTI] = "noxpti", }; -static void __init opt_pcid_init(struct param_hypfs *par) +static void __init cf_check opt_pcid_init(struct param_hypfs *par) { custom_runtime_set_var(par, opt_pcid_2_string[opt_pcid]); } #endif -static int parse_pcid(const char *s); +static int cf_check parse_pcid(const char *s); custom_runtime_param("pcid", parse_pcid, opt_pcid_init); -static int parse_pcid(const char *s) +static int cf_check parse_pcid(const char *s) { int rc = 0; diff --git a/xen/arch/x86/pv/shim.c b/xen/arch/x86/pv/shim.c index 4c710ad8913f..ae4d8913faa1 100644 --- a/xen/arch/x86/pv/shim.c +++ b/xen/arch/x86/pv/shim.c @@ -73,7 +73,7 @@ static uint64_t __initdata shim_nrpages; static uint64_t __initdata shim_min_nrpages; static uint64_t __initdata shim_max_nrpages; -static int __init parse_shim_mem(const char *s) +static int __init cf_check parse_shim_mem(const char *s) { do { if ( !strncmp(s, "min:", 4) ) diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 115f8f651734..eceff0a4e2b4 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -81,8 +81,6 @@ unsigned long __read_mostly cr4_pv32_mask; /* "acpi=ht": Limit ACPI just to boot-time to enable HT. */ /* "acpi=noirq": Disables ACPI interrupt routing. */ /* "acpi=verbose": Enables more verbose ACPI boot time logging. */ -static int parse_acpi_param(const char *s); -custom_param("acpi", parse_acpi_param); /* **** Linux config option: propagated to domain0. */ /* noapic: Disable IOAPIC setup. */ @@ -104,7 +102,7 @@ static bool __initdata opt_xen_shstk = true; #define opt_xen_shstk false #endif -static int __init parse_cet(const char *s) +static int __init cf_check parse_cet(const char *s) { const char *ss; int val, rc = 0; @@ -159,7 +157,7 @@ static s8 __initdata opt_smep = -1; */ static struct domain *__initdata dom0; -static int __init parse_smep_param(const char *s) +static int __init cf_check parse_smep_param(const char *s) { if ( !*s ) { @@ -190,7 +188,7 @@ custom_param("smep", parse_smep_param); #define SMAP_HVM_ONLY (-2) static s8 __initdata opt_smap = -1; -static int __init parse_smap_param(const char *s) +static int __init cf_check parse_smap_param(const char *s) { if ( !*s ) { @@ -221,7 +219,7 @@ bool __read_mostly acpi_disabled; bool __initdata acpi_force; static char __initdata acpi_param[10] = ""; -static int __init parse_acpi_param(const char *s) +static int __init cf_check parse_acpi_param(const char *s) { /* Interpret the parameter for use within Xen. */ if ( !parse_bool(s, NULL) ) @@ -257,6 +255,7 @@ static int __init parse_acpi_param(const char *s) return 0; } +custom_param("acpi", parse_acpi_param); static const module_t *__initdata initial_images; static unsigned int __initdata nr_initial_images; diff --git a/xen/arch/x86/shutdown.c b/xen/arch/x86/shutdown.c index acef03314372..a01354d93319 100644 --- a/xen/arch/x86/shutdown.c +++ b/xen/arch/x86/shutdown.c @@ -56,7 +56,7 @@ static int reboot_mode; */ static enum reboot_type reboot_type = BOOT_INVALID; -static int __init set_reboot_type(const char *str) +static int __init cf_check set_reboot_type(const char *str) { int rc = 0; diff --git a/xen/arch/x86/spec_ctrl.c b/xen/arch/x86/spec_ctrl.c index cbeeb199037e..d45841043c58 100644 --- a/xen/arch/x86/spec_ctrl.c +++ b/xen/arch/x86/spec_ctrl.c @@ -68,7 +68,7 @@ static bool __initdata cpu_has_bug_mds; /* Any other M{LP,SB,FB}DS combination. static int8_t __initdata opt_srb_lock = -1; -static int __init parse_spec_ctrl(const char *s) +static int __init cf_check parse_spec_ctrl(const char *s) { const char *ss; int val, rc = 0; @@ -218,7 +218,7 @@ static __init void xpti_init_default(uint64_t caps) } } -static __init int parse_xpti(const char *s) +static int __init cf_check parse_xpti(const char *s) { const char *ss; int val, rc = 0; @@ -264,7 +264,7 @@ custom_param("xpti", parse_xpti); int8_t __read_mostly opt_pv_l1tf_hwdom = -1; int8_t __read_mostly opt_pv_l1tf_domu = -1; -static __init int parse_pv_l1tf(const char *s) +static int __init cf_check parse_pv_l1tf(const char *s) { const char *ss; int val, rc = 0; diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 17f64a6ccdd1..2da9c7f5c8dd 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -2356,7 +2356,7 @@ int hwdom_pit_access(struct ioreq *ioreq) * tsc=skewed: Assume TSCs are individually reliable, but skewed across CPUs. * tsc=stable:socket: Assume TSCs are reliable across sockets. */ -static int __init tsc_parse(const char *s) +static int __init cf_check tsc_parse(const char *s) { if ( !strcmp(s, "unstable") ) { diff --git a/xen/arch/x86/tsx.c b/xen/arch/x86/tsx.c index be89741a2f6d..b156844cdec1 100644 --- a/xen/arch/x86/tsx.c +++ b/xen/arch/x86/tsx.c @@ -22,7 +22,7 @@ int8_t __read_mostly opt_tsx = -1; int8_t __read_mostly cpu_has_tsx_ctrl = -1; bool __read_mostly rtm_disabled; -static int __init parse_tsx(const char *s) +static int __init cf_check parse_tsx(const char *s) { int rc = 0, val = parse_bool(s, NULL); diff --git a/xen/arch/x86/x86_64/mmconfig-shared.c b/xen/arch/x86/x86_64/mmconfig-shared.c index 7c3ed64b4c6c..2fa7f3f0bc4b 100644 --- a/xen/arch/x86/x86_64/mmconfig-shared.c +++ b/xen/arch/x86/x86_64/mmconfig-shared.c @@ -29,7 +29,7 @@ unsigned int pci_probe = PCI_PROBE_CONF1 | PCI_PROBE_MMCONF; -static int __init parse_mmcfg(const char *s) +static int __init cf_check parse_mmcfg(const char *s) { const char *ss; int rc = 0; diff --git a/xen/common/argo.c b/xen/common/argo.c index 1448faf65731..297f6d11f04d 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -78,7 +78,7 @@ DEFINE_COMPAT_HANDLE(compat_argo_iov_t); static bool __read_mostly opt_argo; static bool __read_mostly opt_argo_mac_permissive; -static int __init parse_argo(const char *s) +static int __init cf_check parse_argo(const char *s) { const char *ss; int val, rc = 0; diff --git a/xen/common/core_parking.c b/xen/common/core_parking.c index 411106c675c9..aa432ed2f57b 100644 --- a/xen/common/core_parking.c +++ b/xen/common/core_parking.c @@ -40,7 +40,7 @@ static enum core_parking_controller { PERFORMANCE_FIRST } core_parking_controller __initdata = POWER_FIRST; -static int __init setup_core_parking_option(const char *str) +static int __init cf_check setup_core_parking_option(const char *str) { if ( !strcmp(str, "power") ) core_parking_controller = POWER_FIRST; diff --git a/xen/common/debugtrace.c b/xen/common/debugtrace.c index f3794b945376..29b11239f5a5 100644 --- a/xen/common/debugtrace.c +++ b/xen/common/debugtrace.c @@ -38,7 +38,7 @@ static bool debugtrace_buf_empty = true; static bool debugtrace_used; static DEFINE_SPINLOCK(debugtrace_lock); -static int __init debugtrace_parse_param(const char *s) +static int __init cf_check debugtrace_parse_param(const char *s) { unsigned long bytes; diff --git a/xen/common/domain.c b/xen/common/domain.c index e58c0bd4ddc4..5df0d167537b 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -354,7 +354,7 @@ static int late_hwdom_init(struct domain *d) static unsigned int __read_mostly extra_hwdom_irqs; static unsigned int __read_mostly extra_domU_irqs = 32; -static int __init parse_extra_guest_irqs(const char *s) +static int __init cf_check parse_extra_guest_irqs(const char *s) { if ( isdigit(*s) ) extra_domU_irqs = simple_strtoul(s, &s, 0); diff --git a/xen/common/efi/boot.c b/xen/common/efi/boot.c index 12fd0844bd55..f31f68fd4cd1 100644 --- a/xen/common/efi/boot.c +++ b/xen/common/efi/boot.c @@ -1417,7 +1417,7 @@ efi_start(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable) static bool __initdata efi_map_uc; -static int __init parse_efi_param(const char *s) +static int __init cf_check parse_efi_param(const char *s) { const char *ss; int rc = 0, val; diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 153332b7bfbe..b663845d9c6c 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -117,12 +117,12 @@ static void update_gnttab_par(unsigned int val, struct param_hypfs *par, custom_runtime_set_var_sz(par, parval, GRANT_CUSTOM_VAL_SZ); } -static void __init gnttab_max_frames_init(struct param_hypfs *par) +static void __init cf_check gnttab_max_frames_init(struct param_hypfs *par) { update_gnttab_par(opt_max_grant_frames, par, opt_max_grant_frames_val); } -static void __init max_maptrack_frames_init(struct param_hypfs *par) +static void __init cf_check max_maptrack_frames_init(struct param_hypfs *par) { update_gnttab_par(opt_max_maptrack_frames, par, opt_max_maptrack_frames_val); @@ -156,23 +156,23 @@ static int parse_gnttab_limit(const char *arg, unsigned int *valp, return 0; } -static int parse_gnttab_max_frames(const char *arg); +static int cf_check parse_gnttab_max_frames(const char *arg); custom_runtime_param("gnttab_max_frames", parse_gnttab_max_frames, gnttab_max_frames_init); -static int parse_gnttab_max_frames(const char *arg) +static int cf_check parse_gnttab_max_frames(const char *arg) { return parse_gnttab_limit(arg, &opt_max_grant_frames, param_2_parfs(parse_gnttab_max_frames), opt_max_grant_frames_val); } -static int parse_gnttab_max_maptrack_frames(const char *arg); +static int cf_check parse_gnttab_max_maptrack_frames(const char *arg); custom_runtime_param("gnttab_max_maptrack_frames", parse_gnttab_max_maptrack_frames, max_maptrack_frames_init); -static int parse_gnttab_max_maptrack_frames(const char *arg) +static int cf_check parse_gnttab_max_maptrack_frames(const char *arg) { return parse_gnttab_limit(arg, &opt_max_maptrack_frames, param_2_parfs(parse_gnttab_max_maptrack_frames), @@ -191,7 +191,7 @@ static bool __ro_after_init opt_grant_transfer = true; #define opt_grant_transfer false #endif -static int __init parse_gnttab(const char *s) +static int __init cf_check parse_gnttab(const char *s) { const char *ss, *e; int val, rc = 0; diff --git a/xen/common/kexec.c b/xen/common/kexec.c index 8471590aeea2..6286c0bbf08b 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -104,7 +104,7 @@ static void *crash_heap_current = NULL, *crash_heap_end = NULL; * < and below are synonyomous, the latter being useful for grub2 systems * which would otherwise require escaping of the < option */ -static int __init parse_crashkernel(const char *str) +static int __init cf_check parse_crashkernel(const char *str) { const char *cur; int rc = 0; @@ -201,7 +201,7 @@ custom_param("crashkernel", parse_crashkernel); * - all will allocate additional structures such as domain and vcpu structs * low so the crash kernel can perform an extended analysis of state. */ -static int __init parse_low_crashinfo(const char *str) +static int __init cf_check parse_low_crashinfo(const char *str) { if ( !strlen(str) ) @@ -230,7 +230,7 @@ custom_param("low_crashinfo", parse_low_crashinfo); * * will be rounded down to the nearest power of two. Defaults to 64G */ -static int __init parse_crashinfo_maxaddr(const char *str) +static int __init cf_check parse_crashinfo_maxaddr(const char *str) { u64 addr; const char *q; diff --git a/xen/common/memory.c b/xen/common/memory.c index 38732dde6fd7..ede45c4af9db 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -62,7 +62,7 @@ static unsigned int __read_mostly hwdom_max_order = CONFIG_HWDOM_MAX_ORDER; static unsigned int __read_mostly ptdom_max_order = CONFIG_PTDOM_MAX_ORDER; #endif -static int __init parse_max_order(const char *s) +static int __init cf_check parse_max_order(const char *s) { if ( *s != ',' ) domu_max_order = simple_strtoul(s, &s, 0); diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index f8749b0787a6..ad06655158d2 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -179,7 +179,7 @@ enum bootscrub_mode { * https://bugs.llvm.org/show_bug.cgi?id=39707 */ static enum bootscrub_mode __read_mostly opt_bootscrub = BOOTSCRUB_IDLE; -static int __init parse_bootscrub_param(const char *s) +static int __init cf_check parse_bootscrub_param(const char *s) { /* Interpret 'bootscrub' alone in its positive boolean form */ if ( *s == '\0' ) diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index 8c6e6eb9ccd5..f0dd626054a6 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -93,7 +93,7 @@ static int sched_gran_get(const char *str, enum sched_gran *mode) return -EINVAL; } -static int __init sched_select_granularity(const char *str) +static int __init cf_check sched_select_granularity(const char *str) { return sched_gran_get(str, &opt_sched_granularity); } diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c index 6396b38e044c..a5f073cda51e 100644 --- a/xen/common/sched/credit2.c +++ b/xen/common/sched/credit2.c @@ -456,7 +456,7 @@ static const char *const opt_runqueue_str[] = { }; static int __read_mostly opt_runqueue = OPT_RUNQUEUE_SOCKET; -static int __init parse_credit2_runqueue(const char *s) +static int __init cf_check parse_credit2_runqueue(const char *s) { unsigned int i; diff --git a/xen/drivers/acpi/tables.c b/xen/drivers/acpi/tables.c index f39cd5eaac89..96ff96b84c66 100644 --- a/xen/drivers/acpi/tables.c +++ b/xen/drivers/acpi/tables.c @@ -472,7 +472,7 @@ int __init acpi_table_init(void) return 0; } -static int __init acpi_parse_apic_instance(const char *str) +static int __init cf_check acpi_parse_apic_instance(const char *str) { const char *q; diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index a043e9521afd..4694be83db45 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -88,7 +88,7 @@ static const char con_timestamp_mode_2_string[][7] = { [TSM_RAW] = "raw", }; -static void con_timestamp_mode_upd(struct param_hypfs *par) +static void cf_check con_timestamp_mode_upd(struct param_hypfs *par) { const char *val = con_timestamp_mode_2_string[opt_con_timestamp_mode]; @@ -98,7 +98,7 @@ static void con_timestamp_mode_upd(struct param_hypfs *par) #define con_timestamp_mode_upd(par) #endif -static int parse_console_timestamps(const char *s); +static int cf_check parse_console_timestamps(const char *s); custom_runtime_param("console_timestamps", parse_console_timestamps, con_timestamp_mode_upd); @@ -160,8 +160,8 @@ static int __read_mostly xenlog_guest_upper_thresh = static int __read_mostly xenlog_guest_lower_thresh = XENLOG_GUEST_LOWER_THRESHOLD; -static int parse_loglvl(const char *s); -static int parse_guest_loglvl(const char *s); +static int cf_check parse_loglvl(const char *s); +static int cf_check parse_guest_loglvl(const char *s); #ifdef CONFIG_HYPFS #define LOGLVL_VAL_SZ 16 @@ -176,13 +176,13 @@ static void xenlog_update_val(int lower, int upper, char *val) snprintf(val, LOGLVL_VAL_SZ, "%s/%s", lvl2opt[lower], lvl2opt[upper]); } -static void __init xenlog_init(struct param_hypfs *par) +static void __init cf_check xenlog_init(struct param_hypfs *par) { xenlog_update_val(xenlog_lower_thresh, xenlog_upper_thresh, xenlog_val); custom_runtime_set_var(par, xenlog_val); } -static void __init xenlog_guest_init(struct param_hypfs *par) +static void __init cf_check xenlog_guest_init(struct param_hypfs *par) { xenlog_update_val(xenlog_guest_lower_thresh, xenlog_guest_upper_thresh, xenlog_guest_val); @@ -240,7 +240,7 @@ static int _parse_loglvl(const char *s, int *lower, int *upper, char *val) return *s ? -EINVAL : 0; } -static int parse_loglvl(const char *s) +static int cf_check parse_loglvl(const char *s) { int ret; @@ -251,7 +251,7 @@ static int parse_loglvl(const char *s) return ret; } -static int parse_guest_loglvl(const char *s) +static int cf_check parse_guest_loglvl(const char *s) { int ret; @@ -793,7 +793,7 @@ static int printk_prefix_check(char *p, char **pp) ((loglvl < upper_thresh) && printk_ratelimit())); } -static int parse_console_timestamps(const char *s) +static int cf_check parse_console_timestamps(const char *s) { switch ( parse_bool(s, NULL) ) { diff --git a/xen/drivers/cpufreq/cpufreq.c b/xen/drivers/cpufreq/cpufreq.c index 419aae83eea6..36b079296235 100644 --- a/xen/drivers/cpufreq/cpufreq.c +++ b/xen/drivers/cpufreq/cpufreq.c @@ -65,7 +65,7 @@ enum cpufreq_controller cpufreq_controller = FREQCTL_xen; static int __init cpufreq_cmdline_parse(const char *s); -static int __init setup_cpufreq_option(const char *str) +static int __init cf_check setup_cpufreq_option(const char *str) { const char *arg = strpbrk(str, ",:"); int choice; diff --git a/xen/drivers/passthrough/amd/iommu_acpi.c b/xen/drivers/passthrough/amd/iommu_acpi.c index b07fa4c40124..5ea227732821 100644 --- a/xen/drivers/passthrough/amd/iommu_acpi.c +++ b/xen/drivers/passthrough/amd/iommu_acpi.c @@ -704,7 +704,7 @@ static u16 __init parse_ivhd_device_extended_range( return dev_length; } -static int __init parse_ivrs_ioapic(const char *str) +static int __init cf_check parse_ivrs_ioapic(const char *str) { const char *s = str; unsigned long id; @@ -742,7 +742,7 @@ static int __init parse_ivrs_ioapic(const char *str) } custom_param("ivrs_ioapic[", parse_ivrs_ioapic); -static int __init parse_ivrs_hpet(const char *str) +static int __init cf_check parse_ivrs_hpet(const char *str) { const char *s = str; unsigned long id; @@ -1369,7 +1369,7 @@ int __init amd_iommu_get_supported_ivhd_type(void) * Format: * ivmd=[-][=[-'][,[-'][,...]]][;...] */ -static int __init parse_ivmd_param(const char *s) +static int __init cf_check parse_ivmd_param(const char *s) { do { unsigned long start, end; diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c index fc18f63bd4ac..6ee267d2bfd4 100644 --- a/xen/drivers/passthrough/iommu.c +++ b/xen/drivers/passthrough/iommu.c @@ -64,7 +64,7 @@ bool_t __read_mostly amd_iommu_perdev_intremap = 1; DEFINE_PER_CPU(bool_t, iommu_dont_flush_iotlb); -static int __init parse_iommu_param(const char *s) +static int __init cf_check parse_iommu_param(const char *s) { const char *ss; int val, rc = 0; @@ -135,7 +135,7 @@ static int __init parse_iommu_param(const char *s) } custom_param("iommu", parse_iommu_param); -static int __init parse_dom0_iommu_param(const char *s) +static int __init cf_check parse_dom0_iommu_param(const char *s) { const char *ss; int rc = 0; diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index e8b09d77d880..20cb246598b1 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -146,7 +146,7 @@ static struct phantom_dev { } phantom_devs[8]; static unsigned int nr_phantom_devs; -static int __init parse_phantom_dev(const char *str) +static int __init cf_check parse_phantom_dev(const char *str) { const char *s; unsigned int seg, bus, slot; @@ -182,7 +182,7 @@ custom_param("pci-phantom", parse_phantom_dev); static u16 __read_mostly command_mask; static u16 __read_mostly bridge_ctl_mask; -static int __init parse_pci_param(const char *s) +static int __init cf_check parse_pci_param(const char *s) { const char *ss; int rc = 0; diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index 33a12b2ae976..b152f3da916b 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -1084,7 +1084,7 @@ int intel_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt) * If a segment is specified for other than the first device, and it does not * match the one specified for the first one, an error will be reported. */ -static int __init parse_rmrr_param(const char *str) +static int __init cf_check parse_rmrr_param(const char *str) { const char *s = str, *cur, *stmp; unsigned int seg, bus, dev, func, dev_count; diff --git a/xen/drivers/passthrough/vtd/quirks.c b/xen/drivers/passthrough/vtd/quirks.c index 52b47dd89325..0590ddeea7c4 100644 --- a/xen/drivers/passthrough/vtd/quirks.c +++ b/xen/drivers/passthrough/vtd/quirks.c @@ -308,7 +308,7 @@ void vtd_ops_postamble_quirk(struct vtd_iommu *iommu) } } -static int __init parse_snb_timeout(const char *s) +static int __init cf_check parse_snb_timeout(const char *s) { int t; const char *q = NULL; diff --git a/xen/drivers/video/vesa.c b/xen/drivers/video/vesa.c index 2c1bbd927806..cb0e443be4dd 100644 --- a/xen/drivers/video/vesa.c +++ b/xen/drivers/video/vesa.c @@ -30,7 +30,7 @@ static unsigned int vram_remap; integer_param("vesa-map", vram_remap); static int font_height; -static int __init parse_font_height(const char *s) +static int __init cf_check parse_font_height(const char *s) { if ( simple_strtoul(s, &s, 10) == 8 && (*s++ == 'x') ) font_height = simple_strtoul(s, &s, 10); diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c index bb3bebc30e01..2d7ca3abaecd 100644 --- a/xen/xsm/flask/flask_op.c +++ b/xen/xsm/flask/flask_op.c @@ -28,8 +28,6 @@ #define _copy_from_guest copy_from_guest enum flask_bootparam_t __read_mostly flask_bootparam = FLASK_BOOTPARAM_ENFORCING; -static int parse_flask_param(const char *s); -custom_param("flask", parse_flask_param); bool __read_mostly flask_enforcing = true; @@ -60,7 +58,7 @@ static int flask_security_make_bools(void); extern int ss_initialized; -static int __init parse_flask_param(const char *s) +static int __init cf_check parse_flask_param(const char *s) { if ( !strcmp(s, "enforcing") ) flask_bootparam = FLASK_BOOTPARAM_ENFORCING; @@ -75,6 +73,7 @@ static int __init parse_flask_param(const char *s) return (flask_bootparam == FLASK_BOOTPARAM_INVALID) ? -EINVAL : 0; } +custom_param("flask", parse_flask_param); static int domain_has_security(struct domain *d, u32 perms) { diff --git a/xen/xsm/xsm_core.c b/xen/xsm/xsm_core.c index 5fc3a5f75478..2286a502e3e8 100644 --- a/xen/xsm/xsm_core.c +++ b/xen/xsm/xsm_core.c @@ -55,7 +55,7 @@ static enum xsm_bootparam __initdata xsm_bootparam = XSM_BOOTPARAM_DUMMY; #endif -static int __init parse_xsm_param(const char *s) +static int __init cf_check parse_xsm_param(const char *s) { int rc = 0; From patchwork Mon Feb 14 12:50:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745562 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 29750C433FE for ; Mon, 14 Feb 2022 13:06:24 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271705.466327 (Exim 4.92) (envelope-from ) id 1nJb3V-00079c-PO; Mon, 14 Feb 2022 13:06:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271705.466327; Mon, 14 Feb 2022 13:06:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3V-00076e-It; Mon, 14 Feb 2022 13:06:13 +0000 Received: by outflank-mailman (input) for mailman id 271705; Mon, 14 Feb 2022 13:06:11 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3C-00023t-70 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:54 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id d495ce3a-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:50 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d495ce3a-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843951; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=DT/FfQl+XmikwzNvldKPzp5Fi1KnEHWZn7DpIm9D+IQ=; b=gmymjwTb0Wx6O3gPuzj83RfrT4ii1LAfdW4yCj++kvS/Mhub4cHBjfEe o1WlHM/y+2KO4GUmzhXsq45+3P5NCXQRrXJkyJOpT+2OfvMo7QPFxkDQY Us4MHyvcz19xUclRCvTX6UT0QJAVBGgfYgHVMmwv6+bpoTipLd8DlaH1K M=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: MjkvN0rIeBabDS3x7UKhMnVMszo15I42VfqX0sZayQ/G2oner+0AKcDs/QXxW2qZS4qjG49qJo neTYnJj6lWTHIpCrjyyYmxlhLFxDofa9lJc+NyxHpo+2YvMyCqh4QOiz9w7pkxp7maQO2RlX+m MKtdknqBbTagUDm8V7MsjXuWot6Q/b2oDgCcpHfG1DJhFJL0UZjpRvu5vwDt8n4bFG43VHteZD TJzF/drGfYXZakKBhWtRZkv6ugmLPOQ1N39j8zJDRZTzZzTB0mYXJn0M4UW3E3uCcu7VZ01U/w YeL/ew0PZ42LsHCTI5g2SNis X-SBRS: 5.1 X-MesageID: 66374915 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:H+7tV6DFwxEnHRVW/zbkw5YqxClBgxIJ4kV8jS/XYbTApGwqhDQAy WFNCGGOM/reamTxfY9zPIS08x4C7JHUzYdgQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/tDWRjtxOx N92iY2AVSJ0Go32ic1eTEwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgmxv2pEXQJ4yY eIEeytwRwjeZCFeP3ERLc4DobbzgGXgJmgwRFW9+vNsvjm7IBZK+KjgNp/Zd8KHQe1Rn12Ev STW8mLhGBYYOdeDjz2f/RqRavTnxH2hHthITfvhq6As0Ab7KnEv5AM+alujsPWGhkSFZ8NvN 2lJ3goUvIFx6xn+JjXiZCGQrHmBtx8aftNfFewm9Q2AopbpDxal6nssFWAYNoF/3CMibXlzj wLSwYu1bdB6mODNERqgGqGoQSRe0MT/BUsLfmc6QAQM+LEPS6lj30uUHr6P/ENY5+AZ+A0cI RjX9kDSZJ1J1KbnMplXGnid3VqRSmDhFFJd2+kudjvNAvlFTICkfZe0zlPQ8OxNKo2UJnHY4 iRYxJjOsb1WVMrX/MBofAnqNOv3j8tpzRWG2QI/d3Xf32jFF4GfkXB4v2gleRYB3jcscj71e k7D0T69F7cIVEZGmZRfOtrrY+xzlPCIPY28Cpj8M4ofCrAsJVTv1Hw/OiatM5XFzRFEfVcXY szAL65BzB8yVMxa8dZBb7lBj+F7nH1irY4RLLiipymaPXOlTCb9Yd843JGmMojVNYuI/1fY9 chxLcyPx0kNWeHyeHCPo4USMUoLPT4wApWv855bceuKIwxHHmA9CqCOneN9KtI9x6kFxP3V+ nydW1NDzAatj3PwNgjXOGtob6niXMgjoCtjbzAsJ1uhx1MqfZ2rsPUEb5IycLR+rL5jwPd4Q uMrYcKFBvgTGD3L9y5ENcv2rZB4dQTtjgWLZnL3bD86dp9mZgrI5t67IVe/qHhQVnK67JJsr aeh2wXXRYs4az5jVMuGOuiyy16RvGQGnL4gVUX/PdQOKl7n95JnKnKtg6Zvcd0MMxjK2hCTy x2SXUUDveDIroI4rIvJiKSDo9v7GudyBBMHTWzS7LLwPijG5Guzh4RHVb/QLzzaUWr1/oSkZ PlUkK6gYKFWwg4SvtouCatvwII/+8Dr9u1TwQlTFXnWa0imV+F7KX6c0MgT7qBAy9e1Y+dtt p5jLjWCBYi0BQ== IronPort-HdrOrdr: A9a23:O8rhhqoHDuk5+g3dL0ydFmYaV5opeYIsimQD101hICG8cqSj+f xG/c5rrCMc5wxwZJhNo7y90ey7MBbhHP1OkO8s1NWZLWrbUQKTRekIh+bfKn/baknDH4ZmpM BdmsNFaeEYY2IUsS+D2njbL+od X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374915" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 10/70] xen: CFI hardening for __initcall() Date: Mon, 14 Feb 2022 12:50:27 +0000 Message-ID: <20220214125127.17985-11-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 4 ++-- xen/arch/x86/acpi/cpufreq/cpufreq.c | 2 +- xen/arch/x86/cpu/mcheck/non-fatal.c | 2 +- xen/arch/x86/cpu/microcode/core.c | 2 +- xen/arch/x86/cpu/mtrr/main.c | 2 +- xen/arch/x86/cpu/vpmu.c | 2 +- xen/arch/x86/domain.c | 2 +- xen/arch/x86/extable.c | 2 +- xen/arch/x86/hvm/hvm.c | 4 ++-- xen/arch/x86/hvm/irq.c | 2 +- xen/arch/x86/hvm/mtrr.c | 2 +- xen/arch/x86/hvm/nestedhvm.c | 3 +-- xen/arch/x86/hvm/quirks.c | 2 +- xen/arch/x86/include/asm/hvm/save.h | 2 +- xen/arch/x86/ioport_emulate.c | 4 ++-- xen/arch/x86/irq.c | 4 ++-- xen/arch/x86/mm/shadow/common.c | 4 ++-- xen/arch/x86/msi.c | 2 +- xen/arch/x86/nmi.c | 2 +- xen/arch/x86/numa.c | 2 +- xen/arch/x86/oprofile/nmi_int.c | 2 +- xen/arch/x86/percpu.c | 2 +- xen/arch/x86/psr.c | 2 +- xen/arch/x86/pv/domain.c | 2 +- xen/arch/x86/shutdown.c | 2 +- xen/arch/x86/time.c | 8 ++++---- xen/common/core_parking.c | 2 +- xen/common/debugtrace.c | 2 +- xen/common/event_channel.c | 2 +- xen/common/gdbstub.c | 2 +- xen/common/grant_table.c | 2 +- xen/common/kernel.c | 4 ++-- xen/common/kexec.c | 2 +- xen/common/livepatch.c | 2 +- xen/common/page_alloc.c | 4 ++-- xen/common/radix-tree.c | 2 +- xen/common/random.c | 2 +- xen/common/sched/cpupool.c | 2 +- xen/common/spinlock.c | 2 +- xen/common/stop_machine.c | 2 +- xen/drivers/cpufreq/cpufreq.c | 2 +- xen/drivers/cpufreq/cpufreq_misc_governors.c | 6 +++--- xen/drivers/cpufreq/cpufreq_ondemand.c | 2 +- xen/drivers/passthrough/amd/iommu.h | 2 +- xen/drivers/passthrough/amd/iommu_init.c | 2 +- xen/drivers/passthrough/pci.c | 2 +- xen/drivers/passthrough/vtd/iommu.c | 2 +- xen/drivers/passthrough/x86/hvm.c | 2 +- 48 files changed, 60 insertions(+), 61 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index 5d73eb5917af..7902ccce6b98 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -410,7 +410,7 @@ static void dump_cx(unsigned char key) } } -static int __init cpu_idle_key_init(void) +static int __init cf_check cpu_idle_key_init(void) { register_keyhandler('c', dump_cx, "dump ACPI Cx structures", 1); return 0; @@ -1655,7 +1655,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback }; -static int __init cpuidle_presmp_init(void) +static int __init cf_check cpuidle_presmp_init(void) { void *cpu = (void *)(long)smp_processor_id(); diff --git a/xen/arch/x86/acpi/cpufreq/cpufreq.c b/xen/arch/x86/acpi/cpufreq/cpufreq.c index 029c9398c42a..9510f05340aa 100644 --- a/xen/arch/x86/acpi/cpufreq/cpufreq.c +++ b/xen/arch/x86/acpi/cpufreq/cpufreq.c @@ -630,7 +630,7 @@ static const struct cpufreq_driver __initconstrel acpi_cpufreq_driver = { .exit = acpi_cpufreq_cpu_exit, }; -static int __init cpufreq_driver_init(void) +static int __init cf_check cpufreq_driver_init(void) { int ret = 0; diff --git a/xen/arch/x86/cpu/mcheck/non-fatal.c b/xen/arch/x86/cpu/mcheck/non-fatal.c index ec52d37c96e1..2679c220a8a2 100644 --- a/xen/arch/x86/cpu/mcheck/non-fatal.c +++ b/xen/arch/x86/cpu/mcheck/non-fatal.c @@ -86,7 +86,7 @@ static void mce_work_fn(void *data) adjust = 0; } -static int __init init_nonfatal_mce_checker(void) +static int __init cf_check init_nonfatal_mce_checker(void) { struct cpuinfo_x86 *c = &boot_cpu_data; diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index 95d35ca0f3f7..46f55fe7f191 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -696,7 +696,7 @@ int microcode_update(XEN_GUEST_HANDLE(const_void) buf, unsigned long len) microcode_update_helper, buffer); } -static int __init microcode_init(void) +static int __init cf_check microcode_init(void) { /* * At this point, all CPUs should have updated their microcode diff --git a/xen/arch/x86/cpu/mtrr/main.c b/xen/arch/x86/cpu/mtrr/main.c index e9df53f00d61..428133100d46 100644 --- a/xen/arch/x86/cpu/mtrr/main.c +++ b/xen/arch/x86/cpu/mtrr/main.c @@ -632,7 +632,7 @@ void mtrr_bp_restore(void) mtrr_if->set_all(); } -static int __init mtrr_init_finialize(void) +static int __init cf_check mtrr_init_finialize(void) { if (!mtrr_if) return 0; diff --git a/xen/arch/x86/cpu/vpmu.c b/xen/arch/x86/cpu/vpmu.c index b10d6e2eb458..9fc897dc8403 100644 --- a/xen/arch/x86/cpu/vpmu.c +++ b/xen/arch/x86/cpu/vpmu.c @@ -844,7 +844,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback }; -static int __init vpmu_init(void) +static int __init cf_check vpmu_init(void) { int vendor = current_cpu_data.x86_vendor; const struct arch_vpmu_ops *ops = NULL; diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index ef1812dc1402..f943283b2a88 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -2532,7 +2532,7 @@ static void vcpu_kick_softirq(void) */ } -static int __init init_vcpu_kick_softirq(void) +static int __init cf_check init_vcpu_kick_softirq(void) { open_softirq(VCPU_KICK_SOFTIRQ, vcpu_kick_softirq); return 0; diff --git a/xen/arch/x86/extable.c b/xen/arch/x86/extable.c index 78d672722580..51ef863d786c 100644 --- a/xen/arch/x86/extable.c +++ b/xen/arch/x86/extable.c @@ -126,7 +126,7 @@ search_exception_table(const struct cpu_user_regs *regs) #ifndef NDEBUG #include -static int __init stub_selftest(void) +static int __init cf_check stub_selftest(void) { static const struct { uint8_t opc[4]; diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 4e685c1b0c1b..2ae1685d0aff 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -164,7 +164,7 @@ static bool __init hap_supported(struct hvm_function_table *fns) return true; } -static int __init hvm_enable(void) +static int __init cf_check hvm_enable(void) { const struct hvm_function_table *fns = NULL; @@ -1506,7 +1506,7 @@ static int hvm_load_cpu_msrs(struct domain *d, hvm_domain_context_t *h) /* We need variable length data chunks for XSAVE area and MSRs, hence * a custom declaration rather than HVM_REGISTER_SAVE_RESTORE. */ -static int __init hvm_register_CPU_save_and_restore(void) +static int __init cf_check hvm_register_CPU_save_and_restore(void) { hvm_register_savevm(CPU_XSAVE_CODE, "CPU_XSAVE", diff --git a/xen/arch/x86/hvm/irq.c b/xen/arch/x86/hvm/irq.c index 52aae4565f0c..6045c9149bad 100644 --- a/xen/arch/x86/hvm/irq.c +++ b/xen/arch/x86/hvm/irq.c @@ -650,7 +650,7 @@ static void dump_irq_info(unsigned char key) rcu_read_unlock(&domlist_read_lock); } -static int __init dump_irq_info_key_init(void) +static int __init cf_check dump_irq_info_key_init(void) { register_keyhandler('I', dump_irq_info, "dump HVM irq info", 1); return 0; diff --git a/xen/arch/x86/hvm/mtrr.c b/xen/arch/x86/hvm/mtrr.c index 4a9f3177edd4..b3ef1bf54133 100644 --- a/xen/arch/x86/hvm/mtrr.c +++ b/xen/arch/x86/hvm/mtrr.c @@ -75,7 +75,7 @@ static uint8_t __read_mostly mtrr_epat_tbl[MTRR_NUM_TYPES][MEMORY_NUM_TYPES] = static uint8_t __read_mostly pat_entry_tbl[PAT_TYPE_NUMS] = { [0 ... PAT_TYPE_NUMS-1] = INVALID_MEM_TYPE }; -static int __init hvm_mtrr_pat_init(void) +static int __init cf_check hvm_mtrr_pat_init(void) { unsigned int i, j; diff --git a/xen/arch/x86/hvm/nestedhvm.c b/xen/arch/x86/hvm/nestedhvm.c index 5021da667a47..23516884482b 100644 --- a/xen/arch/x86/hvm/nestedhvm.c +++ b/xen/arch/x86/hvm/nestedhvm.c @@ -125,8 +125,7 @@ nestedhvm_vmcx_flushtlb(struct p2m_domain *p2m) * iomap[2] set set */ -static int __init -nestedhvm_setup(void) +static int __init cf_check nestedhvm_setup(void) { /* Same format and size as hvm_io_bitmap (Intel needs only 2 pages). */ unsigned nr = cpu_has_vmx ? 2 : 3; diff --git a/xen/arch/x86/hvm/quirks.c b/xen/arch/x86/hvm/quirks.c index 54cc66c382b6..917356b1312c 100644 --- a/xen/arch/x86/hvm/quirks.c +++ b/xen/arch/x86/hvm/quirks.c @@ -36,7 +36,7 @@ static int __init dmi_hvm_deny_port80(const struct dmi_system_id *id) return 0; } -static int __init check_port80(void) +static int __init cf_check check_port80(void) { /* * Quirk table for systems that misbehave (lock up, etc.) if port diff --git a/xen/arch/x86/include/asm/hvm/save.h b/xen/arch/x86/include/asm/hvm/save.h index 4efc53505500..e975011ddb71 100644 --- a/xen/arch/x86/include/asm/hvm/save.h +++ b/xen/arch/x86/include/asm/hvm/save.h @@ -115,7 +115,7 @@ void hvm_register_savevm(uint16_t typecode, /* Syntactic sugar around that function: specify the max number of * saves, and this calculates the size of buffer needed */ #define HVM_REGISTER_SAVE_RESTORE(_x, _save, _load, _num, _k) \ -static int __init __hvm_register_##_x##_save_and_restore(void) \ +static int __init cf_check __hvm_register_##_x##_save_and_restore(void) \ { \ hvm_register_savevm(HVM_SAVE_CODE(_x), \ #_x, \ diff --git a/xen/arch/x86/ioport_emulate.c b/xen/arch/x86/ioport_emulate.c index cf1f3f922959..6caeb3d470ce 100644 --- a/xen/arch/x86/ioport_emulate.c +++ b/xen/arch/x86/ioport_emulate.c @@ -11,7 +11,7 @@ unsigned int (*__read_mostly ioemul_handle_quirk)( uint8_t opcode, char *io_emul_stub, struct cpu_user_regs *regs); -static unsigned int ioemul_handle_proliant_quirk( +static unsigned int cf_check ioemul_handle_proliant_quirk( u8 opcode, char *io_emul_stub, struct cpu_user_regs *regs) { static const char stub[] = { @@ -100,7 +100,7 @@ static const struct dmi_system_id __initconstrel ioport_quirks_tbl[] = { { } }; -static int __init ioport_quirks_init(void) +static int __init cf_check ioport_quirks_init(void) { if ( dmi_check_system(ioport_quirks_tbl) ) ioemul_handle_quirk = ioemul_handle_proliant_quirk; diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index 84b174d0f51f..bcf46cd54d16 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -954,7 +954,7 @@ static void irq_ratelimit_timer_fn(void *data) spin_unlock_irqrestore(&irq_ratelimit_lock, flags); } -static int __init irq_ratelimit_init(void) +static int __init cf_check irq_ratelimit_init(void) { if ( irq_ratelimit_threshold ) init_timer(&irq_ratelimit_timer, irq_ratelimit_timer_fn, NULL, 0); @@ -2504,7 +2504,7 @@ static void dump_irqs(unsigned char key) dump_ioapic_irq_info(); } -static int __init setup_dump_irqs(void) +static int __init cf_check setup_dump_irqs(void) { /* In lieu of being able to live in init_irq_data(). */ BUILD_BUG_ON(sizeof(irq_max_guests) > diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index 6221630fc2dc..b8730a9441ce 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -105,7 +105,7 @@ static void shadow_audit_key(unsigned char key) __func__, shadow_audit_enable); } -static int __init shadow_audit_key_init(void) +static int __init cf_check shadow_audit_key_init(void) { register_keyhandler('O', shadow_audit_key, "toggle shadow audits", 0); return 0; @@ -1057,7 +1057,7 @@ static void shadow_blow_all_tables(unsigned char c) } /* Register this function in the Xen console keypress table */ -static __init int shadow_blow_tables_keyhandler_init(void) +static int __init cf_check shadow_blow_tables_keyhandler_init(void) { register_keyhandler('S', shadow_blow_all_tables, "reset shadow pagetables", 1); return 0; diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c index 5febc0ea4b7c..d1497254b188 100644 --- a/xen/arch/x86/msi.c +++ b/xen/arch/x86/msi.c @@ -1485,7 +1485,7 @@ static void dump_msi(unsigned char key) vpci_dump_msi(); } -static int __init msi_setup_keyhandler(void) +static int __init cf_check msi_setup_keyhandler(void) { register_keyhandler('M', dump_msi, "dump MSI state", 1); return 0; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index 1a225d499295..21e947a46f24 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -606,7 +606,7 @@ static void do_nmi_stats(unsigned char key) printk("%pv: NMI neither pending nor masked\n", v); } -static __init int register_nmi_trigger(void) +static int __init cf_check register_nmi_trigger(void) { register_keyhandler('N', do_nmi_trigger, "trigger an NMI", 0); register_keyhandler('n', do_nmi_stats, "NMI statistics", 1); diff --git a/xen/arch/x86/numa.c b/xen/arch/x86/numa.c index 6be5a0c93322..5de9db4e9943 100644 --- a/xen/arch/x86/numa.c +++ b/xen/arch/x86/numa.c @@ -504,7 +504,7 @@ static void dump_numa(unsigned char key) rcu_read_unlock(&domlist_read_lock); } -static __init int register_numa_trigger(void) +static int __init cf_check register_numa_trigger(void) { register_keyhandler('u', dump_numa, "dump NUMA info", 1); return 0; diff --git a/xen/arch/x86/oprofile/nmi_int.c b/xen/arch/x86/oprofile/nmi_int.c index 7842d95b95ea..ba9c4b9804ca 100644 --- a/xen/arch/x86/oprofile/nmi_int.c +++ b/xen/arch/x86/oprofile/nmi_int.c @@ -388,7 +388,7 @@ static int __init arch_perfmon_init(char **cpu_type) return 1; } -static int __init nmi_init(void) +static int __init cf_check nmi_init(void) { __u8 vendor = current_cpu_data.x86_vendor; __u8 family = current_cpu_data.x86; diff --git a/xen/arch/x86/percpu.c b/xen/arch/x86/percpu.c index 5ea14b6ec312..0e0b6577ca45 100644 --- a/xen/arch/x86/percpu.c +++ b/xen/arch/x86/percpu.c @@ -94,7 +94,7 @@ static struct notifier_block cpu_percpu_nfb = { .priority = 100 /* highest priority */ }; -static int __init percpu_presmp_init(void) +static int __init cf_check percpu_presmp_init(void) { register_cpu_notifier(&cpu_percpu_nfb); diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c index 56916344cb1d..9a3670afc341 100644 --- a/xen/arch/x86/psr.c +++ b/xen/arch/x86/psr.c @@ -1675,7 +1675,7 @@ static struct notifier_block cpu_nfb = { .priority = -1 }; -static int __init psr_presmp_init(void) +static int __init cf_check psr_presmp_init(void) { if ( (opt_psr & PSR_CMT) && opt_rmid_max ) init_psr_cmt(opt_rmid_max); diff --git a/xen/arch/x86/pv/domain.c b/xen/arch/x86/pv/domain.c index 125c4561a7ea..55146c15c853 100644 --- a/xen/arch/x86/pv/domain.c +++ b/xen/arch/x86/pv/domain.c @@ -167,7 +167,7 @@ unsigned long pv_fixup_guest_cr4(const struct vcpu *v, unsigned long cr4) static int8_t __read_mostly opt_global_pages = -1; boolean_runtime_param("global-pages", opt_global_pages); -static int __init pge_init(void) +static int __init cf_check pge_init(void) { if ( opt_global_pages == -1 ) opt_global_pages = !cpu_has_hypervisor || diff --git a/xen/arch/x86/shutdown.c b/xen/arch/x86/shutdown.c index a01354d93319..ad3e3a76916f 100644 --- a/xen/arch/x86/shutdown.c +++ b/xen/arch/x86/shutdown.c @@ -533,7 +533,7 @@ static const struct dmi_system_id __initconstrel reboot_dmi_table[] = { { } }; -static int __init reboot_init(void) +static int __init cf_check reboot_init(void) { /* * Only do the DMI check if reboot_type hasn't been overridden diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 2da9c7f5c8dd..14f7d3fd635e 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -537,7 +537,7 @@ static struct platform_timesource __initdata plt_pmtimer = static struct time_scale __read_mostly pmt_scale; -static __init int init_pmtmr_scale(void) +static __init int cf_check init_pmtmr_scale(void) { set_time_scale(&pmt_scale, ACPI_PM_FREQUENCY); return 0; @@ -2052,7 +2052,7 @@ static void __init try_platform_timer_tail(void) } /* Late init function, after all cpus have booted */ -static int __init verify_tsc_reliability(void) +static int __init cf_check verify_tsc_reliability(void) { if ( boot_cpu_has(X86_FEATURE_TSC_RELIABLE) ) { @@ -2223,7 +2223,7 @@ static int _disable_pit_irq(void(*hpet_broadcast_setup)(void)) return ret; } -static int __init disable_pit_irq(void) +static int __init cf_check disable_pit_irq(void) { if ( !_disable_pit_irq(hpet_broadcast_init) ) { @@ -2586,7 +2586,7 @@ static void dump_softtsc(unsigned char key) printk("No domains have emulated TSC\n"); } -static int __init setup_dump_softtsc(void) +static int __init cf_check setup_dump_softtsc(void) { register_keyhandler('s', dump_softtsc, "dump softtsc stats", 1); return 0; diff --git a/xen/common/core_parking.c b/xen/common/core_parking.c index aa432ed2f57b..44a907abfd7f 100644 --- a/xen/common/core_parking.c +++ b/xen/common/core_parking.c @@ -258,7 +258,7 @@ static int __init register_core_parking_policy(const struct cp_policy *policy) return 0; } -static int __init core_parking_init(void) +static int __init cf_check core_parking_init(void) { int ret = 0; diff --git a/xen/common/debugtrace.c b/xen/common/debugtrace.c index 29b11239f5a5..f3c0fd8aa17b 100644 --- a/xen/common/debugtrace.c +++ b/xen/common/debugtrace.c @@ -279,7 +279,7 @@ static struct notifier_block debugtrace_nfb = { .notifier_call = debugtrace_cpu_callback }; -static int __init debugtrace_init(void) +static int __init cf_check debugtrace_init(void) { unsigned int cpu; diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index a5ee8b8ebf76..2026bc30dc95 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -1642,7 +1642,7 @@ static void dump_evtchn_info(unsigned char key) rcu_read_unlock(&domlist_read_lock); } -static int __init dump_evtchn_info_key_init(void) +static int __init cf_check dump_evtchn_info_key_init(void) { register_keyhandler('e', dump_evtchn_info, "dump evtchn info", 1); return 0; diff --git a/xen/common/gdbstub.c b/xen/common/gdbstub.c index 848c1f4327e8..99bfd9a654c9 100644 --- a/xen/common/gdbstub.c +++ b/xen/common/gdbstub.c @@ -640,7 +640,7 @@ __trap_to_gdb(struct cpu_user_regs *regs, unsigned long cookie) return rc; } -static int __init initialise_gdb(void) +static int __init cf_check initialise_gdb(void) { if ( *opt_gdb == '\0' ) return 0; diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index b663845d9c6c..1078e3e16cda 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -4291,7 +4291,7 @@ static void gnttab_usage_print_all(unsigned char key) printk("%s ] done\n", __func__); } -static int __init gnttab_usage_init(void) +static int __init cf_check gnttab_usage_init(void) { register_keyhandler('g', gnttab_usage_print_all, "print grant table usage", 1); diff --git a/xen/common/kernel.c b/xen/common/kernel.c index 752c2e0dae44..adff2d2c77f3 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -393,7 +393,7 @@ static HYPFS_STRING_INIT(extra, "extra"); static HYPFS_STRING_INIT(config, "config"); #endif -static int __init buildinfo_init(void) +static int __init cf_check buildinfo_init(void) { hypfs_add_dir(&hypfs_root, &buildinfo, true); @@ -431,7 +431,7 @@ __initcall(buildinfo_init); static HYPFS_DIR_INIT(params, "params"); -static int __init param_init(void) +static int __init cf_check param_init(void) { struct param_hypfs *param; diff --git a/xen/common/kexec.c b/xen/common/kexec.c index 6286c0bbf08b..36384f782db3 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -570,7 +570,7 @@ void __init kexec_early_calculations(void) crashinfo_maxaddr_bits = fls64(crashinfo_maxaddr) - 1; } -static int __init kexec_init(void) +static int __init cf_check kexec_init(void) { void *cpu = (void *)(unsigned long)smp_processor_id(); diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c index 7118551b27e2..33708b4e2388 100644 --- a/xen/common/livepatch.c +++ b/xen/common/livepatch.c @@ -2139,7 +2139,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback }; -static int __init livepatch_init(void) +static int __init cf_check livepatch_init(void) { unsigned int cpu; diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index ad06655158d2..561e238d2d6a 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -2549,7 +2549,7 @@ static void pagealloc_info(unsigned char key) printk(" Dom heap: %lukB free\n", total << (PAGE_SHIFT-10)); } -static __init int pagealloc_keyhandler_init(void) +static __init int cf_check pagealloc_keyhandler_init(void) { register_keyhandler('m', pagealloc_info, "memory info", 1); return 0; @@ -2597,7 +2597,7 @@ static void dump_heap(unsigned char key) } } -static __init int register_heap_trigger(void) +static __init int cf_check register_heap_trigger(void) { register_keyhandler('H', dump_heap, "dump heap info", 1); return 0; diff --git a/xen/common/radix-tree.c b/xen/common/radix-tree.c index 2384655a2e90..628a7e06988f 100644 --- a/xen/common/radix-tree.c +++ b/xen/common/radix-tree.c @@ -744,7 +744,7 @@ static __init unsigned long __maxindex(unsigned int height) return ~0UL >> shift; } -static __init int radix_tree_init_maxindex(void) +static int __init cf_check radix_tree_init_maxindex(void) { unsigned int i; diff --git a/xen/common/random.c b/xen/common/random.c index fb805b0ecd95..a29f2fcb991a 100644 --- a/xen/common/random.c +++ b/xen/common/random.c @@ -31,7 +31,7 @@ unsigned int get_random(void) return val; } -static int __init init_boot_random(void) +static int __init cf_check init_boot_random(void) { boot_random = get_random(); return 0; diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index f0dd626054a6..f26c7f289539 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -1218,7 +1218,7 @@ static void cpupool_hypfs_init(void) #endif /* CONFIG_HYPFS */ -static int __init cpupool_init(void) +static int __init cf_check cpupool_init(void) { unsigned int cpu; diff --git a/xen/common/spinlock.c b/xen/common/spinlock.c index b90981bb271e..5ce7e3363863 100644 --- a/xen/common/spinlock.c +++ b/xen/common/spinlock.c @@ -508,7 +508,7 @@ void _lock_profile_deregister_struct( spin_unlock(&lock_profile_lock); } -static int __init lock_prof_init(void) +static int __init cf_check lock_prof_init(void) { struct lock_profile **q; diff --git a/xen/common/stop_machine.c b/xen/common/stop_machine.c index 2d5f6aef61ed..8979d553d677 100644 --- a/xen/common/stop_machine.c +++ b/xen/common/stop_machine.c @@ -198,7 +198,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback }; -static int __init cpu_stopmachine_init(void) +static int __init cf_check cpu_stopmachine_init(void) { unsigned int cpu; for_each_online_cpu ( cpu ) diff --git a/xen/drivers/cpufreq/cpufreq.c b/xen/drivers/cpufreq/cpufreq.c index 36b079296235..e55e202d5a18 100644 --- a/xen/drivers/cpufreq/cpufreq.c +++ b/xen/drivers/cpufreq/cpufreq.c @@ -657,7 +657,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback }; -static int __init cpufreq_presmp_init(void) +static int __init cf_check cpufreq_presmp_init(void) { register_cpu_notifier(&cpu_nfb); return 0; diff --git a/xen/drivers/cpufreq/cpufreq_misc_governors.c b/xen/drivers/cpufreq/cpufreq_misc_governors.c index 746bbcd5ff36..8343f491da87 100644 --- a/xen/drivers/cpufreq/cpufreq_misc_governors.c +++ b/xen/drivers/cpufreq/cpufreq_misc_governors.c @@ -116,7 +116,7 @@ struct cpufreq_governor cpufreq_gov_userspace = { .handle_option = cpufreq_userspace_handle_option }; -static int __init cpufreq_gov_userspace_init(void) +static int __init cf_check cpufreq_gov_userspace_init(void) { unsigned int cpu; @@ -160,7 +160,7 @@ struct cpufreq_governor cpufreq_gov_performance = { .governor = cpufreq_governor_performance, }; -static int __init cpufreq_gov_performance_init(void) +static int __init cf_check cpufreq_gov_performance_init(void) { return cpufreq_register_governor(&cpufreq_gov_performance); } @@ -199,7 +199,7 @@ struct cpufreq_governor cpufreq_gov_powersave = { .governor = cpufreq_governor_powersave, }; -static int __init cpufreq_gov_powersave_init(void) +static int __init cf_check cpufreq_gov_powersave_init(void) { return cpufreq_register_governor(&cpufreq_gov_powersave); } diff --git a/xen/drivers/cpufreq/cpufreq_ondemand.c b/xen/drivers/cpufreq/cpufreq_ondemand.c index 6b905d7cfca8..cabd9ffa8886 100644 --- a/xen/drivers/cpufreq/cpufreq_ondemand.c +++ b/xen/drivers/cpufreq/cpufreq_ondemand.c @@ -356,7 +356,7 @@ struct cpufreq_governor cpufreq_gov_dbs = { .handle_option = cpufreq_dbs_handle_option }; -static int __init cpufreq_gov_dbs_init(void) +static int __init cf_check cpufreq_gov_dbs_init(void) { return cpufreq_register_governor(&cpufreq_gov_dbs); } diff --git a/xen/drivers/passthrough/amd/iommu.h b/xen/drivers/passthrough/amd/iommu.h index 93243424e85d..04517c1a024c 100644 --- a/xen/drivers/passthrough/amd/iommu.h +++ b/xen/drivers/passthrough/amd/iommu.h @@ -234,7 +234,7 @@ int amd_iommu_prepare(bool xt); int amd_iommu_init(bool xt); int amd_iommu_init_late(void); int amd_iommu_update_ivrs_mapping_acpi(void); -int iov_adjust_irq_affinities(void); +int cf_check iov_adjust_irq_affinities(void); int amd_iommu_quarantine_init(struct domain *d); diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index 559a734bdaa5..f1ed75558227 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -808,7 +808,7 @@ static bool_t __init set_iommu_interrupt_handler(struct amd_iommu *iommu) return 1; } -int iov_adjust_irq_affinities(void) +int cf_check iov_adjust_irq_affinities(void) { const struct amd_iommu *iommu; diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index 20cb246598b1..ed459f6409a8 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1358,7 +1358,7 @@ static void dump_pci_devices(unsigned char ch) pcidevs_unlock(); } -static int __init setup_dump_pcidevs(void) +static int __init cf_check setup_dump_pcidevs(void) { register_keyhandler('Q', dump_pci_devices, "dump PCI devices", 1); return 0; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 34ea5f485de7..9e85016830bf 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -2154,7 +2154,7 @@ static void adjust_irq_affinity(struct acpi_drhd_unit *drhd) spin_unlock_irqrestore(&desc->lock, flags); } -static int adjust_vtd_irq_affinities(void) +static int cf_check adjust_vtd_irq_affinities(void) { struct acpi_drhd_unit *drhd; diff --git a/xen/drivers/passthrough/x86/hvm.c b/xen/drivers/passthrough/x86/hvm.c index 0b37cd145b60..e5a2c5830348 100644 --- a/xen/drivers/passthrough/x86/hvm.c +++ b/xen/drivers/passthrough/x86/hvm.c @@ -1076,7 +1076,7 @@ static struct notifier_block cpu_nfb = { .notifier_call = cpu_callback, }; -static int __init setup_dpci_softirq(void) +static int __init cf_check setup_dpci_softirq(void) { unsigned int cpu; From patchwork Mon Feb 14 12:50:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745576 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6CD2BC433F5 for ; Mon, 14 Feb 2022 13:07:02 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271783.466515 (Exim 4.92) (envelope-from ) id 1nJb48-0007lB-B8; Mon, 14 Feb 2022 13:06:52 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271783.466515; Mon, 14 Feb 2022 13:06:52 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb47-0007hl-Sn; Mon, 14 Feb 2022 13:06:51 +0000 Received: by outflank-mailman (input) for mailman id 271783; Mon, 14 Feb 2022 13:06:49 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb37-0008IH-Qm for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:50 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d3a3793b-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:48 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d3a3793b-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843948; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=wpC7OHZwlbhpO5r1RmqVd6pYMJ/HbdVJ8EUY+L3SZWA=; b=XX75n9f6efhcCupVnBRoo2pBpfUuOHA1OLKp+43u023cSUlwvhJo2exj 0MjZfCGqaD+s0VwwFPbumxxKNrqk69xUbra85iG4A7QvgypnFs1/coDRM L4HswO1wxcMecS0rSFA1QaXOlKEYKCTzRDI+VcVOh+47ohiiNP2y8fCJv 0=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: HhFuk9Q+k0qwxzBMTkHd8bbbX5Q0gHPvNI/XfoTIgc1RosQNASyqAu3saeVTLkNCSs8X49+GPB MMOagAMcYsHzHyxIET3RzsE+R8AID3U7KIJ9/zrY8mAhrvLFobcGoLY+08W4zHEJYKGk1MDIAc FktHzS0k969/2uRf8K+ColRkj8+epMR/eaL6y00L6+/E7CEi9EOL7Jtu9OcrX6zIiqP5W6mWv/ 9OxyBxx5M6QqAEyTbNX4g0t1bqieCqUmTlpPKcws8k3xeOVot7IOnNUGTjMoVCp0TApUMpOsZP K0MNQsKo3CyNungrpNxzedF7 X-SBRS: 5.1 X-MesageID: 64149429 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:pQ9VjKlyetOFyFuDjmbmqVvo5gyfIURdPkR7XQ2eYbSJt1+Wr1Gzt xJLCGHTPPzYZjanedt2bom+9x4Cv5bTmoJqTlBo+C40FyMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 N9dssaNFiwVBIbzqMQdQxdyIhtZNLITrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qHO 5tFM2sHgBLoUjJmCg4eF6gHnPqYjSLaYj14hVmUuv9ii4TU5FMoi+W8WDbPQfSaSMMQkkuGq 2bu+2XiHgpcJNGZ0SCC8H+nmqnIhyyTZW4JPOTmrLgw2gTVnzFNTk1NPbemnRWnokSuXIhid GcowAERnYgy5EKBf+PaVgLt9RZooSUgc9ZXFuQ77iSExazV/xuVCwA4c9JRVDA1nJRoHGJ3j zdli/usXGUy6+PNFRpx45/J9WvaBMQDEYMVicbopyMh6sKrnow8hwmnoj1LQP/s1Y2d9d0dL lm3QMkCa1c70JRjO0aTpwmvb9eQSn/hFFBd2+kvdjj5hj6Vnab8D2BS1XDV7OxbMKGSRUSbs X4PlqC2tb5SUc7dxHHQGLxWRtlFAspp1xWG3zZS82QJrWzxqxZPg6gMiN2BGKuZGpldImK4C KMikQhQ+IVSLBOXgVxfOOqM5zAR5fG4T7zND6mMBvIXO8QZXFLXrUlGOB/Lt0iwwRdErE3KE crCGSpaJS1BUvoPIfvfb7p17ILHMQhgmTKNFcijlUzPPHj3TCf9dIrp+WCmNogRhJ5oai2Pm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:tCAOL6BbVakdCkjlHemo55DYdb4zR+YMi2TC1yhKKCC9E/bo7/ xG885rtiMc5Ax/ZJhko6HlBEDiewKkyXcW2/hyAV7KZmCP0wHEQL2Kr7GSpAEIcxeOkNK1vp 0BT0ERMrPN5CBB/KPH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149429" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 11/70] xen: CFI hardening for notifier callbacks Date: Mon, 14 Feb 2022 12:50:28 +0000 Message-ID: <20220214125127.17985-12-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 2 +- xen/arch/x86/cpu/mcheck/mce.c | 2 +- xen/arch/x86/cpu/mcheck/mce_intel.c | 2 +- xen/arch/x86/cpu/mwait-idle.c | 4 ++-- xen/arch/x86/cpu/vpmu.c | 2 +- xen/arch/x86/genapic/x2apic.c | 2 +- xen/arch/x86/hvm/hvm.c | 2 +- xen/arch/x86/nmi.c | 2 +- xen/arch/x86/percpu.c | 2 +- xen/arch/x86/psr.c | 2 +- xen/arch/x86/smpboot.c | 2 +- xen/common/debugtrace.c | 4 ++-- xen/common/kexec.c | 2 +- xen/common/livepatch.c | 2 +- xen/common/rcupdate.c | 2 +- xen/common/sched/core.c | 2 +- xen/common/sched/cpupool.c | 2 +- xen/common/stop_machine.c | 2 +- xen/common/tasklet.c | 2 +- xen/common/timer.c | 2 +- xen/common/trace.c | 2 +- xen/drivers/cpufreq/cpufreq.c | 2 +- xen/drivers/cpufreq/cpufreq_misc_governors.c | 2 +- xen/drivers/passthrough/x86/hvm.c | 2 +- 24 files changed, 26 insertions(+), 26 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index 7902ccce6b98..fb47eb9ad68e 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -1622,7 +1622,7 @@ bool cpuidle_using_deep_cstate(void) : ACPI_STATE_C1); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index ea86d84481b2..a449fa0424ce 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -733,7 +733,7 @@ static int cpu_bank_alloc(unsigned int cpu) return 0; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index d63d6083d3a7..b6da8262e662 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -931,7 +931,7 @@ static int cpu_mcabank_alloc(unsigned int cpu) return -ENOMEM; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/cpu/mwait-idle.c b/xen/arch/x86/cpu/mwait-idle.c index 24d073d315ac..fe1b7af25f01 100644 --- a/xen/arch/x86/cpu/mwait-idle.c +++ b/xen/arch/x86/cpu/mwait-idle.c @@ -1275,8 +1275,8 @@ static int __init mwait_idle_probe(void) return 0; } -static int mwait_idle_cpu_init(struct notifier_block *nfb, - unsigned long action, void *hcpu) +static int cf_check mwait_idle_cpu_init( + struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu, cstate; struct acpi_processor_power *dev = processor_powers[cpu]; diff --git a/xen/arch/x86/cpu/vpmu.c b/xen/arch/x86/cpu/vpmu.c index 9fc897dc8403..df3c9201b2c1 100644 --- a/xen/arch/x86/cpu/vpmu.c +++ b/xen/arch/x86/cpu/vpmu.c @@ -817,7 +817,7 @@ long cf_check do_xenpmu_op( return ret; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/genapic/x2apic.c b/xen/arch/x86/genapic/x2apic.c index 9064a0ca4696..bd44bb753995 100644 --- a/xen/arch/x86/genapic/x2apic.c +++ b/xen/arch/x86/genapic/x2apic.c @@ -187,7 +187,7 @@ static const struct genapic __initconstrel apic_x2apic_cluster = { .send_IPI_self = send_IPI_self_x2apic }; -static int update_clusterinfo( +static int cf_check update_clusterinfo( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 2ae1685d0aff..0a193530680a 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -117,7 +117,7 @@ static const char __initconst warning_hvm_fep[] = static bool_t __initdata opt_altp2m_enabled = 0; boolean_param("altp2m", opt_altp2m_enabled); -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index 21e947a46f24..5c101a9f97b3 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -428,7 +428,7 @@ void setup_apic_nmi_watchdog(void) nmi_active = 1; } -static int cpu_nmi_callback( +static int cf_check cpu_nmi_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/percpu.c b/xen/arch/x86/percpu.c index 0e0b6577ca45..eb3ba7bc8874 100644 --- a/xen/arch/x86/percpu.c +++ b/xen/arch/x86/percpu.c @@ -63,7 +63,7 @@ static void free_percpu_area(unsigned int cpu) call_rcu(&info->rcu, _free_percpu_area); } -static int cpu_percpu_callback( +static int cf_check cpu_percpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c index 9a3670afc341..5b9991bd5b12 100644 --- a/xen/arch/x86/psr.c +++ b/xen/arch/x86/psr.c @@ -1642,7 +1642,7 @@ static void psr_cpu_fini(unsigned int cpu) free_socket_resources(socket); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { int rc = 0; diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c index 335129a0104d..709704d71ada 100644 --- a/xen/arch/x86/smpboot.c +++ b/xen/arch/x86/smpboot.c @@ -1112,7 +1112,7 @@ static int cpu_smpboot_alloc(unsigned int cpu) return rc; } -static int cpu_smpboot_callback( +static int cf_check cpu_smpboot_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/debugtrace.c b/xen/common/debugtrace.c index f3c0fd8aa17b..160d00b79607 100644 --- a/xen/common/debugtrace.c +++ b/xen/common/debugtrace.c @@ -263,8 +263,8 @@ static void debugtrace_alloc_buffer(struct debugtrace_data **ptr, *ptr = data; } -static int debugtrace_cpu_callback(struct notifier_block *nfb, - unsigned long action, void *hcpu) +static int cf_check debugtrace_cpu_callback( + struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/kexec.c b/xen/common/kexec.c index 36384f782db3..3b223cd03d75 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -531,7 +531,7 @@ static int kexec_init_cpu_notes(const unsigned long cpu) return ret; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned long cpu = (unsigned long)hcpu; diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c index 33708b4e2388..701efd87a173 100644 --- a/xen/common/livepatch.c +++ b/xen/common/livepatch.c @@ -2124,7 +2124,7 @@ static void livepatch_printall(unsigned char key) spin_unlock(&payload_lock); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/rcupdate.c b/xen/common/rcupdate.c index a5a27af3def0..2ec5606de5dd 100644 --- a/xen/common/rcupdate.c +++ b/xen/common/rcupdate.c @@ -641,7 +641,7 @@ static void rcu_init_percpu_data(int cpu, struct rcu_ctrlblk *rcp, init_timer(&rdp->idle_timer, rcu_idle_timer_handler, rdp, cpu); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 0f527024ba2e..4a79971a1d45 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2839,7 +2839,7 @@ void sched_rm_cpu(unsigned int cpu) cpu_schedule_down(cpu); } -static int cpu_schedule_callback( +static int cf_check cpu_schedule_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index f26c7f289539..e5cfb03b857e 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -985,7 +985,7 @@ void dump_runq(unsigned char key) spin_unlock(&cpupool_lock); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/stop_machine.c b/xen/common/stop_machine.c index 8979d553d677..a122bd4afe09 100644 --- a/xen/common/stop_machine.c +++ b/xen/common/stop_machine.c @@ -182,7 +182,7 @@ static void stopmachine_action(void *data) local_irq_enable(); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/tasklet.c b/xen/common/tasklet.c index ac89511a0955..1b16bbcdeb0b 100644 --- a/xen/common/tasklet.c +++ b/xen/common/tasklet.c @@ -214,7 +214,7 @@ void softirq_tasklet_init(struct tasklet *t, void (*func)(void *), void *data) t->is_softirq = 1; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/timer.c b/xen/common/timer.c index 1bb265ceea0e..b788050ea1d8 100644 --- a/xen/common/timer.c +++ b/xen/common/timer.c @@ -637,7 +637,7 @@ static void free_percpu_timers(unsigned int cpu) ASSERT(ts->heap == dummy_heap); } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/common/trace.c b/xen/common/trace.c index 61fecc2b2bd2..b5358508f804 100644 --- a/xen/common/trace.c +++ b/xen/common/trace.c @@ -79,7 +79,7 @@ static u32 tb_event_mask = TRC_ALL; * i.e., sizeof(_type) * ans >= _x. */ #define fit_to_type(_type, _x) (((_x)+sizeof(_type)-1) / sizeof(_type)) -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/drivers/cpufreq/cpufreq.c b/xen/drivers/cpufreq/cpufreq.c index e55e202d5a18..a94520ee57ac 100644 --- a/xen/drivers/cpufreq/cpufreq.c +++ b/xen/drivers/cpufreq/cpufreq.c @@ -632,7 +632,7 @@ static int __init cpufreq_cmdline_parse(const char *s) return rc; } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/drivers/cpufreq/cpufreq_misc_governors.c b/xen/drivers/cpufreq/cpufreq_misc_governors.c index 8343f491da87..ad79d0f5d246 100644 --- a/xen/drivers/cpufreq/cpufreq_misc_governors.c +++ b/xen/drivers/cpufreq/cpufreq_misc_governors.c @@ -91,7 +91,7 @@ cpufreq_userspace_handle_option(const char *name, const char *val) return 0; } -static int cpufreq_userspace_cpu_callback( +static int cf_check cpufreq_userspace_cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; diff --git a/xen/drivers/passthrough/x86/hvm.c b/xen/drivers/passthrough/x86/hvm.c index e5a2c5830348..527bd6a56d83 100644 --- a/xen/drivers/passthrough/x86/hvm.c +++ b/xen/drivers/passthrough/x86/hvm.c @@ -1046,7 +1046,7 @@ static void dpci_softirq(void) } } -static int cpu_callback( +static int cf_check cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { unsigned int cpu = (unsigned long)hcpu; From patchwork Mon Feb 14 12:50:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745610 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 085F2C433F5 for ; Mon, 14 Feb 2022 13:18:39 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272107.466929 (Exim 4.92) (envelope-from ) id 1nJbFM-0007yB-KW; Mon, 14 Feb 2022 13:18:28 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272107.466929; Mon, 14 Feb 2022 13:18:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbFM-0007y0-Gt; Mon, 14 Feb 2022 13:18:28 +0000 Received: by outflank-mailman (input) for mailman id 272107; Mon, 14 Feb 2022 13:18:27 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4f-0008IH-Jp for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:25 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0c8203ae-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:23 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0c8203ae-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844043; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=50D+xAeRBi7l/rNYWw5qNsHZx6AmOYhKRxvgdKe98Q8=; b=P1qPBZ2pQj1qm6Yuqkb3kIQYKWRRcUf2y3LTX3T4gcfMsjOOx0FNM0C0 O1cVFn2+thdotBF1TJhbd21K1o5Ejr1ibzYYQ94JyPH1ixxtEcIkamXrb EXNkPBhd5wDfvPpDIiyK15wW1RM0zOoJmVqaFUQBPnaFj8lXt5Elqu3WR E=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: mF2LEJABfwpSZn+t5sRoqTFHKf4A3rR44KKUo4Fj0EjvfnHaFz4SSMewpxCSkTqa+zh7fvzDrM AACnTSUqyHo693ghBv5CDbgw4jq/IGSLvuErrDz13pu68/VdgG5AYRarcx7v2ldDI2C0NM+ytw NVt4mNVwn1xBQRSNm0HSlq0WtpLeXmzi547Fk/xjrupKgsfjVkoT8codK8OqxXpqKB33afzWt2 7zO/+S1o20N8gyOnYLffrQeJYwlbE9PaL6cPGl20yOpSrX+lo+dHUAzpMYvh1Pw48u26+kp4k9 6Wug2SjvCovvG3aGfTj9i+SR X-SBRS: 5.1 X-MesageID: 64554431 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:GHuABKlxs0zTCM0Sbv1HJYXo5gyZIURdPkR7XQ2eYbSJt1+Wr1Gzt xJKWzuOafuINGL8eNgga4+19BsHu5eAz9RjTQtu/i41FiMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 OcRqLLubDouApLJnd9eQTxRHA9kOKITrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qDO pZFMmMHgBLoMh1wGVYwGp4Hkfq6gCXxfDxgt2mVuv9ii4TU5FMoi+W8WDbPQfSaSMMQkkuGq 2bu+2XiHgpcJNGZ0SCC8H+nmqnIhyyTZW4JPOTmrLgw2gTVnzFNTk1NPbemnRWnonziRvwBD nETxhUrqJNx5mmiQffnWhLt9RZooSUgc9ZXFuQ77iSExazV/xuVCwA4c9JRVDA1nJRoHGJ3j zdli/usXGUy6+PNFRpx45/J9WvaBMQDEYMVicbopyMh6sKrnow8hwmnoj1LQP/s1Y2d9d0dL lm3QMkCa1c70JRjO0aTpwmvb9eQSn/hFFBd2+kvdjj5hj6Vnab8D2BS1XDV7OxbMKGSRUSbs X4PlqC2tb5SUc7dxHHQGLxWRtlFAspp1xWG3zZS82QJrWzxqxZPg6gMiN2BGKuZGpldImK4C KMikQhQ+IVSLBOXgVxfOOqM5zAR5fG4T7zND6mMBvIXO8QZXFLXrUlGOB/Lt0iwwRdErE3KE crCGSpaJS1BUvoPIfvfb7p17ILHMQhgmTKNFcijlUzPPHj3TCf9dIrp+WCmNogRhJ5oai2Mr 4k32xKix0oNXevgTDPQ9IJPf1kGIWJiXcL9qtBNd/7FKQ1jQTlzB/jUyLInWopkg6UKybuYo iDjAhdVmAjlmHnKCQSWcXQ/Ornhaoly8CAgNis2MFf2h3V6OdSz7L0SfoccdKU88LAx1uZ9S vQIIp3SAvlGRjnd1S4aaJ3x8N5reBix3FrcNCu5ejkvOZVnQlWRqNPjewLu8ggIDza26pRi8 +HxiFuDTMNaFQp4DcvQZPa+9H+LvCAQyLBoQk/FAthPY0GwooJkHDP8060sKMYWJBSdmjbDj 1SKAQ0VrPXmqpMu9IWbnriNqoqkHrcsHkdeGGWHv7+6OTODozimyI5EFu2JYSrcRCX//6D7P bdZyPT1MfsmmldWstUjT+Y3nPxmv9a/9aVHyglEHWnQawX5A7xtFXCKwM1Tu/Af3bReowa3B hqC99Qy1W9l4y85/Ir9/DYYU9k= IronPort-HdrOrdr: A9a23:lkd4bq46E69fZZnnEwPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554431" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 12/70] xen: CFI hardening for acpi_table_parse() Date: Mon, 14 Feb 2022 12:50:29 +0000 Message-ID: <20220214125127.17985-13-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/boot.c | 24 ++++++++++++------------ xen/arch/x86/hvm/dom0_build.c | 16 ++++++++-------- xen/arch/x86/include/asm/tboot.h | 2 +- xen/arch/x86/srat.c | 4 ++-- xen/arch/x86/tboot.c | 2 +- xen/arch/x86/x86_64/acpi_mmcfg.c | 2 +- xen/arch/x86/x86_64/mmconfig.h | 2 +- xen/drivers/acpi/apei/hest.c | 4 ++-- xen/drivers/acpi/numa.c | 10 +++++----- xen/drivers/passthrough/amd/iommu_acpi.c | 9 +++++---- xen/drivers/passthrough/pci.c | 3 ++- xen/drivers/passthrough/vtd/dmar.c | 2 +- xen/include/xen/acpi.h | 2 +- 13 files changed, 42 insertions(+), 40 deletions(-) diff --git a/xen/arch/x86/acpi/boot.c b/xen/arch/x86/acpi/boot.c index cc4bbc0284fa..54b72d716bed 100644 --- a/xen/arch/x86/acpi/boot.c +++ b/xen/arch/x86/acpi/boot.c @@ -60,7 +60,7 @@ static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE; Boot-time Configuration -------------------------------------------------------------------------- */ -static int __init acpi_parse_madt(struct acpi_table_header *table) +static int __init cf_check acpi_parse_madt(struct acpi_table_header *table) { struct acpi_table_madt *madt = container_of(table, struct acpi_table_madt, header); @@ -77,7 +77,7 @@ static int __init acpi_parse_madt(struct acpi_table_header *table) return 0; } -static int __init +static int __init cf_check acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) { struct acpi_madt_local_x2apic *processor = @@ -133,7 +133,7 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) return 0; } -static int __init +static int __init cf_check acpi_parse_lapic(struct acpi_subtable_header * header, const unsigned long end) { struct acpi_madt_local_apic *processor = @@ -171,7 +171,7 @@ acpi_parse_lapic(struct acpi_subtable_header * header, const unsigned long end) return 0; } -static int __init +static int __init cf_check acpi_parse_lapic_addr_ovr(struct acpi_subtable_header * header, const unsigned long end) { @@ -187,7 +187,7 @@ acpi_parse_lapic_addr_ovr(struct acpi_subtable_header * header, return 0; } -static int __init +static int __init cf_check acpi_parse_x2apic_nmi(struct acpi_subtable_header *header, const unsigned long end) { @@ -206,7 +206,7 @@ acpi_parse_x2apic_nmi(struct acpi_subtable_header *header, return 0; } -static int __init +static int __init cf_check acpi_parse_lapic_nmi(struct acpi_subtable_header * header, const unsigned long end) { struct acpi_madt_local_apic_nmi *lapic_nmi = @@ -223,7 +223,7 @@ acpi_parse_lapic_nmi(struct acpi_subtable_header * header, const unsigned long e return 0; } -static int __init +static int __init cf_check acpi_parse_ioapic(struct acpi_subtable_header * header, const unsigned long end) { struct acpi_madt_io_apic *ioapic = @@ -240,7 +240,7 @@ acpi_parse_ioapic(struct acpi_subtable_header * header, const unsigned long end) return 0; } -static int __init +static int __init cf_check acpi_parse_int_src_ovr(struct acpi_subtable_header * header, const unsigned long end) { @@ -267,7 +267,7 @@ acpi_parse_int_src_ovr(struct acpi_subtable_header * header, return 0; } -static int __init +static int __init cf_check acpi_parse_nmi_src(struct acpi_subtable_header * header, const unsigned long end) { struct acpi_madt_nmi_source *nmi_src = @@ -283,7 +283,7 @@ acpi_parse_nmi_src(struct acpi_subtable_header * header, const unsigned long end return 0; } -static int __init acpi_parse_hpet(struct acpi_table_header *table) +static int __init cf_check acpi_parse_hpet(struct acpi_table_header *table) { const struct acpi_table_hpet *hpet_tbl = container_of(table, const struct acpi_table_hpet, header); @@ -319,7 +319,7 @@ static int __init acpi_parse_hpet(struct acpi_table_header *table) return 0; } -static int __init acpi_invalidate_bgrt(struct acpi_table_header *table) +static int __init cf_check acpi_invalidate_bgrt(struct acpi_table_header *table) { struct acpi_table_bgrt *bgrt_tbl = container_of(table, struct acpi_table_bgrt, header); @@ -472,7 +472,7 @@ acpi_fadt_parse_sleep_info(const struct acpi_table_fadt *fadt) acpi_sinfo.wakeup_vector, acpi_sinfo.vector_width); } -static int __init acpi_parse_fadt(struct acpi_table_header *table) +static int __init cf_check acpi_parse_fadt(struct acpi_table_header *table) { const struct acpi_table_fadt *fadt = container_of(table, const struct acpi_table_fadt, header); diff --git a/xen/arch/x86/hvm/dom0_build.c b/xen/arch/x86/hvm/dom0_build.c index f9e17249dcda..25fb05a389df 100644 --- a/xen/arch/x86/hvm/dom0_build.c +++ b/xen/arch/x86/hvm/dom0_build.c @@ -745,15 +745,15 @@ static int __init pvh_setup_cpus(struct domain *d, paddr_t entry, return 0; } -static int __init acpi_count_intr_ovr(struct acpi_subtable_header *header, - const unsigned long end) +static int __init cf_check acpi_count_intr_ovr( + struct acpi_subtable_header *header, const unsigned long end) { acpi_intr_overrides++; return 0; } -static int __init acpi_set_intr_ovr(struct acpi_subtable_header *header, - const unsigned long end) +static int __init cf_check acpi_set_intr_ovr( + struct acpi_subtable_header *header, const unsigned long end) { const struct acpi_madt_interrupt_override *intr = container_of(header, struct acpi_madt_interrupt_override, header); @@ -764,15 +764,15 @@ static int __init acpi_set_intr_ovr(struct acpi_subtable_header *header, return 0; } -static int __init acpi_count_nmi_src(struct acpi_subtable_header *header, - const unsigned long end) +static int __init cf_check acpi_count_nmi_src( + struct acpi_subtable_header *header, const unsigned long end) { acpi_nmi_sources++; return 0; } -static int __init acpi_set_nmi_src(struct acpi_subtable_header *header, - const unsigned long end) +static int __init cf_check acpi_set_nmi_src( + struct acpi_subtable_header *header, const unsigned long end) { const struct acpi_madt_nmi_source *src = container_of(header, struct acpi_madt_nmi_source, header); diff --git a/xen/arch/x86/include/asm/tboot.h b/xen/arch/x86/include/asm/tboot.h index bfeed1542fa3..818d5fa45132 100644 --- a/xen/arch/x86/include/asm/tboot.h +++ b/xen/arch/x86/include/asm/tboot.h @@ -124,7 +124,7 @@ void tboot_probe(void); void tboot_shutdown(uint32_t shutdown_type); int tboot_in_measured_env(void); int tboot_protect_mem_regions(void); -int tboot_parse_dmar_table(acpi_table_handler dmar_handler); +int cf_check tboot_parse_dmar_table(acpi_table_handler dmar_handler); int tboot_s3_resume(void); void tboot_s3_error(int error); int tboot_wake_ap(int apicid, unsigned long sipi_vec); diff --git a/xen/arch/x86/srat.c b/xen/arch/x86/srat.c index 6b77b9820195..cfe24c7e781c 100644 --- a/xen/arch/x86/srat.c +++ b/xen/arch/x86/srat.c @@ -407,8 +407,8 @@ void __init acpi_numa_arch_fixup(void) {} static uint64_t __initdata srat_region_mask; -static int __init srat_parse_region(struct acpi_subtable_header *header, - const unsigned long end) +static int __init cf_check srat_parse_region( + struct acpi_subtable_header *header, const unsigned long end) { struct acpi_srat_mem_affinity *ma; diff --git a/xen/arch/x86/tboot.c b/xen/arch/x86/tboot.c index 529367ed8167..fe1abfdf08ff 100644 --- a/xen/arch/x86/tboot.c +++ b/xen/arch/x86/tboot.c @@ -450,7 +450,7 @@ int __init tboot_protect_mem_regions(void) return 1; } -int __init tboot_parse_dmar_table(acpi_table_handler dmar_handler) +int __init cf_check tboot_parse_dmar_table(acpi_table_handler dmar_handler) { int rc; uint64_t size; diff --git a/xen/arch/x86/x86_64/acpi_mmcfg.c b/xen/arch/x86/x86_64/acpi_mmcfg.c index 0db8f57abbed..2159c68189e4 100644 --- a/xen/arch/x86/x86_64/acpi_mmcfg.c +++ b/xen/arch/x86/x86_64/acpi_mmcfg.c @@ -68,7 +68,7 @@ static int __init acpi_mcfg_check_entry(struct acpi_table_mcfg *mcfg, return -EINVAL; } -int __init acpi_parse_mcfg(struct acpi_table_header *header) +int __init cf_check acpi_parse_mcfg(struct acpi_table_header *header) { struct acpi_table_mcfg *mcfg; unsigned long i; diff --git a/xen/arch/x86/x86_64/mmconfig.h b/xen/arch/x86/x86_64/mmconfig.h index 4d3b9fcbdd3c..433046be663a 100644 --- a/xen/arch/x86/x86_64/mmconfig.h +++ b/xen/arch/x86/x86_64/mmconfig.h @@ -76,7 +76,7 @@ static inline void mmio_config_writel(void __iomem *pos, u32 val) /* function prototypes */ struct acpi_table_header; -int acpi_parse_mcfg(struct acpi_table_header *header); +int cf_check acpi_parse_mcfg(struct acpi_table_header *header); int pci_mmcfg_reserved(uint64_t address, unsigned int segment, unsigned int start_bus, unsigned int end_bus, unsigned int flags); diff --git a/xen/drivers/acpi/apei/hest.c b/xen/drivers/acpi/apei/hest.c index c5f3aaab7c4e..5881275d2f37 100644 --- a/xen/drivers/acpi/apei/hest.c +++ b/xen/drivers/acpi/apei/hest.c @@ -128,8 +128,8 @@ int apei_hest_parse(apei_hest_func_t func, void *data) * Check if firmware advertises firmware first mode. We need FF bit to be set * along with a set of MC banks which work in FF mode. */ -static int __init hest_parse_cmc(const struct acpi_hest_header *hest_hdr, - void *data) +static int __init cf_check hest_parse_cmc( + const struct acpi_hest_header *hest_hdr, void *data) { #ifdef CONFIG_X86_MCE unsigned int i; diff --git a/xen/drivers/acpi/numa.c b/xen/drivers/acpi/numa.c index 85f891757c21..bc6e888234e4 100644 --- a/xen/drivers/acpi/numa.c +++ b/xen/drivers/acpi/numa.c @@ -112,14 +112,14 @@ void __init acpi_table_print_srat_entry(struct acpi_subtable_header * header) } } -static int __init acpi_parse_slit(struct acpi_table_header *table) +static int __init cf_check acpi_parse_slit(struct acpi_table_header *table) { acpi_numa_slit_init((struct acpi_table_slit *)table); return 0; } -static int __init +static int __init cf_check acpi_parse_x2apic_affinity(struct acpi_subtable_header *header, const unsigned long end) { @@ -138,7 +138,7 @@ acpi_parse_x2apic_affinity(struct acpi_subtable_header *header, return 0; } -static int __init +static int __init cf_check acpi_parse_processor_affinity(struct acpi_subtable_header *header, const unsigned long end) { @@ -156,7 +156,7 @@ acpi_parse_processor_affinity(struct acpi_subtable_header *header, return 0; } -static int __init +static int __init cf_check acpi_parse_memory_affinity(struct acpi_subtable_header *header, const unsigned long end) { @@ -174,7 +174,7 @@ acpi_parse_memory_affinity(struct acpi_subtable_header *header, return 0; } -int __init acpi_parse_srat(struct acpi_table_header *table) +int __init cf_check acpi_parse_srat(struct acpi_table_header *table) { if (!table) return -EINVAL; diff --git a/xen/drivers/passthrough/amd/iommu_acpi.c b/xen/drivers/passthrough/amd/iommu_acpi.c index 5ea227732821..3a7931458944 100644 --- a/xen/drivers/passthrough/amd/iommu_acpi.c +++ b/xen/drivers/passthrough/amd/iommu_acpi.c @@ -1078,7 +1078,7 @@ static inline bool_t is_ivmd_block(u8 type) type == ACPI_IVRS_TYPE_MEMORY_IOMMU); } -static int __init parse_ivrs_table(struct acpi_table_header *table) +static int __init cf_check parse_ivrs_table(struct acpi_table_header *table) { const struct acpi_ivrs_header *ivrs_block; unsigned long length; @@ -1170,7 +1170,7 @@ static int __init parse_ivrs_table(struct acpi_table_header *table) return error; } -static int __init detect_iommu_acpi(struct acpi_table_header *table) +static int __init cf_check detect_iommu_acpi(struct acpi_table_header *table) { const struct acpi_ivrs_header *ivrs_block; unsigned long length = sizeof(struct acpi_table_ivrs); @@ -1264,7 +1264,8 @@ static int __init get_last_bdf_ivhd( return last_bdf; } -static int __init get_last_bdf_acpi(struct acpi_table_header *table) +static int __init cf_check cf_check get_last_bdf_acpi( + struct acpi_table_header *table) { const struct acpi_ivrs_header *ivrs_block; unsigned long length = sizeof(struct acpi_table_ivrs); @@ -1306,7 +1307,7 @@ int __init amd_iommu_update_ivrs_mapping_acpi(void) return acpi_table_parse(ACPI_SIG_IVRS, parse_ivrs_table); } -static int __init +static int __init cf_check get_supported_ivhd_type(struct acpi_table_header *table) { size_t length = sizeof(struct acpi_table_ivrs); diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index ed459f6409a8..c170dd06ba51 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1287,7 +1287,8 @@ static bool_t hest_source_is_pcie_aer(const struct acpi_hest_header *hest_hdr) return 0; } -static int aer_hest_parse(const struct acpi_hest_header *hest_hdr, void *data) +static int cf_check aer_hest_parse( + const struct acpi_hest_header *hest_hdr, void *data) { struct aer_hest_parse_info *info = data; const struct acpi_hest_aer_common *p; diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index b152f3da916b..b8e91f5be1ae 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -767,7 +767,7 @@ acpi_parse_one_rhsa(struct acpi_dmar_header *header) return ret; } -static int __init acpi_parse_dmar(struct acpi_table_header *table) +static int __init cf_check acpi_parse_dmar(struct acpi_table_header *table) { struct acpi_table_dmar *dmar; struct acpi_dmar_header *entry_header; diff --git a/xen/include/xen/acpi.h b/xen/include/xen/acpi.h index 08834f140266..39d51fcd01dd 100644 --- a/xen/include/xen/acpi.h +++ b/xen/include/xen/acpi.h @@ -91,7 +91,7 @@ struct acpi_subtable_header *acpi_table_get_entry_madt(enum acpi_madt_type id, int acpi_table_parse_madt(enum acpi_madt_type id, acpi_table_entry_handler handler, unsigned int max_entries); int acpi_table_parse_srat(int id, acpi_madt_entry_handler handler, unsigned int max_entries); -int acpi_parse_srat(struct acpi_table_header *); +int cf_check acpi_parse_srat(struct acpi_table_header *); void acpi_table_print (struct acpi_table_header *header, unsigned long phys_addr); void acpi_table_print_madt_entry (struct acpi_subtable_header *madt); void acpi_table_print_srat_entry (struct acpi_subtable_header *srat); From patchwork Mon Feb 14 12:50:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745559 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0C3F8C43217 for ; Mon, 14 Feb 2022 13:06:25 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271708.466342 (Exim 4.92) (envelope-from ) id 1nJb3X-0007SK-Db; Mon, 14 Feb 2022 13:06:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271708.466342; Mon, 14 Feb 2022 13:06:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3W-0007Qn-TN; Mon, 14 Feb 2022 13:06:14 +0000 Received: by outflank-mailman (input) for mailman id 271708; Mon, 14 Feb 2022 13:06:12 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2i-00023t-OI for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:24 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id c462146e-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:22 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: c462146e-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843923; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=bD8JK36vRGqRDSWFxaOE44j5YN40/rHS1DgBIOAI8XY=; b=Qi4Thg3sNKZGSa5toglCZzq0PTNWdHsNuRUIdLRJfOA/Mf4lELxzRoEr dGCXYrLb3pG4IrYr3Jj1EkCkxLqOvwZ0GQt4EUS9o0eBF2vQ2+3Yuf56S zrY35QhcLk2LYneEAQKV6zkSNTb8+t6/lM0VVsJmVytJMdsR9NdeMbzvz c=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: JVOdZys/aqxeJl7kRZqeuoSs2gZSKPJXjw27kX5woK0QSW0axl6G1Z3vIYYvJwiJEBAyN1z1s7 FcFvA8NkPiS0vbBuXYDuvBAuFyrJEkWgU+3/WMs1nUegjsCLrG8oKCH3wH5IgX1mT4NdtwM7YA MmciR7r702RXFzCvU5oiipJlD796xb+s1TYESeumuw35BQ5YHz6zWkcWYPTZAeCEBNwvnAz1Js kJujOxX9IlYiiWnjhuMZMgE1c3kHLMx2SJ5maSxgz6U0kGPTm7xmb3MmGSk8biovM5aagWW4rK g5hBfjI3SOzQi8a0VtQr+9yo X-SBRS: 5.1 X-MesageID: 64149402 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:JZd556CcLajG4RVW/zbkw5YqxClBgxIJ4kV8jS/XYbTApGhzhGAEx mZJC2GFa/7eNmDzfdAjbYXi/BsCu8DVmtUyQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/khuYkf1uz 8t0mcb3a0BzFfeLlbsvekwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgG5s15wWR54yY eIBaiJBchbGXidAZGgXGI8dh+ODjXXwJmgwRFW9+vNsvjm7IBZK+KjgNp/Zd8KHQe1Rn12Ev STW8mLhGBYYOdeDjz2f/RqRavTnxH2hHthITfvhq6As0Ab7KnEv5AM+THWqr9SmjVCHd4gYC QtO0XBpoPcA3Rn+JjXiZCGQrHmBtx8aftNfFewm9Q2AopbpDxal6nssFWAYNoF/3CMibXlzj wLSwYu1bdB6mODNERqgGqGoQSRe0MT/BUsLfmc6QAQM+LEPS6lj30uUHr6P/ENY5+AZ+A0cI RjX9kDSZJ1J1KbnMplXGnid3VqRSmDhFFJd2+kudjvNAvlFTICkfZe0zlPQ8OxNKo2UJnHY4 iRYxJjOsb1WVMrX/MBofAnqNOv3j8tpzRWG2QI/d3Xf32jFF4GfkXB4v2gleRYB3jcscj71e k7D0T69F7cIVEZGmZRfOtrrY+xzlPCIPY28Cpj8M4ofCrAsJVTv1Hw/OiatM5XFzRFEfVcXY szAL65BzB8yVMxa8dZBb7lBj+F7nH1irY4RLLiipymaPXOlTCb9Yd843JGmN4jVNYuI/1fY9 chxLcyPx0kNWeHyeHCPo4USMUoLPT4wApWv855bceuKIwxHHmA9CqCOneN9KtI9x6kFxP3V+ nydW1NDzAatj3PwNgjXOGtob6niXMgjoCtjbzAsJ1uhx1MqfZ2rsPUEb5IycLR+rL5jwPd4Q uMrYcKFBvgTGD3L9y5ENcv2rZB4dQTtjgWLZnL3bD86dp9mZgrI5t67IVe/qHhQVnK67JJsr aeh2wXXRYs4az5jVMuGOuiyy16RvGQGnL4gVUX/PdQOKl7n95JnKnKtg6Zvcd0MMxjK2hCTy x2SXUUDveDIroI4rIvJiKSDo9v7GudyBBMHTWzS7LLwPijG5Guzh4RHVb/QLzzaUWr1/oSkZ PlUkK6gYKFWwg4SvtouCatvwII/+8Dr9u1TwQlTFXnWa0imV+F7KX6c0MgT7qBAy9e1Y+dtt p5jLjWCBYi0BQ== IronPort-HdrOrdr: A9a23:2yNHlqlU6HyoEtjAouvxbGok/2fpDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149402" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 13/70] xen: CFI hardening for continue_hypercall_on_cpu() Date: Mon, 14 Feb 2022 12:50:30 +0000 Message-ID: <20220214125127.17985-14-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/power.c | 2 +- xen/arch/x86/cpu/microcode/core.c | 2 +- xen/arch/x86/include/asm/pv/shim.h | 4 ++-- xen/arch/x86/include/asm/smp.h | 6 +++--- xen/arch/x86/platform_hypercall.c | 4 ++-- xen/arch/x86/pv/shim.c | 4 ++-- xen/arch/x86/smp.c | 4 ++-- xen/arch/x86/sysctl.c | 2 +- xen/common/core_parking.c | 2 +- xen/common/kexec.c | 2 +- xen/common/sched/cpupool.c | 2 +- 11 files changed, 17 insertions(+), 17 deletions(-) diff --git a/xen/arch/x86/acpi/power.c b/xen/arch/x86/acpi/power.c index 912d4c4d62f4..c4e7e8698920 100644 --- a/xen/arch/x86/acpi/power.c +++ b/xen/arch/x86/acpi/power.c @@ -326,7 +326,7 @@ static int enter_state(u32 state) return error; } -static long enter_state_helper(void *data) +static long cf_check enter_state_helper(void *data) { struct acpi_sleep_info *sinfo = (struct acpi_sleep_info *)data; return enter_state(sinfo->sleep_state); diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index 46f55fe7f191..9631042190ab 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -558,7 +558,7 @@ struct ucode_buf { char buffer[]; }; -static long microcode_update_helper(void *data) +static long cf_check microcode_update_helper(void *data) { int ret; struct ucode_buf *buffer = data; diff --git a/xen/arch/x86/include/asm/pv/shim.h b/xen/arch/x86/include/asm/pv/shim.h index 6415f8068e5c..be4ae4e60bb8 100644 --- a/xen/arch/x86/include/asm/pv/shim.h +++ b/xen/arch/x86/include/asm/pv/shim.h @@ -38,8 +38,8 @@ void pv_shim_setup_dom(struct domain *d, l4_pgentry_t *l4start, start_info_t *si); int pv_shim_shutdown(uint8_t reason); void pv_shim_inject_evtchn(unsigned int port); -long pv_shim_cpu_up(void *data); -long pv_shim_cpu_down(void *data); +long cf_check pv_shim_cpu_up(void *data); +long cf_check pv_shim_cpu_down(void *data); void pv_shim_online_memory(unsigned int nr, unsigned int order); void pv_shim_offline_memory(unsigned int nr, unsigned int order); domid_t get_initial_domain_id(void); diff --git a/xen/arch/x86/include/asm/smp.h b/xen/arch/x86/include/asm/smp.h index f7485f602efa..1747772d232e 100644 --- a/xen/arch/x86/include/asm/smp.h +++ b/xen/arch/x86/include/asm/smp.h @@ -57,10 +57,10 @@ int cpu_add(uint32_t apic_id, uint32_t acpi_id, uint32_t pxm); void __stop_this_cpu(void); -long cpu_up_helper(void *data); -long cpu_down_helper(void *data); +long cf_check cpu_up_helper(void *data); +long cf_check cpu_down_helper(void *data); -long core_parking_helper(void *data); +long cf_check core_parking_helper(void *data); bool core_parking_remove(unsigned int cpu); uint32_t get_cur_idle_nums(void); diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index 84566bbfaa3d..f5d7adc1e802 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -45,7 +45,7 @@ struct resource_access { xenpf_resource_entry_t *entries; }; -long cpu_frequency_change_helper(void *); +long cf_check cpu_frequency_change_helper(void *); void check_resource_access(struct resource_access *); void resource_access(void *); @@ -59,7 +59,7 @@ DEFINE_SPINLOCK(xenpf_lock); # undef guest_from_compat_handle # define guest_from_compat_handle(x,y) ((x)=(y)) -long cpu_frequency_change_helper(void *data) +long cf_check cpu_frequency_change_helper(void *data) { return cpu_frequency_change((uint64_t)data); } diff --git a/xen/arch/x86/pv/shim.c b/xen/arch/x86/pv/shim.c index ae4d8913faa1..2ee290a3920d 100644 --- a/xen/arch/x86/pv/shim.c +++ b/xen/arch/x86/pv/shim.c @@ -845,7 +845,7 @@ int cf_check compat_grant_table_op( #endif #endif -long pv_shim_cpu_up(void *data) +long cf_check pv_shim_cpu_up(void *data) { struct vcpu *v = data; struct domain *d = v->domain; @@ -883,7 +883,7 @@ long pv_shim_cpu_up(void *data) return 0; } -long pv_shim_cpu_down(void *data) +long cf_check pv_shim_cpu_down(void *data) { struct vcpu *v = data; long rc; diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c index eef0f9c6cbf4..f4952a6bf9a5 100644 --- a/xen/arch/x86/smp.c +++ b/xen/arch/x86/smp.c @@ -399,7 +399,7 @@ void call_function_interrupt(struct cpu_user_regs *regs) smp_call_function_interrupt(); } -long cpu_up_helper(void *data) +long cf_check cpu_up_helper(void *data) { unsigned int cpu = (unsigned long)data; int ret = cpu_up(cpu); @@ -422,7 +422,7 @@ long cpu_up_helper(void *data) return ret; } -long cpu_down_helper(void *data) +long cf_check cpu_down_helper(void *data) { int cpu = (unsigned long)data; int ret = cpu_down(cpu); diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index aff52a13f373..1772f51f8f6e 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -79,7 +79,7 @@ static void l3_cache_get(void *arg) l3_info->size = info.size / 1024; /* in KB unit */ } -static long smt_up_down_helper(void *data) +static long cf_check smt_up_down_helper(void *data) { bool up = (bool)data; unsigned int cpu, sibling_mask = boot_cpu_data.x86_num_siblings - 1; diff --git a/xen/common/core_parking.c b/xen/common/core_parking.c index 44a907abfd7f..4afad04f2f68 100644 --- a/xen/common/core_parking.c +++ b/xen/common/core_parking.c @@ -169,7 +169,7 @@ static unsigned int core_parking_power(unsigned int event) return cpu; } -long core_parking_helper(void *data) +long cf_check core_parking_helper(void *data) { uint32_t idle_nums = (unsigned long)data; unsigned int cpu; diff --git a/xen/common/kexec.c b/xen/common/kexec.c index 3b223cd03d75..b222a5fd782e 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -395,7 +395,7 @@ void kexec_crash(enum crash_reason reason) BUG(); } -static long kexec_reboot(void *_image) +static long cf_check kexec_reboot(void *_image) { struct kexec_image *image = _image; diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index e5cfb03b857e..b9d4babd0d8a 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -544,7 +544,7 @@ static int cpupool_unassign_cpu_start(struct cpupool *c, unsigned int cpu) return ret; } -static long cpupool_unassign_cpu_helper(void *info) +static long cf_check cpupool_unassign_cpu_helper(void *info) { struct cpupool *c = info; long ret; From patchwork Mon Feb 14 12:50:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745552 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A523FC433F5 for ; Mon, 14 Feb 2022 13:05:12 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271649.466257 (Exim 4.92) (envelope-from ) id 1nJb2M-0002Y1-8x; Mon, 14 Feb 2022 13:05:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271649.466257; Mon, 14 Feb 2022 13:05:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2L-0002WP-Tm; Mon, 14 Feb 2022 13:05:01 +0000 Received: by outflank-mailman (input) for mailman id 271649; Mon, 14 Feb 2022 13:04:59 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2J-00023t-HR for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:59 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id b44e322f-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:04:56 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b44e322f-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843897; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=EY8ZkarZcewNBxs9p+GIs0w3h02UIU90azGWZSpiIn8=; b=OPx2bTsGVKk/62xkkCWnEYIam2zc40r8dNaavU1wSyynBFx+//M1zkrV pobGNGB9Fu/qah8WF+Ay239riHTBhtIWEM4Rc5pHLGUZBKC9/Y70carTR 9izE0looKvP3jVrU6ffUh3AEOy3PSeJr8UbS5IjT6irMFy8n0kjeCRpXt U=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: lrGRbVeK6QOXSw5wAUcVhWcw7xA8/bUr8mDWXFRSxZpgxHVy02daTvWPD8OITqMjreflBfYFav +yyMZ5ougwpaZ56EPOY33dIfArG99TFW3Cn2p78/E3yB3QxLOKhgjRFtQERfGRJH9tlHTD2hlL 8g4FO0eWLCaIRtdXOuMngBwtPVB35bqzJi9eWiupePa1m4/ormn/FSbVthalZ4ahKoDdKjhNiC D6M1a6o0HutMBDhRjv+zFDUYWph7F+iYLtuscB6qVRK8Z2+2sSJiIEI1PcxumX6B1bN/TZFH5b lXIoxcXKGR7IobCA5G8LuCMx X-SBRS: 5.1 X-MesageID: 64149659 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:RlvXQqm8pA1lK+JTilOzsl7o5gyeIURdPkR7XQ2eYbSJt1+Wr1Gzt xJKW2mBOvmKMDD9f4glbtvioE4Ov5SHmtRqGVNkqCAxESMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 MQOiYa2bwknB7LRk9pNcyRXPhF7MJQTrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qHO 5tHNGsHgBLobQETJA0xT4oEgbmTrSXQWTxCknaxqv9ii4TU5FMoi+W8WDbPQfSaSMMQkkuGq 2bu+2XiHgpcJNGZ0SCC8H+nmqnIhyyTZW4JPOTmrLgw2gTVnzFNTk1NPbemnRWnol/9Z8hZD UIawzUzppZi1HGkY+n4UiTt9RZooSUgc9ZXFuQ77iSExazV/xuVCwA4c9JRVDA1nJRoHGJ3j zdli/usXGUy6+PNFRpx45/J9WvaBMQDEYMVicbopyMh6sKrnow8hwmnoj1LQP/s1Y2d9d0dL lm3QMkCa1c70JRjO0aTpwmvb9eQSn/hFFBd2+kvdjj5hj6Vnab8D2BS1XDV7OxbMKGSRUSbs X4PlqC2tb5SUc7dxHHQGLxWRtlFAspp1xWG3zZS82QJrWzxqxZPg6gMiN2BGKuZGpldImK4C KMikQhQ+IVSLBOXgVxfOOqM5zAR5fG4T7zND6mMBvIXO8QZXFLXrUlGOB/Lt0iwwRdErE3KE crCGSpaJS1BUvoPIfvfb7p17ILHMQhgmT2NFcqmk3xKE9O2PRaodFvMC3PWBshR0U9OiFm9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:eA9V96uD7sAP5RijWtAMYd087skDdNV00zEX/kB9WHVpmszxra 6TdZUgpGbJYVkqOE3I9ertBEDEewK4yXcX2/h2AV7BZniEhILAFugLhuGO/9SjIVybygc079 YGT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149659" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 14/70] xen: CFI hardening for init_timer() Date: Mon, 14 Feb 2022 12:50:31 +0000 Message-ID: <20220214125127.17985-15-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/mcheck/amd_nonfatal.c | 2 +- xen/arch/x86/cpu/mcheck/non-fatal.c | 2 +- xen/arch/x86/hvm/pmtimer.c | 2 +- xen/arch/x86/hvm/rtc.c | 6 +++--- xen/arch/x86/hvm/viridian/time.c | 2 +- xen/arch/x86/hvm/vpt.c | 2 +- xen/arch/x86/irq.c | 4 ++-- xen/arch/x86/nmi.c | 2 +- xen/arch/x86/time.c | 4 ++-- xen/common/rcupdate.c | 2 +- xen/common/sched/core.c | 18 +++++++++--------- xen/common/sched/credit.c | 10 ++++------ xen/common/sched/credit2.c | 2 +- xen/common/sched/rt.c | 5 +++-- xen/drivers/char/ehci-dbgp.c | 2 +- xen/drivers/char/ns16550.c | 6 +++--- xen/drivers/cpufreq/cpufreq_ondemand.c | 2 +- 17 files changed, 36 insertions(+), 37 deletions(-) diff --git a/xen/arch/x86/cpu/mcheck/amd_nonfatal.c b/xen/arch/x86/cpu/mcheck/amd_nonfatal.c index 6e8901530a69..da0bf85f0223 100644 --- a/xen/arch/x86/cpu/mcheck/amd_nonfatal.c +++ b/xen/arch/x86/cpu/mcheck/amd_nonfatal.c @@ -127,7 +127,7 @@ static void mce_amd_checkregs(void *info) * multiple correctable errors between two polls. In that case, * increase polling frequency higher than normal. */ -static void mce_amd_work_fn(void *data) +static void cf_check mce_amd_work_fn(void *data) { on_each_cpu(mce_amd_checkregs, data, 1); diff --git a/xen/arch/x86/cpu/mcheck/non-fatal.c b/xen/arch/x86/cpu/mcheck/non-fatal.c index 2679c220a8a2..f7e411c0870e 100644 --- a/xen/arch/x86/cpu/mcheck/non-fatal.c +++ b/xen/arch/x86/cpu/mcheck/non-fatal.c @@ -67,7 +67,7 @@ static void mce_checkregs (void *info) } } -static void mce_work_fn(void *data) +static void cf_check mce_work_fn(void *data) { on_each_cpu(mce_checkregs, NULL, 1); diff --git a/xen/arch/x86/hvm/pmtimer.c b/xen/arch/x86/hvm/pmtimer.c index 97b9e41712fa..808819d1de91 100644 --- a/xen/arch/x86/hvm/pmtimer.c +++ b/xen/arch/x86/hvm/pmtimer.c @@ -124,7 +124,7 @@ static void pmt_update_time(PMTState *s) /* This function should be called soon after each time the MSB of the * pmtimer register rolls over, to make sure we update the status * registers and SCI at least once per rollover */ -static void pmt_timer_callback(void *opaque) +static void cf_check pmt_timer_callback(void *opaque) { PMTState *s = opaque; uint32_t pmt_cycles_until_flip; diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 3150f5f1479b..09d3501276bc 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -217,7 +217,7 @@ static void check_update_timer(RTCState *s) s->use_timer = 0; } -static void rtc_update_timer(void *opaque) +static void cf_check rtc_update_timer(void *opaque) { RTCState *s = opaque; @@ -230,7 +230,7 @@ static void rtc_update_timer(void *opaque) spin_unlock(&s->lock); } -static void rtc_update_timer2(void *opaque) +static void cf_check rtc_update_timer2(void *opaque) { RTCState *s = opaque; @@ -421,7 +421,7 @@ static void alarm_timer_update(RTCState *s) } } -static void rtc_alarm_cb(void *opaque) +static void cf_check rtc_alarm_cb(void *opaque) { RTCState *s = opaque; diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c index 24ff117edb20..b56fd6766292 100644 --- a/xen/arch/x86/hvm/viridian/time.c +++ b/xen/arch/x86/hvm/viridian/time.c @@ -126,7 +126,7 @@ static void stop_stimer(struct viridian_stimer *vs) vs->started = false; } -static void stimer_expire(void *data) +static void cf_check stimer_expire(void *data) { struct viridian_stimer *vs = data; struct vcpu *v = vs->v; diff --git a/xen/arch/x86/hvm/vpt.c b/xen/arch/x86/hvm/vpt.c index 6fdc3e19fe8c..cb1d81bf9e82 100644 --- a/xen/arch/x86/hvm/vpt.c +++ b/xen/arch/x86/hvm/vpt.c @@ -271,7 +271,7 @@ void pt_restore_timer(struct vcpu *v) pt_vcpu_unlock(v); } -static void pt_timer_fn(void *data) +static void cf_check pt_timer_fn(void *data) { struct periodic_time *pt = data; diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index bcf46cd54d16..f9c808455535 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -935,7 +935,7 @@ void alloc_direct_apic_vector( spin_unlock(&lock); } -static void irq_ratelimit_timer_fn(void *data) +static void cf_check irq_ratelimit_timer_fn(void *data) { struct irq_desc *desc, *tmp; unsigned long flags; @@ -1129,7 +1129,7 @@ static inline void clear_pirq_eoi(struct domain *d, unsigned int irq) static void set_eoi_ready(void *data); -static void irq_guest_eoi_timer_fn(void *data) +static void cf_check irq_guest_eoi_timer_fn(void *data) { struct irq_desc *desc = data; unsigned int i, irq = desc - irq_desc; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index 5c101a9f97b3..c8ae4a5d7460 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -211,7 +211,7 @@ void __init check_nmi_watchdog(void) return; } -static void nmi_timer_fn(void *unused) +static void cf_check nmi_timer_fn(void *unused) { this_cpu(nmi_timer_ticks)++; set_timer(&this_cpu(nmi_timer), NOW() + MILLISECS(1000)); diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 14f7d3fd635e..fac97023bf10 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -815,7 +815,7 @@ static s_time_t __read_platform_stime(u64 platform_time) return (stime_platform_stamp + scale_delta(diff, &plt_scale)); } -static void plt_overflow(void *unused) +static void cf_check plt_overflow(void *unused) { int i; u64 count; @@ -1855,7 +1855,7 @@ static void time_calibration_nop_rendezvous(void *rv) static void (*time_calibration_rendezvous_fn)(void *) = time_calibration_std_rendezvous; -static void time_calibration(void *unused) +static void cf_check time_calibration(void *unused) { struct calibration_rendezvous r = { .semaphore = ATOMIC_INIT(0) diff --git a/xen/common/rcupdate.c b/xen/common/rcupdate.c index 2ec5606de5dd..f9dd2584a8b7 100644 --- a/xen/common/rcupdate.c +++ b/xen/common/rcupdate.c @@ -575,7 +575,7 @@ static void rcu_idle_timer_stop(void) stop_timer(&rdp->idle_timer); } -static void rcu_idle_timer_handler(void* data) +static void cf_check rcu_idle_timer_handler(void* data) { perfc_incr(rcu_idle_timer); diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 4a79971a1d45..cf1ba01b4d87 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -71,10 +71,10 @@ cpumask_t sched_res_mask; static DEFINE_SPINLOCK(sched_free_cpu_lock); /* Various timer handlers. */ -static void s_timer_fn(void *unused); -static void vcpu_periodic_timer_fn(void *data); -static void vcpu_singleshot_timer_fn(void *data); -static void poll_timer_fn(void *data); +static void cf_check s_timer_fn(void *unused); +static void cf_check vcpu_periodic_timer_fn(void *data); +static void cf_check vcpu_singleshot_timer_fn(void *data); +static void cf_check poll_timer_fn(void *data); /* This is global for now so that private implementations can reach it */ DEFINE_PER_CPU_READ_MOSTLY(struct sched_resource *, sched_res); @@ -1535,7 +1535,7 @@ long vcpu_yield(void) return 0; } -static void domain_watchdog_timeout(void *data) +static void cf_check domain_watchdog_timeout(void *data) { struct domain *d = data; @@ -2697,28 +2697,28 @@ static void schedule(void) } /* The scheduler timer: force a run through the scheduler */ -static void s_timer_fn(void *unused) +static void cf_check s_timer_fn(void *unused) { raise_softirq(SCHEDULE_SOFTIRQ); SCHED_STAT_CRANK(sched_irq); } /* Per-VCPU periodic timer function: sends a virtual timer interrupt. */ -static void vcpu_periodic_timer_fn(void *data) +static void cf_check vcpu_periodic_timer_fn(void *data) { struct vcpu *v = data; vcpu_periodic_timer_work(v); } /* Per-VCPU single-shot timer function: sends a virtual timer interrupt. */ -static void vcpu_singleshot_timer_fn(void *data) +static void cf_check vcpu_singleshot_timer_fn(void *data) { struct vcpu *v = data; send_timer_event(v); } /* SCHEDOP_poll timeout callback. */ -static void poll_timer_fn(void *data) +static void cf_check poll_timer_fn(void *data) { struct vcpu *v = data; diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index d0aa017c643e..5635271f6fea 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -230,8 +230,8 @@ struct csched_private { struct timer master_ticker; }; -static void csched_tick(void *_cpu); -static void csched_acct(void *dummy); +static void cf_check csched_tick(void *_cpu); +static void cf_check csched_acct(void *dummy); static inline int __unit_on_runq(const struct csched_unit *svc) @@ -1356,8 +1356,7 @@ csched_runq_sort(struct csched_private *prv, unsigned int cpu) pcpu_schedule_unlock_irqrestore(lock, flags, cpu); } -static void -csched_acct(void* dummy) +static void cf_check csched_acct(void* dummy) { struct csched_private *prv = dummy; unsigned long flags; @@ -1563,8 +1562,7 @@ csched_acct(void* dummy) set_timer( &prv->master_ticker, NOW() + prv->tslice); } -static void -csched_tick(void *_cpu) +static void cf_check csched_tick(void *_cpu) { unsigned int cpu = (unsigned long)_cpu; const struct sched_resource *sr = get_sched_res(cpu); diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c index a5f073cda51e..d96e2749ddfb 100644 --- a/xen/common/sched/credit2.c +++ b/xen/common/sched/credit2.c @@ -2072,7 +2072,7 @@ static inline void do_replenish(struct csched2_dom *sdom) sdom->budget += sdom->tot_budget; } -static void replenish_domain_budget(void* data) +static void cf_check replenish_domain_budget(void *data) { struct csched2_dom *sdom = data; unsigned long flags; diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c index c24cd2ac3200..5ea6f01f263c 100644 --- a/xen/common/sched/rt.c +++ b/xen/common/sched/rt.c @@ -173,7 +173,7 @@ #define TRC_RTDS_SCHED_TASKLET TRC_SCHED_CLASS_EVT(RTDS, 5) #define TRC_RTDS_SCHEDULE TRC_SCHED_CLASS_EVT(RTDS, 6) -static void repl_timer_handler(void *data); +static void cf_check repl_timer_handler(void *data); /* * System-wide private data, include global RunQueue/DepletedQ @@ -1452,7 +1452,8 @@ rt_dom_cntl( * The replenishment timer handler picks units * from the replq and does the actual replenishment. */ -static void repl_timer_handler(void *data){ +static void cf_check repl_timer_handler(void *data) +{ s_time_t now; const struct scheduler *ops = data; struct rt_private *prv = rt_priv(ops); diff --git a/xen/drivers/char/ehci-dbgp.c b/xen/drivers/char/ehci-dbgp.c index c893d246defa..a6b57fdf2d19 100644 --- a/xen/drivers/char/ehci-dbgp.c +++ b/xen/drivers/char/ehci-dbgp.c @@ -1289,7 +1289,7 @@ static void _ehci_dbgp_poll(struct cpu_user_regs *regs) set_timer(&dbgp->timer, NOW() + timeout); } -static void ehci_dbgp_poll(void *data) +static void cf_check ehci_dbgp_poll(void *data) { poll_port = data; #ifdef run_in_exception_handler diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 30596d60d4ed..990cad39fe85 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -111,7 +111,7 @@ struct ns16550_config_param { static void enable_exar_enhanced_bits(const struct ns16550 *uart); #endif -static void ns16550_delayed_resume(void *data); +static void cf_check ns16550_delayed_resume(void *data); static u8 ns_read_reg(const struct ns16550 *uart, unsigned int reg) { @@ -229,7 +229,7 @@ static void __ns16550_poll(struct cpu_user_regs *regs) set_timer(&uart->timer, NOW() + MILLISECS(uart->timeout_ms)); } -static void ns16550_poll(void *data) +static void cf_check ns16550_poll(void *data) { this_cpu(poll_port) = data; #ifdef run_in_exception_handler @@ -532,7 +532,7 @@ static void _ns16550_resume(struct serial_port *port) } static int delayed_resume_tries; -static void ns16550_delayed_resume(void *data) +static void cf_check ns16550_delayed_resume(void *data) { struct serial_port *port = data; struct ns16550 *uart = port->uart; diff --git a/xen/drivers/cpufreq/cpufreq_ondemand.c b/xen/drivers/cpufreq/cpufreq_ondemand.c index cabd9ffa8886..ba03eaa2336d 100644 --- a/xen/drivers/cpufreq/cpufreq_ondemand.c +++ b/xen/drivers/cpufreq/cpufreq_ondemand.c @@ -172,7 +172,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info) } } -static void do_dbs_timer(void *dbs) +static void cf_check do_dbs_timer(void *dbs) { struct cpu_dbs_info_s *dbs_info = (struct cpu_dbs_info_s *)dbs; From patchwork Mon Feb 14 12:50:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745586 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4BB5DC433FE for ; Mon, 14 Feb 2022 13:16:25 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271911.466643 (Exim 4.92) (envelope-from ) id 1nJbDB-0001JU-RP; Mon, 14 Feb 2022 13:16:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271911.466643; Mon, 14 Feb 2022 13:16:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDB-0001JL-NZ; Mon, 14 Feb 2022 13:16:13 +0000 Received: by outflank-mailman (input) for mailman id 271911; Mon, 14 Feb 2022 13:16:12 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4l-0008IH-IZ for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:31 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 10903f77-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:30 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 10903f77-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844050; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=qS6HhUKN86A8O5F/mJjxVhOAaZfp/FzJTL8mzLuXTEg=; b=Kjf/OXFWAfIAFA9XcKlg8eZUEOSiyWZYH/GtFkREA9K+HCbi5ilmhxx7 7LvPauUBCcuE+cUHpi2x+UQBIknYIzksqVnc7HIJePU7L4SicftK2JHWL xxj+RvTZm7bmrDZgyje9aEonWVnVVV48YF+4+6HLdp1Xgo1bAoKYImgLN w=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: uSSGRCrGGWROjzd7XrtaTrhsfnXs5nikIijwlK+Rl6ZwFVbBzHkKT0hPoClM69p6DuRg4bGxbf iNePTXbFksnnZluH0HTDnKUeNKIJWBfbwxGojI11xQq4+Tl5jWQBWPyYsMQLQut2OIBER6hQXt ljKpl/643UWhWqu5wLwdbUsGJnB3ls2wbQ/5WSDaJZrCR7J3NbhNA5COIJljRjf/0f6bLfbo7D cM1bmQRRIKC/cAdfdWkjcsyYp8p4DOhR1r6MLSNn4NvB/VWvJtOs3D0sYSoZvt46EJ6GQ6ATKU At812VL6d/xvLUI/onkGRt0Q X-SBRS: 5.1 X-MesageID: 64554515 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:X538yay202sG4MOGOyR6t+cvwSrEfRIJ4+MujC+fZmUNrF6WrkVVm zAXDWqAPP+JZGXze9txbN6xpEkFu8eGzNAyQFFt/iAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt9NBk tdMtbGLdRcwY7f02880eERySD4raMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwTQKqDP pdxhTxHVQmHag8MZGguUqkwrb+DhUT/LWNgpwfAzUYwyzeKl1EguFT3C/LFd9rPSchLk0Kwo mPd43+/EhwcLMaYyzeO7jSrnOCnoM/gcNtMTvvirKcs2QDNgDxIYPELabelifqJ0Ey/W/9kF 1wNpzAW7oMb3xGBFcaoCnVUv0W4lhIbXtNRFcgz5weM1rfY7m6lO4QUctJSQId47ZFrHFTGw nfMxoq0XmI37NV5XFrAru/8kN+kBcQCwYbujwcgRBBN3dTsqZpbYvnnHoc6S/7dYjEY9FjNL 9G2QMoW2u97YS0jjfzTEbX7b9WE/Mahc+LNzl+LNl9JFysgDGJfW6Sm6ELA8dFLJ5uDQ1+Ks RAswpbCsL9eXczQzHXWGo3h+Y1FAN7fblXhbaNHRcF9p1xBBVb/FWyv3N2ODBgwaZtVEdMYS ETSpRlQ9Pdu0IiCNsdKj3aKI51yl8DITI29PtiNN4YmSsUhJWevoXA1DWbNjj+FraTZufxmU XttWZ33Vihy5GUO5GfeetrxJpd1mnFglTuLH8iTItbO+eP2WUN5gIwtaDOmBt3VJovd+Fi9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:FzHS1aFzFpbBqtNipLqE6seALOsnbusQ8zAXP0AYc3Jom62j5r mTdZsgtSMc5Ax8ZJhko6HkBEDiewK7yXcW2/hzAV7KZmCP0wHEEGgh1/qH/9SJIVyYygc378 ZdmsZFZ+EYdWIK7/rH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554515" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 15/70] xen: CFI hardening for call_rcu() Date: Mon, 14 Feb 2022 12:50:32 +0000 Message-ID: <20220214125127.17985-16-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/hvm/mtrr.c | 2 +- xen/arch/x86/hvm/vmsi.c | 2 +- xen/arch/x86/mm/mem_sharing.c | 2 +- xen/arch/x86/percpu.c | 2 +- xen/common/domain.c | 4 ++-- xen/common/radix-tree.c | 2 +- xen/common/rcupdate.c | 2 +- xen/common/sched/core.c | 2 +- xen/xsm/flask/avc.c | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/xen/arch/x86/hvm/mtrr.c b/xen/arch/x86/hvm/mtrr.c index b3ef1bf54133..42f3d8319296 100644 --- a/xen/arch/x86/hvm/mtrr.c +++ b/xen/arch/x86/hvm/mtrr.c @@ -586,7 +586,7 @@ int hvm_get_mem_pinned_cacheattr(struct domain *d, gfn_t gfn, return rc; } -static void free_pinned_cacheattr_entry(struct rcu_head *rcu) +static void cf_check free_pinned_cacheattr_entry(struct rcu_head *rcu) { xfree(container_of(rcu, struct hvm_mem_pinned_cacheattr_range, rcu)); } diff --git a/xen/arch/x86/hvm/vmsi.c b/xen/arch/x86/hvm/vmsi.c index 13e2a190b439..2889575a2035 100644 --- a/xen/arch/x86/hvm/vmsi.c +++ b/xen/arch/x86/hvm/vmsi.c @@ -441,7 +441,7 @@ static void add_msixtbl_entry(struct domain *d, list_add_rcu(&entry->list, &d->arch.hvm.msixtbl_list); } -static void free_msixtbl_entry(struct rcu_head *rcu) +static void cf_check free_msixtbl_entry(struct rcu_head *rcu) { struct msixtbl_entry *entry; diff --git a/xen/arch/x86/mm/mem_sharing.c b/xen/arch/x86/mm/mem_sharing.c index 74d2869c0e6f..15e6a7ed814b 100644 --- a/xen/arch/x86/mm/mem_sharing.c +++ b/xen/arch/x86/mm/mem_sharing.c @@ -75,7 +75,7 @@ static DEFINE_SPINLOCK(shr_audit_lock); static DEFINE_RCU_READ_LOCK(shr_audit_read_lock); /* RCU delayed free of audit list entry */ -static void _free_pg_shared_info(struct rcu_head *head) +static void cf_check _free_pg_shared_info(struct rcu_head *head) { xfree(container_of(head, struct page_sharing_info, rcu_head)); } diff --git a/xen/arch/x86/percpu.c b/xen/arch/x86/percpu.c index eb3ba7bc8874..46460689b73d 100644 --- a/xen/arch/x86/percpu.c +++ b/xen/arch/x86/percpu.c @@ -45,7 +45,7 @@ struct free_info { }; static DEFINE_PER_CPU(struct free_info, free_info); -static void _free_percpu_area(struct rcu_head *head) +static void cf_check _free_percpu_area(struct rcu_head *head) { struct free_info *info = container_of(head, struct free_info, rcu); unsigned int cpu = info->cpu; diff --git a/xen/common/domain.c b/xen/common/domain.c index 5df0d167537b..32ec156e6f6a 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -365,7 +365,7 @@ static int __init cf_check parse_extra_guest_irqs(const char *s) } custom_param("extra_guest_irqs", parse_extra_guest_irqs); -static void _free_pirq_struct(struct rcu_head *head) +static void cf_check _free_pirq_struct(struct rcu_head *head) { xfree(container_of(head, struct pirq, rcu_head)); } @@ -1108,7 +1108,7 @@ void vcpu_end_shutdown_deferral(struct vcpu *v) } /* Complete domain destroy after RCU readers are not holding old references. */ -static void complete_domain_destroy(struct rcu_head *head) +static void cf_check complete_domain_destroy(struct rcu_head *head) { struct domain *d = container_of(head, struct domain, rcu); struct vcpu *v; diff --git a/xen/common/radix-tree.c b/xen/common/radix-tree.c index 628a7e06988f..33b47748ae49 100644 --- a/xen/common/radix-tree.c +++ b/xen/common/radix-tree.c @@ -58,7 +58,7 @@ static struct radix_tree_node *rcu_node_alloc(void *arg) return rcu_node ? &rcu_node->node : NULL; } -static void _rcu_node_free(struct rcu_head *head) +static void cf_check _rcu_node_free(struct rcu_head *head) { struct rcu_node *rcu_node = container_of(head, struct rcu_node, rcu_head); diff --git a/xen/common/rcupdate.c b/xen/common/rcupdate.c index f9dd2584a8b7..423d6b1d6d02 100644 --- a/xen/common/rcupdate.c +++ b/xen/common/rcupdate.c @@ -167,7 +167,7 @@ static int rsinterval = 1000; static atomic_t cpu_count = ATOMIC_INIT(0); static atomic_t pending_count = ATOMIC_INIT(0); -static void rcu_barrier_callback(struct rcu_head *head) +static void cf_check rcu_barrier_callback(struct rcu_head *head) { /* * We need a barrier making all previous writes visible to other cpus diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index cf1ba01b4d87..285de9ee2a19 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2798,7 +2798,7 @@ static int cpu_schedule_up(unsigned int cpu) return 0; } -static void sched_res_free(struct rcu_head *head) +static void cf_check sched_res_free(struct rcu_head *head) { struct sched_resource *sr = container_of(head, struct sched_resource, rcu); diff --git a/xen/xsm/flask/avc.c b/xen/xsm/flask/avc.c index 87ea38b7a0d0..e20c16504213 100644 --- a/xen/xsm/flask/avc.c +++ b/xen/xsm/flask/avc.c @@ -276,7 +276,7 @@ int avc_get_hash_stats(struct xen_flask_hash_stats *arg) return 0; } -static void avc_node_free(struct rcu_head *rhead) +static void cf_check avc_node_free(struct rcu_head *rhead) { struct avc_node *node = container_of(rhead, struct avc_node, rhead); xfree(node); From patchwork Mon Feb 14 12:50:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745589 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9DC85C433FE for ; Mon, 14 Feb 2022 13:16:45 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271923.466676 (Exim 4.92) (envelope-from ) id 1nJbDW-0002tc-Ta; Mon, 14 Feb 2022 13:16:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271923.466676; Mon, 14 Feb 2022 13:16:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDW-0002tR-Pk; Mon, 14 Feb 2022 13:16:34 +0000 Received: by outflank-mailman (input) for mailman id 271923; Mon, 14 Feb 2022 13:16:34 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4e-0008IH-R5 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:25 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0c38c0dc-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:23 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0c38c0dc-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844042; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=9/V6nzRZ7VtFwWVXXCLQG4zjWKxi0K/Bd1I6aiIEiw4=; b=QwfDrd+KjLriMLTRD8JjDXaV2nHw8a8HueWc/3V+NCVzN7JvAH9/z7fH 0xfqQffuljFd1DVxeL8XN+x7qPNZvzhm4F5Kw3LgdhWuZN5E/Tv0Vi03a QaU8WASpp4R7stoivLdlKqBdK854CMoOTenN8KKhlvrtl8zFHtSagrIO8 Q=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: QoVcGhRi2qO89G0mlfsb3z4fJRpxrsWCEmF6IwH+yljjgQ6tmYJwawULIcQxB9vpa1O+JOptVA bKotuYX0SADBqbFVQiOG1r3zg9P2auTZSkj8pSLzYuyz4ZKERtSE20w/ElRbN5G+qa20yMck23 xNHi1dgvhE8BswwY8rc5rUY6kfcp5nHN6UjGAnWQnhHs5zJ15/ShNok35B++zocRrf9hjy8Yqc RJm7x70n8A5ocJ6g0Cygzd7AeePFcmWYHMxkiFy0cNWWVVzTnO2/OEWhQMLOMhtNy7N5UbNLvV Pc0x15hKmHTsn35tqjzmlU8z X-SBRS: 5.1 X-MesageID: 64554436 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:ylsxfa9MNE57VophY7JdDrUDmXmTJUtcMsCJ2f8bNWPcYEJGY0x3z mQZDW3UPPuOM2ejLYx/O9u+oExSu8PVz983SgVs/H08E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPhhx vUQr56/az4IM53ristGAiZBHSNXaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SQKuCO 5FHAdZpRC+cMjtyJVsZMc8dwbaUonbUTz5yuE3A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9GphG7jQdBQC XU19xoJv4dppXOyQNvUCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxgmzOJGMyTItbO+eP2WUN5gIwtaDOmBt3VJovd/Fy9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:1Yj2jamh1rf49naRkJgShayoFFjpDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554436" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 16/70] xen: CFI hardening for IPIs Date: Mon, 14 Feb 2022 12:50:33 +0000 Message-ID: <20220214125127.17985-17-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 2 +- xen/arch/x86/acpi/cpufreq/cpufreq.c | 8 ++++---- xen/arch/x86/acpi/cpufreq/powernow.c | 6 +++--- xen/arch/x86/acpi/lib.c | 2 +- xen/arch/x86/cpu/amd.c | 2 +- xen/arch/x86/cpu/mcheck/amd_nonfatal.c | 2 +- xen/arch/x86/cpu/mcheck/mce.c | 6 +++--- xen/arch/x86/cpu/mcheck/mce_intel.c | 2 +- xen/arch/x86/cpu/mcheck/non-fatal.c | 2 +- xen/arch/x86/cpu/microcode/core.c | 2 +- xen/arch/x86/cpu/mtrr/generic.c | 2 +- xen/arch/x86/cpu/mtrr/main.c | 2 +- xen/arch/x86/cpu/mwait-idle.c | 6 +++--- xen/arch/x86/cpu/vpmu.c | 4 ++-- xen/arch/x86/guest/xen/xen.c | 2 +- xen/arch/x86/hvm/nestedhvm.c | 3 +-- xen/arch/x86/hvm/vmx/vmcs.c | 2 +- xen/arch/x86/include/asm/mtrr.h | 2 +- xen/arch/x86/irq.c | 4 ++-- xen/arch/x86/nmi.c | 2 +- xen/arch/x86/oprofile/nmi_int.c | 10 +++++----- xen/arch/x86/oprofile/op_model_athlon.c | 2 +- xen/arch/x86/platform_hypercall.c | 4 ++-- xen/arch/x86/psr.c | 2 +- xen/arch/x86/shutdown.c | 4 ++-- xen/arch/x86/smp.c | 2 +- xen/arch/x86/sysctl.c | 2 +- xen/arch/x86/time.c | 8 ++++---- xen/common/cpu.c | 4 ++-- xen/common/gdbstub.c | 2 +- xen/common/keyhandler.c | 2 +- xen/common/page_alloc.c | 2 +- 32 files changed, 53 insertions(+), 54 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index fb47eb9ad68e..22c8bb0c2d94 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -145,7 +145,7 @@ struct hw_residencies uint64_t cc7; }; -static void do_get_hw_residencies(void *arg) +static void cf_check do_get_hw_residencies(void *arg) { struct cpuinfo_x86 *c = ¤t_cpu_data; struct hw_residencies *hw_res = arg; diff --git a/xen/arch/x86/acpi/cpufreq/cpufreq.c b/xen/arch/x86/acpi/cpufreq/cpufreq.c index 9510f05340aa..8133c2dd958c 100644 --- a/xen/arch/x86/acpi/cpufreq/cpufreq.c +++ b/xen/arch/x86/acpi/cpufreq/cpufreq.c @@ -129,7 +129,7 @@ struct drv_cmd { u32 val; }; -static void do_drv_read(void *drvcmd) +static void cf_check do_drv_read(void *drvcmd) { struct drv_cmd *cmd; @@ -148,7 +148,7 @@ static void do_drv_read(void *drvcmd) } } -static void do_drv_write(void *drvcmd) +static void cf_check do_drv_write(void *drvcmd) { struct drv_cmd *cmd; uint64_t msr_content; @@ -244,7 +244,7 @@ struct perf_pair { static DEFINE_PER_CPU(struct perf_pair, gov_perf_pair); static DEFINE_PER_CPU(struct perf_pair, usr_perf_pair); -static void read_measured_perf_ctrs(void *_readin) +static void cf_check read_measured_perf_ctrs(void *_readin) { struct perf_pair *readin = _readin; @@ -340,7 +340,7 @@ static unsigned int get_cur_freq_on_cpu(unsigned int cpu) return extract_freq(get_cur_val(cpumask_of(cpu)), data); } -static void feature_detect(void *info) +static void cf_check feature_detect(void *info) { struct cpufreq_policy *policy = info; unsigned int eax; diff --git a/xen/arch/x86/acpi/cpufreq/powernow.c b/xen/arch/x86/acpi/cpufreq/powernow.c index da8fc40b9a6f..ca71ecf72d67 100644 --- a/xen/arch/x86/acpi/cpufreq/powernow.c +++ b/xen/arch/x86/acpi/cpufreq/powernow.c @@ -44,12 +44,12 @@ #define ARCH_CPU_FLAG_RESUME 1 -static void transition_pstate(void *pstate) +static void cf_check transition_pstate(void *pstate) { wrmsrl(MSR_PSTATE_CTRL, *(unsigned int *)pstate); } -static void update_cpb(void *data) +static void cf_check update_cpb(void *data) { struct cpufreq_policy *policy = data; @@ -165,7 +165,7 @@ struct amd_cpu_data { u32 max_hw_pstate; }; -static void get_cpu_data(void *arg) +static void cf_check get_cpu_data(void *arg) { struct amd_cpu_data *data = arg; struct processor_performance *perf = data->perf; diff --git a/xen/arch/x86/acpi/lib.c b/xen/arch/x86/acpi/lib.c index b66e7338e74d..43831b92d132 100644 --- a/xen/arch/x86/acpi/lib.c +++ b/xen/arch/x86/acpi/lib.c @@ -99,7 +99,7 @@ unsigned int acpi_get_processor_id(unsigned int cpu) return INVALID_ACPIID; } -static void get_mwait_ecx(void *info) +static void cf_check get_mwait_ecx(void *info) { *(u32 *)info = cpuid_ecx(CPUID_MWAIT_LEAF); } diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c index a8e37dbb1f5c..2d18223f20ef 100644 --- a/xen/arch/x86/cpu/amd.c +++ b/xen/arch/x86/cpu/amd.c @@ -430,7 +430,7 @@ static void disable_c1_ramping(void) } } -static void disable_c1e(void *unused) +static void cf_check disable_c1e(void *unused) { uint64_t msr_content; diff --git a/xen/arch/x86/cpu/mcheck/amd_nonfatal.c b/xen/arch/x86/cpu/mcheck/amd_nonfatal.c index da0bf85f0223..efb45c931e1f 100644 --- a/xen/arch/x86/cpu/mcheck/amd_nonfatal.c +++ b/xen/arch/x86/cpu/mcheck/amd_nonfatal.c @@ -79,7 +79,7 @@ static int variable_period = 1; * Collects information of correctable errors and notifies * Dom0 via an event. */ -static void mce_amd_checkregs(void *info) +static void cf_check mce_amd_checkregs(void *info) { mctelem_cookie_t mctc; struct mca_summary bs; diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index a449fa0424ce..43f6c8471a90 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -961,7 +961,7 @@ void x86_mcinfo_dump(struct mc_info *mi) } while ( 1 ); } -static void do_mc_get_cpu_info(void *v) +static void cf_check do_mc_get_cpu_info(void *v) { int cpu = smp_processor_id(); int cindex, cpn; @@ -1242,7 +1242,7 @@ static void x86_mc_hwcr_wren_restore(uint64_t hwcr) wrmsrl(MSR_K8_HWCR, hwcr); } -static void x86_mc_msrinject(void *data) +static void cf_check x86_mc_msrinject(void *data) { struct xen_mc_msrinject *mci = data; struct mcinfo_msr *msr; @@ -1274,7 +1274,7 @@ static void x86_mc_msrinject(void *data) } /*ARGSUSED*/ -static void x86_mc_mceinject(void *data) +static void cf_check x86_mc_mceinject(void *data) { printk("Simulating #MC on cpu %d\n", smp_processor_id()); __asm__ __volatile__("int $0x12"); diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index b6da8262e662..a691e10bdcd6 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -599,7 +599,7 @@ static void mce_set_owner(void) cmci_discover(); } -static void __cpu_mcheck_distribute_cmci(void *unused) +static void cf_check __cpu_mcheck_distribute_cmci(void *unused) { cmci_discover(); } diff --git a/xen/arch/x86/cpu/mcheck/non-fatal.c b/xen/arch/x86/cpu/mcheck/non-fatal.c index f7e411c0870e..1c0c32ba0821 100644 --- a/xen/arch/x86/cpu/mcheck/non-fatal.c +++ b/xen/arch/x86/cpu/mcheck/non-fatal.c @@ -32,7 +32,7 @@ static uint64_t period = MCE_PERIOD; static int adjust = 0; static int variable_period = 1; -static void mce_checkregs (void *info) +static void cf_check mce_checkregs(void *info) { mctelem_cookie_t mctc; struct mca_summary bs; diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index 9631042190ab..841364208053 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -533,7 +533,7 @@ static int control_thread_fn(const struct microcode_patch *patch) return ret; } -static int do_microcode_update(void *patch) +static int cf_check do_microcode_update(void *patch) { unsigned int cpu = smp_processor_id(); int ret; diff --git a/xen/arch/x86/cpu/mtrr/generic.c b/xen/arch/x86/cpu/mtrr/generic.c index 883e3398ff71..7cf4cd01f3f6 100644 --- a/xen/arch/x86/cpu/mtrr/generic.c +++ b/xen/arch/x86/cpu/mtrr/generic.c @@ -84,7 +84,7 @@ bool is_var_mtrr_overlapped(const struct mtrr_state *m) return false; } -void mtrr_save_fixed_ranges(void *info) +void cf_check mtrr_save_fixed_ranges(void *info) { get_fixed_ranges(mtrr_state.fixed_ranges); } diff --git a/xen/arch/x86/cpu/mtrr/main.c b/xen/arch/x86/cpu/mtrr/main.c index 428133100d46..4e01c8d6f9df 100644 --- a/xen/arch/x86/cpu/mtrr/main.c +++ b/xen/arch/x86/cpu/mtrr/main.c @@ -131,7 +131,7 @@ struct set_mtrr_data { */ int hold_mtrr_updates_on_aps; -static void ipi_handler(void *info) +static void cf_check ipi_handler(void *info) /* [SUMMARY] Synchronisation handler. Executed by "other" CPUs. [RETURNS] Nothing. */ diff --git a/xen/arch/x86/cpu/mwait-idle.c b/xen/arch/x86/cpu/mwait-idle.c index fe1b7af25f01..927ce1b67aa5 100644 --- a/xen/arch/x86/cpu/mwait-idle.c +++ b/xen/arch/x86/cpu/mwait-idle.c @@ -877,7 +877,7 @@ static void mwait_idle(void) cpuidle_current_governor->reflect(power); } -static void auto_demotion_disable(void *dummy) +static void cf_check auto_demotion_disable(void *dummy) { u64 msr_bits; @@ -886,13 +886,13 @@ static void auto_demotion_disable(void *dummy) wrmsrl(MSR_PKG_CST_CONFIG_CONTROL, msr_bits); } -static void byt_auto_demotion_disable(void *dummy) +static void cf_check byt_auto_demotion_disable(void *dummy) { wrmsrl(MSR_CC6_DEMOTION_POLICY_CONFIG, 0); wrmsrl(MSR_MC6_DEMOTION_POLICY_CONFIG, 0); } -static void c1e_promotion_disable(void *dummy) +static void cf_check c1e_promotion_disable(void *dummy) { u64 msr_bits; diff --git a/xen/arch/x86/cpu/vpmu.c b/xen/arch/x86/cpu/vpmu.c index df3c9201b2c1..4fedc7c57012 100644 --- a/xen/arch/x86/cpu/vpmu.c +++ b/xen/arch/x86/cpu/vpmu.c @@ -335,7 +335,7 @@ void vpmu_do_interrupt(struct cpu_user_regs *regs) #endif } -static void vpmu_save_force(void *arg) +static void cf_check vpmu_save_force(void *arg) { struct vcpu *v = arg; struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -528,7 +528,7 @@ void vpmu_initialise(struct vcpu *v) put_vpmu(v); } -static void vpmu_clear_last(void *arg) +static void cf_check vpmu_clear_last(void *arg) { if ( this_cpu(last_vcpu) == arg ) this_cpu(last_vcpu) = NULL; diff --git a/xen/arch/x86/guest/xen/xen.c b/xen/arch/x86/guest/xen/xen.c index 2ff63d370a8a..b2aa3a009b4a 100644 --- a/xen/arch/x86/guest/xen/xen.c +++ b/xen/arch/x86/guest/xen/xen.c @@ -289,7 +289,7 @@ int xg_free_unused_page(mfn_t mfn) return rangeset_remove_range(mem, mfn_x(mfn), mfn_x(mfn)); } -static void ap_resume(void *unused) +static void cf_check ap_resume(void *unused) { BUG_ON(map_vcpuinfo()); BUG_ON(init_evtchn()); diff --git a/xen/arch/x86/hvm/nestedhvm.c b/xen/arch/x86/hvm/nestedhvm.c index 23516884482b..58370190ffc9 100644 --- a/xen/arch/x86/hvm/nestedhvm.c +++ b/xen/arch/x86/hvm/nestedhvm.c @@ -82,8 +82,7 @@ nestedhvm_vcpu_destroy(struct vcpu *v) alternative_vcall(hvm_funcs.nhvm_vcpu_destroy, v); } -static void -nestedhvm_flushtlb_ipi(void *info) +static void cf_check nestedhvm_flushtlb_ipi(void *info) { struct vcpu *v = current; struct domain *d = info; diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index f72a7db0453d..2b6bafe9d542 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -589,7 +589,7 @@ static void vmx_free_vmcs(paddr_t pa) free_domheap_page(maddr_to_page(pa)); } -static void __vmx_clear_vmcs(void *info) +static void cf_check __vmx_clear_vmcs(void *info) { struct vcpu *v = info; struct vmx_vcpu *vmx = &v->arch.hvm.vmx; diff --git a/xen/arch/x86/include/asm/mtrr.h b/xen/arch/x86/include/asm/mtrr.h index e0fd1005ce72..7733800b798f 100644 --- a/xen/arch/x86/include/asm/mtrr.h +++ b/xen/arch/x86/include/asm/mtrr.h @@ -64,7 +64,7 @@ struct mtrr_state { }; extern struct mtrr_state mtrr_state; -extern void mtrr_save_fixed_ranges(void *); +extern void cf_check mtrr_save_fixed_ranges(void *); extern void mtrr_save_state(void); extern int mtrr_add(unsigned long base, unsigned long size, unsigned int type, char increment); diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index f9c808455535..d9bd355113d7 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1127,7 +1127,7 @@ static inline void clear_pirq_eoi(struct domain *d, unsigned int irq) } } -static void set_eoi_ready(void *data); +static void cf_check set_eoi_ready(void *data); static void cf_check irq_guest_eoi_timer_fn(void *data) { @@ -1398,7 +1398,7 @@ static void __set_eoi_ready(const struct irq_desc *desc) } /* Mark specified IRQ as ready-for-EOI (if it really is) and attempt to EOI. */ -static void set_eoi_ready(void *data) +static void cf_check set_eoi_ready(void *data) { struct irq_desc *desc = data; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index c8ae4a5d7460..e20d1393c881 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -149,7 +149,7 @@ int nmi_active; (P4_CCCR_OVF_PMI0|P4_CCCR_THRESHOLD(15)|P4_CCCR_COMPLEMENT| \ P4_CCCR_COMPARE|P4_CCCR_REQUIRED|P4_CCCR_ESCR_SELECT(4)|P4_CCCR_ENABLE) -static void __init wait_for_nmis(void *p) +static void __init cf_check wait_for_nmis(void *p) { unsigned int start_count = this_cpu(nmi_count); unsigned long ticks = 10 * 1000 * cpu_khz / nmi_hz; diff --git a/xen/arch/x86/oprofile/nmi_int.c b/xen/arch/x86/oprofile/nmi_int.c index ba9c4b9804ca..6ebe20bd1d3e 100644 --- a/xen/arch/x86/oprofile/nmi_int.c +++ b/xen/arch/x86/oprofile/nmi_int.c @@ -131,7 +131,7 @@ static void nmi_cpu_save_registers(struct op_msrs *msrs) } -static void nmi_save_registers(void * dummy) +static void cf_check nmi_save_registers(void *dummy) { int cpu = smp_processor_id(); struct op_msrs * msrs = &cpu_msrs[cpu]; @@ -179,7 +179,7 @@ static int allocate_msrs(void) } -static void nmi_cpu_setup(void * dummy) +static void cf_check nmi_cpu_setup(void *dummy) { int cpu = smp_processor_id(); struct op_msrs * msrs = &cpu_msrs[cpu]; @@ -245,7 +245,7 @@ static void nmi_restore_registers(struct op_msrs * msrs) } -static void nmi_cpu_shutdown(void * dummy) +static void cf_check nmi_cpu_shutdown(void *dummy) { int cpu = smp_processor_id(); struct op_msrs * msrs = &cpu_msrs[cpu]; @@ -261,7 +261,7 @@ void nmi_release_counters(void) } -static void nmi_cpu_start(void * dummy) +static void cf_check nmi_cpu_start(void *dummy) { int cpu = smp_processor_id(); struct op_msrs const * msrs = &cpu_msrs[cpu]; @@ -278,7 +278,7 @@ int nmi_start(void) } -static void nmi_cpu_stop(void * dummy) +static void cf_check nmi_cpu_stop(void *dummy) { unsigned int v; int cpu = smp_processor_id(); diff --git a/xen/arch/x86/oprofile/op_model_athlon.c b/xen/arch/x86/oprofile/op_model_athlon.c index ee6eb0ecae79..2177f02946e2 100644 --- a/xen/arch/x86/oprofile/op_model_athlon.c +++ b/xen/arch/x86/oprofile/op_model_athlon.c @@ -436,7 +436,7 @@ static void athlon_stop(struct op_msrs const * const msrs) #define APIC_EILVT_MSG_NMI 0x4 #define APIC_EILVT_LVTOFF_IBS 1 #define APIC_EILVTn(n) (0x500 + 0x10 * n) -static inline void __init init_ibs_nmi_per_cpu(void *arg) +static inline void __init cf_check init_ibs_nmi_per_cpu(void *arg) { unsigned long reg; diff --git a/xen/arch/x86/platform_hypercall.c b/xen/arch/x86/platform_hypercall.c index f5d7adc1e802..b91ccff58900 100644 --- a/xen/arch/x86/platform_hypercall.c +++ b/xen/arch/x86/platform_hypercall.c @@ -47,7 +47,7 @@ struct resource_access { long cf_check cpu_frequency_change_helper(void *); void check_resource_access(struct resource_access *); -void resource_access(void *); +void cf_check resource_access(void *); #ifndef COMPAT typedef long ret_t; @@ -149,7 +149,7 @@ void check_resource_access(struct resource_access *ra) ra->nr_done = i; } -void resource_access(void *info) +void cf_check resource_access(void *info) { struct resource_access *ra = info; unsigned int i; diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c index 5b9991bd5b12..6c9cabf3843d 100644 --- a/xen/arch/x86/psr.c +++ b/xen/arch/x86/psr.c @@ -1247,7 +1247,7 @@ struct cos_write_info const uint32_t *val; }; -static void do_write_psr_msrs(void *data) +static void cf_check do_write_psr_msrs(void *data) { const struct cos_write_info *info = data; unsigned int i, index, cos = info->cos; diff --git a/xen/arch/x86/shutdown.c b/xen/arch/x86/shutdown.c index ad3e3a76916f..30985d36a612 100644 --- a/xen/arch/x86/shutdown.c +++ b/xen/arch/x86/shutdown.c @@ -118,7 +118,7 @@ static inline void kb_wait(void) break; } -static void noreturn __machine_halt(void *unused) +static void noreturn cf_check __machine_halt(void *unused) { local_irq_disable(); @@ -548,7 +548,7 @@ static int __init cf_check reboot_init(void) } __initcall(reboot_init); -static void noreturn __machine_restart(void *pdelay) +static void cf_check noreturn __machine_restart(void *pdelay) { machine_restart(*(unsigned int *)pdelay); } diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c index f4952a6bf9a5..f6fd7f95df58 100644 --- a/xen/arch/x86/smp.c +++ b/xen/arch/x86/smp.c @@ -339,7 +339,7 @@ void __stop_this_cpu(void) cpumask_clear_cpu(smp_processor_id(), &cpu_online_map); } -static void stop_this_cpu(void *dummy) +static void cf_check stop_this_cpu(void *dummy) { __stop_this_cpu(); for ( ; ; ) diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c index 1772f51f8f6e..f82abc248885 100644 --- a/xen/arch/x86/sysctl.c +++ b/xen/arch/x86/sysctl.c @@ -69,7 +69,7 @@ struct l3_cache_info { unsigned long size; }; -static void l3_cache_get(void *arg) +static void cf_check l3_cache_get(void *arg) { struct cpuid4_info info; struct l3_cache_info *l3_info = arg; diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index fac97023bf10..b444d6344e79 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -1661,7 +1661,7 @@ static void check_tsc_warp(unsigned long tsc_khz, unsigned long *max_warp) static unsigned long tsc_max_warp, tsc_check_count; static cpumask_t tsc_check_cpumask; -static void tsc_check_slave(void *unused) +static void cf_check tsc_check_slave(void *unused) { unsigned int cpu = smp_processor_id(); local_irq_disable(); @@ -1809,7 +1809,7 @@ static void time_calibration_tsc_rendezvous(void *_r) } /* Ordinary rendezvous function which does not modify TSC values. */ -static void time_calibration_std_rendezvous(void *_r) +static void cf_check time_calibration_std_rendezvous(void *_r) { struct calibration_rendezvous *r = _r; unsigned int total_cpus = cpumask_weight(&r->cpu_calibration_map); @@ -1840,7 +1840,7 @@ static void time_calibration_std_rendezvous(void *_r) * Rendezvous function used when clocksource is TSC and * no CPU hotplug will be performed. */ -static void time_calibration_nop_rendezvous(void *rv) +static void cf_check time_calibration_nop_rendezvous(void *rv) { const struct calibration_rendezvous *r = rv; struct cpu_time_stamp *c = &this_cpu(cpu_calibration); @@ -2032,7 +2032,7 @@ static void __init tsc_check_writability(void) disable_tsc_sync = true; } -static void __init reset_percpu_time(void *unused) +static void __init cf_check reset_percpu_time(void *unused) { struct cpu_time *t = &this_cpu(cpu_time); diff --git a/xen/common/cpu.c b/xen/common/cpu.c index 1f976db0a51f..b0b63cdb3638 100644 --- a/xen/common/cpu.c +++ b/xen/common/cpu.c @@ -84,13 +84,13 @@ static int cpu_notifier_call_chain(unsigned int cpu, unsigned long action, return ret; } -static void _take_cpu_down(void *unused) +static void cf_check _take_cpu_down(void *unused) { cpu_notifier_call_chain(smp_processor_id(), CPU_DYING, NULL, true); __cpu_disable(); } -static int take_cpu_down(void *arg) +static int cf_check take_cpu_down(void *arg) { _take_cpu_down(arg); return 0; diff --git a/xen/common/gdbstub.c b/xen/common/gdbstub.c index 99bfd9a654c9..079c3ca9616a 100644 --- a/xen/common/gdbstub.c +++ b/xen/common/gdbstub.c @@ -660,7 +660,7 @@ static int __init cf_check initialise_gdb(void) } presmp_initcall(initialise_gdb); -static void gdb_pause_this_cpu(void *unused) +static void cf_check gdb_pause_this_cpu(void *unused) { unsigned long flags; diff --git a/xen/common/keyhandler.c b/xen/common/keyhandler.c index 8b9f37837162..2c916d528ab2 100644 --- a/xen/common/keyhandler.c +++ b/xen/common/keyhandler.c @@ -360,7 +360,7 @@ static cpumask_t read_clocks_cpumask; static DEFINE_PER_CPU(s_time_t, read_clocks_time); static DEFINE_PER_CPU(u64, read_cycles_time); -static void read_clocks_slave(void *unused) +static void cf_check read_clocks_slave(void *unused) { unsigned int cpu = smp_processor_id(); local_irq_disable(); diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 561e238d2d6a..827617502e35 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1898,7 +1898,7 @@ void __init end_boot_allocator(void) printk("\n"); } -static void __init smp_scrub_heap_pages(void *data) +static void __init cf_check smp_scrub_heap_pages(void *data) { unsigned long mfn, start, end; struct page_info *pg; From patchwork Mon Feb 14 12:50:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745608 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 34879C433F5 for ; Mon, 14 Feb 2022 13:18:20 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272071.466895 (Exim 4.92) (envelope-from ) id 1nJbF4-0005iX-6d; Mon, 14 Feb 2022 13:18:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272071.466895; Mon, 14 Feb 2022 13:18:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbF4-0005hS-33; Mon, 14 Feb 2022 13:18:10 +0000 Received: by outflank-mailman (input) for mailman id 272071; Mon, 14 Feb 2022 13:18:08 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3l-0008IH-Ec for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:29 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id eadbca62-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:28 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: eadbca62-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843988; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=h+vNUb1K3qAiOZwiXH80qTGxNUF4bFpNl76o3YyTOpc=; b=ZdeQ/hRJt896EmCTmguNr53p9h0tcZqPceGtp/Bav7CuTjfSCIHot6Mo ZU5igBCAoGN3oErOgyKFxHcouIvottesB7vUB8frBPnFg0SVxKZuqGSB/ 4eiiI9Ml9X/yV6XO045UU3rTeYdpSY743cEtOlCm9ccURuIHVE/WAQcRq E=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: KulfqVaK5LenOMOoXmgXYyGfQJJez7i9OkIgiVROgNMzcLpsHBgqp/5NBBOAJYY42wQdr78krW e9yWNpEzg+P9vLzUpn1zSLH9nmjSgdvgCAoDsWySONr2xE4wh++RyQttCTAFPESaO1WaqFw4he XTtQr0bJ4nTrbS4i/sKtDr7XMObdBUOrYBOknFiFT9Jl+Dctrh87JuTvi6CVlJEktOqEIaFde+ EO2SIBLHPzxDo4zy6UhWzeVZKzcW5g7c2stmgKJcBfCyUe06pj8urkM80uSXiMHOxsBymKq2os g9hvjxtEvD8ln8+hzNoN8kdt X-SBRS: 5.1 X-MesageID: 64050701 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:loj35q9Mz78BUR+WFwm7DrUDmXmTJUtcMsCJ2f8bNWPcYEJGY0x3y WseXW/TO67fZGLwL950bInjpEhU75OBnNNmHQU/pHg8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPhOy tJS7pDtGDwbL5/LqfojegBcMihHaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SRauGO JJAAdZpRCb5UjpdHEgOMZgdgcel11j6aDgDuV3A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9GGiEmhAN4Ce ncm6xgpnLYM3VWvb9DECkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+Vm9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:jNMuyK97mfFpEJgvLhluk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050701" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 17/70] xen: CFI hardening for open_softirq() Date: Mon, 14 Feb 2022 12:50:34 +0000 Message-ID: <20220214125127.17985-18-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/mcheck/mce.c | 2 +- xen/arch/x86/domain.c | 2 +- xen/arch/x86/include/asm/flushtlb.h | 2 +- xen/arch/x86/pv/traps.c | 2 +- xen/arch/x86/smp.c | 2 +- xen/arch/x86/time.c | 2 +- xen/common/rcupdate.c | 2 +- xen/common/sched/core.c | 6 +++--- xen/common/tasklet.c | 2 +- xen/common/timer.c | 2 +- xen/drivers/passthrough/x86/hvm.c | 2 +- 11 files changed, 13 insertions(+), 13 deletions(-) diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index 43f6c8471a90..3467e0f1a315 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -1837,7 +1837,7 @@ static int mce_delayed_action(mctelem_cookie_t mctc) } /* Softirq Handler for this MCE# processing */ -static void mce_softirq(void) +static void cf_check mce_softirq(void) { static DEFINE_MCE_BARRIER(mce_inside_bar); static DEFINE_MCE_BARRIER(mce_severity_bar); diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index f943283b2a88..1c3a1ec2a080 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -2523,7 +2523,7 @@ void vcpu_mark_events_pending(struct vcpu *v) vcpu_kick(v); } -static void vcpu_kick_softirq(void) +static void cf_check vcpu_kick_softirq(void) { /* * Nothing to do here: we merely prevent notifiers from racing with checks diff --git a/xen/arch/x86/include/asm/flushtlb.h b/xen/arch/x86/include/asm/flushtlb.h index 0be2273387ed..18777f1d4c00 100644 --- a/xen/arch/x86/include/asm/flushtlb.h +++ b/xen/arch/x86/include/asm/flushtlb.h @@ -87,7 +87,7 @@ static inline void tlbflush_filter(cpumask_t *mask, uint32_t page_timestamp) __cpumask_clear_cpu(cpu, mask); } -void new_tlbflush_clock_period(void); +void cf_check new_tlbflush_clock_period(void); /* Read pagetable base. */ static inline unsigned long read_cr3(void) diff --git a/xen/arch/x86/pv/traps.c b/xen/arch/x86/pv/traps.c index 170e1030982b..97fe54b5ee5a 100644 --- a/xen/arch/x86/pv/traps.c +++ b/xen/arch/x86/pv/traps.c @@ -130,7 +130,7 @@ bool set_guest_nmi_trapbounce(void) static DEFINE_PER_CPU(struct vcpu *, softirq_nmi_vcpu); -static void nmi_softirq(void) +static void cf_check nmi_softirq(void) { struct vcpu **v_ptr = &this_cpu(softirq_nmi_vcpu); diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c index f6fd7f95df58..b9a696f61963 100644 --- a/xen/arch/x86/smp.c +++ b/xen/arch/x86/smp.c @@ -290,7 +290,7 @@ void flush_area_mask(const cpumask_t *mask, const void *va, unsigned int flags) } /* Call with no locks held and interrupts enabled (e.g., softirq context). */ -void new_tlbflush_clock_period(void) +void cf_check new_tlbflush_clock_period(void) { cpumask_t allbutself; diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index b444d6344e79..5a72b66800e4 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -1455,7 +1455,7 @@ int cpu_frequency_change(u64 freq) static DEFINE_PER_CPU(struct cpu_time_stamp, cpu_calibration); /* Softirq handler for per-CPU time calibration. */ -static void local_time_calibration(void) +static void cf_check local_time_calibration(void) { struct cpu_time *t = &this_cpu(cpu_time); const struct cpu_time_stamp *c = &this_cpu(cpu_calibration); diff --git a/xen/common/rcupdate.c b/xen/common/rcupdate.c index 423d6b1d6d02..212a99acd8c8 100644 --- a/xen/common/rcupdate.c +++ b/xen/common/rcupdate.c @@ -466,7 +466,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp, rcu_do_batch(rdp); } -static void rcu_process_callbacks(void) +static void cf_check rcu_process_callbacks(void) { struct rcu_data *rdp = &this_cpu(rcu_data); diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index 285de9ee2a19..b1836b591c0a 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -2568,7 +2568,7 @@ static struct sched_unit *sched_wait_rendezvous_in(struct sched_unit *prev, return prev->next_task; } -static void sched_slave(void) +static void cf_check sched_slave(void) { struct vcpu *v, *vprev = current; struct sched_unit *prev = vprev->sched_unit, *next; @@ -2632,7 +2632,7 @@ static void sched_slave(void) * - deschedule the current domain (scheduler independent). * - pick a new domain (scheduler dependent). */ -static void schedule(void) +static void cf_check schedule(void) { struct vcpu *vnext, *vprev = current; struct sched_unit *prev = vprev->sched_unit, *next = NULL; @@ -2928,7 +2928,7 @@ const cpumask_t *sched_get_opt_cpumask(enum sched_gran opt, unsigned int cpu) return mask; } -static void schedule_dummy(void) +static void cf_check schedule_dummy(void) { sched_tasklet_check_cpu(smp_processor_id()); } diff --git a/xen/common/tasklet.c b/xen/common/tasklet.c index 1b16bbcdeb0b..3ad67b5c2493 100644 --- a/xen/common/tasklet.c +++ b/xen/common/tasklet.c @@ -135,7 +135,7 @@ void do_tasklet(void) } /* Softirq context work */ -static void tasklet_softirq_action(void) +static void cf_check tasklet_softirq_action(void) { unsigned int cpu = smp_processor_id(); struct list_head *list = &per_cpu(softirq_tasklet_list, cpu); diff --git a/xen/common/timer.c b/xen/common/timer.c index b788050ea1d8..700f191a70b4 100644 --- a/xen/common/timer.c +++ b/xen/common/timer.c @@ -450,7 +450,7 @@ static void execute_timer(struct timers *ts, struct timer *t) } -static void timer_softirq_action(void) +static void cf_check timer_softirq_action(void) { struct timer *t, **heap, *next; struct timers *ts; diff --git a/xen/drivers/passthrough/x86/hvm.c b/xen/drivers/passthrough/x86/hvm.c index 527bd6a56d83..0e3c0f6aeed3 100644 --- a/xen/drivers/passthrough/x86/hvm.c +++ b/xen/drivers/passthrough/x86/hvm.c @@ -1003,7 +1003,7 @@ int arch_pci_clean_pirqs(struct domain *d) * Note: 'pt_pirq_softirq_reset' can clear the STATE_SCHED before we get to * doing it. If that is the case we let 'pt_pirq_softirq_reset' do ref-counting. */ -static void dpci_softirq(void) +static void cf_check dpci_softirq(void) { unsigned int cpu = smp_processor_id(); LIST_HEAD(our_list); From patchwork Mon Feb 14 12:50:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745578 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A5B68C433F5 for ; Mon, 14 Feb 2022 13:07:08 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271788.466531 (Exim 4.92) (envelope-from ) id 1nJb4B-0008OS-IJ; Mon, 14 Feb 2022 13:06:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271788.466531; Mon, 14 Feb 2022 13:06:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4A-0008H9-L3; Mon, 14 Feb 2022 13:06:54 +0000 Received: by outflank-mailman (input) for mailman id 271788; Mon, 14 Feb 2022 13:06:52 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2o-0008IH-Uv for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:31 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id c85ef101-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:29 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: c85ef101-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843928; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=yHxT60mUhe/bdOaYInkxIEHjxisfTCydkooBUoIXm1M=; b=gu3Y0sILdPtKjus+ehUOkt+lF5AKqkB5fkeI2gOi8tzUwmbG1+fMq4yj ldeJ2IXcdVfRbcCuHCxNiR6eqvJmguWXNqPNr8uU4vnrHpOEkyWbetcoG mOX7QdW1rLSwGRomW9KArB443+V1X9JByHIlG9kvnMyQ+xPeibTMPrNlu 8=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: IfyhiO4NRjvgMWsYVeStTCJbvfVis7VLr1QbwYda0dNdTcl8JdA14OmEJiDGvL5ZiRmL7+9iNz ybln7mX/b0K8VbX7oBwyIeHiwdD9+i2rHYZEH0/cI4VYouSJkZRWYhpdHUoMWqqvuNWny5ci+U W37+se8pJsY2NqMjkqd0kjDqsW3dq/J18HEttrVgZYT+TV6Wx/vbicZ4ekYURlmq8uEutugwUk 3iKHGxZlQCwDZHYIvvpq4DI94oY/G8aEV3bgENtOey/lNSbOhE1EtbMsPcUdD/6vhz+m9SVfcG 8ZOMzQDMBwZ9NZafczvi9Xnb X-SBRS: 5.1 X-MesageID: 64149818 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Xwjk2a/KST9YhIf28+VrDrUDnnmTJUtcMsCJ2f8bNWPcYEJGY0x3x 2QaXG/TMvfZMWb1c40gPtu/9UIF7J/dzoJlSgBt+yE8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPh0k PUKqryOSDwNFYHSissDfURzMw5haPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SRKqPN 5NJAdZpRDL+cRNBJ24qMYw7rP66rHflUzZy+F3A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9G80m75RPJhK ncw0QYwv4cs2hGAbvbiCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+W05K v5TaJmHzQtxSur7bnWF+IIfNwlSf3M6GYr3u4pccevaelhqH2QoCvnwx7I9etM6w/QJx7mQp nztCFVFzFffhGHcLVnYYH5Ud76yD410qmg2PHJwMA/wiWQje4um8IwWa4AzIes87OVmwPMtF 6sFdsyMD+5hUDPC/zhBP5DxoJY7LEaghB6UPjrjaz86JsYySwvM897iXw3u6ChRUXbn6Zpg+ +Wtj1qJT4ACSgJuCNftRMiul17h72IAnO9SXlfTJoUBckvb74U3eTf6ieU6Ip9QJEyblCeaz QufHTwRufLJ/90u6NDMiK2J89WpHu95EhYIFmXX9+/rZyzT/27lyo5cSueYOzvaUTqsqqmlY OxUydD6MeEGwwkW49YtTe4zwPJs/cbrqp9b0h9gTSfCYFmcA799JmWLgJtUvapXy74F4Qa7V ypjIDWB1Wll7C89LGMsGQ== IronPort-HdrOrdr: A9a23:UjVNE6/VeiQbj227Zatuk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149818" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 18/70] xsm/flask/ss: CFI hardening Date: Mon, 14 Feb 2022 12:50:35 +0000 Message-ID: <20220214125127.17985-19-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Reviewed-by: Daniel P. Smith --- xen/xsm/flask/ss/avtab.c | 4 ++-- xen/xsm/flask/ss/conditional.c | 10 ++++---- xen/xsm/flask/ss/conditional.h | 6 ++--- xen/xsm/flask/ss/policydb.c | 53 ++++++++++++++++++++++-------------------- xen/xsm/flask/ss/services.c | 6 ++--- xen/xsm/flask/ss/symtab.c | 5 ++-- 6 files changed, 44 insertions(+), 40 deletions(-) diff --git a/xen/xsm/flask/ss/avtab.c b/xen/xsm/flask/ss/avtab.c index bfc91c8b0c2c..55c2b4d8a46d 100644 --- a/xen/xsm/flask/ss/avtab.c +++ b/xen/xsm/flask/ss/avtab.c @@ -482,8 +482,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, return insertf(a, &key, &datum, p); } -static int avtab_insertf(struct avtab *a, struct avtab_key *k, - struct avtab_datum *d, void *p) +static int cf_check avtab_insertf( + struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *p) { return avtab_insert(a, k, d); } diff --git a/xen/xsm/flask/ss/conditional.c b/xen/xsm/flask/ss/conditional.c index 3e58aea55147..b4b116666cf7 100644 --- a/xen/xsm/flask/ss/conditional.c +++ b/xen/xsm/flask/ss/conditional.c @@ -189,14 +189,14 @@ int cond_init_bool_indexes(struct policydb *p) return 0; } -int cond_destroy_bool(void *key, void *datum, void *p) +int cf_check cond_destroy_bool(void *key, void *datum, void *p) { xfree(key); xfree(datum); return 0; } -int cond_index_bool(void *key, void *datum, void *datap) +int cf_check cond_index_bool(void *key, void *datum, void *datap) { struct policydb *p; struct cond_bool_datum *booldatum; @@ -220,7 +220,7 @@ static int bool_isvalid(struct cond_bool_datum *b) return 1; } -int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) +int cf_check cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct cond_bool_datum *booldatum; @@ -268,8 +268,8 @@ struct cond_insertf_data struct cond_av_list *tail; }; -static int cond_insertf(struct avtab *a, struct avtab_key *k, - struct avtab_datum *d, void *ptr) +static int cf_check cond_insertf( + struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) { struct cond_insertf_data *data = ptr; struct policydb *p = data->p; diff --git a/xen/xsm/flask/ss/conditional.h b/xen/xsm/flask/ss/conditional.h index 59ac6b4b57c1..500fe4305a03 100644 --- a/xen/xsm/flask/ss/conditional.h +++ b/xen/xsm/flask/ss/conditional.h @@ -63,11 +63,11 @@ int cond_policydb_init(struct policydb* p); void cond_policydb_destroy(struct policydb* p); int cond_init_bool_indexes(struct policydb* p); -int cond_destroy_bool(void *key, void *datum, void *p); +int cf_check cond_destroy_bool(void *key, void *datum, void *p); -int cond_index_bool(void *key, void *datum, void *datap); +int cf_check cond_index_bool(void *key, void *datum, void *datap); -int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp); +int cf_check cond_read_bool(struct policydb *p, struct hashtab *h, void *fp); int cond_read_list(struct policydb *p, void *fp); void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd); diff --git a/xen/xsm/flask/ss/policydb.c b/xen/xsm/flask/ss/policydb.c index 94261643532a..ff2103c63eab 100644 --- a/xen/xsm/flask/ss/policydb.c +++ b/xen/xsm/flask/ss/policydb.c @@ -257,12 +257,12 @@ static int policydb_init(struct policydb *p) * of a class, role, or user are needed. */ -static int common_index(void *key, void *datum, void *datap) +static int cf_check common_index(void *key, void *datum, void *datap) { return 0; } -static int class_index(void *key, void *datum, void *datap) +static int cf_check class_index(void *key, void *datum, void *datap) { struct policydb *p; struct class_datum *cladatum; @@ -276,7 +276,7 @@ static int class_index(void *key, void *datum, void *datap) return 0; } -static int role_index(void *key, void *datum, void *datap) +static int cf_check role_index(void *key, void *datum, void *datap) { struct policydb *p; struct role_datum *role; @@ -292,7 +292,7 @@ static int role_index(void *key, void *datum, void *datap) return 0; } -static int type_index(void *key, void *datum, void *datap) +static int cf_check type_index(void *key, void *datum, void *datap) { struct policydb *p; struct type_datum *typdatum; @@ -313,7 +313,7 @@ static int type_index(void *key, void *datum, void *datap) return 0; } -static int user_index(void *key, void *datum, void *datap) +static int cf_check user_index(void *key, void *datum, void *datap) { struct policydb *p; struct user_datum *usrdatum; @@ -329,7 +329,7 @@ static int user_index(void *key, void *datum, void *datap) return 0; } -static int sens_index(void *key, void *datum, void *datap) +static int cf_check sens_index(void *key, void *datum, void *datap) { struct policydb *p; struct level_datum *levdatum; @@ -348,7 +348,7 @@ static int sens_index(void *key, void *datum, void *datap) return 0; } -static int cat_index(void *key, void *datum, void *datap) +static int cf_check cat_index(void *key, void *datum, void *datap) { struct policydb *p; struct cat_datum *catdatum; @@ -506,14 +506,14 @@ static int policydb_index_others(struct policydb *p) * symbol data in the policy database. */ -static int perm_destroy(void *key, void *datum, void *p) +static int cf_check perm_destroy(void *key, void *datum, void *p) { xfree(key); xfree(datum); return 0; } -static int common_destroy(void *key, void *datum, void *p) +static int cf_check common_destroy(void *key, void *datum, void *p) { struct common_datum *comdatum; @@ -525,7 +525,7 @@ static int common_destroy(void *key, void *datum, void *p) return 0; } -static int class_destroy(void *key, void *datum, void *p) +static int cf_check class_destroy(void *key, void *datum, void *p) { struct class_datum *cladatum; struct constraint_node *constraint, *ctemp; @@ -572,7 +572,7 @@ static int class_destroy(void *key, void *datum, void *p) return 0; } -static int role_destroy(void *key, void *datum, void *p) +static int cf_check role_destroy(void *key, void *datum, void *p) { struct role_datum *role; @@ -584,14 +584,14 @@ static int role_destroy(void *key, void *datum, void *p) return 0; } -static int type_destroy(void *key, void *datum, void *p) +static int cf_check type_destroy(void *key, void *datum, void *p) { xfree(key); xfree(datum); return 0; } -static int user_destroy(void *key, void *datum, void *p) +static int cf_check user_destroy(void *key, void *datum, void *p) { struct user_datum *usrdatum; @@ -605,7 +605,7 @@ static int user_destroy(void *key, void *datum, void *p) return 0; } -static int sens_destroy(void *key, void *datum, void *p) +static int cf_check sens_destroy(void *key, void *datum, void *p) { struct level_datum *levdatum; @@ -617,7 +617,7 @@ static int sens_destroy(void *key, void *datum, void *p) return 0; } -static int cat_destroy(void *key, void *datum, void *p) +static int cf_check cat_destroy(void *key, void *datum, void *p) { xfree(key); xfree(datum); @@ -989,7 +989,7 @@ static int perm_read(struct policydb *p, struct hashtab *h, void *fp) goto out; } -static int common_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check common_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct common_datum *comdatum; @@ -1151,7 +1151,7 @@ static int read_cons_helper(struct policydb *p, struct constraint_node **nodep, return 0; } -static int class_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check class_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct class_datum *cladatum; @@ -1250,7 +1250,7 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp) goto out; } -static int role_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check role_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct role_datum *role; @@ -1321,7 +1321,7 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp) goto out; } -static int type_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check type_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct type_datum *typdatum; @@ -1415,7 +1415,7 @@ static int mls_read_level(struct mls_level *lp, void *fp) return -EINVAL; } -static int user_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check user_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct user_datum *usrdatum; @@ -1479,7 +1479,7 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp) goto out; } -static int sens_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check sens_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct level_datum *levdatum; @@ -1534,7 +1534,7 @@ static int sens_read(struct policydb *p, struct hashtab *h, void *fp) goto out; } -static int cat_read(struct policydb *p, struct hashtab *h, void *fp) +static int cf_check cat_read(struct policydb *p, struct hashtab *h, void *fp) { char *key = NULL; struct cat_datum *catdatum; @@ -1591,7 +1591,8 @@ static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) cat_read, }; -static int user_bounds_sanity_check(void *key, void *datum, void *datap) +static int cf_check user_bounds_sanity_check( + void *key, void *datum, void *datap) { struct user_datum *upper, *user; struct policydb *p = datap; @@ -1631,7 +1632,8 @@ static int user_bounds_sanity_check(void *key, void *datum, void *datap) return 0; } -static int role_bounds_sanity_check(void *key, void *datum, void *datap) +static int cf_check role_bounds_sanity_check( + void *key, void *datum, void *datap) { struct role_datum *upper, *role; struct policydb *p = datap; @@ -1671,7 +1673,8 @@ static int role_bounds_sanity_check(void *key, void *datum, void *datap) return 0; } -static int type_bounds_sanity_check(void *key, void *datum, void *datap) +static int cf_check type_bounds_sanity_check( + void *key, void *datum, void *datap) { struct type_datum *upper, *type; struct policydb *p = datap; diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c index 42686535f2c4..2f6d3d350d05 100644 --- a/xen/xsm/flask/ss/services.c +++ b/xen/xsm/flask/ss/services.c @@ -283,7 +283,7 @@ static int constraint_expr_eval(struct context *scontext, * security_dump_masked_av - dumps masked permissions during * security_compute_av due to RBAC, MLS/Constraint and Type bounds. */ -static int dump_masked_av_helper(void *k, void *d, void *args) +static int cf_check dump_masked_av_helper(void *k, void *d, void *args) { struct perm_datum *pdatum = d; char **permission_names = args; @@ -1240,7 +1240,7 @@ static int validate_classes(struct policydb *p) } /* Clone the SID into the new SID table. */ -static int clone_sid(u32 sid, struct context *context, void *arg) +static int cf_check clone_sid(u32 sid, struct context *context, void *arg) { struct sidtab *s = arg; @@ -1277,7 +1277,7 @@ struct convert_context_args { * in the policy `p->newp'. Verify that the * context is valid under the new policy. */ -static int convert_context(u32 key, struct context *c, void *p) +static int cf_check convert_context(u32 key, struct context *c, void *p) { struct convert_context_args *args; struct context oldc; diff --git a/xen/xsm/flask/ss/symtab.c b/xen/xsm/flask/ss/symtab.c index d98c116d5b97..0ce7e08c24ea 100644 --- a/xen/xsm/flask/ss/symtab.c +++ b/xen/xsm/flask/ss/symtab.c @@ -12,7 +12,7 @@ #include #include "symtab.h" -static unsigned int symhash(struct hashtab *h, const void *key) +static unsigned int cf_check symhash(struct hashtab *h, const void *key) { const char *p, *keyp; unsigned int size; @@ -26,7 +26,8 @@ static unsigned int symhash(struct hashtab *h, const void *key) return val & (h->size - 1); } -static int symcmp(struct hashtab *h, const void *key1, const void *key2) +static int cf_check symcmp( + struct hashtab *h, const void *key1, const void *key2) { const char *keyp1, *keyp2; From patchwork Mon Feb 14 12:50:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745609 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7CB10C433F5 for ; Mon, 14 Feb 2022 13:18:34 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272097.466918 (Exim 4.92) (envelope-from ) id 1nJbFH-0007N6-5Z; Mon, 14 Feb 2022 13:18:23 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272097.466918; Mon, 14 Feb 2022 13:18:23 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbFH-0007MB-1A; Mon, 14 Feb 2022 13:18:23 +0000 Received: by outflank-mailman (input) for mailman id 272097; Mon, 14 Feb 2022 13:18:21 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4j-0008IH-Sa for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:30 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0e18c045-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:26 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0e18c045-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844046; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=LtJo+RP7waNzs+O/em8BrBScnR7VYL3LyvaDnkUSQHU=; b=Rjh25R4g4/Hjy+5YLDHBsHixUq159uEw6MR5EXTMVs7ME+P9qIKRskPb 3HGdReXkf4jbM+PS7YeBb+mb/Z2FNcNsVS1e8bywpNO2OKYdVy3ITpJql +SDXUcWN7J15CdXNkHSjFT9k0iUtwXnwwKJpCFDJgyEHT3kPTybiMbgEu k=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: JHmOLz3WTCcCK+Mlkx2/1s5a3W5ucwAGtEWS1O9nHaWkHNCnIuYmX04uzbDGFzFM+oSUl+IBV+ txitSnxsmxLAkc++0xAhyeG7qGWdfRNkCxoUbL/KT25zgQurtKtmL1EHdm1XMa6O36iI1NwgBG fG+p8uKee+Fdfk5oI/zbno8Bxa6ezpGNodrfLe9Dubviye3BPZiXhq9NrxX7RsJNR420tYysIE /densTuIjbJnkkbUTxRaBEqP1e6hergHhP9Jt5UHFuyf/pdxpvLuJ1mte4KUGpMM+SB4BMmrQy EW0DmMu7AvwQ1x2Cr9hJiFLK X-SBRS: 5.1 X-MesageID: 64554482 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:UjAjEaLg3RfVaszbFE+RyZIlxSXFcZb7ZxGr2PjKsXjdYENS3zUBm mBKX2vVO/iMZjf3KNgiPoSxoRxQusCAz4NhTQplqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB2yxdB32 PRvmqW2SAULMbzTwbsyYyZXRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Gls250SQaaED yYfQX1BXDjBPzRgA1dNV8MGwOeImVjYbjIN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3OA+/m/mm+cdOtZK k429Tsx9PcdxHOkG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspuNt2uVnrKNaY2y8kT85v1dNoufRVTpl CFax5TBvLBTUMnUz3blrAAx8FaBvajtDdEhqQQ3Q8lJG8qFpxZPgry8EBkhfRw0Y67oiBfiY VPJuBM52XOgFCDCUEODWKroU55C5fG5TbzND6mIBvITMskZXFLWp0lGOB/Pt10BZWBxyMnTz 7/AKp3yZZvbYIw6pAeLqxA1j+N6mHBmnTmLLX05pjz+uYejiLeuYe9tGDOzgioRtfnayOkM2 9oAZcaM1TtFV+jyPnve/YIJdAhYJnknH5Hm7cdQc7fbcAZhHWggDd7XwK8gJNM5z/gEyL+Q8 yHvQFJcxXr+mWbDdVeAZEd8Ze69Rp14t386Y3AhZA76x3g5bI+zx64DbJ9rL6I//eluwKcsH fkIcsmNGNpVTTHD92hPZJXxttU6Jh+qmRiPL2yuZz1mJ8xsQAnA+9nFeArz9XZRUnrr5JVm+ 7D5j1HVW5sOQQhmHf36UvP3wgPjp2UZlcJzQ1DMfotZdnLz/dU4MCf2lPI2fZ0BcE2R2juA2 g+KKh4Evu2R8ZQt+dzEiK3Y/YekF+xyQhhTE2XBtOvkMCDb+iyowJNaUfbOdjfYDTum9KKnb ORT7vf9LPxYwwoa79siS+5mnfAk+t/ih75G1QA1TnzEYmOiBq5kPnTbj9JEsbdAx+MBtAa7M q5VFgK25Vld1BvZLWMs IronPort-HdrOrdr: A9a23:9JZrPanj0MRPGmbv4hoe/P0odXXpDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554482" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 19/70] xsm: CFI hardening Date: Mon, 14 Feb 2022 12:50:36 +0000 Message-ID: <20220214125127.17985-20-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Reviewed-by: Daniel P. Smith --- xen/include/xsm/dummy.h | 211 ++++++++++++++++++++++-------------------- xen/xsm/flask/flask_op.c | 2 +- xen/xsm/flask/hooks.c | 232 ++++++++++++++++++++++++++--------------------- xen/xsm/flask/private.h | 4 +- xen/xsm/silo.c | 24 ++--- 5 files changed, 257 insertions(+), 216 deletions(-) diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index b024119896e6..58afc1d58973 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -101,46 +101,48 @@ static always_inline int xsm_default_action( } } -static XSM_INLINE void xsm_security_domaininfo( +static XSM_INLINE void cf_check xsm_security_domaininfo( struct domain *d, struct xen_domctl_getdomaininfo *info) { return; } -static XSM_INLINE int xsm_domain_create( +static XSM_INLINE int cf_check xsm_domain_create( XSM_DEFAULT_ARG struct domain *d, uint32_t ssidref) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_getdomaininfo(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_getdomaininfo( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_domctl_scheduler_op( +static XSM_INLINE int cf_check xsm_domctl_scheduler_op( XSM_DEFAULT_ARG struct domain *d, int cmd) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl_scheduler_op(XSM_DEFAULT_ARG int cmd) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_set_target( +static XSM_INLINE int cf_check xsm_set_target( XSM_DEFAULT_ARG struct domain *d, struct domain *e) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_domctl(XSM_DEFAULT_ARG struct domain *d, int cmd) +static XSM_INLINE int cf_check xsm_domctl( + XSM_DEFAULT_ARG struct domain *d, int cmd) { XSM_ASSERT_ACTION(XSM_OTHER); switch ( cmd ) @@ -157,91 +159,93 @@ static XSM_INLINE int xsm_domctl(XSM_DEFAULT_ARG struct domain *d, int cmd) } } -static XSM_INLINE int xsm_sysctl(XSM_DEFAULT_ARG int cmd) +static XSM_INLINE int cf_check xsm_sysctl(XSM_DEFAULT_ARG int cmd) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) +static XSM_INLINE int cf_check xsm_readconsole(XSM_DEFAULT_ARG uint32_t clear) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_alloc_security_domain(struct domain *d) +static XSM_INLINE int cf_check xsm_alloc_security_domain(struct domain *d) { return 0; } -static XSM_INLINE void xsm_free_security_domain(struct domain *d) +static XSM_INLINE void cf_check xsm_free_security_domain(struct domain *d) { return; } -static XSM_INLINE int xsm_grant_mapref( +static XSM_INLINE int cf_check xsm_grant_mapref( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2, uint32_t flags) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_grant_unmapref( +static XSM_INLINE int cf_check xsm_grant_unmapref( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_grant_setup( +static XSM_INLINE int cf_check xsm_grant_setup( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_grant_transfer( +static XSM_INLINE int cf_check xsm_grant_transfer( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_grant_copy( +static XSM_INLINE int cf_check xsm_grant_copy( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_grant_query_size( +static XSM_INLINE int cf_check xsm_grant_query_size( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_memory_exchange(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_memory_exchange( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_memory_adjust_reservation( +static XSM_INLINE int cf_check xsm_memory_adjust_reservation( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_memory_stat_reservation( +static XSM_INLINE int cf_check xsm_memory_stat_reservation( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_console_io(XSM_DEFAULT_ARG struct domain *d, int cmd) +static XSM_INLINE int cf_check xsm_console_io( + XSM_DEFAULT_ARG struct domain *d, int cmd) { XSM_ASSERT_ACTION(XSM_OTHER); if ( d->is_console ) @@ -253,26 +257,27 @@ static XSM_INLINE int xsm_console_io(XSM_DEFAULT_ARG struct domain *d, int cmd) return xsm_default_action(XSM_PRIV, d, NULL); } -static XSM_INLINE int xsm_profile(XSM_DEFAULT_ARG struct domain *d, int op) +static XSM_INLINE int cf_check xsm_profile( + XSM_DEFAULT_ARG struct domain *d, int op) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d, NULL); } -static XSM_INLINE int xsm_kexec(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_kexec(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_schedop_shutdown( +static XSM_INLINE int cf_check xsm_schedop_shutdown( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_memory_pin_page( +static XSM_INLINE int cf_check xsm_memory_pin_page( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2, struct page_info *page) { @@ -280,20 +285,20 @@ static XSM_INLINE int xsm_memory_pin_page( return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_claim_pages(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_claim_pages(XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_evtchn_unbound( +static XSM_INLINE int cf_check xsm_evtchn_unbound( XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn, domid_t id2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_evtchn_interdomain( +static XSM_INLINE int cf_check xsm_evtchn_interdomain( XSM_DEFAULT_ARG struct domain *d1, struct evtchn *chan1, struct domain *d2, struct evtchn *chan2) { @@ -301,89 +306,94 @@ static XSM_INLINE int xsm_evtchn_interdomain( return xsm_default_action(action, d1, d2); } -static XSM_INLINE void xsm_evtchn_close_post(struct evtchn *chn) +static XSM_INLINE void cf_check xsm_evtchn_close_post(struct evtchn *chn) { return; } -static XSM_INLINE int xsm_evtchn_send( +static XSM_INLINE int cf_check xsm_evtchn_send( XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, d, NULL); } -static XSM_INLINE int xsm_evtchn_status( +static XSM_INLINE int cf_check xsm_evtchn_status( XSM_DEFAULT_ARG struct domain *d, struct evtchn *chn) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_evtchn_reset( +static XSM_INLINE int cf_check xsm_evtchn_reset( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_alloc_security_evtchns( +static XSM_INLINE int cf_check xsm_alloc_security_evtchns( struct evtchn chn[], unsigned int nr) { return 0; } -static XSM_INLINE void xsm_free_security_evtchns( +static XSM_INLINE void cf_check xsm_free_security_evtchns( struct evtchn chn[], unsigned int nr) { return; } -static XSM_INLINE char *xsm_show_security_evtchn( +static XSM_INLINE char *cf_check xsm_show_security_evtchn( struct domain *d, const struct evtchn *chn) { return NULL; } -static XSM_INLINE int xsm_init_hardware_domain(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_init_hardware_domain( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_get_pod_target(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_get_pod_target( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_set_pod_target(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_set_pod_target( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_get_vnumainfo(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_get_vnumainfo( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } #if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI) -static XSM_INLINE int xsm_get_device_group(XSM_DEFAULT_ARG uint32_t machine_bdf) +static XSM_INLINE int cf_check xsm_get_device_group( + XSM_DEFAULT_ARG uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_assign_device( +static XSM_INLINE int cf_check xsm_assign_device( XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_deassign_device( +static XSM_INLINE int cf_check xsm_deassign_device( XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_HOOK); @@ -393,14 +403,14 @@ static XSM_INLINE int xsm_deassign_device( #endif /* HAS_PASSTHROUGH && HAS_PCI */ #if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_DEVICE_TREE) -static XSM_INLINE int xsm_assign_dtdevice( +static XSM_INLINE int cf_check xsm_assign_dtdevice( XSM_DEFAULT_ARG struct domain *d, const char *dtpath) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_deassign_dtdevice( +static XSM_INLINE int cf_check xsm_deassign_dtdevice( XSM_DEFAULT_ARG struct domain *d, const char *dtpath) { XSM_ASSERT_ACTION(XSM_HOOK); @@ -409,142 +419,144 @@ static XSM_INLINE int xsm_deassign_dtdevice( #endif /* HAS_PASSTHROUGH && HAS_DEVICE_TREE */ -static XSM_INLINE int xsm_resource_plug_core(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_resource_plug_core(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_unplug_core(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_resource_unplug_core(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_plug_pci( +static XSM_INLINE int cf_check xsm_resource_plug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_unplug_pci( +static XSM_INLINE int cf_check xsm_resource_unplug_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_setup_pci( +static XSM_INLINE int cf_check xsm_resource_setup_pci( XSM_DEFAULT_ARG uint32_t machine_bdf) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_setup_gsi(XSM_DEFAULT_ARG int gsi) +static XSM_INLINE int cf_check xsm_resource_setup_gsi(XSM_DEFAULT_ARG int gsi) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_resource_setup_misc(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_resource_setup_misc(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) +static XSM_INLINE int cf_check xsm_page_offline(XSM_DEFAULT_ARG uint32_t cmd) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_hypfs_op(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_hypfs_op(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE long xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) +static XSM_INLINE long cf_check xsm_do_xsm_op(XEN_GUEST_HANDLE_PARAM(void) op) { return -ENOSYS; } #ifdef CONFIG_COMPAT -static XSM_INLINE int xsm_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) op) +static XSM_INLINE int cf_check xsm_do_compat_op(XEN_GUEST_HANDLE_PARAM(void) op) { return -ENOSYS; } #endif -static XSM_INLINE char *xsm_show_irq_sid(int irq) +static XSM_INLINE char *cf_check xsm_show_irq_sid(int irq) { return NULL; } -static XSM_INLINE int xsm_map_domain_pirq(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_map_domain_pirq( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_map_domain_irq( +static XSM_INLINE int cf_check xsm_map_domain_irq( XSM_DEFAULT_ARG struct domain *d, int irq, const void *data) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_unmap_domain_pirq(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_unmap_domain_pirq( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_bind_pt_irq( +static XSM_INLINE int cf_check xsm_bind_pt_irq( XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_unbind_pt_irq( +static XSM_INLINE int cf_check xsm_unbind_pt_irq( XSM_DEFAULT_ARG struct domain *d, struct xen_domctl_bind_pt_irq *bind) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_unmap_domain_irq( +static XSM_INLINE int cf_check xsm_unmap_domain_irq( XSM_DEFAULT_ARG struct domain *d, int irq, const void *data) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_irq_permission( +static XSM_INLINE int cf_check xsm_irq_permission( XSM_DEFAULT_ARG struct domain *d, int pirq, uint8_t allow) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_iomem_permission( +static XSM_INLINE int cf_check xsm_iomem_permission( XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_iomem_mapping( +static XSM_INLINE int cf_check xsm_iomem_mapping( XSM_DEFAULT_ARG struct domain *d, uint64_t s, uint64_t e, uint8_t allow) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_pci_config_permission( +static XSM_INLINE int cf_check xsm_pci_config_permission( XSM_DEFAULT_ARG struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end, uint8_t access) { @@ -552,41 +564,42 @@ static XSM_INLINE int xsm_pci_config_permission( return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_add_to_physmap( +static XSM_INLINE int cf_check xsm_add_to_physmap( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_remove_from_physmap( +static XSM_INLINE int cf_check xsm_remove_from_physmap( XSM_DEFAULT_ARG struct domain *d1, struct domain *d2) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d1, d2); } -static XSM_INLINE int xsm_map_gmfn_foreign( +static XSM_INLINE int cf_check xsm_map_gmfn_foreign( XSM_DEFAULT_ARG struct domain *d, struct domain *t) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d, t); } -static XSM_INLINE int xsm_hvm_param( +static XSM_INLINE int cf_check xsm_hvm_param( XSM_DEFAULT_ARG struct domain *d, unsigned long op) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_hvm_param_altp2mhvm(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_hvm_param_altp2mhvm( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_hvm_altp2mhvm_op( +static XSM_INLINE int cf_check xsm_hvm_altp2mhvm_op( XSM_DEFAULT_ARG struct domain *d, uint64_t mode, uint32_t op) { XSM_ASSERT_ACTION(XSM_OTHER); @@ -606,7 +619,7 @@ static XSM_INLINE int xsm_hvm_altp2mhvm_op( } } -static XSM_INLINE int xsm_vm_event_control( +static XSM_INLINE int cf_check xsm_vm_event_control( XSM_DEFAULT_ARG struct domain *d, int mode, int op) { XSM_ASSERT_ACTION(XSM_PRIV); @@ -614,7 +627,7 @@ static XSM_INLINE int xsm_vm_event_control( } #ifdef CONFIG_MEM_ACCESS -static XSM_INLINE int xsm_mem_access(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_mem_access(XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); @@ -622,7 +635,7 @@ static XSM_INLINE int xsm_mem_access(XSM_DEFAULT_ARG struct domain *d) #endif #ifdef CONFIG_MEM_PAGING -static XSM_INLINE int xsm_mem_paging(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_mem_paging(XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); @@ -630,59 +643,61 @@ static XSM_INLINE int xsm_mem_paging(XSM_DEFAULT_ARG struct domain *d) #endif #ifdef CONFIG_MEM_SHARING -static XSM_INLINE int xsm_mem_sharing(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_mem_sharing(XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } #endif -static XSM_INLINE int xsm_platform_op(XSM_DEFAULT_ARG uint32_t op) +static XSM_INLINE int cf_check xsm_platform_op(XSM_DEFAULT_ARG uint32_t op) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } #ifdef CONFIG_X86 -static XSM_INLINE int xsm_do_mca(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_do_mca(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_shadow_control( +static XSM_INLINE int cf_check xsm_shadow_control( XSM_DEFAULT_ARG struct domain *d, uint32_t op) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_mem_sharing_op( +static XSM_INLINE int cf_check xsm_mem_sharing_op( XSM_DEFAULT_ARG struct domain *d, struct domain *cd, int op) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, cd); } -static XSM_INLINE int xsm_apic(XSM_DEFAULT_ARG struct domain *d, int cmd) +static XSM_INLINE int cf_check xsm_apic( + XSM_DEFAULT_ARG struct domain *d, int cmd) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, d, NULL); } -static XSM_INLINE int xsm_machine_memory_map(XSM_DEFAULT_VOID) +static XSM_INLINE int cf_check xsm_machine_memory_map(XSM_DEFAULT_VOID) { XSM_ASSERT_ACTION(XSM_PRIV); return xsm_default_action(action, current->domain, NULL); } -static XSM_INLINE int xsm_domain_memory_map(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_domain_memory_map( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_mmu_update( +static XSM_INLINE int cf_check xsm_mmu_update( XSM_DEFAULT_ARG struct domain *d, struct domain *t, struct domain *f, uint32_t flags) { @@ -695,42 +710,42 @@ static XSM_INLINE int xsm_mmu_update( return rc; } -static XSM_INLINE int xsm_mmuext_op( +static XSM_INLINE int cf_check xsm_mmuext_op( XSM_DEFAULT_ARG struct domain *d, struct domain *f) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d, f); } -static XSM_INLINE int xsm_update_va_mapping( +static XSM_INLINE int cf_check xsm_update_va_mapping( XSM_DEFAULT_ARG struct domain *d, struct domain *f, l1_pgentry_t pte) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d, f); } -static XSM_INLINE int xsm_priv_mapping( +static XSM_INLINE int cf_check xsm_priv_mapping( XSM_DEFAULT_ARG struct domain *d, struct domain *t) { XSM_ASSERT_ACTION(XSM_TARGET); return xsm_default_action(action, d, t); } -static XSM_INLINE int xsm_ioport_permission( +static XSM_INLINE int cf_check xsm_ioport_permission( XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_ioport_mapping( +static XSM_INLINE int cf_check xsm_ioport_mapping( XSM_DEFAULT_ARG struct domain *d, uint32_t s, uint32_t e, uint8_t allow) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_pmu_op( +static XSM_INLINE int cf_check xsm_pmu_op( XSM_DEFAULT_ARG struct domain *d, unsigned int op) { XSM_ASSERT_ACTION(XSM_OTHER); @@ -748,30 +763,31 @@ static XSM_INLINE int xsm_pmu_op( #endif /* CONFIG_X86 */ -static XSM_INLINE int xsm_dm_op(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_dm_op(XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); } #ifdef CONFIG_ARGO -static XSM_INLINE int xsm_argo_enable(const struct domain *d) +static XSM_INLINE int cf_check xsm_argo_enable(const struct domain *d) { return 0; } -static XSM_INLINE int xsm_argo_register_single_source( +static XSM_INLINE int cf_check xsm_argo_register_single_source( const struct domain *d, const struct domain *t) { return 0; } -static XSM_INLINE int xsm_argo_register_any_source(const struct domain *d) +static XSM_INLINE int cf_check xsm_argo_register_any_source( + const struct domain *d) { return 0; } -static XSM_INLINE int xsm_argo_send( +static XSM_INLINE int cf_check xsm_argo_send( const struct domain *d, const struct domain *t) { return 0; @@ -780,7 +796,7 @@ static XSM_INLINE int xsm_argo_send( #endif /* CONFIG_ARGO */ #include -static XSM_INLINE int xsm_xen_version(XSM_DEFAULT_ARG uint32_t op) +static XSM_INLINE int cf_check xsm_xen_version(XSM_DEFAULT_ARG uint32_t op) { XSM_ASSERT_ACTION(XSM_OTHER); switch ( op ) @@ -804,7 +820,8 @@ static XSM_INLINE int xsm_xen_version(XSM_DEFAULT_ARG uint32_t op) } } -static XSM_INLINE int xsm_domain_resource_map(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int cf_check xsm_domain_resource_map( + XSM_DEFAULT_ARG struct domain *d) { XSM_ASSERT_ACTION(XSM_DM_PRIV); return xsm_default_action(action, current->domain, d); diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c index 2d7ca3abaecd..707be72a3b96 100644 --- a/xen/xsm/flask/flask_op.c +++ b/xen/xsm/flask/flask_op.c @@ -607,7 +607,7 @@ static int flask_relabel_domain(struct xen_flask_relabel *arg) #endif /* !COMPAT */ -ret_t do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op) +ret_t cf_check do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op) { xen_flask_op_t op; int rv; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6ff1be28e4a4..63484e323c09 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -157,7 +157,7 @@ static int avc_unknown_permission(const char *name, int id) return rc; } -static int flask_domain_alloc_security(struct domain *d) +static int cf_check flask_domain_alloc_security(struct domain *d) { struct domain_security_struct *dsec; @@ -186,7 +186,7 @@ static int flask_domain_alloc_security(struct domain *d) return 0; } -static void flask_domain_free_security(struct domain *d) +static void cf_check flask_domain_free_security(struct domain *d) { struct domain_security_struct *dsec = d->ssid; @@ -197,8 +197,8 @@ static void flask_domain_free_security(struct domain *d) xfree(dsec); } -static int flask_evtchn_unbound(struct domain *d1, struct evtchn *chn, - domid_t id2) +static int cf_check flask_evtchn_unbound( + struct domain *d1, struct evtchn *chn, domid_t id2) { u32 sid1, sid2, newsid; int rc; @@ -230,8 +230,9 @@ static int flask_evtchn_unbound(struct domain *d1, struct evtchn *chn, return rc; } -static int flask_evtchn_interdomain(struct domain *d1, struct evtchn *chn1, - struct domain *d2, struct evtchn *chn2) +static int cf_check flask_evtchn_interdomain( + struct domain *d1, struct evtchn *chn1, + struct domain *d2, struct evtchn *chn2) { u32 sid1, sid2, newsid, reverse_sid; int rc; @@ -273,12 +274,12 @@ static int flask_evtchn_interdomain(struct domain *d1, struct evtchn *chn1, return rc; } -static void flask_evtchn_close_post(struct evtchn *chn) +static void cf_check flask_evtchn_close_post(struct evtchn *chn) { chn->ssid.flask_sid = SECINITSID_UNLABELED; } -static int flask_evtchn_send(struct domain *d, struct evtchn *chn) +static int cf_check flask_evtchn_send(struct domain *d, struct evtchn *chn) { int rc; @@ -298,17 +299,18 @@ static int flask_evtchn_send(struct domain *d, struct evtchn *chn) return rc; } -static int flask_evtchn_status(struct domain *d, struct evtchn *chn) +static int cf_check flask_evtchn_status(struct domain *d, struct evtchn *chn) { return domain_has_evtchn(d, chn, EVENT__STATUS); } -static int flask_evtchn_reset(struct domain *d1, struct domain *d2) +static int cf_check flask_evtchn_reset(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_EVENT, EVENT__RESET); } -static int flask_alloc_security_evtchns(struct evtchn chn[], unsigned int nr) +static int cf_check flask_alloc_security_evtchns( + struct evtchn chn[], unsigned int nr) { unsigned int i; @@ -318,7 +320,8 @@ static int flask_alloc_security_evtchns(struct evtchn chn[], unsigned int nr) return 0; } -static void flask_free_security_evtchns(struct evtchn chn[], unsigned int nr) +static void cf_check flask_free_security_evtchns( + struct evtchn chn[], unsigned int nr) { unsigned int i; @@ -329,7 +332,8 @@ static void flask_free_security_evtchns(struct evtchn chn[], unsigned int nr) chn[i].ssid.flask_sid = SECINITSID_UNLABELED; } -static char *flask_show_security_evtchn(struct domain *d, const struct evtchn *chn) +static char *cf_check flask_show_security_evtchn( + struct domain *d, const struct evtchn *chn) { int irq; u32 sid = 0; @@ -355,13 +359,13 @@ static char *flask_show_security_evtchn(struct domain *d, const struct evtchn *c return ctx; } -static int flask_init_hardware_domain(struct domain *d) +static int cf_check flask_init_hardware_domain(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CREATE_HARDWARE_DOMAIN); } -static int flask_grant_mapref(struct domain *d1, struct domain *d2, - uint32_t flags) +static int cf_check flask_grant_mapref( + struct domain *d1, struct domain *d2, uint32_t flags) { u32 perms = GRANT__MAP_READ; @@ -371,73 +375,75 @@ static int flask_grant_mapref(struct domain *d1, struct domain *d2, return domain_has_perm(d1, d2, SECCLASS_GRANT, perms); } -static int flask_grant_unmapref(struct domain *d1, struct domain *d2) +static int cf_check flask_grant_unmapref(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__UNMAP); } -static int flask_grant_setup(struct domain *d1, struct domain *d2) +static int cf_check flask_grant_setup(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__SETUP); } -static int flask_grant_transfer(struct domain *d1, struct domain *d2) +static int cf_check flask_grant_transfer(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__TRANSFER); } -static int flask_grant_copy(struct domain *d1, struct domain *d2) +static int cf_check flask_grant_copy(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__COPY); } -static int flask_grant_query_size(struct domain *d1, struct domain *d2) +static int cf_check flask_grant_query_size(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_GRANT, GRANT__QUERY); } -static int flask_get_pod_target(struct domain *d) +static int cf_check flask_get_pod_target(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETPODTARGET); } -static int flask_set_pod_target(struct domain *d) +static int cf_check flask_set_pod_target(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__SETPODTARGET); } -static int flask_memory_exchange(struct domain *d) +static int cf_check flask_memory_exchange(struct domain *d) { return current_has_perm(d, SECCLASS_MMU, MMU__EXCHANGE); } -static int flask_memory_adjust_reservation(struct domain *d1, struct domain *d2) +static int cf_check flask_memory_adjust_reservation( + struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__ADJUST); } -static int flask_memory_stat_reservation(struct domain *d1, struct domain *d2) +static int cf_check flask_memory_stat_reservation( + struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__STAT); } -static int flask_memory_pin_page(struct domain *d1, struct domain *d2, - struct page_info *page) +static int cf_check flask_memory_pin_page( + struct domain *d1, struct domain *d2, struct page_info *page) { return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__PINPAGE); } -static int flask_claim_pages(struct domain *d) +static int cf_check flask_claim_pages(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SETCLAIM); } -static int flask_get_vnumainfo(struct domain *d) +static int cf_check flask_get_vnumainfo(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_VNUMAINFO); } -static int flask_console_io(struct domain *d, int cmd) +static int cf_check flask_console_io(struct domain *d, int cmd) { u32 perm; @@ -456,7 +462,7 @@ static int flask_console_io(struct domain *d, int cmd) return domain_has_xen(d, perm); } -static int flask_profile(struct domain *d, int op) +static int cf_check flask_profile(struct domain *d, int op) { u32 perm; @@ -488,23 +494,23 @@ static int flask_profile(struct domain *d, int op) return domain_has_xen(d, perm); } -static int flask_kexec(void) +static int cf_check flask_kexec(void) { return domain_has_xen(current->domain, XEN__KEXEC); } -static int flask_schedop_shutdown(struct domain *d1, struct domain *d2) +static int cf_check flask_schedop_shutdown(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_DOMAIN, DOMAIN__SHUTDOWN); } -static void flask_security_domaininfo(struct domain *d, - struct xen_domctl_getdomaininfo *info) +static void cf_check flask_security_domaininfo( + struct domain *d, struct xen_domctl_getdomaininfo *info) { info->ssidref = domain_sid(d); } -static int flask_domain_create(struct domain *d, u32 ssidref) +static int cf_check flask_domain_create(struct domain *d, u32 ssidref) { int rc; struct domain_security_struct *dsec = d->ssid; @@ -532,12 +538,12 @@ static int flask_domain_create(struct domain *d, u32 ssidref) return rc; } -static int flask_getdomaininfo(struct domain *d) +static int cf_check flask_getdomaininfo(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETDOMAININFO); } -static int flask_domctl_scheduler_op(struct domain *d, int op) +static int cf_check flask_domctl_scheduler_op(struct domain *d, int op) { switch ( op ) { @@ -554,7 +560,7 @@ static int flask_domctl_scheduler_op(struct domain *d, int op) } } -static int flask_sysctl_scheduler_op(int op) +static int cf_check flask_sysctl_scheduler_op(int op) { switch ( op ) { @@ -569,7 +575,7 @@ static int flask_sysctl_scheduler_op(int op) } } -static int flask_set_target(struct domain *d, struct domain *t) +static int cf_check flask_set_target(struct domain *d, struct domain *t) { int rc; struct domain_security_struct *dsec, *tsec; @@ -593,7 +599,7 @@ static int flask_set_target(struct domain *d, struct domain *t) return rc; } -static int flask_domctl(struct domain *d, int cmd) +static int cf_check flask_domctl(struct domain *d, int cmd) { switch ( cmd ) { @@ -757,7 +763,7 @@ static int flask_domctl(struct domain *d, int cmd) } } -static int flask_sysctl(int cmd) +static int cf_check flask_sysctl(int cmd) { switch ( cmd ) { @@ -835,7 +841,7 @@ static int flask_sysctl(int cmd) } } -static int flask_readconsole(uint32_t clear) +static int cf_check flask_readconsole(uint32_t clear) { u32 perms = XEN__READCONSOLE; @@ -853,7 +859,7 @@ static inline u32 resource_to_perm(uint8_t access) return RESOURCE__REMOVE; } -static char *flask_show_irq_sid (int irq) +static char *cf_check flask_show_irq_sid(int irq) { u32 sid, ctx_len; char *ctx; @@ -867,7 +873,7 @@ static char *flask_show_irq_sid (int irq) return ctx; } -static int flask_map_domain_pirq (struct domain *d) +static int cf_check flask_map_domain_pirq(struct domain *d) { return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__ADD); } @@ -907,7 +913,7 @@ static u32 flask_iommu_resource_use_perm(const struct domain *d) return perm; } -static int flask_map_domain_irq (struct domain *d, int irq, const void *data) +static int cf_check flask_map_domain_irq(struct domain *d, int irq, const void *data) { u32 sid, dsid; int rc = -EPERM; @@ -933,7 +939,7 @@ static int flask_map_domain_irq (struct domain *d, int irq, const void *data) return rc; } -static int flask_unmap_domain_pirq (struct domain *d) +static int cf_check flask_unmap_domain_pirq(struct domain *d) { return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE); } @@ -954,7 +960,8 @@ static int flask_unmap_domain_msi (struct domain *d, int irq, const void *data, #endif } -static int flask_unmap_domain_irq (struct domain *d, int irq, const void *data) +static int cf_check flask_unmap_domain_irq( + struct domain *d, int irq, const void *data) { u32 sid; int rc = -EPERM; @@ -972,7 +979,8 @@ static int flask_unmap_domain_irq (struct domain *d, int irq, const void *data) return rc; } -static int flask_bind_pt_irq (struct domain *d, struct xen_domctl_bind_pt_irq *bind) +static int cf_check flask_bind_pt_irq( + struct domain *d, struct xen_domctl_bind_pt_irq *bind) { u32 dsid, rsid; int rc = -EPERM; @@ -998,12 +1006,14 @@ static int flask_bind_pt_irq (struct domain *d, struct xen_domctl_bind_pt_irq *b return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, dperm, &ad); } -static int flask_unbind_pt_irq (struct domain *d, struct xen_domctl_bind_pt_irq *bind) +static int cf_check flask_unbind_pt_irq( + struct domain *d, struct xen_domctl_bind_pt_irq *bind) { return current_has_perm(d, SECCLASS_RESOURCE, RESOURCE__REMOVE); } -static int flask_irq_permission (struct domain *d, int pirq, uint8_t access) +static int cf_check flask_irq_permission( + struct domain *d, int pirq, uint8_t access) { /* the PIRQ number is not useful; real IRQ is checked during mapping */ return current_has_perm(d, SECCLASS_RESOURCE, resource_to_perm(access)); @@ -1016,7 +1026,8 @@ struct iomem_has_perm_data { u32 use_perm; }; -static int _iomem_has_perm(void *v, u32 sid, unsigned long start, unsigned long end) +static int cf_check _iomem_has_perm( + void *v, u32 sid, unsigned long start, unsigned long end) { struct iomem_has_perm_data *data = v; struct avc_audit_data ad; @@ -1034,7 +1045,8 @@ static int _iomem_has_perm(void *v, u32 sid, unsigned long start, unsigned long return avc_has_perm(data->dsid, sid, SECCLASS_RESOURCE, data->use_perm, &ad); } -static int flask_iomem_permission(struct domain *d, uint64_t start, uint64_t end, uint8_t access) +static int cf_check flask_iomem_permission( + struct domain *d, uint64_t start, uint64_t end, uint8_t access) { struct iomem_has_perm_data data; int rc; @@ -1056,12 +1068,14 @@ static int flask_iomem_permission(struct domain *d, uint64_t start, uint64_t end return security_iterate_iomem_sids(start, end, _iomem_has_perm, &data); } -static int flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, uint8_t access) +static int cf_check flask_iomem_mapping(struct domain *d, uint64_t start, uint64_t end, uint8_t access) { return flask_iomem_permission(d, start, end, access); } -static int flask_pci_config_permission(struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end, uint8_t access) +static int cf_check flask_pci_config_permission( + struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end, + uint8_t access) { u32 dsid, rsid; int rc = -EPERM; @@ -1085,12 +1099,12 @@ static int flask_pci_config_permission(struct domain *d, uint32_t machine_bdf, u } -static int flask_resource_plug_core(void) +static int cf_check flask_resource_plug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__PLUG, NULL); } -static int flask_resource_unplug_core(void) +static int cf_check flask_resource_unplug_core(void) { return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__UNPLUG, NULL); } @@ -1100,7 +1114,7 @@ static int flask_resource_use_core(void) return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, RESOURCE__USE, NULL); } -static int flask_resource_plug_pci(uint32_t machine_bdf) +static int cf_check flask_resource_plug_pci(uint32_t machine_bdf) { u32 rsid; int rc = -EPERM; @@ -1115,7 +1129,7 @@ static int flask_resource_plug_pci(uint32_t machine_bdf) return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__PLUG, &ad); } -static int flask_resource_unplug_pci(uint32_t machine_bdf) +static int cf_check flask_resource_unplug_pci(uint32_t machine_bdf) { u32 rsid; int rc = -EPERM; @@ -1130,7 +1144,7 @@ static int flask_resource_unplug_pci(uint32_t machine_bdf) return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__UNPLUG, &ad); } -static int flask_resource_setup_pci(uint32_t machine_bdf) +static int cf_check flask_resource_setup_pci(uint32_t machine_bdf) { u32 rsid; int rc = -EPERM; @@ -1145,7 +1159,7 @@ static int flask_resource_setup_pci(uint32_t machine_bdf) return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__SETUP, &ad); } -static int flask_resource_setup_gsi(int gsi) +static int cf_check flask_resource_setup_gsi(int gsi) { u32 rsid; int rc = -EPERM; @@ -1158,12 +1172,12 @@ static int flask_resource_setup_gsi(int gsi) return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__SETUP, &ad); } -static int flask_resource_setup_misc(void) +static int cf_check flask_resource_setup_misc(void) { return avc_current_has_perm(SECINITSID_XEN, SECCLASS_RESOURCE, RESOURCE__SETUP, NULL); } -static inline int flask_page_offline(uint32_t cmd) +static inline int cf_check flask_page_offline(uint32_t cmd) { switch (cmd) { case sysctl_page_offline: @@ -1177,27 +1191,28 @@ static inline int flask_page_offline(uint32_t cmd) } } -static inline int flask_hypfs_op(void) +static inline int cf_check flask_hypfs_op(void) { return domain_has_xen(current->domain, XEN__HYPFS_OP); } -static int flask_add_to_physmap(struct domain *d1, struct domain *d2) +static int cf_check flask_add_to_physmap(struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__PHYSMAP); } -static int flask_remove_from_physmap(struct domain *d1, struct domain *d2) +static int cf_check flask_remove_from_physmap( + struct domain *d1, struct domain *d2) { return domain_has_perm(d1, d2, SECCLASS_MMU, MMU__PHYSMAP); } -static int flask_map_gmfn_foreign(struct domain *d, struct domain *t) +static int cf_check flask_map_gmfn_foreign(struct domain *d, struct domain *t) { return domain_has_perm(d, t, SECCLASS_MMU, MMU__MAP_READ | MMU__MAP_WRITE); } -static int flask_hvm_param(struct domain *d, unsigned long op) +static int cf_check flask_hvm_param(struct domain *d, unsigned long op) { u32 perm; @@ -1216,12 +1231,12 @@ static int flask_hvm_param(struct domain *d, unsigned long op) return current_has_perm(d, SECCLASS_HVM, perm); } -static int flask_hvm_param_altp2mhvm(struct domain *d) +static int cf_check flask_hvm_param_altp2mhvm(struct domain *d) { return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM); } -static int flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op) +static int cf_check flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op) { /* * Require both mode and XSM to allow the operation. Assume XSM rules @@ -1245,34 +1260,34 @@ static int flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op) return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP); } -static int flask_vm_event_control(struct domain *d, int mode, int op) +static int cf_check flask_vm_event_control(struct domain *d, int mode, int op) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__VM_EVENT); } #ifdef CONFIG_MEM_ACCESS -static int flask_mem_access(struct domain *d) +static int cf_check flask_mem_access(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__MEM_ACCESS); } #endif #ifdef CONFIG_MEM_PAGING -static int flask_mem_paging(struct domain *d) +static int cf_check flask_mem_paging(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__MEM_PAGING); } #endif #ifdef CONFIG_MEM_SHARING -static int flask_mem_sharing(struct domain *d) +static int cf_check flask_mem_sharing(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__MEM_SHARING); } #endif #if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI) -static int flask_get_device_group(uint32_t machine_bdf) +static int cf_check flask_get_device_group(uint32_t machine_bdf) { u32 rsid; int rc = -EPERM; @@ -1296,7 +1311,7 @@ static int flask_test_assign_device(uint32_t machine_bdf) return avc_current_has_perm(rsid, SECCLASS_RESOURCE, RESOURCE__STAT_DEVICE, NULL); } -static int flask_assign_device(struct domain *d, uint32_t machine_bdf) +static int cf_check flask_assign_device(struct domain *d, uint32_t machine_bdf) { u32 dsid, rsid; int rc = -EPERM; @@ -1326,7 +1341,8 @@ static int flask_assign_device(struct domain *d, uint32_t machine_bdf) return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, dperm, &ad); } -static int flask_deassign_device(struct domain *d, uint32_t machine_bdf) +static int cf_check flask_deassign_device( + struct domain *d, uint32_t machine_bdf) { u32 rsid; int rc = -EPERM; @@ -1357,7 +1373,7 @@ static int flask_test_assign_dtdevice(const char *dtpath) NULL); } -static int flask_assign_dtdevice(struct domain *d, const char *dtpath) +static int cf_check flask_assign_dtdevice(struct domain *d, const char *dtpath) { u32 dsid, rsid; int rc = -EPERM; @@ -1387,7 +1403,8 @@ static int flask_assign_dtdevice(struct domain *d, const char *dtpath) return avc_has_perm(dsid, rsid, SECCLASS_RESOURCE, dperm, &ad); } -static int flask_deassign_dtdevice(struct domain *d, const char *dtpath) +static int cf_check flask_deassign_dtdevice( + struct domain *d, const char *dtpath) { u32 rsid; int rc = -EPERM; @@ -1405,7 +1422,7 @@ static int flask_deassign_dtdevice(struct domain *d, const char *dtpath) } #endif /* HAS_PASSTHROUGH && HAS_DEVICE_TREE */ -static int flask_platform_op(uint32_t op) +static int cf_check flask_platform_op(uint32_t op) { switch ( op ) { @@ -1474,12 +1491,12 @@ static int flask_platform_op(uint32_t op) } #ifdef CONFIG_X86 -static int flask_do_mca(void) +static int cf_check flask_do_mca(void) { return domain_has_xen(current->domain, XEN__MCA_OP); } -static int flask_shadow_control(struct domain *d, uint32_t op) +static int cf_check flask_shadow_control(struct domain *d, uint32_t op) { u32 perm; @@ -1513,7 +1530,8 @@ struct ioport_has_perm_data { u32 use_perm; }; -static int _ioport_has_perm(void *v, u32 sid, unsigned long start, unsigned long end) +static int cf_check _ioport_has_perm( + void *v, u32 sid, unsigned long start, unsigned long end) { struct ioport_has_perm_data *data = v; struct avc_audit_data ad; @@ -1531,7 +1549,8 @@ static int _ioport_has_perm(void *v, u32 sid, unsigned long start, unsigned long return avc_has_perm(data->dsid, sid, SECCLASS_RESOURCE, data->use_perm, &ad); } -static int flask_ioport_permission(struct domain *d, uint32_t start, uint32_t end, uint8_t access) +static int cf_check flask_ioport_permission( + struct domain *d, uint32_t start, uint32_t end, uint8_t access) { int rc; struct ioport_has_perm_data data; @@ -1554,12 +1573,14 @@ static int flask_ioport_permission(struct domain *d, uint32_t start, uint32_t en return security_iterate_ioport_sids(start, end, _ioport_has_perm, &data); } -static int flask_ioport_mapping(struct domain *d, uint32_t start, uint32_t end, uint8_t access) +static int cf_check flask_ioport_mapping( + struct domain *d, uint32_t start, uint32_t end, uint8_t access) { return flask_ioport_permission(d, start, end, access); } -static int flask_mem_sharing_op(struct domain *d, struct domain *cd, int op) +static int cf_check flask_mem_sharing_op( + struct domain *d, struct domain *cd, int op) { int rc = current_has_perm(cd, SECCLASS_HVM, HVM__MEM_SHARING); if ( rc ) @@ -1567,7 +1588,7 @@ static int flask_mem_sharing_op(struct domain *d, struct domain *cd, int op) return domain_has_perm(d, cd, SECCLASS_HVM, HVM__SHARE_MEM); } -static int flask_apic(struct domain *d, int cmd) +static int cf_check flask_apic(struct domain *d, int cmd) { u32 perm; @@ -1587,18 +1608,18 @@ static int flask_apic(struct domain *d, int cmd) return domain_has_xen(d, perm); } -static int flask_machine_memory_map(void) +static int cf_check flask_machine_memory_map(void) { return avc_current_has_perm(SECINITSID_XEN, SECCLASS_MMU, MMU__MEMORYMAP, NULL); } -static int flask_domain_memory_map(struct domain *d) +static int cf_check flask_domain_memory_map(struct domain *d) { return current_has_perm(d, SECCLASS_MMU, MMU__MEMORYMAP); } -static int flask_mmu_update(struct domain *d, struct domain *t, - struct domain *f, uint32_t flags) +static int cf_check flask_mmu_update( + struct domain *d, struct domain *t, struct domain *f, uint32_t flags) { int rc = 0; u32 map_perms = 0; @@ -1620,13 +1641,13 @@ static int flask_mmu_update(struct domain *d, struct domain *t, return rc; } -static int flask_mmuext_op(struct domain *d, struct domain *f) +static int cf_check flask_mmuext_op(struct domain *d, struct domain *f) { return domain_has_perm(d, f, SECCLASS_MMU, MMU__MMUEXT_OP); } -static int flask_update_va_mapping(struct domain *d, struct domain *f, - l1_pgentry_t pte) +static int cf_check flask_update_va_mapping( + struct domain *d, struct domain *f, l1_pgentry_t pte) { u32 map_perms = MMU__MAP_READ; if ( !(l1e_get_flags(pte) & _PAGE_PRESENT) ) @@ -1637,12 +1658,12 @@ static int flask_update_va_mapping(struct domain *d, struct domain *f, return domain_has_perm(d, f, SECCLASS_MMU, map_perms); } -static int flask_priv_mapping(struct domain *d, struct domain *t) +static int cf_check flask_priv_mapping(struct domain *d, struct domain *t) { return domain_has_perm(d, t, SECCLASS_MMU, MMU__TARGET_HACK); } -static int flask_pmu_op (struct domain *d, unsigned int op) +static int cf_check flask_pmu_op(struct domain *d, unsigned int op) { u32 dsid = domain_sid(d); @@ -1666,12 +1687,12 @@ static int flask_pmu_op (struct domain *d, unsigned int op) } #endif /* CONFIG_X86 */ -static int flask_dm_op(struct domain *d) +static int cf_check flask_dm_op(struct domain *d) { return current_has_perm(d, SECCLASS_HVM, HVM__DM); } -static int flask_xen_version (uint32_t op) +static int cf_check flask_xen_version(uint32_t op) { u32 dsid = domain_sid(current->domain); @@ -1711,32 +1732,33 @@ static int flask_xen_version (uint32_t op) } } -static int flask_domain_resource_map(struct domain *d) +static int cf_check flask_domain_resource_map(struct domain *d) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__RESOURCE_MAP); } #ifdef CONFIG_ARGO -static int flask_argo_enable(const struct domain *d) +static int cf_check flask_argo_enable(const struct domain *d) { return avc_has_perm(domain_sid(d), SECINITSID_XEN, SECCLASS_ARGO, ARGO__ENABLE, NULL); } -static int flask_argo_register_single_source(const struct domain *d, - const struct domain *t) +static int cf_check flask_argo_register_single_source( + const struct domain *d, const struct domain *t) { return domain_has_perm(d, t, SECCLASS_ARGO, ARGO__REGISTER_SINGLE_SOURCE); } -static int flask_argo_register_any_source(const struct domain *d) +static int cf_check flask_argo_register_any_source(const struct domain *d) { return avc_has_perm(domain_sid(d), SECINITSID_XEN, SECCLASS_ARGO, ARGO__REGISTER_ANY_SOURCE, NULL); } -static int flask_argo_send(const struct domain *d, const struct domain *t) +static int cf_check flask_argo_send( + const struct domain *d, const struct domain *t) { return domain_has_perm(d, t, SECCLASS_ARGO, ARGO__SEND); } diff --git a/xen/xsm/flask/private.h b/xen/xsm/flask/private.h index 73b0de87245a..429f213cce74 100644 --- a/xen/xsm/flask/private.h +++ b/xen/xsm/flask/private.h @@ -3,7 +3,7 @@ #include -long do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); -int compat_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); +long cf_check do_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); +int cf_check compat_flask_op(XEN_GUEST_HANDLE_PARAM(void) u_flask_op); #endif /* XSM_FLASK_PRIVATE */ diff --git a/xen/xsm/silo.c b/xen/xsm/silo.c index 3550dded7b4e..4d5fc98e7e54 100644 --- a/xen/xsm/silo.c +++ b/xen/xsm/silo.c @@ -33,8 +33,8 @@ static bool silo_mode_dom_check(const struct domain *ldom, is_control_domain(rdom) || ldom == rdom); } -static int silo_evtchn_unbound(struct domain *d1, struct evtchn *chn, - domid_t id2) +static int cf_check silo_evtchn_unbound( + struct domain *d1, struct evtchn *chn, domid_t id2) { int rc = -EPERM; struct domain *d2 = rcu_lock_domain_by_any_id(id2); @@ -51,30 +51,31 @@ static int silo_evtchn_unbound(struct domain *d1, struct evtchn *chn, return rc; } -static int silo_evtchn_interdomain(struct domain *d1, struct evtchn *chan1, - struct domain *d2, struct evtchn *chan2) +static int cf_check silo_evtchn_interdomain( + struct domain *d1, struct evtchn *chan1, + struct domain *d2, struct evtchn *chan2) { if ( silo_mode_dom_check(d1, d2) ) return xsm_evtchn_interdomain(d1, chan1, d2, chan2); return -EPERM; } -static int silo_grant_mapref(struct domain *d1, struct domain *d2, - uint32_t flags) +static int cf_check silo_grant_mapref( + struct domain *d1, struct domain *d2, uint32_t flags) { if ( silo_mode_dom_check(d1, d2) ) return xsm_grant_mapref(d1, d2, flags); return -EPERM; } -static int silo_grant_transfer(struct domain *d1, struct domain *d2) +static int cf_check silo_grant_transfer(struct domain *d1, struct domain *d2) { if ( silo_mode_dom_check(d1, d2) ) return xsm_grant_transfer(d1, d2); return -EPERM; } -static int silo_grant_copy(struct domain *d1, struct domain *d2) +static int cf_check silo_grant_copy(struct domain *d1, struct domain *d2) { if ( silo_mode_dom_check(d1, d2) ) return xsm_grant_copy(d1, d2); @@ -83,15 +84,16 @@ static int silo_grant_copy(struct domain *d1, struct domain *d2) #ifdef CONFIG_ARGO -static int silo_argo_register_single_source(const struct domain *d1, - const struct domain *d2) +static int cf_check silo_argo_register_single_source( + const struct domain *d1, const struct domain *d2) { if ( silo_mode_dom_check(d1, d2) ) return xsm_argo_register_single_source(d1, d2); return -EPERM; } -static int silo_argo_send(const struct domain *d1, const struct domain *d2) +static int cf_check silo_argo_send( + const struct domain *d1, const struct domain *d2) { if ( silo_mode_dom_check(d1, d2) ) return xsm_argo_send(d1, d2); From patchwork Mon Feb 14 12:50:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745551 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C1007C433EF for ; Mon, 14 Feb 2022 13:05:09 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271648.466246 (Exim 4.92) (envelope-from ) id 1nJb2K-00027b-AA; Mon, 14 Feb 2022 13:05:00 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271648.466246; Mon, 14 Feb 2022 13:05:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2K-00027M-5i; Mon, 14 Feb 2022 13:05:00 +0000 Received: by outflank-mailman (input) for mailman id 271648; Mon, 14 Feb 2022 13:04:59 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2I-0008IH-Kj for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:58 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id b3f624cb-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:56 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b3f624cb-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843895; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=pfhdXVvCWz6Fs6X++wjrTNrqVSs3wjv7wmnK/81GecM=; b=ZDay2MKrjN+Mh8oZQyInZNgPP/fl07hSAFxn3vaKgcXWLdoobN5cgFos NSW4Pk6sHvcsQ1yJhiEOUmk8o/EBXoHBA6E5KpspR6+ZyBgX6VGHsDrp7 js1nKcEy4deYJLsarswwXYO1xxClfZ5vUkkcQ6oegMD5BqLI39eqEY0r0 M=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 5qzbJEgkWLQuuZ6suPdPbZ5i9qx84NCPrBpyP+ktyWo5TRk6cxC2kKzBxd4F3fonV1/HbnAg4+ b3a9QZ3hIdKh4rMBvhq0LbJtxDVueOsQXNGE3i8ZY0oefJK7/eimJfDA5VaVDJXuYmIv4pRoeV Zs8Rt5QcOwWEhaCg+zfMT+XqgN04O59X90HD29y2giLls1bd/FlzyKwkmm9FdgDhkT3fLoE4BX X/dQbuaxdcXVsyaTcGqrcfXcoRUTv6N4M2dzkryVWSmdMHTBz2RjfrCdDkQmvM+mGFNPAow96j aa0ejekdB6HgglrhV+trZVYK X-SBRS: 5.1 X-MesageID: 64149320 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:ZwFvuqx2U3I+ix/11EZ6t+cowSrEfRIJ4+MujC+fZmUNrF6WrkUBm GsZCGvSP6zfY2ujKYp/bIiw/UJQvJXSy9EyHQdtqiAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt4937 4tOiMXvcyMsIKnPqOMsUh9RSy4raMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwXQaeFP ZJxhTxHZRf4PQZMC34sFb0avuD2jHXETABGtwfAzUYwyzeKl1EguFT3C/LFd9rPSchLk0Kwo mPd43+/EhwcLMaYyzeO7jSrnOCnoM/gcNtMTvvirKcs2QDNgDxIYPELabeliaa/rRC9ZosAE WgR5C4tna8D9UqiFtaoCnVUv0W4lhIbXtNRFcgz5weM1rfY7m6lO4QUctJSQId47ZFrHFTGw nfMxoq0XmI37NV5XFrAru/8kN+kBcQCwYbujwcgRBBN3dTsqZpbYvnnHoc6S/7dYjEY9FjNL 9G2QMoW2u97YS0jjfzTEbX7b9WE/Mahc+LNzl+LNl9JFysgDGJfW6Sm6ELA8dFLJ5uDQ1+Ks RAswpbCsL9eXczQzHXWGo3h+Y1FAN7fblXhbaNHRcF9p1xBBVb/FWyv3N2ODBgwaZtVEdMYS ETSpRlQ9Pdu0IiCNsdKj3aKI51yl8DITI29PtiNN4YmSsUhJWevoXA1DWbNjj+FraTZufxmU XttWZ33Vihy5GUO5GfeetrxJpd1mn5glTmOGfgWDX2PiNKjWZJccp9dWHPmUwzzxPrsTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:uR7z8KPttWKn9MBcTsOjsMiBIKoaSvp037Eqv3oedfU1SL3gqy nAppQmPHPP5Ar5HUtQ/OxoW5PwJ080l6QFgrX5VI3KNGKN1VdAbrsSibcKqweQfBEWndQ96U 4PScdD4aXLfDpHsfo= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149320" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 20/70] xen/sched: CFI hardening Date: Mon, 14 Feb 2022 12:50:37 +0000 Message-ID: <20220214125127.17985-21-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Dario Faggioli --- xen/common/sched/arinc653.c | 20 +++++++-------- xen/common/sched/core.c | 8 +++--- xen/common/sched/credit.c | 49 ++++++++++++++++++------------------ xen/common/sched/credit2.c | 51 +++++++++++++++++++------------------- xen/common/sched/null.c | 60 +++++++++++++++++++++++---------------------- xen/common/sched/rt.c | 42 +++++++++++++++---------------- 6 files changed, 115 insertions(+), 115 deletions(-) diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c index 542191822192..a82c0d7314a1 100644 --- a/xen/common/sched/arinc653.c +++ b/xen/common/sched/arinc653.c @@ -343,7 +343,7 @@ arinc653_sched_get( *
  • !0 = error * */ -static int +static int cf_check a653sched_init(struct scheduler *ops) { a653sched_priv_t *prv; @@ -366,7 +366,7 @@ a653sched_init(struct scheduler *ops) * * @param ops Pointer to this instance of the scheduler structure */ -static void +static void cf_check a653sched_deinit(struct scheduler *ops) { xfree(SCHED_PRIV(ops)); @@ -381,7 +381,7 @@ a653sched_deinit(struct scheduler *ops) * * @return Pointer to the allocated data */ -static void * +static void *cf_check a653sched_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, void *dd) { @@ -442,7 +442,7 @@ a653sched_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, * * @param ops Pointer to this instance of the scheduler structure */ -static void +static void cf_check a653sched_free_udata(const struct scheduler *ops, void *priv) { a653sched_priv_t *sched_priv = SCHED_PRIV(ops); @@ -469,7 +469,7 @@ a653sched_free_udata(const struct scheduler *ops, void *priv) * @param ops Pointer to this instance of the scheduler structure * @param unit Pointer to struct sched_unit */ -static void +static void cf_check a653sched_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) { if ( AUNIT(unit) != NULL ) @@ -489,7 +489,7 @@ a653sched_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) * @param ops Pointer to this instance of the scheduler structure * @param unit Pointer to struct sched_unit */ -static void +static void cf_check a653sched_unit_wake(const struct scheduler *ops, struct sched_unit *unit) { if ( AUNIT(unit) != NULL ) @@ -505,7 +505,7 @@ a653sched_unit_wake(const struct scheduler *ops, struct sched_unit *unit) * @param ops Pointer to this instance of the scheduler structure * @param now Current time */ -static void +static void cf_check a653sched_do_schedule( const struct scheduler *ops, struct sched_unit *prev, @@ -604,7 +604,7 @@ a653sched_do_schedule( * * @return Scheduler resource to run on */ -static struct sched_resource * +static struct sched_resource *cf_check a653sched_pick_resource(const struct scheduler *ops, const struct sched_unit *unit) { @@ -634,7 +634,7 @@ a653sched_pick_resource(const struct scheduler *ops, * @param pdata scheduler specific PCPU data (we don't have any) * @param vdata scheduler specific UNIT data of the idle unit */ -static spinlock_t * +static spinlock_t *cf_check a653_switch_sched(struct scheduler *new_ops, unsigned int cpu, void *pdata, void *vdata) { @@ -656,7 +656,7 @@ a653_switch_sched(struct scheduler *new_ops, unsigned int cpu, * @param ops Pointer to this instance of the scheduler structure * @param sc Pointer to the scheduler operation specified by Domain 0 */ -static int +static int cf_check a653sched_adjust_global(const struct scheduler *ops, struct xen_sysctl_scheduler_op *sc) { diff --git a/xen/common/sched/core.c b/xen/common/sched/core.c index b1836b591c0a..9e09d9befa23 100644 --- a/xen/common/sched/core.c +++ b/xen/common/sched/core.c @@ -98,13 +98,13 @@ static bool scheduler_active; static void sched_set_affinity( struct sched_unit *unit, const cpumask_t *hard, const cpumask_t *soft); -static struct sched_resource * +static struct sched_resource *cf_check sched_idle_res_pick(const struct scheduler *ops, const struct sched_unit *unit) { return unit->res; } -static void * +static void *cf_check sched_idle_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, void *dd) { @@ -112,12 +112,12 @@ sched_idle_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, return ZERO_BLOCK_PTR; } -static void +static void cf_check sched_idle_free_udata(const struct scheduler *ops, void *priv) { } -static void sched_idle_schedule( +static void cf_check sched_idle_schedule( const struct scheduler *ops, struct sched_unit *unit, s_time_t now, bool tasklet_work_scheduled) { diff --git a/xen/common/sched/credit.c b/xen/common/sched/credit.c index 5635271f6fea..4d3bd8cba6fc 100644 --- a/xen/common/sched/credit.c +++ b/xen/common/sched/credit.c @@ -507,7 +507,7 @@ static inline void __runq_tickle(const struct csched_unit *new) SCHED_STAT_CRANK(tickled_no_cpu); } -static void +static void cf_check csched_free_pdata(const struct scheduler *ops, void *pcpu, int cpu) { const struct csched_private *prv = CSCHED_PRIV(ops); @@ -524,7 +524,7 @@ csched_free_pdata(const struct scheduler *ops, void *pcpu, int cpu) xfree(pcpu); } -static void +static void cf_check csched_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) { struct csched_private *prv = CSCHED_PRIV(ops); @@ -566,7 +566,7 @@ csched_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) spin_unlock_irqrestore(&prv->lock, flags); } -static void * +static void *cf_check csched_alloc_pdata(const struct scheduler *ops, int cpu) { struct csched_pcpu *spc; @@ -615,7 +615,7 @@ init_pdata(struct csched_private *prv, struct csched_pcpu *spc, int cpu) } /* Change the scheduler of cpu to us (Credit). */ -static spinlock_t * +static spinlock_t *cf_check csched_switch_sched(struct scheduler *new_ops, unsigned int cpu, void *pdata, void *vdata) { @@ -848,7 +848,7 @@ _csched_cpu_pick(const struct scheduler *ops, const struct sched_unit *unit, return cpu; } -static struct sched_resource * +static struct sched_resource *cf_check csched_res_pick(const struct scheduler *ops, const struct sched_unit *unit) { struct csched_unit *svc = CSCHED_UNIT(unit); @@ -985,9 +985,8 @@ csched_unit_acct(struct csched_private *prv, unsigned int cpu) } } -static void * -csched_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, - void *dd) +static void *cf_check csched_alloc_udata( + const struct scheduler *ops, struct sched_unit *unit, void *dd) { struct csched_unit *svc; @@ -1007,7 +1006,7 @@ csched_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, return svc; } -static void +static void cf_check csched_unit_insert(const struct scheduler *ops, struct sched_unit *unit) { struct csched_unit *svc = unit->priv; @@ -1032,7 +1031,7 @@ csched_unit_insert(const struct scheduler *ops, struct sched_unit *unit) SCHED_STAT_CRANK(unit_insert); } -static void +static void cf_check csched_free_udata(const struct scheduler *ops, void *priv) { struct csched_unit *svc = priv; @@ -1042,7 +1041,7 @@ csched_free_udata(const struct scheduler *ops, void *priv) xfree(svc); } -static void +static void cf_check csched_unit_remove(const struct scheduler *ops, struct sched_unit *unit) { struct csched_private *prv = CSCHED_PRIV(ops); @@ -1069,7 +1068,7 @@ csched_unit_remove(const struct scheduler *ops, struct sched_unit *unit) BUG_ON( sdom == NULL ); } -static void +static void cf_check csched_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) { struct csched_unit * const svc = CSCHED_UNIT(unit); @@ -1094,7 +1093,7 @@ csched_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) runq_remove(svc); } -static void +static void cf_check csched_unit_wake(const struct scheduler *ops, struct sched_unit *unit) { struct csched_unit * const svc = CSCHED_UNIT(unit); @@ -1156,7 +1155,7 @@ csched_unit_wake(const struct scheduler *ops, struct sched_unit *unit) __runq_tickle(svc); } -static void +static void cf_check csched_unit_yield(const struct scheduler *ops, struct sched_unit *unit) { struct csched_unit * const svc = CSCHED_UNIT(unit); @@ -1165,7 +1164,7 @@ csched_unit_yield(const struct scheduler *ops, struct sched_unit *unit) set_bit(CSCHED_FLAG_UNIT_YIELD, &svc->flags); } -static int +static int cf_check csched_dom_cntl( const struct scheduler *ops, struct domain *d, @@ -1210,7 +1209,7 @@ csched_dom_cntl( return rc; } -static void +static void cf_check csched_aff_cntl(const struct scheduler *ops, struct sched_unit *unit, const cpumask_t *hard, const cpumask_t *soft) { @@ -1238,7 +1237,7 @@ __csched_set_tslice(struct csched_private *prv, unsigned int timeslice_ms) prv->credit = prv->credits_per_tslice * prv->ncpus; } -static int +static int cf_check csched_sys_cntl(const struct scheduler *ops, struct xen_sysctl_scheduler_op *sc) { @@ -1281,7 +1280,7 @@ csched_sys_cntl(const struct scheduler *ops, return rc; } -static void * +static void *cf_check csched_alloc_domdata(const struct scheduler *ops, struct domain *dom) { struct csched_dom *sdom; @@ -1299,7 +1298,7 @@ csched_alloc_domdata(const struct scheduler *ops, struct domain *dom) return sdom; } -static void +static void cf_check csched_free_domdata(const struct scheduler *ops, void *data) { xfree(data); @@ -1809,7 +1808,7 @@ csched_load_balance(struct csched_private *prv, int cpu, * This function is in the critical path. It is designed to be simple and * fast for the common case. */ -static void csched_schedule( +static void cf_check csched_schedule( const struct scheduler *ops, struct sched_unit *unit, s_time_t now, bool tasklet_work_scheduled) { @@ -2026,7 +2025,7 @@ csched_dump_unit(const struct csched_unit *svc) printk("\n"); } -static void +static void cf_check csched_dump_pcpu(const struct scheduler *ops, int cpu) { const struct list_head *runq; @@ -2079,7 +2078,7 @@ csched_dump_pcpu(const struct scheduler *ops, int cpu) spin_unlock_irqrestore(&prv->lock, flags); } -static void +static void cf_check csched_dump(const struct scheduler *ops) { struct list_head *iter_sdom, *iter_svc; @@ -2143,7 +2142,7 @@ csched_dump(const struct scheduler *ops) spin_unlock_irqrestore(&prv->lock, flags); } -static int __init +static int __init cf_check csched_global_init(void) { if ( sched_credit_tslice_ms > XEN_SYSCTL_CSCHED_TSLICE_MAX || @@ -2173,7 +2172,7 @@ csched_global_init(void) return 0; } -static int +static int cf_check csched_init(struct scheduler *ops) { struct csched_private *prv; @@ -2215,7 +2214,7 @@ csched_init(struct scheduler *ops) return 0; } -static void +static void cf_check csched_deinit(struct scheduler *ops) { struct csched_private *prv; diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c index d96e2749ddfb..0e3f89e5378e 100644 --- a/xen/common/sched/credit2.c +++ b/xen/common/sched/credit2.c @@ -2164,7 +2164,7 @@ csched2_unit_check(const struct sched_unit *unit) #define CSCHED2_UNIT_CHECK(unit) #endif -static void * +static void *cf_check csched2_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, void *dd) { @@ -2208,7 +2208,7 @@ csched2_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, return svc; } -static void +static void cf_check csched2_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) { struct csched2_unit * const svc = csched2_unit(unit); @@ -2230,7 +2230,7 @@ csched2_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) __clear_bit(__CSFLAG_delayed_runq_add, &svc->flags); } -static void +static void cf_check csched2_unit_wake(const struct scheduler *ops, struct sched_unit *unit) { struct csched2_unit * const svc = csched2_unit(unit); @@ -2285,7 +2285,7 @@ csched2_unit_wake(const struct scheduler *ops, struct sched_unit *unit) return; } -static void +static void cf_check csched2_unit_yield(const struct scheduler *ops, struct sched_unit *unit) { struct csched2_unit * const svc = csched2_unit(unit); @@ -2293,7 +2293,7 @@ csched2_unit_yield(const struct scheduler *ops, struct sched_unit *unit) __set_bit(__CSFLAG_unit_yield, &svc->flags); } -static void +static void cf_check csched2_context_saved(const struct scheduler *ops, struct sched_unit *unit) { struct csched2_unit * const svc = csched2_unit(unit); @@ -2335,7 +2335,7 @@ csched2_context_saved(const struct scheduler *ops, struct sched_unit *unit) } #define MAX_LOAD (STIME_MAX) -static struct sched_resource * +static struct sched_resource *cf_check csched2_res_pick(const struct scheduler *ops, const struct sched_unit *unit) { struct csched2_private *prv = csched2_priv(ops); @@ -2867,8 +2867,7 @@ static void balance_load(const struct scheduler *ops, int cpu, s_time_t now) return; } -static void -csched2_unit_migrate( +static void cf_check csched2_unit_migrate( const struct scheduler *ops, struct sched_unit *unit, unsigned int new_cpu) { struct csched2_unit * const svc = csched2_unit(unit); @@ -2894,7 +2893,7 @@ csched2_unit_migrate( sched_set_res(unit, get_sched_res(new_cpu)); } -static int +static int cf_check csched2_dom_cntl( const struct scheduler *ops, struct domain *d, @@ -3100,7 +3099,7 @@ csched2_dom_cntl( return rc; } -static void +static void cf_check csched2_aff_cntl(const struct scheduler *ops, struct sched_unit *unit, const cpumask_t *hard, const cpumask_t *soft) { @@ -3116,8 +3115,8 @@ csched2_aff_cntl(const struct scheduler *ops, struct sched_unit *unit, __clear_bit(__CSFLAG_pinned, &svc->flags); } -static int csched2_sys_cntl(const struct scheduler *ops, - struct xen_sysctl_scheduler_op *sc) +static int cf_check csched2_sys_cntl( + const struct scheduler *ops, struct xen_sysctl_scheduler_op *sc) { struct xen_sysctl_credit2_schedule *params = &sc->u.sched_credit2; struct csched2_private *prv = csched2_priv(ops); @@ -3148,7 +3147,7 @@ static int csched2_sys_cntl(const struct scheduler *ops, return 0; } -static void * +static void *cf_check csched2_alloc_domdata(const struct scheduler *ops, struct domain *dom) { struct csched2_private *prv = csched2_priv(ops); @@ -3180,7 +3179,7 @@ csched2_alloc_domdata(const struct scheduler *ops, struct domain *dom) return sdom; } -static void +static void cf_check csched2_free_domdata(const struct scheduler *ops, void *data) { struct csched2_dom *sdom = data; @@ -3200,7 +3199,7 @@ csched2_free_domdata(const struct scheduler *ops, void *data) } } -static void +static void cf_check csched2_unit_insert(const struct scheduler *ops, struct sched_unit *unit) { const struct csched2_unit *svc = unit->priv; @@ -3231,7 +3230,7 @@ csched2_unit_insert(const struct scheduler *ops, struct sched_unit *unit) CSCHED2_UNIT_CHECK(unit); } -static void +static void cf_check csched2_free_udata(const struct scheduler *ops, void *priv) { struct csched2_unit *svc = priv; @@ -3239,7 +3238,7 @@ csched2_free_udata(const struct scheduler *ops, void *priv) xfree(svc); } -static void +static void cf_check csched2_unit_remove(const struct scheduler *ops, struct sched_unit *unit) { struct csched2_unit * const svc = csched2_unit(unit); @@ -3558,7 +3557,7 @@ runq_candidate(struct csched2_runqueue_data *rqd, * This function is in the critical path. It is designed to be simple and * fast for the common case. */ -static void csched2_schedule( +static void cf_check csched2_schedule( const struct scheduler *ops, struct sched_unit *currunit, s_time_t now, bool tasklet_work_scheduled) { @@ -3790,7 +3789,7 @@ dump_pcpu(const struct scheduler *ops, int cpu) } } -static void +static void cf_check csched2_dump(const struct scheduler *ops) { struct list_head *iter_sdom; @@ -3898,7 +3897,7 @@ csched2_dump(const struct scheduler *ops) read_unlock_irqrestore(&prv->lock, flags); } -static void * +static void *cf_check csched2_alloc_pdata(const struct scheduler *ops, int cpu) { struct csched2_pcpu *spc; @@ -3988,7 +3987,7 @@ init_pdata(struct csched2_private *prv, struct csched2_pcpu *spc, } /* Change the scheduler of cpu to us (Credit2). */ -static spinlock_t * +static spinlock_t *cf_check csched2_switch_sched(struct scheduler *new_ops, unsigned int cpu, void *pdata, void *vdata) { @@ -4026,7 +4025,7 @@ csched2_switch_sched(struct scheduler *new_ops, unsigned int cpu, return &rqd->lock; } -static void +static void cf_check csched2_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) { unsigned long flags; @@ -4086,7 +4085,7 @@ csched2_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) return; } -static void +static void cf_check csched2_free_pdata(const struct scheduler *ops, void *pcpu, int cpu) { struct csched2_private *prv = csched2_priv(ops); @@ -4115,7 +4114,7 @@ csched2_free_pdata(const struct scheduler *ops, void *pcpu, int cpu) xfree(pcpu); } -static int __init +static int __init cf_check csched2_global_init(void) { if ( opt_load_precision_shift < LOADAVG_PRECISION_SHIFT_MIN ) @@ -4142,7 +4141,7 @@ csched2_global_init(void) return 0; } -static int +static int cf_check csched2_init(struct scheduler *ops) { struct csched2_private *prv; @@ -4190,7 +4189,7 @@ csched2_init(struct scheduler *ops) return 0; } -static void +static void cf_check csched2_deinit(struct scheduler *ops) { struct csched2_private *prv; diff --git a/xen/common/sched/null.c b/xen/common/sched/null.c index 82d5d1baab85..65a0a6c5312d 100644 --- a/xen/common/sched/null.c +++ b/xen/common/sched/null.c @@ -130,7 +130,7 @@ static inline bool unit_check_affinity(struct sched_unit *unit, return cpumask_test_cpu(cpu, cpumask_scratch_cpu(cpu)); } -static int null_init(struct scheduler *ops) +static int cf_check null_init(struct scheduler *ops) { struct null_private *prv; @@ -152,7 +152,7 @@ static int null_init(struct scheduler *ops) return 0; } -static void null_deinit(struct scheduler *ops) +static void cf_check null_deinit(struct scheduler *ops) { xfree(ops->sched_data); ops->sched_data = NULL; @@ -166,7 +166,8 @@ static void init_pdata(struct null_private *prv, struct null_pcpu *npc, npc->unit = NULL; } -static void null_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) +static void cf_check null_deinit_pdata( + const struct scheduler *ops, void *pcpu, int cpu) { struct null_private *prv = null_priv(ops); struct null_pcpu *npc = pcpu; @@ -177,7 +178,7 @@ static void null_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) npc->unit = NULL; } -static void *null_alloc_pdata(const struct scheduler *ops, int cpu) +static void *cf_check null_alloc_pdata(const struct scheduler *ops, int cpu) { struct null_pcpu *npc; @@ -188,13 +189,14 @@ static void *null_alloc_pdata(const struct scheduler *ops, int cpu) return npc; } -static void null_free_pdata(const struct scheduler *ops, void *pcpu, int cpu) +static void cf_check null_free_pdata( + const struct scheduler *ops, void *pcpu, int cpu) { xfree(pcpu); } -static void *null_alloc_udata(const struct scheduler *ops, - struct sched_unit *unit, void *dd) +static void *cf_check null_alloc_udata( + const struct scheduler *ops, struct sched_unit *unit, void *dd) { struct null_unit *nvc; @@ -210,15 +212,15 @@ static void *null_alloc_udata(const struct scheduler *ops, return nvc; } -static void null_free_udata(const struct scheduler *ops, void *priv) +static void cf_check null_free_udata(const struct scheduler *ops, void *priv) { struct null_unit *nvc = priv; xfree(nvc); } -static void * null_alloc_domdata(const struct scheduler *ops, - struct domain *d) +static void *cf_check null_alloc_domdata( + const struct scheduler *ops, struct domain *d) { struct null_private *prv = null_priv(ops); struct null_dom *ndom; @@ -237,7 +239,7 @@ static void * null_alloc_domdata(const struct scheduler *ops, return ndom; } -static void null_free_domdata(const struct scheduler *ops, void *data) +static void cf_check null_free_domdata(const struct scheduler *ops, void *data) { struct null_dom *ndom = data; struct null_private *prv = null_priv(ops); @@ -426,9 +428,8 @@ static bool unit_deassign(struct null_private *prv, const struct sched_unit *uni } /* Change the scheduler of cpu to us (null). */ -static spinlock_t *null_switch_sched(struct scheduler *new_ops, - unsigned int cpu, - void *pdata, void *vdata) +static spinlock_t *cf_check null_switch_sched( + struct scheduler *new_ops, unsigned int cpu, void *pdata, void *vdata) { struct sched_resource *sr = get_sched_res(cpu); struct null_private *prv = null_priv(new_ops); @@ -450,8 +451,8 @@ static spinlock_t *null_switch_sched(struct scheduler *new_ops, return &sr->_lock; } -static void null_unit_insert(const struct scheduler *ops, - struct sched_unit *unit) +static void cf_check null_unit_insert( + const struct scheduler *ops, struct sched_unit *unit) { struct null_private *prv = null_priv(ops); struct null_unit *nvc = null_unit(unit); @@ -516,8 +517,8 @@ static void null_unit_insert(const struct scheduler *ops, SCHED_STAT_CRANK(unit_insert); } -static void null_unit_remove(const struct scheduler *ops, - struct sched_unit *unit) +static void cf_check null_unit_remove( + const struct scheduler *ops, struct sched_unit *unit) { struct null_private *prv = null_priv(ops); struct null_unit *nvc = null_unit(unit); @@ -556,8 +557,8 @@ static void null_unit_remove(const struct scheduler *ops, SCHED_STAT_CRANK(unit_remove); } -static void null_unit_wake(const struct scheduler *ops, - struct sched_unit *unit) +static void cf_check null_unit_wake( + const struct scheduler *ops, struct sched_unit *unit) { struct null_private *prv = null_priv(ops); struct null_unit *nvc = null_unit(unit); @@ -632,8 +633,8 @@ static void null_unit_wake(const struct scheduler *ops, cpumask_raise_softirq(cpumask_scratch_cpu(cpu), SCHEDULE_SOFTIRQ); } -static void null_unit_sleep(const struct scheduler *ops, - struct sched_unit *unit) +static void cf_check null_unit_sleep( + const struct scheduler *ops, struct sched_unit *unit) { struct null_private *prv = null_priv(ops); unsigned int cpu = sched_unit_master(unit); @@ -667,15 +668,15 @@ static void null_unit_sleep(const struct scheduler *ops, SCHED_STAT_CRANK(unit_sleep); } -static struct sched_resource * +static struct sched_resource *cf_check null_res_pick(const struct scheduler *ops, const struct sched_unit *unit) { ASSERT(!is_idle_unit(unit)); return pick_res(null_priv(ops), unit); } -static void null_unit_migrate(const struct scheduler *ops, - struct sched_unit *unit, unsigned int new_cpu) +static void cf_check null_unit_migrate( + const struct scheduler *ops, struct sched_unit *unit, unsigned int new_cpu) { struct null_private *prv = null_priv(ops); struct null_unit *nvc = null_unit(unit); @@ -801,8 +802,9 @@ static inline void null_unit_check(struct sched_unit *unit) * - the unit assigned to the pCPU, if there's one and it can run; * - the idle unit, otherwise. */ -static void null_schedule(const struct scheduler *ops, struct sched_unit *prev, - s_time_t now, bool tasklet_work_scheduled) +static void cf_check null_schedule( + const struct scheduler *ops, struct sched_unit *prev, s_time_t now, + bool tasklet_work_scheduled) { unsigned int bs; const unsigned int cur_cpu = smp_processor_id(); @@ -939,7 +941,7 @@ static inline void dump_unit(const struct null_private *prv, sched_unit_master(nvc->unit) : -1); } -static void null_dump_pcpu(const struct scheduler *ops, int cpu) +static void cf_check null_dump_pcpu(const struct scheduler *ops, int cpu) { struct null_private *prv = null_priv(ops); const struct null_pcpu *npc = get_sched_res(cpu)->sched_priv; @@ -968,7 +970,7 @@ static void null_dump_pcpu(const struct scheduler *ops, int cpu) pcpu_schedule_unlock_irqrestore(lock, flags, cpu); } -static void null_dump(const struct scheduler *ops) +static void cf_check null_dump(const struct scheduler *ops) { struct null_private *prv = null_priv(ops); struct list_head *iter; diff --git a/xen/common/sched/rt.c b/xen/common/sched/rt.c index 5ea6f01f263c..d6de25531b3c 100644 --- a/xen/common/sched/rt.c +++ b/xen/common/sched/rt.c @@ -269,13 +269,13 @@ unit_on_q(const struct rt_unit *svc) return !list_empty(&svc->q_elem); } -static struct rt_unit * +static struct rt_unit *cf_check q_elem(struct list_head *elem) { return list_entry(elem, struct rt_unit, q_elem); } -static struct rt_unit * +static struct rt_unit *cf_check replq_elem(struct list_head *elem) { return list_entry(elem, struct rt_unit, replq_elem); @@ -348,7 +348,7 @@ rt_dump_unit(const struct scheduler *ops, const struct rt_unit *svc) svc->flags, CPUMASK_PR(mask)); } -static void +static void cf_check rt_dump_pcpu(const struct scheduler *ops, int cpu) { struct rt_private *prv = rt_priv(ops); @@ -366,7 +366,7 @@ rt_dump_pcpu(const struct scheduler *ops, int cpu) spin_unlock_irqrestore(&prv->lock, flags); } -static void +static void cf_check rt_dump(const struct scheduler *ops) { struct list_head *runq, *depletedq, *replq, *iter; @@ -636,7 +636,7 @@ replq_reinsert(const struct scheduler *ops, struct rt_unit *svc) * Valid resource of an unit is intesection of unit's affinity * and available resources */ -static struct sched_resource * +static struct sched_resource *cf_check rt_res_pick_locked(const struct sched_unit *unit, unsigned int locked_cpu) { cpumask_t *cpus = cpumask_scratch_cpu(locked_cpu); @@ -659,7 +659,7 @@ rt_res_pick_locked(const struct sched_unit *unit, unsigned int locked_cpu) * Valid resource of an unit is intesection of unit's affinity * and available resources */ -static struct sched_resource * +static struct sched_resource *cf_check rt_res_pick(const struct scheduler *ops, const struct sched_unit *unit) { struct sched_resource *res; @@ -672,7 +672,7 @@ rt_res_pick(const struct scheduler *ops, const struct sched_unit *unit) /* * Init/Free related code */ -static int +static int cf_check rt_init(struct scheduler *ops) { int rc = -ENOMEM; @@ -701,7 +701,7 @@ rt_init(struct scheduler *ops) return rc; } -static void +static void cf_check rt_deinit(struct scheduler *ops) { struct rt_private *prv = rt_priv(ops); @@ -714,7 +714,7 @@ rt_deinit(struct scheduler *ops) } /* Change the scheduler of cpu to us (RTDS). */ -static spinlock_t * +static spinlock_t *cf_check rt_switch_sched(struct scheduler *new_ops, unsigned int cpu, void *pdata, void *vdata) { @@ -750,7 +750,7 @@ rt_switch_sched(struct scheduler *new_ops, unsigned int cpu, return &prv->lock; } -static void +static void cf_check rt_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) { unsigned long flags; @@ -782,7 +782,7 @@ rt_deinit_pdata(const struct scheduler *ops, void *pcpu, int cpu) spin_unlock_irqrestore(&prv->lock, flags); } -static void * +static void *cf_check rt_alloc_domdata(const struct scheduler *ops, struct domain *dom) { unsigned long flags; @@ -804,7 +804,7 @@ rt_alloc_domdata(const struct scheduler *ops, struct domain *dom) return sdom; } -static void +static void cf_check rt_free_domdata(const struct scheduler *ops, void *data) { struct rt_dom *sdom = data; @@ -822,7 +822,7 @@ rt_free_domdata(const struct scheduler *ops, void *data) } } -static void * +static void * cf_check rt_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, void *dd) { struct rt_unit *svc; @@ -850,7 +850,7 @@ rt_alloc_udata(const struct scheduler *ops, struct sched_unit *unit, void *dd) return svc; } -static void +static void cf_check rt_free_udata(const struct scheduler *ops, void *priv) { struct rt_unit *svc = priv; @@ -865,7 +865,7 @@ rt_free_udata(const struct scheduler *ops, void *priv) * It inserts units of moving domain to the scheduler's RunQ in * dest. cpupool. */ -static void +static void cf_check rt_unit_insert(const struct scheduler *ops, struct sched_unit *unit) { struct rt_unit *svc = rt_unit(unit); @@ -901,7 +901,7 @@ rt_unit_insert(const struct scheduler *ops, struct sched_unit *unit) /* * Remove rt_unit svc from the old scheduler in source cpupool. */ -static void +static void cf_check rt_unit_remove(const struct scheduler *ops, struct sched_unit *unit) { struct rt_unit * const svc = rt_unit(unit); @@ -1042,7 +1042,7 @@ runq_pick(const struct scheduler *ops, const cpumask_t *mask, unsigned int cpu) * schedule function for rt scheduler. * The lock is already grabbed in schedule.c, no need to lock here */ -static void +static void cf_check rt_schedule(const struct scheduler *ops, struct sched_unit *currunit, s_time_t now, bool tasklet_work_scheduled) { @@ -1129,7 +1129,7 @@ rt_schedule(const struct scheduler *ops, struct sched_unit *currunit, * Remove UNIT from RunQ * The lock is already grabbed in schedule.c, no need to lock here */ -static void +static void cf_check rt_unit_sleep(const struct scheduler *ops, struct sched_unit *unit) { struct rt_unit * const svc = rt_unit(unit); @@ -1244,7 +1244,7 @@ runq_tickle(const struct scheduler *ops, const struct rt_unit *new) * The lock is already grabbed in schedule.c, no need to lock here * TODO: what if these two units belongs to the same domain? */ -static void +static void cf_check rt_unit_wake(const struct scheduler *ops, struct sched_unit *unit) { struct rt_unit * const svc = rt_unit(unit); @@ -1314,7 +1314,7 @@ rt_unit_wake(const struct scheduler *ops, struct sched_unit *unit) * scurr has finished context switch, insert it back to the RunQ, * and then pick the highest priority unit from runq to run */ -static void +static void cf_check rt_context_saved(const struct scheduler *ops, struct sched_unit *unit) { struct rt_unit *svc = rt_unit(unit); @@ -1341,7 +1341,7 @@ rt_context_saved(const struct scheduler *ops, struct sched_unit *unit) /* * set/get each unit info of each domain */ -static int +static int cf_check rt_dom_cntl( const struct scheduler *ops, struct domain *d, From patchwork Mon Feb 14 12:50:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745604 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 90FF1C433F5 for ; Mon, 14 Feb 2022 13:18:07 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272051.466852 (Exim 4.92) (envelope-from ) id 1nJbEs-0003V0-4j; Mon, 14 Feb 2022 13:17:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272051.466852; Mon, 14 Feb 2022 13:17:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEr-0003UY-UI; Mon, 14 Feb 2022 13:17:57 +0000 Received: by outflank-mailman (input) for mailman id 272051; Mon, 14 Feb 2022 13:17:56 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4m-00023t-9Y for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:32 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 0f868522-8d97-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:07:30 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0f868522-8d97-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844050; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=s+Jt3kVFT6FeqRAFMyblKx1FZnX0D4ErdxbQ4UUEYAQ=; b=VHarnlgKoEuz+T/DcNbffAC3R15cP7vxCHcVh7ZMZzg9D1UNXKbnYH2Z DMPp3d4KVFy7W+nCbPf/kl1k5p2qmF5tq5Z0zQrXIvrLrwu4z2lExFH9R RyFz497djkvC/QkT44p/z+M1JsJ2MBxvBesfvZhBqmL3mXF77BF7LGO2h Q=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: sOXmjbQ9kP//HyRdi956wfUOuNX9Kjm/Wd+sZjKDp0SuqOAg0z0HsOt9ixom5wnyM8vkYkojxm bg1bRlH/iLWZwTl44lZzjUIM6HaSSyZtddniFaqScqOJ9q+pS0zonjOqRsxGmGyOOy/aNSFPgP vkIB70wKB6zyczGx+P3uqUU9k7EqyhxP16qRJ8HTuNYx7Rvp5TEgL0YWP4vl0PpalA09LiA4Lo eLtdmwn/rHgPR2gbceQ3xtzVZUEwAGn9ydpe/7O2873JfJRWjA+1r7aBT04ziTi8XziETD20BK E4+Fl/YUTZEBoeFHBoN22mqm X-SBRS: 5.1 X-MesageID: 64554519 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:758jf61bnZxSwly59/bD5cp2kn2cJEfYwER7XKvMYLTBsI5bpzdSz mBJXTzVbP6JYWOhc951OYvjoUwC6pHTnNBjSAU6pC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhktBD7 vlHt5OJGAIQMP3939Y/CyBzHHQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u2p0TQauHN qL1bxJrYjXlYhB1fW1PBY8Ykd6xt36nfi9h/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWTrPmLrGK0Wd1me kkt9Hof6poQrHWAQYyoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3mH5unz6PLX05pjz+uYejiLeuYe9tGDOzgioRtfvYyOkM2 9oAZcaM1TtFV+jyPnve/YIJdAhYJnknH5Hm7cdQc7fbcAZhHWggDd7XwK8gJNM5z/gEyL+Q8 yHvQFJcxXr+mWbDdVeAZEd8Ze69Rp14t386Y3AhZA76x3g5bI+zx64DbJ9rL6I//eluwKcsH fkIcsmNGNpVTTHD92hPZJXxttU6Jh+qmRiPL2yuZz1mJ8xsQAnA+9nFeArz9XZRUnrr5JVm+ 7D5j1HVW5sOQQhmHf36UvP3wgPjp2UZlcJzQ1DMfotZdnLz/dU4MCf2lPI2fZ0BcE2R2juA2 g+KKh4Evu2R8ZQt+dzEiK3Y/YekF+xyQhhTE2XBtOvkMCDb+iyowJNaUfbOdjfYDTum9KKnb ORT7vf9LPxYwwoa79siS+5mnfAk+t/ih75G1QA1TnzEYmOiBq5kPnTbj9JEsbdAx+MBtAa7M q5VFgK25Vld1BvZLWMs IronPort-HdrOrdr: A9a23:y/CNiai7vN8Zi7SlCLHi2MtuB3BQXtgji2hC6mlwRA09TySZ// rBoB17726MtN9/YhEdcLy7VJVoBEmskKKdgrNhW4tKPjOW21dARbsKheCJrgEIWReOktK1vZ 0QFJSWY+eQMbEVt6nHCXGDYrQd/OU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554519" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 21/70] xen/evtchn: CFI hardening Date: Mon, 14 Feb 2022 12:50:38 +0000 Message-ID: <20220214125127.17985-22-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/common/event_2l.c | 21 ++++++++++++--------- xen/common/event_channel.c | 3 ++- xen/common/event_fifo.c | 30 ++++++++++++++++-------------- 3 files changed, 30 insertions(+), 24 deletions(-) diff --git a/xen/common/event_2l.c b/xen/common/event_2l.c index 7424320e525a..d40dd51ab555 100644 --- a/xen/common/event_2l.c +++ b/xen/common/event_2l.c @@ -16,7 +16,8 @@ #include -static void evtchn_2l_set_pending(struct vcpu *v, struct evtchn *evtchn) +static void cf_check evtchn_2l_set_pending( + struct vcpu *v, struct evtchn *evtchn) { struct domain *d = v->domain; unsigned int port = evtchn->port; @@ -41,12 +42,14 @@ static void evtchn_2l_set_pending(struct vcpu *v, struct evtchn *evtchn) evtchn_check_pollers(d, port); } -static void evtchn_2l_clear_pending(struct domain *d, struct evtchn *evtchn) +static void cf_check evtchn_2l_clear_pending( + struct domain *d, struct evtchn *evtchn) { guest_clear_bit(d, evtchn->port, &shared_info(d, evtchn_pending)); } -static void evtchn_2l_unmask(struct domain *d, struct evtchn *evtchn) +static void cf_check evtchn_2l_unmask( + struct domain *d, struct evtchn *evtchn) { struct vcpu *v = d->vcpu[evtchn->notify_vcpu_id]; unsigned int port = evtchn->port; @@ -64,8 +67,8 @@ static void evtchn_2l_unmask(struct domain *d, struct evtchn *evtchn) } } -static bool evtchn_2l_is_pending(const struct domain *d, - const struct evtchn *evtchn) +static bool cf_check evtchn_2l_is_pending( + const struct domain *d, const struct evtchn *evtchn) { evtchn_port_t port = evtchn->port; unsigned int max_ports = BITS_PER_EVTCHN_WORD(d) * BITS_PER_EVTCHN_WORD(d); @@ -75,8 +78,8 @@ static bool evtchn_2l_is_pending(const struct domain *d, guest_test_bit(d, port, &shared_info(d, evtchn_pending))); } -static bool evtchn_2l_is_masked(const struct domain *d, - const struct evtchn *evtchn) +static bool cf_check evtchn_2l_is_masked( + const struct domain *d, const struct evtchn *evtchn) { evtchn_port_t port = evtchn->port; unsigned int max_ports = BITS_PER_EVTCHN_WORD(d) * BITS_PER_EVTCHN_WORD(d); @@ -86,8 +89,8 @@ static bool evtchn_2l_is_masked(const struct domain *d, guest_test_bit(d, port, &shared_info(d, evtchn_mask))); } -static void evtchn_2l_print_state(struct domain *d, - const struct evtchn *evtchn) +static void cf_check evtchn_2l_print_state( + struct domain *d, const struct evtchn *evtchn) { struct vcpu *v = d->vcpu[evtchn->notify_vcpu_id]; diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index 2026bc30dc95..183e78ac17f1 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -99,7 +99,8 @@ static xen_event_channel_notification_t __read_mostly xen_consumers[NR_XEN_CONSUMERS]; /* Default notification action: wake up from wait_on_xen_event_channel(). */ -static void default_xen_notification_fn(struct vcpu *v, unsigned int port) +static void cf_check default_xen_notification_fn( + struct vcpu *v, unsigned int port) { /* Consumer needs notification only if blocked. */ if ( test_and_clear_bit(_VPF_blocked_in_xen, &v->pause_flags) ) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index 2fb01b82db84..ed4d3beb10f3 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -78,7 +78,7 @@ static inline event_word_t *evtchn_fifo_word_from_port(const struct domain *d, return d->evtchn_fifo->event_array[p] + w; } -static void evtchn_fifo_init(struct domain *d, struct evtchn *evtchn) +static void cf_check evtchn_fifo_init(struct domain *d, struct evtchn *evtchn) { event_word_t *word; @@ -158,7 +158,8 @@ static bool_t evtchn_fifo_set_link(struct domain *d, event_word_t *word, return 1; } -static void evtchn_fifo_set_pending(struct vcpu *v, struct evtchn *evtchn) +static void cf_check evtchn_fifo_set_pending( + struct vcpu *v, struct evtchn *evtchn) { struct domain *d = v->domain; unsigned int port; @@ -317,7 +318,8 @@ static void evtchn_fifo_set_pending(struct vcpu *v, struct evtchn *evtchn) evtchn_check_pollers(d, port); } -static void evtchn_fifo_clear_pending(struct domain *d, struct evtchn *evtchn) +static void cf_check evtchn_fifo_clear_pending( + struct domain *d, struct evtchn *evtchn) { event_word_t *word; @@ -334,7 +336,7 @@ static void evtchn_fifo_clear_pending(struct domain *d, struct evtchn *evtchn) guest_clear_bit(d, EVTCHN_FIFO_PENDING, word); } -static void evtchn_fifo_unmask(struct domain *d, struct evtchn *evtchn) +static void cf_check evtchn_fifo_unmask(struct domain *d, struct evtchn *evtchn) { struct vcpu *v = d->vcpu[evtchn->notify_vcpu_id]; event_word_t *word; @@ -350,32 +352,32 @@ static void evtchn_fifo_unmask(struct domain *d, struct evtchn *evtchn) evtchn_fifo_set_pending(v, evtchn); } -static bool evtchn_fifo_is_pending(const struct domain *d, - const struct evtchn *evtchn) +static bool cf_check evtchn_fifo_is_pending( + const struct domain *d, const struct evtchn *evtchn) { const event_word_t *word = evtchn_fifo_word_from_port(d, evtchn->port); return word && guest_test_bit(d, EVTCHN_FIFO_PENDING, word); } -static bool_t evtchn_fifo_is_masked(const struct domain *d, - const struct evtchn *evtchn) +static bool cf_check evtchn_fifo_is_masked( + const struct domain *d, const struct evtchn *evtchn) { const event_word_t *word = evtchn_fifo_word_from_port(d, evtchn->port); return !word || guest_test_bit(d, EVTCHN_FIFO_MASKED, word); } -static bool_t evtchn_fifo_is_busy(const struct domain *d, - const struct evtchn *evtchn) +static bool cf_check evtchn_fifo_is_busy( + const struct domain *d, const struct evtchn *evtchn) { const event_word_t *word = evtchn_fifo_word_from_port(d, evtchn->port); return word && guest_test_bit(d, EVTCHN_FIFO_LINKED, word); } -static int evtchn_fifo_set_priority(struct domain *d, struct evtchn *evtchn, - unsigned int priority) +static int cf_check evtchn_fifo_set_priority( + struct domain *d, struct evtchn *evtchn, unsigned int priority) { if ( priority > EVTCHN_FIFO_PRIORITY_MIN ) return -EINVAL; @@ -390,8 +392,8 @@ static int evtchn_fifo_set_priority(struct domain *d, struct evtchn *evtchn, return 0; } -static void evtchn_fifo_print_state(struct domain *d, - const struct evtchn *evtchn) +static void cf_check evtchn_fifo_print_state( + struct domain *d, const struct evtchn *evtchn) { event_word_t *word; From patchwork Mon Feb 14 12:50:39 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745593 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6FC22C433F5 for ; Mon, 14 Feb 2022 13:17:05 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271950.466720 (Exim 4.92) (envelope-from ) id 1nJbDq-0004pp-Ff; Mon, 14 Feb 2022 13:16:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271950.466720; Mon, 14 Feb 2022 13:16:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDq-0004pc-Bl; Mon, 14 Feb 2022 13:16:54 +0000 Received: by outflank-mailman (input) for mailman id 271950; Mon, 14 Feb 2022 13:16:52 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4S-0008IH-L9 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:12 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0480d88e-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:11 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0480d88e-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844031; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=yEfJ1NphsqCcqUw8wV8ep+8qNFa6scIfTulHuJmrWCU=; b=BV6MgJgt1uxW3nHKsjmv5L56zukR6CjPzyP3m/uzCMfGqK34518N9EOq enD6Ny7puxpeXV+zGR33pjvqHFOMlR9R6krevpLCiDzVZrvJnQ6f8G65a zJIcDMwuQWlL/Z+vhSdPrYcgVe4f5VL+ELIJ3aUikIZuZck4fdaEr9fbU Q=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: eeE3LFTm9b8nkfrMlUyy4uZFO/R4lMxjDAfHhnrjeDnBJZud3NiZXxnsPOqcWXd+ZgMjWITqva eh5HcLAqsc6HKfVABc6qlCVqqZrkhoewaXy7qmvp/23vEotR8ErY6SwanUvzTtNxiq3JmKpjqP tAUpWzutLeLxeYYiOU5ZQF1KIQS8y7c+ls8eQce7w3nxC1X3hd6SuvTDOciTpR47kZd3NhUy+D PMqqgNT6CVcL3PzN1SI9D+uaIvwzqTvb26ucvVPFoaYg2Qu7SYLutkdjqXVDzjEOMCsPlTbHE5 oHmYc33QS11WMmqwAGWUFrdD X-SBRS: 5.1 X-MesageID: 64554366 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:05oBVq4mnwcOXuE8EroTCwxRtCDAchMFZxGqfqrLsTDasY5as4F+v jcYWG/Sb62PNGD8fox/b9zloEIA7JbQz9c2SVFkpC9jHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z5 M5drreIbDwQJ7Dgt8UGQkNUFRB9FPgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQauDO 5FHN1KDajzQUgBjF2pJLqsDt7awtCShVTsE9G+88P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeRplWuQPlnD nct4zcCgokp5RanSOj+dkjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5ilD2DHcihl3xKE9O2PRaodFvMC3PWBshR0U9OiFyFq r6z7uOGlEdSVvPQeC7S/dJBJFwGNyFjV5v3t9ZWZqiIJQ8/QDMtDPrYwLUAfY15nvsKyreUr y/lAkIImkDigXDnKBmRbiwxYr3YQpsi/2kwOjYhPAj01iF7M5qv9qoWa7A+YaIjqL541fdxQ vRcI5eAD/1DRy7p4TMYaZWh/oVueA7y3VCFPja/YSh5dJllHlSb9tjhdwrp1S8PEivo6pdu/ +z+jlvWGMNRSR5jAcDabOOU42mw5XVNyvhvW0boI8VIfBm++oZdNCGs3OQ8JNsBKEufy2LCh RqWGxoRucLEv5QxrIvSnamBooqkT7l+E05dEzWJ5Lq6L3CHrG+qwIsGW+eUZzHNEmjz/fz6N +lSyvj9NtwBnUpL7NUgQ+o6k/pm6ou9vaJewyRlAG7PPgaiBb5XK3Wb2dVC6/9WzbhDtArqA k+C97G241lS1B8JxLLJGDcYUw== IronPort-HdrOrdr: A9a23:oCqK1qB25taa2f/lHemu55DYdb4zR+YMi2TC1yhKJyC9E/bo7v xG88566faZslossTQb6LW90cq7MBXhHPxOkOos1N6ZNWGM0gaVxcNZnO/fKlXbakrDH4VmtJ uIHZIQNDSJNykZsfrH X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554366" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 22/70] xen/hypfs: CFI hardening Date: Mon, 14 Feb 2022 12:50:39 +0000 Message-ID: <20220214125127.17985-23-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Juergen Gross --- xen/common/hypfs.c | 57 +++++++++++++++++++++++----------------------- xen/common/sched/cpupool.c | 25 ++++++++++---------- xen/include/xen/hypfs.h | 49 +++++++++++++++++++-------------------- 3 files changed, 65 insertions(+), 66 deletions(-) diff --git a/xen/common/hypfs.c b/xen/common/hypfs.c index 1526bcc52810..0d22396f5dd7 100644 --- a/xen/common/hypfs.c +++ b/xen/common/hypfs.c @@ -113,12 +113,13 @@ static void hypfs_unlock(void) } } -const struct hypfs_entry *hypfs_node_enter(const struct hypfs_entry *entry) +const struct hypfs_entry *cf_check hypfs_node_enter( + const struct hypfs_entry *entry) { return entry; } -void hypfs_node_exit(const struct hypfs_entry *entry) +void cf_check hypfs_node_exit(const struct hypfs_entry *entry) { } @@ -289,16 +290,14 @@ static int hypfs_get_path_user(char *buf, return 0; } -struct hypfs_entry *hypfs_leaf_findentry(const struct hypfs_entry_dir *dir, - const char *name, - unsigned int name_len) +struct hypfs_entry *cf_check hypfs_leaf_findentry( + const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len) { return ERR_PTR(-ENOTDIR); } -struct hypfs_entry *hypfs_dir_findentry(const struct hypfs_entry_dir *dir, - const char *name, - unsigned int name_len) +struct hypfs_entry *cf_check hypfs_dir_findentry( + const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len) { struct hypfs_entry *entry; @@ -360,7 +359,7 @@ static struct hypfs_entry *hypfs_get_entry(const char *path) return hypfs_get_entry_rel(&hypfs_root, path + 1); } -unsigned int hypfs_getsize(const struct hypfs_entry *entry) +unsigned int cf_check hypfs_getsize(const struct hypfs_entry *entry) { return entry->size; } @@ -396,7 +395,7 @@ int hypfs_read_dyndir_id_entry(const struct hypfs_entry_dir *template, return 0; } -static const struct hypfs_entry *hypfs_dyndir_enter( +static const struct hypfs_entry *cf_check hypfs_dyndir_enter( const struct hypfs_entry *entry) { const struct hypfs_dyndir_id *data; @@ -407,7 +406,7 @@ static const struct hypfs_entry *hypfs_dyndir_enter( return data->template->e.funcs->enter(&data->template->e); } -static struct hypfs_entry *hypfs_dyndir_findentry( +static struct hypfs_entry *cf_check hypfs_dyndir_findentry( const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len) { const struct hypfs_dyndir_id *data; @@ -418,8 +417,8 @@ static struct hypfs_entry *hypfs_dyndir_findentry( return data->template->e.funcs->findentry(data->template, name, name_len); } -static int hypfs_read_dyndir(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr) +static int cf_check hypfs_read_dyndir( + const struct hypfs_entry *entry, XEN_GUEST_HANDLE_PARAM(void) uaddr) { const struct hypfs_dyndir_id *data; @@ -463,8 +462,8 @@ unsigned int hypfs_dynid_entry_size(const struct hypfs_entry *template, return DIRENTRY_SIZE(snprintf(NULL, 0, template->name, id)); } -int hypfs_read_dir(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr) +int cf_check hypfs_read_dir(const struct hypfs_entry *entry, + XEN_GUEST_HANDLE_PARAM(void) uaddr) { const struct hypfs_entry_dir *d; const struct hypfs_entry *e; @@ -510,8 +509,8 @@ int hypfs_read_dir(const struct hypfs_entry *entry, return 0; } -int hypfs_read_leaf(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr) +int cf_check hypfs_read_leaf( + const struct hypfs_entry *entry, XEN_GUEST_HANDLE_PARAM(void) uaddr) { const struct hypfs_entry_leaf *l; unsigned int size = entry->funcs->getsize(entry); @@ -555,9 +554,9 @@ static int hypfs_read(const struct hypfs_entry *entry, return ret; } -int hypfs_write_leaf(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen) +int cf_check hypfs_write_leaf( + struct hypfs_entry_leaf *leaf, XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen) { char *buf; int ret; @@ -596,9 +595,9 @@ int hypfs_write_leaf(struct hypfs_entry_leaf *leaf, return ret; } -int hypfs_write_bool(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen) +int cf_check hypfs_write_bool( + struct hypfs_entry_leaf *leaf, XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen) { bool buf; @@ -618,9 +617,9 @@ int hypfs_write_bool(struct hypfs_entry_leaf *leaf, return 0; } -int hypfs_write_custom(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen) +int cf_check hypfs_write_custom( + struct hypfs_entry_leaf *leaf, XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen) { struct param_hypfs *p; char *buf; @@ -653,9 +652,9 @@ int hypfs_write_custom(struct hypfs_entry_leaf *leaf, return ret; } -int hypfs_write_deny(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen) +int cf_check hypfs_write_deny( + struct hypfs_entry_leaf *leaf, XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen) { return -EACCES; } diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index b9d4babd0d8a..07f984a659cd 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -1026,8 +1026,8 @@ static struct notifier_block cpu_nfb = { static HYPFS_DIR_INIT(cpupool_pooldir, "%u"); -static int cpupool_dir_read(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr) +static int cf_check cpupool_dir_read( + const struct hypfs_entry *entry, XEN_GUEST_HANDLE_PARAM(void) uaddr) { int ret = 0; struct cpupool *c; @@ -1050,7 +1050,8 @@ static int cpupool_dir_read(const struct hypfs_entry *entry, return ret; } -static unsigned int cpupool_dir_getsize(const struct hypfs_entry *entry) +static unsigned int cf_check cpupool_dir_getsize( + const struct hypfs_entry *entry) { const struct cpupool *c; unsigned int size = 0; @@ -1061,7 +1062,7 @@ static unsigned int cpupool_dir_getsize(const struct hypfs_entry *entry) return size; } -static const struct hypfs_entry *cpupool_dir_enter( +static const struct hypfs_entry *cf_check cpupool_dir_enter( const struct hypfs_entry *entry) { struct hypfs_dyndir_id *data; @@ -1076,14 +1077,14 @@ static const struct hypfs_entry *cpupool_dir_enter( return entry; } -static void cpupool_dir_exit(const struct hypfs_entry *entry) +static void cf_check cpupool_dir_exit(const struct hypfs_entry *entry) { spin_unlock(&cpupool_lock); hypfs_free_dyndata(); } -static struct hypfs_entry *cpupool_dir_findentry( +static struct hypfs_entry *cf_check cpupool_dir_findentry( const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len) { unsigned long id; @@ -1102,8 +1103,8 @@ static struct hypfs_entry *cpupool_dir_findentry( return hypfs_gen_dyndir_id_entry(&cpupool_pooldir, id, cpupool); } -static int cpupool_gran_read(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr) +static int cf_check cpupool_gran_read( + const struct hypfs_entry *entry, XEN_GUEST_HANDLE_PARAM(void) uaddr) { const struct hypfs_dyndir_id *data; const struct cpupool *cpupool; @@ -1121,7 +1122,7 @@ static int cpupool_gran_read(const struct hypfs_entry *entry, return copy_to_guest(uaddr, gran, strlen(gran) + 1) ? -EFAULT : 0; } -static unsigned int hypfs_gran_getsize(const struct hypfs_entry *entry) +static unsigned int cf_check hypfs_gran_getsize(const struct hypfs_entry *entry) { const struct hypfs_dyndir_id *data; const struct cpupool *cpupool; @@ -1136,9 +1137,9 @@ static unsigned int hypfs_gran_getsize(const struct hypfs_entry *entry) return strlen(gran) + 1; } -static int cpupool_gran_write(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen) +static int cf_check cpupool_gran_write( + struct hypfs_entry_leaf *leaf, XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen) { const struct hypfs_dyndir_id *data; struct cpupool *cpupool; diff --git a/xen/include/xen/hypfs.h b/xen/include/xen/hypfs.h index e9d4c2555bd7..1b65a9188c6c 100644 --- a/xen/include/xen/hypfs.h +++ b/xen/include/xen/hypfs.h @@ -168,31 +168,30 @@ void hypfs_add_dyndir(struct hypfs_entry_dir *parent, struct hypfs_entry_dir *template); int hypfs_add_leaf(struct hypfs_entry_dir *parent, struct hypfs_entry_leaf *leaf, bool nofault); -const struct hypfs_entry *hypfs_node_enter(const struct hypfs_entry *entry); -void hypfs_node_exit(const struct hypfs_entry *entry); -int hypfs_read_dir(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr); -int hypfs_read_leaf(const struct hypfs_entry *entry, - XEN_GUEST_HANDLE_PARAM(void) uaddr); -int hypfs_write_deny(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen); -int hypfs_write_leaf(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen); -int hypfs_write_bool(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen); -int hypfs_write_custom(struct hypfs_entry_leaf *leaf, - XEN_GUEST_HANDLE_PARAM(const_void) uaddr, - unsigned int ulen); -unsigned int hypfs_getsize(const struct hypfs_entry *entry); -struct hypfs_entry *hypfs_leaf_findentry(const struct hypfs_entry_dir *dir, - const char *name, - unsigned int name_len); -struct hypfs_entry *hypfs_dir_findentry(const struct hypfs_entry_dir *dir, - const char *name, - unsigned int name_len); +const struct hypfs_entry *cf_check hypfs_node_enter( + const struct hypfs_entry *entry); +void cf_check hypfs_node_exit(const struct hypfs_entry *entry); +int cf_check hypfs_read_dir(const struct hypfs_entry *entry, + XEN_GUEST_HANDLE_PARAM(void) uaddr); +int cf_check hypfs_read_leaf(const struct hypfs_entry *entry, + XEN_GUEST_HANDLE_PARAM(void) uaddr); +int cf_check hypfs_write_deny(struct hypfs_entry_leaf *leaf, + XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen); +int cf_check hypfs_write_leaf(struct hypfs_entry_leaf *leaf, + XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen); +int cf_check hypfs_write_bool(struct hypfs_entry_leaf *leaf, + XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen); +int cf_check hypfs_write_custom(struct hypfs_entry_leaf *leaf, + XEN_GUEST_HANDLE_PARAM(const_void) uaddr, + unsigned int ulen); +unsigned int cf_check hypfs_getsize(const struct hypfs_entry *entry); +struct hypfs_entry *cf_check hypfs_leaf_findentry( + const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len); +struct hypfs_entry *cf_check hypfs_dir_findentry( + const struct hypfs_entry_dir *dir, const char *name, unsigned int name_len); void *hypfs_alloc_dyndata(unsigned long size); #define hypfs_alloc_dyndata(type) ((type *)hypfs_alloc_dyndata(sizeof(type))) void *hypfs_get_dyndata(void); From patchwork Mon Feb 14 12:50:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745563 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A4CCEC4321E for ; Mon, 14 Feb 2022 13:06:27 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271713.466368 (Exim 4.92) (envelope-from ) id 1nJb3a-0008Id-R6; Mon, 14 Feb 2022 13:06:18 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271713.466368; Mon, 14 Feb 2022 13:06:18 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3a-0008Fe-6K; Mon, 14 Feb 2022 13:06:18 +0000 Received: by outflank-mailman (input) for mailman id 271713; Mon, 14 Feb 2022 13:06:16 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb35-0008IH-46 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:47 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d214b42f-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:45 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d214b42f-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843945; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=cecI+FT44l503L9yO+BFfcS5GuY0TLog87wC0Mx5p8E=; b=O38jx71Zul2bjj1rBV6saBgq7h73AZZqdOR4WfXA2ZBD7BWZcSj28j50 HY5vlczv7P53mFkiPtqaI05RehnRDj7s7zsMWDYjEfRUpcEkfcU3+T/ri 0clt9S+IV04H07oaRtbP+hY/QOpIsCBbZChJeNYrAQFOP2an3YbEWbwMY I=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: vuaVnpiE5/1VbUEBdoc2AlO5mmSNnFUgbdKKI2IOLHaiq6jyqa/Mn4FpVnPXXszc6kH9GYqlLb gSeLTktCqP+0rfKjCvIzUqyVBuyHAGv3L9JoiXgBqO6qGW593IugZwb1CQFWlU2i+aXgYJT1Tx sacDZZIirfHeeHsrykrZeLrMjslr+KaSTbggrjTaQjIXR3lvC12B8zTdi9IafYSebzEw9HY82a KoqP81SzWAFN04S/uePItXnqyPqjy4I/RxyJIpAhdRZCcCb9XkYFMIDVWMsV+QIQY53gqu+PUL Z49Y/4s4hJnOJR2Ytmcvbo7c X-SBRS: 5.1 X-MesageID: 63592652 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Z2RLJK2Z7uUo8pkPHvbD5c12kn2cJEfYwER7XKvMYLTBsI5bpzAAn WodCzvTb/bbZGrye9xzOtvi/UgEvZfcm9NhSgNrpC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhxcxX2 tJunpuLe1k1P/PFqOM/TgFiOnQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u3Z0fR6iDP aL1bxIzXBvZfkBiCG0NS6oDlcr5r2fWV21x/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWT++WfmEmdcNVkG RII+3Qnna8Q6VSRZ4yoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3l35unTuJHfgWDX2PiNKjWZJccp9dWHPmUwzzxPrsTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:PWc8jarwhvv7Qligx5fKpGkaV5opeYIsimQD101hICG8cqSj+f xG/c5rrCMc5wxwZJhNo7y90ey7MBbhHP1OkO8s1NWZLWrbUQKTRekIh+bfKn/baknDH4ZmpM BdmsNFaeEYY2IUsS+D2njbL+od X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592652" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 23/70] xen/tasklet: CFI hardening Date: Mon, 14 Feb 2022 12:50:40 +0000 Message-ID: <20220214125127.17985-24-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. The function pointer cast in hvm_vcpu_initialise() is undefined behaviour. While it happens to function correctly, it is not compatible with control flow typechecking, so introduce a new hvm_assert_evtchn_irq_tasklet() to handle the parameter type conversion in a legal way. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- v2: * Fix typo in commit message. * Drop changes to arm-only driver. --- xen/arch/x86/hvm/hvm.c | 7 ++++++- xen/arch/x86/hvm/vlapic.c | 2 +- xen/arch/x86/include/asm/shadow.h | 2 +- xen/arch/x86/mm/shadow/common.c | 2 +- xen/common/domain.c | 2 +- xen/common/keyhandler.c | 6 +++--- xen/common/livepatch.c | 2 +- xen/common/stop_machine.c | 2 +- xen/common/trace.c | 2 +- xen/drivers/char/console.c | 2 +- xen/drivers/passthrough/amd/iommu_guest.c | 2 +- xen/drivers/passthrough/amd/iommu_init.c | 4 ++-- xen/drivers/passthrough/vtd/iommu.c | 2 +- 13 files changed, 21 insertions(+), 16 deletions(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 0a193530680a..5ec10f30803e 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -1528,6 +1528,11 @@ static int __init cf_check hvm_register_CPU_save_and_restore(void) } __initcall(hvm_register_CPU_save_and_restore); +static void cf_check hvm_assert_evtchn_irq_tasklet(void *v) +{ + hvm_assert_evtchn_irq(v); +} + int hvm_vcpu_initialise(struct vcpu *v) { int rc; @@ -1552,7 +1557,7 @@ int hvm_vcpu_initialise(struct vcpu *v) goto fail3; softirq_tasklet_init(&v->arch.hvm.assert_evtchn_irq_tasklet, - (void (*)(void *))hvm_assert_evtchn_irq, v); + hvm_assert_evtchn_irq_tasklet, v); v->arch.hvm.inject_event.vector = HVM_EVENT_VECTOR_UNSET; diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c index b8c84458ffdc..fe375912bef1 100644 --- a/xen/arch/x86/hvm/vlapic.c +++ b/xen/arch/x86/hvm/vlapic.c @@ -312,7 +312,7 @@ static void vlapic_init_sipi_one(struct vcpu *target, uint32_t icr) vcpu_unpause(target); } -static void vlapic_init_sipi_action(void *data) +static void cf_check vlapic_init_sipi_action(void *data) { struct vcpu *origin = data; uint32_t icr = vcpu_vlapic(origin)->init_sipi.icr; diff --git a/xen/arch/x86/include/asm/shadow.h b/xen/arch/x86/include/asm/shadow.h index e25f9604d896..7ef76cc0635b 100644 --- a/xen/arch/x86/include/asm/shadow.h +++ b/xen/arch/x86/include/asm/shadow.h @@ -233,7 +233,7 @@ static inline bool pv_l1tf_check_l4e(struct domain *d, l4_pgentry_t l4e) return pv_l1tf_check_pte(d, 4, l4e.l4); } -void pv_l1tf_tasklet(void *data); +void cf_check pv_l1tf_tasklet(void *data); static inline void pv_l1tf_domain_init(struct domain *d) { diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index b8730a9441ce..fb370af90b5c 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -3242,7 +3242,7 @@ void shadow_audit_tables(struct vcpu *v) #ifdef CONFIG_PV -void pv_l1tf_tasklet(void *data) +void cf_check pv_l1tf_tasklet(void *data) { struct domain *d = data; diff --git a/xen/common/domain.c b/xen/common/domain.c index 32ec156e6f6a..a49c26064601 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -1824,7 +1824,7 @@ struct migrate_info { static DEFINE_PER_CPU(struct migrate_info *, continue_info); -static void continue_hypercall_tasklet_handler(void *data) +static void cf_check continue_hypercall_tasklet_handler(void *data) { struct migrate_info *info = data; struct vcpu *v = info->vcpu; diff --git a/xen/common/keyhandler.c b/xen/common/keyhandler.c index 2c916d528ab2..b568484ca62c 100644 --- a/xen/common/keyhandler.c +++ b/xen/common/keyhandler.c @@ -73,7 +73,7 @@ static struct keyhandler { #undef KEYHANDLER }; -static void keypress_action(void *unused) +static void cf_check keypress_action(void *unused) { handle_keypress(keypress_key, NULL); } @@ -206,7 +206,7 @@ static void dump_registers(unsigned char key, struct cpu_user_regs *regs) static DECLARE_TASKLET(dump_hwdom_tasklet, NULL, NULL); -static void dump_hwdom_action(void *data) +static void cf_check dump_hwdom_action(void *data) { struct vcpu *v = data; @@ -437,7 +437,7 @@ static void read_clocks(unsigned char key) maxdif_cycles, sumdif_cycles/count, count, dif_cycles); } -static void run_all_nonirq_keyhandlers(void *unused) +static void cf_check run_all_nonirq_keyhandlers(void *unused) { /* Fire all the non-IRQ-context diagnostic keyhandlers */ struct keyhandler *h; diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c index 701efd87a173..4e1c29ab7879 100644 --- a/xen/common/livepatch.c +++ b/xen/common/livepatch.c @@ -1591,7 +1591,7 @@ static int schedule_work(struct payload *data, uint32_t cmd, uint32_t timeout) return 0; } -static void tasklet_fn(void *unused) +static void cf_check tasklet_fn(void *unused) { this_cpu(work_to_do) = 1; } diff --git a/xen/common/stop_machine.c b/xen/common/stop_machine.c index a122bd4afe09..3adbe380de96 100644 --- a/xen/common/stop_machine.c +++ b/xen/common/stop_machine.c @@ -141,7 +141,7 @@ int stop_machine_run(int (*fn)(void *), void *data, unsigned int cpu) return ret; } -static void stopmachine_action(void *data) +static void cf_check stopmachine_action(void *data) { unsigned int cpu = (unsigned long)data; enum stopmachine_state state = STOPMACHINE_START; diff --git a/xen/common/trace.c b/xen/common/trace.c index b5358508f804..a7c092fcbbe9 100644 --- a/xen/common/trace.c +++ b/xen/common/trace.c @@ -663,7 +663,7 @@ static inline void insert_lost_records(struct t_buf *buf) * Notification is performed in qtasklet to avoid deadlocks with contexts * which __trace_var() may be called from (e.g., scheduler critical regions). */ -static void trace_notify_dom0(void *unused) +static void cf_check trace_notify_dom0(void *unused) { send_global_virq(VIRQ_TBUF); } diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 4694be83db45..d74b65f6bf23 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -574,7 +574,7 @@ static void serial_rx(char c, struct cpu_user_regs *regs) __serial_rx(c, regs); } -static void notify_dom0_con_ring(void *unused) +static void cf_check notify_dom0_con_ring(void *unused) { send_global_virq(VIRQ_CON_RING); } diff --git a/xen/drivers/passthrough/amd/iommu_guest.c b/xen/drivers/passthrough/amd/iommu_guest.c index 85828490ffee..361ff864d846 100644 --- a/xen/drivers/passthrough/amd/iommu_guest.c +++ b/xen/drivers/passthrough/amd/iommu_guest.c @@ -456,7 +456,7 @@ static int do_invalidate_dte(struct domain *d, cmd_entry_t *cmd) return 0; } -static void guest_iommu_process_command(void *data) +static void cf_check guest_iommu_process_command(void *data) { unsigned long opcode, tail, head, cmd_mfn; cmd_entry_t *cmd; diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index f1ed75558227..34a9e49f1c5a 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -26,7 +26,7 @@ static int __initdata nr_amd_iommus; static bool __initdata pci_init; -static void do_amd_iommu_irq(void *data); +static void cf_check do_amd_iommu_irq(void *data); static DECLARE_SOFTIRQ_TASKLET(amd_iommu_irq_tasklet, do_amd_iommu_irq, NULL); unsigned int __read_mostly amd_iommu_acpi_info; @@ -692,7 +692,7 @@ static void iommu_check_ppr_log(struct amd_iommu *iommu) spin_unlock_irqrestore(&iommu->lock, flags); } -static void do_amd_iommu_irq(void *unused) +static void cf_check do_amd_iommu_irq(void *unused) { struct amd_iommu *iommu; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 9e85016830bf..7a9c391bec70 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1097,7 +1097,7 @@ static void __do_iommu_page_fault(struct vtd_iommu *iommu) } } -static void do_iommu_page_fault(void *unused) +static void cf_check do_iommu_page_fault(void *unused) { struct acpi_drhd_unit *drhd; From patchwork Mon Feb 14 12:50:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745600 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 561D9C433EF for ; Mon, 14 Feb 2022 13:17:58 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272036.466814 (Exim 4.92) (envelope-from ) id 1nJbEg-00025A-TR; Mon, 14 Feb 2022 13:17:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272036.466814; Mon, 14 Feb 2022 13:17:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEg-00023X-NL; Mon, 14 Feb 2022 13:17:46 +0000 Received: by outflank-mailman (input) for mailman id 272036; Mon, 14 Feb 2022 13:17:46 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4c-0008IH-OG for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:23 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0a73c9dc-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:20 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0a73c9dc-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844040; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=LivTElKoKg6RGtpxx8XvSouEzTvppj+Csy+3sm8lMAU=; b=GquhXjR1NX390snx6hztGFyZvFKodtIme1F2Rk+2nGjMzkBJTIJVFanJ YRMRySx57C1+0Pj0EkkD8+AR1PluHOqnjG41OTdkfjuCykyz+xrh6If10 RUc24kwCjBcUFpORYE0j5UdxJCpaX6uJ1k1I87pNULhX9c6qJlj4XtNuo A=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: AjsViK0O9s9wW1s3wOF5KfVi+35Mzoq5/gn4EZEajFTvwqvP8sjoFNRl8dnspl2VDvsYMdRlmk N0ajlrs1l3+cUO4VYIzoGAKsYwYOV/dCIKsE6YdxVY4jqNccRViR/SXpDFOfwynFmX0IrVR89R ws3awO7tNSBFIEcqMo0TwHRG2d0jH4NmorV4P1vt7008RQBHt9lJGcAmMz5cZxSu4YJyZYfLyG AK+wiVyVO61VAWJ1lQH5F4KABCvvVI4Pz1Olj/fc1X/MCqKv9JcueoYuo+xHtXi+TPR93UIw9M 3jy5yXrYVq6RbwnRM3htyvqH X-SBRS: 5.1 X-MesageID: 64554420 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:tniWyK/0TxnBGW6WYVleDrUDmHmTJUtcMsCJ2f8bNWPcYEJGY0x3z WoaXGjQbvaCZmanKY92a4+080wDup7Tz9BjHFFv+X88E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPh11 v9UjYO0EjwgZJaXqr8gChhEKX5xaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SQKuCO 5BBAdZpRCyeUQRFamsSMYs/jPj4jHCuLyxWtnvA8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9G9lGSnY81bc HcdoBF1n/MPrU23dIbyCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+VmEm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:2PPMJK7gdMtNMyj7nwPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554420" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 24/70] xen/keyhandler: CFI hardening Date: Mon, 14 Feb 2022 12:50:41 +0000 Message-ID: <20220214125127.17985-25-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Tweak {IRQ_,}KEYHANDLER() to use a named initialiser instead of requiring a pointer cast to compile in the IRQ case. Reposition iommu_dump_page_tables() to avoid a forward declaration. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 2 +- xen/arch/x86/hvm/irq.c | 2 +- xen/arch/x86/hvm/svm/vmcb.c | 2 +- xen/arch/x86/hvm/vmx/vmcs.c | 2 +- xen/arch/x86/io_apic.c | 2 +- xen/arch/x86/irq.c | 2 +- xen/arch/x86/mm/p2m-ept.c | 2 +- xen/arch/x86/mm/shadow/common.c | 4 +-- xen/arch/x86/msi.c | 2 +- xen/arch/x86/nmi.c | 4 +-- xen/arch/x86/numa.c | 2 +- xen/arch/x86/time.c | 2 +- xen/common/debugtrace.c | 2 +- xen/common/event_channel.c | 2 +- xen/common/grant_table.c | 2 +- xen/common/kexec.c | 2 +- xen/common/keyhandler.c | 35 ++++++++++++--------- xen/common/livepatch.c | 2 +- xen/common/page_alloc.c | 4 +-- xen/common/perfc.c | 4 +-- xen/common/sched/cpupool.c | 2 +- xen/common/spinlock.c | 4 +-- xen/common/timer.c | 2 +- xen/drivers/char/console.c | 8 ++--- xen/drivers/passthrough/amd/iommu.h | 2 +- xen/drivers/passthrough/amd/iommu_intr.c | 2 +- xen/drivers/passthrough/iommu.c | 52 +++++++++++++++----------------- xen/drivers/passthrough/pci.c | 2 +- xen/drivers/passthrough/vtd/extern.h | 2 +- xen/drivers/passthrough/vtd/utils.c | 2 +- xen/include/xen/perfc.h | 4 +-- xen/include/xen/sched.h | 2 +- xen/include/xen/spinlock.h | 4 +-- 33 files changed, 86 insertions(+), 83 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index 22c8bb0c2d94..0142671bb836 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -377,7 +377,7 @@ static void print_acpi_power(uint32_t cpu, struct acpi_processor_power *power) print_hw_residencies(cpu); } -static void dump_cx(unsigned char key) +static void cf_check dump_cx(unsigned char key) { unsigned int cpu; diff --git a/xen/arch/x86/hvm/irq.c b/xen/arch/x86/hvm/irq.c index 6045c9149bad..a7f8991a7b84 100644 --- a/xen/arch/x86/hvm/irq.c +++ b/xen/arch/x86/hvm/irq.c @@ -635,7 +635,7 @@ static void irq_dump(struct domain *d) hvm_irq->callback_via_asserted ? "" : " not"); } -static void dump_irq_info(unsigned char key) +static void cf_check dump_irq_info(unsigned char key) { struct domain *d; diff --git a/xen/arch/x86/hvm/svm/vmcb.c b/xen/arch/x86/hvm/svm/vmcb.c index efa085032bb5..958309657799 100644 --- a/xen/arch/x86/hvm/svm/vmcb.c +++ b/xen/arch/x86/hvm/svm/vmcb.c @@ -226,7 +226,7 @@ void svm_destroy_vmcb(struct vcpu *v) svm->vmcb = NULL; } -static void vmcb_dump(unsigned char ch) +static void cf_check vmcb_dump(unsigned char ch) { struct domain *d; struct vcpu *v; diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index 2b6bafe9d542..d2cafd8ca1c5 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -2117,7 +2117,7 @@ void vmcs_dump_vcpu(struct vcpu *v) vmx_vmcs_exit(v); } -static void vmcs_dump(unsigned char ch) +static void cf_check vmcs_dump(unsigned char ch) { struct domain *d; struct vcpu *v; diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c index 4135a9c06052..4c5eaef86273 100644 --- a/xen/arch/x86/io_apic.c +++ b/xen/arch/x86/io_apic.c @@ -1268,7 +1268,7 @@ static void __init print_IO_APIC(void) __print_IO_APIC(1); } -static void _print_IO_APIC_keyhandler(unsigned char key) +static void cf_check _print_IO_APIC_keyhandler(unsigned char key) { __print_IO_APIC(0); } diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index d9bd355113d7..f43b926ed26b 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -2424,7 +2424,7 @@ void free_domain_pirqs(struct domain *d) pcidevs_unlock(); } -static void dump_irqs(unsigned char key) +static void cf_check dump_irqs(unsigned char key) { int i, irq, pirq; struct irq_desc *desc; diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c index b7ee441d4573..a8a6ad629528 100644 --- a/xen/arch/x86/mm/p2m-ept.c +++ b/xen/arch/x86/mm/p2m-ept.c @@ -1433,7 +1433,7 @@ static const char *memory_type_to_str(unsigned int x) return memory_types[x][0] ? memory_types[x] : "?"; } -static void ept_dump_p2m_table(unsigned char key) +static void cf_check ept_dump_p2m_table(unsigned char key) { struct domain *d; ept_entry_t *table, *ept_entry; diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index fb370af90b5c..83dedc8870aa 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -98,7 +98,7 @@ void shadow_vcpu_init(struct vcpu *v) #if SHADOW_AUDIT int shadow_audit_enable = 0; -static void shadow_audit_key(unsigned char key) +static void cf_check shadow_audit_key(unsigned char key) { shadow_audit_enable = !shadow_audit_enable; printk("%s shadow_audit_enable=%d\n", @@ -1046,7 +1046,7 @@ void shadow_blow_tables_per_domain(struct domain *d) /* Blow all shadows of all shadowed domains: this can be used to cause the * guest's pagetables to be re-shadowed if we suspect that the shadows * have somehow got out of sync */ -static void shadow_blow_all_tables(unsigned char c) +static void cf_check shadow_blow_all_tables(unsigned char c) { struct domain *d; printk("'%c' pressed -> blowing all shadow tables\n", c); diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c index d1497254b188..77a4fbf13f9f 100644 --- a/xen/arch/x86/msi.c +++ b/xen/arch/x86/msi.c @@ -1411,7 +1411,7 @@ void __init early_msi_init(void) return; } -static void dump_msi(unsigned char key) +static void cf_check dump_msi(unsigned char key) { unsigned int irq; diff --git a/xen/arch/x86/nmi.c b/xen/arch/x86/nmi.c index e20d1393c881..5c26e8785dfc 100644 --- a/xen/arch/x86/nmi.c +++ b/xen/arch/x86/nmi.c @@ -578,13 +578,13 @@ void self_nmi(void) local_irq_restore(flags); } -static void do_nmi_trigger(unsigned char key) +static void cf_check do_nmi_trigger(unsigned char key) { printk("Triggering NMI on APIC ID %x\n", get_apic_id()); self_nmi(); } -static void do_nmi_stats(unsigned char key) +static void cf_check do_nmi_stats(unsigned char key) { const struct vcpu *v; unsigned int cpu; diff --git a/xen/arch/x86/numa.c b/xen/arch/x86/numa.c index 5de9db4e9943..680b7d9002c5 100644 --- a/xen/arch/x86/numa.c +++ b/xen/arch/x86/numa.c @@ -369,7 +369,7 @@ unsigned int __init arch_get_dma_bitsize(void) + PAGE_SHIFT, 32); } -static void dump_numa(unsigned char key) +static void cf_check dump_numa(unsigned char key) { s_time_t now = NOW(); unsigned int i, j, n; diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 5a72b66800e4..3d767d70f61f 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -2541,7 +2541,7 @@ int tsc_set_info(struct domain *d, } /* vtsc may incur measurable performance degradation, diagnose with this */ -static void dump_softtsc(unsigned char key) +static void cf_check dump_softtsc(unsigned char key) { struct domain *d; int domcnt = 0; diff --git a/xen/common/debugtrace.c b/xen/common/debugtrace.c index 160d00b79607..a272e5e43761 100644 --- a/xen/common/debugtrace.c +++ b/xen/common/debugtrace.c @@ -233,7 +233,7 @@ void debugtrace_printk(const char *fmt, ...) spin_unlock_irqrestore(&debugtrace_lock, flags); } -static void debugtrace_key(unsigned char key) +static void cf_check debugtrace_key(unsigned char key) { debugtrace_toggle(); } diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c index 183e78ac17f1..ffb042a241a6 100644 --- a/xen/common/event_channel.c +++ b/xen/common/event_channel.c @@ -1629,7 +1629,7 @@ static void domain_dump_evtchn_info(struct domain *d) spin_unlock(&d->event_lock); } -static void dump_evtchn_info(unsigned char key) +static void cf_check dump_evtchn_info(unsigned char key) { struct domain *d; diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 1078e3e16cda..1e0762b064d7 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -4275,7 +4275,7 @@ static void gnttab_usage_print(struct domain *rd) printk("no active grant table entries\n"); } -static void gnttab_usage_print_all(unsigned char key) +static void cf_check gnttab_usage_print_all(unsigned char key) { struct domain *d; diff --git a/xen/common/kexec.c b/xen/common/kexec.c index b222a5fd782e..a2ffb6530cff 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -408,7 +408,7 @@ static long cf_check kexec_reboot(void *_image) return 0; } -static void do_crashdump_trigger(unsigned char key) +static void cf_check do_crashdump_trigger(unsigned char key) { printk("'%c' pressed -> triggering crashdump\n", key); kexec_crash(CRASHREASON_DEBUGKEY); diff --git a/xen/common/keyhandler.c b/xen/common/keyhandler.c index b568484ca62c..5dc650a37c5c 100644 --- a/xen/common/keyhandler.c +++ b/xen/common/keyhandler.c @@ -26,10 +26,11 @@ static unsigned char keypress_key; static bool_t alt_key_handling; -static keyhandler_fn_t show_handlers, dump_hwdom_registers, - dump_domains, read_clocks; -static irq_keyhandler_fn_t do_toggle_alt_key, dump_registers, - reboot_machine, run_all_keyhandlers, do_debug_key; +static keyhandler_fn_t cf_check show_handlers, cf_check dump_hwdom_registers, + cf_check dump_domains, cf_check read_clocks; +static irq_keyhandler_fn_t cf_check do_toggle_alt_key, cf_check dump_registers, + cf_check reboot_machine, cf_check run_all_keyhandlers, + cf_check do_debug_key; static struct keyhandler { union { @@ -43,10 +44,10 @@ static struct keyhandler { } key_table[128] __read_mostly = { #define KEYHANDLER(k, f, desc, diag) \ - [k] = { { (f) }, desc, 0, diag } + [k] = { { .fn = (f) }, desc, 0, diag } #define IRQ_KEYHANDLER(k, f, desc, diag) \ - [k] = { { (keyhandler_fn_t *)(f) }, desc, 1, diag } + [k] = { { .irq_fn = (f) }, desc, 1, diag } IRQ_KEYHANDLER('A', do_toggle_alt_key, "toggle alternative key handling", 0), IRQ_KEYHANDLER('d', dump_registers, "dump registers", 1), @@ -124,7 +125,7 @@ void register_irq_keyhandler(unsigned char key, irq_keyhandler_fn_t fn, key_table[key].diagnostic = diagnostic; } -static void show_handlers(unsigned char key) +static void cf_check show_handlers(unsigned char key) { unsigned int i; @@ -170,7 +171,8 @@ void dump_execstate(struct cpu_user_regs *regs) watchdog_enable(); } -static void dump_registers(unsigned char key, struct cpu_user_regs *regs) +static void cf_check dump_registers( + unsigned char key, struct cpu_user_regs *regs) { unsigned int cpu; @@ -224,7 +226,7 @@ static void cf_check dump_hwdom_action(void *data) } } -static void dump_hwdom_registers(unsigned char key) +static void cf_check dump_hwdom_registers(unsigned char key) { struct vcpu *v; @@ -246,13 +248,14 @@ static void dump_hwdom_registers(unsigned char key) } } -static void reboot_machine(unsigned char key, struct cpu_user_regs *regs) +static void cf_check reboot_machine( + unsigned char key, struct cpu_user_regs *regs) { printk("'%c' pressed -> rebooting machine\n", key); machine_restart(0); } -static void dump_domains(unsigned char key) +static void cf_check dump_domains(unsigned char key) { struct domain *d; const struct sched_unit *unit; @@ -372,7 +375,7 @@ static void cf_check read_clocks_slave(void *unused) local_irq_enable(); } -static void read_clocks(unsigned char key) +static void cf_check read_clocks(unsigned char key) { unsigned int cpu = smp_processor_id(), min_stime_cpu, max_stime_cpu; unsigned int min_cycles_cpu, max_cycles_cpu; @@ -461,7 +464,8 @@ static void cf_check run_all_nonirq_keyhandlers(void *unused) static DECLARE_TASKLET(run_all_keyhandlers_tasklet, run_all_nonirq_keyhandlers, NULL); -static void run_all_keyhandlers(unsigned char key, struct cpu_user_regs *regs) +static void cf_check run_all_keyhandlers( + unsigned char key, struct cpu_user_regs *regs) { struct keyhandler *h; unsigned int k; @@ -494,7 +498,7 @@ static void do_debugger_trap_fatal(struct cpu_user_regs *regs) barrier(); } -static void do_debug_key(unsigned char key, struct cpu_user_regs *regs) +static void cf_check do_debug_key(unsigned char key, struct cpu_user_regs *regs) { printk("'%c' pressed -> trapping into debugger\n", key); if ( regs ) @@ -503,7 +507,8 @@ static void do_debug_key(unsigned char key, struct cpu_user_regs *regs) run_in_exception_handler(do_debugger_trap_fatal); } -static void do_toggle_alt_key(unsigned char key, struct cpu_user_regs *regs) +static void cf_check do_toggle_alt_key( + unsigned char key, struct cpu_user_regs *regs) { alt_key_handling = !alt_key_handling; printk("'%c' pressed -> using %s key handling\n", key, diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c index 4e1c29ab7879..e8714920dc8f 100644 --- a/xen/common/livepatch.c +++ b/xen/common/livepatch.c @@ -2068,7 +2068,7 @@ static const char *state2str(unsigned int state) return names[state]; } -static void livepatch_printall(unsigned char key) +static void cf_check livepatch_printall(unsigned char key) { struct payload *data; const void *binary_id = NULL; diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 827617502e35..3caf5c954b24 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -2522,7 +2522,7 @@ unsigned long avail_node_heap_pages(unsigned int nodeid) } -static void pagealloc_info(unsigned char key) +static void cf_check pagealloc_info(unsigned char key) { unsigned int zone = MEMZONE_XEN; unsigned long n, total = 0; @@ -2572,7 +2572,7 @@ void scrub_one_page(struct page_info *pg) #endif } -static void dump_heap(unsigned char key) +static void cf_check dump_heap(unsigned char key) { s_time_t now = NOW(); int i, j; diff --git a/xen/common/perfc.c b/xen/common/perfc.c index 3abe35892a83..7400667bf0c4 100644 --- a/xen/common/perfc.c +++ b/xen/common/perfc.c @@ -28,7 +28,7 @@ static const struct { DEFINE_PER_CPU(perfc_t[NUM_PERFCOUNTERS], perfcounters); -void perfc_printall(unsigned char key) +void cf_check perfc_printall(unsigned char key) { unsigned int i, j; s_time_t now = NOW(); @@ -115,7 +115,7 @@ void perfc_printall(unsigned char key) } } -void perfc_reset(unsigned char key) +void cf_check perfc_reset(unsigned char key) { unsigned int i, j; s_time_t now = NOW(); diff --git a/xen/common/sched/cpupool.c b/xen/common/sched/cpupool.c index 07f984a659cd..a6da4970506a 100644 --- a/xen/common/sched/cpupool.c +++ b/xen/common/sched/cpupool.c @@ -956,7 +956,7 @@ const cpumask_t *cpupool_valid_cpus(const struct cpupool *pool) return pool->cpu_valid; } -void dump_runq(unsigned char key) +void cf_check dump_runq(unsigned char key) { s_time_t now = NOW(); struct cpupool *c; diff --git a/xen/common/spinlock.c b/xen/common/spinlock.c index 5ce7e3363863..25bfbf3c47f7 100644 --- a/xen/common/spinlock.c +++ b/xen/common/spinlock.c @@ -393,7 +393,7 @@ static void spinlock_profile_print_elem(struct lock_profile *data, data->lock_cnt, data->time_hold, data->block_cnt, data->time_block); } -void spinlock_profile_printall(unsigned char key) +void cf_check spinlock_profile_printall(unsigned char key) { s_time_t now = NOW(); s_time_t diff; @@ -413,7 +413,7 @@ static void spinlock_profile_reset_elem(struct lock_profile *data, data->time_block = 0; } -void spinlock_profile_reset(unsigned char key) +void cf_check spinlock_profile_reset(unsigned char key) { s_time_t now = NOW(); diff --git a/xen/common/timer.c b/xen/common/timer.c index 700f191a70b4..9b5016d5ed82 100644 --- a/xen/common/timer.c +++ b/xen/common/timer.c @@ -546,7 +546,7 @@ static void dump_timer(struct timer *t, s_time_t now) (t->expires - now) / 1000, t, t->function, t->data); } -static void dump_timerq(unsigned char key) +static void cf_check dump_timerq(unsigned char key) { struct timer *t; struct timers *ts; diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index d74b65f6bf23..380765ab02fd 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -280,7 +280,7 @@ static int *__read_mostly upper_thresh_adj = &xenlog_upper_thresh; static int *__read_mostly lower_thresh_adj = &xenlog_lower_thresh; static const char *__read_mostly thresh_adj = "standard"; -static void do_toggle_guest(unsigned char key, struct cpu_user_regs *regs) +static void cf_check do_toggle_guest(unsigned char key, struct cpu_user_regs *regs) { if ( upper_thresh_adj == &xenlog_upper_thresh ) { @@ -307,13 +307,13 @@ static void do_adj_thresh(unsigned char key) loglvl_str(*upper_thresh_adj)); } -static void do_inc_thresh(unsigned char key, struct cpu_user_regs *regs) +static void cf_check do_inc_thresh(unsigned char key, struct cpu_user_regs *regs) { ++*lower_thresh_adj; do_adj_thresh(key); } -static void do_dec_thresh(unsigned char key, struct cpu_user_regs *regs) +static void cf_check do_dec_thresh(unsigned char key, struct cpu_user_regs *regs) { if ( *lower_thresh_adj ) --*lower_thresh_adj; @@ -424,7 +424,7 @@ void console_serial_puts(const char *s, size_t nr) pv_console_puts(s, nr); } -static void dump_console_ring_key(unsigned char key) +static void cf_check dump_console_ring_key(unsigned char key) { uint32_t idx, len, sofar, c; unsigned int order; diff --git a/xen/drivers/passthrough/amd/iommu.h b/xen/drivers/passthrough/amd/iommu.h index 04517c1a024c..99be9aafcc53 100644 --- a/xen/drivers/passthrough/amd/iommu.h +++ b/xen/drivers/passthrough/amd/iommu.h @@ -297,7 +297,7 @@ unsigned int amd_iommu_read_ioapic_from_ire( int amd_iommu_msi_msg_update_ire( struct msi_desc *msi_desc, struct msi_msg *msg); int amd_setup_hpet_msi(struct msi_desc *msi_desc); -void amd_iommu_dump_intremap_tables(unsigned char key); +void cf_check amd_iommu_dump_intremap_tables(unsigned char key); extern struct ioapic_sbdf { u16 bdf, seg; diff --git a/xen/drivers/passthrough/amd/iommu_intr.c b/xen/drivers/passthrough/amd/iommu_intr.c index b166a0466654..e7804413c7f4 100644 --- a/xen/drivers/passthrough/amd/iommu_intr.c +++ b/xen/drivers/passthrough/amd/iommu_intr.c @@ -844,7 +844,7 @@ static int dump_intremap_mapping(const struct amd_iommu *iommu, return 0; } -void amd_iommu_dump_intremap_tables(unsigned char key) +void cf_check amd_iommu_dump_intremap_tables(unsigned char key) { if ( !shared_intremap_table ) { diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c index 6ee267d2bfd4..e220fea72c2f 100644 --- a/xen/drivers/passthrough/iommu.c +++ b/xen/drivers/passthrough/iommu.c @@ -22,8 +22,6 @@ #include #include -static void iommu_dump_page_tables(unsigned char key); - unsigned int __read_mostly iommu_dev_iotlb_timeout = 1000; integer_param("iommu_dev_iotlb_timeout", iommu_dev_iotlb_timeout); @@ -224,6 +222,31 @@ int iommu_domain_init(struct domain *d, unsigned int opts) return 0; } +static void cf_check iommu_dump_page_tables(unsigned char key) +{ + struct domain *d; + + ASSERT(iommu_enabled); + + rcu_read_lock(&domlist_read_lock); + + for_each_domain(d) + { + if ( is_hardware_domain(d) || !is_iommu_enabled(d) ) + continue; + + if ( iommu_use_hap_pt(d) ) + { + printk("%pd sharing page tables\n", d); + continue; + } + + iommu_vcall(dom_iommu(d)->platform_ops, dump_page_tables, d); + } + + rcu_read_unlock(&domlist_read_lock); +} + void __hwdom_init iommu_hwdom_init(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); @@ -584,31 +607,6 @@ bool_t iommu_has_feature(struct domain *d, enum iommu_feature feature) return is_iommu_enabled(d) && test_bit(feature, dom_iommu(d)->features); } -static void iommu_dump_page_tables(unsigned char key) -{ - struct domain *d; - - ASSERT(iommu_enabled); - - rcu_read_lock(&domlist_read_lock); - - for_each_domain(d) - { - if ( is_hardware_domain(d) || !is_iommu_enabled(d) ) - continue; - - if ( iommu_use_hap_pt(d) ) - { - printk("%pd sharing page tables\n", d); - continue; - } - - iommu_vcall(dom_iommu(d)->platform_ops, dump_page_tables, d); - } - - rcu_read_unlock(&domlist_read_lock); -} - /* * Local variables: * mode: C diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index c170dd06ba51..79f49f0e6007 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1351,7 +1351,7 @@ static int _dump_pci_devices(struct pci_seg *pseg, void *arg) return 0; } -static void dump_pci_devices(unsigned char ch) +static void cf_check dump_pci_devices(unsigned char ch) { printk("==== PCI devices ====\n"); pcidevs_lock(); diff --git a/xen/drivers/passthrough/vtd/extern.h b/xen/drivers/passthrough/vtd/extern.h index f97883a780a2..4595b65e5bce 100644 --- a/xen/drivers/passthrough/vtd/extern.h +++ b/xen/drivers/passthrough/vtd/extern.h @@ -31,7 +31,7 @@ extern const struct iommu_init_ops intel_iommu_init_ops; void print_iommu_regs(struct acpi_drhd_unit *drhd); void print_vtd_entries(struct vtd_iommu *iommu, int bus, int devfn, u64 gmfn); -keyhandler_fn_t vtd_dump_iommu_info; +keyhandler_fn_t cf_check vtd_dump_iommu_info; bool intel_iommu_supports_eim(void); int intel_iommu_enable_eim(void); diff --git a/xen/drivers/passthrough/vtd/utils.c b/xen/drivers/passthrough/vtd/utils.c index 56dfdff9bd0d..47922dc8e813 100644 --- a/xen/drivers/passthrough/vtd/utils.c +++ b/xen/drivers/passthrough/vtd/utils.c @@ -154,7 +154,7 @@ void print_vtd_entries(struct vtd_iommu *iommu, int bus, int devfn, u64 gmfn) } while ( --level ); } -void vtd_dump_iommu_info(unsigned char key) +void cf_check vtd_dump_iommu_info(unsigned char key) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; diff --git a/xen/include/xen/perfc.h b/xen/include/xen/perfc.h index 6846e7119fa3..bb010b0aae93 100644 --- a/xen/include/xen/perfc.h +++ b/xen/include/xen/perfc.h @@ -96,8 +96,8 @@ DECLARE_PER_CPU(perfc_t[NUM_PERFCOUNTERS], perfcounters); struct xen_sysctl_perfc_op; int perfc_control(struct xen_sysctl_perfc_op *); -extern void perfc_printall(unsigned char key); -extern void perfc_reset(unsigned char key); +extern void cf_check perfc_printall(unsigned char key); +extern void cf_check perfc_reset(unsigned char key); #else /* CONFIG_PERF_COUNTERS */ diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h index 37f78cc4c4c9..67b0f6b86853 100644 --- a/xen/include/xen/sched.h +++ b/xen/include/xen/sched.h @@ -1145,7 +1145,7 @@ int cpupool_move_domain(struct domain *d, struct cpupool *c); int cpupool_do_sysctl(struct xen_sysctl_cpupool_op *op); unsigned int cpupool_get_id(const struct domain *d); const cpumask_t *cpupool_valid_cpus(const struct cpupool *pool); -extern void dump_runq(unsigned char key); +extern void cf_check dump_runq(unsigned char key); void arch_do_physinfo(struct xen_sysctl_physinfo *pi); diff --git a/xen/include/xen/spinlock.h b/xen/include/xen/spinlock.h index 9fa4e600c1f7..961891bea4d5 100644 --- a/xen/include/xen/spinlock.h +++ b/xen/include/xen/spinlock.h @@ -129,8 +129,8 @@ void _lock_profile_deregister_struct(int32_t, struct lock_profile_qhead *); _lock_profile_deregister_struct(type, &((ptr)->profile_head)) extern int spinlock_profile_control(struct xen_sysctl_lockprof_op *pc); -extern void spinlock_profile_printall(unsigned char key); -extern void spinlock_profile_reset(unsigned char key); +extern void cf_check spinlock_profile_printall(unsigned char key); +extern void cf_check spinlock_profile_reset(unsigned char key); #else From patchwork Mon Feb 14 12:50:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745587 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 582B1C433F5 for ; Mon, 14 Feb 2022 13:16:29 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271912.466654 (Exim 4.92) (envelope-from ) id 1nJbDH-0001ev-31; Mon, 14 Feb 2022 13:16:19 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271912.466654; Mon, 14 Feb 2022 13:16:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDG-0001em-WD; Mon, 14 Feb 2022 13:16:19 +0000 Received: by outflank-mailman (input) for mailman id 271912; Mon, 14 Feb 2022 13:16:17 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3U-00023t-II for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:12 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id e0413ad2-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:06:10 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e0413ad2-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843971; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=qZhvnjEBLt6HNiQInDJlsXjMWzuTPnZZsavbgdbb+Q8=; b=IGboPm52Xu/8RsyDY7+JM1YtWkKZ7aSLvl6CJwXdg/BzX8KLOu3BzgIP 5qzndOF6dxURgrPPJEkelNht5XQdIPWK03gkgYq+5p6THn+sf6z18OWFR 1PYx75PFpTgG95t5O33aW4zjv6Mo8C+X2eUzj+LDiTMaHEIh6vxcUApfG k=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: lyrDEo4OMsz6HcvoqhuRMiigziNljYEumekSe7hFU9ENYrAtYLSDI7IPzKXjU00SOpj327clsp xb0x1quFKSr6uFUphmruFhZZkYjpu1OdmSvDUF8j0xKkWRBUiqAOaGX+HcLqTbrFY44yeE8O7B k728GMPVi6dB4qJMjEN/8pIrgjTZcI3/ngRcIBJIIv1TwYHxJPl09pxoFgmRHBzoVOp01Gsoq4 KiSozyMQD9WsbM4GHx+sIIC2RrHyDAE/FjuNdJSZnhvLleQDY6z8EIcLRNmRe3wdFkN2Ok+SJ1 7EHa51g7zKu2QKwh717mcleh X-SBRS: 5.1 X-MesageID: 64149447 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:5q+K6qhQNSBfGjsO5QoImiKyX161fxcKZh0ujC45NGQN5FlHY01je htvXGmCOqyKNzSgf95/PYi+80JUv5LWzdUwSwpt+SlgE38b9cadCdqndUqhZCn6wu8v7a5EA 2fyTvGacajYm1eF/k/F3oAMKRCQ7InQLlbGILes1htZGEk0GE/NtTo5w7Rj2tQx3YDga++wk YiaT/P3aQfNNwFcagr424rbwP+4lK2v0N+wlgVWicFj5DcypVFMZH4sDfjZw0/DaptVBoaHq 9Prl9lVyI97EyAFUbtJmp6jGqEDryW70QKm0hK6UID66vROS7BbPg/W+5PwZG8O4whlkeydx /1dlYKZdD4AIJfVp8A8Cj15PxFyAr9JreqvzXiX6aR/zmXDenrohf5vEFs3LcsT/eMf7WNmr KJCbmpXN1ba2rzwkOnTpupE36zPKOHCOo8Ft24m5jbeFfs8GrjIQrnQ5M8e1zA17ixLNaiCP pZINWYwBPjGSxBLKEc4Go4CpcaTmGvBdyJYqnW5qaVitgA/yyQuieOwYbI5YOeiVchT20qVu G/C12D4GQ0BcsySzyKf9XChjfOJmjn0ML/+D5XhqKQs2gfKgDVOVltGDjNXvMVVlGaue8x2F nU95BA3kowTrWiKYunxYA+39SvsUgEnZ/JcFOgz6Qeow6XS4hqECmVscgOteODKp+dtG2V0i wbhc8fBQGU27ebLES71GqK88GvqURX5O1PucsPtoeEtx9D46L8+gRvUJjqIOP7k14alcd0cL t3jkcTfu1nxpZNRv0lY1Qqe695JmnQuZlRrjjg7pkr/smtEiHeNPuREE2Tz4/daN5q+RVKcp nUCkMX2xLlQUc3SxHzQHb1UR+vBCxO53Nr02wAHInXc3271py7LkX54vFmS23uFwu5bIGS0M Sc/SCta5YNJPWvCUEOES9nZNije9oC5TY6NfqmNNrJmO8EtHCfarHAGTRPBhAjFzRlz+ZzTz L/GKK5A+15BUv85pNd3Ls9AuYIWKtcWmz+NG8ChkkjPPHj3TCf9dIrp+WCmNogRhJ5oai2Pm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:XfeIua9x/dkPwzLbZNZuk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149447" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 25/70] xen/vpci: CFI hardening Date: Mon, 14 Feb 2022 12:50:42 +0000 Message-ID: <20220214125127.17985-26-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/drivers/vpci/header.c | 18 +++++++++--------- xen/drivers/vpci/msi.c | 42 +++++++++++++++++++++--------------------- xen/drivers/vpci/msix.c | 20 ++++++++++---------- xen/drivers/vpci/vpci.c | 16 ++++++++-------- xen/include/xen/vpci.h | 8 ++++---- 5 files changed, 52 insertions(+), 52 deletions(-) diff --git a/xen/drivers/vpci/header.c b/xen/drivers/vpci/header.c index 40ff79c33f8f..a1c928a0d26f 100644 --- a/xen/drivers/vpci/header.c +++ b/xen/drivers/vpci/header.c @@ -33,8 +33,8 @@ struct map_data { bool map; }; -static int map_range(unsigned long s, unsigned long e, void *data, - unsigned long *c) +static int cf_check map_range( + unsigned long s, unsigned long e, void *data, unsigned long *c) { const struct map_data *map = data; int rc; @@ -332,8 +332,8 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only) return 0; } -static void cmd_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t cmd, void *data) +static void cf_check cmd_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t cmd, void *data) { uint16_t current_cmd = pci_conf_read16(pdev->sbdf, reg); @@ -353,8 +353,8 @@ static void cmd_write(const struct pci_dev *pdev, unsigned int reg, pci_conf_write16(pdev->sbdf, reg, cmd); } -static void bar_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check bar_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_bar *bar = data; bool hi = false; @@ -397,8 +397,8 @@ static void bar_write(const struct pci_dev *pdev, unsigned int reg, pci_conf_write32(pdev->sbdf, reg, val); } -static void rom_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check rom_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_header *header = &pdev->vpci->header; struct vpci_bar *rom = data; @@ -445,7 +445,7 @@ static void rom_write(const struct pci_dev *pdev, unsigned int reg, rom->addr = val & PCI_ROM_ADDRESS_MASK; } -static int init_bars(struct pci_dev *pdev) +static int cf_check init_bars(struct pci_dev *pdev) { uint16_t cmd; uint64_t addr, size; diff --git a/xen/drivers/vpci/msi.c b/xen/drivers/vpci/msi.c index 5757a7aed20f..8f2b59e61aa4 100644 --- a/xen/drivers/vpci/msi.c +++ b/xen/drivers/vpci/msi.c @@ -22,8 +22,8 @@ #include -static uint32_t control_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check control_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msi *msi = data; @@ -34,8 +34,8 @@ static uint32_t control_read(const struct pci_dev *pdev, unsigned int reg, (msi->address64 ? PCI_MSI_FLAGS_64BIT : 0); } -static void control_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check control_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msi *msi = data; unsigned int vectors = min_t(uint8_t, @@ -89,16 +89,16 @@ static void update_msi(const struct pci_dev *pdev, struct vpci_msi *msi) } /* Handlers for the address field (32bit or low part of a 64bit address). */ -static uint32_t address_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check address_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msi *msi = data; return msi->address; } -static void address_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check address_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msi *msi = data; @@ -110,16 +110,16 @@ static void address_write(const struct pci_dev *pdev, unsigned int reg, } /* Handlers for the high part of a 64bit address field. */ -static uint32_t address_hi_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check address_hi_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msi *msi = data; return msi->address >> 32; } -static void address_hi_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check address_hi_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msi *msi = data; @@ -131,16 +131,16 @@ static void address_hi_write(const struct pci_dev *pdev, unsigned int reg, } /* Handlers for the data field. */ -static uint32_t data_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check data_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msi *msi = data; return msi->data; } -static void data_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check data_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msi *msi = data; @@ -150,16 +150,16 @@ static void data_write(const struct pci_dev *pdev, unsigned int reg, } /* Handlers for the MSI mask bits. */ -static uint32_t mask_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check mask_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msi *msi = data; return msi->mask; } -static void mask_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check mask_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msi *msi = data; uint32_t dmask = msi->mask ^ val; @@ -182,7 +182,7 @@ static void mask_write(const struct pci_dev *pdev, unsigned int reg, msi->mask = val; } -static int init_msi(struct pci_dev *pdev) +static int cf_check init_msi(struct pci_dev *pdev) { uint8_t slot = PCI_SLOT(pdev->devfn), func = PCI_FUNC(pdev->devfn); unsigned int pos = pci_find_cap_offset(pdev->seg, pdev->bus, slot, func, diff --git a/xen/drivers/vpci/msix.c b/xen/drivers/vpci/msix.c index 846f1b8d7038..2ab4079412f2 100644 --- a/xen/drivers/vpci/msix.c +++ b/xen/drivers/vpci/msix.c @@ -27,8 +27,8 @@ ((addr) >= vmsix_table_addr(vpci, nr) && \ (addr) < vmsix_table_addr(vpci, nr) + vmsix_table_size(vpci, nr)) -static uint32_t control_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check control_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { const struct vpci_msix *msix = data; @@ -65,8 +65,8 @@ static void update_entry(struct vpci_msix_entry *entry, entry->updated = false; } -static void control_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check control_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { struct vpci_msix *msix = data; bool new_masked = val & PCI_MSIX_FLAGS_MASKALL; @@ -156,7 +156,7 @@ static struct vpci_msix *msix_find(const struct domain *d, unsigned long addr) return NULL; } -static int msix_accept(struct vcpu *v, unsigned long addr) +static int cf_check msix_accept(struct vcpu *v, unsigned long addr) { return !!msix_find(v->domain, addr); } @@ -182,8 +182,8 @@ static struct vpci_msix_entry *get_entry(struct vpci_msix *msix, return &msix->entries[(addr - start) / PCI_MSIX_ENTRY_SIZE]; } -static int msix_read(struct vcpu *v, unsigned long addr, unsigned int len, - unsigned long *data) +static int cf_check msix_read( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long *data) { const struct domain *d = v->domain; struct vpci_msix *msix = msix_find(d, addr); @@ -259,8 +259,8 @@ static int msix_read(struct vcpu *v, unsigned long addr, unsigned int len, return X86EMUL_OKAY; } -static int msix_write(struct vcpu *v, unsigned long addr, unsigned int len, - unsigned long data) +static int cf_check msix_write( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long data) { const struct domain *d = v->domain; struct vpci_msix *msix = msix_find(d, addr); @@ -428,7 +428,7 @@ int vpci_make_msix_hole(const struct pci_dev *pdev) return 0; } -static int init_msix(struct pci_dev *pdev) +static int cf_check init_msix(struct pci_dev *pdev) { struct domain *d = pdev->domain; uint8_t slot = PCI_SLOT(pdev->devfn), func = PCI_FUNC(pdev->devfn); diff --git a/xen/drivers/vpci/vpci.c b/xen/drivers/vpci/vpci.c index fb0947179b79..f3b32d66cb35 100644 --- a/xen/drivers/vpci/vpci.c +++ b/xen/drivers/vpci/vpci.c @@ -106,25 +106,25 @@ static int vpci_register_cmp(const struct vpci_register *r1, } /* Dummy hooks, writes are ignored, reads return 1's */ -static uint32_t vpci_ignored_read(const struct pci_dev *pdev, unsigned int reg, - void *data) +static uint32_t cf_check vpci_ignored_read( + const struct pci_dev *pdev, unsigned int reg, void *data) { return ~(uint32_t)0; } -static void vpci_ignored_write(const struct pci_dev *pdev, unsigned int reg, - uint32_t val, void *data) +static void cf_check vpci_ignored_write( + const struct pci_dev *pdev, unsigned int reg, uint32_t val, void *data) { } -uint32_t vpci_hw_read16(const struct pci_dev *pdev, unsigned int reg, - void *data) +uint32_t cf_check vpci_hw_read16( + const struct pci_dev *pdev, unsigned int reg, void *data) { return pci_conf_read16(pdev->sbdf, reg); } -uint32_t vpci_hw_read32(const struct pci_dev *pdev, unsigned int reg, - void *data) +uint32_t cf_check vpci_hw_read32( + const struct pci_dev *pdev, unsigned int reg, void *data) { return pci_conf_read32(pdev->sbdf, reg); } diff --git a/xen/include/xen/vpci.h b/xen/include/xen/vpci.h index e8ac1eb39513..bcad1516aee1 100644 --- a/xen/include/xen/vpci.h +++ b/xen/include/xen/vpci.h @@ -46,10 +46,10 @@ void vpci_write(pci_sbdf_t sbdf, unsigned int reg, unsigned int size, uint32_t data); /* Passthrough handlers. */ -uint32_t vpci_hw_read16(const struct pci_dev *pdev, unsigned int reg, - void *data); -uint32_t vpci_hw_read32(const struct pci_dev *pdev, unsigned int reg, - void *data); +uint32_t cf_check vpci_hw_read16( + const struct pci_dev *pdev, unsigned int reg, void *data); +uint32_t cf_check vpci_hw_read32( + const struct pci_dev *pdev, unsigned int reg, void *data); /* * Check for pending vPCI operations on this vcpu. Returns true if the vcpu From patchwork Mon Feb 14 12:50:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745545 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D1356C433EF for ; Mon, 14 Feb 2022 13:04:59 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271644.466203 (Exim 4.92) (envelope-from ) id 1nJb2B-0000hD-CZ; Mon, 14 Feb 2022 13:04:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271644.466203; Mon, 14 Feb 2022 13:04:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2B-0000h6-8z; Mon, 14 Feb 2022 13:04:51 +0000 Received: by outflank-mailman (input) for mailman id 271644; Mon, 14 Feb 2022 13:04:49 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb29-0008IH-3O for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:49 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id af28c3de-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:48 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: af28c3de-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843887; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=vffdhJkQcOZTM/FEyvATjcefKfxzfQ918n4MAzGwqnA=; b=a67BnXivL47UiuEZHpBA79Hs3m/KEqQCmrZO1KtGTSZxqoUNeiMZPM5t bJyckYB/Wdh/vp4hARWBbL4HH/imWaBYtsZ0JMjN2febPlovND8380wiu yfAiDUFfBXwt7TdRgX56sf009nFe7nZLd13Av40iorAFjDM+HwEE6xhyk s=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: sM20GbCcen2mFkHzTNczXs5slIOV5qqFwR8rms/1B4/eg+cCfD95Sx8tlkm9diDSkpu9Kh79KM IbXGPszWolfrSTN5A/PLQNqHzUnGh0/dosl4szeLcIDueiGMIRChT85psiBWhE9yDiaAk/Lcg0 vj9OZ3jqSE6tboicide6kwTDnSUg5ep3g2RMLgKlCBhxSn6BeSwzrwCUh/AkBZcyyvGmd4Ry+g 8ZwXUSH/kb+V9qSrG1L0ZkqKiMHWim4waoFCd6jf2mvjemmL9JVdfuBeQ3MKSZcMG2OcFOTdNY lXKqS5hrHkeupTHBRiWv7ABy X-SBRS: 5.1 X-MesageID: 64149316 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:qhcvE6yDkFdLcXQflUd6t+cpwSrEfRIJ4+MujC+fZmUNrF6WrkVSy DMXWD+HPvaOazPxLop1aoi+8EoOupXUx9JhSwE6qCAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt5Nv5 oRMt6Tqcg0SZbXzoOgDWBRqKT4raMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwXQaeFP pRxhTxHMzjMYS9PB24tOq0Fsc2OokXubw1BkQfAzUYwyzeKl1EguFT3C/LFd9rPSchLk0Kwo mPd43+/EhwcLMaYyzeO7jSrnOCnoM/gcNtMTvvirKcs2QDNgDxIYPELabelibqnpB+/WeoFE EYvoTIRlaQs/0GZdMaoCnVUv0W4lhIbXtNRFcgz5weM1rfY7m6lO4QUctJSQId47ZFrHFTGw nfMxoq0XmI37NV5XFrAru/8kN+kBcQCwYbujwcgRBBN3dTsqZpbYvnnHoc6S/7dYjEY9FjNL 9G2QMoW2u97YS0jjfzTEbX7b9WE/Mahc+LNzl+LNl9JFysgDGJfW6Sm6ELA8dFLJ5uDQ1+Ks RAswpbCsL9eXczQzHXWGo3h+Y1FAN7fblXhbaNHRcF9p1xBBVb/FWyv3N2ODBgwaZtVEdMYS ETSpRlQ9Pdu0IiCNsdKj3aKI51yl8DITI29PtiNN4YmSsUhJWevoXA1DWbNjj+FraTZufxmU XttWZ33Vihy5GUO5GfeetrxJpd1mnFglTuLH8iTItbO+eP2WUN5gIwtaDOmBt3VJoveyOkM2 9oAZcaM1TtFV+jyPnve/YIJdAhYJnknH5Hm7cdQc7fbcAZhHWggDd7XwK8gJNM5z/gEyL+Q8 yHvQFJcxXr+mWbDdVeAZEd8Ze69Rp14t386Y3AhZA76x3g5bI+zx64DbJ9rL6I//eluwKcsH fkIcsmNGNpVTTHD92hPZJXxttU6Jh+qmRiPL2yuZz1mJ8xsQAnA+9nFeArz9XZRUnrr5JVm+ 7D5j1HVW5sOQQhmHf36UvP3wgPjp2UZlcJzQ1DMfotZdnLz/dU4MCf2lPI2fZ0BcE2R2juA2 g+KKh4Evu2R8ZQt+dzEiK3Y/YekF+xyQhhTE2XBtOvkMCDb+iyowJNaUfbOdjfYDTum9KKnb ORT7vf9LPxYwwoa79siS+5mnfAk+t/ih75G1QA1TnzEYmOiBq5kPnTbj9JEsbdAx+MBtAa7M q5VFgK25Vld1BvZLWMs IronPort-HdrOrdr: A9a23:D+YHTa9R+7BH4lPnc1Nuk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149316" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 26/70] xen/decompress: CFI hardening Date: Mon, 14 Feb 2022 12:50:43 +0000 Message-ID: <20220214125127.17985-27-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/common/bunzip2.c | 2 +- xen/common/decompress.c | 2 +- xen/common/unlzma.c | 2 +- xen/common/zstd/zstd_common.c | 4 ++-- xen/common/zstd/zstd_internal.h | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/xen/common/bunzip2.c b/xen/common/bunzip2.c index 2087cfbbedc8..782b589a8b01 100644 --- a/xen/common/bunzip2.c +++ b/xen/common/bunzip2.c @@ -607,7 +607,7 @@ static int __init read_bunzip(struct bunzip_data *bd, unsigned char *outbuf, int goto decode_next_byte; } -static int __init nofill(void *buf, unsigned int len) +static int __init cf_check nofill(void *buf, unsigned int len) { return -1; } diff --git a/xen/common/decompress.c b/xen/common/decompress.c index 79e60f4802d5..989336983f61 100644 --- a/xen/common/decompress.c +++ b/xen/common/decompress.c @@ -3,7 +3,7 @@ #include #include -static void __init error(const char *msg) +static void __init cf_check error(const char *msg) { printk("%s\n", msg); } diff --git a/xen/common/unlzma.c b/xen/common/unlzma.c index d0ef78eef0d1..6cd99023adf6 100644 --- a/xen/common/unlzma.c +++ b/xen/common/unlzma.c @@ -76,7 +76,7 @@ struct rc { #define RC_MODEL_TOTAL_BITS 11 -static int __init nofill(void *buffer, unsigned int len) +static int __init cf_check nofill(void *buffer, unsigned int len) { return -1; } diff --git a/xen/common/zstd/zstd_common.c b/xen/common/zstd/zstd_common.c index 9a85e938cdd6..5c44e5db7671 100644 --- a/xen/common/zstd/zstd_common.c +++ b/xen/common/zstd/zstd_common.c @@ -54,12 +54,12 @@ void *__init ZSTD_stackAllocAll(void *opaque, size_t *size) return stack_push(stack, *size); } -void *__init ZSTD_stackAlloc(void *opaque, size_t size) +void *__init cf_check ZSTD_stackAlloc(void *opaque, size_t size) { ZSTD_stack *stack = (ZSTD_stack *)opaque; return stack_push(stack, size); } -void __init ZSTD_stackFree(void *opaque, void *address) +void __init cf_check ZSTD_stackFree(void *opaque, void *address) { (void)opaque; (void)address; diff --git a/xen/common/zstd/zstd_internal.h b/xen/common/zstd/zstd_internal.h index b7dd14f6ce79..94f8c586220e 100644 --- a/xen/common/zstd/zstd_internal.h +++ b/xen/common/zstd/zstd_internal.h @@ -351,8 +351,8 @@ typedef struct { ZSTD_customMem ZSTD_initStack(void *workspace, size_t workspaceSize); void *ZSTD_stackAllocAll(void *opaque, size_t *size); -void *ZSTD_stackAlloc(void *opaque, size_t size); -void ZSTD_stackFree(void *opaque, void *address); +void *cf_check ZSTD_stackAlloc(void *opaque, size_t size); +void cf_check ZSTD_stackFree(void *opaque, void *address); /*====== common function ======*/ From patchwork Mon Feb 14 12:50:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745558 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DE6CDC433F5 for ; Mon, 14 Feb 2022 13:06:23 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271695.466291 (Exim 4.92) (envelope-from ) id 1nJb3R-0006Iv-Ne; Mon, 14 Feb 2022 13:06:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271695.466291; Mon, 14 Feb 2022 13:06:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3R-0006Im-KM; Mon, 14 Feb 2022 13:06:09 +0000 Received: by outflank-mailman (input) for mailman id 271695; Mon, 14 Feb 2022 13:06:08 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3B-0008IH-AY for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:53 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d54d9daf-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:50 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d54d9daf-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843950; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Wv0rQqRPWpcG0ewKeUqSGZKCO/w3udjtsWVFXdBQG/w=; b=GOZehs7pXGxGVkQcXy0fYhVsyVvRqgOKYuh4LZoOqCWwUG9xahUv4qiV DX51joY5ikmk7z+S6uyxiHetHwk6Y/sfAQ5ZZ8m342UkIqGtRUQscJwMY qzB+IV099XfjAf35ihqP/TkJOzsX8CPRl54liFd3USEvVWzZXbohHShrg I=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 0j2hK2Ow4/t6RBTgf3IoSL36BC6PnZvYFQaJXVU6RGynC5Ju3H4l+lDiOqxCgP5yjIAvNJjUr+ 6PDItm1ugrTwjHsbjWfG8ic+6ou3RY54QwD5dYjpLl0PgrwGH+MYXfKBLJ1wjwj8p2UehG8XgT lLw7N1mug47SuiyKRm9wZSE13zKt2/UmM3jFqmlDvHKdW7R4h3vTQY6kX7cJhPBqQgo0keN87v v7gXwV8nu+qoiyjrkxCQmWDAI4OkjyYUJK8BCOole4sg+AyaQlFPnzidVOPqFfTuUY7G1ac9Qo hS6J67BKLqcW5icshTtvRTat X-SBRS: 5.1 X-MesageID: 66374886 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Lj/RRaP7c1arI2TvrR28kMFynXyQoLVcMsEvi/4bfWQNrUpz0TQFz 2QdCmHXb/aLN2akc9Ana9mwpkoAsJPSy4VlHAto+SlhQUwRpJueD7x1DKtR0wB+jCHnZBg6h ynLQoCYdKjYdpJYz/uUGuCJQUNUjMlkfZKhTr6UUsxNbVU8En1500s/w7dRbrNA2rBVPSvc4 bsenOWHULOV82Yc3rU8sv/rRLtH5ZweiRtA1rAMTakjUGz2zhH5OKk3N6CpR0YUd6EPdgKMq 0Qv+5nilo/R109F5tpICd8XeGVSKlLZFVDmZna7x8FOK/WNz8A/+v9TCRYSVatYox+rn48u1 Ophjsa9dkQ4DrLnsusTdyANRkmSPYUekFPGCX22sMjVxEzaaXr8hf5pCSnaP6VBpLwxWzsXs 6VFdnZdNXhvhMrvqF6/YsBqit4uM4/AO4QHt2s75TrYEewnUdbIRKCiCdpwgmlr2ZweTai2i 8wxb31OUjGaex5zORQwV7g4l8qB1lOnfGgNwL6SjfVuuDWCpOBr65D9PdyQdtGUSMF9mkeDu nmA72n/GgsdNtGU1XyC6H3EuwPUtXqlAsRITuT+r6M0xg3IroAONPEIfXGZoabmlnGSYIhSF A8FyjUFh6c80HX+G7ERQCaEiHKDuxcdXf9ZHOs79ByBx8Lo3uqJOoQXZmUfMYJ77afaURRvj wbUxI2xWVSDpZXIESr1y1uCkd+l1cH5x0cmbDRMcwYK6sKLTGob3kOWFYYL/EJYY7TI9dDML 9Ki8XJWa1Y715djO0CHEbfv2WzEm3QxZlRpjjg7p0r8hu+DWKarZpaz9X/Q5utaIYCSQzGp5 SZYx5fOvL1TVcjWzkRhpdnh+5nzuZ643MD02wYzT/HNCRzxk5JcQWygyG4nfxo4Wir1UTTof FXSqWtsCGx7ZxOXgVtMS9vpUawClPG4ffy8D6y8RoceM/BZKV7clAkzNBH44owYuBV1+U3JE czAKpjE4LdzIfkP8QdasM9Dje51lnhmnzu7qFKS503P7IdyrUW9Ed8tWGZipMhgvMtoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:W6QGy67FHYtEWXDOuAPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374886" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 27/70] xen/iommu: CFI hardening Date: Mon, 14 Feb 2022 12:50:44 +0000 Message-ID: <20220214125127.17985-28-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. AMD's parse_ppr_log_entry() has no external callers, so becomes static. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/common/compat/memory.c | 4 +- xen/drivers/passthrough/amd/iommu.h | 41 ++++++++-------- xen/drivers/passthrough/amd/iommu_init.c | 22 ++++----- xen/drivers/passthrough/amd/iommu_intr.c | 18 +++---- xen/drivers/passthrough/amd/iommu_map.c | 22 +++++---- xen/drivers/passthrough/amd/pci_amd_iommu.c | 32 ++++++------ xen/drivers/passthrough/pci.c | 7 +-- xen/drivers/passthrough/vtd/dmar.c | 3 +- xen/drivers/passthrough/vtd/extern.h | 36 +++++++------- xen/drivers/passthrough/vtd/intremap.c | 14 +++--- xen/drivers/passthrough/vtd/iommu.c | 75 +++++++++++++++-------------- xen/drivers/passthrough/vtd/qinval.c | 28 +++++------ 12 files changed, 153 insertions(+), 149 deletions(-) diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index ec8ba54bb66e..077ded4a754c 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -23,8 +23,8 @@ struct get_reserved_device_memory { unsigned int used_entries; }; -static int get_reserved_device_memory(xen_pfn_t start, xen_ulong_t nr, - u32 id, void *ctxt) +static int cf_check get_reserved_device_memory( + xen_pfn_t start, xen_ulong_t nr, u32 id, void *ctxt) { struct get_reserved_device_memory *grdm = ctxt; uint32_t sbdf = PCI_SBDF3(grdm->map.dev.pci.seg, grdm->map.dev.pci.bus, diff --git a/xen/drivers/passthrough/amd/iommu.h b/xen/drivers/passthrough/amd/iommu.h index 99be9aafcc53..03811fedea57 100644 --- a/xen/drivers/passthrough/amd/iommu.h +++ b/xen/drivers/passthrough/amd/iommu.h @@ -236,25 +236,26 @@ int amd_iommu_init_late(void); int amd_iommu_update_ivrs_mapping_acpi(void); int cf_check iov_adjust_irq_affinities(void); -int amd_iommu_quarantine_init(struct domain *d); +int cf_check amd_iommu_quarantine_init(struct domain *d); /* mapping functions */ -int __must_check amd_iommu_map_page(struct domain *d, dfn_t dfn, - mfn_t mfn, unsigned int flags, - unsigned int *flush_flags); -int __must_check amd_iommu_unmap_page(struct domain *d, dfn_t dfn, - unsigned int *flush_flags); +int __must_check cf_check amd_iommu_map_page( + struct domain *d, dfn_t dfn, mfn_t mfn, unsigned int flags, + unsigned int *flush_flags); +int __must_check cf_check amd_iommu_unmap_page( + struct domain *d, dfn_t dfn, unsigned int *flush_flags); int __must_check amd_iommu_alloc_root(struct domain *d); int amd_iommu_reserve_domain_unity_map(struct domain *domain, const struct ivrs_unity_map *map, unsigned int flag); int amd_iommu_reserve_domain_unity_unmap(struct domain *d, const struct ivrs_unity_map *map); -int amd_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt); -int __must_check amd_iommu_flush_iotlb_pages(struct domain *d, dfn_t dfn, - unsigned long page_count, - unsigned int flush_flags); -int __must_check amd_iommu_flush_iotlb_all(struct domain *d); +int cf_check amd_iommu_get_reserved_device_memory( + iommu_grdm_t *func, void *ctxt); +int __must_check cf_check amd_iommu_flush_iotlb_pages( + struct domain *d, dfn_t dfn, unsigned long page_count, + unsigned int flush_flags); +int __must_check cf_check amd_iommu_flush_iotlb_all(struct domain *d); /* device table functions */ int get_dma_requestor_id(uint16_t seg, uint16_t bdf); @@ -282,21 +283,21 @@ void amd_iommu_flush_all_caches(struct amd_iommu *iommu); struct amd_iommu *find_iommu_for_device(int seg, int bdf); /* interrupt remapping */ -bool iov_supports_xt(void); +bool cf_check iov_supports_xt(void); int amd_iommu_setup_ioapic_remapping(void); void *amd_iommu_alloc_intremap_table( const struct amd_iommu *, unsigned long **, unsigned int nr); -int amd_iommu_free_intremap_table( +int cf_check amd_iommu_free_intremap_table( const struct amd_iommu *, struct ivrs_mappings *, uint16_t); unsigned int amd_iommu_intremap_table_order( const void *irt, const struct amd_iommu *iommu); -void amd_iommu_ioapic_update_ire( +void cf_check amd_iommu_ioapic_update_ire( unsigned int apic, unsigned int reg, unsigned int value); -unsigned int amd_iommu_read_ioapic_from_ire( +unsigned int cf_check amd_iommu_read_ioapic_from_ire( unsigned int apic, unsigned int reg); -int amd_iommu_msi_msg_update_ire( +int cf_check amd_iommu_msi_msg_update_ire( struct msi_desc *msi_desc, struct msi_msg *msg); -int amd_setup_hpet_msi(struct msi_desc *msi_desc); +int cf_check amd_setup_hpet_msi(struct msi_desc *msi_desc); void cf_check amd_iommu_dump_intremap_tables(unsigned char key); extern struct ioapic_sbdf { @@ -327,9 +328,9 @@ extern void *shared_intremap_table; extern unsigned long *shared_intremap_inuse; /* power management support */ -void amd_iommu_resume(void); -int __must_check amd_iommu_suspend(void); -void amd_iommu_crash_shutdown(void); +void cf_check amd_iommu_resume(void); +int __must_check cf_check amd_iommu_suspend(void); +void cf_check amd_iommu_crash_shutdown(void); /* guest iommu support */ #ifdef CONFIG_HVM diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index 34a9e49f1c5a..06b4d2b1fea0 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -258,8 +258,8 @@ static void register_iommu_exclusion_range(struct amd_iommu *iommu) writel(entry, iommu->mmio_base+IOMMU_EXCLUSION_BASE_LOW_OFFSET); } -static void set_iommu_event_log_control(struct amd_iommu *iommu, - bool enable) +static void cf_check set_iommu_event_log_control( + struct amd_iommu *iommu, bool enable) { /* Reset head and tail pointer manually before enablement */ if ( enable ) @@ -275,8 +275,8 @@ static void set_iommu_event_log_control(struct amd_iommu *iommu, writeq(iommu->ctrl.raw, iommu->mmio_base + IOMMU_CONTROL_MMIO_OFFSET); } -static void set_iommu_ppr_log_control(struct amd_iommu *iommu, - bool enable) +static void cf_check set_iommu_ppr_log_control( + struct amd_iommu *iommu, bool enable) { /* Reset head and tail pointer manually before enablement */ if ( enable ) @@ -527,7 +527,7 @@ static hw_irq_controller iommu_x2apic_type = { .set_affinity = set_x2apic_affinity, }; -static void parse_event_log_entry(struct amd_iommu *iommu, u32 entry[]) +static void cf_check parse_event_log_entry(struct amd_iommu *iommu, u32 entry[]) { u32 code; static const char *const event_str[] = { @@ -628,7 +628,7 @@ static void iommu_check_event_log(struct amd_iommu *iommu) spin_unlock_irqrestore(&iommu->lock, flags); } -void parse_ppr_log_entry(struct amd_iommu *iommu, u32 entry[]) +static void cf_check parse_ppr_log_entry(struct amd_iommu *iommu, u32 entry[]) { u16 device_id; @@ -1243,7 +1243,7 @@ static int __init alloc_ivrs_mappings(u16 seg) return 0; } -static int __init amd_iommu_setup_device_table( +static int __init cf_check amd_iommu_setup_device_table( u16 seg, struct ivrs_mappings *ivrs_mappings) { struct amd_iommu_dte *dt = IVRS_MAPPINGS_DEVTAB(ivrs_mappings); @@ -1543,7 +1543,7 @@ static void invalidate_all_domain_pages(void) amd_iommu_flush_all_pages(d); } -static int _invalidate_all_devices( +static int cf_check _invalidate_all_devices( u16 seg, struct ivrs_mappings *ivrs_mappings) { unsigned int bdf; @@ -1569,14 +1569,14 @@ static void invalidate_all_devices(void) iterate_ivrs_mappings(_invalidate_all_devices); } -int amd_iommu_suspend(void) +int cf_check amd_iommu_suspend(void) { amd_iommu_crash_shutdown(); return 0; } -void amd_iommu_crash_shutdown(void) +void cf_check amd_iommu_crash_shutdown(void) { struct amd_iommu *iommu; @@ -1584,7 +1584,7 @@ void amd_iommu_crash_shutdown(void) disable_iommu(iommu); } -void amd_iommu_resume(void) +void cf_check amd_iommu_resume(void) { struct amd_iommu *iommu; diff --git a/xen/drivers/passthrough/amd/iommu_intr.c b/xen/drivers/passthrough/amd/iommu_intr.c index e7804413c7f4..cebf9ceca74e 100644 --- a/xen/drivers/passthrough/amd/iommu_intr.c +++ b/xen/drivers/passthrough/amd/iommu_intr.c @@ -349,7 +349,7 @@ static int update_intremap_entry_from_ioapic( return 0; } -void amd_iommu_ioapic_update_ire( +void cf_check amd_iommu_ioapic_update_ire( unsigned int apic, unsigned int reg, unsigned int value) { struct IO_APIC_route_entry old_rte = { 0 }; @@ -455,7 +455,7 @@ void amd_iommu_ioapic_update_ire( } } -unsigned int amd_iommu_read_ioapic_from_ire( +unsigned int cf_check amd_iommu_read_ioapic_from_ire( unsigned int apic, unsigned int reg) { unsigned int idx; @@ -608,7 +608,7 @@ static struct amd_iommu *_find_iommu_for_device(int seg, int bdf) return ERR_PTR(-EINVAL); } -int amd_iommu_msi_msg_update_ire( +int cf_check amd_iommu_msi_msg_update_ire( struct msi_desc *msi_desc, struct msi_msg *msg) { struct pci_dev *pdev = msi_desc->dev; @@ -653,7 +653,7 @@ int amd_iommu_msi_msg_update_ire( return rc; } -int amd_iommu_free_intremap_table( +int cf_check amd_iommu_free_intremap_table( const struct amd_iommu *iommu, struct ivrs_mappings *ivrs_mapping, uint16_t bdf) { @@ -727,7 +727,7 @@ void *amd_iommu_alloc_intremap_table( return tb; } -bool __init iov_supports_xt(void) +bool __init cf_check iov_supports_xt(void) { unsigned int apic; @@ -756,7 +756,7 @@ bool __init iov_supports_xt(void) return true; } -int __init amd_setup_hpet_msi(struct msi_desc *msi_desc) +int __init cf_check amd_setup_hpet_msi(struct msi_desc *msi_desc) { const struct amd_iommu *iommu; spinlock_t *lock; @@ -826,9 +826,9 @@ static void dump_intremap_table(const struct amd_iommu *iommu, } } -static int dump_intremap_mapping(const struct amd_iommu *iommu, - struct ivrs_mappings *ivrs_mapping, - uint16_t unused) +static int cf_check dump_intremap_mapping( + const struct amd_iommu *iommu, struct ivrs_mappings *ivrs_mapping, + uint16_t unused) { unsigned long flags; diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c index b0330157eab5..bf5df5fe5d9a 100644 --- a/xen/drivers/passthrough/amd/iommu_map.c +++ b/xen/drivers/passthrough/amd/iommu_map.c @@ -276,8 +276,9 @@ static int iommu_pde_from_dfn(struct domain *d, unsigned long dfn, return 0; } -int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn, - unsigned int flags, unsigned int *flush_flags) +int cf_check amd_iommu_map_page( + struct domain *d, dfn_t dfn, mfn_t mfn, unsigned int flags, + unsigned int *flush_flags) { struct domain_iommu *hd = dom_iommu(d); int rc; @@ -326,8 +327,8 @@ int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn, return 0; } -int amd_iommu_unmap_page(struct domain *d, dfn_t dfn, - unsigned int *flush_flags) +int cf_check amd_iommu_unmap_page( + struct domain *d, dfn_t dfn, unsigned int *flush_flags) { unsigned long pt_mfn = 0; struct domain_iommu *hd = dom_iommu(d); @@ -370,9 +371,9 @@ static unsigned long flush_count(unsigned long dfn, unsigned long page_count, return end - start; } -int amd_iommu_flush_iotlb_pages(struct domain *d, dfn_t dfn, - unsigned long page_count, - unsigned int flush_flags) +int cf_check amd_iommu_flush_iotlb_pages( + struct domain *d, dfn_t dfn, unsigned long page_count, + unsigned int flush_flags) { unsigned long dfn_l = dfn_x(dfn); @@ -410,7 +411,7 @@ int amd_iommu_flush_iotlb_pages(struct domain *d, dfn_t dfn, return 0; } -int amd_iommu_flush_iotlb_all(struct domain *d) +int cf_check amd_iommu_flush_iotlb_all(struct domain *d) { amd_iommu_flush_all_pages(d); @@ -462,7 +463,8 @@ int amd_iommu_reserve_domain_unity_unmap(struct domain *d, return rc; } -int amd_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt) +int cf_check amd_iommu_get_reserved_device_memory( + iommu_grdm_t *func, void *ctxt) { unsigned int seg = 0 /* XXX */, bdf; const struct ivrs_mappings *ivrs_mappings = get_ivrs_mappings(seg); @@ -537,7 +539,7 @@ int amd_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt) return 0; } -int __init amd_iommu_quarantine_init(struct domain *d) +int __init cf_check amd_iommu_quarantine_init(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); unsigned long end_gfn = diff --git a/xen/drivers/passthrough/amd/pci_amd_iommu.c b/xen/drivers/passthrough/amd/pci_amd_iommu.c index 9642bba43a26..e57f555d00d1 100644 --- a/xen/drivers/passthrough/amd/pci_amd_iommu.c +++ b/xen/drivers/passthrough/amd/pci_amd_iommu.c @@ -197,7 +197,7 @@ int __init acpi_ivrs_init(void) return 0; } -static int __init iov_detect(void) +static int __init cf_check iov_detect(void) { if ( !iommu_enable && !iommu_intremap ) return 0; @@ -217,7 +217,7 @@ static int __init iov_detect(void) return 0; } -static int iov_enable_xt(void) +static int cf_check iov_enable_xt(void) { int rc; @@ -253,7 +253,7 @@ int amd_iommu_alloc_root(struct domain *d) unsigned int __read_mostly amd_iommu_max_paging_mode = 6; int __read_mostly amd_iommu_min_paging_mode = 1; -static int amd_iommu_domain_init(struct domain *d) +static int cf_check amd_iommu_domain_init(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); @@ -275,9 +275,9 @@ static int amd_iommu_domain_init(struct domain *d) return 0; } -static int amd_iommu_add_device(u8 devfn, struct pci_dev *pdev); +static int cf_check amd_iommu_add_device(u8 devfn, struct pci_dev *pdev); -static void __hwdom_init amd_iommu_hwdom_init(struct domain *d) +static void __hwdom_init cf_check amd_iommu_hwdom_init(struct domain *d) { const struct amd_iommu *iommu; @@ -350,8 +350,9 @@ static void amd_iommu_disable_domain_device(const struct domain *domain, spin_unlock_irqrestore(&iommu->lock, flags); } -static int reassign_device(struct domain *source, struct domain *target, - u8 devfn, struct pci_dev *pdev) +static int cf_check reassign_device( + struct domain *source, struct domain *target, u8 devfn, + struct pci_dev *pdev) { struct amd_iommu *iommu; int bdf, rc; @@ -404,9 +405,8 @@ static int reassign_device(struct domain *source, struct domain *target, return 0; } -static int amd_iommu_assign_device(struct domain *d, u8 devfn, - struct pci_dev *pdev, - u32 flag) +static int cf_check amd_iommu_assign_device( + struct domain *d, u8 devfn, struct pci_dev *pdev, u32 flag) { struct ivrs_mappings *ivrs_mappings = get_ivrs_mappings(pdev->seg); int bdf = PCI_BDF2(pdev->bus, devfn); @@ -435,7 +435,7 @@ static int amd_iommu_assign_device(struct domain *d, u8 devfn, return rc; } -static void amd_iommu_clear_root_pgtable(struct domain *d) +static void cf_check amd_iommu_clear_root_pgtable(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); @@ -444,13 +444,13 @@ static void amd_iommu_clear_root_pgtable(struct domain *d) spin_unlock(&hd->arch.mapping_lock); } -static void amd_iommu_domain_destroy(struct domain *d) +static void cf_check amd_iommu_domain_destroy(struct domain *d) { iommu_identity_map_teardown(d); ASSERT(!dom_iommu(d)->arch.amd.root_table); } -static int amd_iommu_add_device(u8 devfn, struct pci_dev *pdev) +static int cf_check amd_iommu_add_device(u8 devfn, struct pci_dev *pdev) { struct amd_iommu *iommu; u16 bdf; @@ -525,7 +525,7 @@ static int amd_iommu_add_device(u8 devfn, struct pci_dev *pdev) return amd_iommu_setup_domain_device(pdev->domain, iommu, devfn, pdev); } -static int amd_iommu_remove_device(u8 devfn, struct pci_dev *pdev) +static int cf_check amd_iommu_remove_device(u8 devfn, struct pci_dev *pdev) { struct amd_iommu *iommu; u16 bdf; @@ -562,7 +562,7 @@ static int amd_iommu_remove_device(u8 devfn, struct pci_dev *pdev) return 0; } -static int amd_iommu_group_id(u16 seg, u8 bus, u8 devfn) +static int cf_check amd_iommu_group_id(u16 seg, u8 bus, u8 devfn) { int bdf = PCI_BDF2(bus, devfn); @@ -616,7 +616,7 @@ static void amd_dump_page_table_level(struct page_info *pg, int level, unmap_domain_page(table_vaddr); } -static void amd_dump_page_tables(struct domain *d) +static void cf_check amd_dump_page_tables(struct domain *d) { const struct domain_iommu *hd = dom_iommu(d); diff --git a/xen/drivers/passthrough/pci.c b/xen/drivers/passthrough/pci.c index 79f49f0e6007..af1a7f9fab6d 100644 --- a/xen/drivers/passthrough/pci.c +++ b/xen/drivers/passthrough/pci.c @@ -1098,7 +1098,7 @@ void pci_check_disable_device(u16 seg, u8 bus, u8 devfn) * scan pci devices to add all existed PCI devices to alldevs_list, * and setup pci hierarchy in array bus2bridge. */ -static int __init _scan_pci_devices(struct pci_seg *pseg, void *arg) +static int __init cf_check _scan_pci_devices(struct pci_seg *pseg, void *arg) { struct pci_dev *pdev; int bus, dev, func; @@ -1176,7 +1176,8 @@ static void __hwdom_init setup_one_hwdom_device(const struct setup_hwdom *ctxt, ctxt->d->domain_id, err); } -static int __hwdom_init _setup_hwdom_pci_devices(struct pci_seg *pseg, void *arg) +static int __hwdom_init cf_check _setup_hwdom_pci_devices( + struct pci_seg *pseg, void *arg) { struct setup_hwdom *ctxt = arg; int bus, devfn; @@ -1333,7 +1334,7 @@ bool_t pcie_aer_get_firmware_first(const struct pci_dev *pdev) } #endif -static int _dump_pci_devices(struct pci_seg *pseg, void *arg) +static int cf_check _dump_pci_devices(struct pci_seg *pseg, void *arg) { struct pci_dev *pdev; diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c index b8e91f5be1ae..63f8642e126a 100644 --- a/xen/drivers/passthrough/vtd/dmar.c +++ b/xen/drivers/passthrough/vtd/dmar.c @@ -1046,7 +1046,8 @@ bool_t __init platform_supports_x2apic(void) return cpu_has_x2apic && ((dmar_flags & mask) == ACPI_DMAR_INTR_REMAP); } -int intel_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt) +int cf_check intel_iommu_get_reserved_device_memory( + iommu_grdm_t *func, void *ctxt) { struct acpi_rmrr_unit *rmrr, *rmrr_cur = NULL; unsigned int i; diff --git a/xen/drivers/passthrough/vtd/extern.h b/xen/drivers/passthrough/vtd/extern.h index 4595b65e5bce..bf625fd4540e 100644 --- a/xen/drivers/passthrough/vtd/extern.h +++ b/xen/drivers/passthrough/vtd/extern.h @@ -33,9 +33,9 @@ void print_iommu_regs(struct acpi_drhd_unit *drhd); void print_vtd_entries(struct vtd_iommu *iommu, int bus, int devfn, u64 gmfn); keyhandler_fn_t cf_check vtd_dump_iommu_info; -bool intel_iommu_supports_eim(void); -int intel_iommu_enable_eim(void); -void intel_iommu_disable_eim(void); +bool cf_check intel_iommu_supports_eim(void); +int cf_check intel_iommu_enable_eim(void); +void cf_check intel_iommu_disable_eim(void); int enable_qinval(struct vtd_iommu *iommu); void disable_qinval(struct vtd_iommu *iommu); @@ -51,15 +51,13 @@ int iommu_flush_iec_global(struct vtd_iommu *iommu); int iommu_flush_iec_index(struct vtd_iommu *iommu, u8 im, u16 iidx); void clear_fault_bits(struct vtd_iommu *iommu); -int __must_check vtd_flush_context_reg(struct vtd_iommu *iommu, uint16_t did, - uint16_t source_id, - uint8_t function_mask, uint64_t type, - bool flush_non_present_entry); -int __must_check vtd_flush_iotlb_reg(struct vtd_iommu *iommu, uint16_t did, - uint64_t addr, unsigned int size_order, - uint64_t type, - bool flush_non_present_entry, - bool flush_dev_iotlb); +int __must_check cf_check vtd_flush_context_reg( + struct vtd_iommu *iommu, uint16_t did, uint16_t source_id, + uint8_t function_mask, uint64_t type, bool flush_non_present_entry); +int __must_check cf_check vtd_flush_iotlb_reg( + struct vtd_iommu *iommu, uint16_t did, uint64_t addr, + unsigned int size_order, uint64_t type, bool flush_non_present_entry, + bool flush_dev_iotlb); struct vtd_iommu *ioapic_to_iommu(unsigned int apic_id); struct vtd_iommu *hpet_to_iommu(unsigned int hpet_id); @@ -89,17 +87,19 @@ int domain_context_mapping_one(struct domain *domain, struct vtd_iommu *iommu, u8 bus, u8 devfn, const struct pci_dev *); int domain_context_unmap_one(struct domain *domain, struct vtd_iommu *iommu, u8 bus, u8 devfn); -int intel_iommu_get_reserved_device_memory(iommu_grdm_t *func, void *ctxt); +int cf_check intel_iommu_get_reserved_device_memory( + iommu_grdm_t *func, void *ctxt); -unsigned int io_apic_read_remap_rte(unsigned int apic, unsigned int reg); -void io_apic_write_remap_rte(unsigned int apic, - unsigned int reg, unsigned int value); +unsigned int cf_check io_apic_read_remap_rte( + unsigned int apic, unsigned int reg); +void cf_check io_apic_write_remap_rte( + unsigned int apic, unsigned int reg, unsigned int value); struct msi_desc; struct msi_msg; -int msi_msg_write_remap_rte(struct msi_desc *, struct msi_msg *); +int cf_check msi_msg_write_remap_rte(struct msi_desc *, struct msi_msg *); -int intel_setup_hpet_msi(struct msi_desc *); +int cf_check intel_setup_hpet_msi(struct msi_desc *); int is_igd_vt_enabled_quirk(void); bool is_azalia_tlb_enabled(const struct acpi_drhd_unit *); diff --git a/xen/drivers/passthrough/vtd/intremap.c b/xen/drivers/passthrough/vtd/intremap.c index 01152f200664..e6ba89591b6f 100644 --- a/xen/drivers/passthrough/vtd/intremap.c +++ b/xen/drivers/passthrough/vtd/intremap.c @@ -142,7 +142,7 @@ static void set_hpet_source_id(unsigned int id, struct iremap_entry *ire) set_ire_sid(ire, SVT_VERIFY_SID_SQ, SQ_13_IGNORE_3, hpetid_to_bdf(id)); } -bool __init intel_iommu_supports_eim(void) +bool __init cf_check intel_iommu_supports_eim(void) { struct acpi_drhd_unit *drhd; unsigned int apic; @@ -414,7 +414,7 @@ static int ioapic_rte_to_remap_entry(struct vtd_iommu *iommu, return 0; } -unsigned int io_apic_read_remap_rte( +unsigned int cf_check io_apic_read_remap_rte( unsigned int apic, unsigned int reg) { unsigned int ioapic_pin = (reg - 0x10) / 2; @@ -438,7 +438,7 @@ unsigned int io_apic_read_remap_rte( return (*(((u32 *)&old_rte) + 0)); } -void io_apic_write_remap_rte( +void cf_check io_apic_write_remap_rte( unsigned int apic, unsigned int reg, unsigned int value) { unsigned int ioapic_pin = (reg - 0x10) / 2; @@ -639,7 +639,7 @@ static int msi_msg_to_remap_entry( return 0; } -int msi_msg_write_remap_rte( +int cf_check msi_msg_write_remap_rte( struct msi_desc *msi_desc, struct msi_msg *msg) { struct pci_dev *pdev = msi_desc->dev; @@ -651,7 +651,7 @@ int msi_msg_write_remap_rte( : -EINVAL; } -int __init intel_setup_hpet_msi(struct msi_desc *msi_desc) +int __init cf_check intel_setup_hpet_msi(struct msi_desc *msi_desc) { struct vtd_iommu *iommu = hpet_to_iommu(msi_desc->hpet_id); unsigned long flags; @@ -802,7 +802,7 @@ void disable_intremap(struct vtd_iommu *iommu) * This function is used to enable Interrupt remapping when * enable x2apic */ -int intel_iommu_enable_eim(void) +int cf_check intel_iommu_enable_eim(void) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; @@ -856,7 +856,7 @@ int intel_iommu_enable_eim(void) * This function is used to disable Interrupt remapping when * suspend local apic */ -void intel_iommu_disable_eim(void) +void cf_check intel_iommu_disable_eim(void) { struct acpi_drhd_unit *drhd; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 7a9c391bec70..4d7703dd9a20 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -59,7 +59,7 @@ static unsigned int __read_mostly nr_iommus; static struct iommu_ops vtd_ops; static struct tasklet vtd_fault_tasklet; -static int setup_hwdom_device(u8 devfn, struct pci_dev *); +static int cf_check setup_hwdom_device(u8 devfn, struct pci_dev *); static void setup_hwdom_rmrr(struct domain *d); static bool domid_mapping(const struct vtd_iommu *iommu) @@ -240,7 +240,7 @@ domid_t did_to_domain_id(const struct vtd_iommu *iommu, unsigned int did) return iommu->domid_map[did]; } -static void sync_cache(const void *addr, unsigned int size) +static void cf_check sync_cache(const void *addr, unsigned int size) { static unsigned long clflush_size = 0; const void *end = addr + size; @@ -475,9 +475,9 @@ static void iommu_flush_write_buffer(struct vtd_iommu *iommu) } /* return value determine if we need a write buffer flush */ -int vtd_flush_context_reg(struct vtd_iommu *iommu, uint16_t did, - uint16_t source_id, uint8_t function_mask, - uint64_t type, bool flush_non_present_entry) +int cf_check vtd_flush_context_reg( + struct vtd_iommu *iommu, uint16_t did, uint16_t source_id, + uint8_t function_mask, uint64_t type, bool flush_non_present_entry) { unsigned long flags; @@ -542,9 +542,10 @@ static int __must_check iommu_flush_context_device(struct vtd_iommu *iommu, } /* return value determine if we need a write buffer flush */ -int vtd_flush_iotlb_reg(struct vtd_iommu *iommu, uint16_t did, uint64_t addr, - unsigned int size_order, uint64_t type, - bool flush_non_present_entry, bool flush_dev_iotlb) +int cf_check vtd_flush_iotlb_reg( + struct vtd_iommu *iommu, uint16_t did, uint64_t addr, + unsigned int size_order, uint64_t type, bool flush_non_present_entry, + bool flush_dev_iotlb) { int tlb_offset = ecap_iotlb_offset(iommu->ecap); uint64_t val = type | DMA_TLB_IVT; @@ -752,10 +753,9 @@ static int __must_check iommu_flush_iotlb(struct domain *d, dfn_t dfn, return ret; } -static int __must_check iommu_flush_iotlb_pages(struct domain *d, - dfn_t dfn, - unsigned long page_count, - unsigned int flush_flags) +static int __must_check cf_check iommu_flush_iotlb_pages( + struct domain *d, dfn_t dfn, unsigned long page_count, + unsigned int flush_flags) { ASSERT(page_count && !dfn_eq(dfn, INVALID_DFN)); ASSERT(flush_flags); @@ -764,7 +764,7 @@ static int __must_check iommu_flush_iotlb_pages(struct domain *d, page_count); } -static int __must_check iommu_flush_iotlb_all(struct domain *d) +static int __must_check cf_check iommu_flush_iotlb_all(struct domain *d) { return iommu_flush_iotlb(d, INVALID_DFN, 0, 0); } @@ -1393,7 +1393,7 @@ void __init iommu_free(struct acpi_drhd_unit *drhd) agaw = 64; \ agaw; }) -static int intel_iommu_domain_init(struct domain *d) +static int cf_check intel_iommu_domain_init(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); @@ -1407,7 +1407,7 @@ static int intel_iommu_domain_init(struct domain *d) return 0; } -static void __hwdom_init intel_iommu_hwdom_init(struct domain *d) +static void __hwdom_init cf_check intel_iommu_hwdom_init(struct domain *d) { struct acpi_drhd_unit *drhd; @@ -1856,7 +1856,7 @@ static int domain_context_unmap(struct domain *domain, u8 devfn, return ret; } -static void iommu_clear_root_pgtable(struct domain *d) +static void cf_check iommu_clear_root_pgtable(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); @@ -1865,7 +1865,7 @@ static void iommu_clear_root_pgtable(struct domain *d) spin_unlock(&hd->arch.mapping_lock); } -static void iommu_domain_teardown(struct domain *d) +static void cf_check iommu_domain_teardown(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); const struct acpi_drhd_unit *drhd; @@ -1883,9 +1883,9 @@ static void iommu_domain_teardown(struct domain *d) XFREE(hd->arch.vtd.iommu_bitmap); } -static int __must_check intel_iommu_map_page(struct domain *d, dfn_t dfn, - mfn_t mfn, unsigned int flags, - unsigned int *flush_flags) +static int __must_check cf_check intel_iommu_map_page( + struct domain *d, dfn_t dfn, mfn_t mfn, unsigned int flags, + unsigned int *flush_flags) { struct domain_iommu *hd = dom_iommu(d); struct dma_pte *page, *pte, old, new = {}; @@ -1954,8 +1954,8 @@ static int __must_check intel_iommu_map_page(struct domain *d, dfn_t dfn, return rc; } -static int __must_check intel_iommu_unmap_page(struct domain *d, dfn_t dfn, - unsigned int *flush_flags) +static int __must_check cf_check intel_iommu_unmap_page( + struct domain *d, dfn_t dfn, unsigned int *flush_flags) { /* Do nothing if VT-d shares EPT page table */ if ( iommu_use_hap_pt(d) ) @@ -1970,8 +1970,8 @@ static int __must_check intel_iommu_unmap_page(struct domain *d, dfn_t dfn, return 0; } -static int intel_iommu_lookup_page(struct domain *d, dfn_t dfn, mfn_t *mfn, - unsigned int *flags) +static int cf_check intel_iommu_lookup_page( + struct domain *d, dfn_t dfn, mfn_t *mfn, unsigned int *flags) { struct domain_iommu *hd = dom_iommu(d); struct dma_pte *page, val; @@ -2023,7 +2023,7 @@ static int __init vtd_ept_page_compatible(struct vtd_iommu *iommu) (ept_has_1gb(ept_cap) && opt_hap_1gb) <= cap_sps_1gb(vtd_cap); } -static int intel_iommu_add_device(u8 devfn, struct pci_dev *pdev) +static int cf_check intel_iommu_add_device(u8 devfn, struct pci_dev *pdev) { struct acpi_rmrr_unit *rmrr; u16 bdf; @@ -2066,7 +2066,7 @@ static int intel_iommu_add_device(u8 devfn, struct pci_dev *pdev) return 0; } -static int intel_iommu_enable_device(struct pci_dev *pdev) +static int cf_check intel_iommu_enable_device(struct pci_dev *pdev) { struct acpi_drhd_unit *drhd = acpi_find_matched_drhd_unit(pdev); int ret = drhd ? ats_device(pdev, drhd) : -ENODEV; @@ -2081,7 +2081,7 @@ static int intel_iommu_enable_device(struct pci_dev *pdev) return ret >= 0 ? 0 : ret; } -static int intel_iommu_remove_device(u8 devfn, struct pci_dev *pdev) +static int cf_check intel_iommu_remove_device(u8 devfn, struct pci_dev *pdev) { struct acpi_rmrr_unit *rmrr; u16 bdf; @@ -2108,7 +2108,8 @@ static int intel_iommu_remove_device(u8 devfn, struct pci_dev *pdev) return domain_context_unmap(pdev->domain, devfn, pdev); } -static int __hwdom_init setup_hwdom_device(u8 devfn, struct pci_dev *pdev) +static int __hwdom_init cf_check setup_hwdom_device( + u8 devfn, struct pci_dev *pdev) { return domain_context_mapping(pdev->domain, devfn, pdev); } @@ -2314,7 +2315,7 @@ static struct iommu_state { uint32_t fectl; } *__read_mostly iommu_state; -static int __init vtd_setup(void) +static int __init cf_check vtd_setup(void) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; @@ -2449,7 +2450,7 @@ static int __init vtd_setup(void) return ret; } -static int reassign_device_ownership( +static int cf_check reassign_device_ownership( struct domain *source, struct domain *target, u8 devfn, struct pci_dev *pdev) @@ -2527,7 +2528,7 @@ static int reassign_device_ownership( return ret; } -static int intel_iommu_assign_device( +static int cf_check intel_iommu_assign_device( struct domain *d, u8 devfn, struct pci_dev *pdev, u32 flag) { struct domain *s = pdev->domain; @@ -2609,7 +2610,7 @@ static int intel_iommu_assign_device( return ret; } -static int intel_iommu_group_id(u16 seg, u8 bus, u8 devfn) +static int cf_check intel_iommu_group_id(u16 seg, u8 bus, u8 devfn) { u8 secbus; if ( find_upstream_bridge(seg, &bus, &devfn, &secbus) < 0 ) @@ -2618,7 +2619,7 @@ static int intel_iommu_group_id(u16 seg, u8 bus, u8 devfn) return PCI_BDF2(bus, devfn); } -static int __must_check vtd_suspend(void) +static int __must_check cf_check vtd_suspend(void) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; @@ -2661,7 +2662,7 @@ static int __must_check vtd_suspend(void) return 0; } -static void vtd_crash_shutdown(void) +static void cf_check vtd_crash_shutdown(void) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; @@ -2682,7 +2683,7 @@ static void vtd_crash_shutdown(void) } } -static void vtd_resume(void) +static void cf_check vtd_resume(void) { struct acpi_drhd_unit *drhd; struct vtd_iommu *iommu; @@ -2760,7 +2761,7 @@ static void vtd_dump_page_table_level(paddr_t pt_maddr, int level, paddr_t gpa, unmap_vtd_domain_page(pt_vaddr); } -static void vtd_dump_page_tables(struct domain *d) +static void cf_check vtd_dump_page_tables(struct domain *d) { const struct domain_iommu *hd = dom_iommu(d); @@ -2770,7 +2771,7 @@ static void vtd_dump_page_tables(struct domain *d) agaw_to_level(hd->arch.vtd.agaw), 0, 0); } -static int __init intel_iommu_quarantine_init(struct domain *d) +static int __init cf_check intel_iommu_quarantine_init(struct domain *d) { struct domain_iommu *hd = dom_iommu(d); struct page_info *pg; diff --git a/xen/drivers/passthrough/vtd/qinval.c b/xen/drivers/passthrough/vtd/qinval.c index 9f291f47e518..beeb65f0deec 100644 --- a/xen/drivers/passthrough/vtd/qinval.c +++ b/xen/drivers/passthrough/vtd/qinval.c @@ -322,9 +322,9 @@ int iommu_flush_iec_index(struct vtd_iommu *iommu, u8 im, u16 iidx) return queue_invalidate_iec_sync(iommu, IEC_INDEX_INVL, im, iidx); } -static int __must_check flush_context_qi(struct vtd_iommu *iommu, u16 did, - u16 sid, u8 fm, u64 type, - bool flush_non_present_entry) +static int __must_check cf_check flush_context_qi( + struct vtd_iommu *iommu, u16 did, u16 sid, u8 fm, u64 type, + bool flush_non_present_entry) { ASSERT(iommu->qinval_maddr); @@ -346,11 +346,9 @@ static int __must_check flush_context_qi(struct vtd_iommu *iommu, u16 did, type >> DMA_CCMD_INVL_GRANU_OFFSET); } -static int __must_check flush_iotlb_qi(struct vtd_iommu *iommu, u16 did, - u64 addr, - unsigned int size_order, u64 type, - bool flush_non_present_entry, - bool flush_dev_iotlb) +static int __must_check cf_check flush_iotlb_qi( + struct vtd_iommu *iommu, u16 did, u64 addr, unsigned int size_order, + u64 type, bool flush_non_present_entry, bool flush_dev_iotlb) { u8 dr = 0, dw = 0; int ret = 0, rc; @@ -461,18 +459,18 @@ int enable_qinval(struct vtd_iommu *iommu) return 0; } -static int vtd_flush_context_noop(struct vtd_iommu *iommu, uint16_t did, - uint16_t source_id, uint8_t function_mask, - uint64_t type, bool flush_non_present_entry) +static int cf_check vtd_flush_context_noop( + struct vtd_iommu *iommu, uint16_t did, uint16_t source_id, + uint8_t function_mask, uint64_t type, bool flush_non_present_entry) { WARN(); return -EIO; } -static int vtd_flush_iotlb_noop(struct vtd_iommu *iommu, uint16_t did, - uint64_t addr, unsigned int size_order, - uint64_t type, bool flush_non_present_entry, - bool flush_dev_iotlb) +static int cf_check vtd_flush_iotlb_noop( + struct vtd_iommu *iommu, uint16_t did, uint64_t addr, + unsigned int size_order, uint64_t type, bool flush_non_present_entry, + bool flush_dev_iotlb) { WARN(); return -EIO; From patchwork Mon Feb 14 12:50:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745596 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 22446C433F5 for ; Mon, 14 Feb 2022 13:17:16 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271977.466753 (Exim 4.92) (envelope-from ) id 1nJbE2-0006Vu-Pi; Mon, 14 Feb 2022 13:17:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271977.466753; Mon, 14 Feb 2022 13:17:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbE2-0006VW-K4; Mon, 14 Feb 2022 13:17:06 +0000 Received: by outflank-mailman (input) for mailman id 271977; Mon, 14 Feb 2022 13:17:04 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4d-0008IH-H1 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:23 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0b791dfc-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:21 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0b791dfc-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844041; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=eqhKAymiA22/wB5PZk3BR4BeJKlUT2B+meSMBCt3MmU=; b=cpFSFB0Y6d6swQiujtITK9SsguSmgsaIDj9dd6Xpceg8NXh5iSw9viMS BwqVNgI5AC04Uz5BHTn7NXNkGBLiuzFdrlG45fB8OFN03xiBc3QJJN4Hg YeC9COwCJXP9HO4IB6CkOQp72n6SnGPx0REXQWqnL8twM8kB569LWyXOC 0=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: +E6Enw6kwx7WWxt+vv6po0BIihZjUYHGHfpjS5XIMAvcmcdh12ggcmN2kZipUmE0QjWWe9i9j3 HyJgdHhXRdaFYMK0qFjIlif5Bynr2nxfMpO8WZGSO2o4eZHUIOMIkIM+XGlLpTbo+1IHEytNNY +KaiB/akovSRepz1cbNPrWer1T+D82nSKjJW/huRNG3yV8syMoElL6Uv/fhp/zomF3xjqP/Hzb sPB0JGPk7aA7MJn1IlFwMwI6fzmK1wf0/+8PZzTGXt7gW2Aax7MpNontZL+mQ0A5bsPm+k3KrN q720fo+VRZGVn5Rx0DLjBfKf X-SBRS: 5.1 X-MesageID: 64554438 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:SLMNT631puw+7FO/kfbD5cp2kn2cJEfYwER7XKvMYLTBsI5bpzIBz mIbCGyAMqneZWb0fI8kb9uzpEIG6MPXyNFjTQVqpC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhudIyw vlPqpeLbgo3Ooj2tfpDSkBHKnQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u2p0TQaqFN 6L1bxJ/TEiaIDkTNm47L585juOJmV3/KwJX/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWTh/v6gGK8RNlkD EEK/g8UgLZs7RW0d4yoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3mH5unz6PLX05pjz+uYejiLeuYe9tGDOzgioRtf/dyOkM2 9oAZcaM1TtFV+jyPnve/YIJdAhYJnknH5Hm7cdQc7fbcAZhHWggDd7XwK8gJNM5z/gEyL+Q8 yHvQFJcxXr+mWbDdVeAZEd8Ze69Rp14t386Y3AhZA76x3g5bI+zx64DbJ9rL6I//eluwKcsH fkIcsmNGNpVTTHD92hPZJXxttU6Jh+qmRiPL2yuZz1mJ8xsQAnA+9nFeArz9XZRUnrr5JVm+ 7D5j1HVW5sOQQhmHf36UvP3wgPjp2UZlcJzQ1DMfotZdnLz/dU4MCf2lPI2fZ0BcE2R2juA2 g+KKh4Evu2R8ZQt+dzEiK3Y/YekF+xyQhhTE2XBtOvkMCDb+iyowJNaUfbOdjfYDTum9KKnb ORT7vf9LPxYwwoa79siS+5mnfAk+t/ih75G1QA1TnzEYmOiBq5kPnTbj9JEsbdAx+MBtAa7M q5VFgK25Vld1BvZLWMs IronPort-HdrOrdr: A9a23:opt64K0SypVTil+K/JqNtAqjBLAkLtp133Aq2lEZdPRUGvb3qy nOpoVj6faaslYssR0b9exofZPwJE80lqQFh7X5X43SPzUO0VHAROoJgLcKgQeQfxEWntQtsp uIGJIeNDSfNzdHZL7BkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554438" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 28/70] xen/video: CFI hardening Date: Mon, 14 Feb 2022 12:50:45 +0000 Message-ID: <20220214125127.17985-29-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/drivers/video/lfb.c | 4 ++-- xen/drivers/video/lfb.h | 4 ++-- xen/drivers/video/vesa.c | 4 ++-- xen/drivers/video/vga.c | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/xen/drivers/video/lfb.c b/xen/drivers/video/lfb.c index 75b749b3303b..48c66f8acf10 100644 --- a/xen/drivers/video/lfb.c +++ b/xen/drivers/video/lfb.c @@ -53,7 +53,7 @@ static void lfb_show_line( } /* Fast mode which redraws all modified parts of a 2D text buffer. */ -void lfb_redraw_puts(const char *s, size_t nr) +void cf_check lfb_redraw_puts(const char *s, size_t nr) { unsigned int i, min_redraw_y = lfb.ypos; @@ -98,7 +98,7 @@ void lfb_redraw_puts(const char *s, size_t nr) } /* Slower line-based scroll mode which interacts better with dom0. */ -void lfb_scroll_puts(const char *s, size_t nr) +void cf_check lfb_scroll_puts(const char *s, size_t nr) { unsigned int i; diff --git a/xen/drivers/video/lfb.h b/xen/drivers/video/lfb.h index e743ccdd6b11..42161402d611 100644 --- a/xen/drivers/video/lfb.h +++ b/xen/drivers/video/lfb.h @@ -35,8 +35,8 @@ struct lfb_prop { unsigned int text_rows; }; -void lfb_redraw_puts(const char *s, size_t nr); -void lfb_scroll_puts(const char *s, size_t nr); +void cf_check lfb_redraw_puts(const char *s, size_t nr); +void cf_check lfb_scroll_puts(const char *s, size_t nr); void lfb_carriage_return(void); void lfb_free(void); diff --git a/xen/drivers/video/vesa.c b/xen/drivers/video/vesa.c index cb0e443be4dd..155bc09d3237 100644 --- a/xen/drivers/video/vesa.c +++ b/xen/drivers/video/vesa.c @@ -17,7 +17,7 @@ #define vlfb_info vga_console_info.u.vesa_lfb -static void lfb_flush(void); +static void cf_check lfb_flush(void); static unsigned char *lfb; static const struct font_desc *font; @@ -177,7 +177,7 @@ void __init vesa_mtrr_init(void) } while ( (size_total >= PAGE_SIZE) && (rc == -EINVAL) ); } -static void lfb_flush(void) +static void cf_check lfb_flush(void) { if ( vesa_mtrr == 3 ) __asm__ __volatile__ ("sfence" : : : "memory"); diff --git a/xen/drivers/video/vga.c b/xen/drivers/video/vga.c index b7f04d0d97f4..abe295e477b1 100644 --- a/xen/drivers/video/vga.c +++ b/xen/drivers/video/vga.c @@ -19,8 +19,8 @@ static int vgacon_keep; static unsigned int xpos, ypos; static unsigned char *video; -static void vga_text_puts(const char *s, size_t nr); -static void vga_noop_puts(const char *s, size_t nr) {} +static void cf_check vga_text_puts(const char *s, size_t nr); +static void cf_check vga_noop_puts(const char *s, size_t nr) {} void (*video_puts)(const char *, size_t nr) = vga_noop_puts; /* @@ -175,7 +175,7 @@ void __init video_endboot(void) } } -static void vga_text_puts(const char *s, size_t nr) +static void cf_check vga_text_puts(const char *s, size_t nr) { for ( ; nr > 0; nr--, s++ ) { From patchwork Mon Feb 14 12:50:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745594 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AA457C433F5 for ; Mon, 14 Feb 2022 13:17:08 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271957.466731 (Exim 4.92) (envelope-from ) id 1nJbDu-0005LI-6C; Mon, 14 Feb 2022 13:16:58 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271957.466731; Mon, 14 Feb 2022 13:16:58 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDu-0005L3-1a; Mon, 14 Feb 2022 13:16:58 +0000 Received: by outflank-mailman (input) for mailman id 271957; Mon, 14 Feb 2022 13:16:57 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3b-0008IH-7q for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:19 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e5622eb6-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:17 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e5622eb6-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843977; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=lw78qzzzuiYAtb4DaXkKqrMnrmW0OepdLJjLyhv/BGI=; b=W9n8TYnjPjjYwOzqjane4XyVrnSWiI/J32ZALF4kLtTR4fno/J6EzjxR L5wXZQ76dYH1hv22eqrDnZof/g2b8nN8KUqgd7TlZAMRag05o0GRjGNtG 7SHbhu2EaK6k7f4SlQnCine7MTFP00nEI5hjLH2n5QXbkscNXlEXBnroV Y=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: GiZ73pqCSnaQswr4ErlANhPRz8vWxZokQs4C0FBQcFZXfCidf60HFdYdTd2usiV/4U3k7KkZj0 ZgqndL5rtOQOTlLuIhZY2QgsYcO5ZKhsO+7sAoXzTqD8M+AiC05Nb1xzhjaNqL9sLm6F613k5p EutSoSYZ0Jn6/SJNiwdLvkFPKhywz3hQ0iQbUeaXNzQimGc7Z0oO9fFNmqYfIjGokplOGfNcgZ E7snI3yZJ3Atgy0EZf1Z+uL61s1RG2QibSY94225E2N1x369piJQhUsORPDztGDywMupsc9WXH U+db3yoTiU8ThmrKHa8ySRA1 X-SBRS: 5.1 X-MesageID: 64149893 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:fa50kqLNV0ODhaYOFE+Rz5IlxSXFcZb7ZxGr2PjKsXjdYENS1jcOz jQeXW7UO/aMajf0LdBxbo6+pxsPvsXWyIBgGgdlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB2th45q8 8xGtKfsEyYQY7H2t/QBaANXRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Gls35wfTaeFD yYfQX00LwrHSg9qAAgwOoswk9+ZjHXjShQN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3OfuaeisVe1WukDc W0tpzYUgrguz1akG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspuNt2uVnrKNaY2y8kT85v1dNoufRVTpl CFax5TBvLBTUMnUz3blrAAx8FaBvajtDdEhqQQ3Q8lJG8qFpxZPgry8EBkhfRw0Y67oiBfiY VPJuBM52XOgFCDCUEODWKroU55C5fG5TbzND6mIBvITMskZXFLWp0lGOB/Pt10BZWBxyMnTz 7/AKp3yZZvbYIw6pAeLqxA1j+N6mHBmnTmLLX05pjz+uYejiLeuYe9tGDOzgioRsctoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:Qef3WKgwrG4UduGeoQJ/ya/4nnBQXtgji2hC6mlwRA09TySZ// rBoB17726MtN9/YhEdcLy7VJVoBEmskKKdgrNhW4tKPjOW21dARbsKheCJrgEIWReOktK1vZ 0QFJSWY+eQMbEVt6nHCXGDYrQd/OU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149893" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 29/70] xen/console: CFI hardening Date: Mon, 14 Feb 2022 12:50:46 +0000 Message-ID: <20220214125127.17985-30-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/drivers/char/console.c | 4 ++-- xen/drivers/char/ehci-dbgp.c | 24 +++++++++++++----------- xen/drivers/char/ns16550.c | 26 +++++++++++++------------- 3 files changed, 28 insertions(+), 26 deletions(-) diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c index 380765ab02fd..d9d6556c2293 100644 --- a/xen/drivers/char/console.c +++ b/xen/drivers/char/console.c @@ -552,7 +552,7 @@ static void __serial_rx(char c, struct cpu_user_regs *regs) #endif } -static void serial_rx(char c, struct cpu_user_regs *regs) +static void cf_check serial_rx(char c, struct cpu_user_regs *regs) { static int switch_code_count = 0; @@ -1286,7 +1286,7 @@ void panic(const char *fmt, ...) * ************************************************************** */ -static void suspend_steal_fn(const char *str, size_t nr) { } +static void cf_check suspend_steal_fn(const char *str, size_t nr) { } static int suspend_steal_id; int console_suspend(void) diff --git a/xen/drivers/char/ehci-dbgp.c b/xen/drivers/char/ehci-dbgp.c index a6b57fdf2d19..e205c0da6a61 100644 --- a/xen/drivers/char/ehci-dbgp.c +++ b/xen/drivers/char/ehci-dbgp.c @@ -1000,13 +1000,15 @@ static int ehci_dbgp_external_startup(struct ehci_dbgp *dbgp) typedef void (*set_debug_port_t)(struct ehci_dbgp *, unsigned int); -static void default_set_debug_port(struct ehci_dbgp *dbgp, unsigned int port) +static void cf_check default_set_debug_port( + struct ehci_dbgp *dbgp, unsigned int port) { } static set_debug_port_t __read_mostly set_debug_port = default_set_debug_port; -static void nvidia_set_debug_port(struct ehci_dbgp *dbgp, unsigned int port) +static void cf_check nvidia_set_debug_port( + struct ehci_dbgp *dbgp, unsigned int port) { uint32_t dword = pci_conf_read32(PCI_SBDF(0, dbgp->bus, dbgp->slot, dbgp->func), 0x74); @@ -1167,7 +1169,7 @@ static inline void _ehci_dbgp_flush(struct ehci_dbgp *dbgp) dbgp->out.chunk = 0; } -static void ehci_dbgp_flush(struct serial_port *port) +static void cf_check ehci_dbgp_flush(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; s_time_t goal; @@ -1196,7 +1198,7 @@ static void ehci_dbgp_flush(struct serial_port *port) set_timer(&dbgp->timer, goal); } -static void ehci_dbgp_putc(struct serial_port *port, char c) +static void cf_check ehci_dbgp_putc(struct serial_port *port, char c) { struct ehci_dbgp *dbgp = port->uart; @@ -1209,7 +1211,7 @@ static void ehci_dbgp_putc(struct serial_port *port, char c) ehci_dbgp_flush(port); } -static int ehci_dbgp_tx_ready(struct serial_port *port) +static int cf_check ehci_dbgp_tx_ready(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; @@ -1228,7 +1230,7 @@ static int ehci_dbgp_tx_ready(struct serial_port *port) (dbgp->state == dbgp_idle) * DBGP_MAX_PACKET; } -static int ehci_dbgp_getc(struct serial_port *port, char *pc) +static int cf_check ehci_dbgp_getc(struct serial_port *port, char *pc) { struct ehci_dbgp *dbgp = port->uart; @@ -1309,7 +1311,7 @@ static bool_t ehci_dbgp_setup_preirq(struct ehci_dbgp *dbgp) return 0; } -static void __init ehci_dbgp_init_preirq(struct serial_port *port) +static void __init cf_check ehci_dbgp_init_preirq(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; u32 debug_port, offset; @@ -1358,7 +1360,7 @@ static void ehci_dbgp_setup_postirq(struct ehci_dbgp *dbgp) set_timer(&dbgp->timer, NOW() + MILLISECS(1)); } -static void __init ehci_dbgp_init_postirq(struct serial_port *port) +static void __init cf_check ehci_dbgp_init_postirq(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; @@ -1409,12 +1411,12 @@ static int ehci_dbgp_check_release(struct ehci_dbgp *dbgp) return 0; } -static void __init ehci_dbgp_endboot(struct serial_port *port) +static void __init cf_check ehci_dbgp_endboot(struct serial_port *port) { ehci_dbgp_check_release(port->uart); } -static void ehci_dbgp_suspend(struct serial_port *port) +static void cf_check ehci_dbgp_suspend(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; @@ -1431,7 +1433,7 @@ static void ehci_dbgp_suspend(struct serial_port *port) dbgp->state = dbgp_unsafe; } -static void ehci_dbgp_resume(struct serial_port *port) +static void cf_check ehci_dbgp_resume(struct serial_port *port) { struct ehci_dbgp *dbgp = port->uart; diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 990cad39fe85..8df1ee4d5c2c 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -174,7 +174,7 @@ static void handle_dw_usr_busy_quirk(struct ns16550 *uart) } } -static void ns16550_interrupt( +static void cf_check ns16550_interrupt( int irq, void *dev_id, struct cpu_user_regs *regs) { struct serial_port *port = dev_id; @@ -239,7 +239,7 @@ static void cf_check ns16550_poll(void *data) #endif } -static int ns16550_tx_ready(struct serial_port *port) +static int cf_check ns16550_tx_ready(struct serial_port *port) { struct ns16550 *uart = port->uart; @@ -250,13 +250,13 @@ static int ns16550_tx_ready(struct serial_port *port) uart->lsr_mask ) == uart->lsr_mask ) ? uart->fifo_size : 0; } -static void ns16550_putc(struct serial_port *port, char c) +static void cf_check ns16550_putc(struct serial_port *port, char c) { struct ns16550 *uart = port->uart; ns_write_reg(uart, UART_THR, c); } -static int ns16550_getc(struct serial_port *port, char *pc) +static int cf_check ns16550_getc(struct serial_port *port, char *pc) { struct ns16550 *uart = port->uart; @@ -344,7 +344,7 @@ static void ns16550_setup_preirq(struct ns16550 *uart) UART_FCR_ENABLE | UART_FCR_CLRX | UART_FCR_CLTX | UART_FCR_TRG14); } -static void __init ns16550_init_preirq(struct serial_port *port) +static void __init cf_check ns16550_init_preirq(struct serial_port *port) { struct ns16550 *uart = port->uart; @@ -373,7 +373,7 @@ static void __init ns16550_init_preirq(struct serial_port *port) uart->fifo_size = 16; } -static void __init ns16550_init_irq(struct serial_port *port) +static void __init cf_check ns16550_init_irq(struct serial_port *port) { #ifdef NS16550_PCI struct ns16550 *uart = port->uart; @@ -399,7 +399,7 @@ static void ns16550_setup_postirq(struct ns16550 *uart) set_timer(&uart->timer, NOW() + MILLISECS(uart->timeout_ms)); } -static void __init ns16550_init_postirq(struct serial_port *port) +static void __init cf_check ns16550_init_postirq(struct serial_port *port) { struct ns16550 *uart = port->uart; int rc, bits; @@ -491,7 +491,7 @@ static void __init ns16550_init_postirq(struct serial_port *port) ns16550_setup_postirq(uart); } -static void ns16550_suspend(struct serial_port *port) +static void cf_check ns16550_suspend(struct serial_port *port) { struct ns16550 *uart = port->uart; @@ -543,7 +543,7 @@ static void cf_check ns16550_delayed_resume(void *data) _ns16550_resume(port); } -static void ns16550_resume(struct serial_port *port) +static void cf_check ns16550_resume(struct serial_port *port) { struct ns16550 *uart = port->uart; @@ -569,7 +569,7 @@ static void ns16550_resume(struct serial_port *port) _ns16550_resume(port); } -static void __init ns16550_endboot(struct serial_port *port) +static void __init cf_check ns16550_endboot(struct serial_port *port) { #ifdef CONFIG_HAS_IOPORTS struct ns16550 *uart = port->uart; @@ -583,13 +583,13 @@ static void __init ns16550_endboot(struct serial_port *port) #endif } -static int __init ns16550_irq(struct serial_port *port) +static int __init cf_check ns16550_irq(struct serial_port *port) { struct ns16550 *uart = port->uart; return ((uart->irq > 0) ? uart->irq : -1); } -static void ns16550_start_tx(struct serial_port *port) +static void cf_check ns16550_start_tx(struct serial_port *port) { struct ns16550 *uart = port->uart; u8 ier = ns_read_reg(uart, UART_IER); @@ -599,7 +599,7 @@ static void ns16550_start_tx(struct serial_port *port) ns_write_reg(uart, UART_IER, ier | UART_IER_ETHREI); } -static void ns16550_stop_tx(struct serial_port *port) +static void cf_check ns16550_stop_tx(struct serial_port *port) { struct ns16550 *uart = port->uart; u8 ier = ns_read_reg(uart, UART_IER); From patchwork Mon Feb 14 12:50:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F0CBDC433F5 for ; Mon, 14 Feb 2022 13:16:57 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271941.466698 (Exim 4.92) (envelope-from ) id 1nJbDj-0003zP-SG; Mon, 14 Feb 2022 13:16:47 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271941.466698; Mon, 14 Feb 2022 13:16:47 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDj-0003zG-NB; Mon, 14 Feb 2022 13:16:47 +0000 Received: by outflank-mailman (input) for mailman id 271941; Mon, 14 Feb 2022 13:16:46 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4F-0008IH-Cc for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:59 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id fb8b33b2-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:57 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: fb8b33b2-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844017; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Mej6N2PECBXwwElk/AVZTwxR6YCdehxfIEnvABetLnE=; b=ddeI0GA2NG5fEWunYEzgTst/T8YrJGF9ORjC6WsJgcnZRIHmGnk1bsYf nX++QGlZTrF7JHs4C7gm0m7BNAOqiXX4R+hLJsWqLG+ZlCYJ8TS5hIqwN dL5jN2YgI/MCGUlAklebq7fl6ZWZ7s4ofnlzU10VNmK8KIIRBQagStXHq 8=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 4xuPf0XVUbXgWG0v6rS7g0s9+dMqxffyXCBK0hrLTCa9u6ylaVMULtaJR697DxZ6PVle1cTTxw TvPZ0va8h/gcdAZVeV0Xrf9VMKnAHJJ1pmGwIN1Gj1H3fMDV0XyP6XUqeqVaWOuVPHr/3qr4mM veLJ/OBXAePlVJQsIaSPCTBUUEmCxz2/Li/xfaJJnPv2fUAOdr/uNL0UMr1S4mEyMX4urIR/vT e4iESUp8TmMacNBHMQcSsLPUhTz0kX/LDFR8wPt+ktMnXRB4kU4aRR/f8IXzXf9ZITLFfIVrIY +beXpwySc4UuVvYd3FHWPpI7 X-SBRS: 5.1 X-MesageID: 64554298 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:qTxo7qpaha/Fuq7jhrFlBmk6T4leBmIAYhIvgKrLsJaIsI4StFCzt garIBmHO6yJZmunLtBxOY+zpBgFu8TXxoQyHlNprC03RntBp5uZCYyVIHmrMnLJJKUvbq7GA +byyDXkBJppJpMJjk71atANlZT4vE2xbuKU5NTsY0idfic5Dndx4f5fs7Rh2NQw24HlW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCnbbqRw15FKeVoedDTisHOSVAPu5/qZaSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O ZZENGY1PUSojxtnPVgGGI0UwvmTi0b5UQZF+WOJvvMNyj2GpOB2+Oe0a4eEEjCQfu1Fk0Ddq m/Y8mDRBhABKMfZ2TeD6mirhOLEgWX8Qo16KVGj3qc02hvJnDVVUUBIEwvgyRWktqKgc/gFJ UZE0CB3lKts6X70ZN3DXF6B8VfR63bwROFsO+E97QiMzI/d7ACYGnUIQ1Z9VTA2iCMlbWd0j wHUxrsFERQq6eTIEizFqt94uBvvYXB9EIMUWcMToeLpCfHHqZp7sB/AR80L/EWd3oysQmGYL 9xnQUEDa1QvYSwjiv/TEbPv2WvESn31oukdvFu/Y45dxlklDLNJnqTxgbQh0d5OLZyCUn6Kt 2Uels6V4YgmVM/RyHPdELhQROjyvZ5p1QEwZnY1QfEcG8mFoSb/Lei8HhkiTKuWDir0UWCwO xKC0e+gzJRSIGGrfcdKj3GZUKwXIVzbPY29DJj8N4MWCrAoLVPv1Hw+NCa4gjG2+GBxwP5XB HtuWZv1ZZrsIf88l2TeqiZ0+eJD+x3SMkuNGcGln0z/i+L2ibz8Ye5tDWZip9sRtMusyDg5O f4FbJPiJ8x3XLKsby/J35QUKFxWf3E3CYqv855cd/KZIxogE2YkUqeDzbQkco1jvqJUiuaXo S3tBh4GkALy1S/dNAGHSnF/c7ezD5xxmm02YH43NlGy1nl9PYv2tPUDd4E6dKUM/fB4yaImV OEMfsiNW6wdSjnO9zkHQ4P6qYhuKEaiiQ6UZnL3azkjZZ9wAQfO/4a8LAfo8SAPCAuxtNc// OL8hl+KH8JbSl07XsjMaf+pw1eghlQnmbp/DxnSP91eWETw64w2eSb/ueA6fpMXIhLZyzrEi wvPWUUEpfPAqpMe+cXSgfzWtJ+gFuZzExYIH2Tf6rrqZyDW8nD6nN1FWeeMOzvcSHn16OOpY uAMl6PwN/gOnVBrtYtgEuk0kfJitoW3/7IKnB55GHjrbkiwDuIyK3aL6sBDq6lRy+ILogCxQ E+OpoFXNLjh1BkJy7LNyN7Jtti+6Mw= IronPort-HdrOrdr: A9a23:9CJNna6Vyk/F5eKSygPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554298" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 30/70] xen/misc: CFI hardening Date: Mon, 14 Feb 2022 12:50:47 +0000 Message-ID: <20220214125127.17985-31-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/mm.c | 6 ++++-- xen/arch/x86/setup.c | 4 ++-- xen/common/domain.c | 2 +- xen/common/gdbstub.c | 5 ++--- xen/common/livepatch.c | 7 +++---- xen/common/memory.c | 4 ++-- xen/common/page_alloc.c | 2 +- xen/common/radix-tree.c | 4 ++-- xen/common/rangeset.c | 2 +- xen/common/spinlock.c | 6 +++--- xen/common/vm_event.c | 6 +++--- xen/common/xmalloc_tlsf.c | 4 ++-- xen/drivers/passthrough/amd/iommu_init.c | 2 +- 13 files changed, 27 insertions(+), 27 deletions(-) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 3b8bc3dda977..4b6956c5be78 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -835,7 +835,8 @@ struct mmio_emul_range_ctxt { unsigned long mfn; }; -static int print_mmio_emul_range(unsigned long s, unsigned long e, void *arg) +static int cf_check print_mmio_emul_range( + unsigned long s, unsigned long e, void *arg) { const struct mmio_emul_range_ctxt *ctxt = arg; @@ -4606,7 +4607,8 @@ static int _handle_iomem_range(unsigned long s, unsigned long e, return 0; } -static int handle_iomem_range(unsigned long s, unsigned long e, void *p) +static int cf_check handle_iomem_range( + unsigned long s, unsigned long e, void *p) { int err = 0; diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index eceff0a4e2b4..735f69d2cae8 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -2023,8 +2023,8 @@ int __hwdom_init xen_in_range(unsigned long mfn) return 0; } -static int __hwdom_init io_bitmap_cb(unsigned long s, unsigned long e, - void *ctx) +static int __hwdom_init cf_check io_bitmap_cb( + unsigned long s, unsigned long e, void *ctx) { struct domain *d = ctx; unsigned int i; diff --git a/xen/common/domain.c b/xen/common/domain.c index a49c26064601..a3614539e472 100644 --- a/xen/common/domain.c +++ b/xen/common/domain.c @@ -370,7 +370,7 @@ static void cf_check _free_pirq_struct(struct rcu_head *head) xfree(container_of(head, struct pirq, rcu_head)); } -static void free_pirq_struct(void *ptr) +static void cf_check free_pirq_struct(void *ptr) { struct pirq *pirq = ptr; diff --git a/xen/common/gdbstub.c b/xen/common/gdbstub.c index 079c3ca9616a..d6872721dc0d 100644 --- a/xen/common/gdbstub.c +++ b/xen/common/gdbstub.c @@ -69,7 +69,7 @@ static void gdb_smp_resume(void); static char __initdata opt_gdb[30]; string_param("gdb", opt_gdb); -static void gdbstub_console_puts(const char *str, size_t nr); +static void cf_check gdbstub_console_puts(const char *str, size_t nr); /* value <-> char (de)serialzers */ static char @@ -546,8 +546,7 @@ __gdb_ctx = { }; static struct gdb_context *gdb_ctx = &__gdb_ctx; -static void -gdbstub_console_puts(const char *str, size_t nr) +static void cf_check gdbstub_console_puts(const char *str, size_t nr) { const char *p; diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c index e8714920dc8f..ec301a9f120c 100644 --- a/xen/common/livepatch.c +++ b/xen/common/livepatch.c @@ -157,10 +157,9 @@ unsigned long livepatch_symbols_lookup_by_name(const char *symname) return 0; } -static const char *livepatch_symbols_lookup(unsigned long addr, - unsigned long *symbolsize, - unsigned long *offset, - char *namebuf) +static const char *cf_check livepatch_symbols_lookup( + unsigned long addr, unsigned long *symbolsize, unsigned long *offset, + char *namebuf) { const struct payload *data; unsigned int i, best; diff --git a/xen/common/memory.c b/xen/common/memory.c index ede45c4af9db..69b0cd1e50de 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -1051,8 +1051,8 @@ struct get_reserved_device_memory { unsigned int used_entries; }; -static int get_reserved_device_memory(xen_pfn_t start, xen_ulong_t nr, - u32 id, void *ctxt) +static int cf_check get_reserved_device_memory( + xen_pfn_t start, xen_ulong_t nr, u32 id, void *ctxt) { struct get_reserved_device_memory *grdm = ctxt; uint32_t sbdf = PCI_SBDF3(grdm->map.dev.pci.seg, grdm->map.dev.pci.bus, diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c index 3caf5c954b24..46357182375a 100644 --- a/xen/common/page_alloc.c +++ b/xen/common/page_alloc.c @@ -1238,7 +1238,7 @@ struct scrub_wait_state { bool drop; }; -static void scrub_continue(void *data) +static void cf_check scrub_continue(void *data) { struct scrub_wait_state *st = data; diff --git a/xen/common/radix-tree.c b/xen/common/radix-tree.c index 33b47748ae49..adc3034222dc 100644 --- a/xen/common/radix-tree.c +++ b/xen/common/radix-tree.c @@ -52,7 +52,7 @@ struct rcu_node { struct rcu_head rcu_head; }; -static struct radix_tree_node *rcu_node_alloc(void *arg) +static struct radix_tree_node *cf_check rcu_node_alloc(void *arg) { struct rcu_node *rcu_node = xmalloc(struct rcu_node); return rcu_node ? &rcu_node->node : NULL; @@ -65,7 +65,7 @@ static void cf_check _rcu_node_free(struct rcu_head *head) xfree(rcu_node); } -static void rcu_node_free(struct radix_tree_node *node, void *arg) +static void cf_check rcu_node_free(struct radix_tree_node *node, void *arg) { struct rcu_node *rcu_node = container_of(node, struct rcu_node, node); call_rcu(&rcu_node->rcu_head, _rcu_node_free); diff --git a/xen/common/rangeset.c b/xen/common/rangeset.c index 885b6b15c229..a6ef2640462a 100644 --- a/xen/common/rangeset.c +++ b/xen/common/rangeset.c @@ -384,7 +384,7 @@ int rangeset_consume_ranges(struct rangeset *r, return rc; } -static int merge(unsigned long s, unsigned long e, void *data) +static int cf_check merge(unsigned long s, unsigned long e, void *data) { struct rangeset *r = data; diff --git a/xen/common/spinlock.c b/xen/common/spinlock.c index 25bfbf3c47f7..62c83aaa6a73 100644 --- a/xen/common/spinlock.c +++ b/xen/common/spinlock.c @@ -375,7 +375,7 @@ static void spinlock_profile_iterate(lock_profile_subfunc *sub, void *par) spin_unlock(&lock_profile_lock); } -static void spinlock_profile_print_elem(struct lock_profile *data, +static void cf_check spinlock_profile_print_elem(struct lock_profile *data, int32_t type, int32_t idx, void *par) { struct spinlock *lock = data->lock; @@ -404,7 +404,7 @@ void cf_check spinlock_profile_printall(unsigned char key) spinlock_profile_iterate(spinlock_profile_print_elem, NULL); } -static void spinlock_profile_reset_elem(struct lock_profile *data, +static void cf_check spinlock_profile_reset_elem(struct lock_profile *data, int32_t type, int32_t idx, void *par) { data->lock_cnt = 0; @@ -428,7 +428,7 @@ typedef struct { int rc; } spinlock_profile_ucopy_t; -static void spinlock_profile_ucopy_elem(struct lock_profile *data, +static void cf_check spinlock_profile_ucopy_elem(struct lock_profile *data, int32_t type, int32_t idx, void *par) { spinlock_profile_ucopy_t *p = par; diff --git a/xen/common/vm_event.c b/xen/common/vm_event.c index 70ab3ba406ff..84cf52636bc4 100644 --- a/xen/common/vm_event.c +++ b/xen/common/vm_event.c @@ -523,21 +523,21 @@ int __vm_event_claim_slot(struct domain *d, struct vm_event_domain *ved, #ifdef CONFIG_MEM_PAGING /* Registered with Xen-bound event channel for incoming notifications. */ -static void mem_paging_notification(struct vcpu *v, unsigned int port) +static void cf_check mem_paging_notification(struct vcpu *v, unsigned int port) { vm_event_resume(v->domain, v->domain->vm_event_paging); } #endif /* Registered with Xen-bound event channel for incoming notifications. */ -static void monitor_notification(struct vcpu *v, unsigned int port) +static void cf_check monitor_notification(struct vcpu *v, unsigned int port) { vm_event_resume(v->domain, v->domain->vm_event_monitor); } #ifdef CONFIG_MEM_SHARING /* Registered with Xen-bound event channel for incoming notifications. */ -static void mem_sharing_notification(struct vcpu *v, unsigned int port) +static void cf_check mem_sharing_notification(struct vcpu *v, unsigned int port) { vm_event_resume(v->domain, v->domain->vm_event_share); } diff --git a/xen/common/xmalloc_tlsf.c b/xen/common/xmalloc_tlsf.c index e3f6886e6b62..d2ad909502d0 100644 --- a/xen/common/xmalloc_tlsf.c +++ b/xen/common/xmalloc_tlsf.c @@ -512,13 +512,13 @@ int xmem_pool_maxalloc(struct xmem_pool *pool) static struct xmem_pool *xenpool; -static void *xmalloc_pool_get(unsigned long size) +static void *cf_check xmalloc_pool_get(unsigned long size) { ASSERT(size == PAGE_SIZE); return alloc_xenheap_page(); } -static void xmalloc_pool_put(void *p) +static void cf_check xmalloc_pool_put(void *p) { free_xenheap_page(p); } diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index 06b4d2b1fea0..cebcd68a6c04 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -1073,7 +1073,7 @@ static void * __init allocate_ppr_log(struct amd_iommu *iommu) #define IVRS_MAPPINGS_DEVTAB(m) (m)[ivrs_bdf_entries].intremap_table /* Gets passed to radix_tree_destroy(), so its param needs to be void *. */ -static void __init free_ivrs_mapping_callback(void *ptr) +static void __init cf_check free_ivrs_mapping_callback(void *ptr) { const struct ivrs_mappings *ivrs_mappings = ptr; From patchwork Mon Feb 14 12:50:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745601 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 05A13C433FE for ; Mon, 14 Feb 2022 13:18:00 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272035.466808 (Exim 4.92) (envelope-from ) id 1nJbEg-0001x9-A1; Mon, 14 Feb 2022 13:17:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272035.466808; Mon, 14 Feb 2022 13:17:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEg-0001wp-6E; Mon, 14 Feb 2022 13:17:46 +0000 Received: by outflank-mailman (input) for mailman id 272035; Mon, 14 Feb 2022 13:17:44 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4Z-0008IH-4W for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:19 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 0890dc7a-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:16 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 0890dc7a-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844036; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=RYqgg8QK5itpM+XCRkfvVJsrwtwu9tubXMHtrNs746Q=; b=QK/0VjMuIxrS6x9Jav8P4J6khlt1ooWda58GbgwSGQ/qBpnibFNcQlEK wT07bd/rFDzEqFYFvGpjL+bcepQw9Pz7M09bOEj7PktBTLfVlH+Usl2go UTOjMmAcbZeQbOfk1IvgFS6x4KCoGLWkOlVEw1zkr8WKtFv0F8AOrvyFW Q=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 3cxq+WvPrVyp8Ps5hBhq5AfaZE+hRs39an1GJ3H6OqM8n/SsUOrpp4PAwWf7q5/FqFGO8ay5+X 2eeULrVFhDpRFlTXmnLPUyOHiyooK/R6rDoZ7mHgEnCVS+DNGaPBk3z+apMPELNdbd5WrSkoqi 6WG0lZnvq0bjLHJDdQ79EbJ5YOloWoe7BQb7aTKpOUI7mGaK46mOKlVOSD3wVKefYM72SbrIl1 6nUPFn7s0Ow9o1u2TmfMCrNeVEIHlHHjBOd9UJZDSVHuLfzLHm1NuFipUeAR0Cb9stq6il8ka9 lfQogxRSDVrhvTe7zPqqZfwM X-SBRS: 5.1 X-MesageID: 64554399 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:QPcKvqN3qyICkKDvrR29kMFynXyQoLVcMsEvi/4bfWQNrUoh0GRTx mAWUWuGM/2CYjenKIt/Ydm09koGsZCBmN5rSAto+SlhQUwRpJueD7x1DKtR0wB+jCHnZBg6h ynLQoCYdKjYdpJYz/uUGuCJQUNUjMlkfZKhTr6UUsxNbVU8En1500s/w7dRbrNA2rBVPSvc4 bsenOWHULOV82Yc3rU8sv/rRLtH5ZweiRtA1rAMTakjUGz2zhH5OKk3N6CpR0YUd6EPdgKMq 0Qv+5nilo/R109F5tpICd8XeGVSKlLZFVDmZna7x8FOK/WNz8A/+v9TCRYSVatYoxykj+lD+ NZBjrGXcF07Yq/KvbkMYxYNRkmSPYUekFPGCX22sMjVxEzaaXr8hf5pCSnaP6VBpLwxWzsXs 6VFdnZdNXhvhMrvqF6/YsBqit4uM4/AO4QHt2s75TrYEewnUdbIRKCiCdpwgmtt25wVTKe2i 8wxankwXTjaTkNzOk5OD7M0m+2Hhlr/bGgNwL6SjfVuuDWCpOBr65D9PdyQdtGUSMF9mkeDu nmA72n/GgsdNtGU1XyC6H3EuwPUtXqlAsRITuT+r6M0xg3IroAONPEIfXKWscCLuk2yYP94E hYGpigoiPUjxEP+G7ERQCaEiHKDuxcdXf9ZHOs79ByBx8Lo3uqJOoQXZmUfMYJ77afaURRvj wbUxI2xWVSDpZXIESr1y1uCkd+l1cH5x0cmbDRMcwYK6sKLTGob3kOWFYYL/EJYY7TI9dDML 9Ki8XJWa1Y715djO0CHEbfv2WzEm3QxZlRpjjg7p0r8hu+DWKarZpaz9X/Q5utaIYCSQzGp5 SZYx5fOvL1TVcjWzkRhpdnh+5nzuZ643MD02wYzT/HNCRzxk5JcQWygyG4nfxo4Wir1UTTof FXSqWtsCGx7ZxOXgVtMS9vpUawClPG4ffy8D6y8RoceM/BZKV7clAkzNBH44owYuBV1+U3JE czAKpjE4LdzIfkP8QdasM9Dje51lnhmnzu7qFKS503P7IdyrUW9Ed8tWGZipMhgsvPsTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:Tn1MEavEYcXo+qMACPcGz/BZ7skDdNV00zEX/kB9WHVpmszxra 6TdZUgpGbJYVkqOE3I9ertBEDEewK4yXcX2/h2AV7BZniEhILAFugLhuGO/9SjIVybygc079 YGT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554399" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 31/70] x86: CFI hardening for request_irq() Date: Mon, 14 Feb 2022 12:50:48 +0000 Message-ID: <20220214125127.17985-32-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 ... and friends; alloc_direct_apic_vector() and set_direct_apic_vector(). Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/apic.c | 8 ++++---- xen/arch/x86/cpu/mcheck/mce_intel.c | 4 ++-- xen/arch/x86/guest/xen/xen.c | 2 +- xen/arch/x86/hpet.c | 4 ++-- xen/arch/x86/hvm/vmx/vmx.c | 4 ++-- xen/arch/x86/include/asm/irq.h | 16 ++++++++-------- xen/arch/x86/irq.c | 2 +- xen/arch/x86/smp.c | 6 +++--- xen/arch/x86/time.c | 3 ++- xen/drivers/passthrough/amd/iommu_init.c | 4 ++-- xen/drivers/passthrough/vtd/iommu.c | 4 ++-- 11 files changed, 29 insertions(+), 28 deletions(-) diff --git a/xen/arch/x86/apic.c b/xen/arch/x86/apic.c index 68e4d870c749..5a7a58dc9830 100644 --- a/xen/arch/x86/apic.c +++ b/xen/arch/x86/apic.c @@ -1361,7 +1361,7 @@ int reprogram_timer(s_time_t timeout) return apic_tmict || !timeout; } -void apic_timer_interrupt(struct cpu_user_regs * regs) +void cf_check apic_timer_interrupt(struct cpu_user_regs *regs) { ack_APIC_irq(); perfc_incr(apic_timer); @@ -1380,7 +1380,7 @@ void smp_send_state_dump(unsigned int cpu) /* * Spurious interrupts should _never_ happen with our APIC/SMP architecture. */ -void spurious_interrupt(struct cpu_user_regs *regs) +void cf_check spurious_interrupt(struct cpu_user_regs *regs) { /* * Check if this is a vectored interrupt (most likely, as this is probably @@ -1411,7 +1411,7 @@ void spurious_interrupt(struct cpu_user_regs *regs) * This interrupt should never happen with our APIC/SMP architecture */ -void error_interrupt(struct cpu_user_regs *regs) +void cf_check error_interrupt(struct cpu_user_regs *regs) { static const char *const esr_fields[] = { "Send CS error", @@ -1444,7 +1444,7 @@ void error_interrupt(struct cpu_user_regs *regs) * This interrupt handles performance counters interrupt */ -void pmu_apic_interrupt(struct cpu_user_regs *regs) +void cf_check pmu_apic_interrupt(struct cpu_user_regs *regs) { ack_APIC_irq(); vpmu_do_interrupt(regs); diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index a691e10bdcd6..7aaa56fd02eb 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -55,7 +55,7 @@ bool __read_mostly lmce_support; #define MCE_RING 0x1 static DEFINE_PER_CPU(int, last_state); -static void intel_thermal_interrupt(struct cpu_user_regs *regs) +static void cf_check intel_thermal_interrupt(struct cpu_user_regs *regs) { uint64_t msr_content; unsigned int cpu = smp_processor_id(); @@ -639,7 +639,7 @@ static void cpu_mcheck_disable(void) clear_cmci(); } -static void cmci_interrupt(struct cpu_user_regs *regs) +static void cf_check cmci_interrupt(struct cpu_user_regs *regs) { mctelem_cookie_t mctc; struct mca_summary bs; diff --git a/xen/arch/x86/guest/xen/xen.c b/xen/arch/x86/guest/xen/xen.c index b2aa3a009b4a..17807cdea688 100644 --- a/xen/arch/x86/guest/xen/xen.c +++ b/xen/arch/x86/guest/xen/xen.c @@ -170,7 +170,7 @@ static void __init init_memmap(void) } } -static void xen_evtchn_upcall(struct cpu_user_regs *regs) +static void cf_check xen_evtchn_upcall(struct cpu_user_regs *regs) { struct vcpu_info *vcpu_info = this_cpu(vcpu_info); unsigned long pending; diff --git a/xen/arch/x86/hpet.c b/xen/arch/x86/hpet.c index 7b009a930498..c31fd97579dc 100644 --- a/xen/arch/x86/hpet.c +++ b/xen/arch/x86/hpet.c @@ -240,8 +240,8 @@ static void handle_hpet_broadcast(struct hpet_event_channel *ch) } } -static void hpet_interrupt_handler(int irq, void *data, - struct cpu_user_regs *regs) +static void cf_check hpet_interrupt_handler( + int irq, void *data, struct cpu_user_regs *regs) { struct hpet_event_channel *ch = data; diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index 36c8a12cfe7d..dade08f60279 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -2533,7 +2533,7 @@ static struct hvm_function_table __initdata vmx_function_table = { }; /* Handle VT-d posted-interrupt when VCPU is blocked. */ -static void pi_wakeup_interrupt(struct cpu_user_regs *regs) +static void cf_check pi_wakeup_interrupt(struct cpu_user_regs *regs) { struct vmx_vcpu *vmx, *tmp; spinlock_t *lock = &per_cpu(vmx_pi_blocking, smp_processor_id()).lock; @@ -2565,7 +2565,7 @@ static void pi_wakeup_interrupt(struct cpu_user_regs *regs) } /* Handle VT-d posted-interrupt when VCPU is running. */ -static void pi_notification_interrupt(struct cpu_user_regs *regs) +static void cf_check pi_notification_interrupt(struct cpu_user_regs *regs) { ack_APIC_irq(); this_cpu(irq_count)++; diff --git a/xen/arch/x86/include/asm/irq.h b/xen/arch/x86/include/asm/irq.h index 7c825e9d9c0a..b3f49abc5556 100644 --- a/xen/arch/x86/include/asm/irq.h +++ b/xen/arch/x86/include/asm/irq.h @@ -93,14 +93,14 @@ static inline struct cpu_user_regs *set_irq_regs(struct cpu_user_regs *new_regs) #define platform_legacy_irq(irq) ((irq) < 16) -void event_check_interrupt(struct cpu_user_regs *regs); -void invalidate_interrupt(struct cpu_user_regs *regs); -void call_function_interrupt(struct cpu_user_regs *regs); -void apic_timer_interrupt(struct cpu_user_regs *regs); -void error_interrupt(struct cpu_user_regs *regs); -void pmu_apic_interrupt(struct cpu_user_regs *regs); -void spurious_interrupt(struct cpu_user_regs *regs); -void irq_move_cleanup_interrupt(struct cpu_user_regs *regs); +void cf_check event_check_interrupt(struct cpu_user_regs *regs); +void cf_check invalidate_interrupt(struct cpu_user_regs *regs); +void cf_check call_function_interrupt(struct cpu_user_regs *regs); +void cf_check apic_timer_interrupt(struct cpu_user_regs *regs); +void cf_check error_interrupt(struct cpu_user_regs *regs); +void cf_check pmu_apic_interrupt(struct cpu_user_regs *regs); +void cf_check spurious_interrupt(struct cpu_user_regs *regs); +void cf_check irq_move_cleanup_interrupt(struct cpu_user_regs *regs); uint8_t alloc_hipriority_vector(void); diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index f43b926ed26b..61e09a356f97 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -744,7 +744,7 @@ void move_native_irq(struct irq_desc *desc) desc->handler->enable(desc); } -void irq_move_cleanup_interrupt(struct cpu_user_regs *regs) +void cf_check irq_move_cleanup_interrupt(struct cpu_user_regs *regs) { unsigned vector, me; diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c index b9a696f61963..33748e629a21 100644 --- a/xen/arch/x86/smp.c +++ b/xen/arch/x86/smp.c @@ -246,7 +246,7 @@ static cpumask_t flush_cpumask; static const void *flush_va; static unsigned int flush_flags; -void invalidate_interrupt(struct cpu_user_regs *regs) +void cf_check invalidate_interrupt(struct cpu_user_regs *regs) { unsigned int flags = flush_flags; ack_APIC_irq(); @@ -385,14 +385,14 @@ void smp_send_nmi_allbutself(void) send_IPI_mask(&cpu_online_map, APIC_DM_NMI); } -void event_check_interrupt(struct cpu_user_regs *regs) +void cf_check event_check_interrupt(struct cpu_user_regs *regs) { ack_APIC_irq(); perfc_incr(ipis); this_cpu(irq_count)++; } -void call_function_interrupt(struct cpu_user_regs *regs) +void cf_check call_function_interrupt(struct cpu_user_regs *regs) { ack_APIC_irq(); perfc_incr(ipis); diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 3d767d70f61f..b6e690b76fab 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -196,7 +196,8 @@ static void smp_send_timer_broadcast_ipi(void) } } -static void timer_interrupt(int irq, void *dev_id, struct cpu_user_regs *regs) +static void cf_check timer_interrupt( + int irq, void *dev_id, struct cpu_user_regs *regs) { ASSERT(local_irq_is_enabled()); diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index cebcd68a6c04..d2ad282e93d3 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -715,8 +715,8 @@ static void cf_check do_amd_iommu_irq(void *unused) } } -static void iommu_interrupt_handler(int irq, void *dev_id, - struct cpu_user_regs *regs) +static void cf_check iommu_interrupt_handler( + int irq, void *dev_id, struct cpu_user_regs *regs) { unsigned long flags; struct amd_iommu *iommu = dev_id; diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 4d7703dd9a20..fc3ff064b692 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1117,8 +1117,8 @@ static void cf_check do_iommu_page_fault(void *unused) __do_iommu_page_fault(drhd->iommu); } -static void iommu_page_fault(int irq, void *dev_id, - struct cpu_user_regs *regs) +static void cf_check iommu_page_fault( + int irq, void *dev_id, struct cpu_user_regs *regs) { /* * Just flag the tasklet as runnable. This is fine, according to VT-d From patchwork Mon Feb 14 12:50:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745549 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C7097C4332F for ; Mon, 14 Feb 2022 13:05:02 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271641.466169 (Exim 4.92) (envelope-from ) id 1nJb26-0008IU-En; Mon, 14 Feb 2022 13:04:46 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271641.466169; Mon, 14 Feb 2022 13:04:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb26-0008IN-Bm; Mon, 14 Feb 2022 13:04:46 +0000 Received: by outflank-mailman (input) for mailman id 271641; Mon, 14 Feb 2022 13:04:45 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb25-0008IH-3o for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:45 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ab3fc353-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:41 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ab3fc353-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843881; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=9SBKCVUVoHZcNlwGQnO2XD67JHVChjedlbYxSb50LOk=; b=eBPHaNCZ6xkpzoqdSSp9ZWbW/RYWnI2qk3xncD9FmzoYsU8Xq2SyiO11 QMfC6EQVum9eiK3uHEUXsYFHB3fq52/S+hD9MJAQKp24/SHGhSszzWhtX S4kv5/edDPmIuM6yFGp46QS3znWMR6AZMQl1nivEYfmjWUGY1orSIpo42 Y=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: AgAiKrOfsWqmF2MNEfQDzVivIVdmtYdBCm7OfPoGIiWZxQaBsmyXuX8alQ+NOI5jMf6y9mJ9e8 hj4BbNKMC7YR1fKmr4PuyvKmsJZ0AYtayqdDawFugkoMJDoJjB8Gjbo8zvji+iAL04OaZwmMWn b2BuuAJ4MZOL391mKq8zYZFi1Ja7B9f3/00AVsJOvVD7MuLvZzJb+3/0faVX/I99bjVSL36HoR C8eAlx+5hRGAdux6FBfxdsbF4ZUfm7wqTKJBEb3A1/8u8Asarxr8pE/h7vqWi6P6QX3XVRKGuc VJ6QKOpijtShA65p5e5a77Wk X-SBRS: 5.1 X-MesageID: 64050477 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:80eQFqsR2Hxyzl3t7rds+EZjAefnVEhZMUV32f8akzHdYApBsoF/q tZmKWqHOPqPMWGkfY9zb9m+9koBsJLUzII2Ggpu/CFhES8W+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Nplk7++TQwXF/z2gqcNQxN0OSQ9BYgX0eqSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AO 5JEMWYwM3wsZTVTAVolOqhkm9yvnyL1cWN+mFzIqvQotj27IAtZj+G2bYu9lsaxbdVYmAOUq 3zL+0z9AwoGL5qPxDyd6HWui+TT2yThV+ov+KaQr6AwxgfJnypKVUNQBQDTTeSFZlCWffFRL 0cq03sUt+si5EaHZNy+ZzjpiSvR1vIDYOZ4H+o/4QCL76Pb5QeFG2QJJgJ8hMwaWNweHmJzi ALQ9z/9LXk26eDOFyrBnluBhW7qYUAowXk+iTjopOfvy/3qu8kNgx3GVb6P+4bl34SuSVkcL 91nxRXSZon/b+ZWjc1XHnid2lpAQ6QlqSZvuG3qspqNtF8RWWJcT9XABaLnxfhBNp2FaVKKo WIJncOThMhXU83Ry3zdHbhVRerzjxpgDNE7qQQxd6TNChz3oyLzFWyuyG0WyLhV3jYsJmayP R67VfJ5755PJnq6BZKbkKrqY/nGOZPITIy/PtiNN4ImSsEoKGevoXE/DWbNjjuFuBV9zskC1 WKzLJ/E4YAyUv88klJbho41jNcW+8zJ7T2PFM6rl0z9idJzphe9EN84DbdHVchhhIvsnekf2 4032xKix0oNXevgTDPQ9IJPf1kGIWJiXcL9qtBNd/7FKQ1jQTlzB/jUyLInWopkg6UKybuYo iDjAhdVmAjlmHnKCQSWcXQ/Ornhaoly8CAgNis2MFf2h3V6OdSz7L0SfoccdKU88LAx1uZ9S vQIIp3SAvlGRjnd1S4aaJ3x8N5reBix3FrcNCu5ejkvOZVnQlWRqNPjewLu8ggIDza26pRi8 +HxiFuDTMNaFQp4DcvQZPa+9H+LvCAQyLBoQk/FAthPY0GwooJkHDP8060sKMYWJBSdmjbDj 1SKAQ0VrPXmqpMu9IWbnriNqoqkHrcsHkdeGGWHv7+6OTODozimyI5EFu2JYSrcRCX//6D7P bdZyPT1MfsmmldWstUjT+Y3nPxmv9a/9aVHyglEHWnQawX5A7xtFXCKwM1Tu/Af3bReowa3B hqC99Qy1W9l4y85/Ir9/DYYU9k= IronPort-HdrOrdr: A9a23:crUzMKxrAi9bksQpKGTXKrPwLr1zdoMgy1knxilNoRw8SKKlfq GV7Y0mPHDP6Ar5NEtNpTnEAtjkfZq+z+8S3WByB8bAYOCOggLBR+sO0WKh+UyFJ8SXzJ876U 4KSclD4bPLYmSS9fyKgjWFLw== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050477" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 32/70] x86/hvm: CFI hardening for hvm_funcs Date: Mon, 14 Feb 2022 12:50:49 +0000 Message-ID: <20220214125127.17985-33-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. In svm.c, make a few rearrangements. svm_update_guest_cr() has no external callers so can become static, but needs moving along with svm_fpu_enter() to avoid a forward declaration. Move svm_fpu_leave() too, to match. Also move svm_update_guest_efer() to drop its forward declaration. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- v2: * Move svm_fpu_leave() too. --- xen/arch/x86/hvm/svm/nestedsvm.c | 22 +- xen/arch/x86/hvm/svm/svm.c | 390 ++++++++++++++------------- xen/arch/x86/hvm/vmx/intr.c | 2 +- xen/arch/x86/hvm/vmx/vmcs.c | 8 +- xen/arch/x86/hvm/vmx/vmx.c | 143 +++++----- xen/arch/x86/hvm/vmx/vvmx.c | 16 +- xen/arch/x86/include/asm/hvm/svm/nestedsvm.h | 18 +- xen/arch/x86/include/asm/hvm/svm/svm.h | 1 - xen/arch/x86/include/asm/hvm/vmx/vmcs.h | 8 +- xen/arch/x86/include/asm/hvm/vmx/vmx.h | 2 +- xen/arch/x86/include/asm/hvm/vmx/vvmx.h | 18 +- 11 files changed, 320 insertions(+), 308 deletions(-) diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c index abc178d8d482..9f5f35f16aff 100644 --- a/xen/arch/x86/hvm/svm/nestedsvm.c +++ b/xen/arch/x86/hvm/svm/nestedsvm.c @@ -80,7 +80,7 @@ int nestedsvm_vmcb_map(struct vcpu *v, uint64_t vmcbaddr) } /* Interface methods */ -int nsvm_vcpu_initialise(struct vcpu *v) +int cf_check nsvm_vcpu_initialise(struct vcpu *v) { void *msrpm; struct nestedvcpu *nv = &vcpu_nestedhvm(v); @@ -110,7 +110,7 @@ int nsvm_vcpu_initialise(struct vcpu *v) return -ENOMEM; } -void nsvm_vcpu_destroy(struct vcpu *v) +void cf_check nsvm_vcpu_destroy(struct vcpu *v) { struct nestedvcpu *nv = &vcpu_nestedhvm(v); struct nestedsvm *svm = &vcpu_nestedsvm(v); @@ -150,7 +150,7 @@ void nsvm_vcpu_destroy(struct vcpu *v) svm->ns_iomap = NULL; } -int nsvm_vcpu_reset(struct vcpu *v) +int cf_check nsvm_vcpu_reset(struct vcpu *v) { struct nestedsvm *svm = &vcpu_nestedsvm(v); @@ -855,8 +855,8 @@ nsvm_vcpu_vmexit_inject(struct vcpu *v, struct cpu_user_regs *regs, return 0; } -int -nsvm_vcpu_vmexit_event(struct vcpu *v, const struct x86_event *trap) +int cf_check nsvm_vcpu_vmexit_event( + struct vcpu *v, const struct x86_event *trap) { ASSERT(vcpu_nestedhvm(v).nv_vvmcx != NULL); @@ -865,7 +865,7 @@ nsvm_vcpu_vmexit_event(struct vcpu *v, const struct x86_event *trap) return NESTEDHVM_VMEXIT_DONE; } -uint64_t nsvm_vcpu_hostcr3(struct vcpu *v) +uint64_t cf_check nsvm_vcpu_hostcr3(struct vcpu *v) { return vcpu_nestedsvm(v).ns_vmcb_hostcr3; } @@ -1030,8 +1030,7 @@ nsvm_vmcb_guest_intercepts_exitcode(struct vcpu *v, return 1; } -bool_t -nsvm_vmcb_guest_intercepts_event( +bool cf_check nsvm_vmcb_guest_intercepts_event( struct vcpu *v, unsigned int vector, int errcode) { return nsvm_vmcb_guest_intercepts_exitcode(v, @@ -1206,8 +1205,7 @@ nsvm_vmcb_prepare4vmexit(struct vcpu *v, struct cpu_user_regs *regs) return 0; } -bool_t -nsvm_vmcb_hap_enabled(struct vcpu *v) +bool cf_check nsvm_vmcb_hap_enabled(struct vcpu *v) { return vcpu_nestedsvm(v).ns_hap_enabled; } @@ -1216,7 +1214,7 @@ nsvm_vmcb_hap_enabled(struct vcpu *v) * walk is successful, the translated value is returned in * L1_gpa. The result value tells what to do next. */ -int nsvm_hap_walk_L1_p2m( +int cf_check nsvm_hap_walk_L1_p2m( struct vcpu *v, paddr_t L2_gpa, paddr_t *L1_gpa, unsigned int *page_order, uint8_t *p2m_acc, struct npfec npfec) { @@ -1241,7 +1239,7 @@ int nsvm_hap_walk_L1_p2m( return NESTEDHVM_PAGEFAULT_DONE; } -enum hvm_intblk nsvm_intr_blocked(struct vcpu *v) +enum hvm_intblk cf_check nsvm_intr_blocked(struct vcpu *v) { struct nestedsvm *svm = &vcpu_nestedsvm(v); struct nestedvcpu *nv = &vcpu_nestedhvm(v); diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index c4ce3f75ab74..de6166241bf1 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -67,8 +67,6 @@ void noreturn svm_asm_do_resume(void); u32 svm_feature_flags; -static void svm_update_guest_efer(struct vcpu *); - static struct hvm_function_table svm_function_table; /* @@ -122,11 +120,166 @@ void __update_guest_eip(struct cpu_user_regs *regs, unsigned int inst_len) hvm_inject_hw_exception(TRAP_debug, X86_EVENT_NO_EC); } -static void svm_cpu_down(void) +static void cf_check svm_cpu_down(void) { write_efer(read_efer() & ~EFER_SVME); } +static void svm_fpu_enter(struct vcpu *v) +{ + struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx; + + vcpu_restore_fpu_lazy(v); + vmcb_set_exception_intercepts( + n1vmcb, + vmcb_get_exception_intercepts(n1vmcb) & ~(1U << TRAP_no_device)); +} + +static void cf_check svm_fpu_leave(struct vcpu *v) +{ + struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx; + + ASSERT(!v->fpu_dirtied); + ASSERT(read_cr0() & X86_CR0_TS); + + /* + * If the guest does not have TS enabled then we must cause and handle an + * exception on first use of the FPU. If the guest *does* have TS enabled + * then this is not necessary: no FPU activity can occur until the guest + * clears CR0.TS, and we will initialise the FPU when that happens. + */ + if ( !(v->arch.hvm.guest_cr[0] & X86_CR0_TS) ) + { + vmcb_set_exception_intercepts( + n1vmcb, + vmcb_get_exception_intercepts(n1vmcb) | (1U << TRAP_no_device)); + vmcb_set_cr0(n1vmcb, vmcb_get_cr0(n1vmcb) | X86_CR0_TS); + } +} + +static void cf_check svm_update_guest_cr( + struct vcpu *v, unsigned int cr, unsigned int flags) +{ + struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; + uint64_t value; + + switch ( cr ) + { + case 0: + { + unsigned long hw_cr0_mask = 0; + + if ( !(v->arch.hvm.guest_cr[0] & X86_CR0_TS) ) + { + if ( v != current ) + { + if ( !v->arch.fully_eager_fpu ) + hw_cr0_mask |= X86_CR0_TS; + } + else if ( vmcb_get_cr0(vmcb) & X86_CR0_TS ) + svm_fpu_enter(v); + } + + if ( paging_mode_hap(v->domain) ) + { + uint32_t intercepts = vmcb_get_cr_intercepts(vmcb); + + /* Trap CR3 updates if CR3 memory events are enabled. */ + if ( v->domain->arch.monitor.write_ctrlreg_enabled & + monitor_ctrlreg_bitmask(VM_EVENT_X86_CR3) ) + vmcb_set_cr_intercepts(vmcb, intercepts | CR_INTERCEPT_CR3_WRITE); + } + + value = v->arch.hvm.guest_cr[0] | hw_cr0_mask; + if ( !paging_mode_hap(v->domain) ) + value |= X86_CR0_PG | X86_CR0_WP; + vmcb_set_cr0(vmcb, value); + break; + } + case 2: + vmcb_set_cr2(vmcb, v->arch.hvm.guest_cr[2]); + break; + case 3: + vmcb_set_cr3(vmcb, v->arch.hvm.hw_cr[3]); + if ( !nestedhvm_enabled(v->domain) ) + { + if ( !(flags & HVM_UPDATE_GUEST_CR3_NOFLUSH) ) + hvm_asid_flush_vcpu(v); + } + else if ( nestedhvm_vmswitch_in_progress(v) ) + ; /* CR3 switches during VMRUN/VMEXIT do not flush the TLB. */ + else if ( !(flags & HVM_UPDATE_GUEST_CR3_NOFLUSH) ) + hvm_asid_flush_vcpu_asid( + nestedhvm_vcpu_in_guestmode(v) + ? &vcpu_nestedhvm(v).nv_n2asid : &v->arch.hvm.n1asid); + break; + case 4: + value = HVM_CR4_HOST_MASK; + if ( paging_mode_hap(v->domain) ) + value &= ~X86_CR4_PAE; + value |= v->arch.hvm.guest_cr[4]; + + if ( !hvm_paging_enabled(v) ) + { + /* + * When the guest thinks paging is disabled, Xen may need to hide + * the effects of shadow paging, as hardware runs with the host + * paging settings, rather than the guests settings. + * + * Without CR0.PG, all memory accesses are user mode, so + * _PAGE_USER must be set in the shadow pagetables for guest + * userspace to function. This in turn trips up guest supervisor + * mode if SMEP/SMAP are left active in context. They wouldn't + * have any effect if paging was actually disabled, so hide them + * behind the back of the guest. + */ + value &= ~(X86_CR4_SMEP | X86_CR4_SMAP); + } + + vmcb_set_cr4(vmcb, value); + break; + default: + BUG(); + } +} + +static void cf_check svm_update_guest_efer(struct vcpu *v) +{ + struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; + unsigned long guest_efer = v->arch.hvm.guest_efer, + xen_efer = read_efer(); + + if ( paging_mode_shadow(v->domain) ) + { + /* EFER.NX is a Xen-owned bit and is not under guest control. */ + guest_efer &= ~EFER_NXE; + guest_efer |= xen_efer & EFER_NXE; + + /* + * CR0.PG is a Xen-owned bit, and remains set even when the guest has + * logically disabled paging. + * + * LMA was calculated using the guest CR0.PG setting, but LME needs + * clearing to avoid interacting with Xen's CR0.PG setting. As writes + * to CR0 are intercepted, it is safe to leave LME clear at this + * point, and fix up both LME and LMA when CR0.PG is set. + */ + if ( !(guest_efer & EFER_LMA) ) + guest_efer &= ~EFER_LME; + } + + /* SVME must remain set in non-root mode. */ + guest_efer |= EFER_SVME; + + vmcb_set_efer(vmcb, guest_efer); + + ASSERT(nestedhvm_enabled(v->domain) || + !(v->arch.hvm.guest_efer & EFER_SVME)); + + if ( nestedhvm_enabled(v->domain) ) + svm_nested_features_on_efer_update(v); +} + unsigned long * svm_msrbit(unsigned long *msr_bitmap, uint32_t msr) { @@ -165,7 +318,7 @@ void svm_intercept_msr(struct vcpu *v, uint32_t msr, int flags) __clear_bit(msr * 2 + 1, msr_bit); } -static void svm_enable_msr_interception(struct domain *d, uint32_t msr) +static void cf_check svm_enable_msr_interception(struct domain *d, uint32_t msr) { struct vcpu *v; @@ -377,13 +530,13 @@ static void svm_load_cpu_state(struct vcpu *v, struct hvm_hw_cpu *data) svm_update_guest_efer(v); } -static void svm_save_vmcb_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) +static void cf_check svm_save_vmcb_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) { svm_save_cpu_state(v, ctxt); svm_vmcb_save(v, ctxt); } -static int svm_load_vmcb_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) +static int cf_check svm_load_vmcb_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) { svm_load_cpu_state(v, ctxt); if ( svm_vmcb_restore(v, ctxt) ) @@ -396,39 +549,7 @@ static int svm_load_vmcb_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) return 0; } -static void svm_fpu_enter(struct vcpu *v) -{ - struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx; - - vcpu_restore_fpu_lazy(v); - vmcb_set_exception_intercepts( - n1vmcb, - vmcb_get_exception_intercepts(n1vmcb) & ~(1U << TRAP_no_device)); -} - -static void svm_fpu_leave(struct vcpu *v) -{ - struct vmcb_struct *n1vmcb = vcpu_nestedhvm(v).nv_n1vmcx; - - ASSERT(!v->fpu_dirtied); - ASSERT(read_cr0() & X86_CR0_TS); - - /* - * If the guest does not have TS enabled then we must cause and handle an - * exception on first use of the FPU. If the guest *does* have TS enabled - * then this is not necessary: no FPU activity can occur until the guest - * clears CR0.TS, and we will initialise the FPU when that happens. - */ - if ( !(v->arch.hvm.guest_cr[0] & X86_CR0_TS) ) - { - vmcb_set_exception_intercepts( - n1vmcb, - vmcb_get_exception_intercepts(n1vmcb) | (1U << TRAP_no_device)); - vmcb_set_cr0(n1vmcb, vmcb_get_cr0(n1vmcb) | X86_CR0_TS); - } -} - -static unsigned int svm_get_interrupt_shadow(struct vcpu *v) +static unsigned cf_check int svm_get_interrupt_shadow(struct vcpu *v) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; unsigned int intr_shadow = 0; @@ -442,7 +563,8 @@ static unsigned int svm_get_interrupt_shadow(struct vcpu *v) return intr_shadow; } -static void svm_set_interrupt_shadow(struct vcpu *v, unsigned int intr_shadow) +static void cf_check svm_set_interrupt_shadow( + struct vcpu *v, unsigned int intr_shadow) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; u32 general1_intercepts = vmcb_get_general1_intercepts(vmcb); @@ -456,7 +578,7 @@ static void svm_set_interrupt_shadow(struct vcpu *v, unsigned int intr_shadow) vmcb_set_general1_intercepts(vmcb, general1_intercepts); } -static int svm_guest_x86_mode(struct vcpu *v) +static int cf_check svm_guest_x86_mode(struct vcpu *v) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -469,129 +591,7 @@ static int svm_guest_x86_mode(struct vcpu *v) return likely(vmcb->cs.db) ? 4 : 2; } -void svm_update_guest_cr(struct vcpu *v, unsigned int cr, unsigned int flags) -{ - struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; - uint64_t value; - - switch ( cr ) - { - case 0: - { - unsigned long hw_cr0_mask = 0; - - if ( !(v->arch.hvm.guest_cr[0] & X86_CR0_TS) ) - { - if ( v != current ) - { - if ( !v->arch.fully_eager_fpu ) - hw_cr0_mask |= X86_CR0_TS; - } - else if ( vmcb_get_cr0(vmcb) & X86_CR0_TS ) - svm_fpu_enter(v); - } - - if ( paging_mode_hap(v->domain) ) - { - uint32_t intercepts = vmcb_get_cr_intercepts(vmcb); - - /* Trap CR3 updates if CR3 memory events are enabled. */ - if ( v->domain->arch.monitor.write_ctrlreg_enabled & - monitor_ctrlreg_bitmask(VM_EVENT_X86_CR3) ) - vmcb_set_cr_intercepts(vmcb, intercepts | CR_INTERCEPT_CR3_WRITE); - } - - value = v->arch.hvm.guest_cr[0] | hw_cr0_mask; - if ( !paging_mode_hap(v->domain) ) - value |= X86_CR0_PG | X86_CR0_WP; - vmcb_set_cr0(vmcb, value); - break; - } - case 2: - vmcb_set_cr2(vmcb, v->arch.hvm.guest_cr[2]); - break; - case 3: - vmcb_set_cr3(vmcb, v->arch.hvm.hw_cr[3]); - if ( !nestedhvm_enabled(v->domain) ) - { - if ( !(flags & HVM_UPDATE_GUEST_CR3_NOFLUSH) ) - hvm_asid_flush_vcpu(v); - } - else if ( nestedhvm_vmswitch_in_progress(v) ) - ; /* CR3 switches during VMRUN/VMEXIT do not flush the TLB. */ - else if ( !(flags & HVM_UPDATE_GUEST_CR3_NOFLUSH) ) - hvm_asid_flush_vcpu_asid( - nestedhvm_vcpu_in_guestmode(v) - ? &vcpu_nestedhvm(v).nv_n2asid : &v->arch.hvm.n1asid); - break; - case 4: - value = HVM_CR4_HOST_MASK; - if ( paging_mode_hap(v->domain) ) - value &= ~X86_CR4_PAE; - value |= v->arch.hvm.guest_cr[4]; - - if ( !hvm_paging_enabled(v) ) - { - /* - * When the guest thinks paging is disabled, Xen may need to hide - * the effects of shadow paging, as hardware runs with the host - * paging settings, rather than the guests settings. - * - * Without CR0.PG, all memory accesses are user mode, so - * _PAGE_USER must be set in the shadow pagetables for guest - * userspace to function. This in turn trips up guest supervisor - * mode if SMEP/SMAP are left active in context. They wouldn't - * have any effect if paging was actually disabled, so hide them - * behind the back of the guest. - */ - value &= ~(X86_CR4_SMEP | X86_CR4_SMAP); - } - - vmcb_set_cr4(vmcb, value); - break; - default: - BUG(); - } -} - -static void svm_update_guest_efer(struct vcpu *v) -{ - struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; - unsigned long guest_efer = v->arch.hvm.guest_efer, - xen_efer = read_efer(); - - if ( paging_mode_shadow(v->domain) ) - { - /* EFER.NX is a Xen-owned bit and is not under guest control. */ - guest_efer &= ~EFER_NXE; - guest_efer |= xen_efer & EFER_NXE; - - /* - * CR0.PG is a Xen-owned bit, and remains set even when the guest has - * logically disabled paging. - * - * LMA was calculated using the guest CR0.PG setting, but LME needs - * clearing to avoid interacting with Xen's CR0.PG setting. As writes - * to CR0 are intercepted, it is safe to leave LME clear at this - * point, and fix up both LME and LMA when CR0.PG is set. - */ - if ( !(guest_efer & EFER_LMA) ) - guest_efer &= ~EFER_LME; - } - - /* SVME must remain set in non-root mode. */ - guest_efer |= EFER_SVME; - - vmcb_set_efer(vmcb, guest_efer); - - ASSERT(nestedhvm_enabled(v->domain) || - !(v->arch.hvm.guest_efer & EFER_SVME)); - - if ( nestedhvm_enabled(v->domain) ) - svm_nested_features_on_efer_update(v); -} - -static void svm_cpuid_policy_changed(struct vcpu *v) +static void cf_check svm_cpuid_policy_changed(struct vcpu *v) { struct svm_vcpu *svm = &v->arch.hvm.svm; struct vmcb_struct *vmcb = svm->vmcb; @@ -636,13 +636,13 @@ void svm_sync_vmcb(struct vcpu *v, enum vmcb_sync_state new_state) } } -static unsigned int svm_get_cpl(struct vcpu *v) +static unsigned int cf_check svm_get_cpl(struct vcpu *v) { return vmcb_get_cpl(v->arch.hvm.svm.vmcb); } -static void svm_get_segment_register(struct vcpu *v, enum x86_segment seg, - struct segment_register *reg) +static void cf_check svm_get_segment_register( + struct vcpu *v, enum x86_segment seg, struct segment_register *reg) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -686,8 +686,8 @@ static void svm_get_segment_register(struct vcpu *v, enum x86_segment seg, } } -static void svm_set_segment_register(struct vcpu *v, enum x86_segment seg, - struct segment_register *reg) +static void cf_check svm_set_segment_register( + struct vcpu *v, enum x86_segment seg, struct segment_register *reg) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -756,12 +756,12 @@ static void svm_set_segment_register(struct vcpu *v, enum x86_segment seg, } } -static unsigned long svm_get_shadow_gs_base(struct vcpu *v) +static unsigned long cf_check svm_get_shadow_gs_base(struct vcpu *v) { return v->arch.hvm.svm.vmcb->kerngsbase; } -static int svm_set_guest_pat(struct vcpu *v, u64 gpat) +static int cf_check svm_set_guest_pat(struct vcpu *v, u64 gpat) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -772,7 +772,7 @@ static int svm_set_guest_pat(struct vcpu *v, u64 gpat) return 1; } -static int svm_get_guest_pat(struct vcpu *v, u64 *gpat) +static int cf_check svm_get_guest_pat(struct vcpu *v, u64 *gpat) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -820,7 +820,7 @@ static uint64_t svm_get_tsc_offset(uint64_t host_tsc, uint64_t guest_tsc, return guest_tsc - scale_tsc(host_tsc, ratio); } -static void svm_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) +static void cf_check svm_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; struct vmcb_struct *n1vmcb, *n2vmcb; @@ -856,7 +856,7 @@ static void svm_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) vmcb_set_tsc_offset(vmcb, offset + n2_tsc_offset); } -static void svm_set_rdtsc_exiting(struct vcpu *v, bool_t enable) +static void cf_check svm_set_rdtsc_exiting(struct vcpu *v, bool enable) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; u32 general1_intercepts = vmcb_get_general1_intercepts(vmcb); @@ -875,7 +875,8 @@ static void svm_set_rdtsc_exiting(struct vcpu *v, bool_t enable) vmcb_set_general2_intercepts(vmcb, general2_intercepts); } -static void svm_set_descriptor_access_exiting(struct vcpu *v, bool enable) +static void cf_check svm_set_descriptor_access_exiting( + struct vcpu *v, bool enable) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; u32 general1_intercepts = vmcb_get_general1_intercepts(vmcb); @@ -892,7 +893,7 @@ static void svm_set_descriptor_access_exiting(struct vcpu *v, bool enable) vmcb_set_general1_intercepts(vmcb, general1_intercepts); } -static unsigned int svm_get_insn_bytes(struct vcpu *v, uint8_t *buf) +static unsigned int cf_check svm_get_insn_bytes(struct vcpu *v, uint8_t *buf) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; unsigned int len = v->arch.hvm.svm.cached_insn_len; @@ -907,7 +908,7 @@ static unsigned int svm_get_insn_bytes(struct vcpu *v, uint8_t *buf) return len; } -static void svm_init_hypercall_page(void *p) +static void cf_check svm_init_hypercall_page(void *p) { unsigned int i; @@ -1148,7 +1149,7 @@ static int acpi_c1e_quirk(int dir, unsigned int port, unsigned int bytes, return X86EMUL_OKAY; } -static int svm_domain_initialise(struct domain *d) +static int cf_check svm_domain_initialise(struct domain *d) { static const struct arch_csw csw = { .from = svm_ctxt_switch_from, @@ -1166,7 +1167,7 @@ static int svm_domain_initialise(struct domain *d) return 0; } -static int svm_vcpu_initialise(struct vcpu *v) +static int cf_check svm_vcpu_initialise(struct vcpu *v) { int rc; @@ -1183,7 +1184,7 @@ static int svm_vcpu_initialise(struct vcpu *v) return 0; } -static void svm_vcpu_destroy(struct vcpu *v) +static void cf_check svm_vcpu_destroy(struct vcpu *v) { svm_destroy_vmcb(v); passive_domain_destroy(v); @@ -1304,7 +1305,7 @@ static void svm_emul_swint_injection(struct x86_event *event) event->error_code = ec; } -static void svm_inject_event(const struct x86_event *event) +static void cf_check svm_inject_event(const struct x86_event *event) { struct vcpu *curr = current; struct vmcb_struct *vmcb = curr->arch.hvm.svm.vmcb; @@ -1434,12 +1435,12 @@ static void svm_inject_event(const struct x86_event *event) HVMTRACE_2D(INJ_EXC, _event.vector, _event.error_code); } -static bool svm_event_pending(const struct vcpu *v) +static bool cf_check svm_event_pending(const struct vcpu *v) { return v->arch.hvm.svm.vmcb->event_inj.v; } -static void svm_cpu_dead(unsigned int cpu) +static void cf_check svm_cpu_dead(unsigned int cpu) { paddr_t *this_hsa = &per_cpu(hsa, cpu); paddr_t *this_vmcb = &per_cpu(host_vmcb, cpu); @@ -1465,7 +1466,7 @@ static void svm_cpu_dead(unsigned int cpu) } } -static int svm_cpu_up_prepare(unsigned int cpu) +static int cf_check svm_cpu_up_prepare(unsigned int cpu) { paddr_t *this_hsa = &per_cpu(hsa, cpu); paddr_t *this_vmcb = &per_cpu(host_vmcb, cpu); @@ -1620,7 +1621,7 @@ static int _svm_cpu_up(bool bsp) return 0; } -static int svm_cpu_up(void) +static int cf_check svm_cpu_up(void) { return _svm_cpu_up(false); } @@ -1749,7 +1750,7 @@ static void svm_do_nested_pgfault(struct vcpu *v, domain_crash(v->domain); } -static void svm_fpu_dirty_intercept(void) +static void cf_check svm_fpu_dirty_intercept(void) { struct vcpu *v = current; struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -1795,7 +1796,8 @@ static void svm_dr_access(struct vcpu *v, struct cpu_user_regs *regs) __restore_debug_registers(vmcb, v); } -static int svm_msr_read_intercept(unsigned int msr, uint64_t *msr_content) +static int cf_check svm_msr_read_intercept( + unsigned int msr, uint64_t *msr_content) { struct vcpu *v = current; const struct domain *d = v->domain; @@ -1990,7 +1992,8 @@ static int svm_msr_read_intercept(unsigned int msr, uint64_t *msr_content) return X86EMUL_EXCEPTION; } -static int svm_msr_write_intercept(unsigned int msr, uint64_t msr_content) +static int cf_check svm_msr_write_intercept( + unsigned int msr, uint64_t msr_content) { struct vcpu *v = current; struct domain *d = v->domain; @@ -2409,7 +2412,7 @@ static void svm_vmexit_mce_intercept( } } -static void svm_wbinvd_intercept(void) +static void cf_check svm_wbinvd_intercept(void) { if ( cache_flush_permitted(current->domain) ) flush_all(FLUSH_CACHE); @@ -2454,12 +2457,13 @@ static bool is_invlpg(const struct x86_emulate_state *state, (ext & 7) == 7; } -static void svm_invlpg(struct vcpu *v, unsigned long linear) +static void cf_check svm_invlpg(struct vcpu *v, unsigned long linear) { svm_asid_g_invlpg(v, linear); } -static bool svm_get_pending_event(struct vcpu *v, struct x86_event *info) +static bool cf_check svm_get_pending_event( + struct vcpu *v, struct x86_event *info) { const struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; @@ -2473,7 +2477,7 @@ static bool svm_get_pending_event(struct vcpu *v, struct x86_event *info) return true; } -static uint64_t svm_get_reg(struct vcpu *v, unsigned int reg) +static uint64_t cf_check svm_get_reg(struct vcpu *v, unsigned int reg) { const struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; struct domain *d = v->domain; @@ -2491,7 +2495,7 @@ static uint64_t svm_get_reg(struct vcpu *v, unsigned int reg) } } -static void svm_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) +static void cf_check svm_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; struct domain *d = v->domain; diff --git a/xen/arch/x86/hvm/vmx/intr.c b/xen/arch/x86/hvm/vmx/intr.c index 80bfbb478782..13bbe8430df5 100644 --- a/xen/arch/x86/hvm/vmx/intr.c +++ b/xen/arch/x86/hvm/vmx/intr.c @@ -147,7 +147,7 @@ static void vmx_enable_intr_window(struct vcpu *v, struct hvm_intack intack) * used but may have negative impact on interrupt performance. */ -enum hvm_intblk nvmx_intr_blocked(struct vcpu *v) +enum hvm_intblk cf_check nvmx_intr_blocked(struct vcpu *v) { int r = hvm_intblk_none; struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index d2cafd8ca1c5..60b506ac3f40 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -655,7 +655,7 @@ void vmx_vmcs_reload(struct vcpu *v) vmx_load_vmcs(v); } -int vmx_cpu_up_prepare(unsigned int cpu) +int cf_check vmx_cpu_up_prepare(unsigned int cpu) { /* * If nvmx_cpu_up_prepare() failed, do not return failure and just fallback @@ -676,7 +676,7 @@ int vmx_cpu_up_prepare(unsigned int cpu) return -ENOMEM; } -void vmx_cpu_dead(unsigned int cpu) +void cf_check vmx_cpu_dead(unsigned int cpu) { vmx_free_vmcs(per_cpu(vmxon_region, cpu)); per_cpu(vmxon_region, cpu) = 0; @@ -774,12 +774,12 @@ static int _vmx_cpu_up(bool bsp) return 0; } -int vmx_cpu_up() +int cf_check vmx_cpu_up() { return _vmx_cpu_up(false); } -void vmx_cpu_down(void) +void cf_check vmx_cpu_down(void) { struct list_head *active_vmcs_list = &this_cpu(active_vmcs_list); unsigned long flags; diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index dade08f60279..2c4804f9b884 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -68,14 +68,16 @@ static void vmx_ctxt_switch_to(struct vcpu *v); static int alloc_vlapic_mapping(void); static void vmx_install_vlapic_mapping(struct vcpu *v); -static void vmx_update_guest_cr(struct vcpu *v, unsigned int cr, - unsigned int flags); -static void vmx_update_guest_efer(struct vcpu *v); -static void vmx_wbinvd_intercept(void); -static void vmx_fpu_dirty_intercept(void); -static int vmx_msr_read_intercept(unsigned int msr, uint64_t *msr_content); -static int vmx_msr_write_intercept(unsigned int msr, uint64_t msr_content); -static void vmx_invlpg(struct vcpu *v, unsigned long linear); +static void cf_check vmx_update_guest_cr( + struct vcpu *v, unsigned int cr, unsigned int flags); +static void cf_check vmx_update_guest_efer(struct vcpu *v); +static void cf_check vmx_wbinvd_intercept(void); +static void cf_check vmx_fpu_dirty_intercept(void); +static int cf_check vmx_msr_read_intercept( + unsigned int msr, uint64_t *msr_content); +static int cf_check vmx_msr_write_intercept( + unsigned int msr, uint64_t msr_content); +static void cf_check vmx_invlpg(struct vcpu *v, unsigned long linear); static mfn_t __read_mostly apic_access_mfn = INVALID_MFN_INITIALIZER; @@ -103,7 +105,7 @@ void vmx_pi_per_cpu_init(unsigned int cpu) spin_lock_init(&per_cpu(vmx_pi_blocking, cpu).lock); } -static void vmx_vcpu_block(struct vcpu *v) +static void cf_check vmx_vcpu_block(struct vcpu *v) { unsigned long flags; unsigned int dest; @@ -395,7 +397,7 @@ void vmx_pi_hooks_deassign(struct domain *d) domain_unpause(d); } -static int vmx_domain_initialise(struct domain *d) +static int cf_check vmx_domain_initialise(struct domain *d) { static const struct arch_csw csw = { .from = vmx_ctxt_switch_from, @@ -414,7 +416,7 @@ static int vmx_domain_initialise(struct domain *d) return 0; } -static void domain_creation_finished(struct domain *d) +static void cf_check domain_creation_finished(struct domain *d) { gfn_t gfn = gaddr_to_gfn(APIC_DEFAULT_PHYS_BASE); bool ipat; @@ -444,7 +446,7 @@ static void vmx_init_ipt(struct vcpu *v) v->arch.msrs->rtit.output_limit = size - 1; } -static int vmx_vcpu_initialise(struct vcpu *v) +static int cf_check vmx_vcpu_initialise(struct vcpu *v) { int rc; @@ -491,7 +493,7 @@ static int vmx_vcpu_initialise(struct vcpu *v) return 0; } -static void vmx_vcpu_destroy(struct vcpu *v) +static void cf_check vmx_vcpu_destroy(struct vcpu *v) { /* * There are cases that domain still remains in log-dirty mode when it is @@ -589,7 +591,7 @@ void vmx_update_exception_bitmap(struct vcpu *v) __vmwrite(EXCEPTION_BITMAP, bitmap); } -static void vmx_cpuid_policy_changed(struct vcpu *v) +static void cf_check vmx_cpuid_policy_changed(struct vcpu *v) { const struct cpuid_policy *cp = v->domain->arch.cpuid; int rc = 0; @@ -647,7 +649,7 @@ static void vmx_cpuid_policy_changed(struct vcpu *v) } } -int vmx_guest_x86_mode(struct vcpu *v) +int cf_check vmx_guest_x86_mode(struct vcpu *v) { unsigned long cs_ar_bytes; @@ -844,7 +846,7 @@ static void vmx_load_cpu_state(struct vcpu *v, struct hvm_hw_cpu *data) } -static void vmx_save_vmcs_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) +static void cf_check vmx_save_vmcs_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) { if ( v == current ) vmx_save_guest_msrs(v); @@ -853,7 +855,7 @@ static void vmx_save_vmcs_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) vmx_vmcs_save(v, ctxt); } -static int vmx_load_vmcs_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) +static int cf_check vmx_load_vmcs_ctxt(struct vcpu *v, struct hvm_hw_cpu *ctxt) { /* Not currently safe to use in current context. */ ASSERT(v != current); @@ -879,7 +881,7 @@ static void vmx_fpu_enter(struct vcpu *v) __vmwrite(HOST_CR0, v->arch.hvm.vmx.host_cr0); } -static void vmx_fpu_leave(struct vcpu *v) +static void cf_check vmx_fpu_leave(struct vcpu *v) { ASSERT(!v->fpu_dirtied); ASSERT(read_cr0() & X86_CR0_TS); @@ -956,7 +958,7 @@ unsigned int vmx_get_cpl(void) return (attr >> 5) & 3; } -static unsigned int _vmx_get_cpl(struct vcpu *v) +static unsigned int cf_check _vmx_get_cpl(struct vcpu *v) { unsigned int cpl; @@ -982,8 +984,8 @@ static unsigned int _vmx_get_cpl(struct vcpu *v) #define vm86_ds_attr 0xf3 #define vm86_tr_attr 0x8b -static void vmx_get_segment_register(struct vcpu *v, enum x86_segment seg, - struct segment_register *reg) +static void cf_check vmx_get_segment_register( + struct vcpu *v, enum x86_segment seg, struct segment_register *reg) { unsigned long attr = 0, sel = 0, limit; unsigned int tmp_seg; @@ -1084,8 +1086,8 @@ static void vmx_get_segment_register(struct vcpu *v, enum x86_segment seg, } } -static void vmx_set_segment_register(struct vcpu *v, enum x86_segment seg, - struct segment_register *reg) +static void cf_check vmx_set_segment_register( + struct vcpu *v, enum x86_segment seg, struct segment_register *reg) { uint32_t attr, sel, limit; uint64_t base; @@ -1174,12 +1176,12 @@ static void vmx_set_segment_register(struct vcpu *v, enum x86_segment seg, vmx_vmcs_exit(v); } -static unsigned long vmx_get_shadow_gs_base(struct vcpu *v) +static unsigned long cf_check vmx_get_shadow_gs_base(struct vcpu *v) { return v->arch.hvm.vmx.shadow_gs; } -static int vmx_set_guest_pat(struct vcpu *v, u64 gpat) +static int cf_check vmx_set_guest_pat(struct vcpu *v, u64 gpat) { if ( !paging_mode_hap(v->domain) || unlikely(v->arch.hvm.cache_mode == NO_FILL_CACHE_MODE) ) @@ -1191,7 +1193,7 @@ static int vmx_set_guest_pat(struct vcpu *v, u64 gpat) return 1; } -static int vmx_get_guest_pat(struct vcpu *v, u64 *gpat) +static int cf_check vmx_get_guest_pat(struct vcpu *v, u64 *gpat) { if ( !paging_mode_hap(v->domain) || unlikely(v->arch.hvm.cache_mode == NO_FILL_CACHE_MODE) ) @@ -1203,7 +1205,7 @@ static int vmx_get_guest_pat(struct vcpu *v, u64 *gpat) return 1; } -static void vmx_handle_cd(struct vcpu *v, unsigned long value) +static void cf_check vmx_handle_cd(struct vcpu *v, unsigned long value) { if ( !paging_mode_hap(v->domain) ) { @@ -1253,7 +1255,7 @@ static void vmx_handle_cd(struct vcpu *v, unsigned long value) } } -static void vmx_setup_tsc_scaling(struct vcpu *v) +static void cf_check vmx_setup_tsc_scaling(struct vcpu *v) { if ( v->domain->arch.vtsc ) return; @@ -1263,7 +1265,7 @@ static void vmx_setup_tsc_scaling(struct vcpu *v) vmx_vmcs_exit(v); } -static void vmx_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) +static void cf_check vmx_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) { vmx_vmcs_enter(v); @@ -1274,7 +1276,7 @@ static void vmx_set_tsc_offset(struct vcpu *v, u64 offset, u64 at_tsc) vmx_vmcs_exit(v); } -static void vmx_set_rdtsc_exiting(struct vcpu *v, bool_t enable) +static void cf_check vmx_set_rdtsc_exiting(struct vcpu *v, bool enable) { vmx_vmcs_enter(v); v->arch.hvm.vmx.exec_control &= ~CPU_BASED_RDTSC_EXITING; @@ -1284,7 +1286,8 @@ static void vmx_set_rdtsc_exiting(struct vcpu *v, bool_t enable) vmx_vmcs_exit(v); } -static void vmx_set_descriptor_access_exiting(struct vcpu *v, bool enable) +static void cf_check vmx_set_descriptor_access_exiting( + struct vcpu *v, bool enable) { if ( enable ) v->arch.hvm.vmx.secondary_exec_control |= @@ -1298,7 +1301,7 @@ static void vmx_set_descriptor_access_exiting(struct vcpu *v, bool enable) vmx_vmcs_exit(v); } -static void vmx_init_hypercall_page(void *p) +static void cf_check vmx_init_hypercall_page(void *p) { unsigned int i; @@ -1321,7 +1324,7 @@ static void vmx_init_hypercall_page(void *p) } } -static unsigned int vmx_get_interrupt_shadow(struct vcpu *v) +static unsigned int cf_check vmx_get_interrupt_shadow(struct vcpu *v) { unsigned long intr_shadow; @@ -1330,7 +1333,8 @@ static unsigned int vmx_get_interrupt_shadow(struct vcpu *v) return intr_shadow; } -static void vmx_set_interrupt_shadow(struct vcpu *v, unsigned int intr_shadow) +static void cf_check vmx_set_interrupt_shadow( + struct vcpu *v, unsigned int intr_shadow) { __vmwrite(GUEST_INTERRUPTIBILITY_INFO, intr_shadow); } @@ -1381,7 +1385,7 @@ static void vmx_load_pdptrs(struct vcpu *v) return; } -static void vmx_update_host_cr3(struct vcpu *v) +static void cf_check vmx_update_host_cr3(struct vcpu *v) { vmx_vmcs_enter(v); __vmwrite(HOST_CR3, v->arch.cr3); @@ -1400,8 +1404,8 @@ void vmx_update_debug_state(struct vcpu *v) vmx_vmcs_exit(v); } -static void vmx_update_guest_cr(struct vcpu *v, unsigned int cr, - unsigned int flags) +static void cf_check vmx_update_guest_cr( + struct vcpu *v, unsigned int cr, unsigned int flags) { vmx_vmcs_enter(v); @@ -1603,7 +1607,7 @@ static void vmx_update_guest_cr(struct vcpu *v, unsigned int cr, vmx_vmcs_exit(v); } -static void vmx_update_guest_efer(struct vcpu *v) +static void cf_check vmx_update_guest_efer(struct vcpu *v) { unsigned long entry_ctls, guest_efer = v->arch.hvm.guest_efer, xen_efer = read_efer(); @@ -1705,7 +1709,8 @@ void nvmx_enqueue_n2_exceptions(struct vcpu *v, nvmx->intr.intr_info, nvmx->intr.error_code); } -static int nvmx_vmexit_event(struct vcpu *v, const struct x86_event *event) +static int cf_check nvmx_vmexit_event( + struct vcpu *v, const struct x86_event *event) { nvmx_enqueue_n2_exceptions(v, event->vector, event->error_code, hvm_intsrc_none); @@ -1791,7 +1796,7 @@ void vmx_inject_nmi(void) * - #DB is X86_EVENTTYPE_HW_EXCEPTION, except when generated by * opcode 0xf1 (which is X86_EVENTTYPE_PRI_SW_EXCEPTION) */ -static void vmx_inject_event(const struct x86_event *event) +static void cf_check vmx_inject_event(const struct x86_event *event) { unsigned long intr_info; struct vcpu *curr = current; @@ -1872,7 +1877,7 @@ static void vmx_inject_event(const struct x86_event *event) HVMTRACE_2D(INJ_EXC, _event.vector, _event.error_code); } -static bool vmx_event_pending(const struct vcpu *v) +static bool cf_check vmx_event_pending(const struct vcpu *v) { unsigned long intr_info; @@ -1882,7 +1887,7 @@ static bool vmx_event_pending(const struct vcpu *v) return intr_info & INTR_INFO_VALID_MASK; } -static void vmx_set_info_guest(struct vcpu *v) +static void cf_check vmx_set_info_guest(struct vcpu *v) { unsigned long intr_shadow; @@ -1910,7 +1915,8 @@ static void vmx_set_info_guest(struct vcpu *v) vmx_vmcs_exit(v); } -static void vmx_update_eoi_exit_bitmap(struct vcpu *v, uint8_t vector, bool set) +static void cf_check vmx_update_eoi_exit_bitmap( + struct vcpu *v, uint8_t vector, bool set) { if ( set ) vmx_set_eoi_exit_bitmap(v, vector); @@ -1938,7 +1944,7 @@ static u8 set_svi(int isr) return old; } -static void vmx_process_isr(int isr, struct vcpu *v) +static void cf_check vmx_process_isr(int isr, struct vcpu *v) { unsigned int i; const struct vlapic *vlapic = vcpu_vlapic(v); @@ -2026,7 +2032,7 @@ static void __vmx_deliver_posted_interrupt(struct vcpu *v) } } -static void vmx_deliver_posted_intr(struct vcpu *v, u8 vector) +static void cf_check vmx_deliver_posted_intr(struct vcpu *v, u8 vector) { struct pi_desc old, new, prev; @@ -2073,7 +2079,7 @@ static void vmx_deliver_posted_intr(struct vcpu *v, u8 vector) __vmx_deliver_posted_interrupt(v); } -static void vmx_sync_pir_to_irr(struct vcpu *v) +static void cf_check vmx_sync_pir_to_irr(struct vcpu *v) { struct vlapic *vlapic = vcpu_vlapic(v); unsigned int group, i; @@ -2089,12 +2095,12 @@ static void vmx_sync_pir_to_irr(struct vcpu *v) vlapic_set_vector(i, &vlapic->regs->data[APIC_IRR]); } -static bool vmx_test_pir(const struct vcpu *v, uint8_t vec) +static bool cf_check vmx_test_pir(const struct vcpu *v, uint8_t vec) { return pi_test_pir(vec, &v->arch.hvm.vmx.pi_desc); } -static void vmx_handle_eoi(uint8_t vector, int isr) +static void cf_check vmx_handle_eoi(uint8_t vector, int isr) { uint8_t old_svi = set_svi(isr); static bool warned; @@ -2103,7 +2109,7 @@ static void vmx_handle_eoi(uint8_t vector, int isr) printk(XENLOG_WARNING "EOI for %02x but SVI=%02x\n", vector, old_svi); } -static void vmx_enable_msr_interception(struct domain *d, uint32_t msr) +static void cf_check vmx_enable_msr_interception(struct domain *d, uint32_t msr) { struct vcpu *v; @@ -2111,7 +2117,7 @@ static void vmx_enable_msr_interception(struct domain *d, uint32_t msr) vmx_set_msr_intercept(v, msr, VMX_MSR_W); } -static void vmx_vcpu_update_eptp(struct vcpu *v) +static void cf_check vmx_vcpu_update_eptp(struct vcpu *v) { struct domain *d = v->domain; struct p2m_domain *p2m = NULL; @@ -2136,7 +2142,7 @@ static void vmx_vcpu_update_eptp(struct vcpu *v) vmx_vmcs_exit(v); } -static void vmx_vcpu_update_vmfunc_ve(struct vcpu *v) +static void cf_check vmx_vcpu_update_vmfunc_ve(struct vcpu *v) { struct domain *d = v->domain; u32 mask = SECONDARY_EXEC_ENABLE_VM_FUNCTIONS; @@ -2180,7 +2186,7 @@ static void vmx_vcpu_update_vmfunc_ve(struct vcpu *v) vmx_vmcs_exit(v); } -static int vmx_vcpu_emulate_vmfunc(const struct cpu_user_regs *regs) +static int cf_check vmx_vcpu_emulate_vmfunc(const struct cpu_user_regs *regs) { int rc = X86EMUL_EXCEPTION; struct vcpu *curr = current; @@ -2193,7 +2199,7 @@ static int vmx_vcpu_emulate_vmfunc(const struct cpu_user_regs *regs) return rc; } -static bool_t vmx_vcpu_emulate_ve(struct vcpu *v) +static bool cf_check vmx_vcpu_emulate_ve(struct vcpu *v) { const struct page_info *pg = vcpu_altp2m(v).veinfo_pg; ve_info_t *veinfo; @@ -2230,7 +2236,8 @@ static bool_t vmx_vcpu_emulate_ve(struct vcpu *v) return rc; } -static bool vmx_get_pending_event(struct vcpu *v, struct x86_event *info) +static bool cf_check vmx_get_pending_event( + struct vcpu *v, struct x86_event *info) { unsigned long intr_info, error_code; @@ -2267,7 +2274,8 @@ static bool vmx_get_pending_event(struct vcpu *v, struct x86_event *info) (RTIT_STATUS_FILTER_EN | RTIT_STATUS_CONTEXT_EN | RTIT_STATUS_TRIGGER_EN | \ RTIT_STATUS_ERROR | RTIT_STATUS_STOPPED) -static int vmtrace_get_option(struct vcpu *v, uint64_t key, uint64_t *output) +static int cf_check vmtrace_get_option( + struct vcpu *v, uint64_t key, uint64_t *output) { const struct vcpu_msrs *msrs = v->arch.msrs; @@ -2288,7 +2296,8 @@ static int vmtrace_get_option(struct vcpu *v, uint64_t key, uint64_t *output) return 0; } -static int vmtrace_set_option(struct vcpu *v, uint64_t key, uint64_t value) +static int cf_check vmtrace_set_option( + struct vcpu *v, uint64_t key, uint64_t value) { struct vcpu_msrs *msrs = v->arch.msrs; bool new_en, old_en = msrs->rtit.ctl & RTIT_CTL_TRACE_EN; @@ -2342,7 +2351,7 @@ static int vmtrace_set_option(struct vcpu *v, uint64_t key, uint64_t value) return 0; } -static int vmtrace_control(struct vcpu *v, bool enable, bool reset) +static int cf_check vmtrace_control(struct vcpu *v, bool enable, bool reset) { struct vcpu_msrs *msrs = v->arch.msrs; uint64_t new_ctl; @@ -2374,13 +2383,13 @@ static int vmtrace_control(struct vcpu *v, bool enable, bool reset) return 0; } -static int vmtrace_output_position(struct vcpu *v, uint64_t *pos) +static int cf_check vmtrace_output_position(struct vcpu *v, uint64_t *pos) { *pos = v->arch.msrs->rtit.output_offset; return v->arch.hvm.vmx.ipt_active; } -static int vmtrace_reset(struct vcpu *v) +static int cf_check vmtrace_reset(struct vcpu *v) { if ( !v->arch.hvm.vmx.ipt_active ) return -EINVAL; @@ -2390,7 +2399,7 @@ static int vmtrace_reset(struct vcpu *v) return 0; } -static uint64_t vmx_get_reg(struct vcpu *v, unsigned int reg) +static uint64_t cf_check vmx_get_reg(struct vcpu *v, unsigned int reg) { struct domain *d = v->domain; uint64_t val = 0; @@ -2429,7 +2438,7 @@ static uint64_t vmx_get_reg(struct vcpu *v, unsigned int reg) return val; } -static void vmx_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) +static void cf_check vmx_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) { struct domain *d = v->domain; int rc; @@ -2823,7 +2832,7 @@ void update_guest_eip(void) hvm_inject_hw_exception(TRAP_debug, X86_EVENT_NO_EC); } -static void vmx_fpu_dirty_intercept(void) +static void cf_check vmx_fpu_dirty_intercept(void) { struct vcpu *curr = current; @@ -2858,7 +2867,7 @@ static void vmx_invlpg_intercept(unsigned long linear) paging_invlpg(current, linear); } -static void vmx_invlpg(struct vcpu *v, unsigned long linear) +static void cf_check vmx_invlpg(struct vcpu *v, unsigned long linear) { if ( cpu_has_vmx_vpid ) vpid_sync_vcpu_gva(v, linear); @@ -3184,7 +3193,8 @@ static int is_last_branch_msr(u32 ecx) return 0; } -static int vmx_msr_read_intercept(unsigned int msr, uint64_t *msr_content) +static int cf_check vmx_msr_read_intercept( + unsigned int msr, uint64_t *msr_content) { struct vcpu *curr = current; uint64_t tmp; @@ -3387,7 +3397,8 @@ void vmx_vlapic_msr_changed(struct vcpu *v) vmx_vmcs_exit(v); } -static int vmx_msr_write_intercept(unsigned int msr, uint64_t msr_content) +static int cf_check vmx_msr_write_intercept( + unsigned int msr, uint64_t msr_content) { struct vcpu *v = current; const struct cpuid_policy *cp = v->domain->arch.cpuid; @@ -3587,7 +3598,7 @@ static void vmx_do_extint(struct cpu_user_regs *regs) do_IRQ(regs); } -static void vmx_wbinvd_intercept(void) +static void cf_check vmx_wbinvd_intercept(void) { if ( !cache_flush_permitted(current->domain) || iommu_snoop ) return; diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 7419ee9dd0bc..5f5445147585 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -62,7 +62,7 @@ void nvmx_cpu_dead(unsigned int cpu) XFREE(per_cpu(vvmcs_buf, cpu)); } -int nvmx_vcpu_initialise(struct vcpu *v) +int cf_check nvmx_vcpu_initialise(struct vcpu *v) { struct domain *d = v->domain; struct nestedvmx *nvmx = &vcpu_2_nvmx(v); @@ -150,7 +150,7 @@ int nvmx_vcpu_initialise(struct vcpu *v) return 0; } -void nvmx_vcpu_destroy(struct vcpu *v) +void cf_check nvmx_vcpu_destroy(struct vcpu *v) { struct nestedvmx *nvmx = &vcpu_2_nvmx(v); struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); @@ -199,7 +199,7 @@ static void vcpu_relinquish_resources(struct vcpu *v) FREE_XENHEAP_PAGE(nvmx->msr_merged); } -void nvmx_domain_relinquish_resources(struct domain *d) +void cf_check nvmx_domain_relinquish_resources(struct domain *d) { struct vcpu *v; @@ -210,17 +210,17 @@ void nvmx_domain_relinquish_resources(struct domain *d) } } -int nvmx_vcpu_reset(struct vcpu *v) +int cf_check nvmx_vcpu_reset(struct vcpu *v) { return 0; } -uint64_t nvmx_vcpu_eptp_base(struct vcpu *v) +uint64_t cf_check nvmx_vcpu_eptp_base(struct vcpu *v) { return get_vvmcs(v, EPT_POINTER) & PAGE_MASK; } -bool_t nvmx_ept_enabled(struct vcpu *v) +bool cf_check nvmx_ept_enabled(struct vcpu *v) { struct nestedvmx *nvmx = &vcpu_2_nvmx(v); @@ -514,7 +514,7 @@ static void vmfail(struct cpu_user_regs *regs, enum vmx_insn_errno errno) vmfail_invalid(regs); } -bool_t nvmx_intercepts_exception( +bool cf_check nvmx_intercepts_exception( struct vcpu *v, unsigned int vector, int error_code) { u32 exception_bitmap, pfec_match=0, pfec_mask=0; @@ -2346,7 +2346,7 @@ int nvmx_msr_read_intercept(unsigned int msr, u64 *msr_content) * walk is successful, the translated value is returned in * L1_gpa. The result value tells what to do next. */ -int nvmx_hap_walk_L1_p2m( +int cf_check nvmx_hap_walk_L1_p2m( struct vcpu *v, paddr_t L2_gpa, paddr_t *L1_gpa, unsigned int *page_order, uint8_t *p2m_acc, struct npfec npfec) { diff --git a/xen/arch/x86/include/asm/hvm/svm/nestedsvm.h b/xen/arch/x86/include/asm/hvm/svm/nestedsvm.h index c3ef2354140c..656d7d1a9a71 100644 --- a/xen/arch/x86/include/asm/hvm/svm/nestedsvm.h +++ b/xen/arch/x86/include/asm/hvm/svm/nestedsvm.h @@ -107,22 +107,22 @@ nestedsvm_check_intercepts(struct vcpu *v, struct cpu_user_regs *regs, void svm_nested_features_on_efer_update(struct vcpu *v); /* Interface methods */ -void nsvm_vcpu_destroy(struct vcpu *v); -int nsvm_vcpu_initialise(struct vcpu *v); -int nsvm_vcpu_reset(struct vcpu *v); +void cf_check nsvm_vcpu_destroy(struct vcpu *v); +int cf_check nsvm_vcpu_initialise(struct vcpu *v); +int cf_check nsvm_vcpu_reset(struct vcpu *v); int nsvm_vcpu_vmrun(struct vcpu *v, struct cpu_user_regs *regs); -int nsvm_vcpu_vmexit_event(struct vcpu *v, const struct x86_event *event); -uint64_t nsvm_vcpu_hostcr3(struct vcpu *v); -bool_t nsvm_vmcb_guest_intercepts_event( +int cf_check nsvm_vcpu_vmexit_event(struct vcpu *v, const struct x86_event *event); +uint64_t cf_check nsvm_vcpu_hostcr3(struct vcpu *v); +bool cf_check nsvm_vmcb_guest_intercepts_event( struct vcpu *v, unsigned int vector, int errcode); -bool_t nsvm_vmcb_hap_enabled(struct vcpu *v); -enum hvm_intblk nsvm_intr_blocked(struct vcpu *v); +bool cf_check nsvm_vmcb_hap_enabled(struct vcpu *v); +enum hvm_intblk cf_check nsvm_intr_blocked(struct vcpu *v); /* Interrupts, vGIF */ void svm_vmexit_do_clgi(struct cpu_user_regs *regs, struct vcpu *v); void svm_vmexit_do_stgi(struct cpu_user_regs *regs, struct vcpu *v); bool_t nestedsvm_gif_isset(struct vcpu *v); -int nsvm_hap_walk_L1_p2m( +int cf_check nsvm_hap_walk_L1_p2m( struct vcpu *v, paddr_t L2_gpa, paddr_t *L1_gpa, unsigned int *page_order, uint8_t *p2m_acc, struct npfec npfec); diff --git a/xen/arch/x86/include/asm/hvm/svm/svm.h b/xen/arch/x86/include/asm/hvm/svm/svm.h index 09c32044ec8a..65e35a4f59b7 100644 --- a/xen/arch/x86/include/asm/hvm/svm/svm.h +++ b/xen/arch/x86/include/asm/hvm/svm/svm.h @@ -50,7 +50,6 @@ struct vcpu; unsigned long *svm_msrbit(unsigned long *msr_bitmap, uint32_t msr); void __update_guest_eip(struct cpu_user_regs *regs, unsigned int inst_len); -void svm_update_guest_cr(struct vcpu *, unsigned int cr, unsigned int flags); /* * PV context switch helpers. Prefetching the VMCB area itself has been shown diff --git a/xen/arch/x86/include/asm/hvm/vmx/vmcs.h b/xen/arch/x86/include/asm/hvm/vmx/vmcs.h index 03c9ccf627ab..9119aa8536df 100644 --- a/xen/arch/x86/include/asm/hvm/vmx/vmcs.h +++ b/xen/arch/x86/include/asm/hvm/vmx/vmcs.h @@ -22,10 +22,10 @@ extern void vmcs_dump_vcpu(struct vcpu *v); extern int vmx_vmcs_init(void); -extern int vmx_cpu_up_prepare(unsigned int cpu); -extern void vmx_cpu_dead(unsigned int cpu); -extern int vmx_cpu_up(void); -extern void vmx_cpu_down(void); +int cf_check vmx_cpu_up_prepare(unsigned int cpu); +void cf_check vmx_cpu_dead(unsigned int cpu); +int cf_check vmx_cpu_up(void); +void cf_check vmx_cpu_down(void); struct vmcs_struct { u32 vmcs_revision_id; diff --git a/xen/arch/x86/include/asm/hvm/vmx/vmx.h b/xen/arch/x86/include/asm/hvm/vmx/vmx.h index 97e7652aa12c..5284fe931f62 100644 --- a/xen/arch/x86/include/asm/hvm/vmx/vmx.h +++ b/xen/arch/x86/include/asm/hvm/vmx/vmx.h @@ -588,7 +588,7 @@ static inline int __vmxon(u64 addr) return rc; } -int vmx_guest_x86_mode(struct vcpu *v); +int cf_check vmx_guest_x86_mode(struct vcpu *v); unsigned int vmx_get_cpl(void); void vmx_inject_extint(int trap, uint8_t source); diff --git a/xen/arch/x86/include/asm/hvm/vmx/vvmx.h b/xen/arch/x86/include/asm/hvm/vmx/vvmx.h index e4ca3bc6ee2b..2c3adb5dd6b3 100644 --- a/xen/arch/x86/include/asm/hvm/vmx/vvmx.h +++ b/xen/arch/x86/include/asm/hvm/vmx/vvmx.h @@ -84,23 +84,23 @@ union vmx_inst_info { u32 word; }; -int nvmx_vcpu_initialise(struct vcpu *v); -void nvmx_vcpu_destroy(struct vcpu *v); -int nvmx_vcpu_reset(struct vcpu *v); -uint64_t nvmx_vcpu_eptp_base(struct vcpu *v); -enum hvm_intblk nvmx_intr_blocked(struct vcpu *v); -bool_t nvmx_intercepts_exception( +int cf_check nvmx_vcpu_initialise(struct vcpu *v); +void cf_check nvmx_vcpu_destroy(struct vcpu *v); +int cf_check nvmx_vcpu_reset(struct vcpu *v); +uint64_t cf_check nvmx_vcpu_eptp_base(struct vcpu *v); +enum hvm_intblk cf_check nvmx_intr_blocked(struct vcpu *v); +bool cf_check nvmx_intercepts_exception( struct vcpu *v, unsigned int vector, int error_code); -void nvmx_domain_relinquish_resources(struct domain *d); +void cf_check nvmx_domain_relinquish_resources(struct domain *d); -bool_t nvmx_ept_enabled(struct vcpu *v); +bool cf_check nvmx_ept_enabled(struct vcpu *v); #define EPT_TRANSLATE_SUCCEED 0 #define EPT_TRANSLATE_VIOLATION 1 #define EPT_TRANSLATE_MISCONFIG 2 #define EPT_TRANSLATE_RETRY 3 -int nvmx_hap_walk_L1_p2m( +int cf_check nvmx_hap_walk_L1_p2m( struct vcpu *v, paddr_t L2_gpa, paddr_t *L1_gpa, unsigned int *page_order, uint8_t *p2m_acc, struct npfec npfec); From patchwork Mon Feb 14 12:50:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745566 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 70230C433EF for ; Mon, 14 Feb 2022 13:06:34 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271717.466393 (Exim 4.92) (envelope-from ) id 1nJb3e-0000rR-U4; Mon, 14 Feb 2022 13:06:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271717.466393; Mon, 14 Feb 2022 13:06:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3e-0000p2-Ca; Mon, 14 Feb 2022 13:06:22 +0000 Received: by outflank-mailman (input) for mailman id 271717; Mon, 14 Feb 2022 13:06:20 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb33-00023t-JR for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:45 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id cfb2082c-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:42 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: cfb2082c-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843943; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=OwW5YsR6GfHfWjF2g/4V1G5fiXx9eC4JGeYTntB+Biw=; b=bTkovZwz0Ou8CuafAXR06gA2ldSCoXJ7P2ovFY6JiukylJGk8iU7PJ1M fcGarIre1D9Hnj4rMc1yFIr575ysQCGf0l6G81wc1dP0W6fc5L/iJdORy idbaUD3VAtlui4N0zGY2dSOqH4xOmDHs+0Z8UMoPRyMcxgeeqUIhiCWCq U=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: ppeC++WIrsfEBI6t2hLmZt8vYMV2tXZwuCwCNIS6FvQexE0ACL5AgRKNGXFZagJAiT1tiRA6nG MV6l7keBqlOIzYfy4HMBhzVhrTYAAPtlUwiuvYBtZPFGZNZIvf/jgUcPJnha7aw2szDUo42rWD L4eaFgopv1hTxgKnsGxwX4BY5n71ui/+ZAYRebdCZcK1gobk1vZDDERUN+YJzcsuzQ/FdP10VW 4lhy+NcDDoRuGRpkVZqtJQy4c/SQFYLI0eBiQvkpKm9yFs5H+wzLxxh5ZbhyB4KnIkIlmAf18B sJPbuhNWIj2prJHymCwq9o4V X-SBRS: 5.1 X-MesageID: 64149826 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:4PPMqKn/87z9ojq+Ckpc0m3o5gyfIURdPkR7XQ2eYbSJt1+Wr1Gzt xJNCmHSaK2JZWSgctFxPNi/9kID78fXyNJkHAZkqSo0EiMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 NYThbGoby4gB6fvovszcwBaVAZuH7ITrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qHO 5tJM2QHgBLoTkNkPVo9GIsHh+aomDrubD5h6w2pnP9ii4TU5FMoi+W8WDbPQfSaSMMQkkuGq 2bu+2XiHgpcJNGZ0SCC8H+nmqnIhyyTZW4JPOTmrLgw2gTVnzFNTk1NPbemnRWnok3ga/9HD WUdwyANl7cc1FWpCf7tfQLt9RZooSUgc9ZXFuQ77iSExazV/xuVCwA4c9JRVDA1nJRoHGJ3j zdli/usXGUy6+PNFRpx45/J9WvaBMQDEYMVicbopyMh6sKrnow8hwmnoj1LQP/s1Y2d9d0dL lm3QMkCa1c70JRjO0aTpwmvb9eQSn/hFFBd2+kvdjj5hj6Vnab8D2BS1XDV7OxbMKGSRUSbs X4PlqC2tb5SUc7dxHHQGLxWRtlFAspp1xWG3zZS82QJrWzxqxZPg6gMiN2BGKuZGpldImK4C KMikQhQ+IVSLBOXgVxfOOqM5zAR5fG4T7zND6mMBvIXO8QZXFLXrUlGOB/Lt0iwwRdErE3KE crCGSpaJS1BUvoPIfvfb7p17ILHMQhgmTKNFcijlUzPPHj3TCf9dIrp+WCmNogRhJ5oai2Mm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:TUokqq7Qv1JBWj7L5QPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149826" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 33/70] x86/hvm: CFI hardening for device emulation Date: Mon, 14 Feb 2022 12:50:50 +0000 Message-ID: <20220214125127.17985-34-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/emul-i8254.c | 8 +++---- xen/arch/x86/hvm/emulate.c | 21 ++++++++--------- xen/arch/x86/hvm/hpet.c | 6 ++--- xen/arch/x86/hvm/hvm.c | 2 +- xen/arch/x86/hvm/intercept.c | 28 +++++++++++++---------- xen/arch/x86/hvm/io.c | 38 +++++++++++++++++-------------- xen/arch/x86/hvm/ioreq.c | 2 +- xen/arch/x86/hvm/pmtimer.c | 4 ++-- xen/arch/x86/hvm/rtc.c | 6 ++--- xen/arch/x86/hvm/stdvga.c | 19 ++++++++-------- xen/arch/x86/hvm/svm/svm.c | 4 ++-- xen/arch/x86/hvm/vioapic.c | 8 +++---- xen/arch/x86/hvm/vlapic.c | 11 +++++---- xen/arch/x86/hvm/vmsi.c | 14 +++++++----- xen/arch/x86/hvm/vpic.c | 4 ++-- xen/arch/x86/include/asm/hvm/vioapic.h | 2 +- xen/drivers/passthrough/amd/iommu_guest.c | 10 ++++---- 17 files changed, 98 insertions(+), 89 deletions(-) diff --git a/xen/arch/x86/emul-i8254.c b/xen/arch/x86/emul-i8254.c index 050c784702af..0e09a173187f 100644 --- a/xen/arch/x86/emul-i8254.c +++ b/xen/arch/x86/emul-i8254.c @@ -48,9 +48,9 @@ #define RW_STATE_WORD0 3 #define RW_STATE_WORD1 4 -static int handle_pit_io( +static int cf_check handle_pit_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val); -static int handle_speaker_io( +static int cf_check handle_speaker_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val); #define get_guest_time(v) \ @@ -505,7 +505,7 @@ void pit_deinit(struct domain *d) } /* the intercept action for PIT DM retval:0--not handled; 1--handled */ -static int handle_pit_io( +static int cf_check handle_pit_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct PITState *vpit = vcpu_vpit(current); @@ -548,7 +548,7 @@ static uint32_t speaker_ioport_read( (pit_get_out(pit, 2) << 5) | (refresh_clock << 4)); } -static int handle_speaker_io( +static int cf_check handle_speaker_io( int dir, unsigned int port, uint32_t bytes, uint32_t *val) { struct PITState *vpit = vcpu_vpit(current); diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 2b3fb4d6ba05..39dac7fd9d6d 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -71,19 +71,17 @@ static void hvmtrace_io_assist(const ioreq_t *p) trace_var(event, 0/*!cycles*/, size, buffer); } -static int null_read(const struct hvm_io_handler *io_handler, - uint64_t addr, - uint32_t size, - uint64_t *data) +static int cf_check null_read( + const struct hvm_io_handler *io_handler, uint64_t addr, uint32_t size, + uint64_t *data) { *data = ~0ul; return X86EMUL_OKAY; } -static int null_write(const struct hvm_io_handler *handler, - uint64_t addr, - uint32_t size, - uint64_t data) +static int cf_check null_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { return X86EMUL_OKAY; } @@ -114,10 +112,9 @@ static const struct hvm_io_handler null_handler = { .ops = &null_ops }; -static int ioreq_server_read(const struct hvm_io_handler *io_handler, - uint64_t addr, - uint32_t size, - uint64_t *data) +static int cf_check ioreq_server_read( + const struct hvm_io_handler *io_handler, uint64_t addr, uint32_t size, + uint64_t *data) { if ( hvm_copy_from_guest_phys(data, addr, size) != HVMTRANS_okay ) return X86EMUL_UNHANDLEABLE; diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c index 8267f0b8a278..7bdb51cfa1c4 100644 --- a/xen/arch/x86/hvm/hpet.c +++ b/xen/arch/x86/hvm/hpet.c @@ -162,7 +162,7 @@ static inline int hpet_check_access_length( return 0; } -static int hpet_read( +static int cf_check hpet_read( struct vcpu *v, unsigned long addr, unsigned int length, unsigned long *pval) { @@ -351,7 +351,7 @@ static void timer_sanitize_int_route(HPETState *h, unsigned int tn) HPET_TN_ROUTE); } -static int hpet_write( +static int cf_check hpet_write( struct vcpu *v, unsigned long addr, unsigned int length, unsigned long val) { @@ -569,7 +569,7 @@ static int hpet_write( return X86EMUL_OKAY; } -static int hpet_range(struct vcpu *v, unsigned long addr) +static int cf_check hpet_range(struct vcpu *v, unsigned long addr) { return ( (addr >= HPET_BASE_ADDRESS) && (addr < (HPET_BASE_ADDRESS + HPET_MMAP_SIZE)) ); diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 5ec10f30803e..9e4924649077 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -543,7 +543,7 @@ void hvm_do_resume(struct vcpu *v) } } -static int hvm_print_line( +static int cf_check hvm_print_line( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct domain *cd = current->domain; diff --git a/xen/arch/x86/hvm/intercept.c b/xen/arch/x86/hvm/intercept.c index 02ca3b05b05a..ffa31b746716 100644 --- a/xen/arch/x86/hvm/intercept.c +++ b/xen/arch/x86/hvm/intercept.c @@ -32,8 +32,8 @@ #include #include -static bool_t hvm_mmio_accept(const struct hvm_io_handler *handler, - const ioreq_t *p) +static bool cf_check hvm_mmio_accept( + const struct hvm_io_handler *handler, const ioreq_t *p) { paddr_t first = ioreq_mmio_first_byte(p), last; @@ -51,16 +51,18 @@ static bool_t hvm_mmio_accept(const struct hvm_io_handler *handler, return 1; } -static int hvm_mmio_read(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t *data) +static int cf_check hvm_mmio_read( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t *data) { BUG_ON(handler->type != IOREQ_TYPE_COPY); return handler->mmio.ops->read(current, addr, size, data); } -static int hvm_mmio_write(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t data) +static int cf_check hvm_mmio_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { BUG_ON(handler->type != IOREQ_TYPE_COPY); @@ -73,8 +75,8 @@ static const struct hvm_io_ops mmio_ops = { .write = hvm_mmio_write }; -static bool_t hvm_portio_accept(const struct hvm_io_handler *handler, - const ioreq_t *p) +static bool cf_check hvm_portio_accept( + const struct hvm_io_handler *handler, const ioreq_t *p) { unsigned int start = handler->portio.port; unsigned int end = start + handler->portio.size; @@ -84,8 +86,9 @@ static bool_t hvm_portio_accept(const struct hvm_io_handler *handler, return (p->addr >= start) && ((p->addr + p->size) <= end); } -static int hvm_portio_read(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t *data) +static int cf_check hvm_portio_read( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t *data) { uint32_t val = ~0u; int rc; @@ -98,8 +101,9 @@ static int hvm_portio_read(const struct hvm_io_handler *handler, return rc; } -static int hvm_portio_write(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t data) +static int cf_check hvm_portio_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { uint32_t val = data; diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c index 93f1d1503fa6..f70bfde90143 100644 --- a/xen/arch/x86/hvm/io.c +++ b/xen/arch/x86/hvm/io.c @@ -156,8 +156,8 @@ bool handle_pio(uint16_t port, unsigned int size, int dir) return true; } -static bool_t g2m_portio_accept(const struct hvm_io_handler *handler, - const ioreq_t *p) +static bool cf_check g2m_portio_accept( + const struct hvm_io_handler *handler, const ioreq_t *p) { struct vcpu *curr = current; const struct hvm_domain *hvm = &curr->domain->arch.hvm; @@ -179,8 +179,9 @@ static bool_t g2m_portio_accept(const struct hvm_io_handler *handler, return 0; } -static int g2m_portio_read(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t *data) +static int cf_check g2m_portio_read( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t *data) { struct hvm_vcpu_io *hvio = ¤t->arch.hvm.hvm_io; const struct g2m_ioport *g2m_ioport = hvio->g2m_ioport; @@ -204,8 +205,9 @@ static int g2m_portio_read(const struct hvm_io_handler *handler, return X86EMUL_OKAY; } -static int g2m_portio_write(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t data) +static int cf_check g2m_portio_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { struct hvm_vcpu_io *hvio = ¤t->arch.hvm.hvm_io; const struct g2m_ioport *g2m_ioport = hvio->g2m_ioport; @@ -261,14 +263,15 @@ unsigned int hvm_pci_decode_addr(unsigned int cf8, unsigned int addr, } /* vPCI config space IO ports handlers (0xcf8/0xcfc). */ -static bool vpci_portio_accept(const struct hvm_io_handler *handler, - const ioreq_t *p) +static bool cf_check vpci_portio_accept( + const struct hvm_io_handler *handler, const ioreq_t *p) { return (p->addr == 0xcf8 && p->size == 4) || (p->addr & ~3) == 0xcfc; } -static int vpci_portio_read(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t *data) +static int cf_check vpci_portio_read( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t *data) { const struct domain *d = current->domain; unsigned int reg; @@ -299,8 +302,9 @@ static int vpci_portio_read(const struct hvm_io_handler *handler, return X86EMUL_OKAY; } -static int vpci_portio_write(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t data) +static int cf_check vpci_portio_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { struct domain *d = current->domain; unsigned int reg; @@ -387,7 +391,7 @@ static unsigned int vpci_mmcfg_decode_addr(const struct hvm_mmcfg *mmcfg, return addr & (PCI_CFG_SPACE_EXP_SIZE - 1); } -static int vpci_mmcfg_accept(struct vcpu *v, unsigned long addr) +static int cf_check vpci_mmcfg_accept(struct vcpu *v, unsigned long addr) { struct domain *d = v->domain; bool found; @@ -399,8 +403,8 @@ static int vpci_mmcfg_accept(struct vcpu *v, unsigned long addr) return found; } -static int vpci_mmcfg_read(struct vcpu *v, unsigned long addr, - unsigned int len, unsigned long *data) +static int cf_check vpci_mmcfg_read( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long *data) { struct domain *d = v->domain; const struct hvm_mmcfg *mmcfg; @@ -426,8 +430,8 @@ static int vpci_mmcfg_read(struct vcpu *v, unsigned long addr, return X86EMUL_OKAY; } -static int vpci_mmcfg_write(struct vcpu *v, unsigned long addr, - unsigned int len, unsigned long data) +static int cf_check vpci_mmcfg_write( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long data) { struct domain *d = v->domain; const struct hvm_mmcfg *mmcfg; diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c index 02ad9db56523..8409d910d689 100644 --- a/xen/arch/x86/hvm/ioreq.c +++ b/xen/arch/x86/hvm/ioreq.c @@ -319,7 +319,7 @@ bool arch_ioreq_server_get_type_addr(const struct domain *d, return true; } -static int hvm_access_cf8( +static int cf_check hvm_access_cf8( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct domain *d = current->domain; diff --git a/xen/arch/x86/hvm/pmtimer.c b/xen/arch/x86/hvm/pmtimer.c index 808819d1de91..60e3c8de4c6b 100644 --- a/xen/arch/x86/hvm/pmtimer.c +++ b/xen/arch/x86/hvm/pmtimer.c @@ -152,7 +152,7 @@ static void cf_check pmt_timer_callback(void *opaque) } /* Handle port I/O to the PM1a_STS and PM1a_EN registers */ -static int handle_evt_io( +static int cf_check handle_evt_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct vcpu *v = current; @@ -216,7 +216,7 @@ static int handle_evt_io( /* Handle port I/O to the TMR_VAL register */ -static int handle_pmt_io( +static int cf_check handle_pmt_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct vcpu *v = current; diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 09d3501276bc..bdc647e433e9 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -696,7 +696,7 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) return ret; } -static int handle_rtc_io( +static int cf_check handle_rtc_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct RTCState *vrtc = vcpu_vrtc(current); @@ -809,8 +809,8 @@ void rtc_reset(struct domain *d) } /* RTC mediator for HVM hardware domain. */ -static int hw_rtc_io(int dir, unsigned int port, unsigned int size, - uint32_t *val) +static int cf_check hw_rtc_io( + int dir, unsigned int port, unsigned int size, uint32_t *val) { if ( dir == IOREQ_READ ) *val = ~0; diff --git a/xen/arch/x86/hvm/stdvga.c b/xen/arch/x86/hvm/stdvga.c index ab9781d82a55..be8200c8d072 100644 --- a/xen/arch/x86/hvm/stdvga.c +++ b/xen/arch/x86/hvm/stdvga.c @@ -199,7 +199,7 @@ static void stdvga_out(uint32_t port, uint32_t bytes, uint32_t val) } } -static int stdvga_intercept_pio( +static int cf_check stdvga_intercept_pio( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct hvm_hw_stdvga *s = ¤t->domain->arch.hvm.stdvga; @@ -302,8 +302,9 @@ static uint8_t stdvga_mem_readb(uint64_t addr) return ret; } -static int stdvga_mem_read(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, uint64_t *p_data) +static int cf_check stdvga_mem_read( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t *p_data) { uint64_t data = ~0ul; @@ -453,9 +454,9 @@ static void stdvga_mem_writeb(uint64_t addr, uint32_t val) } } -static int stdvga_mem_write(const struct hvm_io_handler *handler, - uint64_t addr, uint32_t size, - uint64_t data) +static int cf_check stdvga_mem_write( + const struct hvm_io_handler *handler, uint64_t addr, uint32_t size, + uint64_t data) { struct hvm_hw_stdvga *s = ¤t->domain->arch.hvm.stdvga; ioreq_t p = { @@ -514,8 +515,8 @@ static int stdvga_mem_write(const struct hvm_io_handler *handler, return ioreq_send(srv, &p, 1); } -static bool_t stdvga_mem_accept(const struct hvm_io_handler *handler, - const ioreq_t *p) +static bool cf_check stdvga_mem_accept( + const struct hvm_io_handler *handler, const ioreq_t *p) { struct hvm_hw_stdvga *s = ¤t->domain->arch.hvm.stdvga; @@ -558,7 +559,7 @@ static bool_t stdvga_mem_accept(const struct hvm_io_handler *handler, return 0; } -static void stdvga_mem_complete(const struct hvm_io_handler *handler) +static void cf_check stdvga_mem_complete(const struct hvm_io_handler *handler) { struct hvm_hw_stdvga *s = ¤t->domain->arch.hvm.stdvga; diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index de6166241bf1..4c4ebda5e6e4 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -1133,8 +1133,8 @@ static void svm_host_osvw_init(void) spin_unlock(&osvw_lock); } -static int acpi_c1e_quirk(int dir, unsigned int port, unsigned int bytes, - uint32_t *val) +static int cf_check acpi_c1e_quirk( + int dir, unsigned int port, unsigned int bytes, uint32_t *val) { ASSERT(bytes == 1 && port == acpi_smi_cmd); diff --git a/xen/arch/x86/hvm/vioapic.c b/xen/arch/x86/hvm/vioapic.c index 553c0f76eff8..b56549aa22d1 100644 --- a/xen/arch/x86/hvm/vioapic.c +++ b/xen/arch/x86/hvm/vioapic.c @@ -135,7 +135,7 @@ static uint32_t vioapic_read_indirect(const struct hvm_vioapic *vioapic) return result; } -static int vioapic_read( +static int cf_check vioapic_read( struct vcpu *v, unsigned long addr, unsigned int length, unsigned long *pval) { @@ -351,7 +351,7 @@ static void vioapic_write_indirect( } } -static int vioapic_write( +static int cf_check vioapic_write( struct vcpu *v, unsigned long addr, unsigned int length, unsigned long val) { @@ -383,7 +383,7 @@ static int vioapic_write( return X86EMUL_OKAY; } -static int vioapic_range(struct vcpu *v, unsigned long addr) +static int cf_check vioapic_range(struct vcpu *v, unsigned long addr) { return !!addr_vioapic(v->domain, addr); } @@ -568,7 +568,7 @@ int vioapic_get_mask(const struct domain *d, unsigned int gsi) return vioapic->redirtbl[pin].fields.mask; } -int vioapic_get_vector(const struct domain *d, unsigned int gsi) +int cf_check vioapic_get_vector(const struct domain *d, unsigned int gsi) { unsigned int pin = 0; /* See gsi_vioapic */ const struct hvm_vioapic *vioapic = gsi_vioapic(d, gsi, &pin); diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c index fe375912bef1..652e3cb87f12 100644 --- a/xen/arch/x86/hvm/vlapic.c +++ b/xen/arch/x86/hvm/vlapic.c @@ -615,8 +615,9 @@ static uint32_t vlapic_read_aligned(const struct vlapic *vlapic, return 0; } -static int vlapic_mmio_read(struct vcpu *v, unsigned long address, - unsigned int len, unsigned long *pval) +static int cf_check vlapic_mmio_read( + struct vcpu *v, unsigned long address, unsigned int len, + unsigned long *pval) { struct vlapic *vlapic = vcpu_vlapic(v); unsigned int offset = address - vlapic_base_address(vlapic); @@ -898,8 +899,8 @@ void vlapic_reg_write(struct vcpu *v, unsigned int reg, uint32_t val) } } -static int vlapic_mmio_write(struct vcpu *v, unsigned long address, - unsigned int len, unsigned long val) +static int cf_check vlapic_mmio_write( + struct vcpu *v, unsigned long address, unsigned int len, unsigned long val) { struct vlapic *vlapic = vcpu_vlapic(v); unsigned int offset = address - vlapic_base_address(vlapic); @@ -1052,7 +1053,7 @@ int guest_wrmsr_x2apic(struct vcpu *v, uint32_t msr, uint64_t msr_content) return X86EMUL_OKAY; } -static int vlapic_range(struct vcpu *v, unsigned long addr) +static int cf_check vlapic_range(struct vcpu *v, unsigned long addr) { struct vlapic *vlapic = vcpu_vlapic(v); unsigned long offset = addr - vlapic_base_address(vlapic); diff --git a/xen/arch/x86/hvm/vmsi.c b/xen/arch/x86/hvm/vmsi.c index 2889575a2035..d4a8c953e23f 100644 --- a/xen/arch/x86/hvm/vmsi.c +++ b/xen/arch/x86/hvm/vmsi.c @@ -211,8 +211,9 @@ static struct msi_desc *msixtbl_addr_to_desc( return NULL; } -static int msixtbl_read(const struct hvm_io_handler *handler, - uint64_t address, uint32_t len, uint64_t *pval) +static int cf_check msixtbl_read( + const struct hvm_io_handler *handler, uint64_t address, uint32_t len, + uint64_t *pval) { unsigned long offset; struct msixtbl_entry *entry; @@ -350,14 +351,15 @@ static int msixtbl_write(struct vcpu *v, unsigned long address, return r; } -static int _msixtbl_write(const struct hvm_io_handler *handler, - uint64_t address, uint32_t len, uint64_t val) +static int cf_check _msixtbl_write( + const struct hvm_io_handler *handler, uint64_t address, uint32_t len, + uint64_t val) { return msixtbl_write(current, address, len, val); } -static bool_t msixtbl_range(const struct hvm_io_handler *handler, - const ioreq_t *r) +static bool cf_check msixtbl_range( + const struct hvm_io_handler *handler, const ioreq_t *r) { struct vcpu *curr = current; unsigned long addr = r->addr; diff --git a/xen/arch/x86/hvm/vpic.c b/xen/arch/x86/hvm/vpic.c index 91c2c6983393..5d8ef259b710 100644 --- a/xen/arch/x86/hvm/vpic.c +++ b/xen/arch/x86/hvm/vpic.c @@ -351,7 +351,7 @@ static uint32_t vpic_ioport_read(struct hvm_hw_vpic *vpic, uint32_t addr) return vpic->imr; } -static int vpic_intercept_pic_io( +static int cf_check vpic_intercept_pic_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct hvm_hw_vpic *vpic; @@ -373,7 +373,7 @@ static int vpic_intercept_pic_io( return X86EMUL_OKAY; } -static int vpic_intercept_elcr_io( +static int cf_check vpic_intercept_elcr_io( int dir, unsigned int port, unsigned int bytes, uint32_t *val) { struct hvm_hw_vpic *vpic; diff --git a/xen/arch/x86/include/asm/hvm/vioapic.h b/xen/arch/x86/include/asm/hvm/vioapic.h index 36b64d20d60c..2944ec20dd53 100644 --- a/xen/arch/x86/include/asm/hvm/vioapic.h +++ b/xen/arch/x86/include/asm/hvm/vioapic.h @@ -66,7 +66,7 @@ void vioapic_irq_positive_edge(struct domain *d, unsigned int irq); void vioapic_update_EOI(struct domain *d, u8 vector); int vioapic_get_mask(const struct domain *d, unsigned int gsi); -int vioapic_get_vector(const struct domain *d, unsigned int gsi); +int cf_check vioapic_get_vector(const struct domain *d, unsigned int gsi); int vioapic_get_trigger_mode(const struct domain *d, unsigned int gsi); #endif /* __ASM_X86_HVM_VIOAPIC_H__ */ diff --git a/xen/drivers/passthrough/amd/iommu_guest.c b/xen/drivers/passthrough/amd/iommu_guest.c index 361ff864d846..80a331f546ed 100644 --- a/xen/drivers/passthrough/amd/iommu_guest.c +++ b/xen/drivers/passthrough/amd/iommu_guest.c @@ -645,8 +645,8 @@ static uint64_t iommu_mmio_read64(struct guest_iommu *iommu, return val; } -static int guest_iommu_mmio_read(struct vcpu *v, unsigned long addr, - unsigned int len, unsigned long *pval) +static int cf_check guest_iommu_mmio_read( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long *pval) { struct guest_iommu *iommu = vcpu_iommu(v); unsigned long offset; @@ -735,8 +735,8 @@ static void guest_iommu_mmio_write64(struct guest_iommu *iommu, } } -static int guest_iommu_mmio_write(struct vcpu *v, unsigned long addr, - unsigned int len, unsigned long val) +static int cf_check guest_iommu_mmio_write( + struct vcpu *v, unsigned long addr, unsigned int len, unsigned long val) { struct guest_iommu *iommu = vcpu_iommu(v); unsigned long offset; @@ -819,7 +819,7 @@ static void guest_iommu_reg_init(struct guest_iommu *iommu) iommu->reg_ext_feature = ef; } -static int guest_iommu_mmio_range(struct vcpu *v, unsigned long addr) +static int cf_check guest_iommu_mmio_range(struct vcpu *v, unsigned long addr) { struct guest_iommu *iommu = vcpu_iommu(v); From patchwork Mon Feb 14 12:50:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745590 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 75956C433EF for ; Mon, 14 Feb 2022 13:16:50 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271930.466687 (Exim 4.92) (envelope-from ) id 1nJbDb-0003Nf-D0; Mon, 14 Feb 2022 13:16:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271930.466687; Mon, 14 Feb 2022 13:16:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDb-0003NT-9E; Mon, 14 Feb 2022 13:16:39 +0000 Received: by outflank-mailman (input) for mailman id 271930; Mon, 14 Feb 2022 13:16:37 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3m-0008IH-0Q for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:30 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id eb2b0ec9-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:27 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: eb2b0ec9-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843987; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=GWauAq5Hi4t0sVZGrU3/q6tMpZvbMlc+nyZ6uD+AkRI=; b=Ay0CCB9Kz/uvcRFfhiLSB3FuZDpAMadFy6IrAJFC8UMVbsMpgeXyMube ZvsvsJb5xhRogwpn4PXuGdH878DFwAvEvZergm9mxrIiwf5bHIdV29+QM YNeBpuFUM8hpBErbvUWgoTOWR/IzkvWNxnkTwFim7DqRGu09B2XT9xQR0 0=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: o4lSuCzDEusyVfSInkyFoHW4DgsPAKeUwFYa6tsXxSB0jgSnx/3zwHDm161r/7oMdBA0f212v0 0sSY+qJAZRTzrax9S5ujZSAWaWtZjKM4PLDUDnejA6F6izTMDj3EwXkIHONTE4NMkMIW/j28Wl 6/zwDaGnHAzxYHxsC4g65ZOyGUyBbCEVnGj+PD6DsqwP4QgXGwbtqXUlzBuy1SpmQ94IPUW/By oBvLqf4ZXIK5gajkxkkbu49X6G5shjOQnawJA+LofFqUMjAMqU+RtZt/s3uvNe2Wh5IJATPTGc yFnRCnF5ImrkU+N539g2xh3h X-SBRS: 5.1 X-MesageID: 64050683 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Rn4lV65YTRTMTU2Ztge6hQxRtCHAchMFZxGqfqrLsTDasY5as4F+v mtJDG+HOvaPNzOjc40kbtyy/E0O68WAzt8yTAI+rygwHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z9 /hXmMXrYiYSEaSVu8MhXzgBOCNmMvgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQa6DP 5RJMlKDajyHTCxMHwoGMakDp7nxpynmVj8fpVaa8P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeRtWOkdosEA G0v1SN3jo8O+G3yZdvlUEjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5ilD2DHcihl3xKE9O2PRaodFvMC3PWBshR0U9OiF+Nm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:uUxSV6GC3MTHEZd/pLqE6seALOsnbusQ8zAXP0AYc3Jom62j5r mTdZsgtSMc5Ax8ZJhko6HkBEDiewK7yXcW2/hzAV7KZmCP0wHEEGgh1/qH/9SJIVyYygc378 ZdmsZFZ+EYdWIK7/rH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050683" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 34/70] x86/emul: CFI hardening Date: Mon, 14 Feb 2022 12:50:51 +0000 Message-ID: <20220214125127.17985-35-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. pv_emul_is_mem_write() is only used in a single file. Having it as a static inline is pointless because it can't be inlined to begin with. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- v2: * Correct details in commit message. --- xen/arch/x86/hvm/emulate.c | 72 +++++++++++++++++----------------- xen/arch/x86/hvm/hvm.c | 8 ++-- xen/arch/x86/hvm/svm/svm.c | 4 +- xen/arch/x86/include/asm/hvm/emulate.h | 8 ++-- xen/arch/x86/include/asm/mm.h | 16 +++----- xen/arch/x86/mm.c | 4 +- xen/arch/x86/mm/shadow/hvm.c | 8 ++-- xen/arch/x86/pv/emul-gate-op.c | 9 +++-- xen/arch/x86/pv/emul-priv-op.c | 64 +++++++++++++++--------------- xen/arch/x86/pv/emulate.h | 7 ---- xen/arch/x86/pv/ro-page-fault.c | 31 +++++++++------ xen/arch/x86/x86_emulate.c | 21 +++++----- xen/arch/x86/x86_emulate/x86_emulate.c | 10 ++--- xen/arch/x86/x86_emulate/x86_emulate.h | 33 ++++++++-------- 14 files changed, 148 insertions(+), 147 deletions(-) diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c index 39dac7fd9d6d..e8d510e0be91 100644 --- a/xen/arch/x86/hvm/emulate.c +++ b/xen/arch/x86/hvm/emulate.c @@ -1272,7 +1272,7 @@ static int __hvmemul_read( return linear_read(addr, bytes, p_data, pfec, hvmemul_ctxt); } -static int hvmemul_read( +static int cf_check hvmemul_read( enum x86_segment seg, unsigned long offset, void *p_data, @@ -1290,7 +1290,7 @@ static int hvmemul_read( container_of(ctxt, struct hvm_emulate_ctxt, ctxt)); } -int hvmemul_insn_fetch( +int cf_check hvmemul_insn_fetch( unsigned long offset, void *p_data, unsigned int bytes, @@ -1336,7 +1336,7 @@ int hvmemul_insn_fetch( return X86EMUL_OKAY; } -static int hvmemul_write( +static int cf_check hvmemul_write( enum x86_segment seg, unsigned long offset, void *p_data, @@ -1384,7 +1384,7 @@ static int hvmemul_write( return X86EMUL_OKAY; } -static int hvmemul_rmw( +static int cf_check hvmemul_rmw( enum x86_segment seg, unsigned long offset, unsigned int bytes, @@ -1437,7 +1437,7 @@ static int hvmemul_rmw( return rc; } -static int hvmemul_blk( +static int cf_check hvmemul_blk( enum x86_segment seg, unsigned long offset, void *p_data, @@ -1478,7 +1478,7 @@ static int hvmemul_blk( return rc; } -static int hvmemul_write_discard( +static int cf_check hvmemul_write_discard( enum x86_segment seg, unsigned long offset, void *p_data, @@ -1489,7 +1489,7 @@ static int hvmemul_write_discard( return X86EMUL_OKAY; } -static int hvmemul_rep_ins_discard( +static int cf_check hvmemul_rep_ins_discard( uint16_t src_port, enum x86_segment dst_seg, unsigned long dst_offset, @@ -1500,7 +1500,7 @@ static int hvmemul_rep_ins_discard( return X86EMUL_OKAY; } -static int hvmemul_rep_movs_discard( +static int cf_check hvmemul_rep_movs_discard( enum x86_segment src_seg, unsigned long src_offset, enum x86_segment dst_seg, @@ -1512,7 +1512,7 @@ static int hvmemul_rep_movs_discard( return X86EMUL_OKAY; } -static int hvmemul_rep_stos_discard( +static int cf_check hvmemul_rep_stos_discard( void *p_data, enum x86_segment seg, unsigned long offset, @@ -1523,7 +1523,7 @@ static int hvmemul_rep_stos_discard( return X86EMUL_OKAY; } -static int hvmemul_rep_outs_discard( +static int cf_check hvmemul_rep_outs_discard( enum x86_segment src_seg, unsigned long src_offset, uint16_t dst_port, @@ -1534,7 +1534,7 @@ static int hvmemul_rep_outs_discard( return X86EMUL_OKAY; } -static int hvmemul_cmpxchg_discard( +static int cf_check hvmemul_cmpxchg_discard( enum x86_segment seg, unsigned long offset, void *p_old, @@ -1546,7 +1546,7 @@ static int hvmemul_cmpxchg_discard( return X86EMUL_OKAY; } -static int hvmemul_read_io_discard( +static int cf_check hvmemul_read_io_discard( unsigned int port, unsigned int bytes, unsigned long *val, @@ -1555,7 +1555,7 @@ static int hvmemul_read_io_discard( return X86EMUL_OKAY; } -static int hvmemul_write_io_discard( +static int cf_check hvmemul_write_io_discard( unsigned int port, unsigned int bytes, unsigned long val, @@ -1564,7 +1564,7 @@ static int hvmemul_write_io_discard( return X86EMUL_OKAY; } -static int hvmemul_write_msr_discard( +static int cf_check hvmemul_write_msr_discard( unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt) @@ -1572,7 +1572,7 @@ static int hvmemul_write_msr_discard( return X86EMUL_OKAY; } -static int hvmemul_cache_op_discard( +static int cf_check hvmemul_cache_op_discard( enum x86emul_cache_op op, enum x86_segment seg, unsigned long offset, @@ -1581,7 +1581,7 @@ static int hvmemul_cache_op_discard( return X86EMUL_OKAY; } -static int hvmemul_cmpxchg( +static int cf_check hvmemul_cmpxchg( enum x86_segment seg, unsigned long offset, void *p_old, @@ -1675,7 +1675,7 @@ static int hvmemul_cmpxchg( return rc; } -static int hvmemul_validate( +static int cf_check hvmemul_validate( const struct x86_emulate_state *state, struct x86_emulate_ctxt *ctxt) { @@ -1688,7 +1688,7 @@ static int hvmemul_validate( ? X86EMUL_OKAY : X86EMUL_UNHANDLEABLE; } -static int hvmemul_rep_ins( +static int cf_check hvmemul_rep_ins( uint16_t src_port, enum x86_segment dst_seg, unsigned long dst_offset, @@ -1766,7 +1766,7 @@ static int hvmemul_rep_outs_set_context( return rc; } -static int hvmemul_rep_outs( +static int cf_check hvmemul_rep_outs( enum x86_segment src_seg, unsigned long src_offset, uint16_t dst_port, @@ -1807,7 +1807,7 @@ static int hvmemul_rep_outs( !!(ctxt->regs->eflags & X86_EFLAGS_DF), gpa); } -static int hvmemul_rep_movs( +static int cf_check hvmemul_rep_movs( enum x86_segment src_seg, unsigned long src_offset, enum x86_segment dst_seg, @@ -1977,7 +1977,7 @@ static int hvmemul_rep_movs( return X86EMUL_UNHANDLEABLE; } -static int hvmemul_rep_stos( +static int cf_check hvmemul_rep_stos( void *p_data, enum x86_segment seg, unsigned long offset, @@ -2105,7 +2105,7 @@ static int hvmemul_rep_stos( } } -static int hvmemul_read_segment( +static int cf_check hvmemul_read_segment( enum x86_segment seg, struct segment_register *reg, struct x86_emulate_ctxt *ctxt) @@ -2122,7 +2122,7 @@ static int hvmemul_read_segment( return X86EMUL_OKAY; } -static int hvmemul_write_segment( +static int cf_check hvmemul_write_segment( enum x86_segment seg, const struct segment_register *reg, struct x86_emulate_ctxt *ctxt) @@ -2141,7 +2141,7 @@ static int hvmemul_write_segment( return X86EMUL_OKAY; } -static int hvmemul_read_io( +static int cf_check hvmemul_read_io( unsigned int port, unsigned int bytes, unsigned long *val, @@ -2158,7 +2158,7 @@ static int hvmemul_read_io( return hvmemul_do_pio_buffer(port, bytes, IOREQ_READ, val); } -static int hvmemul_write_io( +static int cf_check hvmemul_write_io( unsigned int port, unsigned int bytes, unsigned long val, @@ -2167,7 +2167,7 @@ static int hvmemul_write_io( return hvmemul_do_pio_buffer(port, bytes, IOREQ_WRITE, &val); } -static int hvmemul_read_cr( +static int cf_check hvmemul_read_cr( unsigned int reg, unsigned long *val, struct x86_emulate_ctxt *ctxt) @@ -2188,7 +2188,7 @@ static int hvmemul_read_cr( return X86EMUL_UNHANDLEABLE; } -static int hvmemul_write_cr( +static int cf_check hvmemul_write_cr( unsigned int reg, unsigned long val, struct x86_emulate_ctxt *ctxt) @@ -2232,7 +2232,7 @@ static int hvmemul_write_cr( return rc; } -static int hvmemul_read_xcr( +static int cf_check hvmemul_read_xcr( unsigned int reg, uint64_t *val, struct x86_emulate_ctxt *ctxt) @@ -2245,7 +2245,7 @@ static int hvmemul_read_xcr( return rc; } -static int hvmemul_write_xcr( +static int cf_check hvmemul_write_xcr( unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt) @@ -2255,7 +2255,7 @@ static int hvmemul_write_xcr( return x86emul_write_xcr(reg, val, ctxt); } -static int hvmemul_read_msr( +static int cf_check hvmemul_read_msr( unsigned int reg, uint64_t *val, struct x86_emulate_ctxt *ctxt) @@ -2268,7 +2268,7 @@ static int hvmemul_read_msr( return rc; } -static int hvmemul_write_msr( +static int cf_check hvmemul_write_msr( unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt) @@ -2281,7 +2281,7 @@ static int hvmemul_write_msr( return rc; } -static int hvmemul_cache_op( +static int cf_check hvmemul_cache_op( enum x86emul_cache_op op, enum x86_segment seg, unsigned long offset, @@ -2353,7 +2353,7 @@ static int hvmemul_cache_op( return X86EMUL_OKAY; } -static int hvmemul_get_fpu( +static int cf_check hvmemul_get_fpu( enum x86_emulate_fpu_type type, struct x86_emulate_ctxt *ctxt) { @@ -2395,7 +2395,7 @@ static int hvmemul_get_fpu( return X86EMUL_OKAY; } -static void hvmemul_put_fpu( +static void cf_check hvmemul_put_fpu( struct x86_emulate_ctxt *ctxt, enum x86_emulate_fpu_type backout, const struct x86_emul_fpu_aux *aux) @@ -2482,7 +2482,7 @@ static void hvmemul_put_fpu( } } -static int hvmemul_tlb_op( +static int cf_check hvmemul_tlb_op( enum x86emul_tlb_op op, unsigned long addr, unsigned long aux, @@ -2539,7 +2539,7 @@ static int hvmemul_tlb_op( return rc; } -static int hvmemul_vmfunc( +static int cf_check hvmemul_vmfunc( struct x86_emulate_ctxt *ctxt) { int rc; diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 9e4924649077..e87e809a945d 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3755,8 +3755,8 @@ void hvm_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) } } -static bool is_sysdesc_access(const struct x86_emulate_state *state, - const struct x86_emulate_ctxt *ctxt) +static bool cf_check is_sysdesc_access( + const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { unsigned int ext; int mode = x86_insn_modrm(state, NULL, &ext); @@ -3796,8 +3796,8 @@ int hvm_descriptor_access_intercept(uint64_t exit_info, return X86EMUL_OKAY; } -static bool is_cross_vendor(const struct x86_emulate_state *state, - const struct x86_emulate_ctxt *ctxt) +static bool cf_check is_cross_vendor( + const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { switch ( ctxt->opcode ) { diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index 4c4ebda5e6e4..dedb2848e6a1 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -2447,8 +2447,8 @@ static void svm_invlpg_intercept(unsigned long linear) paging_invlpg(current, linear); } -static bool is_invlpg(const struct x86_emulate_state *state, - const struct x86_emulate_ctxt *ctxt) +static bool cf_check is_invlpg( + const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { unsigned int ext; diff --git a/xen/arch/x86/include/asm/hvm/emulate.h b/xen/arch/x86/include/asm/hvm/emulate.h index e67004060345..d8ba2df4e4a2 100644 --- a/xen/arch/x86/include/asm/hvm/emulate.h +++ b/xen/arch/x86/include/asm/hvm/emulate.h @@ -92,10 +92,10 @@ static inline bool handle_mmio(void) return hvm_emulate_one_insn(x86_insn_is_mem_access, "MMIO"); } -int hvmemul_insn_fetch(unsigned long offset, - void *p_data, - unsigned int bytes, - struct x86_emulate_ctxt *ctxt); +int cf_check hvmemul_insn_fetch( + unsigned long offset, void *p_data, unsigned int bytes, + struct x86_emulate_ctxt *ctxt); + int hvmemul_do_pio_buffer(uint16_t port, unsigned int size, uint8_t dir, diff --git a/xen/arch/x86/include/asm/mm.h b/xen/arch/x86/include/asm/mm.h index 9b9de4c6bef7..a684ffabfaae 100644 --- a/xen/arch/x86/include/asm/mm.h +++ b/xen/arch/x86/include/asm/mm.h @@ -538,16 +538,12 @@ struct mmio_ro_emulate_ctxt { unsigned int seg, bdf; }; -extern int mmio_ro_emulated_write(enum x86_segment seg, - unsigned long offset, - void *p_data, - unsigned int bytes, - struct x86_emulate_ctxt *ctxt); -extern int mmcfg_intercept_write(enum x86_segment seg, - unsigned long offset, - void *p_data, - unsigned int bytes, - struct x86_emulate_ctxt *ctxt); +int cf_check mmio_ro_emulated_write( + enum x86_segment seg, unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt); +int cf_check mmcfg_intercept_write( + enum x86_segment seg, unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt); int audit_adjust_pgtables(struct domain *d, int dir, int noisy); diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 4b6956c5be78..4d0bebbf8aab 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4852,7 +4852,7 @@ long arch_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) return 0; } -int mmio_ro_emulated_write( +int cf_check mmio_ro_emulated_write( enum x86_segment seg, unsigned long offset, void *p_data, @@ -4873,7 +4873,7 @@ int mmio_ro_emulated_write( return X86EMUL_OKAY; } -int mmcfg_intercept_write( +int cf_check mmcfg_intercept_write( enum x86_segment seg, unsigned long offset, void *p_data, diff --git a/xen/arch/x86/mm/shadow/hvm.c b/xen/arch/x86/mm/shadow/hvm.c index f2991bc176f0..c90d326becb3 100644 --- a/xen/arch/x86/mm/shadow/hvm.c +++ b/xen/arch/x86/mm/shadow/hvm.c @@ -148,7 +148,7 @@ hvm_read(enum x86_segment seg, return X86EMUL_UNHANDLEABLE; } -static int +static int cf_check hvm_emulate_read(enum x86_segment seg, unsigned long offset, void *p_data, @@ -161,7 +161,7 @@ hvm_emulate_read(enum x86_segment seg, container_of(ctxt, struct sh_emulate_ctxt, ctxt)); } -static int +static int cf_check hvm_emulate_insn_fetch(unsigned long offset, void *p_data, unsigned int bytes, @@ -181,7 +181,7 @@ hvm_emulate_insn_fetch(unsigned long offset, return X86EMUL_OKAY; } -static int +static int cf_check hvm_emulate_write(enum x86_segment seg, unsigned long offset, void *p_data, @@ -234,7 +234,7 @@ hvm_emulate_write(enum x86_segment seg, return X86EMUL_OKAY; } -static int +static int cf_check hvm_emulate_cmpxchg(enum x86_segment seg, unsigned long offset, void *p_old, diff --git a/xen/arch/x86/pv/emul-gate-op.c b/xen/arch/x86/pv/emul-gate-op.c index 68ec4d11f6bb..758a20ad9df4 100644 --- a/xen/arch/x86/pv/emul-gate-op.c +++ b/xen/arch/x86/pv/emul-gate-op.c @@ -96,8 +96,9 @@ struct gate_op_ctxt { bool insn_fetch; }; -static int read_mem(enum x86_segment seg, unsigned long offset, void *p_data, - unsigned int bytes, struct x86_emulate_ctxt *ctxt) +static int cf_check read_mem( + enum x86_segment seg, unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt) { const struct gate_op_ctxt *goc = container_of(ctxt, struct gate_op_ctxt, ctxt); @@ -163,8 +164,8 @@ static int read_mem(enum x86_segment seg, unsigned long offset, void *p_data, return X86EMUL_OKAY; } -static int fetch(unsigned long offset, void *p_data, - unsigned int bytes, struct x86_emulate_ctxt *ctxt) +static int cf_check fetch(unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt) { return read_mem(x86_seg_cs, offset, p_data, bytes, ctxt); } diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c index c78be6d92b21..c46c072f93db 100644 --- a/xen/arch/x86/pv/emul-priv-op.c +++ b/xen/arch/x86/pv/emul-priv-op.c @@ -358,8 +358,9 @@ static unsigned int check_guest_io_breakpoint(struct vcpu *v, return match; } -static int read_io(unsigned int port, unsigned int bytes, - unsigned long *val, struct x86_emulate_ctxt *ctxt) +static int cf_check read_io( + unsigned int port, unsigned int bytes, unsigned long *val, + struct x86_emulate_ctxt *ctxt) { struct priv_op_ctxt *poc = container_of(ctxt, struct priv_op_ctxt, ctxt); struct vcpu *curr = current; @@ -462,8 +463,9 @@ static void guest_io_write(unsigned int port, unsigned int bytes, } } -static int write_io(unsigned int port, unsigned int bytes, - unsigned long val, struct x86_emulate_ctxt *ctxt) +static int cf_check write_io( + unsigned int port, unsigned int bytes, unsigned long val, + struct x86_emulate_ctxt *ctxt) { struct priv_op_ctxt *poc = container_of(ctxt, struct priv_op_ctxt, ctxt); struct vcpu *curr = current; @@ -493,9 +495,9 @@ static int write_io(unsigned int port, unsigned int bytes, return X86EMUL_OKAY; } -static int read_segment(enum x86_segment seg, - struct segment_register *reg, - struct x86_emulate_ctxt *ctxt) +static int cf_check read_segment( + enum x86_segment seg, struct segment_register *reg, + struct x86_emulate_ctxt *ctxt) { /* Check if this is an attempt to access the I/O bitmap. */ if ( seg == x86_seg_tr ) @@ -607,10 +609,10 @@ static int pv_emul_virt_to_linear(unsigned long base, unsigned long offset, return rc; } -static int rep_ins(uint16_t port, - enum x86_segment seg, unsigned long offset, - unsigned int bytes_per_rep, unsigned long *reps, - struct x86_emulate_ctxt *ctxt) +static int cf_check rep_ins( + uint16_t port, enum x86_segment seg, unsigned long offset, + unsigned int bytes_per_rep, unsigned long *reps, + struct x86_emulate_ctxt *ctxt) { struct priv_op_ctxt *poc = container_of(ctxt, struct priv_op_ctxt, ctxt); struct vcpu *curr = current; @@ -675,10 +677,10 @@ static int rep_ins(uint16_t port, return X86EMUL_OKAY; } -static int rep_outs(enum x86_segment seg, unsigned long offset, - uint16_t port, - unsigned int bytes_per_rep, unsigned long *reps, - struct x86_emulate_ctxt *ctxt) +static int cf_check rep_outs( + enum x86_segment seg, unsigned long offset, uint16_t port, + unsigned int bytes_per_rep, unsigned long *reps, + struct x86_emulate_ctxt *ctxt) { struct priv_op_ctxt *poc = container_of(ctxt, struct priv_op_ctxt, ctxt); struct vcpu *curr = current; @@ -744,8 +746,8 @@ static int rep_outs(enum x86_segment seg, unsigned long offset, return X86EMUL_OKAY; } -static int read_cr(unsigned int reg, unsigned long *val, - struct x86_emulate_ctxt *ctxt) +static int cf_check read_cr( + unsigned int reg, unsigned long *val, struct x86_emulate_ctxt *ctxt) { const struct vcpu *curr = current; @@ -787,8 +789,8 @@ static int read_cr(unsigned int reg, unsigned long *val, return X86EMUL_UNHANDLEABLE; } -static int write_cr(unsigned int reg, unsigned long val, - struct x86_emulate_ctxt *ctxt) +static int cf_check write_cr( + unsigned int reg, unsigned long val, struct x86_emulate_ctxt *ctxt) { struct vcpu *curr = current; @@ -871,8 +873,8 @@ static uint64_t guest_efer(const struct domain *d) return val; } -static int read_msr(unsigned int reg, uint64_t *val, - struct x86_emulate_ctxt *ctxt) +static int cf_check read_msr( + unsigned int reg, uint64_t *val, struct x86_emulate_ctxt *ctxt) { struct vcpu *curr = current; const struct domain *currd = curr->domain; @@ -1020,8 +1022,8 @@ static int read_msr(unsigned int reg, uint64_t *val, return ret; } -static int write_msr(unsigned int reg, uint64_t val, - struct x86_emulate_ctxt *ctxt) +static int cf_check write_msr( + unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt) { struct vcpu *curr = current; const struct domain *currd = curr->domain; @@ -1188,8 +1190,9 @@ static int write_msr(unsigned int reg, uint64_t val, return X86EMUL_UNHANDLEABLE; } -static int cache_op(enum x86emul_cache_op op, enum x86_segment seg, - unsigned long offset, struct x86_emulate_ctxt *ctxt) +static int cf_check cache_op( + enum x86emul_cache_op op, enum x86_segment seg, + unsigned long offset, struct x86_emulate_ctxt *ctxt) { ASSERT(op == x86emul_wbinvd || op == x86emul_wbnoinvd); @@ -1208,8 +1211,8 @@ static int cache_op(enum x86emul_cache_op op, enum x86_segment seg, return X86EMUL_OKAY; } -static int validate(const struct x86_emulate_state *state, - struct x86_emulate_ctxt *ctxt) +static int cf_check validate( + const struct x86_emulate_state *state, struct x86_emulate_ctxt *ctxt) { switch ( ctxt->opcode ) { @@ -1258,10 +1261,9 @@ static int validate(const struct x86_emulate_state *state, return X86EMUL_UNHANDLEABLE; } -static int insn_fetch(unsigned long offset, - void *p_data, - unsigned int bytes, - struct x86_emulate_ctxt *ctxt) +static int cf_check insn_fetch( + unsigned long offset, void *p_data, unsigned int bytes, + struct x86_emulate_ctxt *ctxt) { const struct priv_op_ctxt *poc = container_of(ctxt, struct priv_op_ctxt, ctxt); diff --git a/xen/arch/x86/pv/emulate.h b/xen/arch/x86/pv/emulate.h index 4b845b08e372..49a4d34832df 100644 --- a/xen/arch/x86/pv/emulate.h +++ b/xen/arch/x86/pv/emulate.h @@ -12,13 +12,6 @@ int pv_emul_read_descriptor(unsigned int sel, const struct vcpu *v, void pv_emul_instruction_done(struct cpu_user_regs *regs, unsigned long rip); -static inline int pv_emul_is_mem_write(const struct x86_emulate_state *state, - struct x86_emulate_ctxt *ctxt) -{ - return x86_insn_is_mem_write(state, ctxt) ? X86EMUL_OKAY - : X86EMUL_UNHANDLEABLE; -} - /* Return a pointer to the GDT/LDT descriptor referenced by sel. */ static inline const seg_desc_t *gdt_ldt_desc_ptr(unsigned int sel) { diff --git a/xen/arch/x86/pv/ro-page-fault.c b/xen/arch/x86/pv/ro-page-fault.c index ef4d146c1d9e..5963f5ee2d51 100644 --- a/xen/arch/x86/pv/ro-page-fault.c +++ b/xen/arch/x86/pv/ro-page-fault.c @@ -26,6 +26,13 @@ #include "emulate.h" #include "mm.h" +static int cf_check pv_emul_is_mem_write( + const struct x86_emulate_state *state, struct x86_emulate_ctxt *ctxt) +{ + return x86_insn_is_mem_write(state, ctxt) ? X86EMUL_OKAY + : X86EMUL_UNHANDLEABLE; +} + /********************* * Writable Pagetables */ @@ -35,9 +42,9 @@ struct ptwr_emulate_ctxt { l1_pgentry_t pte; }; -static int ptwr_emulated_read(enum x86_segment seg, unsigned long offset, - void *p_data, unsigned int bytes, - struct x86_emulate_ctxt *ctxt) +static int cf_check ptwr_emulated_read( + enum x86_segment seg, unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt) { unsigned int rc = bytes; unsigned long addr = offset; @@ -52,9 +59,9 @@ static int ptwr_emulated_read(enum x86_segment seg, unsigned long offset, return X86EMUL_OKAY; } -static int ptwr_emulated_insn_fetch(unsigned long offset, - void *p_data, unsigned int bytes, - struct x86_emulate_ctxt *ctxt) +static int cf_check ptwr_emulated_insn_fetch( + unsigned long offset, void *p_data, unsigned int bytes, + struct x86_emulate_ctxt *ctxt) { unsigned int rc = copy_from_guest_pv(p_data, (void *)offset, bytes); @@ -218,9 +225,9 @@ static int ptwr_emulated_update(unsigned long addr, intpte_t *p_old, return X86EMUL_OKAY; } -static int ptwr_emulated_write(enum x86_segment seg, unsigned long offset, - void *p_data, unsigned int bytes, - struct x86_emulate_ctxt *ctxt) +static int cf_check ptwr_emulated_write( + enum x86_segment seg, unsigned long offset, void *p_data, + unsigned int bytes, struct x86_emulate_ctxt *ctxt) { intpte_t val = 0; @@ -236,9 +243,9 @@ static int ptwr_emulated_write(enum x86_segment seg, unsigned long offset, return ptwr_emulated_update(offset, NULL, val, bytes, ctxt); } -static int ptwr_emulated_cmpxchg(enum x86_segment seg, unsigned long offset, - void *p_old, void *p_new, unsigned int bytes, - bool lock, struct x86_emulate_ctxt *ctxt) +static int cf_check ptwr_emulated_cmpxchg( + enum x86_segment seg, unsigned long offset, void *p_old, void *p_new, + unsigned int bytes, bool lock, struct x86_emulate_ctxt *ctxt) { intpte_t old = 0, new = 0; int rc; diff --git a/xen/arch/x86/x86_emulate.c b/xen/arch/x86/x86_emulate.c index 1e082e6f3b2d..60191a94dc18 100644 --- a/xen/arch/x86/x86_emulate.c +++ b/xen/arch/x86/x86_emulate.c @@ -53,8 +53,8 @@ #include "x86_emulate/x86_emulate.c" -int x86emul_read_xcr(unsigned int reg, uint64_t *val, - struct x86_emulate_ctxt *ctxt) +int cf_check x86emul_read_xcr( + unsigned int reg, uint64_t *val, struct x86_emulate_ctxt *ctxt) { switch ( reg ) { @@ -77,8 +77,8 @@ int x86emul_read_xcr(unsigned int reg, uint64_t *val, } /* Note: May be called with ctxt=NULL. */ -int x86emul_write_xcr(unsigned int reg, uint64_t val, - struct x86_emulate_ctxt *ctxt) +int cf_check x86emul_write_xcr( + unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt) { switch ( reg ) { @@ -100,8 +100,8 @@ int x86emul_write_xcr(unsigned int reg, uint64_t val, #ifdef CONFIG_PV /* Called with NULL ctxt in hypercall context. */ -int x86emul_read_dr(unsigned int reg, unsigned long *val, - struct x86_emulate_ctxt *ctxt) +int cf_check x86emul_read_dr( + unsigned int reg, unsigned long *val, struct x86_emulate_ctxt *ctxt) { struct vcpu *curr = current; @@ -143,8 +143,8 @@ int x86emul_read_dr(unsigned int reg, unsigned long *val, return X86EMUL_OKAY; } -int x86emul_write_dr(unsigned int reg, unsigned long val, - struct x86_emulate_ctxt *ctxt) +int cf_check x86emul_write_dr( + unsigned int reg, unsigned long val, struct x86_emulate_ctxt *ctxt) { struct vcpu *curr = current; @@ -167,8 +167,9 @@ int x86emul_write_dr(unsigned int reg, unsigned long val, } #endif /* CONFIG_PV */ -int x86emul_cpuid(uint32_t leaf, uint32_t subleaf, - struct cpuid_leaf *res, struct x86_emulate_ctxt *ctxt) +int cf_check x86emul_cpuid( + uint32_t leaf, uint32_t subleaf, struct cpuid_leaf *res, + struct x86_emulate_ctxt *ctxt) { guest_cpuid(current, leaf, subleaf, res); diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 824af9d899b5..5cdef535affd 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2524,7 +2524,7 @@ static void adjust_bnd(struct x86_emulate_ctxt *ctxt, done:; } -int x86emul_unhandleable_rw( +int cf_check x86emul_unhandleable_rw( enum x86_segment seg, unsigned long offset, void *p_data, @@ -12318,7 +12318,7 @@ x86_insn_operand_ea(const struct x86_emulate_state *state, * memory operand (like POP), but it does not mean e.g. segment selector * loads, where the descriptor table access is considered an implicit one. */ -bool +bool cf_check x86_insn_is_mem_access(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { @@ -12410,7 +12410,7 @@ x86_insn_is_mem_access(const struct x86_emulate_state *state, * loads, where the (possible) descriptor table write is considered an * implicit access. */ -bool +bool cf_check x86_insn_is_mem_write(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { @@ -12582,7 +12582,7 @@ x86_insn_is_mem_write(const struct x86_emulate_state *state, return false; } -bool +bool cf_check x86_insn_is_portio(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { @@ -12597,7 +12597,7 @@ x86_insn_is_portio(const struct x86_emulate_state *state, return false; } -bool +bool cf_check x86_insn_is_cr_access(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt) { diff --git a/xen/arch/x86/x86_emulate/x86_emulate.h b/xen/arch/x86/x86_emulate/x86_emulate.h index 419def8790a0..4732855c40ed 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.h +++ b/xen/arch/x86/x86_emulate/x86_emulate.h @@ -737,7 +737,7 @@ static inline unsigned long *decode_gpr(struct cpu_user_regs *regs, } /* Unhandleable read, write or instruction fetch */ -int +int cf_check x86emul_unhandleable_rw( enum x86_segment seg, unsigned long offset, @@ -766,16 +766,16 @@ x86_insn_immediate(const struct x86_emulate_state *state, unsigned int x86_insn_length(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt); -bool +bool cf_check x86_insn_is_mem_access(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt); -bool +bool cf_check x86_insn_is_mem_write(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt); -bool +bool cf_check x86_insn_is_portio(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt); -bool +bool cf_check x86_insn_is_cr_access(const struct x86_emulate_state *state, const struct x86_emulate_ctxt *ctxt); @@ -787,17 +787,18 @@ void x86_emulate_free_state(struct x86_emulate_state *state); #ifdef __XEN__ -int x86emul_read_xcr(unsigned int reg, uint64_t *val, - struct x86_emulate_ctxt *ctxt); -int x86emul_write_xcr(unsigned int reg, uint64_t val, - struct x86_emulate_ctxt *ctxt); - -int x86emul_read_dr(unsigned int reg, unsigned long *val, - struct x86_emulate_ctxt *ctxt); -int x86emul_write_dr(unsigned int reg, unsigned long val, - struct x86_emulate_ctxt *ctxt); -int x86emul_cpuid(uint32_t leaf, uint32_t subleaf, - struct cpuid_leaf *res, struct x86_emulate_ctxt *ctxt); +int cf_check x86emul_read_xcr( + unsigned int reg, uint64_t *val, struct x86_emulate_ctxt *ctxt); +int cf_check x86emul_write_xcr( + unsigned int reg, uint64_t val, struct x86_emulate_ctxt *ctxt); + +int cf_check x86emul_read_dr( + unsigned int reg, unsigned long *val, struct x86_emulate_ctxt *ctxt); +int cf_check x86emul_write_dr( + unsigned int reg, unsigned long val, struct x86_emulate_ctxt *ctxt); +int cf_check x86emul_cpuid( + uint32_t leaf, uint32_t subleaf, struct cpuid_leaf *res, + struct x86_emulate_ctxt *ctxt); #endif From patchwork Mon Feb 14 12:50:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745572 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 351EAC433F5 for ; Mon, 14 Feb 2022 13:06:54 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271754.466472 (Exim 4.92) (envelope-from ) id 1nJb3y-0005NK-BK; Mon, 14 Feb 2022 13:06:42 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271754.466472; Mon, 14 Feb 2022 13:06:42 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3x-0005K7-Ke; Mon, 14 Feb 2022 13:06:41 +0000 Received: by outflank-mailman (input) for mailman id 271754; Mon, 14 Feb 2022 13:06:39 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2y-0008IH-15 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:40 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id cd88c665-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:38 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: cd88c665-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843939; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=4p8+U7bQUnOYzkSxSSSq0ARZQ5aCAjglSKvDPx7PBXU=; b=cdBPF2rTlXP97cxC5uEypg64F2+pKnF/dTu/cYMAJiqW97waMsrs3ZhY yNQEjlFVpvuRwFsiyogqWv5PyzfVSDLspM4SLnZJnxbgeuUfj22BJhq0X MjMSoD+u9yZgPewdf060FWipMPIF4Rj04ad5hy+xtgSjv0ZzlsAlDjrWA o=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: I3xCB+3fYRW2bTBtXxPA9LKnhh8j+kIIwyPJaxWpSWbX0yPGAxBsOCiFCeFL2z8YUP2i2QNjmE FuQ+uuwjc8RCpCLbQYpu8t3j0lKvL95ukJnmxd6HFtb5HcJqiUYLZPJtFUJ+vpMwKGaDUqwwsL dThtQs3O9pu9DALvZtuqo/EjqgiD2xRQ9SiIyBLBO9NmaFMf2lQvGvkehcPSttwwWMn2NH9Xkw AQLscSxktHCugoZ0xvvFAxiD1+/KavASYX1/Oxx/54T9hz5wGMAAEf9zkK702/VqoC+nF3QGuy V4LidFhyYeC6kTylrBo6DuQK X-SBRS: 5.1 X-MesageID: 64149412 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:uiZ6yqJZVFsbZxGpFE+RzpIlxSXFcZb7ZxGr2PjKsXjdYENS1TcBz GcbXWjVOPjYM2GkKdB1b4/k90tVusTTxoVgSwJlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB2Qo/Bj0 cgdk6brEx8yYZDCwsI+f0VhRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Gls35wfQa+ED yYfQRVuQh+DOC8fA24WT8Iag6CIgHzkczIN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3Oindmrk1PufegEc VQPpRcg944R2BCSG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspuNt2uVnrKNaY2y8kT85v1dNoufRVTpl CFax5TBvLBTUMnUz3blrAAx8FaBvajtDdEhqQQ3Q8lJG8qFpxZPgry8EBkhfRw0Y67oiBfiY VPJuBM52XOgFCDCUEODWKroU55C5fG5TbzND6mIBvITMskZXFLWp0lGOB/Pt10BZWBxyMnTz 7/AKp3yZZvbYIw6pAeLqxA1j+N1mHBkmD+7qFKS503P7IdyrUW9Ed8tWGZipMhjhE9diAmKo dtZKeWQzBBTDL/3biXNqNZBJlEWN3krQ5vxrpUPJOKEJwNnHkAnCuPQnux9K9A0wfwNm7ea5 Gy5V29Z1EH72S/NJzKVZy0xc7joR5t+8y42ZHR+IVay1nE/So+z96NDJYAvdLwq+bU7n/55R vUIYeuaBfFLRmiV8jgRd8Cl/odjaA6qlUSFOC/8OGozeJtpRgro/N74f1SwqHlSX3Tv7cZn+ u+uzALWR5YHVj9ONseOZaL91U61sFgchPl2AxnCLO5MdRi+64NtMSHw0KM6epleNRXZyzKG/ A+KGhNE9/LVqoo4/dSV16CJq4ClT7l3EkZARjSJ6L+3MW/R/3a5wJ8GW+GNJGiPWGTx8aSkR ONU0/Cjb6FXwAcU69JxQ+Rx0KYzx9rzvLsLnA1rEULCY0mvFr49cGKN2tNCt/EVy7JU0edst pljJjWO1W21Bf7Y IronPort-HdrOrdr: A9a23:Ig21wK/4+ssNKksLZx9uk+DcI+orL9Y04lQ7vn2YSXRuE/Bw9v re5MjzuiWE6wr5NEtOpTnEAtjlfZq+z+8N3WByB8bBYOCOggLBR+sOgbcKgQeQfBEWntQts5 uIGJIfNDSfNzZHZL7BkWyFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149412" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 35/70] x86/ucode: CFI hardening Date: Mon, 14 Feb 2022 12:50:52 +0000 Message-ID: <20220214125127.17985-36-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/microcode/amd.c | 9 +++++---- xen/arch/x86/cpu/microcode/core.c | 4 ++-- xen/arch/x86/cpu/microcode/intel.c | 10 +++++----- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c index fe92e594f129..0afa2192bf1d 100644 --- a/xen/arch/x86/cpu/microcode/amd.c +++ b/xen/arch/x86/cpu/microcode/amd.c @@ -91,7 +91,7 @@ static struct { uint16_t id; } equiv __read_mostly; -static void collect_cpu_info(void) +static void cf_check collect_cpu_info(void) { struct cpu_signature *csig = &this_cpu(cpu_sig); @@ -204,7 +204,7 @@ static enum microcode_match_result compare_header( return compare_revisions(old->patch_id, new->patch_id); } -static enum microcode_match_result compare_patch( +static enum microcode_match_result cf_check compare_patch( const struct microcode_patch *new, const struct microcode_patch *old) { /* Both patches to compare are supposed to be applicable to local CPU. */ @@ -214,7 +214,7 @@ static enum microcode_match_result compare_patch( return compare_header(new, old); } -static int apply_microcode(const struct microcode_patch *patch) +static int cf_check apply_microcode(const struct microcode_patch *patch) { int hw_err; unsigned int cpu = smp_processor_id(); @@ -299,7 +299,8 @@ static int scan_equiv_cpu_table(const struct container_equiv_table *et) return -ESRCH; } -static struct microcode_patch *cpu_request_microcode(const void *buf, size_t size) +static struct microcode_patch *cf_check cpu_request_microcode( + const void *buf, size_t size) { const struct microcode_patch *saved = NULL; struct microcode_patch *patch = NULL; diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index 841364208053..c07f68ba350e 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -291,12 +291,12 @@ static int wait_for_condition(bool (*func)(unsigned int data), return 0; } -static bool wait_cpu_callin(unsigned int nr) +static bool cf_check wait_cpu_callin(unsigned int nr) { return cpumask_weight(&cpu_callin_map) >= nr; } -static bool wait_cpu_callout(unsigned int nr) +static bool cf_check wait_cpu_callout(unsigned int nr) { return atomic_read(&cpu_out) >= nr; } diff --git a/xen/arch/x86/cpu/microcode/intel.c b/xen/arch/x86/cpu/microcode/intel.c index f6d01490e0ab..d3864b5ab03e 100644 --- a/xen/arch/x86/cpu/microcode/intel.c +++ b/xen/arch/x86/cpu/microcode/intel.c @@ -116,7 +116,7 @@ static bool signature_matches(const struct cpu_signature *cpu_sig, return cpu_sig->pf & ucode_pf; } -static void collect_cpu_info(void) +static void cf_check collect_cpu_info(void) { struct cpu_signature *csig = &this_cpu(cpu_sig); uint64_t msr_content; @@ -271,7 +271,7 @@ static enum microcode_match_result microcode_update_match( return compare_revisions(cpu_sig->rev, mc->rev); } -static enum microcode_match_result compare_patch( +static enum microcode_match_result cf_check compare_patch( const struct microcode_patch *new, const struct microcode_patch *old) { /* @@ -284,7 +284,7 @@ static enum microcode_match_result compare_patch( return compare_revisions(old->rev, new->rev); } -static int apply_microcode(const struct microcode_patch *patch) +static int cf_check apply_microcode(const struct microcode_patch *patch) { uint64_t msr_content; unsigned int cpu = smp_processor_id(); @@ -323,8 +323,8 @@ static int apply_microcode(const struct microcode_patch *patch) return 0; } -static struct microcode_patch *cpu_request_microcode(const void *buf, - size_t size) +static struct microcode_patch *cf_check cpu_request_microcode( + const void *buf, size_t size) { int error = 0; const struct microcode_patch *saved = NULL; From patchwork Mon Feb 14 12:50:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745546 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9E9B1C433F5 for ; Mon, 14 Feb 2022 13:05:01 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271645.466208 (Exim 4.92) (envelope-from ) id 1nJb2B-0000js-Pt; Mon, 14 Feb 2022 13:04:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271645.466208; Mon, 14 Feb 2022 13:04:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2B-0000jP-IR; Mon, 14 Feb 2022 13:04:51 +0000 Received: by outflank-mailman (input) for mailman id 271645; Mon, 14 Feb 2022 13:04:49 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb29-0008IH-LL for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:49 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id af782393-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:48 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: af782393-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843888; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=BEoNz1G1VEb1PvMVHl3dUIUZku1FDM+32RnsoUebuRQ=; b=JpfsnV0I4ACv5kyo+ixL2GWs1tBqlly6FtEObKMqncdivA8rw7A0BJ/L trlnzdHdD3UziKDVAs1TLv5iUltIfFUTFVKEg0zim8tBSXoEOQh9nJOxM fVdk471ds+H3Fx3ciFJ9CEkfuiSUye9SBNabxVQtPb1KL/iAAskQMc+rk c=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: PmpWHPe03+VbbIE8oS71P1YGSlFsPbH89gQw0QKTwC1T5H0nJ9d2eaFOerhhj1Ah1qQnKJENtV MpRBfFGnvfyed4YbBcjHH0BgfNLvImeqtPHMzvTttRCI7rCoIJkHz932whdopODlUl7pG1czdn 9+AA9t4cqorIciBtMdP9cx57Db7benA5L3uTaylXG57W2QWmOJW6Yg7seuVdSaaGJmougDINAJ rH20FV5qvSEvCsesfmGrjG/Zs6Ti0kQ0SsfODw6APf/I0laBbDntFLdv/iBgXpSwkRalj5X/E9 tgAnKaKKSCEbCQs5QgfSEbhJ X-SBRS: 5.1 X-MesageID: 64149632 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:sJNihKpkBnGbHDq2jI9fCPpKaWdeBmIGYhIvgKrLsJaIsI4StFCzt garIBmCa6uPYDbzL98kbo23pBxVsMDVzdMwGlFrris1RCxD9JuZCYyVIHmrMnLJJKUvbq7GA +byyDXkBJppJpMJjk71atANlZT4vE2xbuKU5NTsY0idfic5Dndx4f5fs7Rh2NQw24HlW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCnZK+axwJGaHdorsmdUNCLjN7IY9IxLCSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O ZZANWsxN06ojxtnOGcPGpwek8qRn3zeai9mklu8oYQe2j2GpOB2+Oe0a4eEEjCQfu1Fk0Ddq m/Y8mDRBhABKMfZ2TeD6mirhOLEgWX8Qo16KVGj3qc02hvJnDVVUUBIEwvgyRWktqKgc9xRC Vc03SY/l/cJ0haxc8v4Qz+2nHHR63bwROFsO+E97QiMzI/d7ACYGnUIQ1Z9VTA2iCMlbWd0j wHUxrsFERQq6eTIEizFqt94uBvvYXB9EIMUWcMToeLpCfHHqZp7sB/AR80L/EWd3oysQmGYL 9xnQUEDa1QvYSwjiv/TEbPv2WvESn31oukdvFu/Y45dxlklDLNJnqTxgbQh0d5OLZyCUn6Kt 2Uels6V4YgmVM/RyHPdELhQROjyvZ5p1QEwZnY1QfEcG8mFoSb/Lei8HhkiTKuWDir0UWCwO xKC0e+gzJRSIGGrfcdKj3GZUKwXIVzbPY29DJj8N4MWCrAoLVPv1Hw+NCa4gjG2+GBxwP5XB HtuWZv1ZZrsIf88l2TeqiZ0+eJD+x3SMkuNGcGln0z/i+L2ibz8Ye5tDWZip9sRtMusyDg5O f4GXydT4xkAAuD4fAfN9osfcQIDIXQhXMikoM1LbO+TZAFhHTh5WfPWxLogfa1jnrhUybiUr i3sBBcAxQqtn2DDJCWLdmtnNOHlU6FgoC9pJicrJ1uphSQuON798KcFepIrVrA77+g/n+VsR vwIdpzYUPRCQzjK4RoHapz5oNAwfRinn1vWbSGkfCI+b9hrQAmQoo3oeQ7m9S8vCCurtJRh/ +38h12DGZdaHlZsFsfbbv6r3midh3lFlbIgRVbML/lSZF7orNpgJRvug6JlOMoLMxjCmGeXj l7EHRcCqODRiIYp692V17ucpoKkHuYiTEpXG27XseS/OSXApzfxxIZBVKCDfCzHVXOy86KnP L0Hw/b5OfwBvVBLr4sjTOo7kfNgv4Pi9+1A0wBpPHTXdFD6WLpvL06P0dRLqqAQlKRSvhG7W x7X99RXUVlT1BgJzLLFyNIZU9m+ IronPort-HdrOrdr: A9a23:F1g3+asH0y7UsJN15xlOxFFn7skDdNV00zEX/kB9WHVpmszxra 6TdZUgpGbJYVkqOE3I9ertBEDEewK4yXcX2/h2AV7BZniEhILAFugLhuGO/9SjIVybygc079 YGT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149632" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 36/70] x86/power: CFI hardening Date: Mon, 14 Feb 2022 12:50:53 +0000 Message-ID: <20220214125127.17985-37-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. cpufreq_governor_dbs() has no external callers so make it static. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpufreq/cpufreq.c | 14 +++++++------- xen/arch/x86/acpi/cpufreq/powernow.c | 15 ++++++++------- xen/common/core_parking.c | 4 ++-- xen/drivers/cpufreq/cpufreq_ondemand.c | 6 ++++-- xen/include/acpi/cpufreq/cpufreq.h | 1 - 5 files changed, 21 insertions(+), 19 deletions(-) diff --git a/xen/arch/x86/acpi/cpufreq/cpufreq.c b/xen/arch/x86/acpi/cpufreq/cpufreq.c index 8133c2dd958c..c27cbb2304f2 100644 --- a/xen/arch/x86/acpi/cpufreq/cpufreq.c +++ b/xen/arch/x86/acpi/cpufreq/cpufreq.c @@ -320,7 +320,7 @@ unsigned int get_measured_perf(unsigned int cpu, unsigned int flag) return policy->cpuinfo.max_freq * perf_percent / 100; } -static unsigned int get_cur_freq_on_cpu(unsigned int cpu) +static unsigned int cf_check get_cur_freq_on_cpu(unsigned int cpu) { struct cpufreq_policy *policy; struct acpi_cpufreq_data *data; @@ -369,8 +369,9 @@ static unsigned int check_freqs(const cpumask_t *mask, unsigned int freq, return 0; } -static int acpi_cpufreq_target(struct cpufreq_policy *policy, - unsigned int target_freq, unsigned int relation) +static int cf_check acpi_cpufreq_target( + struct cpufreq_policy *policy, + unsigned int target_freq, unsigned int relation) { struct acpi_cpufreq_data *data = cpufreq_drv_data[policy->cpu]; struct processor_performance *perf; @@ -449,7 +450,7 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy, return result; } -static int acpi_cpufreq_verify(struct cpufreq_policy *policy) +static int cf_check acpi_cpufreq_verify(struct cpufreq_policy *policy) { struct acpi_cpufreq_data *data; struct processor_performance *perf; @@ -494,8 +495,7 @@ acpi_cpufreq_guess_freq(struct acpi_cpufreq_data *data, unsigned int cpu) } } -static int -acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) +static int cf_check acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) { unsigned int i; unsigned int valid_states = 0; @@ -609,7 +609,7 @@ acpi_cpufreq_cpu_init(struct cpufreq_policy *policy) return result; } -static int acpi_cpufreq_cpu_exit(struct cpufreq_policy *policy) +static int cf_check acpi_cpufreq_cpu_exit(struct cpufreq_policy *policy) { struct acpi_cpufreq_data *data = cpufreq_drv_data[policy->cpu]; diff --git a/xen/arch/x86/acpi/cpufreq/powernow.c b/xen/arch/x86/acpi/cpufreq/powernow.c index ca71ecf72d67..d4c7dcd5d99d 100644 --- a/xen/arch/x86/acpi/cpufreq/powernow.c +++ b/xen/arch/x86/acpi/cpufreq/powernow.c @@ -67,8 +67,8 @@ static void cf_check update_cpb(void *data) } } -static int powernow_cpufreq_update (int cpuid, - struct cpufreq_policy *policy) +static int cf_check powernow_cpufreq_update( + int cpuid, struct cpufreq_policy *policy) { if (!cpumask_test_cpu(cpuid, &cpu_online_map)) return -EINVAL; @@ -78,8 +78,9 @@ static int powernow_cpufreq_update (int cpuid, return 0; } -static int powernow_cpufreq_target(struct cpufreq_policy *policy, - unsigned int target_freq, unsigned int relation) +static int cf_check powernow_cpufreq_target( + struct cpufreq_policy *policy, + unsigned int target_freq, unsigned int relation) { struct acpi_cpufreq_data *data = cpufreq_drv_data[policy->cpu]; struct processor_performance *perf; @@ -180,7 +181,7 @@ static void cf_check get_cpu_data(void *arg) amd_fixup_frequency(&perf->states[i]); } -static int powernow_cpufreq_verify(struct cpufreq_policy *policy) +static int cf_check powernow_cpufreq_verify(struct cpufreq_policy *policy) { struct acpi_cpufreq_data *data; struct processor_performance *perf; @@ -197,7 +198,7 @@ static int powernow_cpufreq_verify(struct cpufreq_policy *policy) return cpufreq_frequency_table_verify(policy, data->freq_table); } -static int powernow_cpufreq_cpu_init(struct cpufreq_policy *policy) +static int cf_check powernow_cpufreq_cpu_init(struct cpufreq_policy *policy) { unsigned int i; unsigned int valid_states = 0; @@ -303,7 +304,7 @@ static int powernow_cpufreq_cpu_init(struct cpufreq_policy *policy) return result; } -static int powernow_cpufreq_cpu_exit(struct cpufreq_policy *policy) +static int cf_check powernow_cpufreq_cpu_exit(struct cpufreq_policy *policy) { struct acpi_cpufreq_data *data = cpufreq_drv_data[policy->cpu]; diff --git a/xen/common/core_parking.c b/xen/common/core_parking.c index 4afad04f2f68..c4f01291c0be 100644 --- a/xen/common/core_parking.c +++ b/xen/common/core_parking.c @@ -53,7 +53,7 @@ static int __init cf_check setup_core_parking_option(const char *str) } custom_param("core_parking", setup_core_parking_option); -static unsigned int core_parking_performance(unsigned int event) +static unsigned int cf_check core_parking_performance(unsigned int event) { unsigned int cpu = -1; @@ -111,7 +111,7 @@ static unsigned int core_parking_performance(unsigned int event) return cpu; } -static unsigned int core_parking_power(unsigned int event) +static unsigned int cf_check core_parking_power(unsigned int event) { unsigned int cpu = -1; diff --git a/xen/drivers/cpufreq/cpufreq_ondemand.c b/xen/drivers/cpufreq/cpufreq_ondemand.c index ba03eaa2336d..fbcd14d6c32f 100644 --- a/xen/drivers/cpufreq/cpufreq_ondemand.c +++ b/xen/drivers/cpufreq/cpufreq_ondemand.c @@ -215,7 +215,8 @@ static void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info) kill_timer(&per_cpu(dbs_timer, dbs_info->cpu)); } -int cpufreq_governor_dbs(struct cpufreq_policy *policy, unsigned int event) +static int cf_check cpufreq_governor_dbs( + struct cpufreq_policy *policy, unsigned int event) { unsigned int cpu = policy->cpu; struct cpu_dbs_info_s *this_dbs_info; @@ -307,7 +308,8 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy, unsigned int event) return 0; } -static bool_t __init cpufreq_dbs_handle_option(const char *name, const char *val) +static bool __init cf_check cpufreq_dbs_handle_option( + const char *name, const char *val) { if ( !strcmp(name, "rate") && val ) { diff --git a/xen/include/acpi/cpufreq/cpufreq.h b/xen/include/acpi/cpufreq/cpufreq.h index 4958d3f7d315..e5e58c6c30ea 100644 --- a/xen/include/acpi/cpufreq/cpufreq.h +++ b/xen/include/acpi/cpufreq/cpufreq.h @@ -227,7 +227,6 @@ struct cpu_dbs_info_s { int8_t stoppable; }; -int cpufreq_governor_dbs(struct cpufreq_policy *policy, unsigned int event); int get_cpufreq_ondemand_para(uint32_t *sampling_rate_max, uint32_t *sampling_rate_min, uint32_t *sampling_rate, From patchwork Mon Feb 14 12:50:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745560 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2C51CC4332F for ; Mon, 14 Feb 2022 13:06:24 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271701.466319 (Exim 4.92) (envelope-from ) id 1nJb3V-0006x4-3P; Mon, 14 Feb 2022 13:06:13 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271701.466319; Mon, 14 Feb 2022 13:06:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3U-0006vX-Nt; Mon, 14 Feb 2022 13:06:12 +0000 Received: by outflank-mailman (input) for mailman id 271701; Mon, 14 Feb 2022 13:06:10 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3I-00023t-II for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:00 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id d9261969-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:58 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d9261969-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843959; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=1mxkmFvBHm9TxAw5kL2fslSWdtu5vEoGopavW5H2guc=; b=FdX0Bfkwo5GiZMXCWjnQkpoIffe8XjBTrhwaAAXhhvXy6W46ruhcH7fU 9TBCGmvUbvW7f1G1UrOBAaOrafYgB0QHXdFoVyS2Bc98pRY7dEt31sa0e qoNkSBss6oqPs+1V0XTufDPzsfP7hroFWwhySNcKzwMxETvxZ6RwTYeJ0 c=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 6qVrT5YlGRLe+iB32YZTsQOWSU/VWq5wH2X4XuAUdRo7uhPMH01lQPSplGVDoye+u39HVFUsWj GlaznnRrjnGfI3nWFfVrpuirUGhDsQLb57yNmO3qUT6BYEXWnvvYc9O7U65Ao0fKXnfqLp/BUP AK3WxvcZg3D8XHjAHOpDqWsLvj/XBgvQ4xFABRuUe7J2/GnzVlyTrp2zkoDeDSqUrR4Y//wyX1 JBbQZ7nMLS2KhzG4ebGv2jsDT+2UUKl1cDF5qwLU2Y2sAoOoJ0fgZ2wLWZaJvmIJ7kuIxI/LWK BbsIyjiVyyc7sDxvfswrysrR X-SBRS: 5.1 X-MesageID: 63592665 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:mkvNcauFnnrShkkFCzfWplKis+fnVEhZMUV32f8akzHdYApBsoF/q tZmKTrUP/+LMGbzLt4jPIm39BkCvJeEmtZrHQI/r3o2E34R+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ NplnpWSRF4NDIP3u8cZfD0HDHh+IqN29+qSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AP JdIM2QxMXwsZTUUZwclEsgHu9632F/jLjxTo3/E+KAOtj27IAtZj+G2bYu9lsaxbdVYmAOUq 3zL+0z9AwoGL5qPxDyd6HWui+TT2yThV+ov+KaQr6AwxgfJnypKVUNQBQDTTeSFZlCWcNt9J hUwyAQVjos222j0UYD9QBOIryvR1vIDYOZ4H+o/4QCL76Pb5QeFG2QJJgJ8hMwaWNweHmJzi ALQ9z/9LXk26eDOFyrBnluBhW7qYUAowXk+iTjopOfvy/3qu8kNgx3GVb6P+4bl34SuSVkcL 91nxRXSZon/b+ZWjc1XHnid2lpAQ6QlqSZvuG3qspqNtF8RWWJcT9XABaLnxfhBNp2FaVKKo WIJncOThMhXU83Ry3zdHbhVRerzjxpgDNE7qQQxd6TNChz3oyLzFWyuyG0WyLhV3jYsJmayP R67VfJ5755PJnq6BZKbkKrqY/nGOZPITIy/PtiNN4ImSsEoKGevoXE/DWbNjjuFuBV9zskC1 WKzLJ/E4YAyUv88klJbho41jNcW+8zJ7T2PFM6rl0z9idJzphe9EN84DbdHVchhhIvsnekf2 4832xKix0oNXevgTDPQ9IJPf1kGIWJiXcL9qtBNd/7FKQ1jQTlzB/jUyLInWopkg6UKybuYo iDjAhdVmAjlmHnKCQSWcXQ/Ornhaoly8CAgNis2MFf2h3V6OdSz7L0SfoccdKU88LAx1uZ9S vQIIp3SAvlGRjnd1S4aaJ3x8N5reBix3FrcNCu5ejkvOZVnQlWRqNPjewLu8ggIDza26pRi8 +HxiFuDTMNaFQp4DcvQZPa+9H+LvCAQyLBoQk/FAthPY0GwooJkHDP8060sKMYWJBSdmjbDj 1SKAQ0VrPXmqpMu9IWbnriNqoqkHrcsHkdeGGWHv7+6OTODozimyI5EFu2JYSrcRCX//6D7P bdZyPT1MfsmmldWstUjT+Y3nPxmv9a/9aVHyglEHWnQawX5A7xtFXCKwM1Tu/Af3bReowa3B hqC99Qy1W9l4y85/Ir9/DYYU9k= IronPort-HdrOrdr: A9a23:Adm6qK7ZXP0F5SbHMgPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592665" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 37/70] x86/apic: CFI hardening Date: Mon, 14 Feb 2022 12:50:54 +0000 Message-ID: <20220214125127.17985-38-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/genapic/bigsmp.c | 4 ++-- xen/arch/x86/genapic/delivery.c | 12 ++++++------ xen/arch/x86/genapic/x2apic.c | 16 ++++++++++------ xen/arch/x86/include/asm/genapic.h | 18 +++++++++--------- xen/arch/x86/smp.c | 6 +++--- 5 files changed, 30 insertions(+), 26 deletions(-) diff --git a/xen/arch/x86/genapic/bigsmp.c b/xen/arch/x86/genapic/bigsmp.c index b9d976e8abf2..2000383ab0bf 100644 --- a/xen/arch/x86/genapic/bigsmp.c +++ b/xen/arch/x86/genapic/bigsmp.c @@ -10,7 +10,7 @@ #include #include -static __init int force_bigsmp(const struct dmi_system_id *d) +static int __init cf_check force_bigsmp(const struct dmi_system_id *d) { printk(KERN_NOTICE "%s detected: force use of apic=bigsmp\n", d->ident); def_to_bigsmp = true; @@ -27,7 +27,7 @@ static const struct dmi_system_id __initconstrel bigsmp_dmi_table[] = { }; -static __init int probe_bigsmp(void) +static int __init cf_check probe_bigsmp(void) { /* * We don't implement cluster mode, so force use of diff --git a/xen/arch/x86/genapic/delivery.c b/xen/arch/x86/genapic/delivery.c index 548c33f282dd..d1f99bf6834a 100644 --- a/xen/arch/x86/genapic/delivery.c +++ b/xen/arch/x86/genapic/delivery.c @@ -9,7 +9,7 @@ * LOGICAL FLAT DELIVERY MODE (multicast via bitmask to <= 8 logical APIC IDs). */ -void init_apic_ldr_flat(void) +void cf_check init_apic_ldr_flat(void) { unsigned long val; @@ -19,12 +19,12 @@ void init_apic_ldr_flat(void) apic_write(APIC_LDR, val); } -const cpumask_t *vector_allocation_cpumask_flat(int cpu) +const cpumask_t *cf_check vector_allocation_cpumask_flat(int cpu) { return &cpu_online_map; } -unsigned int cpu_mask_to_apicid_flat(const cpumask_t *cpumask) +unsigned int cf_check cpu_mask_to_apicid_flat(const cpumask_t *cpumask) { return cpumask_bits(cpumask)[0]&0xFF; } @@ -33,17 +33,17 @@ unsigned int cpu_mask_to_apicid_flat(const cpumask_t *cpumask) * PHYSICAL DELIVERY MODE (unicast to physical APIC IDs). */ -void init_apic_ldr_phys(void) +void cf_check init_apic_ldr_phys(void) { /* We only deliver in phys mode - no setup needed. */ } -const cpumask_t *vector_allocation_cpumask_phys(int cpu) +const cpumask_t *cf_check vector_allocation_cpumask_phys(int cpu) { return cpumask_of(cpu); } -unsigned int cpu_mask_to_apicid_phys(const cpumask_t *cpumask) +unsigned int cf_check cpu_mask_to_apicid_phys(const cpumask_t *cpumask) { /* As we are using single CPU as destination, pick only one CPU here */ return cpu_physical_id(cpumask_any(cpumask)); diff --git a/xen/arch/x86/genapic/x2apic.c b/xen/arch/x86/genapic/x2apic.c index bd44bb753995..de5032f2020a 100644 --- a/xen/arch/x86/genapic/x2apic.c +++ b/xen/arch/x86/genapic/x2apic.c @@ -38,7 +38,7 @@ static inline u32 x2apic_cluster(unsigned int cpu) return per_cpu(cpu_2_logical_apicid, cpu) >> 16; } -static void init_apic_ldr_x2apic_cluster(void) +static void cf_check init_apic_ldr_x2apic_cluster(void) { unsigned int cpu, this_cpu = smp_processor_id(); @@ -74,12 +74,14 @@ static void init_apic_ldr_x2apic_cluster(void) cpumask_set_cpu(this_cpu, per_cpu(cluster_cpus, this_cpu)); } -static const cpumask_t *vector_allocation_cpumask_x2apic_cluster(int cpu) +static const cpumask_t *cf_check vector_allocation_cpumask_x2apic_cluster( + int cpu) { return per_cpu(cluster_cpus, cpu); } -static unsigned int cpu_mask_to_apicid_x2apic_cluster(const cpumask_t *cpumask) +static unsigned int cf_check cpu_mask_to_apicid_x2apic_cluster( + const cpumask_t *cpumask) { unsigned int cpu = cpumask_any(cpumask); unsigned int dest = per_cpu(cpu_2_logical_apicid, cpu); @@ -92,12 +94,13 @@ static unsigned int cpu_mask_to_apicid_x2apic_cluster(const cpumask_t *cpumask) return dest; } -static void send_IPI_self_x2apic(uint8_t vector) +static void cf_check send_IPI_self_x2apic(uint8_t vector) { apic_wrmsr(APIC_SELF_IPI, vector); } -static void send_IPI_mask_x2apic_phys(const cpumask_t *cpumask, int vector) +static void cf_check send_IPI_mask_x2apic_phys( + const cpumask_t *cpumask, int vector) { unsigned int cpu; unsigned long flags; @@ -130,7 +133,8 @@ static void send_IPI_mask_x2apic_phys(const cpumask_t *cpumask, int vector) local_irq_restore(flags); } -static void send_IPI_mask_x2apic_cluster(const cpumask_t *cpumask, int vector) +static void cf_check send_IPI_mask_x2apic_cluster( + const cpumask_t *cpumask, int vector) { unsigned int cpu = smp_processor_id(); cpumask_t *ipimask = per_cpu(scratch_mask, cpu); diff --git a/xen/arch/x86/include/asm/genapic.h b/xen/arch/x86/include/asm/genapic.h index 51a65d3e0f0c..beeaddf19daa 100644 --- a/xen/arch/x86/include/asm/genapic.h +++ b/xen/arch/x86/include/asm/genapic.h @@ -39,12 +39,12 @@ extern struct genapic genapic; extern const struct genapic apic_default; extern const struct genapic apic_bigsmp; -void send_IPI_self_legacy(uint8_t vector); +void cf_check send_IPI_self_legacy(uint8_t vector); -void init_apic_ldr_flat(void); -unsigned int cpu_mask_to_apicid_flat(const cpumask_t *cpumask); -void send_IPI_mask_flat(const cpumask_t *mask, int vector); -const cpumask_t *vector_allocation_cpumask_flat(int cpu); +void cf_check init_apic_ldr_flat(void); +unsigned int cf_check cpu_mask_to_apicid_flat(const cpumask_t *cpumask); +void cf_check send_IPI_mask_flat(const cpumask_t *mask, int vector); +const cpumask_t *cf_check vector_allocation_cpumask_flat(int cpu); #define GENAPIC_FLAT \ .int_delivery_mode = dest_LowestPrio, \ .int_dest_mode = 1 /* logical delivery */, \ @@ -54,10 +54,10 @@ const cpumask_t *vector_allocation_cpumask_flat(int cpu); .send_IPI_mask = send_IPI_mask_flat, \ .send_IPI_self = send_IPI_self_legacy -void init_apic_ldr_phys(void); -unsigned int cpu_mask_to_apicid_phys(const cpumask_t *cpumask); -void send_IPI_mask_phys(const cpumask_t *mask, int vector); -const cpumask_t *vector_allocation_cpumask_phys(int cpu); +void cf_check init_apic_ldr_phys(void); +unsigned int cf_check cpu_mask_to_apicid_phys(const cpumask_t *cpumask); +void cf_check send_IPI_mask_phys(const cpumask_t *mask, int vector); +const cpumask_t *cf_check vector_allocation_cpumask_phys(int cpu); #define GENAPIC_PHYS \ .int_delivery_mode = dest_Fixed, \ .int_dest_mode = 0 /* physical delivery */, \ diff --git a/xen/arch/x86/smp.c b/xen/arch/x86/smp.c index 33748e629a21..0a02086966c0 100644 --- a/xen/arch/x86/smp.c +++ b/xen/arch/x86/smp.c @@ -161,13 +161,13 @@ void send_IPI_self(int vector) * The following functions deal with sending IPIs between CPUs. */ -void send_IPI_self_legacy(uint8_t vector) +void cf_check send_IPI_self_legacy(uint8_t vector) { /* NMI continuation handling relies on using a shorthand here. */ send_IPI_shortcut(APIC_DEST_SELF, vector, APIC_DEST_PHYSICAL); } -void send_IPI_mask_flat(const cpumask_t *cpumask, int vector) +void cf_check send_IPI_mask_flat(const cpumask_t *cpumask, int vector) { unsigned long mask = cpumask_bits(cpumask)[0]; unsigned long cfg; @@ -204,7 +204,7 @@ void send_IPI_mask_flat(const cpumask_t *cpumask, int vector) local_irq_restore(flags); } -void send_IPI_mask_phys(const cpumask_t *mask, int vector) +void cf_check send_IPI_mask_phys(const cpumask_t *mask, int vector) { unsigned long cfg, flags; unsigned int query_cpu; From patchwork Mon Feb 14 12:50:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745574 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 948EEC433EF for ; Mon, 14 Feb 2022 13:06:58 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271777.466495 (Exim 4.92) (envelope-from ) id 1nJb44-0006vx-NP; Mon, 14 Feb 2022 13:06:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271777.466495; Mon, 14 Feb 2022 13:06:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb44-0006u3-CJ; Mon, 14 Feb 2022 13:06:48 +0000 Received: by outflank-mailman (input) for mailman id 271777; Mon, 14 Feb 2022 13:06:47 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3J-00023t-F4 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:01 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id d9d7fb2a-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:59 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d9d7fb2a-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843960; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=FaRq4uMLqchtYBsH0ZZXc1AMBt9Hn3Liv9Sb03AHXI0=; b=B5cLgp3C7y0GYo1Ykoro8F+fHs3iqBrVbnXxYXnQ8Ps103Z/Ork7ywm9 BppRO1s8pHAw5mcwYJPxhvo0zqj74n4WG53r5Q4qoQJ9vGKKxwiZnax/S JTOl/DIrzAupa/bRRKqynUEetcyY2hiGRKv1+KyiyvC7kZYn13etbgt3O I=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 3HmRFu2V3WurqLDDXunRl3owx5tt8Ietenwy3QtwnZ0FP18z5TgqQJdGbIDDBOpPso1OhSrLlN Q38UQ8lu75VdBRqISRBBmB7UJbhVIF9lbjg3dv4emhifGVkCHZB6kWwpdwjEOB5VdRUoH/xwZq 9D4ebPhhXa5R6TSBUVsPXfF7mgDauGOzIqQJBU3tMWUMUOVf/2NACizqtDIVMb/IMIzZVkLWUu N1kWc0dFsktAVvvQS3kOVgP/bohZ/8s0fIdaUgI9zAvNLvaRl0H/wskze5jw5GV55seF+8s0zx tR8672NT/dAFTNpv+KV15bdD X-SBRS: 5.1 X-MesageID: 63592666 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:qM4d1K4AjQLSdC51ES03egxRtCbAchMFZxGqfqrLsTDasY5as4F+v mJLCGyDbP7cZzShc9t0Pomz80wOu5bQzNdnTAJuqi4zHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z7 pJiq6GycCgVGKzchdQjcDdkInBCIvgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQRquPP ZRHN1KDajyQWzRMJ30IOqhimequxVnRTQZH9nus8P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeRrAmRRe9dE mMo3Cs+sJgM12KXf4jBQEjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5ilD2DHcihl3xKE9O2PRaodFvMC3PWBshR0U9OiFy9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:wn6HVa7CyBCeH2h1PgPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592666" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 38/70] x86/nmi: CFI hardening Date: Mon, 14 Feb 2022 12:50:55 +0000 Message-ID: <20220214125127.17985-39-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/alternative.c | 4 ++-- xen/arch/x86/cpu/microcode/core.c | 3 ++- xen/arch/x86/crash.c | 3 ++- xen/arch/x86/livepatch.c | 2 +- xen/arch/x86/oprofile/nmi_int.c | 2 +- xen/arch/x86/traps.c | 3 ++- 6 files changed, 10 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/alternative.c b/xen/arch/x86/alternative.c index 1cb531c9df83..436047abe021 100644 --- a/xen/arch/x86/alternative.c +++ b/xen/arch/x86/alternative.c @@ -324,8 +324,8 @@ static unsigned int __initdata alt_done; * condition where an NMI hits while we are midway though patching some * instructions in the NMI path. */ -static int __init nmi_apply_alternatives(const struct cpu_user_regs *regs, - int cpu) +static int __init cf_check nmi_apply_alternatives( + const struct cpu_user_regs *regs, int cpu) { /* * More than one NMI may occur between the two set_nmi_callback() below. diff --git a/xen/arch/x86/cpu/microcode/core.c b/xen/arch/x86/cpu/microcode/core.c index c07f68ba350e..f84dafa82693 100644 --- a/xen/arch/x86/cpu/microcode/core.c +++ b/xen/arch/x86/cpu/microcode/core.c @@ -376,7 +376,8 @@ static int primary_thread_work(const struct microcode_patch *patch) return ret; } -static int microcode_nmi_callback(const struct cpu_user_regs *regs, int cpu) +static int cf_check microcode_nmi_callback( + const struct cpu_user_regs *regs, int cpu) { unsigned int primary = cpumask_first(this_cpu(cpu_sibling_mask)); int ret; diff --git a/xen/arch/x86/crash.c b/xen/arch/x86/crash.c index f6264946a681..c383f718f5bd 100644 --- a/xen/arch/x86/crash.c +++ b/xen/arch/x86/crash.c @@ -36,7 +36,8 @@ static unsigned int crashing_cpu; static DEFINE_PER_CPU_READ_MOSTLY(bool, crash_save_done); /* This becomes the NMI handler for non-crashing CPUs, when Xen is crashing. */ -static int noreturn do_nmi_crash(const struct cpu_user_regs *regs, int cpu) +static int noreturn cf_check do_nmi_crash( + const struct cpu_user_regs *regs, int cpu) { stac(); diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c index d056b1ed8b41..37c9b8435eda 100644 --- a/xen/arch/x86/livepatch.c +++ b/xen/arch/x86/livepatch.c @@ -175,7 +175,7 @@ static nmi_callback_t *saved_nmi_callback; * Note that because of this NOP code the do_nmi is not safely patchable. * Also if we do receive 'real' NMIs we have lost them. */ -static int mask_nmi_callback(const struct cpu_user_regs *regs, int cpu) +static int cf_check mask_nmi_callback(const struct cpu_user_regs *regs, int cpu) { /* TODO: Handle missing NMI/MCE.*/ return 1; diff --git a/xen/arch/x86/oprofile/nmi_int.c b/xen/arch/x86/oprofile/nmi_int.c index 6ebe20bd1d3e..a90b72825818 100644 --- a/xen/arch/x86/oprofile/nmi_int.c +++ b/xen/arch/x86/oprofile/nmi_int.c @@ -95,7 +95,7 @@ bool nmi_oprofile_send_virq(void) return v; } -static int nmi_callback(const struct cpu_user_regs *regs, int cpu) +static int cf_check nmi_callback(const struct cpu_user_regs *regs, int cpu) { int xen_mode, ovf; diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c index 485bd66971db..7b957101934e 100644 --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -752,7 +752,8 @@ static cpumask_t show_state_mask; static bool opt_show_all; boolean_param("async-show-all", opt_show_all); -static int nmi_show_execution_state(const struct cpu_user_regs *regs, int cpu) +static int cf_check nmi_show_execution_state( + const struct cpu_user_regs *regs, int cpu) { if ( !cpumask_test_cpu(cpu, &show_state_mask) ) return 0; From patchwork Mon Feb 14 12:50:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745571 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0F6B3C433F5 for ; Mon, 14 Feb 2022 13:06:52 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271747.466458 (Exim 4.92) (envelope-from ) id 1nJb3v-0004ba-88; Mon, 14 Feb 2022 13:06:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271747.466458; Mon, 14 Feb 2022 13:06:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3u-0004a4-P5; Mon, 14 Feb 2022 13:06:38 +0000 Received: by outflank-mailman (input) for mailman id 271747; Mon, 14 Feb 2022 13:06:36 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb34-0008IH-44 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:46 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d1d065cc-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:44 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d1d065cc-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843945; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=uqi1jxBHAWzCvFq7xfZy03983Yg3cPF97gGqXtbut+k=; b=GdsEl4p4HbJXvigEFQcPPXW7iGAIJbSrb/5bQeFQIB9rg0dfbIO852nt JMw10Cuw6sXlMZEQAhuAIp8bOi1lXfT7V6GwoBn/oDrFI/wgYb8GwNy5H fAzAyre2CIMeVxkwivTt2A1YmZRqG8PDwKsO7JfMkyfnOSyKNE809WdgW o=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: iaDkqD7qUoS+zmzC9I81HrN30704v81fnmngrv1xCn3IcoDwSM9/eR7vPuGemTUvEkaLAHuVgw Mn8p46+CExuwiD9jIgXu480cLfiHSwyWwJ3Yc6JE+MhxFLB8bL6KxOhrVgE43IYrnJOfRFaD1a 9Teps+DNvhyYYUoduPKL32/pXjD2lqKHVes0ctCjQRDAHji9UZTX5Y0M3Ziuqt8n1GadR4wYxU WUhQfhVKDwBXOWnS2UOBwyw1ZJ7MfLhbWHgArXpJwfK6v/26wQukn9JbWVDlbRWFc/TyIKdMgC UJAZDDG22SsF58EKkwKNHqmQ X-SBRS: 5.1 X-MesageID: 64149421 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:IDM+Dqr7hQbJCia82Kjfe8P/UYBeBmIGYhIvgKrLsJaIsI4StFCzt garIBmFPfyJYGOnL98jYY6x/BkC65XXy4JqSwJk+X0wRisb85uZCYyVIHmrMnLJJKUvbq7GA +byyDXkBJppJpMJjk71atANlZT4vE2xbuKU5NTsY0idfic5Dndx4f5fs7Rh2NQw24HlW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCnaCgCkBxE6Puo/U6XhBeMCxfBL1D+bCSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O ZZANWszNk2ojxtnIE8+UsgVzaSSuSfHdzFkqWOQmqYlyj2GpOB2+Oe0a4eEEjCQfu1Fk0Ddq m/Y8mDRBhABKMfZ2TeD6mirhOLEgWX8Qo16KVGj3qc02hvJnDVVUUBIEwvgyRWktqKgc+5Pa AtM1yQMlrkV+UWtbdTcZg29oXHR63bwROFsO+E97QiMzI/d7ACYGnUIQ1Z9VTA2iCMlbWd0j wHUxrsFERQq6eTIEizFqt94uBvvYXB9EIMUWcMToeLpCfHHqZp7sB/AR80L/EWd3oysQmGYL 9xnQUEDa1QvYSwjiv/TEbPv2WvESn31oukdvFu/Y45dxlklDLNJnqTxgbQh0d5OLZyCUn6Kt 2Uels6V4YgmVM/RyHPdELhQROjyvZ5p1QEwZnY1QfEcG8mFoSb/Lei8HhkiTKuWDir0UWCwO xKC0e+gzJRSIGGrfcdKj3GZUKwXIVzbPY29DJj8N4MWCrAoLVPv1Hw+NCa4gjG2+GBxwP5XB HtuWZv1ZZrsIf88l2TeqiZ0+eJD+x3SMkuNGcGln0z/i+L2ibz8Ye5tDWZip9sRtMusyDg5O f4DXydT4xkAAuD4fAfN9osfcQIDIXQhXMikoM1LbO+TZAFhHTh5WfPWxLogfa1jnrhUybiUr i3sBBcAxQqtn2DDJCWLdmtnNOHlU6FgoC9pJicrJ1uphSQuON798KcFepIrVrA77+g/n+VsR vwIdpzYUPRCQzjK4RoHapz5oNAwfRinn1vWbSGkfCI+b9hrQAmQoo3oeQ7m9S8vCCurtJRh/ +38h12DGZdaHlZsFsfbbv6r3midh3lFlbIgRVbML/lSZF7orNpgJRvug6JlOMoLMxjCmGeXj l7EHRcCqODRiIYp692V17ucpoKkHuYiTEpXG27XseS/OSXApzfxxIZBVKCDfCzHVXOy86KnP L0Hw/b5OfwBvVBLr4sjTOo7kfNgv4Pi9+1A0wBpPHTXdFD6WLpvL06P0dRLqqAQlKRSvhG7W x7X99RXUVlT1BgJzLLFyNIZU9m+ IronPort-HdrOrdr: A9a23:N2/ke6gbAIuV/gTQIR78AqjGU3BQXtgji2hC6mlwRA09TySZ// rBoB17726MtN9/YhEdcLy7VJVoBEmskKKdgrNhW4tKPjOW21dARbsKheCJrgEIWReOktK1vZ 0QFJSWY+eQMbEVt6nHCXGDYrQd/OU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149421" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 39/70] x86/mtrr: CFI hardening Date: Mon, 14 Feb 2022 12:50:56 +0000 Message-ID: <20220214125127.17985-40-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/mtrr/generic.c | 18 ++++++++++-------- xen/arch/x86/cpu/mtrr/mtrr.h | 8 ++++---- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/xen/arch/x86/cpu/mtrr/generic.c b/xen/arch/x86/cpu/mtrr/generic.c index 7cf4cd01f3f6..47aaf76226e0 100644 --- a/xen/arch/x86/cpu/mtrr/generic.c +++ b/xen/arch/x86/cpu/mtrr/generic.c @@ -287,7 +287,8 @@ static void set_fixed_range(int msr, bool *changed, unsigned int *msrwords) } } -int generic_get_free_region(unsigned long base, unsigned long size, int replace_reg) +int cf_check generic_get_free_region( + unsigned long base, unsigned long size, int replace_reg) /* [SUMMARY] Get a free MTRR. The starting (base) address of the region. The size (in bytes) of the region. @@ -309,8 +310,8 @@ int generic_get_free_region(unsigned long base, unsigned long size, int replace_ return -ENOSPC; } -static void generic_get_mtrr(unsigned int reg, unsigned long *base, - unsigned long *size, mtrr_type *type) +static void cf_check generic_get_mtrr( + unsigned int reg, unsigned long *base, unsigned long *size, mtrr_type *type) { uint64_t _mask, _base; @@ -499,7 +500,7 @@ static void post_set(bool pge) spin_unlock(&set_atomicity_lock); } -static void generic_set_all(void) +static void cf_check generic_set_all(void) { unsigned long mask, count; unsigned long flags; @@ -522,8 +523,8 @@ static void generic_set_all(void) } } -static void generic_set_mtrr(unsigned int reg, unsigned long base, - unsigned long size, mtrr_type type) +static void cf_check generic_set_mtrr( + unsigned int reg, unsigned long base, unsigned long size, mtrr_type type) /* [SUMMARY] Set variable MTRR register on the local CPU. The register to set. The base address of the region. @@ -566,7 +567,8 @@ static void generic_set_mtrr(unsigned int reg, unsigned long base, local_irq_restore(flags); } -int generic_validate_add_page(unsigned long base, unsigned long size, unsigned int type) +int cf_check generic_validate_add_page( + unsigned long base, unsigned long size, unsigned int type) { unsigned long lbase, last; @@ -584,7 +586,7 @@ int generic_validate_add_page(unsigned long base, unsigned long size, unsigned i } -static int generic_have_wrcomb(void) +static int cf_check generic_have_wrcomb(void) { unsigned long config; rdmsrl(MSR_MTRRcap, config); diff --git a/xen/arch/x86/cpu/mtrr/mtrr.h b/xen/arch/x86/cpu/mtrr/mtrr.h index 9a406e6f6199..c7fd44daab27 100644 --- a/xen/arch/x86/cpu/mtrr/mtrr.h +++ b/xen/arch/x86/cpu/mtrr/mtrr.h @@ -24,10 +24,10 @@ struct mtrr_ops { int (*have_wrcomb)(void); }; -extern int generic_get_free_region(unsigned long base, unsigned long size, - int replace_reg); -extern int generic_validate_add_page(unsigned long base, unsigned long size, - unsigned int type); +int cf_check generic_get_free_region( + unsigned long base, unsigned long size, int replace_reg); +int cf_check generic_validate_add_page( + unsigned long base, unsigned long size, unsigned int type); extern const struct mtrr_ops generic_mtrr_ops; From patchwork Mon Feb 14 12:50:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745595 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A6744C433F5 for ; Mon, 14 Feb 2022 13:17:11 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271967.466742 (Exim 4.92) (envelope-from ) id 1nJbDx-0005rX-Fs; Mon, 14 Feb 2022 13:17:01 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271967.466742; Mon, 14 Feb 2022 13:17:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDx-0005rK-Aw; Mon, 14 Feb 2022 13:17:01 +0000 Received: by outflank-mailman (input) for mailman id 271967; Mon, 14 Feb 2022 13:16:59 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3X-00023t-Jd for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:15 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id e1f7365e-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:06:13 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e1f7365e-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843973; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=DvkxBtgSCdVebD4VLLY7NY7aTsNOKJgA8KGiz3D+sSg=; b=eJhUdTZvvPYd/WrwQI3bWhTwZ10S20HPK3m9Goxbd4liaygh3v0UwdSm /N9g1sH+xQLRNT0/105XjBkOpOKWCwC4H7+P2Sg1qUL6B5MdEmS4+3+ms vM8ACionfM6LtMxR1SQD7953sQKAgG0uruCjutHUDIFL+VlQlzuOgtBno Q=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: uFd/8GjHXGZn2dw6P4h4cbueAJDEKi1MZmt9mLEP8k+l6RAKBQXr1MzE9QmMnkkpeDWJ08xksG yLK8BxkUldtzrwIthLtrOkRgAhmiwhnLDMysXkT69oarGUuU5/keO05v1LUZNnQd8bg8iwEoN5 otcgzdMBjBAbDbXOqdEExE8U5R9n6XDqLbbA8bVsQZLWFV8x/TUmFdu5+2GEcS696Ui2MhiGdV 5vIm+buc0r/Wg9VbRODd1gE7wAP+cKnaFQT3olvbo5a1EFOhvdqnvT0gNNSPQef70cd5gQ6T5U 412AOROA4hzc2UKKK6WgToDp X-SBRS: 5.1 X-MesageID: 66374944 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:UsFTTKKx31Cik8p2FE+RzpIlxSXFcZb7ZxGr2PjKsXjdYENS1WMDn WdLD26FPKuCYjegLY8ga4Wy8hhTv8TQyIBqSlZlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB2Hn9J1l e1G5aC9SAYJHpXNvOo5egFxRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Glu3Z8STKqCD yYfQRQ+PRXKfiFBAUoKK40Smuisoyb4YxQN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3O1ofu913a1C+5SK k002hIviaYW3VSCG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspuNt2uVnrKNaY2y8kT85v1dNoufRVTpl CFax5TBvLBTUMnUz3blrAAx8FaBvajtDdEhqQQ3Q8lJG8qFpxZPgry8EBkhfRw0Y67oiBfiY VPJuBM52XOgFCDCUEODWKroU55C5fG5TbzND6mIBvITMskZXFLWp0lGOB/Pt10BZWBxyMnTz 7/AKp3yZZvbYIw6pAeLqxA1j+N1mHBkmD+7qFKS503P7IdyrUW9Ed8tWGZipMhghE9diAmKo dtZKeWQzBBTDL/3biXNqNZBJlEWN3krQ5vxrpUPJOKEJwNnHkAnCuPQnux9K9A0wfwNm7ea5 Gy5V29Z1EH72S/NJzKVZy0xc7joR5t+8y42ZHR+IVay1nE/So+z96NDJYAvdLwq+bU7n/55R vUIYeuaBfFLRmiV8jgRd8Cl/odjaA6qlUSFOC/8OGozeJtpRgro/N74f1SwqHlSX3Tv7cZn+ u+uzALWR5YHVj9ONseOZaL91U61sFgchPl2AxnCLO5MdRi+64NtMSHw0KM6epleNRXZyzKG/ A+KGhNE9/LVqoo4/dSV16CJq4ClT7l3EkZARjSJ6L+3MW/R/3a5wJ8GW+GNJGiPWGTx8aSkR ONU0/Cjb6FXwAcU69JxQ+Rx0KYzx9rzvLsLnA1rEULCY0mvFr49cGKN2tNCt/EVy7JU0edst pljJjWO1W21Bf7Y IronPort-HdrOrdr: A9a23:wU3Gn6DZKqzyMFblHemo55DYdb4zR+YMi2TC1yhKKCC9E/bo7/ xG885rtiMc5Ax/ZJhko6HlBEDiewKkyXcW2/hyAV7KZmCP0wHEQL2Kr7GSpAEIcxeOkNK1vp 0BT0ERMrPN5CBB/KPH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374944" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 40/70] x86/idle: CFI hardening Date: Mon, 14 Feb 2022 12:50:57 +0000 Message-ID: <20220214125127.17985-41-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/acpi/cpu_idle.c | 31 +++++++++++++++++++++------- xen/arch/x86/acpi/cpuidle_menu.c | 6 +++--- xen/arch/x86/cpu/mwait-idle.c | 2 +- xen/arch/x86/domain.c | 6 +++--- xen/arch/x86/hpet.c | 4 ++-- xen/arch/x86/include/asm/cpuidle.h | 4 ++-- xen/arch/x86/include/asm/hpet.h | 4 ++-- xen/arch/x86/include/asm/time.h | 6 +++--- xen/arch/x86/time.c | 6 +++--- xen/drivers/cpufreq/cpufreq_misc_governors.c | 14 ++++++------- 10 files changed, 49 insertions(+), 34 deletions(-) diff --git a/xen/arch/x86/acpi/cpu_idle.c b/xen/arch/x86/acpi/cpu_idle.c index 0142671bb836..557bc6ef8642 100644 --- a/xen/arch/x86/acpi/cpu_idle.c +++ b/xen/arch/x86/acpi/cpu_idle.c @@ -75,7 +75,7 @@ #define GET_CC7_RES(val) GET_HW_RES_IN_NS(0x3FE, val) /* SNB onwards */ #define PHI_CC6_RES(val) GET_HW_RES_IN_NS(0x3FF, val) /* Xeon Phi only */ -static void lapic_timer_nop(void) { } +static void cf_check lapic_timer_nop(void) { } void (*__read_mostly lapic_timer_off)(void); void (*__read_mostly lapic_timer_on)(void); @@ -310,12 +310,27 @@ static char* acpi_cstate_method_name[] = "HALT" }; -static uint64_t get_stime_tick(void) { return (uint64_t)NOW(); } -static uint64_t stime_ticks_elapsed(uint64_t t1, uint64_t t2) { return t2 - t1; } -static uint64_t stime_tick_to_ns(uint64_t ticks) { return ticks; } +static uint64_t cf_check get_stime_tick(void) +{ + return NOW(); +} + +static uint64_t cf_check stime_ticks_elapsed(uint64_t t1, uint64_t t2) +{ + return t2 - t1; +} + +static uint64_t cf_check stime_tick_to_ns(uint64_t ticks) +{ + return ticks; +} + +static uint64_t cf_check get_acpi_pm_tick(void) +{ + return inl(pmtmr_ioport); +} -static uint64_t get_acpi_pm_tick(void) { return (uint64_t)inl(pmtmr_ioport); } -static uint64_t acpi_pm_ticks_elapsed(uint64_t t1, uint64_t t2) +static uint64_t cf_check acpi_pm_ticks_elapsed(uint64_t t1, uint64_t t2) { if ( t2 >= t1 ) return (t2 - t1); @@ -664,7 +679,7 @@ void update_idle_stats(struct acpi_processor_power *power, spin_unlock(&power->stat_lock); } -static void acpi_processor_idle(void) +static void cf_check acpi_processor_idle(void) { unsigned int cpu = smp_processor_id(); struct acpi_processor_power *power = processor_powers[cpu]; @@ -869,7 +884,7 @@ static void acpi_processor_idle(void) cpuidle_current_governor->reflect(power); } -void acpi_dead_idle(void) +void cf_check acpi_dead_idle(void) { struct acpi_processor_power *power; struct acpi_processor_cx *cx; diff --git a/xen/arch/x86/acpi/cpuidle_menu.c b/xen/arch/x86/acpi/cpuidle_menu.c index 6ff5fb8ff215..a275436d799c 100644 --- a/xen/arch/x86/acpi/cpuidle_menu.c +++ b/xen/arch/x86/acpi/cpuidle_menu.c @@ -185,7 +185,7 @@ static unsigned int get_sleep_length_us(void) return (us >> 32) ? (unsigned int)-2000 : (unsigned int)us; } -static int menu_select(struct acpi_processor_power *power) +static int cf_check menu_select(struct acpi_processor_power *power) { struct menu_device *data = &this_cpu(menu_devices); int i; @@ -237,7 +237,7 @@ static int menu_select(struct acpi_processor_power *power) return data->last_state_idx; } -static void menu_reflect(struct acpi_processor_power *power) +static void cf_check menu_reflect(struct acpi_processor_power *power) { struct menu_device *data = &this_cpu(menu_devices); u64 new_factor; @@ -275,7 +275,7 @@ static void menu_reflect(struct acpi_processor_power *power) data->correction_factor[data->bucket] = new_factor; } -static int menu_enable_device(struct acpi_processor_power *power) +static int cf_check menu_enable_device(struct acpi_processor_power *power) { memset(&per_cpu(menu_devices, power->cpu), 0, sizeof(struct menu_device)); diff --git a/xen/arch/x86/cpu/mwait-idle.c b/xen/arch/x86/cpu/mwait-idle.c index 927ce1b67aa5..f76c64e04b20 100644 --- a/xen/arch/x86/cpu/mwait-idle.c +++ b/xen/arch/x86/cpu/mwait-idle.c @@ -773,7 +773,7 @@ static const struct cpuidle_state snr_cstates[] = { {} }; -static void mwait_idle(void) +static void cf_check mwait_idle(void) { unsigned int cpu = smp_processor_id(); struct acpi_processor_power *power = processor_powers[cpu]; diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index 1c3a1ec2a080..ae7c88b51af1 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -74,11 +74,11 @@ DEFINE_PER_CPU(struct vcpu *, curr_vcpu); -static void default_idle(void); +static void cf_check default_idle(void); void (*pm_idle) (void) __read_mostly = default_idle; void (*dead_idle) (void) __read_mostly = default_dead_idle; -static void default_idle(void) +static void cf_check default_idle(void) { struct cpu_info *info = get_cpu_info(); @@ -93,7 +93,7 @@ static void default_idle(void) local_irq_enable(); } -void default_dead_idle(void) +void cf_check default_dead_idle(void) { /* * When going into S3, without flushing caches modified data may be diff --git a/xen/arch/x86/hpet.c b/xen/arch/x86/hpet.c index c31fd97579dc..20fca839907c 100644 --- a/xen/arch/x86/hpet.c +++ b/xen/arch/x86/hpet.c @@ -709,7 +709,7 @@ void hpet_disable_legacy_broadcast(void) smp_send_event_check_mask(&cpu_online_map); } -void hpet_broadcast_enter(void) +void cf_check hpet_broadcast_enter(void) { unsigned int cpu = smp_processor_id(); struct hpet_event_channel *ch = per_cpu(cpu_bc_channel, cpu); @@ -740,7 +740,7 @@ void hpet_broadcast_enter(void) spin_unlock(&ch->lock); } -void hpet_broadcast_exit(void) +void cf_check hpet_broadcast_exit(void) { unsigned int cpu = smp_processor_id(); struct hpet_event_channel *ch = per_cpu(cpu_bc_channel, cpu); diff --git a/xen/arch/x86/include/asm/cpuidle.h b/xen/arch/x86/include/asm/cpuidle.h index 0981a8fd6417..3edd7a75d2ef 100644 --- a/xen/arch/x86/include/asm/cpuidle.h +++ b/xen/arch/x86/include/asm/cpuidle.h @@ -17,8 +17,8 @@ extern uint64_t (*cpuidle_get_tick)(void); int mwait_idle_init(struct notifier_block *); int cpuidle_init_cpu(unsigned int cpu); -void default_dead_idle(void); -void acpi_dead_idle(void); +void cf_check default_dead_idle(void); +void cf_check acpi_dead_idle(void); void play_dead(void); void trace_exit_reason(u32 *irq_traced); void update_idle_stats(struct acpi_processor_power *, diff --git a/xen/arch/x86/include/asm/hpet.h b/xen/arch/x86/include/asm/hpet.h index 8f9725a95e21..f343fe4740f1 100644 --- a/xen/arch/x86/include/asm/hpet.h +++ b/xen/arch/x86/include/asm/hpet.h @@ -91,8 +91,8 @@ void hpet_disable_legacy_replacement_mode(void); */ void hpet_broadcast_init(void); void hpet_broadcast_resume(void); -void hpet_broadcast_enter(void); -void hpet_broadcast_exit(void); +void cf_check hpet_broadcast_enter(void); +void cf_check hpet_broadcast_exit(void); int hpet_broadcast_is_available(void); void hpet_disable_legacy_broadcast(void); diff --git a/xen/arch/x86/include/asm/time.h b/xen/arch/x86/include/asm/time.h index f06f2bfd8b8f..2a57d930ef30 100644 --- a/xen/arch/x86/include/asm/time.h +++ b/xen/arch/x86/include/asm/time.h @@ -43,11 +43,11 @@ int hwdom_pit_access(struct ioreq *ioreq); int cpu_frequency_change(u64 freq); -void pit_broadcast_enter(void); -void pit_broadcast_exit(void); +void cf_check pit_broadcast_enter(void); +void cf_check pit_broadcast_exit(void); int pit_broadcast_is_available(void); -uint64_t acpi_pm_tick_to_ns(uint64_t ticks); +uint64_t cf_check acpi_pm_tick_to_ns(uint64_t ticks); uint64_t tsc_ticks2ns(uint64_t ticks); diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index b6e690b76fab..043be2a8ec1a 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -545,7 +545,7 @@ static __init int cf_check init_pmtmr_scale(void) } __initcall(init_pmtmr_scale); -uint64_t acpi_pm_tick_to_ns(uint64_t ticks) +uint64_t cf_check acpi_pm_tick_to_ns(uint64_t ticks) { return scale_delta(ticks, &pmt_scale); } @@ -2237,12 +2237,12 @@ static int __init cf_check disable_pit_irq(void) } __initcall(disable_pit_irq); -void pit_broadcast_enter(void) +void cf_check pit_broadcast_enter(void) { cpumask_set_cpu(smp_processor_id(), &pit_broadcast_mask); } -void pit_broadcast_exit(void) +void cf_check pit_broadcast_exit(void) { int cpu = smp_processor_id(); diff --git a/xen/drivers/cpufreq/cpufreq_misc_governors.c b/xen/drivers/cpufreq/cpufreq_misc_governors.c index ad79d0f5d246..f5571f5486ab 100644 --- a/xen/drivers/cpufreq/cpufreq_misc_governors.c +++ b/xen/drivers/cpufreq/cpufreq_misc_governors.c @@ -26,8 +26,8 @@ static unsigned int __read_mostly userspace_cmdline_freq; static DEFINE_PER_CPU(unsigned int, cpu_set_freq); -static int cpufreq_governor_userspace(struct cpufreq_policy *policy, - unsigned int event) +static int cf_check cpufreq_governor_userspace( + struct cpufreq_policy *policy, unsigned int event) { int ret = 0; unsigned int cpu; @@ -81,7 +81,7 @@ int write_userspace_scaling_setspeed(unsigned int cpu, unsigned int freq) return __cpufreq_driver_target(policy, freq, CPUFREQ_RELATION_L); } -static bool_t __init +static bool __init cf_check cpufreq_userspace_handle_option(const char *name, const char *val) { if (!strcmp(name, "speed") && val) { @@ -131,8 +131,8 @@ __initcall(cpufreq_gov_userspace_init); /* * cpufreq performance governor */ -static int cpufreq_governor_performance(struct cpufreq_policy *policy, - unsigned int event) +static int cf_check cpufreq_governor_performance( + struct cpufreq_policy *policy, unsigned int event) { int ret = 0; @@ -170,8 +170,8 @@ __initcall(cpufreq_gov_performance_init); /* * cpufreq powersave governor */ -static int cpufreq_governor_powersave(struct cpufreq_policy *policy, - unsigned int event) +static int cf_check cpufreq_governor_powersave( + struct cpufreq_policy *policy, unsigned int event) { int ret = 0; From patchwork Mon Feb 14 12:50:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745568 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 49D66C433F5 for ; Mon, 14 Feb 2022 13:06:41 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271723.466430 (Exim 4.92) (envelope-from ) id 1nJb3n-0002if-Sz; Mon, 14 Feb 2022 13:06:31 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271723.466430; Mon, 14 Feb 2022 13:06:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3m-0002dA-Jm; Mon, 14 Feb 2022 13:06:30 +0000 Received: by outflank-mailman (input) for mailman id 271723; Mon, 14 Feb 2022 13:06:28 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2h-00023t-4r for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:23 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id c2e7a5a7-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:21 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: c2e7a5a7-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843922; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=QPTLA3fxBXu+aWVC9A50VpUZzEOTsG18u0DPp6i34Rw=; b=GSed5NuU4e7fyLn0FMMiVRKkmFUBsHkcWiGsNsy0ZBSaAUBGdEl/TjYZ f4G2yyGAFgMANxZ/q07xVsOUoMOE03VS61qJjgZMiRoQpRjKAuqGROqR/ CNBQoC9SPSvTC7g1lfAoQGSnlcCHdEYuOrSXQYE+YGWH7HkLENkK32xB1 s=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: c2M73LM69pIwwg1qbCGadoc2ajN9nWF7fZKXxFINZQUIpiechXqiAM9dhGJRicOlH0lNnjKFUQ uRNM54fdc3VLddtTFmb1I3uw+xRbmLH+N3tsIZZyCG2VaLCTQ1miqgwmvPZ0J0RSYQLeqINKjW /iAsNvjfnQFuzqBsvL97tC4RpaIEBEJU8jaIgQGLTVsvmmofbjewZ/5gnQklSp9gPvcsDymhVj GBu4iqutX8ozgWDIl5uHZJfmxUzlIdtgsuPl5sUCoEYq4uaNcVzAeioK2v+5Cg16zFWHUa5uMy MyI7uxoZD3JGT23iz1kxgoLg X-SBRS: 5.1 X-MesageID: 64149399 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:NrpN56M6BtRU0fbvrR27kMFynXyQoLVcMsEvi/4bfWQNrUon1jAEy zRNCj2Da/+IZ2unetwiPN7j9U8F6pPRyt5gGQto+SlhQUwRpJueD7x1DKtR0wB+jCHnZBg6h ynLQoCYdKjYdpJYz/uUGuCJQUNUjMlkfZKhTr6UUsxNbVU8En1500s/w7dRbrNA2rBVPSvc4 bsenOWHULOV82Yc3rU8sv/rRLtH5ZweiRtA1rAMTakjUGz2zhH5OKk3N6CpR0YUd6EPdgKMq 0Qv+5nilo/R109F5tpICd8XeGVSKlLZFVDmZna7x8FOK/WNz8A/+v9TCRYSVatYo2WQrs8ux 5IQjIyPFAwXObWTwuENXzANRkmSPYUekFPGCX22sMjVxEzaaXr8hf5pCSnaP6VBpLwxWzsXs 6VFdnZdNXhvhMrvqF6/YsBqit4uM4/AO4QHt2s75TrYEewnUdbIRKCiCdpwgmtp2pEVTKe2i 8wxZytwSyqZTx1zak4uM5U9oqCL2mLEbGgNwL6SjfVuuDWCpOBr65D9PdyQdtGUSMF9mkeDu nmA72n/GgsdNtGU1XyC6H3EuwPUtXqlAsRITuT+r6M0xg3IroAONPEIfQuikObmhQnjYsJgd kcq/TJx960i+GX+G7ERQCaEiHKDuxcdXf9ZHOs79ByBx8Lo3uqJOoQXZmUfMYJ77afaURRvj wbUxI2xWVSDpZXIESr1y1uCkd+l1cH5x0cmbDRMcwYK6sKLTGob3kOWFYYL/EJYY7TI9dDML 9Ki8XJWa1Y715djO0CHEbfv2WzEm3QxZlRpjjg7p0r8hu+DWKarZpaz9X/Q5utaIYCSQzGp5 SZYx5fOvL1TVcjWzkRhpdnh+5nzuZ643MD02wYzT/HNCRzxk5JcQWygyG4nfxo4Wir1UTTof FXSqWtsCGx7ZxOXgVtMS9vpUawClPG4ffy8D6y8RoceM/BZKV7clAkzNBH44owYuBV1+U3JE czAKpjE4LdzIfkP8QdasM9Dje51lnhmnzu7qFKS503P7IdyrUW9Ed8tWGZipMhghE9diAmKo dtZKeWQzBBTDL/3biXNqNZBJlEWN3krQ5vxrpUPJOKEJwNnHkAnCuPQnux9K9A0wfwNm7ea5 Gy5V29Z1EH72S/NJzKVZy0xc7joR5t+8y42ZHR+IVay1nE/So+z96NDJYAvdLwq+bU7n/55R vUIYeuaBfFLRmiV8jgRd8Cl/odjaA6qlUSFOC/8OGozeJtpRgro/N74f1SwqHlSX3Tv7cZn+ u+uzALWR5YHVj9ONseOZaL91U61sFgchPl2AxnCLO5MdRi+64NtMSHw0KM6epleNRXZyzKG/ A+KGhNE9/LVqoo4/dSV16CJq4ClT7l3EkZARjSJ6L+3MW/R/3a5wJ8GW+GNJGiPWGTx8aSkR ONU0/Cjb6FXwAcU69JxQ+Rx0KYzx9rzvLsLnA1rEULCY0mvFr49cGKN2tNCt/EVy7JU0edst pljJjWO1W21Bf7Y IronPort-HdrOrdr: A9a23:qibe6KHniW4PmsTmpLqE6seALOsnbusQ8zAXP0AYc3Jom62j5r mTdZsgtSMc5Ax8ZJhko6HkBEDiewK7yXcW2/hzAV7KZmCP0wHEEGgh1/qH/9SJIVyYygc378 ZdmsZFZ+EYdWIK7/rH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149399" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 41/70] x86/quirks: CFI hardening Date: Mon, 14 Feb 2022 12:50:58 +0000 Message-ID: <20220214125127.17985-42-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/dmi_scan.c | 10 +++++----- xen/arch/x86/hvm/quirks.c | 2 +- xen/arch/x86/shutdown.c | 2 +- xen/arch/x86/x86_64/mmconfig-shared.c | 8 ++++---- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/xen/arch/x86/dmi_scan.c b/xen/arch/x86/dmi_scan.c index d27cd3450a29..81f80c053a7a 100644 --- a/xen/arch/x86/dmi_scan.c +++ b/xen/arch/x86/dmi_scan.c @@ -476,7 +476,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot, int str #define NO_MATCH { DMI_NONE, NULL} #define MATCH DMI_MATCH -static int __init ich10_bios_quirk(const struct dmi_system_id *d) +static int __init cf_check ich10_bios_quirk(const struct dmi_system_id *d) { u32 port, smictl; @@ -499,14 +499,14 @@ static int __init ich10_bios_quirk(const struct dmi_system_id *d) return 0; } -static __init int reset_videomode_after_s3(const struct dmi_blacklist *d) +static __init int cf_check reset_videomode_after_s3(const struct dmi_blacklist *d) { /* See wakeup.S */ acpi_video_flags |= 2; return 0; } -static __init int dmi_disable_acpi(const struct dmi_blacklist *d) +static __init int cf_check dmi_disable_acpi(const struct dmi_blacklist *d) { if (!acpi_force) { printk(KERN_NOTICE "%s detected: acpi off\n",d->ident); @@ -521,7 +521,7 @@ static __init int dmi_disable_acpi(const struct dmi_blacklist *d) /* * Limit ACPI to CPU enumeration for HT */ -static __init int force_acpi_ht(const struct dmi_blacklist *d) +static __init int cf_check force_acpi_ht(const struct dmi_blacklist *d) { if (!acpi_force) { printk(KERN_NOTICE "%s detected: force use of acpi=ht\n", d->ident); @@ -650,7 +650,7 @@ static const struct dmi_blacklist __initconstrel dmi_blacklist[] = { * out of here. */ -static void __init dmi_decode(const struct dmi_header *dm) +static void __init cf_check dmi_decode(const struct dmi_header *dm) { #ifdef DMI_DEBUG const uint8_t *data = (const void *)dm; diff --git a/xen/arch/x86/hvm/quirks.c b/xen/arch/x86/hvm/quirks.c index 917356b1312c..2adab1f4b84b 100644 --- a/xen/arch/x86/hvm/quirks.c +++ b/xen/arch/x86/hvm/quirks.c @@ -25,7 +25,7 @@ s8 __read_mostly hvm_port80_allowed = -1; boolean_param("hvm_port80", hvm_port80_allowed); -static int __init dmi_hvm_deny_port80(const struct dmi_system_id *id) +static int __init cf_check dmi_hvm_deny_port80(const struct dmi_system_id *id) { printk(XENLOG_WARNING "%s: port 0x80 access %s allowed for HVM guests\n", id->ident, hvm_port80_allowed > 0 ? "forcibly" : "not"); diff --git a/xen/arch/x86/shutdown.c b/xen/arch/x86/shutdown.c index 30985d36a612..7619544d14da 100644 --- a/xen/arch/x86/shutdown.c +++ b/xen/arch/x86/shutdown.c @@ -158,7 +158,7 @@ static void default_reboot_type(void) reboot_type = BOOT_ACPI; } -static int __init override_reboot(const struct dmi_system_id *d) +static int __init cf_check override_reboot(const struct dmi_system_id *d) { enum reboot_type type = (long)d->driver_data; diff --git a/xen/arch/x86/x86_64/mmconfig-shared.c b/xen/arch/x86/x86_64/mmconfig-shared.c index 2fa7f3f0bc4b..74b22b71a19c 100644 --- a/xen/arch/x86/x86_64/mmconfig-shared.c +++ b/xen/arch/x86/x86_64/mmconfig-shared.c @@ -62,7 +62,7 @@ static int __init cf_check parse_mmcfg(const char *s) } custom_param("mmcfg", parse_mmcfg); -static const char __init *pci_mmcfg_e7520(void) +static const char *__init cf_check pci_mmcfg_e7520(void) { u32 win; win = pci_conf_read16(PCI_SBDF(0, 0, 0, 0), 0xce); @@ -84,7 +84,7 @@ static const char __init *pci_mmcfg_e7520(void) return "Intel Corporation E7520 Memory Controller Hub"; } -static const char __init *pci_mmcfg_intel_945(void) +static const char *__init cf_check pci_mmcfg_intel_945(void) { u32 pciexbar, mask = 0, len = 0; @@ -137,7 +137,7 @@ static const char __init *pci_mmcfg_intel_945(void) return "Intel Corporation 945G/GZ/P/PL Express Memory Controller Hub"; } -static const char __init *pci_mmcfg_amd_fam10h(void) +static const char *__init cf_check pci_mmcfg_amd_fam10h(void) { uint32_t address; uint64_t base, msr_content; @@ -190,7 +190,7 @@ static const char __init *pci_mmcfg_amd_fam10h(void) return "AMD Family 10h NB"; } -static const char __init *pci_mmcfg_nvidia_mcp55(void) +static const char *__init cf_check pci_mmcfg_nvidia_mcp55(void) { static bool_t __initdata mcp55_checked; int bus, i; From patchwork Mon Feb 14 12:50:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745588 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 672EDC433EF for ; Mon, 14 Feb 2022 13:16:34 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271913.466665 (Exim 4.92) (envelope-from ) id 1nJbDK-00020K-Iy; Mon, 14 Feb 2022 13:16:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271913.466665; Mon, 14 Feb 2022 13:16:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDK-0001zy-F0; Mon, 14 Feb 2022 13:16:22 +0000 Received: by outflank-mailman (input) for mailman id 271913; Mon, 14 Feb 2022 13:16:19 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3W-0008IH-A5 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:14 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e168e7d9-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:12 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e168e7d9-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843972; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=ZeH6O9XaSCM4nWzskGu9oWidhKAGbDFLn89nxDUkjLk=; b=QJZzM5oaZhi2xA2Zi89Y2xHTTFb08J+5kg3g51lyURuTTfHkyTqM+ldN MB40FNTexah9W2SHlfj2hz5FQ6TS0uRn0xUQO5vgrDCxP50MvMtW+OuS7 4lJ+O9797EniZa0U9k+Z8Df2KId/udjvvMWVDK1cBmU0X2CUIi/D6X6h4 Q=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: PgHkDbHah6iAFNUMu4uw1QH6AB+iOophm8YewS0rfzJp6aePwkzcxFz0t/hmEoM/+Jxxvzck7g LpNjFD83Q+8hHJlHJYJ8B+Nu3K+69PlUeh6vXnWQRIp9QUBHU4uCqbI54QitbuTDHNPqyDgkC9 FWmMWo8uBygGhhpFuEJdBZ4CkJ3NHWNkvyBEQ8enZGdyXRHTpWAxDozFO0SkviYmbzk7QVa59H BcYk8w4f0JwsRK4J7oIr2eejvIa76ZG4PozqUAZGM6+tuNGHx470pUjbsnzie62WHwzNKgxUXL jY2T/Ti6Fh9CKX5IGGjgoT78 X-SBRS: 5.1 X-MesageID: 64149870 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:7+b3VK6m1Bog8IjFj4AnKQxRtCfAchMFZxGqfqrLsTDasY5as4F+v mVOD2qAaK2OYjH3Lox1bom39h4CvcXVnNE2HAI+/yBjHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Zx I0SrbWAYwsSHrTv2/oHSidcHTNvMvgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQa+CN ppGMVKDajzRODpOYAkPV6sP37iupXn2dDpit1ua8P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeRhhbhQ/tvA UAv2jMN7rYo7XKvQMvsUEjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5imz2DH82np/lluJLHDEOopX4+GAPmRogEAGms+W05K v5TaJmHzQtxSur7bnWF+IIfNwlSf3M6GYr3u4pccevaelhqH2QoCvnwx7I9etM6w/QJx7mQp nztCFVFzFffhGHcLVnYYH5Ud76yD410qmg2PHJwMA/wiWQje4um8IwWa4AzIes87OVmwPMtF 6sFdsyMD+5hUDPC/zhBP5DxoJY7LEaghB6UPjrjaz86JsYySwvM897iXw3u6ChRUXbn6Zpg+ +Wtj1qJT4ACSgJuCNftRMiul17h72IAnO9SXlfTJoUBckvb74U3eTf6ieU6Ip9QJEyblCeaz QufHTwRufLJ/90u6NDMiK2J89WpHu95EhYIFmXX9+/rZyzT/27lyo5cSueYOzvaUTqsqqmlY OxUydD6MeEGwwkW49YtTe4zwPJs/cbrqp9b0h9gTSfCYFmcA799JmWLgJtUvapXy74F4Qa7V ypjIDWB1Wll7C89LGMsGQ== IronPort-HdrOrdr: A9a23:6e+jBa8GOLnaHDB8X45uk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149870" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 42/70] x86/hvmsave: CFI hardening Date: Mon, 14 Feb 2022 12:50:59 +0000 Message-ID: <20220214125127.17985-43-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/mcheck/vmce.c | 4 ++-- xen/arch/x86/emul-i8254.c | 4 ++-- xen/arch/x86/hvm/hpet.c | 4 ++-- xen/arch/x86/hvm/hvm.c | 18 ++++++++++-------- xen/arch/x86/hvm/irq.c | 12 ++++++------ xen/arch/x86/hvm/mtrr.c | 4 ++-- xen/arch/x86/hvm/pmtimer.c | 4 ++-- xen/arch/x86/hvm/rtc.c | 4 ++-- xen/arch/x86/hvm/vioapic.c | 4 ++-- xen/arch/x86/hvm/viridian/viridian.c | 15 ++++++++------- xen/arch/x86/hvm/vlapic.c | 8 ++++---- xen/arch/x86/hvm/vpic.c | 4 ++-- 12 files changed, 44 insertions(+), 41 deletions(-) diff --git a/xen/arch/x86/cpu/mcheck/vmce.c b/xen/arch/x86/cpu/mcheck/vmce.c index eb6434a3ba20..458120f9ad8d 100644 --- a/xen/arch/x86/cpu/mcheck/vmce.c +++ b/xen/arch/x86/cpu/mcheck/vmce.c @@ -353,7 +353,7 @@ int vmce_wrmsr(uint32_t msr, uint64_t val) } #if CONFIG_HVM -static int vmce_save_vcpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check vmce_save_vcpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) { struct hvm_vmce_vcpu ctxt = { .caps = v->arch.vmce.mcg_cap, @@ -365,7 +365,7 @@ static int vmce_save_vcpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(VMCE_VCPU, v->vcpu_id, h, &ctxt); } -static int vmce_load_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) +static int cf_check vmce_load_vcpu_ctxt(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; diff --git a/xen/arch/x86/emul-i8254.c b/xen/arch/x86/emul-i8254.c index 0e09a173187f..d170f464d966 100644 --- a/xen/arch/x86/emul-i8254.c +++ b/xen/arch/x86/emul-i8254.c @@ -391,7 +391,7 @@ void pit_stop_channel0_irq(PITState *pit) spin_unlock(&pit->lock); } -static int pit_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check pit_save(struct vcpu *v, hvm_domain_context_t *h) { struct domain *d = v->domain; PITState *pit = domain_vpit(d); @@ -409,7 +409,7 @@ static int pit_save(struct vcpu *v, hvm_domain_context_t *h) return rc; } -static int pit_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check pit_load(struct domain *d, hvm_domain_context_t *h) { PITState *pit = domain_vpit(d); int i, rc = 0; diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c index 7bdb51cfa1c4..ed512fa65b63 100644 --- a/xen/arch/x86/hvm/hpet.c +++ b/xen/arch/x86/hvm/hpet.c @@ -582,7 +582,7 @@ static const struct hvm_mmio_ops hpet_mmio_ops = { }; -static int hpet_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hpet_save(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; HPETState *hp = domain_vhpet(d); @@ -645,7 +645,7 @@ static int hpet_save(struct vcpu *v, hvm_domain_context_t *h) return rc; } -static int hpet_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check hpet_load(struct domain *d, hvm_domain_context_t *h) { HPETState *hp = domain_vhpet(d); struct hvm_hw_hpet *rec; diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index e87e809a945d..4cf313a0ad0a 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -756,7 +756,7 @@ void hvm_domain_destroy(struct domain *d) destroy_vpci_mmcfg(d); } -static int hvm_save_tsc_adjust(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hvm_save_tsc_adjust(struct vcpu *v, hvm_domain_context_t *h) { struct hvm_tsc_adjust ctxt = { .tsc_adjust = v->arch.hvm.msr_tsc_adjust, @@ -765,7 +765,7 @@ static int hvm_save_tsc_adjust(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(TSC_ADJUST, v->vcpu_id, h, &ctxt); } -static int hvm_load_tsc_adjust(struct domain *d, hvm_domain_context_t *h) +static int cf_check hvm_load_tsc_adjust(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; @@ -788,7 +788,7 @@ static int hvm_load_tsc_adjust(struct domain *d, hvm_domain_context_t *h) HVM_REGISTER_SAVE_RESTORE(TSC_ADJUST, hvm_save_tsc_adjust, hvm_load_tsc_adjust, 1, HVMSR_PER_VCPU); -static int hvm_save_cpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hvm_save_cpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) { struct segment_register seg; struct hvm_hw_cpu ctxt = { @@ -971,7 +971,7 @@ unsigned long hvm_cr4_guest_valid_bits(const struct domain *d) (cet ? X86_CR4_CET : 0)); } -static int hvm_load_cpu_ctxt(struct domain *d, hvm_domain_context_t *h) +static int cf_check hvm_load_cpu_ctxt(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; @@ -1172,7 +1172,8 @@ HVM_REGISTER_SAVE_RESTORE(CPU, hvm_save_cpu_ctxt, hvm_load_cpu_ctxt, 1, save_area) + \ xstate_ctxt_size(xcr0)) -static int hvm_save_cpu_xsave_states(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hvm_save_cpu_xsave_states( + struct vcpu *v, hvm_domain_context_t *h) { struct hvm_hw_cpu_xsave *ctxt; unsigned int size = HVM_CPU_XSAVE_SIZE(v->arch.xcr0_accum); @@ -1210,7 +1211,8 @@ CHECK_FIELD_(struct, xsave_hdr, reserved); #undef compat_xsave_hdr #undef xen_xsave_hdr -static int hvm_load_cpu_xsave_states(struct domain *d, hvm_domain_context_t *h) +static int cf_check hvm_load_cpu_xsave_states( + struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid, size; int err; @@ -1338,7 +1340,7 @@ static const uint32_t msrs_to_send[] = { MSR_AMD64_DR3_ADDRESS_MASK, }; -static int hvm_save_cpu_msrs(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hvm_save_cpu_msrs(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; struct hvm_save_descriptor *desc = _p(&h->data[h->cur]); @@ -1418,7 +1420,7 @@ static int hvm_save_cpu_msrs(struct vcpu *v, hvm_domain_context_t *h) return 0; } -static int hvm_load_cpu_msrs(struct domain *d, hvm_domain_context_t *h) +static int cf_check hvm_load_cpu_msrs(struct domain *d, hvm_domain_context_t *h) { unsigned int i, vcpuid = hvm_load_instance(h); struct vcpu *v; diff --git a/xen/arch/x86/hvm/irq.c b/xen/arch/x86/hvm/irq.c index a7f8991a7b84..5a7f39b54ff4 100644 --- a/xen/arch/x86/hvm/irq.c +++ b/xen/arch/x86/hvm/irq.c @@ -657,7 +657,7 @@ static int __init cf_check dump_irq_info_key_init(void) } __initcall(dump_irq_info_key_init); -static int irq_save_pci(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check irq_save_pci(struct vcpu *v, hvm_domain_context_t *h) { struct domain *d = v->domain; struct hvm_irq *hvm_irq = hvm_domain_irq(d); @@ -690,7 +690,7 @@ static int irq_save_pci(struct vcpu *v, hvm_domain_context_t *h) return rc; } -static int irq_save_isa(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check irq_save_isa(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; struct hvm_irq *hvm_irq = hvm_domain_irq(d); @@ -699,7 +699,7 @@ static int irq_save_isa(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(ISA_IRQ, 0, h, &hvm_irq->isa_irq); } -static int irq_save_link(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check irq_save_link(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; struct hvm_irq *hvm_irq = hvm_domain_irq(d); @@ -708,7 +708,7 @@ static int irq_save_link(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(PCI_LINK, 0, h, &hvm_irq->pci_link); } -static int irq_load_pci(struct domain *d, hvm_domain_context_t *h) +static int cf_check irq_load_pci(struct domain *d, hvm_domain_context_t *h) { struct hvm_irq *hvm_irq = hvm_domain_irq(d); int link, dev, intx, gsi; @@ -741,7 +741,7 @@ static int irq_load_pci(struct domain *d, hvm_domain_context_t *h) return 0; } -static int irq_load_isa(struct domain *d, hvm_domain_context_t *h) +static int cf_check irq_load_isa(struct domain *d, hvm_domain_context_t *h) { struct hvm_irq *hvm_irq = hvm_domain_irq(d); int irq; @@ -760,7 +760,7 @@ static int irq_load_isa(struct domain *d, hvm_domain_context_t *h) } -static int irq_load_link(struct domain *d, hvm_domain_context_t *h) +static int cf_check irq_load_link(struct domain *d, hvm_domain_context_t *h) { struct hvm_irq *hvm_irq = hvm_domain_irq(d); int link, gsi; diff --git a/xen/arch/x86/hvm/mtrr.c b/xen/arch/x86/hvm/mtrr.c index 42f3d8319296..4d2aa6def86d 100644 --- a/xen/arch/x86/hvm/mtrr.c +++ b/xen/arch/x86/hvm/mtrr.c @@ -687,7 +687,7 @@ int hvm_set_mem_pinned_cacheattr(struct domain *d, uint64_t gfn_start, return 0; } -static int hvm_save_mtrr_msr(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check hvm_save_mtrr_msr(struct vcpu *v, hvm_domain_context_t *h) { const struct mtrr_state *mtrr_state = &v->arch.hvm.mtrr; struct hvm_hw_mtrr hw_mtrr = { @@ -725,7 +725,7 @@ static int hvm_save_mtrr_msr(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(MTRR, v->vcpu_id, h, &hw_mtrr); } -static int hvm_load_mtrr_msr(struct domain *d, hvm_domain_context_t *h) +static int cf_check hvm_load_mtrr_msr(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid, i; struct vcpu *v; diff --git a/xen/arch/x86/hvm/pmtimer.c b/xen/arch/x86/hvm/pmtimer.c index 60e3c8de4c6b..2a89bbdfa5b8 100644 --- a/xen/arch/x86/hvm/pmtimer.c +++ b/xen/arch/x86/hvm/pmtimer.c @@ -249,7 +249,7 @@ static int cf_check handle_pmt_io( return X86EMUL_OKAY; } -static int acpi_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check acpi_save(struct vcpu *v, hvm_domain_context_t *h) { struct domain *d = v->domain; struct hvm_hw_acpi *acpi = &d->arch.hvm.acpi; @@ -281,7 +281,7 @@ static int acpi_save(struct vcpu *v, hvm_domain_context_t *h) return rc; } -static int acpi_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check acpi_load(struct domain *d, hvm_domain_context_t *h) { struct hvm_hw_acpi *acpi = &d->arch.hvm.acpi; PMTState *s = &d->arch.hvm.pl_time->vpmt; diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index bdc647e433e9..ed397276faa3 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -738,7 +738,7 @@ void rtc_migrate_timers(struct vcpu *v) } /* Save RTC hardware state */ -static int rtc_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check rtc_save(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; RTCState *s = domain_vrtc(d); @@ -756,7 +756,7 @@ static int rtc_save(struct vcpu *v, hvm_domain_context_t *h) } /* Reload the hardware state from a saved domain */ -static int rtc_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check rtc_load(struct domain *d, hvm_domain_context_t *h) { RTCState *s = domain_vrtc(d); diff --git a/xen/arch/x86/hvm/vioapic.c b/xen/arch/x86/hvm/vioapic.c index b56549aa22d1..d5d5b02421e9 100644 --- a/xen/arch/x86/hvm/vioapic.c +++ b/xen/arch/x86/hvm/vioapic.c @@ -590,7 +590,7 @@ int vioapic_get_trigger_mode(const struct domain *d, unsigned int gsi) return vioapic->redirtbl[pin].fields.trig_mode; } -static int ioapic_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check ioapic_save(struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; struct hvm_vioapic *s; @@ -607,7 +607,7 @@ static int ioapic_save(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(IOAPIC, 0, h, &s->domU); } -static int ioapic_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check ioapic_load(struct domain *d, hvm_domain_context_t *h) { struct hvm_vioapic *s; diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c index 7ebcaa1c899f..25dca93e8b71 100644 --- a/xen/arch/x86/hvm/viridian/viridian.c +++ b/xen/arch/x86/hvm/viridian/viridian.c @@ -1104,8 +1104,8 @@ void viridian_unmap_guest_page(struct viridian_page *vp) put_page_and_type(page); } -static int viridian_save_domain_ctxt(struct vcpu *v, - hvm_domain_context_t *h) +static int cf_check viridian_save_domain_ctxt( + struct vcpu *v, hvm_domain_context_t *h) { const struct domain *d = v->domain; const struct viridian_domain *vd = d->arch.hvm.viridian; @@ -1123,8 +1123,8 @@ static int viridian_save_domain_ctxt(struct vcpu *v, return (hvm_save_entry(VIRIDIAN_DOMAIN, 0, h, &ctxt) != 0); } -static int viridian_load_domain_ctxt(struct domain *d, - hvm_domain_context_t *h) +static int cf_check viridian_load_domain_ctxt( + struct domain *d, hvm_domain_context_t *h) { struct viridian_domain *vd = d->arch.hvm.viridian; struct hvm_viridian_domain_context ctxt; @@ -1144,7 +1144,8 @@ static int viridian_load_domain_ctxt(struct domain *d, HVM_REGISTER_SAVE_RESTORE(VIRIDIAN_DOMAIN, viridian_save_domain_ctxt, viridian_load_domain_ctxt, 1, HVMSR_PER_DOM); -static int viridian_save_vcpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check viridian_save_vcpu_ctxt( + struct vcpu *v, hvm_domain_context_t *h) { struct hvm_viridian_vcpu_context ctxt = {}; @@ -1157,8 +1158,8 @@ static int viridian_save_vcpu_ctxt(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(VIRIDIAN_VCPU, v->vcpu_id, h, &ctxt); } -static int viridian_load_vcpu_ctxt(struct domain *d, - hvm_domain_context_t *h) +static int cf_check viridian_load_vcpu_ctxt( + struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c index 652e3cb87f12..d4e29ef1ff1d 100644 --- a/xen/arch/x86/hvm/vlapic.c +++ b/xen/arch/x86/hvm/vlapic.c @@ -1482,7 +1482,7 @@ static void lapic_rearm(struct vlapic *s) s->timer_last_update = s->pt.last_plt_gtime; } -static int lapic_save_hidden(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check lapic_save_hidden(struct vcpu *v, hvm_domain_context_t *h) { if ( !has_vlapic(v->domain) ) return 0; @@ -1490,7 +1490,7 @@ static int lapic_save_hidden(struct vcpu *v, hvm_domain_context_t *h) return hvm_save_entry(LAPIC, v->vcpu_id, h, &vcpu_vlapic(v)->hw); } -static int lapic_save_regs(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check lapic_save_regs(struct vcpu *v, hvm_domain_context_t *h) { if ( !has_vlapic(v->domain) ) return 0; @@ -1529,7 +1529,7 @@ static void lapic_load_fixup(struct vlapic *vlapic) } } -static int lapic_load_hidden(struct domain *d, hvm_domain_context_t *h) +static int cf_check lapic_load_hidden(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; @@ -1563,7 +1563,7 @@ static int lapic_load_hidden(struct domain *d, hvm_domain_context_t *h) return 0; } -static int lapic_load_regs(struct domain *d, hvm_domain_context_t *h) +static int cf_check lapic_load_regs(struct domain *d, hvm_domain_context_t *h) { unsigned int vcpuid = hvm_load_instance(h); struct vcpu *v; diff --git a/xen/arch/x86/hvm/vpic.c b/xen/arch/x86/hvm/vpic.c index 5d8ef259b710..b3cafaab8fad 100644 --- a/xen/arch/x86/hvm/vpic.c +++ b/xen/arch/x86/hvm/vpic.c @@ -400,7 +400,7 @@ static int cf_check vpic_intercept_elcr_io( return X86EMUL_OKAY; } -static int vpic_save(struct vcpu *v, hvm_domain_context_t *h) +static int cf_check vpic_save(struct vcpu *v, hvm_domain_context_t *h) { struct domain *d = v->domain; struct hvm_hw_vpic *s; @@ -420,7 +420,7 @@ static int vpic_save(struct vcpu *v, hvm_domain_context_t *h) return 0; } -static int vpic_load(struct domain *d, hvm_domain_context_t *h) +static int cf_check vpic_load(struct domain *d, hvm_domain_context_t *h) { struct hvm_hw_vpic *s; unsigned int inst = hvm_load_instance(h); From patchwork Mon Feb 14 12:51:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745547 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 95309C433EF for ; Mon, 14 Feb 2022 13:05:02 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271642.466181 (Exim 4.92) (envelope-from ) id 1nJb28-00007L-Rf; Mon, 14 Feb 2022 13:04:48 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271642.466181; Mon, 14 Feb 2022 13:04:48 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb28-00007B-OX; Mon, 14 Feb 2022 13:04:48 +0000 Received: by outflank-mailman (input) for mailman id 271642; Mon, 14 Feb 2022 13:04:47 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb27-0008IH-3M for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:47 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ae7b14de-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:45 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ae7b14de-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843885; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=e92OCL5JW96cE+yF15zAo6mkF0e29pgcSSh3YdFWn/0=; b=KOwSP+S7PBX11G4DlPNpJYuku9QogWmZwyvy0Ok88/zSyv+2O1UlHhCG +RZzxebWCcEgAgfeCrOfzFzAGMfmm14g9wACFMpVkqas4sTjvS4IOuKe5 szYUy3uV7iDiX/c57PTWsqA/NAjMHpTywhtzMkY8lOsqFCMdlfA56WSl0 s=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: rQcdzzGVT9+6Jr1mdg/nHbkZS/dqgRwSrlYb3CNg3PlPpzmkbmRD7LtGnH/db0gppo6wneDbNH Y3477CXvYxfIQOu1w4SrnJCi9mm/oyfb+zfln9g9XcJaXO6k1cHXU9oFrTgMTwumZil+Vh6N2u x0KtuFZlni5d3pg/mKgFTCtKaTclr3TO88gKduDAthTOFL062ja0px35Iz6hgLLqcE5zFL9vGb 2nfOHa1gwmJkwEy/owP718rwA9I1XsxYnpPBIn1Cek7g0JilQJ/7FMGWws2Zn4ZAOwEGnXZ1af lQBTeCeexUWKjt8UhUOI4B6l X-SBRS: 5.1 X-MesageID: 64050482 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:ccKvm69ZwnNm15vLh4rODrUDnnmTJUtcMsCJ2f8bNWPcYEJGY0x3y WVJWWCHOa3eYzf2e9Fzbdvn9xxVupXWx9RrSVQ+/Hg8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPh3w 94W9rCdWDt3L67jyOMSXjd/H3xxaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SRauGO 5pDAdZpREjCZAAUeUw3MZ4vlvu6hHK4SGx1q03A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9G/gUXlGP5yO nBK6ykB/a89+WKMQoTyCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+W05K v5TaJmHzQtxSur7bnWF+IIfNwlSf3M6GYr3u4pccevaelhqH2QoCvnwx7I9etM6w/QJx7mQp nztCFVFzFffhGHcLVnYYH5Ud76yD410qmg2PHJwMA/wiWQje4um8IwWa4AzIes87OVmwPMtF 6sFdsyMD+5hUDPC/zhBP5DxoJY7LEaghB6UPjrjaz86JsYySwvM897iXw3u6ChRUXbn6Zpg+ +Wtj1qJT4ACSgJuCNftRMiul17h72IAnO9SXlfTJoUBckvb74U3eTf6ieU6Ip9QJEyblCeaz QufHTwRufLJ/90u6NDMiK2J89WpHu95EhYIFmXX9+/rZyzT/27lyo5cSueYOzvaUTqsqqmlY OxUydD6MeEGwwkW49YtTe4zwPJs/cbrqp9b0h9gTSfCYFmcA799JmWLgJtUvapXy74F4Qa7V ypjIDWB1Wll7C89LGMsGQ== IronPort-HdrOrdr: A9a23:iy2Qaay9i3yZFZLBISe6KrPw1r1zdoMgy1knxilNoHxuH/BwWf rPoB17726RtN91YhsdcL+7V5VoLUmzyXcX2/h1AV7BZniEhILAFugLgbcKqweKJ8SUzJ8+6U 4PSclD4N2bNykGsS75ijPIb+rJFrO8gd+VbeS19QYScelzAZsQiDuQkmygYzZLrA8tP+teKL OsovBpihCHYnotYsGyFhA+LpL+T42iruOeXfYebSRXkDWzsQ== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050482" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 43/70] x86/mce: CFI hardening Date: Mon, 14 Feb 2022 12:51:00 +0000 Message-ID: <20220214125127.17985-44-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/mcheck/mce.c | 8 ++++---- xen/arch/x86/cpu/mcheck/mce.h | 2 +- xen/arch/x86/cpu/mcheck/mce_amd.c | 9 ++++---- xen/arch/x86/cpu/mcheck/mce_amd.h | 4 ++-- xen/arch/x86/cpu/mcheck/mce_intel.c | 41 +++++++++++++++++-------------------- 5 files changed, 31 insertions(+), 33 deletions(-) diff --git a/xen/arch/x86/cpu/mcheck/mce.c b/xen/arch/x86/cpu/mcheck/mce.c index 3467e0f1a315..275c54be7c0f 100644 --- a/xen/arch/x86/cpu/mcheck/mce.c +++ b/xen/arch/x86/cpu/mcheck/mce.c @@ -75,7 +75,7 @@ static int __init cf_check mce_set_verbosity(const char *str) custom_param("mce_verbosity", mce_set_verbosity); /* Handle unconfigured int18 (should never happen) */ -static void unexpected_machine_check(const struct cpu_user_regs *regs) +static void cf_check unexpected_machine_check(const struct cpu_user_regs *regs) { console_force_unlock(); printk("Unexpected Machine Check Exception\n"); @@ -469,7 +469,7 @@ static int mce_urgent_action(const struct cpu_user_regs *regs, } /* Shared #MC handler. */ -void mcheck_cmn_handler(const struct cpu_user_regs *regs) +void cf_check mcheck_cmn_handler(const struct cpu_user_regs *regs) { static DEFINE_MCE_BARRIER(mce_trap_bar); static atomic_t severity_cpu = ATOMIC_INIT(-1); @@ -1684,7 +1684,7 @@ long cf_check do_mca(XEN_GUEST_HANDLE_PARAM(xen_mc_t) u_xen_mc) } int mcinfo_dumpped; -static int x86_mcinfo_dump_panic(mctelem_cookie_t mctc) +static int cf_check x86_mcinfo_dump_panic(mctelem_cookie_t mctc) { struct mc_info *mcip = mctelem_dataptr(mctc); @@ -1801,7 +1801,7 @@ static enum mce_result mce_action(const struct cpu_user_regs *regs, * should be committed for dom0 consumption, 0 if it should be * dismissed. */ -static int mce_delayed_action(mctelem_cookie_t mctc) +static int cf_check mce_delayed_action(mctelem_cookie_t mctc) { enum mce_result result; int ret = 0; diff --git a/xen/arch/x86/cpu/mcheck/mce.h b/xen/arch/x86/cpu/mcheck/mce.h index 195362691904..535d0abf8f9b 100644 --- a/xen/arch/x86/cpu/mcheck/mce.h +++ b/xen/arch/x86/cpu/mcheck/mce.h @@ -70,7 +70,7 @@ extern void x86_mce_vector_register(x86_mce_vector_t); * Common generic MCE handler that implementations may nominate * via x86_mce_vector_register. */ -extern void mcheck_cmn_handler(const struct cpu_user_regs *regs); +void cf_check mcheck_cmn_handler(const struct cpu_user_regs *regs); /* Register a handler for judging whether mce is recoverable. */ typedef bool (*mce_recoverable_t)(uint64_t status); diff --git a/xen/arch/x86/cpu/mcheck/mce_amd.c b/xen/arch/x86/cpu/mcheck/mce_amd.c index 279a8e6f122d..d7ae8919df77 100644 --- a/xen/arch/x86/cpu/mcheck/mce_amd.c +++ b/xen/arch/x86/cpu/mcheck/mce_amd.c @@ -113,7 +113,7 @@ mc_ec2type(uint16_t errorcode) return 0; } -bool mc_amd_recoverable_scan(uint64_t status) +bool cf_check mc_amd_recoverable_scan(uint64_t status) { bool ret = false; enum mc_ec_type ectype; @@ -143,7 +143,7 @@ bool mc_amd_recoverable_scan(uint64_t status) return ret; } -bool mc_amd_addrcheck(uint64_t status, uint64_t misc, int addrtype) +bool cf_check mc_amd_addrcheck(uint64_t status, uint64_t misc, int addrtype) { enum mc_ec_type ectype; uint16_t errorcode; @@ -216,7 +216,7 @@ static void mcequirk_amd_apply(enum mcequirk_amd_flags flags) } } -static struct mcinfo_extended * +static struct mcinfo_extended *cf_check amd_f10_handler(struct mc_info *mi, uint16_t bank, uint64_t status) { struct mcinfo_extended *mc_ext; @@ -252,7 +252,8 @@ amd_f10_handler(struct mc_info *mi, uint16_t bank, uint64_t status) return mc_ext; } -static bool amd_need_clearbank_scan(enum mca_source who, uint64_t status) +static bool cf_check amd_need_clearbank_scan( + enum mca_source who, uint64_t status) { if ( who != MCA_MCE_SCAN ) return true; diff --git a/xen/arch/x86/cpu/mcheck/mce_amd.h b/xen/arch/x86/cpu/mcheck/mce_amd.h index 67c45454707d..c12c25d74567 100644 --- a/xen/arch/x86/cpu/mcheck/mce_amd.h +++ b/xen/arch/x86/cpu/mcheck/mce_amd.h @@ -1,7 +1,7 @@ #ifndef _MCHECK_AMD_H #define _MCHECK_AMD_H -bool mc_amd_recoverable_scan(uint64_t status); -bool mc_amd_addrcheck(uint64_t status, uint64_t misc, int addrtype); +bool cf_check mc_amd_recoverable_scan(uint64_t status); +bool cf_check mc_amd_addrcheck(uint64_t status, uint64_t misc, int addrtype); #endif diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index 7aaa56fd02eb..50198e0c295c 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -271,12 +271,13 @@ static void intel_memerr_dhandler( mc_memerr_dhandler(binfo, result, regs); } -static bool intel_srar_check(uint64_t status) +static bool cf_check intel_srar_check(uint64_t status) { return (intel_check_mce_type(status) == intel_mce_ucr_srar); } -static bool intel_checkaddr(uint64_t status, uint64_t misc, int addrtype) +static bool cf_check intel_checkaddr( + uint64_t status, uint64_t misc, int addrtype) { if ( !(status & MCi_STATUS_ADDRV) || !(status & MCi_STATUS_MISCV) || @@ -287,10 +288,9 @@ static bool intel_checkaddr(uint64_t status, uint64_t misc, int addrtype) return (addrtype == MC_ADDR_PHYSICAL); } -static void intel_srar_dhandler( - struct mca_binfo *binfo, - enum mce_result *result, - const struct cpu_user_regs *regs) +static void cf_check intel_srar_dhandler( + struct mca_binfo *binfo, enum mce_result *result, + const struct cpu_user_regs *regs) { uint64_t status = binfo->mib->mc_status; @@ -306,15 +306,14 @@ static void intel_srar_dhandler( } } -static bool intel_srao_check(uint64_t status) +static bool cf_check intel_srao_check(uint64_t status) { return (intel_check_mce_type(status) == intel_mce_ucr_srao); } -static void intel_srao_dhandler( - struct mca_binfo *binfo, - enum mce_result *result, - const struct cpu_user_regs *regs) +static void cf_check intel_srao_dhandler( + struct mca_binfo *binfo, enum mce_result *result, + const struct cpu_user_regs *regs) { uint64_t status = binfo->mib->mc_status; @@ -333,15 +332,14 @@ static void intel_srao_dhandler( } } -static bool intel_default_check(uint64_t status) +static bool cf_check intel_default_check(uint64_t status) { return true; } -static void intel_default_mce_dhandler( - struct mca_binfo *binfo, - enum mce_result *result, - const struct cpu_user_regs * regs) +static void cf_check intel_default_mce_dhandler( + struct mca_binfo *binfo, enum mce_result *result, + const struct cpu_user_regs * regs) { uint64_t status = binfo->mib->mc_status; enum intel_mce_type type; @@ -360,10 +358,9 @@ static const struct mca_error_handler intel_mce_dhandlers[] = { {intel_default_check, intel_default_mce_dhandler} }; -static void intel_default_mce_uhandler( - struct mca_binfo *binfo, - enum mce_result *result, - const struct cpu_user_regs *regs) +static void cf_check intel_default_mce_uhandler( + struct mca_binfo *binfo, enum mce_result *result, + const struct cpu_user_regs *regs) { uint64_t status = binfo->mib->mc_status; enum intel_mce_type type; @@ -396,7 +393,7 @@ static const struct mca_error_handler intel_mce_uhandlers[] = { * 3) ser_support = 1, SRAO, UC = 1, S = 1, AR = 0, [EN = 1] */ -static bool intel_need_clearbank_scan(enum mca_source who, u64 status) +static bool cf_check intel_need_clearbank_scan(enum mca_source who, u64 status) { if ( who == MCA_CMCI_HANDLER ) { @@ -453,7 +450,7 @@ static bool intel_need_clearbank_scan(enum mca_source who, u64 status) * 4) SRAO ser_support = 1, PCC = 0, S = 1, AR = 0, EN = 1 [UC = 1] * 5) UCNA ser_support = 1, OVER = 0, EN = 1, PCC = 0, S = 0, AR = 0, [UC = 1] */ -static bool intel_recoverable_scan(uint64_t status) +static bool cf_check intel_recoverable_scan(uint64_t status) { if ( !(status & MCi_STATUS_UC ) ) From patchwork Mon Feb 14 12:51:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745553 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D21D9C433FE for ; Mon, 14 Feb 2022 13:05:14 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271653.466279 (Exim 4.92) (envelope-from ) id 1nJb2P-0003Nw-UJ; Mon, 14 Feb 2022 13:05:05 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271653.466279; Mon, 14 Feb 2022 13:05:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2P-0003LQ-Ck; Mon, 14 Feb 2022 13:05:05 +0000 Received: by outflank-mailman (input) for mailman id 271653; Mon, 14 Feb 2022 13:05:03 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2N-00023t-C1 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:03 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id b699f3dd-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:00 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b699f3dd-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843901; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Vmf+grYE8bKtbE+rcnkJIH/kZo6uatD1f3oilVOV1Mo=; b=dLJwZ9ACtIntA7zQuw9g97zLzcXOs8P1itm25ptg//lLPEE8Cru6NLZh MJA7ASW2pQ8L9gAt2dsAX3BLhKZwrv11JBSwneMPnqEbt9NSbooawiJBM iTQH4Yl6r+MHh12nvMW7XXJg39M0kAjrZQHkVC6Ifj1URpqCdPNz0mDLY g=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: H91983OJySle/XwUPf9C7ClRnyUt40HvBbr2gDnpRR7yQONQvm90NE4gklDMhWGB0bZEeUOBBI P9PXFmw5C2dhAChTv2st6OJ0gAL9nt1zq6RRV/CJW/Oe+5pCgK+qEjj5EhuIM0vD2gOpbRNzzH bwoJ+gIIsAXKPwrHlYDjJAQBFbCt6KeVJO2fqeTINuU+WOLrgaCHMUGjGzchIYPKifidrH+VC5 X+Go0idnmudpB804gW1e0E7fQwYTASSOoMgMNeED6UEYdbZCjFsW3zWQxBEFY26vCJ3z/bKudP waVTpe3ebicex2b7Oy7eFN5d X-SBRS: 5.1 X-MesageID: 63592493 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Dmg5K6jnt8cAp/aTP24tSKe0X161eRcKZh0ujC45NGQN5FlHY01je htvD2uEb/uPZTP9KI0kPtnj908DsJTRm9NgGgo5/CA2Riwb9cadCdqndUqhZCn6wu8v7a5EA 2fyTvGacajYm1eF/k/F3oAMKRCQ7InQLlbGILes1htZGEk0GE/NtTo5w7Rj2tQx3YDga++wk YiaT/P3aQfNNwFcagr424rbwP+4lK2v0N+wlgVWicFj5DcypVFMZH4sDfjZw0/DaptVBoaHq 9Prl9lVyI97EyAFUbtJmp6jGqEDryW70QKm0hK6UID66vROS7BbPg/W+5PwZG8O4whlkeydx /1NiYK5cywFApbundkgbTR7KTlkBLxJreqvzXiX6aR/zmXDenrohf5vEFs3LcsT/eMf7WNmr KJCbmpXN1ba2rzwkOnTpupE36zPKOHCOo8Ft24m5jbeFfs8GrjIQrnQ5M8e1zA17ixLNaiFO ptDNWs0BPjGSxNUIAw1AY86p8brikL4XWRVsAvLjpNitgA/yyQuieOwYbI5YOeiVchT20qVu G/C12D4GQ0BcsySzyKf9XChjfOJmjn0ML/+D5XhqKQs2gfKgDVOVltGDjNXvMVVlGa+Z8xWE Wc4xhEMqJUPymGIdMHnZgy39SvsUgEnZ/JcFOgz6Qeow6XS4hqECmVscgOteODKp+dtG2V0i wbhc8fBQGU27ebLES71GqK88GvqURX5O1PucsPtoeEtx9D46L8+gRvUJjqIOP7k14alcd0cL t3jkcTfu1nxpZNRv0lY1Qqe695JmnQuZlRrjjg7pkr/smtEiHeNPuREE2Tz4/daN5q+RVKcp nUCkMX2xLlQUc3SxHzQHb1UR+vBCxO53Nr02wAHInXc3271py7LkX54vFmS23uFwu5bIGS0M Sc/SCta5YNJPWvCUEOES9nZNije9oC5TY6NfqmNNrJmO8EtHCfarHAGTRPBhAjFzRlz+ZzTz L/GKK5A+15BUv85pNd3Ls9AuYIWKtcWmz+CG8Cjl07/uVdcDVbMIYo43JK1RrhRxMu5TM/9q oY32xKix0oNXevgTDPQ9IJPf1kGIWJiXcL9qtBNd/7FKQ1jQTlzB/jUyLInWopkg6UKybuYo iDjAhdVmAjlmHnKCQSWcXQ/Ornhaoly8CAgNis2MFf2h3V6OdSz7L0SfoccdKU88LAx1uZ9S vQIIp3SAvlGRjnd1S4aaJ3x8N5reBix3FrcNCu5ejkvOZVnQlWRqNPjewLu8ggIDza26pRi8 +HxiFuDTMNaFQp4DcvQZPa+9H+LvCAQyLBoQk/FAthPY0GwooJkHDP8060sKMYWJBSdmjbDj 1SKAQ0VrPXmqpMu9IWbnriNqoqkHrcsHkdeGGWHv7+6OTODozimyI5EFu2JYSrcRCX//6D7P bdZyPT1MfsmmldWstUjT+Y3nPxmv9a/9aVHyglEHWnQawX5A7xtFXCKwM1Tu/Af3bReowa3B hqC99Qy1W9l4y85/Ir9/DYYU9k= IronPort-HdrOrdr: A9a23:9wn6f69jvBhkISSWOupuk+DcI+orL9Y04lQ7vn2YSXRuE/Bw9v re5MjzuiWE6wr5NEtOpTnEAtjlfZq+z+8N3WByB8bBYOCOggLBR+sOgbcKgQeQfBEWntQts5 uIGJIfNDSfNzZHZL7BkWyFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592493" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 44/70] x86/pmu: CFI hardening Date: Mon, 14 Feb 2022 12:51:01 +0000 Message-ID: <20220214125127.17985-45-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/vpmu_amd.c | 16 ++++++++-------- xen/arch/x86/cpu/vpmu_intel.c | 16 ++++++++-------- xen/arch/x86/oprofile/op_model_athlon.c | 16 ++++++++-------- xen/arch/x86/oprofile/op_model_p4.c | 14 +++++++------- xen/arch/x86/oprofile/op_model_ppro.c | 26 ++++++++++++++------------ 5 files changed, 45 insertions(+), 43 deletions(-) diff --git a/xen/arch/x86/cpu/vpmu_amd.c b/xen/arch/x86/cpu/vpmu_amd.c index 25ad4ecf48a4..5963ce90150a 100644 --- a/xen/arch/x86/cpu/vpmu_amd.c +++ b/xen/arch/x86/cpu/vpmu_amd.c @@ -186,7 +186,7 @@ static void amd_vpmu_unset_msr_bitmap(struct vcpu *v) msr_bitmap_off(vpmu); } -static int amd_vpmu_do_interrupt(struct cpu_user_regs *regs) +static int cf_check amd_vpmu_do_interrupt(struct cpu_user_regs *regs) { return 1; } @@ -206,7 +206,7 @@ static inline void context_load(struct vcpu *v) } } -static int amd_vpmu_load(struct vcpu *v, bool_t from_guest) +static int cf_check amd_vpmu_load(struct vcpu *v, bool from_guest) { struct vpmu_struct *vpmu = vcpu_vpmu(v); struct xen_pmu_amd_ctxt *ctxt; @@ -280,7 +280,7 @@ static inline void context_save(struct vcpu *v) rdmsrl(counters[i], counter_regs[i]); } -static int amd_vpmu_save(struct vcpu *v, bool_t to_guest) +static int cf_check amd_vpmu_save(struct vcpu *v, bool to_guest) { struct vpmu_struct *vpmu = vcpu_vpmu(v); unsigned int i; @@ -348,7 +348,7 @@ static void context_update(unsigned int msr, u64 msr_content) } } -static int amd_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) +static int cf_check amd_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) { struct vcpu *v = current; struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -404,7 +404,7 @@ static int amd_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) return 0; } -static int amd_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) +static int cf_check amd_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) { struct vcpu *v = current; struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -422,7 +422,7 @@ static int amd_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) return 0; } -static void amd_vpmu_destroy(struct vcpu *v) +static void cf_check amd_vpmu_destroy(struct vcpu *v) { struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -440,7 +440,7 @@ static void amd_vpmu_destroy(struct vcpu *v) } /* VPMU part of the 'q' keyhandler */ -static void amd_vpmu_dump(const struct vcpu *v) +static void cf_check amd_vpmu_dump(const struct vcpu *v) { const struct vpmu_struct *vpmu = vcpu_vpmu(v); const struct xen_pmu_amd_ctxt *ctxt = vpmu->context; @@ -480,7 +480,7 @@ static void amd_vpmu_dump(const struct vcpu *v) } } -static int svm_vpmu_initialise(struct vcpu *v) +static int cf_check svm_vpmu_initialise(struct vcpu *v) { struct xen_pmu_amd_ctxt *ctxt; struct vpmu_struct *vpmu = vcpu_vpmu(v); diff --git a/xen/arch/x86/cpu/vpmu_intel.c b/xen/arch/x86/cpu/vpmu_intel.c index 22dd4469d920..48b81ab6f018 100644 --- a/xen/arch/x86/cpu/vpmu_intel.c +++ b/xen/arch/x86/cpu/vpmu_intel.c @@ -288,7 +288,7 @@ static inline void __core2_vpmu_save(struct vcpu *v) rdmsrl(MSR_CORE_PERF_GLOBAL_STATUS, core2_vpmu_cxt->global_status); } -static int core2_vpmu_save(struct vcpu *v, bool_t to_guest) +static int cf_check core2_vpmu_save(struct vcpu *v, bool to_guest) { struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -407,7 +407,7 @@ static int core2_vpmu_verify(struct vcpu *v) return 0; } -static int core2_vpmu_load(struct vcpu *v, bool_t from_guest) +static int cf_check core2_vpmu_load(struct vcpu *v, bool from_guest) { struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -522,7 +522,7 @@ static int core2_vpmu_msr_common_check(u32 msr_index, int *type, int *index) return 1; } -static int core2_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) +static int cf_check core2_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) { int i, tmp; int type = -1, index = -1; @@ -690,7 +690,7 @@ static int core2_vpmu_do_wrmsr(unsigned int msr, uint64_t msr_content) return 0; } -static int core2_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) +static int cf_check core2_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) { int type = -1, index = -1; struct vcpu *v = current; @@ -730,7 +730,7 @@ static int core2_vpmu_do_rdmsr(unsigned int msr, uint64_t *msr_content) } /* Dump vpmu info on console, called in the context of keyhandler 'q'. */ -static void core2_vpmu_dump(const struct vcpu *v) +static void cf_check core2_vpmu_dump(const struct vcpu *v) { const struct vpmu_struct *vpmu = vcpu_vpmu(v); unsigned int i; @@ -775,7 +775,7 @@ static void core2_vpmu_dump(const struct vcpu *v) } } -static int core2_vpmu_do_interrupt(struct cpu_user_regs *regs) +static int cf_check core2_vpmu_do_interrupt(struct cpu_user_regs *regs) { struct vcpu *v = current; u64 msr_content; @@ -802,7 +802,7 @@ static int core2_vpmu_do_interrupt(struct cpu_user_regs *regs) return 1; } -static void core2_vpmu_destroy(struct vcpu *v) +static void cf_check core2_vpmu_destroy(struct vcpu *v) { struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -816,7 +816,7 @@ static void core2_vpmu_destroy(struct vcpu *v) vpmu_clear(vpmu); } -static int vmx_vpmu_initialise(struct vcpu *v) +static int cf_check vmx_vpmu_initialise(struct vcpu *v) { struct vpmu_struct *vpmu = vcpu_vpmu(v); u64 msr_content; diff --git a/xen/arch/x86/oprofile/op_model_athlon.c b/xen/arch/x86/oprofile/op_model_athlon.c index 2177f02946e2..7bc5853a6c23 100644 --- a/xen/arch/x86/oprofile/op_model_athlon.c +++ b/xen/arch/x86/oprofile/op_model_athlon.c @@ -164,7 +164,7 @@ static inline u64 op_amd_randomize_ibs_op(u64 val) return val; } -static void athlon_fill_in_addresses(struct op_msrs * const msrs) +static void cf_check athlon_fill_in_addresses(struct op_msrs * const msrs) { msrs->counters[0].addr = MSR_K7_PERFCTR0; msrs->counters[1].addr = MSR_K7_PERFCTR1; @@ -177,7 +177,7 @@ static void athlon_fill_in_addresses(struct op_msrs * const msrs) msrs->controls[3].addr = MSR_K7_EVNTSEL3; } -static void fam15h_fill_in_addresses(struct op_msrs * const msrs) +static void cf_check fam15h_fill_in_addresses(struct op_msrs * const msrs) { msrs->counters[0].addr = MSR_AMD_FAM15H_PERFCTR0; msrs->counters[1].addr = MSR_AMD_FAM15H_PERFCTR1; @@ -194,7 +194,7 @@ static void fam15h_fill_in_addresses(struct op_msrs * const msrs) msrs->controls[5].addr = MSR_AMD_FAM15H_EVNTSEL5; } -static void athlon_setup_ctrs(struct op_msrs const * const msrs) +static void cf_check athlon_setup_ctrs(struct op_msrs const * const msrs) { uint64_t msr_content; int i; @@ -308,9 +308,9 @@ static inline int handle_ibs(int mode, struct cpu_user_regs const * const regs) return 1; } -static int athlon_check_ctrs(unsigned int const cpu, - struct op_msrs const * const msrs, - struct cpu_user_regs const * const regs) +static int cf_check athlon_check_ctrs( + unsigned int const cpu, struct op_msrs const * const msrs, + struct cpu_user_regs const * const regs) { uint64_t msr_content; @@ -386,7 +386,7 @@ static inline void start_ibs(void) } } -static void athlon_start(struct op_msrs const * const msrs) +static void cf_check athlon_start(struct op_msrs const * const msrs) { uint64_t msr_content; int i; @@ -415,7 +415,7 @@ static void stop_ibs(void) wrmsrl(MSR_AMD64_IBSOPCTL, 0); } -static void athlon_stop(struct op_msrs const * const msrs) +static void cf_check athlon_stop(struct op_msrs const * const msrs) { uint64_t msr_content; int i; diff --git a/xen/arch/x86/oprofile/op_model_p4.c b/xen/arch/x86/oprofile/op_model_p4.c index b08ba53cbd39..d047258644db 100644 --- a/xen/arch/x86/oprofile/op_model_p4.c +++ b/xen/arch/x86/oprofile/op_model_p4.c @@ -390,7 +390,7 @@ static unsigned int get_stagger(void) static unsigned long reset_value[NUM_COUNTERS_NON_HT]; -static void p4_fill_in_addresses(struct op_msrs * const msrs) +static void cf_check p4_fill_in_addresses(struct op_msrs * const msrs) { unsigned int i; unsigned int addr, stag; @@ -530,7 +530,7 @@ static void pmc_setup_one_p4_counter(unsigned int ctr) } -static void p4_setup_ctrs(struct op_msrs const * const msrs) +static void cf_check p4_setup_ctrs(struct op_msrs const * const msrs) { unsigned int i; uint64_t msr_content; @@ -609,9 +609,9 @@ static void p4_setup_ctrs(struct op_msrs const * const msrs) } } -static int p4_check_ctrs(unsigned int const cpu, - struct op_msrs const * const msrs, - struct cpu_user_regs const * const regs) +static int cf_check p4_check_ctrs( + unsigned int const cpu, struct op_msrs const * const msrs, + struct cpu_user_regs const * const regs) { unsigned long ctr, stag, real; uint64_t msr_content; @@ -665,7 +665,7 @@ static int p4_check_ctrs(unsigned int const cpu, } -static void p4_start(struct op_msrs const * const msrs) +static void cf_check p4_start(struct op_msrs const * const msrs) { unsigned int stag; uint64_t msr_content; @@ -683,7 +683,7 @@ static void p4_start(struct op_msrs const * const msrs) } -static void p4_stop(struct op_msrs const * const msrs) +static void cf_check p4_stop(struct op_msrs const * const msrs) { unsigned int stag; uint64_t msr_content; diff --git a/xen/arch/x86/oprofile/op_model_ppro.c b/xen/arch/x86/oprofile/op_model_ppro.c index 72c504a10216..8d7e13ea8777 100644 --- a/xen/arch/x86/oprofile/op_model_ppro.c +++ b/xen/arch/x86/oprofile/op_model_ppro.c @@ -63,7 +63,7 @@ static int counter_width = 32; static unsigned long reset_value[OP_MAX_COUNTER]; int ppro_has_global_ctrl = 0; -static void ppro_fill_in_addresses(struct op_msrs * const msrs) +static void cf_check ppro_fill_in_addresses(struct op_msrs * const msrs) { int i; @@ -74,7 +74,7 @@ static void ppro_fill_in_addresses(struct op_msrs * const msrs) } -static void ppro_setup_ctrs(struct op_msrs const * const msrs) +static void cf_check ppro_setup_ctrs(struct op_msrs const * const msrs) { uint64_t msr_content; int i; @@ -128,9 +128,9 @@ static void ppro_setup_ctrs(struct op_msrs const * const msrs) } } -static int ppro_check_ctrs(unsigned int const cpu, - struct op_msrs const * const msrs, - struct cpu_user_regs const * const regs) +static int cf_check ppro_check_ctrs( + unsigned int const cpu, struct op_msrs const * const msrs, + struct cpu_user_regs const * const regs) { u64 val; int i; @@ -170,7 +170,7 @@ static int ppro_check_ctrs(unsigned int const cpu, } -static void ppro_start(struct op_msrs const * const msrs) +static void cf_check ppro_start(struct op_msrs const * const msrs) { uint64_t msr_content; int i; @@ -190,7 +190,7 @@ static void ppro_start(struct op_msrs const * const msrs) } -static void ppro_stop(struct op_msrs const * const msrs) +static void cf_check ppro_stop(struct op_msrs const * const msrs) { uint64_t msr_content; int i; @@ -206,7 +206,7 @@ static void ppro_stop(struct op_msrs const * const msrs) wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0x0ULL); } -static int ppro_is_arch_pmu_msr(u64 msr_index, int *type, int *index) +static int cf_check ppro_is_arch_pmu_msr(u64 msr_index, int *type, int *index) { if ( (msr_index >= MSR_IA32_PERFCTR0) && (msr_index < (MSR_IA32_PERFCTR0 + num_counters)) ) @@ -226,7 +226,7 @@ static int ppro_is_arch_pmu_msr(u64 msr_index, int *type, int *index) return 0; } -static int ppro_allocate_msr(struct vcpu *v) +static int cf_check ppro_allocate_msr(struct vcpu *v) { struct vpmu_struct *vpmu = vcpu_vpmu(v); struct arch_msr_pair *msr_content; @@ -245,7 +245,7 @@ static int ppro_allocate_msr(struct vcpu *v) return 0; } -static void ppro_free_msr(struct vcpu *v) +static void cf_check ppro_free_msr(struct vcpu *v) { struct vpmu_struct *vpmu = vcpu_vpmu(v); @@ -255,7 +255,8 @@ static void ppro_free_msr(struct vcpu *v) vpmu_reset(vpmu, VPMU_PASSIVE_DOMAIN_ALLOCATED); } -static void ppro_load_msr(struct vcpu *v, int type, int index, u64 *msr_content) +static void cf_check ppro_load_msr( + struct vcpu *v, int type, int index, u64 *msr_content) { struct arch_msr_pair *msrs = vcpu_vpmu(v)->context; switch ( type ) @@ -269,7 +270,8 @@ static void ppro_load_msr(struct vcpu *v, int type, int index, u64 *msr_content) } } -static void ppro_save_msr(struct vcpu *v, int type, int index, u64 msr_content) +static void cf_check ppro_save_msr( + struct vcpu *v, int type, int index, u64 msr_content) { struct arch_msr_pair *msrs = vcpu_vpmu(v)->context; From patchwork Mon Feb 14 12:51:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745548 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1AF47C433F5 for ; Mon, 14 Feb 2022 13:05:05 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271647.466236 (Exim 4.92) (envelope-from ) id 1nJb2G-0001dZ-L8; Mon, 14 Feb 2022 13:04:56 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271647.466236; Mon, 14 Feb 2022 13:04:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2G-0001d3-Fh; Mon, 14 Feb 2022 13:04:56 +0000 Received: by outflank-mailman (input) for mailman id 271647; Mon, 14 Feb 2022 13:04:54 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2E-0008IH-EI for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:54 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id b253348c-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:53 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b253348c-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843893; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=ipAxHYrAKEzK9SFgAkUSAhz6N1h8OI0W6ZrwtK0U1gA=; b=P/DyMK0yomKaNBSVSgfoXEmDe9eUlGZu91PE+aKcc78M15aIAsqQDBA/ DlbUifezqwFpzAPX8/ek2DeM2PCPTjy1cvUfi2lGspnhdLIBOAvdMuujL pir86Gz2ZBZnepTpgVF4J3YdKFjW2ZpLa52u7qqACDEa8BR7k8AME43Y4 0=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: spdufPN7QL5caJcmVWTXNMp5zXVwJqXGVqJ8c49c8TGoa49DhSj9cthVBz2xX32eXHySfnrz3h 8RbwRuDOI6g/4sXW7ADlK5rW4F1/N77aJOmQtKUgEe30Lprf6UMQODg/E/qb5BgffjialJrY7J hLV+9dkO2+iMpGnqOvODt2WsIcpklG/TwJrkO5YeZ3O1VNyOiP0AmK7QLyvInylX762a3CDeL3 BtzBMrYI4xOP04RfM2mcM/9vDtLqabCKNw9PNbH04IhSo2BxgFpkL+yPI79Iu3qOyzwCmoP6Ya RSENZGY+W2QttGzQ38y4sf5K X-SBRS: 5.1 X-MesageID: 66374750 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:9VU2t6v7QXDun761HSGkfdk2dOfnVElZMUV32f8akzHdYApBsoF/q tZmKTuAPaqCYWXyedknOtm/pEsFusDdmNdhHARk+3owHyMb+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Npl6MObaT5yAqHw27oef0hDSChDDPd80eqSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AO ZFGNWUyNHwsZTVxOwYPFLISs9v53HelWhlk81Ks/Kk4tj27IAtZj+G2bYu9lsaxbdVYmAOUq 3zL+0z9AwoGL5qPxDyd6HWui+TT2yThV+ov+KaQr6AwxgfJnypKVUNQBQDTTeSFZlCWBo10C 3VPxiYS7vYx2B2wFdDAbkeCiSvR1vIDYOZ4H+o/4QCL76Pb5QeFG2QJJgJ8hMwaWNweHmJzi ALQ9z/9LXk26eDOFyrBnluBhW7qYUAowXk+iTjopOfvy/3qu8kNgx3GVb6P+4bl34SuSVkcL 91nxRXSZon/b+ZWjc1XHnid2lpAQ6QlqSZvuG3qspqNtF8RWWJcT9XABaLnxfhBNp2FaVKKo WIJncOThMhXU83Ry3zdHbhVRerzjxpgDNE7qQQxd6TNChz3oyLzFWyuyG0WyLhV3jYsJmayP R67VfJ5755PJnq6BZKbkKrqY/nGOZPITIy/PtiNN4ImSsEoKGevoXE/DWbNjjuFuBV9zskC1 WKzLJ/E4YAyUv88klJbho41jNcW+8zJ7T2PG86rlUn7uVdcDVbMIYo43JK1RrhRxMu5TM/9q r6z7uOGlEdSVvPQeC7S/dJBJFwGNyFjV5v3t9ZWZqiIJQ8/QDMtDPrYwLUAfY15nvsKyreUr y/lAkIImkDigXDnKBmRbiwxYr3YQpsi/2kwOjYhPAj01iF7M5qv9qoWa7A+YaIjqL541fdxQ vRcI5eAD/1DRy7p4TMYaZWh/oVueA7y3VCFPja/YSh5dJllHlSb9tjhdwrp1S8PEivo6pdu/ +z+jlvWGMNRSR5jAcDabOOU42mw5XVNyvhvW0boI8VIfBm++oZdNCGs3OQ8JNsBKEufy2LCh RqWGxoRucLEv5QxrIvSnamBooqkT7l+E05dEzWJ5Lq6L3CHrG+qwIsGW+eUZzHNEmjz/fz6N +lSyvj9NtwBnUpL7NUgQ+o6k/pm6ou9vaJewyRlAG7PPgaiBb5XK3Wb2dVC6/9WzbhDtArqA k+C97G241lS1B8JxLLJGDcYUw== IronPort-HdrOrdr: A9a23:fRCDYa8SRoZtE6D/+hBuk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374750" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 45/70] x86/cpu: CFI hardening Date: Mon, 14 Feb 2022 12:51:02 +0000 Message-ID: <20220214125127.17985-46-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/cpu/amd.c | 6 +++--- xen/arch/x86/cpu/centaur.c | 2 +- xen/arch/x86/cpu/common.c | 2 +- xen/arch/x86/cpu/cpu.h | 2 +- xen/arch/x86/cpu/hygon.c | 2 +- xen/arch/x86/cpu/intel.c | 6 +++--- xen/arch/x86/cpu/shanghai.c | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c index 2d18223f20ef..4999f8be2b11 100644 --- a/xen/arch/x86/cpu/amd.c +++ b/xen/arch/x86/cpu/amd.c @@ -208,7 +208,7 @@ static void __init noinline probe_masking_msrs(void) * parameter of NULL is used to context switch to the default host state (by * the cpu bringup-code, crash path, etc). */ -static void amd_ctxt_switch_masking(const struct vcpu *next) +static void cf_check amd_ctxt_switch_masking(const struct vcpu *next) { struct cpuidmasks *these_masks = &this_cpu(cpuidmasks); const struct domain *nextd = next ? next->domain : NULL; @@ -634,7 +634,7 @@ void amd_log_freq(const struct cpuinfo_x86 *c) #undef FREQ } -void early_init_amd(struct cpuinfo_x86 *c) +void cf_check early_init_amd(struct cpuinfo_x86 *c) { if (c == &boot_cpu_data) amd_init_levelling(); @@ -744,7 +744,7 @@ void __init detect_zen2_null_seg_behaviour(void) } -static void init_amd(struct cpuinfo_x86 *c) +static void cf_check init_amd(struct cpuinfo_x86 *c) { u32 l, h; diff --git a/xen/arch/x86/cpu/centaur.c b/xen/arch/x86/cpu/centaur.c index 34a5bfcaeef2..eac49d78db62 100644 --- a/xen/arch/x86/cpu/centaur.c +++ b/xen/arch/x86/cpu/centaur.c @@ -48,7 +48,7 @@ static void init_c3(struct cpuinfo_x86 *c) display_cacheinfo(c); } -static void init_centaur(struct cpuinfo_x86 *c) +static void cf_check init_centaur(struct cpuinfo_x86 *c) { if (c->x86 == 6) init_c3(c); diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index c4f07f2d1da4..6b674bf15e8b 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -104,7 +104,7 @@ bool __init is_forced_cpu_cap(unsigned int cap) return test_bit(cap, forced_caps); } -static void default_init(struct cpuinfo_x86 * c) +static void cf_check default_init(struct cpuinfo_x86 * c) { /* Not much we can do here... */ /* Check if at least it has cpuid */ diff --git a/xen/arch/x86/cpu/cpu.h b/xen/arch/x86/cpu/cpu.h index b593bd85f04f..a228087f9157 100644 --- a/xen/arch/x86/cpu/cpu.h +++ b/xen/arch/x86/cpu/cpu.h @@ -18,7 +18,7 @@ extern void display_cacheinfo(struct cpuinfo_x86 *c); extern void detect_ht(struct cpuinfo_x86 *c); extern bool detect_extended_topology(struct cpuinfo_x86 *c); -void early_init_amd(struct cpuinfo_x86 *c); +void cf_check early_init_amd(struct cpuinfo_x86 *c); void amd_log_freq(const struct cpuinfo_x86 *c); void amd_init_lfence(struct cpuinfo_x86 *c); void amd_init_ssbd(const struct cpuinfo_x86 *c); diff --git a/xen/arch/x86/cpu/hygon.c b/xen/arch/x86/cpu/hygon.c index cdc94130dd2e..3c8516e014c3 100644 --- a/xen/arch/x86/cpu/hygon.c +++ b/xen/arch/x86/cpu/hygon.c @@ -28,7 +28,7 @@ static void hygon_get_topology(struct cpuinfo_x86 *c) c->phys_proc_id, c->cpu_core_id); } -static void init_hygon(struct cpuinfo_x86 *c) +static void cf_check init_hygon(struct cpuinfo_x86 *c) { unsigned long long value; diff --git a/xen/arch/x86/cpu/intel.c b/xen/arch/x86/cpu/intel.c index 06b0e552cc8f..ff7c02223687 100644 --- a/xen/arch/x86/cpu/intel.c +++ b/xen/arch/x86/cpu/intel.c @@ -176,7 +176,7 @@ static void __init probe_masking_msrs(void) * parameter of NULL is used to context switch to the default host state (by * the cpu bringup-code, crash path, etc). */ -static void intel_ctxt_switch_masking(const struct vcpu *next) +static void cf_check intel_ctxt_switch_masking(const struct vcpu *next) { struct cpuidmasks *these_masks = &this_cpu(cpuidmasks); const struct domain *nextd = next ? next->domain : NULL; @@ -286,7 +286,7 @@ static void __init noinline intel_init_levelling(void) ctxt_switch_masking = intel_ctxt_switch_masking; } -static void early_init_intel(struct cpuinfo_x86 *c) +static void cf_check early_init_intel(struct cpuinfo_x86 *c) { u64 misc_enable, disable; @@ -500,7 +500,7 @@ static void intel_log_freq(const struct cpuinfo_x86 *c) } } -static void init_intel(struct cpuinfo_x86 *c) +static void cf_check init_intel(struct cpuinfo_x86 *c) { /* Detect the extended topology information if available */ detect_extended_topology(c); diff --git a/xen/arch/x86/cpu/shanghai.c b/xen/arch/x86/cpu/shanghai.c index 08a81f0f0c8e..95ae544f8c54 100644 --- a/xen/arch/x86/cpu/shanghai.c +++ b/xen/arch/x86/cpu/shanghai.c @@ -3,7 +3,7 @@ #include #include "cpu.h" -static void init_shanghai(struct cpuinfo_x86 *c) +static void cf_check init_shanghai(struct cpuinfo_x86 *c) { if ( cpu_has(c, X86_FEATURE_ITSC) ) { From patchwork Mon Feb 14 12:51:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745564 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D77BDC433EF for ; Mon, 14 Feb 2022 13:06:30 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271715.466387 (Exim 4.92) (envelope-from ) id 1nJb3d-0000eN-MH; Mon, 14 Feb 2022 13:06:21 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271715.466387; Mon, 14 Feb 2022 13:06:21 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3d-0000bE-5U; Mon, 14 Feb 2022 13:06:21 +0000 Received: by outflank-mailman (input) for mailman id 271715; Mon, 14 Feb 2022 13:06:19 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2W-0008IH-WA for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:13 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id bc264d17-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:09 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: bc264d17-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843909; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=W97kFRgj/MifUbIaqTE03bRGTNYxneRqJuik8bYXmus=; b=Thd1PFc2MnRcHBfQMxNvSPomzPfvLUJHOZ4F39NrscNwPRdQUdWFMtlt wWxZrUHtTawOJjhQ8u3QGynC43rjZDcCkJA0rUFrcahN7z8f2a879h22t SP+dlt/2rSlgNw0gvqEExKPGpjjY/hmDQs1KVBVk+NRAkAMg5BiOnpGUj Q=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 0kQ1sX3mZvJKZSOECf8Dl6WPt+Bb5qhEtGkfZ7gae1V/6iBUBIwWfi0MvudW4E8bzxH581D6BD 9EOwQ4DBb5fuK+/kGBnRdybZ4xg/daZ4sni1Mq1kcXVdW3XNu2xC5EYA0AQqnRTMyWEhlbWl/y 3baz1A/+EfN7+tFWEc/2stWrSppaTdZWIigq4PSG64UZ7hcyc+RcAjXPZFnVyQxg9RJZomyBjk tUcIj0AmlZRu/f0GrE0I0KlIIOWIKuo343IWJtlH0hTrWQxBU06Pg6J9wrwXvqtj+Gtw4b6GrK iFfIr+LQmWJbCm3N2D0ZJZR7 X-SBRS: 5.1 X-MesageID: 66374839 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:r8h/KKJH11eaxoWtFE+Rz5IlxSXFcZb7ZxGr2PjKsXjdYENS1zwEx mIdXjzVP63cY2CnLtl2aYzj9E9UuJLdztZmQQZlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB2rlfkoz uhhjaC3QDssEJ/KlegzVklhRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Glu3Z8STa2PD yYfQWFTXUvFcloRBgpUMLYywfXrgEnPLBQN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3OZq9DgjHOSY+5YI nAR1BgooKQc8RySG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspuNt2uVnrKNaY2y8kT85v1dNoufRVTpl CFax5TBvLBTUMnUz3blrAAx8FaBvajtDdEhqQQ3Q8lJG8qFpxZPgry8EBkhfRw0Y67oiBfiY VPJuBM52XOgFCDCUEODWKroU55C5fG5TbzND6mIBvITMskZXFLWp0lGOB/Pt10BZWBxyMnTz 7/AKp3yZZvbYIw6pAeLqxA1j+N6mHBmnTmLLX05pjz+uYejiLeuYe9tGDOzgioRtctoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:IlRx5KuOjcTHE5hSfMXq4eTl7skDdNV00zEX/kB9WHVpmszxra 6TdZUgpGbJYVkqOE3I9ertBEDEewK4yXcX2/h2AV7BZniEhILAFugLhuGO/9SjIVybygc079 YGT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374839" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 46/70] x86/guest: CFI hardening Date: Mon, 14 Feb 2022 12:51:03 +0000 Message-ID: <20220214125127.17985-47-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/guest/hyperv/hyperv.c | 10 +++++----- xen/arch/x86/guest/xen/xen.c | 11 ++++++----- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/xen/arch/x86/guest/hyperv/hyperv.c b/xen/arch/x86/guest/hyperv/hyperv.c index 84221b751453..b101ba3080b4 100644 --- a/xen/arch/x86/guest/hyperv/hyperv.c +++ b/xen/arch/x86/guest/hyperv/hyperv.c @@ -175,7 +175,7 @@ static int setup_vp_assist(void) return 0; } -static void __init setup(void) +static void __init cf_check setup(void) { ASM_CONSTANT(HV_HCALL_PAGE, __fix_x_to_virt(FIX_X_HYPERV_HCALL)); @@ -188,7 +188,7 @@ static void __init setup(void) panic("VP assist page setup failed\n"); } -static int ap_setup(void) +static int cf_check ap_setup(void) { int rc; @@ -199,7 +199,7 @@ static int ap_setup(void) return setup_vp_assist(); } -static void __init e820_fixup(struct e820map *e820) +static void __init cf_check e820_fixup(struct e820map *e820) { uint64_t s = HV_HCALL_MFN << PAGE_SHIFT; @@ -207,8 +207,8 @@ static void __init e820_fixup(struct e820map *e820) panic("Unable to reserve Hyper-V hypercall range\n"); } -static int flush_tlb(const cpumask_t *mask, const void *va, - unsigned int flags) +static int cf_check flush_tlb( + const cpumask_t *mask, const void *va, unsigned int flags) { if ( !(ms_hyperv.hints & HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED) ) return -EOPNOTSUPP; diff --git a/xen/arch/x86/guest/xen/xen.c b/xen/arch/x86/guest/xen/xen.c index 17807cdea688..9c2defaa6621 100644 --- a/xen/arch/x86/guest/xen/xen.c +++ b/xen/arch/x86/guest/xen/xen.c @@ -237,7 +237,7 @@ static int init_evtchn(void) return rc; } -static void __init setup(void) +static void __init cf_check setup(void) { init_memmap(); @@ -265,7 +265,7 @@ static void __init setup(void) BUG_ON(init_evtchn()); } -static int ap_setup(void) +static int cf_check ap_setup(void) { set_vcpu_id(); @@ -295,7 +295,7 @@ static void cf_check ap_resume(void *unused) BUG_ON(init_evtchn()); } -static void resume(void) +static void cf_check resume(void) { /* Reset shared info page. */ map_shared_info(); @@ -318,13 +318,14 @@ static void resume(void) pv_console_init(); } -static void __init e820_fixup(struct e820map *e820) +static void __init cf_check e820_fixup(struct e820map *e820) { if ( pv_shim ) pv_shim_fixup_e820(e820); } -static int flush_tlb(const cpumask_t *mask, const void *va, unsigned int flags) +static int cf_check flush_tlb( + const cpumask_t *mask, const void *va, unsigned int flags) { return xen_hypercall_hvm_op(HVMOP_flush_tlbs, NULL); } From patchwork Mon Feb 14 12:51:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745607 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F3955C433EF for ; Mon, 14 Feb 2022 13:18:13 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272060.466879 (Exim 4.92) (envelope-from ) id 1nJbEw-0004Sp-Tr; Mon, 14 Feb 2022 13:18:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272060.466879; Mon, 14 Feb 2022 13:18:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEw-0004QW-Iq; Mon, 14 Feb 2022 13:18:02 +0000 Received: by outflank-mailman (input) for mailman id 272060; Mon, 14 Feb 2022 13:18:00 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4C-0008IH-Pz for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:56 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id fac7a096-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:55 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: fac7a096-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844015; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Iv+EtTL4QKtjYW+p8dU15rg4ZfKzEluz7BW9resL5q4=; b=MIOvzfYFH3hsCF5qV4kY75oZEsPT6fGIqSO/+yv/LTaLcslFABg07zGk OPSQfCGiQG97PSeqghe8oP9oYMjKP+rSz8JVLUkcvoM0pjsR4tpyn5m2S GPxsQJKz1dQ3H+9fjPQ9Xd4icrFYIGMdtlTVJIVmyzcXuYuoV0aUCaWHW I=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 4EaJ4De7JaIZS5ouqAPgjsMWIRv7Tz8YCPfBzzjGG2hm3vLKYI77/wBKvgkkAx7dgJiAceWgB4 gVXoeIrMqMwy/waTtI3ePBtcckKASl4bj7FBgTHgXNkXuJNFqP1HECQ1X3RxJQpHQjtpZ1Ebqq tqRbfVxQJgLCm1re2xDCF9YiD0oa2xbB6wnPxEj8ubeMlTupvxRBUx8asAbM1pMuj41IFWlcNt xw/Rs13y8AUdBqTZKtVqYacfatkAkosu9mhLVWlNGXneimFyn6OJkQXvmxf0PGBpmz9HThCEDm qeNqADK5gRAMTy2lSQX86kSw X-SBRS: 5.1 X-MesageID: 64554292 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:/xJMjavt6chmy3R15TnBwqDhN+fnVE9ZMUV32f8akzHdYApBsoF/q tZmKT3UbKzbYmqkKd92Ot/i9U0GvJXWyYIxGlRorn83FiwS+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Nplq7mybAIkOaP3kds/WDBzCQdQY6RJ5+qSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AO 5dENWA+NnwsZTUUGVMFU8g439v5xXOhaDZYg1y+poMOtj27IAtZj+G2bYu9lsaxbdVYmAOUq 3zL+0z9AwoGL5qPxDyd6HWui+TT2yThV+ov+KaQr6AwxgfJnypKVUNQBQDTTeSFZlCWRfddD kkZ/SQVpJcQ/2WAVP/TARS3vyvR1vIDYOZ4H+o/4QCL76Pb5QeFG2QJJgJ8hMwaWNweHmJzi ALQ9z/9LXk26eDOFyrBnluBhW7qYUAowXk+iTjopOfvy/3qu8kNgx3GVb6P+4bl34SuSVkcL 91nxRXSZon/b+ZWjc1XHnid2lpAQ6QlqSZvuG3qspqNtF8RWWJcT9XABaLnxfhBNp2FaVKKo WIJncOThMhXU83Ry3zdHbhVRerzjxpgDNE7qQQxd6TNChz3oyLzFWyuyG0WyLhV3jYsJmayP R67VfJ5755PJnq6BZKbkKrqY/nGOZPITIy/PtiNN4ImSsEoKGevoXE/DWbNjjuFuBV9zskC1 WKzLJ/E4YAyUv88klJbho41jNcW+8zJ7T2PG86rlUn7uVdcDVbMIYo43JK1RrhRxMu5TM/9q YwOXydT4xkAAuD4fAfN9osfcQIDIXQhXMikoM1LbO+TZAFhHTh5WfPWxLogfa1jnrhUybiUr i3sBBcAxQqtn2DDJCWLdmtnNOHlU6FgoC9pJicrJ1uphSQuON798KcFepIrVrA77+g/n+VsR vwIdpzYUPRCQzjK4RoHapz5oNAwfRinn1vWbSGkfCI+b9hrQAmQoo3oeQ7m9S8vCCurtJRh/ +38h12DGZdaHlZsFsfbbv6r3midh3lFlbIgRVbML/lSZF7orNpgJRvug6JlOMoLMxjCmGeXj l7EHRcCqODRiIYp692V17ucpoKkHuYiTEpXG27XseS/OSXApzfxxIZBVKCDfCzHVXOy86KnP L0Hw/b5OfwBvVBLr4sjTOo7kfNgv4Pi9+1A0wBpPHTXdFD6WLpvL06P0dRLqqAQlKRSvhG7W x7X99RXUVlT1BgJzLLFyNIZU9m+ IronPort-HdrOrdr: A9a23:k5pwYa0FptbJb7JbakFR2QqjBEgkLtp133Aq2lEZdPU0SKGlfg 6V/MjztCWE7Ar5PUtLpTnuAsa9qB/nm6KdgrNhWItKPjOW21dARbsKheffKlXbcBEWndQtt5 uIHZIeNDXxZ2IK8PoT4mODYqodKA/sytHWuQ/cpU0dMz2Dc8tbnmBE4p7wKDwMeOFBb6BJcq a01458iBeLX28YVci/DmltZZm4mzWa/KiWGCLvHnQcmXGzsQ8= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554292" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 47/70] x86/logdirty: CFI hardening Date: Mon, 14 Feb 2022 12:51:04 +0000 Message-ID: <20220214125127.17985-48-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/mm/hap/hap.c | 6 +++--- xen/arch/x86/mm/shadow/common.c | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c index de4b13565ab4..ed5112b00b63 100644 --- a/xen/arch/x86/mm/hap/hap.c +++ b/xen/arch/x86/mm/hap/hap.c @@ -180,7 +180,7 @@ int hap_track_dirty_vram(struct domain *d, * NB: Domain that having device assigned should not set log_global. Because * there is no way to track the memory updating from device. */ -static int hap_enable_log_dirty(struct domain *d, bool_t log_global) +static int cf_check hap_enable_log_dirty(struct domain *d, bool log_global) { struct p2m_domain *p2m = p2m_get_hostp2m(d); @@ -211,7 +211,7 @@ static int hap_enable_log_dirty(struct domain *d, bool_t log_global) return 0; } -static int hap_disable_log_dirty(struct domain *d) +static int cf_check hap_disable_log_dirty(struct domain *d) { paging_lock(d); d->arch.paging.mode &= ~PG_log_dirty; @@ -228,7 +228,7 @@ static int hap_disable_log_dirty(struct domain *d) return 0; } -static void hap_clean_dirty_bitmap(struct domain *d) +static void cf_check hap_clean_dirty_bitmap(struct domain *d) { /* * Switch to log-dirty mode, either by setting l1e entries of P2M table to diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index 83dedc8870aa..071a19adce82 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -40,9 +40,9 @@ DEFINE_PER_CPU(uint32_t,trace_shadow_path_flags); -static int sh_enable_log_dirty(struct domain *, bool log_global); -static int sh_disable_log_dirty(struct domain *); -static void sh_clean_dirty_bitmap(struct domain *); +static int cf_check sh_enable_log_dirty(struct domain *, bool log_global); +static int cf_check sh_disable_log_dirty(struct domain *); +static void cf_check sh_clean_dirty_bitmap(struct domain *); /* Set up the shadow-specific parts of a domain struct at start of day. * Called for every domain from arch_domain_create() */ @@ -3016,7 +3016,7 @@ static int shadow_test_disable(struct domain *d) /* Shadow specific code which is called in paging_log_dirty_enable(). * Return 0 if no problem found. */ -static int sh_enable_log_dirty(struct domain *d, bool log_global) +static int cf_check sh_enable_log_dirty(struct domain *d, bool log_global) { int ret; @@ -3044,7 +3044,7 @@ static int sh_enable_log_dirty(struct domain *d, bool log_global) } /* shadow specfic code which is called in paging_log_dirty_disable() */ -static int sh_disable_log_dirty(struct domain *d) +static int cf_check sh_disable_log_dirty(struct domain *d) { int ret; @@ -3058,7 +3058,7 @@ static int sh_disable_log_dirty(struct domain *d) /* This function is called when we CLEAN log dirty bitmap. See * paging_log_dirty_op() for details. */ -static void sh_clean_dirty_bitmap(struct domain *d) +static void cf_check sh_clean_dirty_bitmap(struct domain *d) { paging_lock(d); /* Need to revoke write access to the domain's pages again. From patchwork Mon Feb 14 12:51:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745550 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 963BFC433EF for ; Mon, 14 Feb 2022 13:05:05 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271646.466225 (Exim 4.92) (envelope-from ) id 1nJb2F-0001LL-5C; Mon, 14 Feb 2022 13:04:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271646.466225; Mon, 14 Feb 2022 13:04:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2F-0001L9-1C; Mon, 14 Feb 2022 13:04:55 +0000 Received: by outflank-mailman (input) for mailman id 271646; Mon, 14 Feb 2022 13:04:53 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2D-0008IH-7c for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:53 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id b1c1c827-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:51 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b1c1c827-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843891; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=DcxCCbUcz9kGC1s+CalTd9n61kMqs4eclO1Ue2UkPFk=; b=ghlbEI80/nXbYYr+FNiOll1AC/zdGWgpk38jVi1VMITYTFvBGhzn2dhi oDN+wWttEVIXY6RYgNf8w+DBGjCP1a+C1iiMB4GQpnW4oigPbtvVwEKeT 5Uc8BG16AUuPY6xkGjUTNSz+NyHuwqjtLomk3ikA1kp/wh07TKX/jRBtw 8=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: eEZUEZ9Ij573N0JqESrw5UF2ReAltDdmaV5bWfH2TWTP+RGFhmvJ0pOYJQcjDiiG3QQ/G3VvXt hEZUlXCwOc9/GjmZn1rx8i7okXz2WSoPYoDH9pLGLCrjVcUy+uawz+PzpHGQJF4c25sMX9oeX9 h1D8U/ZsotXm45SqFQyYrj+mM/cNBInZHWnRVdVZEIzP80pm+SeHeXyqDl8c7TJpqpRNqseJUD riZDR/36Yk8WcmXBGnpPoIYWt3wgwGiO0svAvFurf0ofJWbQQ+pwlCg9R3Y7C3EbF14zljAfQ8 82YMjWj9vWwnEagY6TupmSIF X-SBRS: 5.1 X-MesageID: 64050489 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:62nNwK8ng0wTRPQQI6j+DrUDn3mTJUtcMsCJ2f8bNWPcYEJGY0x3x mYcDT2OMv+NZWr3Kdl0Oouxpk0CuJXQz9dkTgE6rn08E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPhz9 41z6beBEj14AYvuse43fDRyPQFXaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4SRauGO 5pIAdZpRDiaZRcIE1cGM48Rn+aSmnr/SwdkoXvA8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9G7tRaAB/luc HZFxQwMhKIY22GBYPnUCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxgmzOJGMyTItbO+eP2WUN5gIwtaDOmBt3VJovYyOkM2 9oAZcaM1TtFV+jyPnve/YIJdAhYJnknH5Hm7cdQc7fbcAZhHWggDd7XwK8gJNM5z/gEyL+Q8 yHvQFJcxXr+mWbDdVeAZEd8Ze69Rp14t386Y3AhZA76x3g5bI+zx64DbJ9rL6I//eluwKcsH fkIcsmNGNpVTTHD92hPZJXxttU6Jh+qmRiPL2yuZz1mJ8xsQAnA+9nFeArz9XZRUnrr5JVm+ 7D5j1HVW5sOQQhmHf36UvP3wgPjp2UZlcJzQ1DMfotZdnLz/dU4MCf2lPI2fZ0BcE2R2juA2 g+KKh4Evu2R8ZQt+dzEiK3Y/YekF+xyQhhTE2XBtOvkMCDb+iyowJNaUfbOdjfYDTum9KKnb ORT7vf9LPxYwwoa79siS+5mnfAk+t/ih75G1QA1TnzEYmOiBq5kPnTbj9JEsbdAx+MBtAa7M q5VFgK25Vld1BvZLWMs IronPort-HdrOrdr: A9a23:6uJ/H60XEe0sUYgDeKx0tQqjBLAkLtp133Aq2lEZdPRUGvb3qy nOpoVj6faaslYssR0b9exofZPwJE80lqQFh7X5X43SPzUO0VHAROoJgLcKgQeQfxEWntQtsp uIGJIeNDSfNzdHZL7BkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050489" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 48/70] x86/shadow: CFI hardening Date: Mon, 14 Feb 2022 12:51:05 +0000 Message-ID: <20220214125127.17985-49-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/mm/shadow/common.c | 11 +++--- xen/arch/x86/mm/shadow/hvm.c | 8 ++-- xen/arch/x86/mm/shadow/multi.c | 80 ++++++++++++++++++++-------------------- xen/arch/x86/mm/shadow/multi.h | 20 +++++----- xen/arch/x86/mm/shadow/private.h | 12 +++--- xen/arch/x86/mm/shadow/pv.c | 4 +- 6 files changed, 67 insertions(+), 68 deletions(-) diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index 071a19adce82..8f111901730f 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -1215,7 +1215,7 @@ void shadow_free(struct domain *d, mfn_t smfn) * This action is irreversible: the p2m mapping only ever grows. * That's OK because the p2m table only exists for translated domains, * and those domains can't ever turn off shadow mode. */ -static struct page_info * +static struct page_info *cf_check shadow_alloc_p2m_page(struct domain *d) { struct page_info *pg; @@ -1251,7 +1251,7 @@ shadow_alloc_p2m_page(struct domain *d) return pg; } -static void +static void cf_check shadow_free_p2m_page(struct domain *d, struct page_info *pg) { struct domain *owner = page_get_owner(pg); @@ -2290,7 +2290,8 @@ void shadow_prepare_page_type_change(struct domain *d, struct page_info *page, /* Reset the up-pointers of every L3 shadow to 0. * This is called when l3 shadows stop being pinnable, to clear out all * the list-head bits so the up-pointer field is properly inititalised. */ -static int sh_clear_up_pointer(struct vcpu *v, mfn_t smfn, mfn_t unused) +static int cf_check sh_clear_up_pointer( + struct vcpu *v, mfn_t smfn, mfn_t unused) { mfn_to_page(smfn)->up = 0; return 0; @@ -2490,7 +2491,7 @@ static void sh_update_paging_modes(struct vcpu *v) v->arch.paging.mode->update_cr3(v, 0, false); } -void shadow_update_paging_modes(struct vcpu *v) +void cf_check shadow_update_paging_modes(struct vcpu *v) { paging_lock(v->domain); sh_update_paging_modes(v); @@ -3075,7 +3076,7 @@ static bool flush_vcpu(const struct vcpu *v, const unsigned long *vcpu_bitmap) } /* Flush TLB of selected vCPUs. NULL for all. */ -bool shadow_flush_tlb(const unsigned long *vcpu_bitmap) +bool cf_check shadow_flush_tlb(const unsigned long *vcpu_bitmap) { static DEFINE_PER_CPU(cpumask_t, flush_cpumask); cpumask_t *mask = &this_cpu(flush_cpumask); diff --git a/xen/arch/x86/mm/shadow/hvm.c b/xen/arch/x86/mm/shadow/hvm.c index c90d326becb3..27dd99f1a12e 100644 --- a/xen/arch/x86/mm/shadow/hvm.c +++ b/xen/arch/x86/mm/shadow/hvm.c @@ -794,9 +794,9 @@ sh_remove_all_shadows_and_parents(struct domain *d, mfn_t gmfn) * It means extra emulated writes and slows down removal of mappings. */ } -static void sh_unshadow_for_p2m_change(struct domain *d, unsigned long gfn, - l1_pgentry_t old, l1_pgentry_t new, - unsigned int level) +static void cf_check sh_unshadow_for_p2m_change( + struct domain *d, unsigned long gfn, l1_pgentry_t old, l1_pgentry_t new, + unsigned int level) { mfn_t omfn = l1e_get_mfn(old); unsigned int oflags = l1e_get_flags(old); @@ -879,7 +879,7 @@ static void sh_unshadow_for_p2m_change(struct domain *d, unsigned long gfn, } #if (SHADOW_OPTIMIZATIONS & SHOPT_FAST_FAULT_PATH) -static void +static void cf_check sh_write_p2m_entry_post(struct p2m_domain *p2m, unsigned int oflags) { struct domain *d = p2m->domain; diff --git a/xen/arch/x86/mm/shadow/multi.c b/xen/arch/x86/mm/shadow/multi.c index bddef53163f5..b0b1c31ee033 100644 --- a/xen/arch/x86/mm/shadow/multi.c +++ b/xen/arch/x86/mm/shadow/multi.c @@ -369,7 +369,7 @@ static void sh_audit_gw(struct vcpu *v, const walk_t *gw) #if GUEST_PAGING_LEVELS == 2 /* From one page of a multi-page shadow, find the next one */ -static inline mfn_t sh_next_page(mfn_t smfn) +static inline mfn_t cf_check sh_next_page(mfn_t smfn) { struct page_info *pg = mfn_to_page(smfn), *next; struct page_list_head h = PAGE_LIST_HEAD_INIT(h); @@ -399,8 +399,7 @@ guest_index(void *ptr) return (u32)((unsigned long)ptr & ~PAGE_MASK) / sizeof(guest_l1e_t); } -static u32 -shadow_l1_index(mfn_t *smfn, u32 guest_index) +static u32 cf_check shadow_l1_index(mfn_t *smfn, u32 guest_index) { #if (GUEST_PAGING_LEVELS == 2) ASSERT(mfn_to_page(*smfn)->u.sh.head); @@ -412,8 +411,7 @@ shadow_l1_index(mfn_t *smfn, u32 guest_index) #endif } -static u32 -shadow_l2_index(mfn_t *smfn, u32 guest_index) +static u32 cf_check shadow_l2_index(mfn_t *smfn, u32 guest_index) { #if (GUEST_PAGING_LEVELS == 2) int i; @@ -432,14 +430,12 @@ shadow_l2_index(mfn_t *smfn, u32 guest_index) #if GUEST_PAGING_LEVELS >= 4 -static u32 -shadow_l3_index(mfn_t *smfn, u32 guest_index) +static u32 cf_check shadow_l3_index(mfn_t *smfn, u32 guest_index) { return guest_index; } -static u32 -shadow_l4_index(mfn_t *smfn, u32 guest_index) +static u32 cf_check shadow_l4_index(mfn_t *smfn, u32 guest_index) { return guest_index; } @@ -924,7 +920,7 @@ do { \ /**************************************************************************/ /* Create a shadow of a given guest page. */ -static mfn_t +static mfn_t cf_check sh_make_shadow(struct vcpu *v, mfn_t gmfn, u32 shadow_type) { struct domain *d = v->domain; @@ -1459,7 +1455,8 @@ void sh_unhook_64b_mappings(struct domain *d, mfn_t sl4mfn, int user_only) */ #if GUEST_PAGING_LEVELS >= 4 -static int validate_gl4e(struct vcpu *v, void *new_ge, mfn_t sl4mfn, void *se) +static int cf_check validate_gl4e( + struct vcpu *v, void *new_ge, mfn_t sl4mfn, void *se) { shadow_l4e_t new_sl4e; guest_l4e_t new_gl4e = *(guest_l4e_t *)new_ge; @@ -1518,7 +1515,8 @@ static int validate_gl4e(struct vcpu *v, void *new_ge, mfn_t sl4mfn, void *se) } -static int validate_gl3e(struct vcpu *v, void *new_ge, mfn_t sl3mfn, void *se) +static int cf_check validate_gl3e( + struct vcpu *v, void *new_ge, mfn_t sl3mfn, void *se) { struct domain *d = v->domain; shadow_l3e_t new_sl3e; @@ -1552,7 +1550,8 @@ static int validate_gl3e(struct vcpu *v, void *new_ge, mfn_t sl3mfn, void *se) } #endif // GUEST_PAGING_LEVELS >= 4 -static int validate_gl2e(struct vcpu *v, void *new_ge, mfn_t sl2mfn, void *se) +static int cf_check validate_gl2e( + struct vcpu *v, void *new_ge, mfn_t sl2mfn, void *se) { struct domain *d = v->domain; shadow_l2e_t new_sl2e; @@ -1599,7 +1598,8 @@ static int validate_gl2e(struct vcpu *v, void *new_ge, mfn_t sl2mfn, void *se) return result; } -static int validate_gl1e(struct vcpu *v, void *new_ge, mfn_t sl1mfn, void *se) +static int cf_check validate_gl1e( + struct vcpu *v, void *new_ge, mfn_t sl1mfn, void *se) { struct domain *d = v->domain; shadow_l1e_t new_sl1e; @@ -2089,8 +2089,8 @@ static DEFINE_PER_CPU(int,trace_extra_emulation_count); #endif static DEFINE_PER_CPU(guest_pa_t,trace_emulate_write_val); -static void trace_emulate_write_val(const void *ptr, unsigned long vaddr, - const void *src, unsigned int bytes) +static void cf_check trace_emulate_write_val( + const void *ptr, unsigned long vaddr, const void *src, unsigned int bytes) { #if GUEST_PAGING_LEVELS == 3 if ( vaddr == this_cpu(trace_emulate_initial_va) ) @@ -2144,9 +2144,8 @@ static inline void trace_shadow_emulate(guest_l1e_t gl1e, unsigned long va) * shadow code (and the guest should retry) or 0 if it is not (and the * fault should be handled elsewhere or passed to the guest). */ -static int sh_page_fault(struct vcpu *v, - unsigned long va, - struct cpu_user_regs *regs) +static int cf_check sh_page_fault( + struct vcpu *v, unsigned long va, struct cpu_user_regs *regs) { struct domain *d = v->domain; walk_t gw; @@ -2898,7 +2897,7 @@ static int sh_page_fault(struct vcpu *v, * instruction should be issued on the hardware, or false if it's safe not * to do so. */ -static bool sh_invlpg(struct vcpu *v, unsigned long linear) +static bool cf_check sh_invlpg(struct vcpu *v, unsigned long linear) { mfn_t sl1mfn; shadow_l2e_t sl2e; @@ -3030,9 +3029,8 @@ static bool sh_invlpg(struct vcpu *v, unsigned long linear) #ifdef CONFIG_HVM -static unsigned long -sh_gva_to_gfn(struct vcpu *v, struct p2m_domain *p2m, - unsigned long va, uint32_t *pfec) +static unsigned long cf_check sh_gva_to_gfn( + struct vcpu *v, struct p2m_domain *p2m, unsigned long va, uint32_t *pfec) /* Called to translate a guest virtual address to what the *guest* * pagetables would map it to. */ { @@ -3196,8 +3194,7 @@ sh_update_linear_entries(struct vcpu *v) * Removes v->arch.paging.shadow.shadow_table[]. * Does all appropriate management/bookkeeping/refcounting/etc... */ -static void -sh_detach_old_tables(struct vcpu *v) +static void cf_check sh_detach_old_tables(struct vcpu *v) { struct domain *d = v->domain; mfn_t smfn; @@ -3216,8 +3213,7 @@ sh_detach_old_tables(struct vcpu *v) } } -static void -sh_update_cr3(struct vcpu *v, int do_locking, bool noflush) +static void cf_check sh_update_cr3(struct vcpu *v, int do_locking, bool noflush) /* Updates vcpu->arch.cr3 after the guest has changed CR3. * Paravirtual guests should set v->arch.guest_table (and guest_table_user, * if appropriate). @@ -3525,7 +3521,8 @@ int sh_rm_write_access_from_sl1p(struct domain *d, mfn_t gmfn, #endif /* OOS */ #if defined(CONFIG_HVM) && (SHADOW_OPTIMIZATIONS & SHOPT_WRITABLE_HEURISTIC) -static int sh_guess_wrmap(struct vcpu *v, unsigned long vaddr, mfn_t gmfn) +static int cf_check sh_guess_wrmap( + struct vcpu *v, unsigned long vaddr, mfn_t gmfn) /* Look up this vaddr in the current shadow and see if it's a writeable * mapping of this gmfn. If so, remove it. Returns 1 if it worked. */ { @@ -3589,8 +3586,8 @@ static int sh_guess_wrmap(struct vcpu *v, unsigned long vaddr, mfn_t gmfn) } #endif -int sh_rm_write_access_from_l1(struct domain *d, mfn_t sl1mfn, - mfn_t readonly_mfn) +int cf_check sh_rm_write_access_from_l1( + struct domain *d, mfn_t sl1mfn, mfn_t readonly_mfn) /* Excises all writeable mappings to readonly_mfn from this l1 shadow table */ { shadow_l1e_t *sl1e; @@ -3626,7 +3623,8 @@ int sh_rm_write_access_from_l1(struct domain *d, mfn_t sl1mfn, } -int sh_rm_mappings_from_l1(struct domain *d, mfn_t sl1mfn, mfn_t target_mfn) +int cf_check sh_rm_mappings_from_l1( + struct domain *d, mfn_t sl1mfn, mfn_t target_mfn) /* Excises all mappings to guest frame from this shadow l1 table */ { shadow_l1e_t *sl1e; @@ -3677,7 +3675,7 @@ void sh_clear_shadow_entry(struct domain *d, void *ep, mfn_t smfn) } } -int sh_remove_l1_shadow(struct domain *d, mfn_t sl2mfn, mfn_t sl1mfn) +int cf_check sh_remove_l1_shadow(struct domain *d, mfn_t sl2mfn, mfn_t sl1mfn) /* Remove all mappings of this l1 shadow from this l2 shadow */ { shadow_l2e_t *sl2e; @@ -3700,7 +3698,7 @@ int sh_remove_l1_shadow(struct domain *d, mfn_t sl2mfn, mfn_t sl1mfn) } #if GUEST_PAGING_LEVELS >= 4 -int sh_remove_l2_shadow(struct domain *d, mfn_t sl3mfn, mfn_t sl2mfn) +int cf_check sh_remove_l2_shadow(struct domain *d, mfn_t sl3mfn, mfn_t sl2mfn) /* Remove all mappings of this l2 shadow from this l3 shadow */ { shadow_l3e_t *sl3e; @@ -3722,7 +3720,7 @@ int sh_remove_l2_shadow(struct domain *d, mfn_t sl3mfn, mfn_t sl2mfn) return done; } -int sh_remove_l3_shadow(struct domain *d, mfn_t sl4mfn, mfn_t sl3mfn) +int cf_check sh_remove_l3_shadow(struct domain *d, mfn_t sl4mfn, mfn_t sl3mfn) /* Remove all mappings of this l3 shadow from this l4 shadow */ { shadow_l4e_t *sl4e; @@ -3752,7 +3750,7 @@ int sh_remove_l3_shadow(struct domain *d, mfn_t sl4mfn, mfn_t sl3mfn) * and in the meantime we unhook its top-level user-mode entries. */ #if GUEST_PAGING_LEVELS == 3 -static void sh_pagetable_dying(paddr_t gpa) +static void cf_check sh_pagetable_dying(paddr_t gpa) { struct vcpu *v = current; struct domain *d = v->domain; @@ -3833,7 +3831,7 @@ static void sh_pagetable_dying(paddr_t gpa) put_gfn(d, l3gfn); } #else -static void sh_pagetable_dying(paddr_t gpa) +static void cf_check sh_pagetable_dying(paddr_t gpa) { struct vcpu *v = current; struct domain *d = v->domain; @@ -3932,7 +3930,7 @@ static const char *sh_audit_flags(struct vcpu *v, int level, return NULL; } -int sh_audit_l1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) +int cf_check sh_audit_l1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) { guest_l1e_t *gl1e, *gp; shadow_l1e_t *sl1e; @@ -4000,7 +3998,7 @@ int sh_audit_l1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) return done; } -int sh_audit_fl1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) +int cf_check sh_audit_fl1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) { guest_l1e_t *gl1e, e; shadow_l1e_t *sl1e; @@ -4026,7 +4024,7 @@ int sh_audit_fl1_table(struct vcpu *v, mfn_t sl1mfn, mfn_t x) return 0; } -int sh_audit_l2_table(struct vcpu *v, mfn_t sl2mfn, mfn_t x) +int cf_check sh_audit_l2_table(struct vcpu *v, mfn_t sl2mfn, mfn_t x) { struct domain *d = v->domain; guest_l2e_t *gl2e, *gp; @@ -4078,7 +4076,7 @@ int sh_audit_l2_table(struct vcpu *v, mfn_t sl2mfn, mfn_t x) } #if GUEST_PAGING_LEVELS >= 4 -int sh_audit_l3_table(struct vcpu *v, mfn_t sl3mfn, mfn_t x) +int cf_check sh_audit_l3_table(struct vcpu *v, mfn_t sl3mfn, mfn_t x) { struct domain *d = v->domain; guest_l3e_t *gl3e, *gp; @@ -4126,7 +4124,7 @@ int sh_audit_l3_table(struct vcpu *v, mfn_t sl3mfn, mfn_t x) return 0; } -int sh_audit_l4_table(struct vcpu *v, mfn_t sl4mfn, mfn_t x) +int cf_check sh_audit_l4_table(struct vcpu *v, mfn_t sl4mfn, mfn_t x) { struct domain *d = v->domain; guest_l4e_t *gl4e, *gp; diff --git a/xen/arch/x86/mm/shadow/multi.h b/xen/arch/x86/mm/shadow/multi.h index 0bd6a2d5b787..5bcd6ae1a8da 100644 --- a/xen/arch/x86/mm/shadow/multi.h +++ b/xen/arch/x86/mm/shadow/multi.h @@ -59,10 +59,10 @@ extern void SHADOW_INTERNAL_NAME(sh_unhook_64b_mappings, GUEST_LEVELS) (struct domain *d, mfn_t sl4mfn, int user_only); -extern int +int cf_check SHADOW_INTERNAL_NAME(sh_rm_write_access_from_l1, GUEST_LEVELS) (struct domain *d, mfn_t sl1mfn, mfn_t readonly_mfn); -extern int +int cf_check SHADOW_INTERNAL_NAME(sh_rm_mappings_from_l1, GUEST_LEVELS) (struct domain *d, mfn_t sl1mfn, mfn_t target_mfn); @@ -70,30 +70,30 @@ extern void SHADOW_INTERNAL_NAME(sh_clear_shadow_entry, GUEST_LEVELS) (struct domain *d, void *ep, mfn_t smfn); -extern int +int cf_check SHADOW_INTERNAL_NAME(sh_remove_l1_shadow, GUEST_LEVELS) (struct domain *d, mfn_t sl2mfn, mfn_t sl1mfn); -extern int +int cf_check SHADOW_INTERNAL_NAME(sh_remove_l2_shadow, GUEST_LEVELS) (struct domain *d, mfn_t sl3mfn, mfn_t sl2mfn); -extern int +int cf_check SHADOW_INTERNAL_NAME(sh_remove_l3_shadow, GUEST_LEVELS) (struct domain *d, mfn_t sl4mfn, mfn_t sl3mfn); #if SHADOW_AUDIT & SHADOW_AUDIT_ENTRIES -int +int cf_check SHADOW_INTERNAL_NAME(sh_audit_l1_table, GUEST_LEVELS) (struct vcpu *v, mfn_t sl1mfn, mfn_t x); -int +int cf_check SHADOW_INTERNAL_NAME(sh_audit_fl1_table, GUEST_LEVELS) (struct vcpu *v, mfn_t sl1mfn, mfn_t x); -int +int cf_check SHADOW_INTERNAL_NAME(sh_audit_l2_table, GUEST_LEVELS) (struct vcpu *v, mfn_t sl2mfn, mfn_t x); -int +int cf_check SHADOW_INTERNAL_NAME(sh_audit_l3_table, GUEST_LEVELS) (struct vcpu *v, mfn_t sl3mfn, mfn_t x); -int +int cf_check SHADOW_INTERNAL_NAME(sh_audit_l4_table, GUEST_LEVELS) (struct vcpu *v, mfn_t sl4mfn, mfn_t x); #endif diff --git a/xen/arch/x86/mm/shadow/private.h b/xen/arch/x86/mm/shadow/private.h index e4db8d32546a..3dc024e30f20 100644 --- a/xen/arch/x86/mm/shadow/private.h +++ b/xen/arch/x86/mm/shadow/private.h @@ -420,15 +420,15 @@ static inline int sh_remove_write_access(struct domain *d, mfn_t readonly_mfn, #endif /* Functions that atomically write PV guest PT entries */ -void sh_write_guest_entry(struct vcpu *v, intpte_t *p, intpte_t new, - mfn_t gmfn); -intpte_t sh_cmpxchg_guest_entry(struct vcpu *v, intpte_t *p, intpte_t old, - intpte_t new, mfn_t gmfn); +void cf_check sh_write_guest_entry( + struct vcpu *v, intpte_t *p, intpte_t new, mfn_t gmfn); +intpte_t cf_check sh_cmpxchg_guest_entry( + struct vcpu *v, intpte_t *p, intpte_t old, intpte_t new, mfn_t gmfn); /* Update all the things that are derived from the guest's CR0/CR3/CR4. * Called to initialize paging structures if the paging mode * has changed, and when bringing up a VCPU for the first time. */ -void shadow_update_paging_modes(struct vcpu *v); +void cf_check shadow_update_paging_modes(struct vcpu *v); /* Unhook the non-Xen mappings in this top-level shadow mfn. * With user_only == 1, unhooks only the user-mode mappings. */ @@ -922,7 +922,7 @@ static inline int sh_check_page_has_no_refs(struct page_info *page) } /* Flush the TLB of the selected vCPUs. */ -bool shadow_flush_tlb(const unsigned long *vcpu_bitmap); +bool cf_check shadow_flush_tlb(const unsigned long *vcpu_bitmap); #endif /* _XEN_SHADOW_PRIVATE_H */ diff --git a/xen/arch/x86/mm/shadow/pv.c b/xen/arch/x86/mm/shadow/pv.c index f51f980f2694..ed10d5479c5e 100644 --- a/xen/arch/x86/mm/shadow/pv.c +++ b/xen/arch/x86/mm/shadow/pv.c @@ -28,7 +28,7 @@ * Write a new value into the guest pagetable, and update the shadows * appropriately. */ -void +void cf_check sh_write_guest_entry(struct vcpu *v, intpte_t *p, intpte_t new, mfn_t gmfn) { paging_lock(v->domain); @@ -42,7 +42,7 @@ sh_write_guest_entry(struct vcpu *v, intpte_t *p, intpte_t new, mfn_t gmfn) * appropriately. Returns the previous entry found, which the caller is * expected to check to see if the cmpxchg was successful. */ -intpte_t +intpte_t cf_check sh_cmpxchg_guest_entry(struct vcpu *v, intpte_t *p, intpte_t old, intpte_t new, mfn_t gmfn) { From patchwork Mon Feb 14 12:51:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745556 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0945CC433F5 for ; Mon, 14 Feb 2022 13:06:22 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271696.466296 (Exim 4.92) (envelope-from ) id 1nJb3S-0006Ls-2B; Mon, 14 Feb 2022 13:06:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271696.466296; Mon, 14 Feb 2022 13:06:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3R-0006LF-Sw; Mon, 14 Feb 2022 13:06:09 +0000 Received: by outflank-mailman (input) for mailman id 271696; Mon, 14 Feb 2022 13:06:08 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2d-00023t-3E for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:19 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id bf1c7d79-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:14 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: bf1c7d79-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843915; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Tggw0GZ6bfnXtc3j4bg8kNAeAyzyeywPiqWn1QmRJkY=; b=hWqUX8sHy2nidq9jL+80nzlAb/4wFPqq9B9+1a022ixiHc4MDE+naiSN wtJcqELJEtDONTMK59Xb0KxjM6LpMmsjHl89uAVqfaVcNEApFdFWSpOqv rYCIeTAuBnUDwSclYCYg0+oIANUoj7Mxx3ihyVzHNiJVvdUzFoX72DFQ2 c=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: h3iYyQsK6zE5hVydfGasuPl2S6zQCRvyDC8bkeVSnsO+uetH8nNUUuE2JnTJOudLkRFmpRcOUe I5c65DN0NJLHfNifkAASDni17Vg/KlOm39Lh30kFzAG5/liJWQGB+zDU3lOG6T8GBJdC4zjFSn lblgbCBcoLwovYAPr9gZALpt+0UDzLFn8uyjwNwyQmvDcBGEGDZeuJ4Wa1VB/TPBZT7E5AowGq ph/ZiH0Yl5aW43fhtRIRVn4X0H6rb1hon0zFmR3gVHOeMSsf/RgnqZnAoiMgnM6XD0F1zcIkRy kuPS1TxufY1NFHz90P+tDrp4 X-SBRS: 5.1 X-MesageID: 64050600 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:dK7b7a6cv4gWjnE+dDCrwAxRtCbAchMFZxGqfqrLsTDasY5as4F+v mofWmzUOP+MazGkfNAgO4znpk9SuZXSzYVjT1Q6/i5nHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Zl +h18tuXEzgVPZbhpqc6XEF8KwRTFPgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQa6DP 5RBMVKDajzjW1pEI0owOqkUjcSajFv9Wm1ktn+a8P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeR1XOGHJV4c XMo+REDk+sV+xSPdvzQdkjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5ilD2DHcihl3xKE9O2PRaodFvMC3PWBshR0U9OiFq9H w93O5TYxhNBfvf5ZyWLo4cfIUpTdSowBIzsqtwRfemGe1I0FGYkAv7X4LUgZ406wPgFyraWp imwCh1C1V7ypXzbMgHWOHptX6ziAMRkpnUhMC1yYVvxgyo/YZyi5bs0focseeV17/RqyPN5F qFXe8iJDvlVZC7A/jARMcv0oIB4LUz5jgOSJSu1JjM4esc4FQDO/9bleCrp9TUPUXXr5Zdv/ eX421qCE5QZRglkAMLHU96Vzgu87SoHheZ/f0rUOd0PKk/ix5dndn7qhfgtLsBSdRianmmG1 xybCAszrPXWp9Nn68HAgK2Jotv7E+Z6GUYGTWDX4azvaHvf92unh4RBTPyJbXbWU2atoPeuY uBczvfdNvwbnQkV79ogQugzla9utcHyo7J6zxh/GCSZZlumPbpsP32a0JQdraZK3LJY5VO7V 0/nFgO24llV1BcJyGIsGTc= IronPort-HdrOrdr: A9a23:peCOGqMpSc0cScBcTvKjsMiBIKoaSvp037B87TEUdfU1SL3jqy nKpp536faaskd2ZJhNo6H5BEDiexPhHPxOkO4s1N6ZNWGMhILPFvAB0WLM+UyEJ8SUzJ8l6U 4PSdkENDQyNzdHZATBjDVQ3+xA/DBPys7Y5tvj8w== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050600" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 49/70] x86/hap: CFI hardening Date: Mon, 14 Feb 2022 12:51:06 +0000 Message-ID: <20220214125127.17985-50-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/mm/hap/guest_walk.c | 4 ++-- xen/arch/x86/mm/hap/hap.c | 21 +++++++++++---------- xen/arch/x86/mm/hap/private.h | 30 ++++++++++++------------------ 3 files changed, 25 insertions(+), 30 deletions(-) diff --git a/xen/arch/x86/mm/hap/guest_walk.c b/xen/arch/x86/mm/hap/guest_walk.c index 832a8058471e..1da8d3b99edc 100644 --- a/xen/arch/x86/mm/hap/guest_walk.c +++ b/xen/arch/x86/mm/hap/guest_walk.c @@ -36,14 +36,14 @@ #include #include -unsigned long hap_gva_to_gfn(GUEST_PAGING_LEVELS)( +unsigned long cf_check hap_gva_to_gfn(GUEST_PAGING_LEVELS)( struct vcpu *v, struct p2m_domain *p2m, unsigned long gva, uint32_t *pfec) { unsigned long cr3 = v->arch.hvm.guest_cr[3]; return hap_p2m_ga_to_gfn(GUEST_PAGING_LEVELS)(v, p2m, cr3, gva, pfec, NULL); } -unsigned long hap_p2m_ga_to_gfn(GUEST_PAGING_LEVELS)( +unsigned long cf_check hap_p2m_ga_to_gfn(GUEST_PAGING_LEVELS)( struct vcpu *v, struct p2m_domain *p2m, unsigned long cr3, paddr_t ga, uint32_t *pfec, unsigned int *page_order) { diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c index ed5112b00b63..9d67a47f5fe9 100644 --- a/xen/arch/x86/mm/hap/hap.c +++ b/xen/arch/x86/mm/hap/hap.c @@ -268,7 +268,7 @@ static void hap_free(struct domain *d, mfn_t mfn) page_list_add_tail(pg, &d->arch.paging.hap.freelist); } -static struct page_info *hap_alloc_p2m_page(struct domain *d) +static struct page_info *cf_check hap_alloc_p2m_page(struct domain *d) { struct page_info *pg; @@ -294,7 +294,7 @@ static struct page_info *hap_alloc_p2m_page(struct domain *d) return pg; } -static void hap_free_p2m_page(struct domain *d, struct page_info *pg) +static void cf_check hap_free_p2m_page(struct domain *d, struct page_info *pg) { struct domain *owner = page_get_owner(pg); @@ -662,8 +662,8 @@ void hap_vcpu_init(struct vcpu *v) * HAP guests can handle page faults (in the guest page tables) without * needing any action from Xen, so we should not be intercepting them. */ -static int hap_page_fault(struct vcpu *v, unsigned long va, - struct cpu_user_regs *regs) +static int cf_check hap_page_fault( + struct vcpu *v, unsigned long va, struct cpu_user_regs *regs) { struct domain *d = v->domain; @@ -677,7 +677,7 @@ static int hap_page_fault(struct vcpu *v, unsigned long va, * should not be intercepting it. However, we need to correctly handle * getting here from instruction emulation. */ -static bool_t hap_invlpg(struct vcpu *v, unsigned long linear) +static bool cf_check hap_invlpg(struct vcpu *v, unsigned long linear) { /* * Emulate INVLPGA: @@ -690,7 +690,8 @@ static bool_t hap_invlpg(struct vcpu *v, unsigned long linear) return 1; } -static void hap_update_cr3(struct vcpu *v, int do_locking, bool noflush) +static void cf_check hap_update_cr3( + struct vcpu *v, int do_locking, bool noflush) { v->arch.hvm.hw_cr[3] = v->arch.hvm.guest_cr[3]; hvm_update_guest_cr3(v, noflush); @@ -702,7 +703,7 @@ static bool flush_vcpu(const struct vcpu *v, const unsigned long *vcpu_bitmap) } /* Flush TLB of selected vCPUs. NULL for all. */ -static bool flush_tlb(const unsigned long *vcpu_bitmap) +static bool cf_check flush_tlb(const unsigned long *vcpu_bitmap) { static DEFINE_PER_CPU(cpumask_t, flush_cpumask); cpumask_t *mask = &this_cpu(flush_cpumask); @@ -747,7 +748,7 @@ hap_paging_get_mode(struct vcpu *v) &hap_paging_protected_mode); } -static void hap_update_paging_modes(struct vcpu *v) +static void cf_check hap_update_paging_modes(struct vcpu *v) { struct domain *d = v->domain; unsigned long cr3_gfn = v->arch.hvm.guest_cr[3] >> PAGE_SHIFT; @@ -791,13 +792,13 @@ void hap_p2m_init(struct p2m_domain *p2m) p2m->write_p2m_entry_post = hap_write_p2m_entry_post; } -static unsigned long hap_gva_to_gfn_real_mode( +static unsigned long cf_check hap_gva_to_gfn_real_mode( struct vcpu *v, struct p2m_domain *p2m, unsigned long gva, uint32_t *pfec) { return ((paddr_t)gva >> PAGE_SHIFT); } -static unsigned long hap_p2m_ga_to_gfn_real_mode( +static unsigned long cf_check hap_p2m_ga_to_gfn_real_mode( struct vcpu *v, struct p2m_domain *p2m, unsigned long cr3, paddr_t ga, uint32_t *pfec, unsigned int *page_order) { diff --git a/xen/arch/x86/mm/hap/private.h b/xen/arch/x86/mm/hap/private.h index 973fbe8be59c..1040eaf69f43 100644 --- a/xen/arch/x86/mm/hap/private.h +++ b/xen/arch/x86/mm/hap/private.h @@ -24,27 +24,21 @@ /********************************************/ /* GUEST TRANSLATION FUNCS */ /********************************************/ -unsigned long hap_gva_to_gfn_2_levels(struct vcpu *v, - struct p2m_domain *p2m, - unsigned long gva, - uint32_t *pfec); -unsigned long hap_gva_to_gfn_3_levels(struct vcpu *v, - struct p2m_domain *p2m, - unsigned long gva, - uint32_t *pfec); -unsigned long hap_gva_to_gfn_4_levels(struct vcpu *v, - struct p2m_domain *p2m, - unsigned long gva, - uint32_t *pfec); +unsigned long cf_check hap_gva_to_gfn_2_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long gva, uint32_t *pfec); +unsigned long cf_check hap_gva_to_gfn_3_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long gva, uint32_t *pfec); +unsigned long cf_check hap_gva_to_gfn_4_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long gva, uint32_t *pfec); -unsigned long hap_p2m_ga_to_gfn_2_levels(struct vcpu *v, - struct p2m_domain *p2m, unsigned long cr3, +unsigned long cf_check hap_p2m_ga_to_gfn_2_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long cr3, paddr_t ga, uint32_t *pfec, unsigned int *page_order); -unsigned long hap_p2m_ga_to_gfn_3_levels(struct vcpu *v, - struct p2m_domain *p2m, unsigned long cr3, +unsigned long cf_check hap_p2m_ga_to_gfn_3_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long cr3, paddr_t ga, uint32_t *pfec, unsigned int *page_order); -unsigned long hap_p2m_ga_to_gfn_4_levels(struct vcpu *v, - struct p2m_domain *p2m, unsigned long cr3, +unsigned long cf_check hap_p2m_ga_to_gfn_4_levels( + struct vcpu *v, struct p2m_domain *p2m, unsigned long cr3, paddr_t ga, uint32_t *pfec, unsigned int *page_order); #endif /* __HAP_PRIVATE_H__ */ From patchwork Mon Feb 14 12:51:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745565 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 88A17C433F5 for ; Mon, 14 Feb 2022 13:06:34 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271718.466401 (Exim 4.92) (envelope-from ) id 1nJb3g-00018C-LO; Mon, 14 Feb 2022 13:06:24 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271718.466401; Mon, 14 Feb 2022 13:06:24 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3f-00012f-LZ; Mon, 14 Feb 2022 13:06:23 +0000 Received: by outflank-mailman (input) for mailman id 271718; Mon, 14 Feb 2022 13:06:21 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2k-0008IH-St for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:27 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id c59298a3-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:25 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: c59298a3-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843925; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=+QYHYC1eoLvldjqb5KMKNFpB/QJHZdfvkMfW0IB8GJg=; b=dGvbwJFzOxIeHii8yWuBpkvNvhVzYnZ+oU13Iq9gSWMpQr2zNdIBaYQP /vkHN0FUCsVsBO0fvn4QRP3GsEjLwhDjRZcUJVaxVwKU2MCxoJWDQP0zR 9IV3RRM1Z9gtFaiDfvmHUkpNX57OMSSl9HPtNyDy5N71Gwh3y1Gd3JWPm 0=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: C6Sv2M/yMcWd5uk1UcVDDsDlml2D6fzDMx2LjXFX52Hu9QcWv5sN1dhPbLEi68L49qxmoEgCSk yvWMjaeEkbh7r1Pis63iSkFgz1w1dFHGKumlxMMtLzmsQV9fuWLDvBTZL56fVzCOyx49k8uWMc t5kkzd4P0s8gP/v/XGfuSa1ajMmeB2+iYoUKgyEQZ26NqWBgxFIImxEYGwni5cHzuQ8TUv+BZg SP16gzy3ciunaSBTwwOPWs+wgXEsNFMl1cxmM/iOT7lXFdcHHDcctELGf2Z9TksMuLV8BIS1Fe MGQCxQVVzbXcpKjIwtfoVggD X-SBRS: 5.1 X-MesageID: 64149812 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:wPpoL6JAo3pq/N8yFE+R95IlxSXFcZb7ZxGr2PjKsXjdYENSgWBVy TAXDT+POvnZYjT2e412OtmzoB5SsJPSm95qTQJlqX01Q3x08seUXt7xwmUcns+xwm8vaGo9s q3yv/GZdJhcokcxIn5BC5C5xZVG/fjgqoHUVaiUakideSc+EH170Ug6x7Zg6mJVqYPR7z2l6 IuaT/L3YDdJ6xYsWo7Dw/vewP/HlK2aVAIw5jTSV9gS1LPtvyB94KYkDbOwNxPFrrx8RYZWc QphIIaRpQs19z91Yj+sfy2SnkciGtY+NiDW4pZatjTLbrGvaUXe345iXMfwZ3u7hB3OutpP0 I1A7aecbj0nY4jKw9Q+UUFhRnQW0a1uoNcrIFC6uM2XiUbHb2Ht07NlC0Re0Y8wo7gtRzsUr LpBdW5LPkvra+GemdpXTsFFgMg5IdatF4QYonx6lhnSDOo8QICFSKLPjTNd9Gls35wfTa+ED yYfQQVvVRHjexkQBlNNT9Ewv9maiFDvbjIN/Tp5ooJoujOOnWSdyoPFINfTP9CHW8hRtkKZv X7duXT0BAkAM96SwibD9Wij7tIjhguiBthUTufhsKc33hvDnQT/FSH6S3P8hPOHkhazA+lzD HYapw8o9pgR9hSSG4yVswKDnFaIuRsVWtx1GuI86R2Qxqe83zt1FlToXRYaNoV46ZZeqSgCk wbQwoi3XWAHXKi9FCrFnop4uw9eLsT8wYUqQSYfBTUI7ND4yG3YpkKeF40zeEJZYzCcJN0R/ 9xohHVk71nwpZRSv0lewbwgq2jyzqUltiZvum3qspiZxg14fpW5QIej9ELW6/1NRK7AEAXd4 yhUxpXGtbtUZX1oqMBqaL9TdIxFGt7faGGM6bKRN8VJG8uRF46LItkLvWAWyLZBOccYYz75C HI/SisKjKK/yECCNPctC6roUpxC5fG5SbzNC6CFBvITM8MZXFLWo0lTibu4gjmFuFIyips2J ZrzWZ/qVR72/4w8l2HoLwrcuJd2rh0DKZT7G8ylkUT9jOb2ibz8Ye5tDWZip9sRtMusyDg5O f4FXydT4xkAAuD4fAfN9osfcQIDIXQhXMikoM1LbO+TZAFhHTh5WfPWxLogfa1jnrhUybiUr i3sBBcAxQqtn2DDJCWLdmtnNOHlU6FgoC9pJicrJ1uphSQuON798KcFepIrVrA77+g/n+VsR vwIdpzYUPRCQzjK4RoHapz5oNAwfRinn1vWbSGkfCI+b9hrQAmQoo3oeQ7m9S8vCCurtJRh/ +38h12DGZdaHlZsFsfbbv6r3midh3lFlbIgRVbML/lSZF7orNpgJRvug6JlOMoLMxjCmGeXj l7EHRcCqODRiIYp692V17ucpoKkHuYiTEpXG27XseS/OSXApzfxxIZBVKCDfCzHVXOy86KnP L0Hw/b5OfwBvVBLr4sjTOo7kfNgv4Pi9+1A0wBpPHTXdFD6WLpvL06P0dRLqqAQlKRSvhG7W x7X99RXUVlT1BgJzLLFyNIZU9m+ IronPort-HdrOrdr: A9a23:Qa61dqnU6+TUEIgrYkd11ElM9YjpDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149812" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 50/70] x86/p2m: CFI hardening Date: Mon, 14 Feb 2022 12:51:07 +0000 Message-ID: <20220214125127.17985-51-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/include/asm/p2m.h | 4 ++-- xen/arch/x86/mm/hap/hap.c | 2 +- xen/arch/x86/mm/hap/nested_hap.c | 2 +- xen/arch/x86/mm/p2m-ept.c | 32 +++++++++++++++----------------- xen/arch/x86/mm/p2m-pt.c | 19 +++++++++---------- 5 files changed, 28 insertions(+), 31 deletions(-) diff --git a/xen/arch/x86/include/asm/p2m.h b/xen/arch/x86/include/asm/p2m.h index 6e2206874d62..787374426371 100644 --- a/xen/arch/x86/include/asm/p2m.h +++ b/xen/arch/x86/include/asm/p2m.h @@ -820,8 +820,8 @@ void np2m_flush_base(struct vcpu *v, unsigned long np2m_base); void hap_p2m_init(struct p2m_domain *p2m); void shadow_p2m_init(struct p2m_domain *p2m); -void nestedp2m_write_p2m_entry_post(struct p2m_domain *p2m, - unsigned int oflags); +void cf_check nestedp2m_write_p2m_entry_post( + struct p2m_domain *p2m, unsigned int oflags); /* * Alternate p2m: shadow p2m tables used for alternate memory views diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c index 9d67a47f5fe9..c19e337d6585 100644 --- a/xen/arch/x86/mm/hap/hap.c +++ b/xen/arch/x86/mm/hap/hap.c @@ -778,7 +778,7 @@ static void cf_check hap_update_paging_modes(struct vcpu *v) put_gfn(d, cr3_gfn); } -static void +static void cf_check hap_write_p2m_entry_post(struct p2m_domain *p2m, unsigned int oflags) { struct domain *d = p2m->domain; diff --git a/xen/arch/x86/mm/hap/nested_hap.c b/xen/arch/x86/mm/hap/nested_hap.c index d8a7b3b40167..dbe5ad23a112 100644 --- a/xen/arch/x86/mm/hap/nested_hap.c +++ b/xen/arch/x86/mm/hap/nested_hap.c @@ -71,7 +71,7 @@ /* NESTED VIRT P2M FUNCTIONS */ /********************************************/ -void +void cf_check nestedp2m_write_p2m_entry_post(struct p2m_domain *p2m, unsigned int oflags) { if ( oflags & _PAGE_PRESENT ) diff --git a/xen/arch/x86/mm/p2m-ept.c b/xen/arch/x86/mm/p2m-ept.c index a8a6ad629528..70a401c3a7ea 100644 --- a/xen/arch/x86/mm/p2m-ept.c +++ b/xen/arch/x86/mm/p2m-ept.c @@ -624,7 +624,7 @@ int epte_get_entry_emt(struct domain *d, gfn_t gfn, mfn_t mfn, * - zero if no adjustment was done, * - a positive value if at least one adjustment was done. */ -static int resolve_misconfig(struct p2m_domain *p2m, unsigned long gfn) +static int cf_check resolve_misconfig(struct p2m_domain *p2m, unsigned long gfn) { struct ept_data *ept = &p2m->ept; unsigned int level = ept->wl; @@ -793,7 +793,7 @@ bool_t ept_handle_misconfig(uint64_t gpa) * * Returns: 0 for success, -errno for failure */ -static int +static int cf_check ept_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn, unsigned int order, p2m_type_t p2mt, p2m_access_t p2ma, int sve) @@ -1002,10 +1002,9 @@ ept_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn, } /* Read ept p2m entries */ -static mfn_t ept_get_entry(struct p2m_domain *p2m, - gfn_t gfn_, p2m_type_t *t, p2m_access_t* a, - p2m_query_t q, unsigned int *page_order, - bool_t *sve) +static mfn_t cf_check ept_get_entry( + struct p2m_domain *p2m, gfn_t gfn_, p2m_type_t *t, p2m_access_t *a, + p2m_query_t q, unsigned int *page_order, bool *sve) { ept_entry_t *table = map_domain_page(pagetable_get_mfn(p2m_get_pagetable(p2m))); @@ -1165,8 +1164,8 @@ void ept_walk_table(struct domain *d, unsigned long gfn) return; } -static void ept_change_entry_type_global(struct p2m_domain *p2m, - p2m_type_t ot, p2m_type_t nt) +static void cf_check ept_change_entry_type_global( + struct p2m_domain *p2m, p2m_type_t ot, p2m_type_t nt) { unsigned long mfn = p2m->ept.mfn; @@ -1177,10 +1176,9 @@ static void ept_change_entry_type_global(struct p2m_domain *p2m, ept_sync_domain(p2m); } -static int ept_change_entry_type_range(struct p2m_domain *p2m, - p2m_type_t ot, p2m_type_t nt, - unsigned long first_gfn, - unsigned long last_gfn) +static int cf_check ept_change_entry_type_range( + struct p2m_domain *p2m, p2m_type_t ot, p2m_type_t nt, + unsigned long first_gfn, unsigned long last_gfn) { unsigned int i, wl = p2m->ept.wl; unsigned long mask = (1 << EPT_TABLE_ORDER) - 1; @@ -1224,7 +1222,7 @@ static int ept_change_entry_type_range(struct p2m_domain *p2m, return rc < 0 ? rc : 0; } -static void ept_memory_type_changed(struct p2m_domain *p2m) +static void cf_check ept_memory_type_changed(struct p2m_domain *p2m) { unsigned long mfn = p2m->ept.mfn; @@ -1283,7 +1281,7 @@ void ept_sync_domain(struct p2m_domain *p2m) ept_sync_domain_mask(p2m, d->dirty_cpumask); } -static void ept_tlb_flush(struct p2m_domain *p2m) +static void cf_check ept_tlb_flush(struct p2m_domain *p2m) { ept_sync_domain_mask(p2m, p2m->domain->dirty_cpumask); } @@ -1346,7 +1344,7 @@ static void ept_disable_pml(struct p2m_domain *p2m) vmx_domain_update_eptp(p2m->domain); } -static void ept_enable_hardware_log_dirty(struct p2m_domain *p2m) +static void cf_check ept_enable_hardware_log_dirty(struct p2m_domain *p2m) { struct p2m_domain *hostp2m = p2m_get_hostp2m(p2m->domain); @@ -1355,7 +1353,7 @@ static void ept_enable_hardware_log_dirty(struct p2m_domain *p2m) p2m_unlock(hostp2m); } -static void ept_disable_hardware_log_dirty(struct p2m_domain *p2m) +static void cf_check ept_disable_hardware_log_dirty(struct p2m_domain *p2m) { struct p2m_domain *hostp2m = p2m_get_hostp2m(p2m->domain); @@ -1364,7 +1362,7 @@ static void ept_disable_hardware_log_dirty(struct p2m_domain *p2m) p2m_unlock(hostp2m); } -static void ept_flush_pml_buffers(struct p2m_domain *p2m) +static void cf_check ept_flush_pml_buffers(struct p2m_domain *p2m) { /* Domain must have been paused */ ASSERT(atomic_read(&p2m->domain->pause_count)); diff --git a/xen/arch/x86/mm/p2m-pt.c b/xen/arch/x86/mm/p2m-pt.c index ef3f8e02a415..eaba2b0fb4e6 100644 --- a/xen/arch/x86/mm/p2m-pt.c +++ b/xen/arch/x86/mm/p2m-pt.c @@ -399,7 +399,7 @@ static int p2m_pt_set_recalc_range(struct p2m_domain *p2m, * GFN. Propagate the re-calculation flag down to the next page table level * for entries not involved in the translation of the given GFN. */ -static int do_recalc(struct p2m_domain *p2m, unsigned long gfn) +static int cf_check do_recalc(struct p2m_domain *p2m, unsigned long gfn) { void *table; unsigned long gfn_remainder = gfn; @@ -573,7 +573,7 @@ static void check_entry(mfn_t mfn, p2m_type_t new, p2m_type_t old, } /* Returns: 0 for success, -errno for failure */ -static int +static int cf_check p2m_pt_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn, unsigned int page_order, p2m_type_t p2mt, p2m_access_t p2ma, int sve) @@ -774,7 +774,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m, gfn_t gfn_, mfn_t mfn, return rc; } -static mfn_t +static mfn_t cf_check p2m_pt_get_entry(struct p2m_domain *p2m, gfn_t gfn_, p2m_type_t *t, p2m_access_t *a, p2m_query_t q, unsigned int *page_order, bool_t *sve) @@ -943,8 +943,8 @@ p2m_pt_get_entry(struct p2m_domain *p2m, gfn_t gfn_, return (p2m_is_valid(*t) || p2m_is_any_ram(*t)) ? mfn : INVALID_MFN; } -static void p2m_pt_change_entry_type_global(struct p2m_domain *p2m, - p2m_type_t ot, p2m_type_t nt) +static void cf_check p2m_pt_change_entry_type_global( + struct p2m_domain *p2m, p2m_type_t ot, p2m_type_t nt) { l1_pgentry_t *tab; unsigned long gfn = 0; @@ -983,10 +983,9 @@ static void p2m_pt_change_entry_type_global(struct p2m_domain *p2m, guest_flush_tlb_mask(d, d->dirty_cpumask); } -static int p2m_pt_change_entry_type_range(struct p2m_domain *p2m, - p2m_type_t ot, p2m_type_t nt, - unsigned long first_gfn, - unsigned long last_gfn) +static int cf_check p2m_pt_change_entry_type_range( + struct p2m_domain *p2m, p2m_type_t ot, p2m_type_t nt, + unsigned long first_gfn, unsigned long last_gfn) { unsigned long mask = (1 << PAGETABLE_ORDER) - 1; unsigned int i; @@ -1025,7 +1024,7 @@ static int p2m_pt_change_entry_type_range(struct p2m_domain *p2m, } #if P2M_AUDIT -static long p2m_pt_audit_p2m(struct p2m_domain *p2m) +static long cf_check p2m_pt_audit_p2m(struct p2m_domain *p2m) { unsigned long entry_count = 0, pmbad = 0; unsigned long mfn, gfn, m2pfn; From patchwork Mon Feb 14 12:51:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745561 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6AD84C433EF for ; Mon, 14 Feb 2022 13:06:26 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271711.466350 (Exim 4.92) (envelope-from ) id 1nJb3Y-0007hp-JB; Mon, 14 Feb 2022 13:06:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271711.466350; Mon, 14 Feb 2022 13:06:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3X-0007dK-Rd; Mon, 14 Feb 2022 13:06:15 +0000 Received: by outflank-mailman (input) for mailman id 271711; Mon, 14 Feb 2022 13:06:13 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2a-00023t-2E for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:16 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id bde2d12a-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:12 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: bde2d12a-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843913; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=h36fBx0LFuxnyE677FLM/COl0irN2W1vke1lrZtnkVs=; b=eJoAgxtOGX1ha3LQRp167aB0V47GguagKGZ0wiJSvj35ld7YPn9DoRB7 bPZryP1bYjeRu0zmOklXp/rtXRSNIStvaJ0qNzernalUtfVIjIDdzBacJ uwUIi3Nr1WM/10C6822pUALzJjEUfJ36YOS3jv92q2cJYdq/6TIL1GOiF k=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: oG2RzYEMxtvV1Y9hwhqCFCQDucZgsQTYSRna3POglRxV+qwki062O3WwLloF6of6BYFGXhJQkY raO7T4peL+c5uQ4+XGybny7OuFyDv1JgZ/QTB3RnzlX4Nh2QrFAgcHjDWJzeR6RmlqGPf9lxt0 czN5YWYQpqNRGJ/+rS3Ks3NmWxiL1FwqbXwzdFN+uu2wNrHWBc6ufxUygI6tuEskyxXAMVhEGt YCsqey8UqE6HboXrPVWftZJCQfF0fx68nBI1lim4wHZjQvBBMX36NuA3Ob/EaVegcOPa/SY6ll i0Ha7Xd6nxzB9+6A+M65ocsC X-SBRS: 5.1 X-MesageID: 63592601 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:wUHFDa2ctH4asle9e/bD5c12kn2cJEfYwER7XKvMYLTBsI5bp2NWz WAeXW2FOPeKajT0eN5xa4yz8E5X7ZHVz9FiGgpppC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhhsl7j /ZEnpyKSQ4rOI2TiMJBazNyKnQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u3Z0fR6iGP qL1bxJCVTfhQgBRJms6M8xnhPrzonnOawdX/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWTuOCzzW23cNJlK 0UW/ApxvY5uzGaBd4yoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3l35unTuJHfgWDX2PiNKjWZJccp9dWHPmUwzzxP/sTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:+pxzu6/PWM23dmoNKOduk+DaI+orL9Y04lQ7vn2YSXRuHPBw9v re5cjzuiWVtN98Yh0dcJW7Scy9qBDnhPhICOsqTNSftWDd0QPCRuxfBMnZslnd8kXFh4lgPM xbEpSWZueeMbEDt7eZ3DWF X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592601" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 51/70] x86/irq: CFI hardening Date: Mon, 14 Feb 2022 12:51:08 +0000 Message-ID: <20220214125127.17985-52-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/hpet.c | 11 ++++++----- xen/arch/x86/i8259.c | 10 +++++----- xen/arch/x86/include/asm/irq.h | 8 ++++---- xen/arch/x86/include/asm/msi.h | 8 ++++---- xen/arch/x86/io_apic.c | 24 ++++++++++++------------ xen/arch/x86/irq.c | 6 +++--- xen/arch/x86/msi.c | 14 +++++++------- xen/common/irq.c | 6 +++--- xen/drivers/passthrough/amd/iommu_init.c | 15 ++++++++------- xen/drivers/passthrough/vtd/iommu.c | 13 +++++++------ xen/include/xen/irq.h | 6 +++--- 11 files changed, 62 insertions(+), 59 deletions(-) diff --git a/xen/arch/x86/hpet.c b/xen/arch/x86/hpet.c index 20fca839907c..dcc9e16693e9 100644 --- a/xen/arch/x86/hpet.c +++ b/xen/arch/x86/hpet.c @@ -256,7 +256,7 @@ static void cf_check hpet_interrupt_handler( ch->event_handler(ch); } -static void hpet_msi_unmask(struct irq_desc *desc) +static void cf_check hpet_msi_unmask(struct irq_desc *desc) { u32 cfg; struct hpet_event_channel *ch = desc->action->dev_id; @@ -267,7 +267,7 @@ static void hpet_msi_unmask(struct irq_desc *desc) ch->msi.msi_attrib.host_masked = 0; } -static void hpet_msi_mask(struct irq_desc *desc) +static void cf_check hpet_msi_mask(struct irq_desc *desc) { u32 cfg; struct hpet_event_channel *ch = desc->action->dev_id; @@ -296,7 +296,7 @@ static int hpet_msi_write(struct hpet_event_channel *ch, struct msi_msg *msg) return 0; } -static unsigned int hpet_msi_startup(struct irq_desc *desc) +static unsigned int cf_check hpet_msi_startup(struct irq_desc *desc) { hpet_msi_unmask(desc); return 0; @@ -304,14 +304,15 @@ static unsigned int hpet_msi_startup(struct irq_desc *desc) #define hpet_msi_shutdown hpet_msi_mask -static void hpet_msi_ack(struct irq_desc *desc) +static void cf_check hpet_msi_ack(struct irq_desc *desc) { irq_complete_move(desc); move_native_irq(desc); ack_APIC_irq(); } -static void hpet_msi_set_affinity(struct irq_desc *desc, const cpumask_t *mask) +static void cf_check hpet_msi_set_affinity( + struct irq_desc *desc, const cpumask_t *mask) { struct hpet_event_channel *ch = desc->action->dev_id; struct msi_msg msg = ch->msi.msg; diff --git a/xen/arch/x86/i8259.c b/xen/arch/x86/i8259.c index b389bb217622..6b35be10f09a 100644 --- a/xen/arch/x86/i8259.c +++ b/xen/arch/x86/i8259.c @@ -40,18 +40,18 @@ bool bogus_8259A_irq(unsigned int irq) return _mask_and_ack_8259A_irq(irq); } -static void mask_and_ack_8259A_irq(struct irq_desc *desc) +static void cf_check mask_and_ack_8259A_irq(struct irq_desc *desc) { _mask_and_ack_8259A_irq(desc->irq); } -static unsigned int startup_8259A_irq(struct irq_desc *desc) +static unsigned int cf_check startup_8259A_irq(struct irq_desc *desc) { enable_8259A_irq(desc); return 0; /* never anything pending */ } -static void end_8259A_irq(struct irq_desc *desc, u8 vector) +static void cf_check end_8259A_irq(struct irq_desc *desc, u8 vector) { if (!(desc->status & (IRQ_DISABLED|IRQ_INPROGRESS))) enable_8259A_irq(desc); @@ -108,12 +108,12 @@ static void _disable_8259A_irq(unsigned int irq) spin_unlock_irqrestore(&i8259A_lock, flags); } -void disable_8259A_irq(struct irq_desc *desc) +void cf_check disable_8259A_irq(struct irq_desc *desc) { _disable_8259A_irq(desc->irq); } -void enable_8259A_irq(struct irq_desc *desc) +void cf_check enable_8259A_irq(struct irq_desc *desc) { unsigned int mask = ~(1 << desc->irq); unsigned long flags; diff --git a/xen/arch/x86/include/asm/irq.h b/xen/arch/x86/include/asm/irq.h index b3f49abc5556..76e6ed6d60aa 100644 --- a/xen/arch/x86/include/asm/irq.h +++ b/xen/arch/x86/include/asm/irq.h @@ -111,8 +111,8 @@ void alloc_direct_apic_vector( void do_IRQ(struct cpu_user_regs *regs); -void disable_8259A_irq(struct irq_desc *); -void enable_8259A_irq(struct irq_desc *); +void cf_check disable_8259A_irq(struct irq_desc *); +void cf_check enable_8259A_irq(struct irq_desc *); int i8259A_irq_pending(unsigned int irq); void mask_8259A(void); void unmask_8259A(void); @@ -173,7 +173,7 @@ int create_irq(nodeid_t node, bool grant_access); void destroy_irq(unsigned int irq); int assign_irq_vector(int irq, const cpumask_t *); -extern void irq_complete_move(struct irq_desc *); +void cf_check irq_complete_move(struct irq_desc *); extern struct irq_desc *irq_desc; @@ -187,7 +187,7 @@ void move_masked_irq(struct irq_desc *); int bind_irq_vector(int irq, int vector, const cpumask_t *); -void end_nonmaskable_irq(struct irq_desc *, uint8_t vector); +void cf_check end_nonmaskable_irq(struct irq_desc *, uint8_t vector); void irq_set_affinity(struct irq_desc *, const cpumask_t *mask); int init_domain_irq_mapping(struct domain *); diff --git a/xen/arch/x86/include/asm/msi.h b/xen/arch/x86/include/asm/msi.h index e228b0f3f344..117379318f2c 100644 --- a/xen/arch/x86/include/asm/msi.h +++ b/xen/arch/x86/include/asm/msi.h @@ -247,10 +247,10 @@ void early_msi_init(void); void msi_compose_msg(unsigned vector, const cpumask_t *mask, struct msi_msg *msg); void __msi_set_enable(u16 seg, u8 bus, u8 slot, u8 func, int pos, int enable); -void mask_msi_irq(struct irq_desc *); -void unmask_msi_irq(struct irq_desc *); +void cf_check mask_msi_irq(struct irq_desc *); +void cf_check unmask_msi_irq(struct irq_desc *); void guest_mask_msi_irq(struct irq_desc *, bool mask); -void ack_nonmaskable_msi_irq(struct irq_desc *); -void set_msi_affinity(struct irq_desc *, const cpumask_t *); +void cf_check ack_nonmaskable_msi_irq(struct irq_desc *); +void cf_check set_msi_affinity(struct irq_desc *, const cpumask_t *); #endif /* __ASM_MSI_H */ diff --git a/xen/arch/x86/io_apic.c b/xen/arch/x86/io_apic.c index 4c5eaef86273..c086f40f6314 100644 --- a/xen/arch/x86/io_apic.c +++ b/xen/arch/x86/io_apic.c @@ -473,7 +473,7 @@ static void __level_IO_APIC_irq (unsigned int irq) modify_IO_APIC_irq(irq, IO_APIC_REDIR_LEVEL_TRIGGER, 0); } -static void mask_IO_APIC_irq(struct irq_desc *desc) +static void cf_check mask_IO_APIC_irq(struct irq_desc *desc) { unsigned long flags; @@ -482,7 +482,7 @@ static void mask_IO_APIC_irq(struct irq_desc *desc) spin_unlock_irqrestore(&ioapic_lock, flags); } -static void unmask_IO_APIC_irq(struct irq_desc *desc) +static void cf_check unmask_IO_APIC_irq(struct irq_desc *desc) { unsigned long flags; @@ -567,7 +567,7 @@ static void clear_IO_APIC (void) } } -static void +static void cf_check set_ioapic_affinity_irq(struct irq_desc *desc, const cpumask_t *mask) { unsigned int dest; @@ -1547,7 +1547,7 @@ static int __init timer_irq_works(void) * This is not complete - we should be able to fake * an edge even if it isn't on the 8259A... */ -static unsigned int startup_edge_ioapic_irq(struct irq_desc *desc) +static unsigned int cf_check startup_edge_ioapic_irq(struct irq_desc *desc) { int was_pending = 0; unsigned long flags; @@ -1569,7 +1569,7 @@ static unsigned int startup_edge_ioapic_irq(struct irq_desc *desc) * interrupt for real. This prevents IRQ storms from unhandled * devices. */ -static void ack_edge_ioapic_irq(struct irq_desc *desc) +static void cf_check ack_edge_ioapic_irq(struct irq_desc *desc) { irq_complete_move(desc); move_native_irq(desc); @@ -1594,7 +1594,7 @@ static void ack_edge_ioapic_irq(struct irq_desc *desc) * generic IRQ layer and by the fact that an unacked local * APIC does not accept IRQs. */ -static unsigned int startup_level_ioapic_irq(struct irq_desc *desc) +static unsigned int cf_check startup_level_ioapic_irq(struct irq_desc *desc) { unmask_IO_APIC_irq(desc); @@ -1652,7 +1652,7 @@ static bool io_apic_level_ack_pending(unsigned int irq) return 0; } -static void mask_and_ack_level_ioapic_irq(struct irq_desc *desc) +static void cf_check mask_and_ack_level_ioapic_irq(struct irq_desc *desc) { unsigned long v; int i; @@ -1702,7 +1702,7 @@ static void mask_and_ack_level_ioapic_irq(struct irq_desc *desc) } } -static void end_level_ioapic_irq_old(struct irq_desc *desc, u8 vector) +static void cf_check end_level_ioapic_irq_old(struct irq_desc *desc, u8 vector) { if ( directed_eoi_enabled ) { @@ -1723,7 +1723,7 @@ static void end_level_ioapic_irq_old(struct irq_desc *desc, u8 vector) unmask_IO_APIC_irq(desc); } -static void end_level_ioapic_irq_new(struct irq_desc *desc, u8 vector) +static void cf_check end_level_ioapic_irq_new(struct irq_desc *desc, u8 vector) { /* * It appears there is an erratum which affects at least version 0x11 @@ -1807,7 +1807,7 @@ static inline void init_IO_APIC_traps(void) make_8259A_irq(irq); } -static void enable_lapic_irq(struct irq_desc *desc) +static void cf_check enable_lapic_irq(struct irq_desc *desc) { unsigned long v; @@ -1815,7 +1815,7 @@ static void enable_lapic_irq(struct irq_desc *desc) apic_write(APIC_LVT0, v & ~APIC_LVT_MASKED); } -static void disable_lapic_irq(struct irq_desc *desc) +static void cf_check disable_lapic_irq(struct irq_desc *desc) { unsigned long v; @@ -1823,7 +1823,7 @@ static void disable_lapic_irq(struct irq_desc *desc) apic_write(APIC_LVT0, v | APIC_LVT_MASKED); } -static void ack_lapic_irq(struct irq_desc *desc) +static void cf_check ack_lapic_irq(struct irq_desc *desc) { ack_APIC_irq(); } diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index 61e09a356f97..285ac399fbfd 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -468,7 +468,7 @@ int __init init_irq_data(void) return 0; } -static void ack_none(struct irq_desc *desc) +static void cf_check ack_none(struct irq_desc *desc) { ack_bad_irq(desc->irq); } @@ -832,7 +832,7 @@ static void send_cleanup_vector(struct irq_desc *desc) desc->arch.move_in_progress = 0; } -void irq_complete_move(struct irq_desc *desc) +void cf_check irq_complete_move(struct irq_desc *desc) { unsigned vector, me; @@ -1086,7 +1086,7 @@ bool cpu_has_pending_apic_eoi(void) return pending_eoi_sp(this_cpu(pending_eoi)) != 0; } -void end_nonmaskable_irq(struct irq_desc *desc, uint8_t vector) +void cf_check end_nonmaskable_irq(struct irq_desc *desc, uint8_t vector) { struct pending_eoi *peoi = this_cpu(pending_eoi); unsigned int sp = pending_eoi_sp(peoi); diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c index 77a4fbf13f9f..b32b1378f84e 100644 --- a/xen/arch/x86/msi.c +++ b/xen/arch/x86/msi.c @@ -241,7 +241,7 @@ static int write_msi_msg(struct msi_desc *entry, struct msi_msg *msg) return 0; } -void set_msi_affinity(struct irq_desc *desc, const cpumask_t *mask) +void cf_check set_msi_affinity(struct irq_desc *desc, const cpumask_t *mask) { struct msi_msg msg; unsigned int dest; @@ -416,14 +416,14 @@ static int msi_get_mask_bit(const struct msi_desc *entry) return -1; } -void mask_msi_irq(struct irq_desc *desc) +void cf_check mask_msi_irq(struct irq_desc *desc) { if ( unlikely(!msi_set_mask_bit(desc, 1, desc->msi_desc->msi_attrib.guest_masked)) ) BUG_ON(!(desc->status & IRQ_DISABLED)); } -void unmask_msi_irq(struct irq_desc *desc) +void cf_check unmask_msi_irq(struct irq_desc *desc) { if ( unlikely(!msi_set_mask_bit(desc, 0, desc->msi_desc->msi_attrib.guest_masked)) ) @@ -435,26 +435,26 @@ void guest_mask_msi_irq(struct irq_desc *desc, bool mask) msi_set_mask_bit(desc, desc->msi_desc->msi_attrib.host_masked, mask); } -static unsigned int startup_msi_irq(struct irq_desc *desc) +static unsigned int cf_check startup_msi_irq(struct irq_desc *desc) { if ( unlikely(!msi_set_mask_bit(desc, 0, !!(desc->status & IRQ_GUEST))) ) WARN(); return 0; } -static void shutdown_msi_irq(struct irq_desc *desc) +static void cf_check shutdown_msi_irq(struct irq_desc *desc) { if ( unlikely(!msi_set_mask_bit(desc, 1, 1)) ) BUG_ON(!(desc->status & IRQ_DISABLED)); } -void ack_nonmaskable_msi_irq(struct irq_desc *desc) +void cf_check ack_nonmaskable_msi_irq(struct irq_desc *desc) { irq_complete_move(desc); move_native_irq(desc); } -static void ack_maskable_msi_irq(struct irq_desc *desc) +static void cf_check ack_maskable_msi_irq(struct irq_desc *desc) { ack_nonmaskable_msi_irq(desc); ack_APIC_irq(); /* ACKTYPE_NONE */ diff --git a/xen/common/irq.c b/xen/common/irq.c index f42512db33b7..727cf8bd22da 100644 --- a/xen/common/irq.c +++ b/xen/common/irq.c @@ -27,15 +27,15 @@ int init_one_irq_desc(struct irq_desc *desc) return err; } -void no_action(int cpl, void *dev_id, struct cpu_user_regs *regs) +void cf_check no_action(int cpl, void *dev_id, struct cpu_user_regs *regs) { } -void irq_actor_none(struct irq_desc *desc) +void cf_check irq_actor_none(struct irq_desc *desc) { } -unsigned int irq_startup_none(struct irq_desc *desc) +unsigned int cf_check irq_startup_none(struct irq_desc *desc) { return 0; } diff --git a/xen/drivers/passthrough/amd/iommu_init.c b/xen/drivers/passthrough/amd/iommu_init.c index d2ad282e93d3..657c7f619a51 100644 --- a/xen/drivers/passthrough/amd/iommu_init.c +++ b/xen/drivers/passthrough/amd/iommu_init.c @@ -410,7 +410,7 @@ static void amd_iommu_msi_enable(struct amd_iommu *iommu, int flag) PCI_FUNC(iommu->bdf), iommu->msi.msi_attrib.pos, flag); } -static void iommu_msi_unmask(struct irq_desc *desc) +static void cf_check iommu_msi_unmask(struct irq_desc *desc) { unsigned long flags; struct amd_iommu *iommu = desc->action->dev_id; @@ -421,7 +421,7 @@ static void iommu_msi_unmask(struct irq_desc *desc) iommu->msi.msi_attrib.host_masked = 0; } -static void iommu_msi_mask(struct irq_desc *desc) +static void cf_check iommu_msi_mask(struct irq_desc *desc) { unsigned long flags; struct amd_iommu *iommu = desc->action->dev_id; @@ -434,13 +434,13 @@ static void iommu_msi_mask(struct irq_desc *desc) iommu->msi.msi_attrib.host_masked = 1; } -static unsigned int iommu_msi_startup(struct irq_desc *desc) +static unsigned int cf_check iommu_msi_startup(struct irq_desc *desc) { iommu_msi_unmask(desc); return 0; } -static void iommu_msi_end(struct irq_desc *desc, u8 vector) +static void cf_check iommu_msi_end(struct irq_desc *desc, u8 vector) { iommu_msi_unmask(desc); end_nonmaskable_irq(desc, vector); @@ -458,14 +458,14 @@ static hw_irq_controller iommu_msi_type = { .set_affinity = set_msi_affinity, }; -static unsigned int iommu_maskable_msi_startup(struct irq_desc *desc) +static unsigned int cf_check iommu_maskable_msi_startup(struct irq_desc *desc) { iommu_msi_unmask(desc); unmask_msi_irq(desc); return 0; } -static void iommu_maskable_msi_shutdown(struct irq_desc *desc) +static void cf_check iommu_maskable_msi_shutdown(struct irq_desc *desc) { mask_msi_irq(desc); iommu_msi_mask(desc); @@ -489,7 +489,8 @@ static hw_irq_controller iommu_maskable_msi_type = { .set_affinity = set_msi_affinity, }; -static void set_x2apic_affinity(struct irq_desc *desc, const cpumask_t *mask) +static void cf_check set_x2apic_affinity( + struct irq_desc *desc, const cpumask_t *mask) { struct amd_iommu *iommu = desc->action->dev_id; unsigned int dest = set_desc_affinity(desc, mask); diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index fc3ff064b692..c05670eb68a8 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1128,7 +1128,7 @@ static void cf_check iommu_page_fault( tasklet_schedule(&vtd_fault_tasklet); } -static void dma_msi_unmask(struct irq_desc *desc) +static void cf_check dma_msi_unmask(struct irq_desc *desc) { struct vtd_iommu *iommu = desc->action->dev_id; unsigned long flags; @@ -1143,7 +1143,7 @@ static void dma_msi_unmask(struct irq_desc *desc) iommu->msi.msi_attrib.host_masked = 0; } -static void dma_msi_mask(struct irq_desc *desc) +static void cf_check dma_msi_mask(struct irq_desc *desc) { unsigned long flags; struct vtd_iommu *iommu = desc->action->dev_id; @@ -1158,26 +1158,27 @@ static void dma_msi_mask(struct irq_desc *desc) iommu->msi.msi_attrib.host_masked = 1; } -static unsigned int dma_msi_startup(struct irq_desc *desc) +static unsigned int cf_check dma_msi_startup(struct irq_desc *desc) { dma_msi_unmask(desc); return 0; } -static void dma_msi_ack(struct irq_desc *desc) +static void cf_check dma_msi_ack(struct irq_desc *desc) { irq_complete_move(desc); dma_msi_mask(desc); move_masked_irq(desc); } -static void dma_msi_end(struct irq_desc *desc, u8 vector) +static void cf_check dma_msi_end(struct irq_desc *desc, u8 vector) { dma_msi_unmask(desc); end_nonmaskable_irq(desc, vector); } -static void dma_msi_set_affinity(struct irq_desc *desc, const cpumask_t *mask) +static void cf_check dma_msi_set_affinity( + struct irq_desc *desc, const cpumask_t *mask) { struct msi_msg msg; unsigned int dest; diff --git a/xen/include/xen/irq.h b/xen/include/xen/irq.h index 43d567fe445c..d8beadd16b9f 100644 --- a/xen/include/xen/irq.h +++ b/xen/include/xen/irq.h @@ -116,9 +116,9 @@ extern int request_irq(unsigned int irq, unsigned int irqflags, const char * devname, void *dev_id); extern hw_irq_controller no_irq_type; -extern void no_action(int cpl, void *dev_id, struct cpu_user_regs *regs); -extern unsigned int irq_startup_none(struct irq_desc *); -extern void irq_actor_none(struct irq_desc *); +void cf_check no_action(int cpl, void *dev_id, struct cpu_user_regs *regs); +unsigned int cf_check irq_startup_none(struct irq_desc *); +void cf_check irq_actor_none(struct irq_desc *); #define irq_shutdown_none irq_actor_none #define irq_disable_none irq_actor_none #define irq_enable_none irq_actor_none From patchwork Mon Feb 14 12:51:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745567 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 79E0AC4332F for ; Mon, 14 Feb 2022 13:06:36 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271719.466408 (Exim 4.92) (envelope-from ) id 1nJb3i-0001TO-BV; Mon, 14 Feb 2022 13:06:26 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271719.466408; Mon, 14 Feb 2022 13:06:26 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3h-0001PB-Eu; Mon, 14 Feb 2022 13:06:25 +0000 Received: by outflank-mailman (input) for mailman id 271719; Mon, 14 Feb 2022 13:06:22 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2y-0008IH-J3 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:40 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ce48bf03-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:39 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ce48bf03-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843938; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=tpbBQsuMzZyq6LzFUh1145Bs01ZMNWBvog9FT8SWVF0=; b=RmJHp55foSegsmV2b9mRd/BDKgcL3Mea9FQmwQwdx/ifgMiY/U9WUrvF MNuRLtM4cDtOoLXGuybezIIBY2LB+HIZ6x47ZWsDFifI4prdOLDjd1yqg T3PGZ3TmvFzENvqbeNfHcIB/g+n+ddW4W1CU9H4O1jg/CO5z7CCrkOgL8 Q=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 4q+4l8ZC+4wl7Vru7sNrarw+ORF5dGXlfgKV9IUx8+NDQ86Nwv58/Pugh9w6SNG5x2bzuj1Sp1 BcS0Frn3gJhOxcUdHnLTykY1vCz5Jo5YJIjM1UMm9mPqsKcQqbAagWxdV2cKwIeGXrAGGQMcf5 Rxd2RDa2ih/QQlXz0NmK5eitb+1754V8qOS0YnjxUYN7QdmZ+q3fHj9Epeb1Zjlz5qfy5wIfH3 RnB+SbCt4GKFEdqK1HNqUQLmZckI+Fv35yvm22/rEfDUY6d7T4S4QAzrkuUYoeoJ6dxRlbF1fC SCUT8Mn7Kjr2aGHRg9LmgtHR X-SBRS: 5.1 X-MesageID: 63592646 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Hgl8Xq8MsvGHeZib+lalDrUDnnmTJUtcMsCJ2f8bNWPcYEJGY0x3m zZMDzjQa/eMMTDzftkia9ux9kMAuJOHyIJqTwFqqis8E34SpcT7XtnIdU2Y0wF+jyHgoOCLy +1EN7Es+ehtFie0Si9AttENlFEkvU2ybuOU5NXsZ2YhFWeIdA970Ug5w7Rg3tYx6TSEK1jlV e3a8pW31GCNg1aYAkpMg05UgEoy1BhakGpwUm0WPZinjneH/5UmJMt3yZWKB2n5WuFp8tuSH I4v+l0bElTxpH/BAvv9+lryn9ZjrrT6ZWBigVIOM0Sub4QrSoXfHc/XOdJFAXq7hQllkPht2 PZEq7KJSzwyZJPsletefjdpAjlXaPguFL/veRBTsOSWxkzCNXDt3+9vHAc9OohwFuRfWD8Us 6ZCcXZUM07F17neLLGTE4GAguwKKsXxMZxZkXZn1TzDVt4tQIzZQrWM7thdtNs1rp4VQKeEO ZZHAdZpRFfRYTd3HFsGMZYBhr7rmkanTTxokU3A8MLb5ECMlVcsgdABKuH9atGMAMlYgEucj mbH5HjiRAEXMsSFzjiI+W7qgfXA9R4XQ6pLSuf+rKQzxgTOmCpDU3X6SGdXv9Glmm23RfxmK XcPoBQOoKdx2WKaX8HUCkjQTGG/gjYQXN9ZEusf4Q6Ly7bJ7wvxOlXoXgKte/R96pZoGGVCO kuh2oqwWGcx6OH9pWe1q+/MxQ5eLxT5OoPricUsaQIeq+fur4go5v4kZoYySfXl5jEZ9NyZ/ txrkMTcr+hJ5SLo///ilbwiv95LjsKXJjPZHi2NAgqYAvpRPeZJnbCA51nB9upnJ42EVFSHt 3Vss5HAsLxRXcHQyXTUG79l8FSVCxGtamO0vLKSN8N5q2TFF4CLIei8Hw2S1G82a51ZKFcFk WfYuB9L5Y87AZdZRfQfXm5FMOxzlfKIPY28Dpj8N4MSCrAsJF7v1Hw/Pia4gjGy+HXAZIliY P93h+73Vi1EYUmmpRLrL9ogPUgDmHxvmzOLHcqjp/lluJLHDEOopX4+GAPmRogEAGms+W05K v5TaJmHzQtxSur7bnWF+IIfNwlSf3M6GYr3u4pccevaelhqH2QoCvnwx7I9etM6w/QJx7mQp nztCFVFzFffhGHcLVnYYH5Ud76yD410qmg2PHJwMA/wiWQje4um8IwWa4AzIes87OVmwPMtF 6sFdsyMD+5hUDPC/zhBP5DxoJY7LEaghB6UPjrjaz86JsYySwvM897iXw3u6ChRUXbn6Zpg+ +Wtj1qJT4ACSgJuCNftRMiul17h72IAnO9SXlfTJoUBckvb74U3eTf6ieU6Ip9QJEyblCeaz QufHTwRufLJ/90u6NDMiK2J89WpHu95EhYIFmXX9+/rZyzT/27lyo5cSueYOzvaUTqsqqmlY OxUydD6MeEGwwkW49YtTe4zwPJs/cbrqp9b0h9gTSfCYFmcA799JmWLgJtUvapXy74F4Qa7V ypjIDWB1Wll7C89LGMsGQ== IronPort-HdrOrdr: A9a23:7NURPq2rKbbF8K3JVS1OHAqjBLAkLtp133Aq2lEZdPRUGvb3qy nOpoVj6faaslYssR0b9exofZPwJE80lqQFh7X5X43SPzUO0VHAROoJgLcKgQeQfxEWntQtsp uIGJIeNDSfNzdHZL7BkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592646" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 52/70] x86/apei: CFI hardening Date: Mon, 14 Feb 2022 12:51:09 +0000 Message-ID: <20220214125127.17985-53-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/drivers/acpi/apei/apei-base.c | 32 ++++++++++---------- xen/drivers/acpi/apei/apei-internal.h | 20 ++++++------ xen/drivers/acpi/apei/erst.c | 57 +++++++++++++++++------------------ 3 files changed, 54 insertions(+), 55 deletions(-) diff --git a/xen/drivers/acpi/apei/apei-base.c b/xen/drivers/acpi/apei/apei-base.c index 6f81e7fa366a..de75c1cef992 100644 --- a/xen/drivers/acpi/apei/apei-base.c +++ b/xen/drivers/acpi/apei/apei-base.c @@ -80,8 +80,8 @@ int __apei_exec_read_register(struct acpi_whea_header *entry, u64 *val) return 0; } -int apei_exec_read_register(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +int cf_check apei_exec_read_register( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 val = 0; @@ -94,8 +94,8 @@ int apei_exec_read_register(struct apei_exec_context *ctx, return 0; } -int apei_exec_read_register_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +int cf_check apei_exec_read_register_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; @@ -126,14 +126,14 @@ int __apei_exec_write_register(struct acpi_whea_header *entry, u64 val) return rc; } -int apei_exec_write_register(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +int cf_check apei_exec_write_register( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_write_register(entry, ctx->value); } -int apei_exec_write_register_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +int cf_check apei_exec_write_register_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; @@ -143,8 +143,8 @@ int apei_exec_write_register_value(struct apei_exec_context *ctx, return rc; } -int apei_exec_noop(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +int cf_check apei_exec_noop( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return 0; } @@ -230,9 +230,9 @@ static int __init apei_exec_for_each_entry(struct apei_exec_context *ctx, return 0; } -static int __init pre_map_gar_callback(struct apei_exec_context *ctx, - struct acpi_whea_header *entry, - void *data) +static int __init cf_check pre_map_gar_callback( + struct apei_exec_context *ctx, struct acpi_whea_header *entry, + void *data) { u8 ins = entry->instruction; @@ -259,9 +259,9 @@ int __init apei_exec_pre_map_gars(struct apei_exec_context *ctx) return rc; } -static int __init post_unmap_gar_callback(struct apei_exec_context *ctx, - struct acpi_whea_header *entry, - void *data) +static int __init cf_check post_unmap_gar_callback( + struct apei_exec_context *ctx, struct acpi_whea_header *entry, + void *data) { u8 ins = entry->instruction; diff --git a/xen/drivers/acpi/apei/apei-internal.h b/xen/drivers/acpi/apei/apei-internal.h index b813d55b92a9..360e94b9c877 100644 --- a/xen/drivers/acpi/apei/apei-internal.h +++ b/xen/drivers/acpi/apei/apei-internal.h @@ -68,16 +68,16 @@ static inline int apei_exec_run_optional(struct apei_exec_context *ctx, u8 actio int __apei_exec_read_register(struct acpi_whea_header *entry, u64 *val); int __apei_exec_write_register(struct acpi_whea_header *entry, u64 val); -int apei_exec_read_register(struct apei_exec_context *ctx, - struct acpi_whea_header *entry); -int apei_exec_read_register_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry); -int apei_exec_write_register(struct apei_exec_context *ctx, - struct acpi_whea_header *entry); -int apei_exec_write_register_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry); -int apei_exec_noop(struct apei_exec_context *ctx, - struct acpi_whea_header *entry); +int cf_check apei_exec_read_register( + struct apei_exec_context *ctx, struct acpi_whea_header *entry); +int cf_check apei_exec_read_register_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry); +int cf_check apei_exec_write_register( + struct apei_exec_context *ctx, struct acpi_whea_header *entry); +int cf_check apei_exec_write_register_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry); +int cf_check apei_exec_noop( + struct apei_exec_context *ctx, struct acpi_whea_header *entry); int apei_exec_pre_map_gars(struct apei_exec_context *ctx); int apei_exec_post_unmap_gars(struct apei_exec_context *ctx); diff --git a/xen/drivers/acpi/apei/erst.c b/xen/drivers/acpi/apei/erst.c index c5df512b9838..40d8f00270d0 100644 --- a/xen/drivers/acpi/apei/erst.c +++ b/xen/drivers/acpi/apei/erst.c @@ -114,40 +114,40 @@ static int erst_timedout(u64 *t, u64 spin_unit) return 0; } -static int erst_exec_load_var1(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_load_var1( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_read_register(entry, &ctx->var1); } -static int erst_exec_load_var2(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_load_var2( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_read_register(entry, &ctx->var2); } -static int erst_exec_store_var1(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_store_var1( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_write_register(entry, ctx->var1); } -static int erst_exec_add(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_add( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { ctx->var1 += ctx->var2; return 0; } -static int erst_exec_subtract(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_subtract( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { ctx->var1 -= ctx->var2; return 0; } -static int erst_exec_add_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_add_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 val; @@ -160,8 +160,8 @@ static int erst_exec_add_value(struct apei_exec_context *ctx, return rc; } -static int erst_exec_subtract_value(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_subtract_value( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 val; @@ -174,8 +174,8 @@ static int erst_exec_subtract_value(struct apei_exec_context *ctx, return rc; } -static int erst_exec_stall(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_stall( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { udelay((ctx->var1 > FIRMWARE_MAX_STALL) ? FIRMWARE_MAX_STALL : @@ -183,8 +183,8 @@ static int erst_exec_stall(struct apei_exec_context *ctx, return 0; } -static int erst_exec_stall_while_true(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_stall_while_true( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 val; @@ -205,9 +205,8 @@ static int erst_exec_stall_while_true(struct apei_exec_context *ctx, return 0; } -static int erst_exec_skip_next_instruction_if_true( - struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_skip_next_instruction_if_true( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 val; @@ -223,27 +222,27 @@ static int erst_exec_skip_next_instruction_if_true( return 0; } -static int erst_exec_goto(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_goto( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { ctx->ip = ctx->value; return APEI_EXEC_SET_IP; } -static int erst_exec_set_src_address_base(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_set_src_address_base( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_read_register(entry, &ctx->src_base); } -static int erst_exec_set_dst_address_base(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_set_dst_address_base( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { return __apei_exec_read_register(entry, &ctx->dst_base); } -static int erst_exec_move_data(struct apei_exec_context *ctx, - struct acpi_whea_header *entry) +static int cf_check erst_exec_move_data( + struct apei_exec_context *ctx, struct acpi_whea_header *entry) { int rc; u64 offset; From patchwork Mon Feb 14 12:51:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745555 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1F0A5C433EF for ; Mon, 14 Feb 2022 13:06:21 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271699.466313 (Exim 4.92) (envelope-from ) id 1nJb3U-0006sc-Em; Mon, 14 Feb 2022 13:06:12 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271699.466313; Mon, 14 Feb 2022 13:06:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3U-0006sV-AM; Mon, 14 Feb 2022 13:06:12 +0000 Received: by outflank-mailman (input) for mailman id 271699; Mon, 14 Feb 2022 13:06:10 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2w-0008IH-Gb for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:38 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id cca26c48-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:37 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: cca26c48-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843937; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=4s3bqHzDxRb3sy7KdmJzYNLlBSeOBXvCKtFlSSrGjpU=; b=CNQti08JLvQqrEccupWdbSo4PoWSm6HyuOiA0tIeLcYMW3e6yssqWxs6 BQ/8Pzm6vFyCpmbEmaeSrxiPD2a54nJ2TUvCv1PQRdLWvjuEbdQy9GPCG M/VCPbyZq5fX4Xr8ePjAleJO/mJFI+t2q0IeB27st3rTZ/8eX032eFL0U s=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: f2121Ej7+AAryE+M4fZWH1sR0wMYOCIhdRvvy2ee7nTBRUsqxx5mjG8EbvYG4ULwFfybOvLzbz beP00bjVaLt/VtFJzjTyvZxYhAyG7ll6LAv4CYHiKlMN9+b1Z/ArXOVKRZlGGYEH4A6222Bv5N av+ofoiIdA7KRlEpTArzl6qgbe/FppWbw232UDgJg5Plhb3Pf5OhXLeAygJc+jXn98UcMWq611 qRWN282hkenzj0c21G4XpvgibLK9ZOr4OWjwA75o7vALoYEZwP23PvJJ7+4v5JeyZ/FVIg5NRp 8sFJ+H3wcz2l0helDOTJup3R X-SBRS: 5.1 X-MesageID: 63592636 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:LIOa8qPhWI2Yj+vvrR27kMFynXyQoLVcMsEvi/4bfWQNrUoggzYPm 2dMWD2DbKmJYzf8f9ogPoqwo0tXuZ6Ay9IwGgto+SlhQUwRpJueD7x1DKtR0wB+jCHnZBg6h ynLQoCYdKjYdpJYz/uUGuCJQUNUjMlkfZKhTr6UUsxNbVU8En1500s/w7dRbrNA2rBVPSvc4 bsenOWHULOV82Yc3rU8sv/rRLtH5ZweiRtA1rAMTakjUGz2zhH5OKk3N6CpR0YUd6EPdgKMq 0Qv+5nilo/R109F5tpICd8XeGVSKlLZFVDmZna7x8FOK/WNz8A/+v9TCRYSVatYoy2swOFS4 8Vyibmfaj0DP7zIp80bfBYNRkmSPYUekFPGCX22sMjVxEzaaXr8hf5pCSnaP6VBpLwxWzsXs 6VFdnZdNXhvhMrvqF6/YsBqit4uM4/AO4QHt2s75TrYEewnUdbIRKCiCdpwgmxt15oQRqi2i 8wxVT8yUQr4ZUZzfUYoKooCvsCqmn/kbGgNwL6SjfVuuDWCpOBr65D9PdyQdtGUSMF9mkeDu nmA72n/GgsdNtGU1XyC6H3EuwPUtXqlAsRITuT+r6M0xg3IroAONPEIfUOe/siaoV6BZ/dwC HY++zsqkoE020P+G7ERQCaEiHKDuxcdXf9ZHOs79ByBx8Lo3uqJOoQXZmUfMYJ77afaURRvj wbUxI2xWVSDpZXIESr1y1uCkd+l1cH5x0cmbDRMcwYK6sKLTGob3kOWFYYL/EJYY7TI9dDML 9Ki8XJWa1Y715djO0CHEbfv2WzEm3QxZlRpjjg7p0r8hu+DWKarZpaz9X/Q5utaIYCSQzGp5 SZYx5fOvL1TVcjWzkRhpdnh+5nzuZ643MD02wYzT/HNCRzxk5JcQWygyG4nfxo4Wir1UTTof FXSqWtsCGx7ZxOXgVtMS9vpUawClPG4ffy8D6y8RoceM/BZKV7clAkzNBH44owYuBV1+U3JE czAKpjE4LdzIfkP8QdasM9Dje51lnhmnzu7qFKS503P7IdyrUW9Ed8tWGZipMhghE9diAmKo dtZKeWQzBBTDL/3biXNqNZBJlEWN3krQ5vxrpUPJOKEJwNnHkAnCuPQnux9K9A0wfwNm7ea5 Gy5V29Z1EH72S/NJzKVZy0xc7joR5t+8y42ZHR+IVay1nE/So+z96NDJYAvdLwq+bU7n/55R vUIYeuaBfFLRmiV8jgRd8Cl/odjaA6qlUSFOC/8OGozeJtpRgro/N74f1SwqHlSX3Tv7cZn+ u+uzALWR5YHVj9ONseOZaL91U61sFgchPl2AxnCLO5MdRi+64NtMSHw0KM6epleNRXZyzKG/ A+KGhNE9/LVqoo4/dSV16CJq4ClT7l3EkZARjSJ6L+3MW/R/3a5wJ8GW+GNJGiPWGTx8aSkR ONU0/Cjb6FXwAcU69JxQ+Rx0KYzx9rzvLsLnA1rEULCY0mvFr49cGKN2tNCt/EVy7JU0edst pljJjWO1W21Bf7Y IronPort-HdrOrdr: A9a23:a2X9Z6MLL114acBcTsOjsMiBIKoaSvp037Eqv3oedfU1SL3gqy nAppQmPHPP5Ar5HUtQ/OxoW5PwJ080l6QFgrX5VI3KNGKN1VdAbrsSibcKqweQfBEWndQ96U 4PScdD4aXLfDpHsfo= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592636" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 53/70] x86/psr: CFI hardening Date: Mon, 14 Feb 2022 12:51:10 +0000 Message-ID: <20220214125127.17985-54-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/psr.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c index 6c9cabf3843d..ccb761998f9a 100644 --- a/xen/arch/x86/psr.c +++ b/xen/arch/x86/psr.c @@ -282,7 +282,7 @@ static enum psr_feat_type psr_type_to_feat_type(enum psr_type type) } /* Implementation of allocation features' functions. */ -static bool cat_check_cbm(const struct feat_node *feat, uint32_t *val) +static bool cf_check cat_check_cbm(const struct feat_node *feat, uint32_t *val) { unsigned int first_bit, zero_bit; unsigned int cbm_len = feat->cat.cbm_len; @@ -417,8 +417,8 @@ static bool mba_init_feature(const struct cpuid_leaf *regs, return true; } -static bool cat_get_feat_info(const struct feat_node *feat, - uint32_t data[], unsigned int array_len) +static bool cf_check cat_get_feat_info( + const struct feat_node *feat, uint32_t data[], unsigned int array_len) { if ( array_len != PSR_INFO_ARRAY_SIZE ) return false; @@ -431,8 +431,8 @@ static bool cat_get_feat_info(const struct feat_node *feat, } /* L3 CAT props */ -static void l3_cat_write_msr(unsigned int cos, uint32_t val, - enum psr_type type) +static void cf_check l3_cat_write_msr( + unsigned int cos, uint32_t val, enum psr_type type) { wrmsrl(MSR_IA32_PSR_L3_MASK(cos), val); } @@ -447,8 +447,8 @@ static const struct feat_props l3_cat_props = { }; /* L3 CDP props */ -static bool l3_cdp_get_feat_info(const struct feat_node *feat, - uint32_t data[], uint32_t array_len) +static bool cf_check l3_cdp_get_feat_info( + const struct feat_node *feat, uint32_t data[], uint32_t array_len) { if ( !cat_get_feat_info(feat, data, array_len) ) return false; @@ -458,8 +458,8 @@ static bool l3_cdp_get_feat_info(const struct feat_node *feat, return true; } -static void l3_cdp_write_msr(unsigned int cos, uint32_t val, - enum psr_type type) +static void cf_check l3_cdp_write_msr( + unsigned int cos, uint32_t val, enum psr_type type) { wrmsrl(((type == PSR_TYPE_L3_DATA) ? MSR_IA32_PSR_L3_MASK_DATA(cos) : @@ -478,8 +478,8 @@ static const struct feat_props l3_cdp_props = { }; /* L2 CAT props */ -static void l2_cat_write_msr(unsigned int cos, uint32_t val, - enum psr_type type) +static void cf_check l2_cat_write_msr( + unsigned int cos, uint32_t val, enum psr_type type) { wrmsrl(MSR_IA32_PSR_L2_MASK(cos), val); } @@ -494,8 +494,8 @@ static const struct feat_props l2_cat_props = { }; /* MBA props */ -static bool mba_get_feat_info(const struct feat_node *feat, - uint32_t data[], unsigned int array_len) +static bool cf_check mba_get_feat_info( + const struct feat_node *feat, uint32_t data[], unsigned int array_len) { ASSERT(array_len == PSR_INFO_ARRAY_SIZE); @@ -508,13 +508,14 @@ static bool mba_get_feat_info(const struct feat_node *feat, return true; } -static void mba_write_msr(unsigned int cos, uint32_t val, - enum psr_type type) +static void cf_check mba_write_msr( + unsigned int cos, uint32_t val, enum psr_type type) { wrmsrl(MSR_IA32_PSR_MBA_MASK(cos), val); } -static bool mba_sanitize_thrtl(const struct feat_node *feat, uint32_t *thrtl) +static bool cf_check mba_sanitize_thrtl( + const struct feat_node *feat, uint32_t *thrtl) { /* * Per SDM (chapter "Memory Bandwidth Allocation Configuration"): From patchwork Mon Feb 14 12:51:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745602 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 40032C433FE for ; Mon, 14 Feb 2022 13:18:02 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272042.466830 (Exim 4.92) (envelope-from ) id 1nJbEm-0002ez-5Q; Mon, 14 Feb 2022 13:17:52 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272042.466830; Mon, 14 Feb 2022 13:17:52 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEm-0002ek-1n; Mon, 14 Feb 2022 13:17:52 +0000 Received: by outflank-mailman (input) for mailman id 272042; Mon, 14 Feb 2022 13:17:50 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3R-0008IH-Dn for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:09 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id def9e9d4-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:08 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: def9e9d4-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843968; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=mFvh8LG+XymZDQVBuCKArEEiktD2ZTkwHy0DqtzmEhk=; b=UVWEpIzyDoSzng5L+mIBPrePXtxu3PZoDGyrO7HPubasTzzHBkH9usbg l2ROrPT/QGEULeEok9JXh2gV2oGdrSA/L/LFGpctrS9jNf+h4ItUPRs/m vDEEHRxnEJbV8q0NcKb9dvCsUe2HQiaiDolLhvRYQ0JQNAHfytVw86jHX A=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: yT49laUGTy2FPkWCwaShby2MY0ToeoCCIQuyMvF44JSS9XAcDhMs+yZ8VRkS3Nd7NZucpcdiSL 9vVdx6JPWeSgo8fPAuRrmIpklv/7kNnySqAD0r2v9+2rnpscPqc5fp104/qdqF8x6LqDjxauGt 3Yw934Z8mDX3QmhBb4mopnokFI97vzquXHup/uP7TJwrJvntHF1Zveo48WhygRHUGBsfzhdGIC ipXkTj8xkPTsC/XyGfW+8o2n9gZlhzbDrCSg4gbCYYz8EHAg5cvs6fPdIg/mGMycIwcukHPOqU QwsTLaleUhH87CQRGznchgbT X-SBRS: 5.1 X-MesageID: 64149443 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:xRFYU6AF6B/3ghVW/zfkw5YqxClBgxIJ4kV8jS/XYbTApDt2gmRVz DBOWW+EPf6NZGHyKot0PdzkoBkBv8OGx95kQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/ij+2gux3x Oh0q6PgWC0KFILStMYhekwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgG5s15wSRp4yY eJeeSNjfhLnSiEVAUw6M64Eg+KxhlzwJmgwRFW9+vNsvjm7IBZK+KjgNp/Zd8KHQe1Rn12Ev STW8mLhGBYYOdeDjz2f/RqRavTnxH2hHthITfvhq6As0Ab7KnEv5AM+VFGEvMW/hnOHRe0PO mY30AUwgYoO3Rn+JjXiZCGQrHmBtx8aftNfFewm9Q2AopbpDxal6nssFWAYNoF/3CMibXlzj wLSwYu1bdB6mODNERqgGqGoQSRe0MT/BUsLfmc6QAQM+LEPS6lj30uUHr6P/ENY5+AZ+A0cI RjX9kDSZJ1J1KbnMplXGnid3VqRSmDhFFJd2+kudjvNAvlFTICkfZe0zlPQ8OxNKo2UJnHY4 iRYxJjOsb1WVMrX/MBofAnqNOv3j8tpzRWG2QI/d3Xf32jFF4GfkXB4v2gleRYB3jcscj71e k7D0T69F7cIVEZGmZRfOtrrY+xzlPCIPY28Cpj8M4ofCrAsJVTv1Hw/OiatM5XFzRFEfVcXY szAL65BzB8yVMxa8dZBb7lBgOF7nnhknQs+h/nTlnya7FZXX1bNIZ9tDbdERrpRAHqsrFqH/ tBBGdGNzhkDAuTybjOOqdwYLEwQLGh9Dpfz8pQFeumGKwtgOWcgF/6Onu9xJ907x/xYxrXS4 3Wwek5E016j13fJHhqHNyJ4Y7T1UJch8X9iZX4wPUyl0mQIaJq06PtNbIM+eLQqrbQxzfN9Q /QfVd+HB/BDFmbO9zgHNMGvp41+bhW7wwmJOnP9MjQ4epdhQS3P+8PlIVSzpHVfUHLvuJJn8 bO61w7dTZ4SfChYDZ7bOKC10le8nXkBg+YuDUHGFcZeJRf3+49wJi2v0vJue5MQKQ/Ozyex3 hqNBUtKvvHEpoI4/YWbha2AqIv1QeJyElADQjve5LeycyLb4nCi0clLV+PRJWLRU2b9+aODY +RJzq6jbK1bzQgS64csQax2ya8e5sf0o+4IxwtpK3zHclC3B+4yOXKBx8RO6vVAy7IxVdFag a5TFg224Ym0Bf4= IronPort-HdrOrdr: A9a23:L+G3FKo5CUa6ZuEaM7ntZhsaV5opeYIsimQD101hICG8cqSj+f xG/c5rrCMc5wxwZJhNo7y90ey7MBbhHP1OkO8s1NWZLWrbUQKTRekIh+bfKn/baknDH4ZmpM BdmsNFaeEYY2IUsS+D2njbL+od X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149443" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 54/70] x86/dpci: CFI hardening Date: Mon, 14 Feb 2022 12:51:11 +0000 Message-ID: <20220214125127.17985-55-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/hvm/hvm.c | 4 ++-- xen/drivers/passthrough/vtd/x86/hvm.c | 4 ++-- xen/drivers/passthrough/x86/hvm.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 4cf313a0ad0a..cdd1529014f2 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -474,8 +474,8 @@ void hvm_migrate_pirq(struct hvm_pirq_dpci *pirq_dpci, const struct vcpu *v) } } -static int migrate_pirq(struct domain *d, struct hvm_pirq_dpci *pirq_dpci, - void *arg) +static int cf_check migrate_pirq( + struct domain *d, struct hvm_pirq_dpci *pirq_dpci, void *arg) { hvm_migrate_pirq(pirq_dpci, arg); diff --git a/xen/drivers/passthrough/vtd/x86/hvm.c b/xen/drivers/passthrough/vtd/x86/hvm.c index b531fe907a94..132d252d1cca 100644 --- a/xen/drivers/passthrough/vtd/x86/hvm.c +++ b/xen/drivers/passthrough/vtd/x86/hvm.c @@ -21,8 +21,8 @@ #include #include -static int _hvm_dpci_isairq_eoi(struct domain *d, - struct hvm_pirq_dpci *pirq_dpci, void *arg) +static int cf_check _hvm_dpci_isairq_eoi( + struct domain *d, struct hvm_pirq_dpci *pirq_dpci, void *arg) { struct hvm_irq *hvm_irq = hvm_domain_irq(d); unsigned int isairq = (long)arg; diff --git a/xen/drivers/passthrough/x86/hvm.c b/xen/drivers/passthrough/x86/hvm.c index 0e3c0f6aeed3..0f94203af817 100644 --- a/xen/drivers/passthrough/x86/hvm.c +++ b/xen/drivers/passthrough/x86/hvm.c @@ -777,8 +777,8 @@ static void __msi_pirq_eoi(struct hvm_pirq_dpci *pirq_dpci) } } -static int _hvm_dpci_msi_eoi(struct domain *d, - struct hvm_pirq_dpci *pirq_dpci, void *arg) +static int cf_check _hvm_dpci_msi_eoi( + struct domain *d, struct hvm_pirq_dpci *pirq_dpci, void *arg) { int vector = (long)arg; @@ -947,8 +947,8 @@ void hvm_dpci_eoi(struct domain *d, unsigned int guest_gsi) spin_unlock(&d->event_lock); } -static int pci_clean_dpci_irq(struct domain *d, - struct hvm_pirq_dpci *pirq_dpci, void *arg) +static int cf_check pci_clean_dpci_irq( + struct domain *d, struct hvm_pirq_dpci *pirq_dpci, void *arg) { struct dev_intx_gsi_link *digl, *tmp; From patchwork Mon Feb 14 12:51:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745570 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 57E78C433EF for ; Mon, 14 Feb 2022 13:06:46 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271739.466446 (Exim 4.92) (envelope-from ) id 1nJb3s-0003uR-Qv; Mon, 14 Feb 2022 13:06:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271739.466446; Mon, 14 Feb 2022 13:06:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3r-0003p0-UL; Mon, 14 Feb 2022 13:06:35 +0000 Received: by outflank-mailman (input) for mailman id 271739; Mon, 14 Feb 2022 13:06:33 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3F-00023t-HC for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:57 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id d8332ef6-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:55 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d8332ef6-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843956; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=EoLk9ARQfV08rXKWBWT/VxrxjsnGxFJXU/V2o57wTSM=; b=fA6FyD371rJHIbzeyFKoqTM0vvD2eAAyhdV8er5RWRxZW8XCx8N87CtJ mgSV69ZPf8yF3x6O+762ASYquyFHE9x7i6lwv6/wGMEghfolVfqE14dj1 sbNPGSxT62A23ROAJCslpuyyDDd+B3cL1/CKnWIAkZYyJog7AsJv+WDdH I=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: lwVxee2gONI8zybZijGPgtRb7S5JZ9rR8CHfg0ghaYoxu1E5N9tIvt91HWF+9OTv8XFLfKgO7I sGklG4QuNyuWBJRb7GUFbCvvrPewTUet58z1MlJJ4+lbLHr2rZo4uvi9H19dHhZhXDu+i2WFcb du2zGaMKUzOB1bYH7qaaAt6KZ91gHLgkteFKozfwjnDGudYqGKLiGB5CzGSwdJqM/tPPQUmyM9 EIYP7GhssMUXd5fqYC5X04ybu+vZSrLHzftQZGmHstgwt8EmmDoKN+oB/9SOlGseJgJ+GkJIfM H0WldQZPdzkqH90PtQKPTWa/ X-SBRS: 5.1 X-MesageID: 64149841 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:yJ9zh6wJaH9Z9ZFyhY96t+cowSrEfRIJ4+MujC+fZmUNrF6WrkUOz moeDzuCPqqNMTb1fdtzati/9UMPvZ7Vx4BmTgM4qSAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt+At9 vtjubzhchoOF/DGgc9eFDtYDxgraMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwXQaeOO 5NxhTxHSSryaUcSClorFpMshdiZjHemazYJpwfAzUYwyzeKl1EguFT3C/LFd9rPSchLk0Kwo mPd43+/EhwcLMaYyzeO7jSrnOCnoM/gcNtMTvvirKcs2QDNgDxIYPELabelicnltGCQV/IOE FEz03cktINxs26rUuCoCnVUv0W4lhIbXtNRFcgz5weM1rfY7m6lO4QUctJSQId47ZFrHFTGw nfMxoq0XmI37NV5XFrAru/8kN+kBcQCwYbujwcgRBBN3dTsqZpbYvnnHoc6S/7dYjEY9FjNL 9G2QMoW2u97YS0jjfzTEbX7b9WE/Mahc+LNzl+LNl9JFysgDGJfW6Sm6ELA8dFLJ5uDQ1+Ks RAswpbCsL9eXczQzHXWGo3h+Y1FAN7fblXhbaNHRcF9p1xBBVb/FWyv3N2ODBgwaZtVEdMYS ETSpRlQ9Pdu0IiCNsdKj3aKI51yl8DITI29PtiNN4YmSsUhJWevoXA1DWbNjj+FraTZufxmU XttWZ33Vihy5GUO5GfeetrxJpd1mn5glTmOGfgWDX2PiNKjWZJccp9dWHPmUwzzxPrsTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:6yYMhqsIzUgwOrs8iYRzYp6c7skDdNV00zEX/kB9WHVpmszxra 6TdZUgpGbJYVkqOE3I9ertBEDEewK4yXcX2/h2AV7BZniEhILAFugLhuGO/9SjIVybygc079 YGT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149841" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 55/70] x86/pt: CFI hardening Date: Mon, 14 Feb 2022 12:51:12 +0000 Message-ID: <20220214125127.17985-56-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/emul-i8254.c | 2 +- xen/arch/x86/hvm/hpet.c | 2 +- xen/arch/x86/hvm/rtc.c | 2 +- xen/arch/x86/hvm/vlapic.c | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/xen/arch/x86/emul-i8254.c b/xen/arch/x86/emul-i8254.c index d170f464d966..18894b63488e 100644 --- a/xen/arch/x86/emul-i8254.c +++ b/xen/arch/x86/emul-i8254.c @@ -156,7 +156,7 @@ static int pit_get_gate(PITState *pit, int channel) return pit->hw.channels[channel].gate; } -static void pit_time_fired(struct vcpu *v, void *priv) +static void cf_check pit_time_fired(struct vcpu *v, void *priv) { uint64_t *count_load_time = priv; TRACE_0D(TRC_HVM_EMUL_PIT_TIMER_CB); diff --git a/xen/arch/x86/hvm/hpet.c b/xen/arch/x86/hvm/hpet.c index ed512fa65b63..45c7b9b40688 100644 --- a/xen/arch/x86/hvm/hpet.c +++ b/xen/arch/x86/hvm/hpet.c @@ -219,7 +219,7 @@ static void hpet_stop_timer(HPETState *h, unsigned int tn, hpet_get_comparator(h, tn, guest_time); } -static void hpet_timer_fired(struct vcpu *v, void *data) +static void cf_check hpet_timer_fired(struct vcpu *v, void *data) { unsigned int tn = (unsigned long)data; HPETState *h = vcpu_vhpet(v); diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index ed397276faa3..d21925db08bc 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -81,7 +81,7 @@ static void rtc_update_irq(RTCState *s) /* Called by the VPT code after it's injected a PF interrupt for us. * Fix up the register state to reflect what happened. */ -static void rtc_pf_callback(struct vcpu *v, void *opaque) +static void cf_check rtc_pf_callback(struct vcpu *v, void *opaque) { RTCState *s = opaque; diff --git a/xen/arch/x86/hvm/vlapic.c b/xen/arch/x86/hvm/vlapic.c index d4e29ef1ff1d..49be9c8ea4fe 100644 --- a/xen/arch/x86/hvm/vlapic.c +++ b/xen/arch/x86/hvm/vlapic.c @@ -691,13 +691,13 @@ int guest_rdmsr_x2apic(const struct vcpu *v, uint32_t msr, uint64_t *val) return X86EMUL_OKAY; } -static void vlapic_pt_cb(struct vcpu *v, void *data) +static void cf_check vlapic_pt_cb(struct vcpu *v, void *data) { TRACE_0D(TRC_HVM_EMUL_LAPIC_TIMER_CB); *(s_time_t *)data = hvm_get_guest_time(v); } -static void vlapic_tdt_pt_cb(struct vcpu *v, void *data) +static void cf_check vlapic_tdt_pt_cb(struct vcpu *v, void *data) { *(s_time_t *)data = hvm_get_guest_time(v); vcpu_vlapic(v)->hw.tdt_msr = 0; From patchwork Mon Feb 14 12:51:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745577 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2021DC433EF for ; Mon, 14 Feb 2022 13:07:04 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271785.466525 (Exim 4.92) (envelope-from ) id 1nJb49-0007vs-Ox; Mon, 14 Feb 2022 13:06:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271785.466525; Mon, 14 Feb 2022 13:06:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb48-0007rv-KK; Mon, 14 Feb 2022 13:06:52 +0000 Received: by outflank-mailman (input) for mailman id 271785; Mon, 14 Feb 2022 13:06:50 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3G-00023t-Qp for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:58 +0000 Received: from esa3.hc3370-68.iphmx.com (esa3.hc3370-68.iphmx.com [216.71.145.155]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id d8de72df-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:56 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d8de72df-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843957; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=zYz6cPCtXWh7bl+DWwkU2uoiErkwKYQ2kvdgoIFv7rs=; b=YoJRgoZ0YXOZ/qMSM1UJdjRjRVSLpI5i987fERiIf/8Je+WKqvSf15+o lwtgxrpMZlIFY4iC+c6NG6MwxHoVxEPGuI7Pqyn3vyaOBEXqDg2K3IUd8 tOcf3WUMOQF5JLX9gNc363v3ZPM9YdfUebmM8q5sXULK3fbAs0QjD2XEC M=; Authentication-Results: esa3.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: Gf6TikuuGiZKt0BfoHzvjOEinQFQ60x15BazYMDXdwzhj/eEhUnlLCzXKxok+itIjouokdTk25 dxB+cl2r844OJqDEQJ37wNtZxG4Lyh1ocCNJcgVeVYM4DxOaLUjvou7nH8k/7Q7/MZ14dk5d9X nOlcX8r9zKWYmuttWWY/AeOEf4LC1DtftYSXucyHMLoxAhShcgwlo6fUTgyx5RktVTXxZmT2f3 K2relrdfYYjyrrgRwNr4mkyeYGBqrbeeNPgHC3ToHoCw804btSuBmAyWlejEWSvvCC2SC1cl7o lyU7j286x9nBF1xU1GdS+Jhc X-SBRS: 5.1 X-MesageID: 64149847 X-Ironport-Server: esa3.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:HoLt8qwRi5Aj8w1rFmF6t+cowSrEfRIJ4+MujC+fZmUNrF6WrkUPy jFLW2vVbP6JNzD0ed8kao7lpx9TsZTQm9E2HFFvpSAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt8FN1 I1iuZOCcl0KDpf1kes2bQFgSy4raMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwXQaeOO 5VxhTxHMA+dZwxXMFosFb1lruGWhXT2UR4BkQfAzUYwyzeKl1EguFT3C/LFd9rPSchLk0Kwo mPd43+/EhwcLMaYyzeO7jSrnOCnoM/gcNtMTvvirKcs2QDNgDxIYPELabelieiFlhaRV91tE BY3yhAXpKcZylSTFtaoCnVUv0W4lhIbXtNRFcgz5weM1rfY7m6lO4QUctJSQId47ZFrHFTGw nfMxoq0XmI37NV5XFrAru/8kN+kBcQCwYbujwcgRBBN3dTsqZpbYvnnHoc6S/7dYjEY9FjNL 9G2QMoW2u97YS0jjfzTEbX7b9WE/Mahc+LNzl+LNl9JFysgDGJfW6Sm6ELA8dFLJ5uDQ1+Ks RAswpbCsL9eXczQzHXWGo3h+Y1FAN7fblXhbaNHRcF9p1xBBVb/FWyv3N2ODBgwaZtVEdMYS ETSpRlQ9Pdu0IiCNsdKj3aKI51yl8DITI29PtiNN4YmSsUhJWevoXA1DWbNjj+FraTZufxmU XttWZ33Vihy5GUO5GfeetrxJpd1mn5glTmOGfgWDX2PiNKjWZJccp9dWHPmUwzzxPrsTNz9/ 4kNOs2U5Q9YVeGiMCDb/ZRKdQIBLGQhBICwoMtSL7bRLg1jEWAnKvnQ3bJ+JNA1w/ULzr/Fr iOnR0tV6Fvjnnmbew+EXW9uNeH0VpFloHNlYSF1ZQS022IuaJqE5bsEc8dlZqEu8eFulKYmT /QMd8iaLO5ITzDLp2YUYZXn9dQwfxW3nwOeeSGiZWFnLZJnQgXI/P7ifxfuq3ZSXnbm65Nmr uT5hA3BQJcFSwBzN+rsaaqinwGroHwQuONuRE+UcNNdT1rhrdpxICvrg/5pf8xVcUffxiGX3 hq9CAsDobWfuJc89dTEiPzWr4qtFOciTENWE3OCsOSzPCjeuGGi3ZVBQKCDejWEDDH4/6CrZ ON0yfDgMaJYwAYW4tQkS7s7n7gj49bPpqNBylU2FXrGWF2nF7d8LyTUxsJIrKBMmudUtAbet phjITWG1WFl4P/YLWM= IronPort-HdrOrdr: A9a23:wqj72q1gfsnh/TME+yQGOQqjBLAkLtp133Aq2lEZdPRUGvb3qy nOpoVj6faaslYssR0b9exofZPwJE80lqQFh7X5X43SPzUO0VHAROoJgLcKgQeQfxEWntQtsp uIGJIeNDSfNzdHZL7BkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149847" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 56/70] x86/time: CFI hardening Date: Mon, 14 Feb 2022 12:51:13 +0000 Message-ID: <20220214125127.17985-57-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/hpet.c | 8 ++++---- xen/arch/x86/include/asm/hpet.h | 4 ++-- xen/arch/x86/time.c | 33 +++++++++++++++++---------------- 3 files changed, 23 insertions(+), 22 deletions(-) diff --git a/xen/arch/x86/hpet.c b/xen/arch/x86/hpet.c index dcc9e16693e9..2b00c30d1153 100644 --- a/xen/arch/x86/hpet.c +++ b/xen/arch/x86/hpet.c @@ -196,7 +196,7 @@ static void evt_do_broadcast(cpumask_t *mask) cpumask_raise_softirq(mask, TIMER_SOFTIRQ); } -static void handle_hpet_broadcast(struct hpet_event_channel *ch) +static void cf_check handle_hpet_broadcast(struct hpet_event_channel *ch) { cpumask_t mask; s_time_t now, next_event; @@ -553,7 +553,7 @@ static void hpet_detach_channel(unsigned int cpu, void (*__read_mostly pv_rtc_handler)(uint8_t index, uint8_t value); -static void handle_rtc_once(uint8_t index, uint8_t value) +static void cf_check handle_rtc_once(uint8_t index, uint8_t value) { if ( index != RTC_REG_B ) return; @@ -566,7 +566,7 @@ static void handle_rtc_once(uint8_t index, uint8_t value) } } -void __init hpet_broadcast_init(void) +void __init cf_check hpet_broadcast_init(void) { u64 hpet_rate = hpet_setup(); u32 hpet_id, cfg; @@ -637,7 +637,7 @@ void __init hpet_broadcast_init(void) hpet_events->flags = HPET_EVT_LEGACY; } -void hpet_broadcast_resume(void) +void cf_check hpet_broadcast_resume(void) { u32 cfg; unsigned int i, n; diff --git a/xen/arch/x86/include/asm/hpet.h b/xen/arch/x86/include/asm/hpet.h index f343fe4740f1..9919f7473071 100644 --- a/xen/arch/x86/include/asm/hpet.h +++ b/xen/arch/x86/include/asm/hpet.h @@ -89,8 +89,8 @@ void hpet_disable_legacy_replacement_mode(void); * Temporarily use an HPET event counter for timer interrupt handling, * rather than using the LAPIC timer. Used for Cx state entry. */ -void hpet_broadcast_init(void); -void hpet_broadcast_resume(void); +void cf_check hpet_broadcast_init(void); +void cf_check hpet_broadcast_resume(void); void cf_check hpet_broadcast_enter(void); void cf_check hpet_broadcast_exit(void); int hpet_broadcast_is_available(void); diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c index 043be2a8ec1a..2a1758ebb33b 100644 --- a/xen/arch/x86/time.c +++ b/xen/arch/x86/time.c @@ -309,7 +309,7 @@ static uint64_t adjust_elapsed(uint64_t elapsed, uint32_t actual, * PLATFORM TIMER 1: PROGRAMMABLE INTERVAL TIMER (LEGACY PIT) */ -static u64 read_pit_count(void) +static u64 cf_check read_pit_count(void) { u16 count16; u32 count32; @@ -328,7 +328,7 @@ static u64 read_pit_count(void) return count32; } -static s64 __init init_pit(struct platform_timesource *pts) +static s64 __init cf_check init_pit(struct platform_timesource *pts) { u8 portb = inb(0x61); u64 start, end; @@ -366,7 +366,7 @@ static s64 __init init_pit(struct platform_timesource *pts) return (end - start) * CALIBRATE_FRAC; } -static void resume_pit(struct platform_timesource *pts) +static void cf_check resume_pit(struct platform_timesource *pts) { /* Set CTC channel 2 to mode 0 again; initial value does not matter. */ outb(0xb0, PIT_MODE); /* binary, mode 0, LSB/MSB, Ch 2 */ @@ -389,12 +389,12 @@ static struct platform_timesource __initdata plt_pit = * PLATFORM TIMER 2: HIGH PRECISION EVENT TIMER (HPET) */ -static u64 read_hpet_count(void) +static u64 cf_check read_hpet_count(void) { return hpet_read32(HPET_COUNTER); } -static int64_t __init init_hpet(struct platform_timesource *pts) +static int64_t __init cf_check init_hpet(struct platform_timesource *pts) { uint64_t hpet_rate, start; uint32_t count, target, elapsed; @@ -477,7 +477,7 @@ static int64_t __init init_hpet(struct platform_timesource *pts) return adjust_elapsed(rdtsc_ordered() - start, elapsed, target); } -static void resume_hpet(struct platform_timesource *pts) +static void cf_check resume_hpet(struct platform_timesource *pts) { hpet_resume(NULL); } @@ -502,12 +502,12 @@ unsigned int __initdata pmtmr_width; /* ACPI PM timer ticks at 3.579545 MHz. */ #define ACPI_PM_FREQUENCY 3579545 -static u64 read_pmtimer_count(void) +static u64 cf_check read_pmtimer_count(void) { return inl(pmtmr_ioport); } -static s64 __init init_pmtimer(struct platform_timesource *pts) +static s64 __init cf_check init_pmtimer(struct platform_timesource *pts) { uint64_t start; uint32_t count, target, mask, elapsed; @@ -562,7 +562,7 @@ static unsigned int __initdata tsc_flags; * Called in verify_tsc_reliability() under reliable TSC conditions * thus reusing all the checks already performed there. */ -static s64 __init init_tsc(struct platform_timesource *pts) +static s64 __init cf_check init_tsc(struct platform_timesource *pts) { u64 ret = pts->frequency; @@ -584,7 +584,7 @@ static s64 __init init_tsc(struct platform_timesource *pts) return ret; } -static u64 read_tsc(void) +static u64 cf_check read_tsc(void) { return rdtsc_ordered(); } @@ -626,7 +626,7 @@ static uint64_t xen_timer_cpu_frequency(void) return freq; } -static int64_t __init init_xen_timer(struct platform_timesource *pts) +static int64_t __init cf_check init_xen_timer(struct platform_timesource *pts) { if ( !xen_guest ) return 0; @@ -647,7 +647,7 @@ static always_inline uint64_t read_cycle(const struct vcpu_time_info *info, return info->system_time + offset; } -static uint64_t read_xen_timer(void) +static uint64_t cf_check read_xen_timer(void) { struct vcpu_time_info *info = &this_cpu(vcpu_info)->time; uint32_t version; @@ -676,7 +676,7 @@ static uint64_t read_xen_timer(void) return ret; } -static void resume_xen_timer(struct platform_timesource *pts) +static void cf_check resume_xen_timer(struct platform_timesource *pts) { write_atomic(&xen_timer_last, 0); } @@ -702,7 +702,8 @@ static struct platform_timesource __initdata plt_xen_timer = static struct ms_hyperv_tsc_page *hyperv_tsc; static struct page_info *hyperv_tsc_page; -static int64_t __init init_hyperv_timer(struct platform_timesource *pts) +static int64_t __init cf_check init_hyperv_timer( + struct platform_timesource *pts) { paddr_t maddr; uint64_t tsc_msr, freq; @@ -745,7 +746,7 @@ static int64_t __init init_hyperv_timer(struct platform_timesource *pts) return freq; } -static uint64_t read_hyperv_timer(void) +static uint64_t cf_check read_hyperv_timer(void) { uint64_t scale, ret, tsc; int64_t offset; @@ -1721,7 +1722,7 @@ time_calibration_rendezvous_tail(const struct calibration_rendezvous *r, * Keep TSCs in sync when they run at the same rate, but may stop in * deep-sleep C states. */ -static void time_calibration_tsc_rendezvous(void *_r) +static void cf_check time_calibration_tsc_rendezvous(void *_r) { int i; struct calibration_rendezvous *r = _r; From patchwork Mon Feb 14 12:51:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745544 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8EE14C433F5 for ; Mon, 14 Feb 2022 13:04:59 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271643.466187 (Exim 4.92) (envelope-from ) id 1nJb29-0000AN-8B; Mon, 14 Feb 2022 13:04:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271643.466187; Mon, 14 Feb 2022 13:04:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb28-00009Q-WD; Mon, 14 Feb 2022 13:04:49 +0000 Received: by outflank-mailman (input) for mailman id 271643; Mon, 14 Feb 2022 13:04:47 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb27-0008IH-U8 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:04:47 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id ad5bf47e-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:46 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ad5bf47e-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843886; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=Hp8XnKkx9GSqf6AkS0zSNG6Qc1BDd2mSHAJ1CWLZ67A=; b=KEYNINcKXbCFcUlAb0rtyySzGDIHasWKWDgM1YVcXkLuJysbnOhBKttp BtTmfQeIkk3O5jh6BdPpz7ZvP3xmAurWb5l40Yf8n7vD0N4/FY4Joyo0O wAHPV+dApsf8HWCalLWMKBy9XrWpvdzgc8K+Brhs0jOWA2RKo/l4iszi3 U=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: b8XcuBXMKkkieRBqBxoKX2f/U+w8fBkueBB1uchr00ZLQ782fgivKa4VtfsQdZ0i8DAAwG1kMo DAsIros95B0kTCDCojtIurVtZNbSi0ObYHFMjR6fLElE48qLIiTEbjONBFVdhx5IBDkPEMjgEQ WqzRhnQ3RxJPUvMrpREyjJpfyhISYfvCp3yyxHbTGbjJDQImQL6OlTUuQxAvG7E3jnbOBRpE06 LW3acygO/i7zV3Qn0oP2Y/l8ZQvpImBGYQv0pyLbO7EmYogBnLDEMo1VQosH5qv4Ilm8QTpZhT LRossTjr23IIqbplcHVWydFX X-SBRS: 5.1 X-MesageID: 64149314 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:MGNz2K04BID6lCN9PvbD5cx2kn2cJEfYwER7XKvMYLTBsI5bpzUHy GQfCGHTO6uPZWXzft0nYdu0oElQuZeDzIVqSVE6pC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhpftT4 e1Jk7aKZBo3LI2Wl+FMXxtqKnQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u2pkSTK2HO 6L1bxJDUz/KbwV3HWxIEY5gw+Sxmnn9fiBh/Qf9Sa0fvDGIkV0ZPKLWGMrYfJmGSNtYmm6cp 3na5CLpDxcCLtudxDGZtHW2iYfycTjTAdxIUufir7gz3QPVljd75AAquUWTm9Kbo3a6ffhlB lEK6Ap0oq1j+E6Zd4yoN/Gnm0KsshkZUttWNuQ17gCR16bZizqk6ng4oi1pM4J/6pJvLdA+/ hrQxo6yW2Qz2FGAYS/Frt+pQSWO1T/5xIPoTQsNVkM77tbqu+nfZTqfH484QMZZYjAYcAwcI gxmTgBj3d3/buZRjs1XGGwrZBr2+PD0ovYdvFm/Y45cxloRiHSZT4Kp80PHyv1LMZyUSFKM1 FBdxZTCs7BeUMzVzXfXKAnoIF1Oz6zbWAAwfHY1R8Vxn9hT0yLLkX9sDMFWex4yb5dslc7Ba 07PowJBjKK/z1PxBZKbl7mZUpxwpYC5TIyNfqmNMrJmP8ggHCfarXoGTRPBgAjQfL0EzPhX1 WGzKp33Ux73yM1PkVKLegvq+eF3mH5unz6PLX05pjz+uYejiLeuYe9tGDOzgioRtstoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:yGHfJ6lbxd44LP+EGVWInaMw9+7pDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149314" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 57/70] x86/misc: CFI hardening Date: Mon, 14 Feb 2022 12:51:14 +0000 Message-ID: <20220214125127.17985-58-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/extable.c | 4 ++-- xen/common/efi/boot.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/extable.c b/xen/arch/x86/extable.c index 51ef863d786c..4d1875585f9d 100644 --- a/xen/arch/x86/extable.c +++ b/xen/arch/x86/extable.c @@ -23,7 +23,7 @@ static inline unsigned long ex_cont(const struct exception_table_entry *x) return EX_FIELD(x, cont); } -static int init_or_livepatch cmp_ex(const void *a, const void *b) +static int init_or_livepatch cf_check cmp_ex(const void *a, const void *b) { const struct exception_table_entry *l = a, *r = b; unsigned long lip = ex_addr(l); @@ -37,7 +37,7 @@ static int init_or_livepatch cmp_ex(const void *a, const void *b) return 0; } -static void init_or_livepatch swap_ex(void *a, void *b, size_t size) +static void init_or_livepatch cf_check swap_ex(void *a, void *b, size_t size) { struct exception_table_entry *l = a, *r = b, tmp; long delta = b - a; diff --git a/xen/common/efi/boot.c b/xen/common/efi/boot.c index f31f68fd4cd1..4dd5ea6a0602 100644 --- a/xen/common/efi/boot.c +++ b/xen/common/efi/boot.c @@ -1497,7 +1497,7 @@ static __init void copy_mapping(unsigned long mfn, unsigned long end, unmap_domain_page(l3dst); } -static bool __init ram_range_valid(unsigned long smfn, unsigned long emfn) +static bool __init cf_check ram_range_valid(unsigned long smfn, unsigned long emfn) { unsigned long sz = pfn_to_pdx(emfn - 1) / PDX_GROUP_COUNT + 1; @@ -1506,7 +1506,7 @@ static bool __init ram_range_valid(unsigned long smfn, unsigned long emfn) pfn_to_pdx(smfn) / PDX_GROUP_COUNT) < sz; } -static bool __init rt_range_valid(unsigned long smfn, unsigned long emfn) +static bool __init cf_check rt_range_valid(unsigned long smfn, unsigned long emfn) { return true; } From patchwork Mon Feb 14 12:51:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745557 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 154FEC433EF for ; Mon, 14 Feb 2022 13:06:24 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271707.466336 (Exim 4.92) (envelope-from ) id 1nJb3W-0007Js-Pa; Mon, 14 Feb 2022 13:06:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271707.466336; Mon, 14 Feb 2022 13:06:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3W-0007IL-AW; Mon, 14 Feb 2022 13:06:14 +0000 Received: by outflank-mailman (input) for mailman id 271707; Mon, 14 Feb 2022 13:06:12 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3D-0008IH-Cm for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:55 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d730742f-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:53 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d730742f-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843953; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=6nZ3O0wdLsQ8m8lXwVCWVEgPWujRaX5DsONJatSODKA=; b=G9ZJpayqO9bP82hoaP0FhIAwhSLDB5uKXAieVBXZm7zOHef4mzK1qcTw oJVASdUoWjm3dCI1ytz2mgoToabfmS+KTXPkaxVd9ftJquU+QP7LUQR26 cuLX2E6oSpOSbqgD1mIAUB1Cs1EzlkzrDbhtyHoA3XEJc481YXRmWsPdW s=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: GQTUxjXdtz64efFHYVYqhkT4VKeUQpZMdJCuq4Sb/IRQJEhcxYbZOMG5zuSpK645tT5EPt4UUR h5HMv3hPz+8PdBFGIRSI9kt7ds36n3JCKgmzfC74Q5jjjwe0pSYJ8koiTnWj2fD5k7uaM8Roy0 I2C6maIxHplB5oayzM4Dx57jP9AreX1BodhVgNKItg7KwvhlhtEGXBm5CYlvuBYVPj4v86s3cE sSBnEXysYO/P8DnHqxw+6TKbYWCV/j1VYU7HdbSl0MFi2BO6IRfUaWxE3rbMB9QEzMkdv7MfGR tC/lcu5OYTWxui7SX00mD8iC X-SBRS: 5.1 X-MesageID: 66374919 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:vmvu3ajx16L7aG6g1ayRceUaX161fhcKZh0ujC45NGQN5FlHY01je htvUT/Sb/2CazeneNslPo+/o04AvpbQy99jSwVqqXtmRXwb9cadCdqndUqhZCn6wu8v7a5EA 2fyTvGacajYm1eF/k/F3oAMKRCQ7InQLlbGILes1htZGEk0GE/NtTo5w7Rj2tQx3YDga++wk YiaT/P3aQfNNwFcagr424rbwP+4lK2v0N+wlgVWicFj5DcypVFMZH4sDfjZw0/DaptVBoaHq 9Prl9lVyI97EyAFUbtJmp6jGqEDryW70QKm0hK6UID66vROS7BbPg/W+5PwZG8O4whlkeydx /12kpCxcwVwM5TCs+EcUERSSRg5MPdZreqvzXiX6aR/zmXDenrohf5vEFs3LcsT/eMf7WNmr KJCbmpXN1ba2rzwkOnTpupE36zPKOHCOo8Ft24m5jbeFfs8GrjIQrnQ5M8e1zA17ixLNaiAP JVFOGM+BPjGSzsTfVkIFYo7oN6LqGWgaiRVrFOQjpNitgA/yyQuieOwYbI5YOeiVchT20qVu G/C12D4GQ0BcsySzyKf9XChjfOJmjn0ML/+D5XhqKQs2gfKgDVOVltGDjNXvMVVlGaFfN5eE U5N9xMghq0z9xGhFOC6Uken9SvsUgEnZ/JcFOgz6Qeow6XS4hqECmVscgOteODKp+dtG2V0i wbhc8fBQGU27ebLES71GqK88GvqURX5O1PucsPtoeEtx9D46L8+gRvUJjqIOP7k14alcd0cL t3jkcTfu1nxpZNRv0lY1Qqe695JmnQuZlRrjjg7pkr/smtEiHeNPuREE2Tz4/daN5q+RVKcp nUCkMX2xLlQUc3SxHzQHb1UR+vBCxO53Nr02wAHInXc3271py7LkX54vFmS23uFwu5bIGS0M Sc/SCta5YNJPWvCUEOES9nZNije9oC5TY6NfqmNNrJmO8EtHCfarHAGTRPBhAjFzRlz+ZzTz L/GKK5A+15BUv85pNd3Ls9AuYIWKtcWmz+CG8Cjl07/uVdcDVbMIYo43JK1RrhRxMu5TM/9q r6z7uOGlEdSVvPQeC7S/dJBJFwGNyFjV5v3t9ZWZqiIJQ8/QDMtDPrYwLUAfY15nvsKyreUr y/lAkIImkDigXDnKBmRbiwxYr3YQpsi/2kwOjYhPAj01iF7M5qv9qoWa7A+YaIjqL541fdxQ vRcI5eAD/1DRy7p4TMYaZWh/oVueA7y3VCFPja/YSh5dJllHlSb9tjhdwrp1S8PEivo6pdu/ +z+jlvWGMNRSR5jAcDabOOU42mw5XVNyvhvW0boI8VIfBm++oZdNCGs3OQ8JNsBKEufy2LCh RqWGxoRucLEv5QxrIvSnamBooqkT7l+E05dEzWJ5Lq6L3CHrG+qwIsGW+eUZzHNEmjz/fz6N +lSyvj9NtwBnUpL7NUgQ+o6k/pm6ou9vaJewyRlAG7PPgaiBb5XK3Wb2dVC6/9WzbhDtArqA k+C97G241lS1B8JxLLJGDcYUw== IronPort-HdrOrdr: A9a23:2JFdqKOAtl1h+8BcTsWjsMiBIKoaSvp037Eqv3oRdfU1SL3hqy nApoV56faZslkssTQb6LS90cq7MArhHPxOkOss1N6ZNWGM0gbFEGgh1/qE/9SJIVyZygc378 ddmsZFZuEYdWIK6PrH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374919" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 58/70] x86/stack: CFI hardening Date: Mon, 14 Feb 2022 12:51:15 +0000 Message-ID: <20220214125127.17985-59-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. The function typecheck in switch_stack_and_jump() is incompatible with control flow typechecking. It's ok for reset_stack_and_jump_ind(), but for reset_stack_and_jump(), it would force us to ENDBR64 the targets which are branched to directly. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- v2: * Extend reset_stack_and_jump_ind() with ({ }) --- xen/arch/x86/domain.c | 6 +++--- xen/arch/x86/hvm/svm/svm.c | 6 +++--- xen/arch/x86/hvm/vmx/vmcs.c | 2 +- xen/arch/x86/hvm/vmx/vmx.c | 8 ++++---- xen/arch/x86/include/asm/current.h | 6 ++++-- xen/arch/x86/include/asm/hvm/vmx/vmx.h | 2 +- xen/arch/x86/include/asm/pv/domain.h | 4 ++-- xen/arch/x86/pv/domain.c | 2 +- xen/arch/x86/x86_64/entry.S | 1 + 9 files changed, 20 insertions(+), 17 deletions(-) diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c index ae7c88b51af1..afccc1525f8b 100644 --- a/xen/arch/x86/domain.c +++ b/xen/arch/x86/domain.c @@ -132,7 +132,7 @@ void play_dead(void) dead_idle(); } -static void noreturn idle_loop(void) +static void noreturn cf_check idle_loop(void) { unsigned int cpu = smp_processor_id(); /* @@ -1790,7 +1790,7 @@ static void save_segments(struct vcpu *v) } } -void paravirt_ctxt_switch_from(struct vcpu *v) +void cf_check paravirt_ctxt_switch_from(struct vcpu *v) { save_segments(v); @@ -1804,7 +1804,7 @@ void paravirt_ctxt_switch_from(struct vcpu *v) write_debugreg(7, 0); } -void paravirt_ctxt_switch_to(struct vcpu *v) +void cf_check paravirt_ctxt_switch_to(struct vcpu *v) { root_pgentry_t *root_pgt = this_cpu(root_pgt); diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c index dedb2848e6a1..63535a74b504 100644 --- a/xen/arch/x86/hvm/svm/svm.c +++ b/xen/arch/x86/hvm/svm/svm.c @@ -944,7 +944,7 @@ static inline void svm_tsc_ratio_load(struct vcpu *v) wrmsrl(MSR_AMD64_TSC_RATIO, hvm_tsc_scaling_ratio(v->domain)); } -static void svm_ctxt_switch_from(struct vcpu *v) +static void cf_check svm_ctxt_switch_from(struct vcpu *v) { int cpu = smp_processor_id(); @@ -969,7 +969,7 @@ static void svm_ctxt_switch_from(struct vcpu *v) enable_each_ist(idt_tables[cpu]); } -static void svm_ctxt_switch_to(struct vcpu *v) +static void cf_check svm_ctxt_switch_to(struct vcpu *v) { struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; int cpu = smp_processor_id(); @@ -996,7 +996,7 @@ static void svm_ctxt_switch_to(struct vcpu *v) wrmsr_tsc_aux(v->arch.msrs->tsc_aux); } -static void noreturn svm_do_resume(void) +static void noreturn cf_check svm_do_resume(void) { struct vcpu *v = current; struct vmcb_struct *vmcb = v->arch.hvm.svm.vmcb; diff --git a/xen/arch/x86/hvm/vmx/vmcs.c b/xen/arch/x86/hvm/vmx/vmcs.c index 60b506ac3f40..e1e1fa14e65e 100644 --- a/xen/arch/x86/hvm/vmx/vmcs.c +++ b/xen/arch/x86/hvm/vmx/vmcs.c @@ -1865,7 +1865,7 @@ void vmx_vmentry_failure(void) void noreturn vmx_asm_do_vmentry(void); -void vmx_do_resume(void) +void cf_check vmx_do_resume(void) { struct vcpu *v = current; bool_t debug_state; diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c index 2c4804f9b884..41db538a9e3d 100644 --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -63,8 +63,8 @@ static bool_t __initdata opt_force_ept; boolean_param("force-ept", opt_force_ept); -static void vmx_ctxt_switch_from(struct vcpu *v); -static void vmx_ctxt_switch_to(struct vcpu *v); +static void cf_check vmx_ctxt_switch_from(struct vcpu *v); +static void cf_check vmx_ctxt_switch_to(struct vcpu *v); static int alloc_vlapic_mapping(void); static void vmx_install_vlapic_mapping(struct vcpu *v); @@ -907,7 +907,7 @@ static void cf_check vmx_fpu_leave(struct vcpu *v) } } -static void vmx_ctxt_switch_from(struct vcpu *v) +static void cf_check vmx_ctxt_switch_from(struct vcpu *v) { /* * Return early if trying to do a context switch without VMX enabled, @@ -939,7 +939,7 @@ static void vmx_ctxt_switch_from(struct vcpu *v) vmx_pi_switch_from(v); } -static void vmx_ctxt_switch_to(struct vcpu *v) +static void cf_check vmx_ctxt_switch_to(struct vcpu *v) { vmx_restore_guest_msrs(v); vmx_restore_dr(v); diff --git a/xen/arch/x86/include/asm/current.h b/xen/arch/x86/include/asm/current.h index dc0edd9ed07d..da5e152a10cc 100644 --- a/xen/arch/x86/include/asm/current.h +++ b/xen/arch/x86/include/asm/current.h @@ -173,7 +173,6 @@ unsigned long get_stack_dump_bottom (unsigned long sp); #define switch_stack_and_jump(fn, instr, constr) \ ({ \ unsigned int tmp; \ - (void)((fn) == (void (*)(void))NULL); \ BUILD_BUG_ON(!ssaj_has_attr_noreturn(fn)); \ __asm__ __volatile__ ( \ SHADOW_STACK_WORK \ @@ -198,7 +197,10 @@ unsigned long get_stack_dump_bottom (unsigned long sp); /* The constraint may only specify non-call-clobbered registers. */ #define reset_stack_and_jump_ind(fn) \ - switch_stack_and_jump(fn, "INDIRECT_JMP %", "b") + ({ \ + (void)((fn) == (void (*)(void))NULL); \ + switch_stack_and_jump(fn, "INDIRECT_JMP %", "b"); \ + }) /* * Which VCPU's state is currently running on each CPU? diff --git a/xen/arch/x86/include/asm/hvm/vmx/vmx.h b/xen/arch/x86/include/asm/hvm/vmx/vmx.h index 5284fe931f62..c2ebdd6864a5 100644 --- a/xen/arch/x86/include/asm/hvm/vmx/vmx.h +++ b/xen/arch/x86/include/asm/hvm/vmx/vmx.h @@ -93,7 +93,7 @@ typedef enum { void vmx_asm_vmexit_handler(struct cpu_user_regs); void vmx_intr_assist(void); -void noreturn vmx_do_resume(void); +void noreturn cf_check vmx_do_resume(void); void vmx_vlapic_msr_changed(struct vcpu *v); struct hvm_emulate_ctxt; void vmx_realmode_emulate_one(struct hvm_emulate_ctxt *hvmemul_ctxt); diff --git a/xen/arch/x86/include/asm/pv/domain.h b/xen/arch/x86/include/asm/pv/domain.h index 6b16da9d187b..924508bbb4f0 100644 --- a/xen/arch/x86/include/asm/pv/domain.h +++ b/xen/arch/x86/include/asm/pv/domain.h @@ -118,8 +118,8 @@ static inline void pv_set_reg(struct vcpu *v, unsigned int reg, uint64_t val) #endif /* CONFIG_PV */ -void paravirt_ctxt_switch_from(struct vcpu *v); -void paravirt_ctxt_switch_to(struct vcpu *v); +void cf_check paravirt_ctxt_switch_from(struct vcpu *v); +void cf_check paravirt_ctxt_switch_to(struct vcpu *v); #endif /* __X86_PV_DOMAIN_H__ */ diff --git a/xen/arch/x86/pv/domain.c b/xen/arch/x86/pv/domain.c index 55146c15c853..f94f28c8e271 100644 --- a/xen/arch/x86/pv/domain.c +++ b/xen/arch/x86/pv/domain.c @@ -351,7 +351,7 @@ void pv_domain_destroy(struct domain *d) FREE_XENHEAP_PAGE(d->arch.pv.gdt_ldt_l1tab); } -void noreturn continue_pv_domain(void); +void noreturn cf_check continue_pv_domain(void); int pv_domain_initialise(struct domain *d) { diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 3eaf0e67b2b9..8494b97a54a2 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -625,6 +625,7 @@ ENTRY(dom_crash_sync_extable) /* No special register assumptions. */ #ifdef CONFIG_PV ENTRY(continue_pv_domain) + ENDBR64 call check_wakeup_from_wait ret_from_intr: GET_CURRENT(bx) From patchwork Mon Feb 14 12:51:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745569 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 19197C433F5 for ; Mon, 14 Feb 2022 13:06:46 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271731.466439 (Exim 4.92) (envelope-from ) id 1nJb3q-0003Mm-KJ; Mon, 14 Feb 2022 13:06:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271731.466439; Mon, 14 Feb 2022 13:06:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3p-0003FZ-GA; Mon, 14 Feb 2022 13:06:33 +0000 Received: by outflank-mailman (input) for mailman id 271731; Mon, 14 Feb 2022 13:06:31 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb38-0008IH-Mh for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:50 +0000 Received: from esa4.hc3370-68.iphmx.com (esa4.hc3370-68.iphmx.com [216.71.155.144]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id d3c4e5f6-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:49 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: d3c4e5f6-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843949; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=1inRFtu44sj2FbmOrmiHpNybEEC6ccoHhKdjBehHxfA=; b=EQIVzqD8N8DjsM7KCw7d1bcdufAa+IKfggxH2Xf3RKSm9cwuj+FrPl6q 6iMCWgoOElO6lcQtnMrs9Faa2StsGojcQiiVenDeIHkt+wJZLNuiVQgO1 svGu0bEyiaks7xf7hZCNH8flborxkdkKJNfwT+pojRydwTSwOs2Rl2qL8 s=; Authentication-Results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: 8IUVSPeiRFZz83MSk0IJGHorStZHdFjdSElCrSoUa8Hl/9CwbUlVIF6FmSEIoHxfUUUD5/PVjI SLN86+5RLAVveE4g0QGIaglQm9kyG75cZkKAxmSJGkMWFsKm6lWfSBWgdVpZkbtcTBn1HJ/a2n wvsSAxuwNIulKX7b+C+j0mBB397Ih+VITXxr4CojUMVv5X5x+DMbpX/Iz00607j+fSnJphbxHL L/QLFX+Bfrvh8WpTE9Te09+5nKoEcfvz3+dX6cv1rPt82rwtPaMOi+JicD0m5wIBYMvVOaJhY0 wvkHi2QCEBGMyJpZ2+DYp8U6 X-SBRS: 5.1 X-MesageID: 66374885 X-Ironport-Server: esa4.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:KmOZM6588DpZukW6csGsAgxRtCHAchMFZxGqfqrLsTDasY5as4F+v jcaC2mDP/vcM2v8et8ka4jloU4Bu5Pcmt4wTQo9qywzHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z7 s9A9rb3eAcTMKjDiMYaUEhUIh1uBPgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQ62BO 5pJNFKDajyZRSFiNF4QLqg9s8KtjWnteBRE9l6a8P9fD2/7k1UqjemF3MDuUsyHQ4BZk1iVo krC/n/lGVcKOdqH0z2H/3mwwOjVkkvGtJk6TePisKQw2RvKmzJVWEZ+uUaHTeeRrFSzGPgYG kwu9C8hvYo19x2nf+XtZkjtyJKbhSI0V91VGuw8zQiCzKvI/gqUblQ5oi59hM8O75FvG2Fzv rOdt5awXGE07uXJIZ6I3urM9VuP1T4pwXjujMPuZS8M+JHdrY46lXojpf4zQffu3rUZ9dwdq g1mTRTSZZ1O16bnNI3hpDgrZg5AQbCTEGYICv3/BD7N0++ATNfNi3aUwVba9+1cC42SU0OMu nMJ8+DHsrxSUsHdyXHVGb5XdF1M2xpiGGeC6WOD4rF7r2j9k5JdVdw4DM5CyLdBbZ9fJG6Bj L77sgJN/p5DVEZGnocsC79d//8ClPC6ffy8D6i8RoMXPvBZKV/WlAkzNBX49z28zyARfVQXZ M7znTCEVi1BV8yKDVOeGo8g7FPc7n5ilD2DHcihl3xKE9O2PRaodFvMC3PWBshR0U9OiFyKm zqGH8fVmRhZTsPkZSzbrdwaIVwQdCBpDpHqsc1HMOWEJ1M+Sm0mDvbQx5InepBkwPsJxruZo CnlVx8K0kf7iF3GNR6ONiJpZoTwUMsttnk8JyEtYwqlgiBxfYa14a4DXJIrZr17pvd7xPt5Q qBdKcWNC/hCUBrd/DEZYcWvpYBubk3z1wmPIzCkcH40eJs5H17F/drtfw3O8igSD3Xo6Zti8 uP4jg6CGMgNXQVvCsrSecmD9VLpsChPgv92UmvJPsJXJBfm/r91JnGjlfQwOcwNd0nOn2PIy waMDB4EjuDRuItposLRjKWJoor1QetzGk1WQzvS4bqsbHSI+2OixclLUfqSfCCbX2Txof3wa eJQxvD6EfsGgFcV7NYsT+c1lfozt4n1urtX7gV4B3GaPV2kB4RpLmSCwcQS5LZGwaVUuFfuV 0+CkjWA1W5l5C8x/IYtGTcY IronPort-HdrOrdr: A9a23:ou0Nl6hTl85HVVmm6S3OW8D4GXBQXt4ji2hC6mlwRA09TySZ// rOoB17726NtN9/YgBCpTntAsa9qDbnhPpICOoqTM6ftWvdyQmVxehZhOOIqVCNJ8S9zJ876U 4JSdkZNDSaNzhHZKjBjjVQa+xQpeW6zA== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="66374885" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 59/70] x86/bugframe: CFI hardening Date: Mon, 14 Feb 2022 12:51:16 +0000 Message-ID: <20220214125127.17985-60-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. run_in_exception_handler() managed to escape typechecking, as the compiler can't see where function pointer gets called. After adding some ad-hoc typechecking, it turns out that dump_execution_state() alone differs in const-ness from the other users of run_in_exception_handler(). Introduce a new show_execution_state_nonconst() to make the typechecking happy. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich --- xen/arch/x86/include/asm/bug.h | 10 +++++++++- xen/arch/x86/include/asm/processor.h | 4 +++- xen/arch/x86/traps.c | 5 +++++ xen/common/keyhandler.c | 4 ++-- xen/drivers/char/ehci-dbgp.c | 2 +- xen/drivers/char/ns16550.c | 2 +- xen/include/xen/lib.h | 2 +- 7 files changed, 22 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/include/asm/bug.h b/xen/arch/x86/include/asm/bug.h index 9bb4a194202f..b7265bdfbe33 100644 --- a/xen/arch/x86/include/asm/bug.h +++ b/xen/arch/x86/include/asm/bug.h @@ -65,7 +65,15 @@ struct bug_frame { unreachable(); \ } while (0) -#define run_in_exception_handler(fn) BUG_FRAME(BUGFRAME_run_fn, 0, fn, 0, NULL) +/* + * TODO: untangle header dependences, break BUILD_BUG_ON() out of xen/lib.h, + * and use a real static inline here to get proper type checking of fn(). + */ +#define run_in_exception_handler(fn) \ + do { \ + (void)((fn) == (void (*)(struct cpu_user_regs *))NULL); \ + BUG_FRAME(BUGFRAME_run_fn, 0, fn, 0, NULL); \ + } while ( 0 ) #define assert_failed(msg) do { \ BUG_FRAME(BUGFRAME_assert, __LINE__, __FILE__, 1, msg); \ diff --git a/xen/arch/x86/include/asm/processor.h b/xen/arch/x86/include/asm/processor.h index 23639d5479a3..8e2816fae9b9 100644 --- a/xen/arch/x86/include/asm/processor.h +++ b/xen/arch/x86/include/asm/processor.h @@ -496,7 +496,9 @@ void show_code(const struct cpu_user_regs *regs); void show_stack_overflow(unsigned int cpu, const struct cpu_user_regs *regs); void show_registers(const struct cpu_user_regs *regs); void show_execution_state(const struct cpu_user_regs *regs); -#define dump_execution_state() run_in_exception_handler(show_execution_state) +void cf_check show_execution_state_nonconst(struct cpu_user_regs *regs); +#define dump_execution_state() \ + run_in_exception_handler(show_execution_state_nonconst) void show_page_walk(unsigned long addr); void noreturn fatal_trap(const struct cpu_user_regs *regs, bool_t show_remote); diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c index 7b957101934e..a2278d9499d0 100644 --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -681,6 +681,11 @@ void show_execution_state(const struct cpu_user_regs *regs) console_unlock_recursive_irqrestore(flags); } +void cf_check show_execution_state_nonconst(struct cpu_user_regs *regs) +{ + show_execution_state(regs); +} + void vcpu_show_execution_state(struct vcpu *v) { unsigned long flags = 0; diff --git a/xen/common/keyhandler.c b/xen/common/keyhandler.c index 5dc650a37c5c..b6e22d8120b1 100644 --- a/xen/common/keyhandler.c +++ b/xen/common/keyhandler.c @@ -138,7 +138,7 @@ static void cf_check show_handlers(unsigned char key) static cpumask_t dump_execstate_mask; -void dump_execstate(struct cpu_user_regs *regs) +void cf_check dump_execstate(struct cpu_user_regs *regs) { unsigned int cpu = smp_processor_id(); @@ -490,7 +490,7 @@ static void cf_check run_all_keyhandlers( tasklet_schedule(&run_all_keyhandlers_tasklet); } -static void do_debugger_trap_fatal(struct cpu_user_regs *regs) +static void cf_check do_debugger_trap_fatal(struct cpu_user_regs *regs) { (void)debugger_trap_fatal(0xf001, regs); diff --git a/xen/drivers/char/ehci-dbgp.c b/xen/drivers/char/ehci-dbgp.c index e205c0da6a61..16c8ff394d5c 100644 --- a/xen/drivers/char/ehci-dbgp.c +++ b/xen/drivers/char/ehci-dbgp.c @@ -1247,7 +1247,7 @@ static int cf_check ehci_dbgp_getc(struct serial_port *port, char *pc) /* Safe: ehci_dbgp_poll() runs as timer handler, so not reentrant. */ static struct serial_port *poll_port; -static void _ehci_dbgp_poll(struct cpu_user_regs *regs) +static void cf_check _ehci_dbgp_poll(struct cpu_user_regs *regs) { struct serial_port *port = poll_port; struct ehci_dbgp *dbgp = port->uart; diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 8df1ee4d5c2c..e5b4a9085516 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -206,7 +206,7 @@ static void cf_check ns16550_interrupt( /* Safe: ns16550_poll() runs as softirq so not reentrant on a given CPU. */ static DEFINE_PER_CPU(struct serial_port *, poll_port); -static void __ns16550_poll(struct cpu_user_regs *regs) +static void cf_check __ns16550_poll(struct cpu_user_regs *regs) { struct serial_port *port = this_cpu(poll_port); struct ns16550 *uart = port->uart; diff --git a/xen/include/xen/lib.h b/xen/include/xen/lib.h index c6987973bf88..3a1fdaf7e35a 100644 --- a/xen/include/xen/lib.h +++ b/xen/include/xen/lib.h @@ -199,7 +199,7 @@ extern char *print_tainted(char *str); extern void add_taint(unsigned int taint); struct cpu_user_regs; -void dump_execstate(struct cpu_user_regs *); +void cf_check dump_execstate(struct cpu_user_regs *); void init_constructors(void); From patchwork Mon Feb 14 12:51:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745575 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2D30BC433FE for ; Mon, 14 Feb 2022 13:06:59 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271778.466501 (Exim 4.92) (envelope-from ) id 1nJb45-00076L-JU; Mon, 14 Feb 2022 13:06:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271778.466501; Mon, 14 Feb 2022 13:06:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb45-00073a-6T; Mon, 14 Feb 2022 13:06:49 +0000 Received: by outflank-mailman (input) for mailman id 271778; Mon, 14 Feb 2022 13:06:47 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2m-00023t-1B for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:28 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id c68bdee8-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:05:26 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: c68bdee8-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843926; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lbPgCP8QoZ01MqJuej5y09QKl0+j0oj0HAV2tSG7L3Y=; b=B85S8KRwksAn8Txd/WPly7ZCG5YItRUYEyuEDyrYT4APvJttNcS2Puev Ru3qJETC+7kYim03NOmOhr6bUI2UJioA5p4xbaeE5SPwdoR1ewM1pZxtu KC4ASGFU60GtShG2PLUBpLBxNkU38P7mizqNxmhlmcHt/te4t826TSq6d 8=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: C5OFwtAmVeQx/l/W1+zxTCPYzAL33kpFmtq11yYcexwEXk3WumaJv4/kPNy+y+vXMcehNRqhSI vNMYItHP8XV5HCyQtSPXghpiniZ9SdWrrh9HotU79Ab/WM7GjsklA3LFPiuCvgZuIc6eUlNo1t SbRA4o6837H8grJxLmLRD8XWvGp8TChY+EvJC8nRMD33q0ljspBdAeUTZGcWNPNm+/SYvIhZPT 1u22/KG3Mgi29pjznTtBGzB/oHkCDWg53epH9OthCbXNCXhTM3oTTv2KWqW/mXVpeyq6nt0LtS senlb8Z1rOZQZg5/l6bNP2CJ X-SBRS: 5.1 X-MesageID: 64149405 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:I3aBJawKCesvIw+J3Px6t+cIwSrEfRIJ4+MujC+fZmUNrF6WrkVVz WsbXm3XMvnbYjP9ftt3Pd6zpElUsMLXm4A3SAtuqiAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnvopW1TYhSEUOZugH9IQM8aZfHAhLeNYYH1500g7wbdl2tcAbeWRWGthh /uj+6UzB3f9s9JEGjp8B3Wr8U4HUFza4Vv0j3RmDRx5lAa2e0o9VfrzEZqZPXrgKrS4K8bhL wr1IBNVyUuCl/slIovNfr8W6STmSJaKVeSFoiI+t6RPHnGuD8H9u0o2HKN0VKtZt9mGt41Wz 49jsre8dScOHerLtPszCUBUKAgraMWq+JefSZS+mcmazkmAeHrw2fR+SkoxOOX0+M4uXzsIr 6ZBbmlQMFbT3Ipaw5riIgVoru0lINPmI8U0vXZ4wCuCJf0nXYrCU+PB4towMDIY2JwXQaeCP 5dxhTxHUA/7Yz51fUksDZswgqCRu0PWaCRcpwfAzUYwyzeKl1EguFT3C/LKfvSaSMMTmVyXz krk1WnkBhARNPSE1CGItHmrg4fnjS79HY4fCrC83vprm0GIgHweDgUMUlm2quX/jVSxM++zM GRNpHBo9/JrshX2EJ+tBHVUvUJooDZBfN0KPeoR5D2t7YmT5CqGKDJdQgVoPYlOWNANeRQm0 VqAntXMDDNpsaGIRX/1yop4vQ9eKgBOczZcOHZsoR8tpoC6/dpt1k6nosNLTfbt5uAZDw0c1 NxjQMIWo7wIxfAG2Kyglbwsq2L9/8OZJuLZC+i+Y45E0u+bTNP/D2BLwQKChRqlEGp+ZgPf1 EXoY+DEsIgz4WilzURhutklErCz/OqiOzbBm1NpFJRJ323zpyL8LdANvWknfx0B3iM4ldjBO hG7hO+szMULYCvCgVFfP+pd9PjGPYC/TI+4B5g4n/JFY4RrdR/vwc2dTRX44owZq2B1yftXE c7CKa6EVC9GYYw6nGveb7pMitcDm3FhrV4/sLimlnxLJ5LFPyXLIVrEWXPTBt0EAFSs/lmEr YYHb5HSo/idOcWnChTqHUcoBQhiBRAG6Vre8aS7r8aPfVhrHn8PEfjUze9zcoBphf0NxOzJ4 mu8SglTz1+m3S/LLgCDa3ZCbrLzXMkg8SJnbHJ0ZVv4iWI+ZYuP7bsEc8dld7cQ6+E+n+V/S OMIepvcD60XGCjH4TkUcbL0sJdmKEawnQuLMif8OGo/cpdsShbn4NjhegezpiACAjDu7Zk1o qG61xOdSp0GHlwwAMHTYfOp7lWwoXlCx74iAxqWeoFeIRy+/pJrJir9iu4MD/sNcRiTlCGH0 wu2AAsDobWfqYEC79SU17uPqJ2kErUiExMCTXXb97u/KQLT4nGnnd1bSO+NcD3QCDH09aGla bkHxv3wKqRazlNDso46GLd316MuodDoouYCnAhjGXzKaXWtC69hfSbajZUe6PUVy+8LoxayV 2KO5sJeaOeAN87SGVIMIBYoM7aY3vYOlziOtfk4LS0WPsOsEGZrhamKAySxtQ== IronPort-HdrOrdr: A9a23:yWBmNqMTrwcGn8BcTsWjsMiBIKoaSvp037Eqv3oRdfU1SL3hqy nApoV56faZslkssTQb6LS90cq7MArhHPxOkOss1N6ZNWGM0gbFEGgh1/qE/9SJIVyZygc378 ddmsZFZuEYdWIK6PrH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149405" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 60/70] x86: Use control flow typechecking where possible Date: Mon, 14 Feb 2022 12:51:17 +0000 Message-ID: <20220214125127.17985-61-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Now all callees have been annotated, turn on typechecking to catch issues in the future. Signed-off-by: Andrew Cooper --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu RFC. This is still an experimental compiler extention https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102953 However, it is also the entire basis of being able to sanely use -mmanual-endbr in the first place, so is very important. --- xen/arch/x86/arch.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/arch.mk b/xen/arch/x86/arch.mk index 8b88f0240e85..1710d056af3f 100644 --- a/xen/arch/x86/arch.mk +++ b/xen/arch/x86/arch.mk @@ -49,6 +49,7 @@ CFLAGS-$(CONFIG_INDIRECT_THUNK) += -fno-jump-tables ifdef CONFIG_XEN_IBT CFLAGS += -fcf-protection=branch -mmanual-endbr +$(call cc-option-add,CFLAGS,CC,-fcf-check-attribute=no) else $(call cc-option-add,CFLAGS,CC,-fcf-protection=none) endif From patchwork Mon Feb 14 12:51:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745606 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 60130C433EF for ; Mon, 14 Feb 2022 13:18:11 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272059.466874 (Exim 4.92) (envelope-from ) id 1nJbEw-0004Jw-58; Mon, 14 Feb 2022 13:18:02 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272059.466874; Mon, 14 Feb 2022 13:18:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEv-0004Iw-Tj; Mon, 14 Feb 2022 13:18:01 +0000 Received: by outflank-mailman (input) for mailman id 272059; Mon, 14 Feb 2022 13:17:59 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4b-0008IH-4e for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:21 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 09de4c78-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:19 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 09de4c78-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844039; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=xssEdp0Svf1EAcyTm/CHU0ZkwIg2XP7+KI+3Pd9nxnc=; b=KpAQox58+qUhBW8s71bMVh0l4Ht1/xi8M2uGMBAcitomB4tTxR9wQSd7 LMEfh1eOPwclnoP0m5PcwzUE44UcYCApLIQG93ma7GRG+cranoRRSs2kQ fdRvWpi2sWgd2qTThLn4VyjwXgVuNWuYP+e5b9fJud2VqFtp+xfXVniaM Q=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: qBoBnxQsU/3wdIOrqcmHNTR2j7JT7U1nrwwDNZuIrcxUm5kZaXWcX7/Pa8fyCZ1/Yey2y/C2PL P1F4aMLpN8iHj21GnmFWozEAB8Z9l2+kmf6iYRfN+0gtH/+SzeYhw1ZUmrl1moOcBrbFG5abKF z1gkwk1wldHbb862h7fzqbguRmS4dL56QAVqI3Ag3Ph+9nhVUlBkpqd99ibROi9ALSkyUYQDHs Hdeo7RFBiZzp84r94QoQWEWlOKutwoocVOGki8CPVpoUd2mDbPva9qVdI7YkMxTuhGts8F/EHp 1bkFOjiaHiSsm7PngOHBwukl X-SBRS: 5.1 X-MesageID: 64554412 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:8ISm1KCyz/lBqxVW/zHkw5YqxClBgxIJ4kV8jS/XYbTApD9whGcEm zcdUGiEaavYM2PzeNB+bIW19U5TuJ+GyYRjQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/rzjVk9Eu8 uR0noGKeC50EbyTie0kakwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgGpt2pwXR54yY eIZYxBiUjflSiFEAXYNVaMjxeaV3lvgJmgwRFW9+vNsvjm7IBZK+KjgNp/Zd8KHQe1Rn12Ev STW8mLhGBYYOdeDjz2f/RqRavTnxH2hHthITfvhq6As0Ab7KnEv5AM+cVbnrfjmsH+HcM9lG mVJ1TtxvKELzRn+JjXiZCGQrHmBtx8aftNfFewm9Q2AopbpDxal6nssFWAYNoF/3CMibXlzj wLSwYu1bdB6mODNERqgGqGoQSRe0MT/BUsLfmc6QAQM+LEPS6lj30uUHr6P/ENY5+AZ+A0cI RjX9kDSZJ1J1KbnMplXGnid3VqRSmDhFFJd2+kudjvNAvlFTICkfZe0zlPQ8OxNKo2UJnHY4 iRYxJjOsb1WVMrX/MBofAnqNOv3j8tpzRWG2QI/d3Xf32jFF4GfkXB4v2gleRYB3jcscj71e k7D0T69F7cIVEZGmZRfOtrrY+xzlPCIPY28Cpj8M4ofCrAsJVTv1Hw/OiatM5XFzRFEfVcXY szAL65BzB8yVMxa8dZBb7lBgOF7nnhknQs+h/nTlnya7FZXX1bNIZ9tDbdERrlksstoeS3Zr IRSMdWk0RJaXLGsayXb69dLf1sLMWI6Fdb9rMkOLryPJQ9vGWcADf7NwOx+J9w5zvoNzuqYr GugXkJ4yUbkgSGVIwu9dX0+OqjkWoxyrCxnMHV0b0qowXUqfa2m8LwbK8ksZbAi+eE6lax0Q vAJdt+uGPNKTjibqT0RYYOk9N5pdQixhBLINC2gOWBtc5llTg3P29nlYgqwq3VeUnvp7ZMz+ uTy2BnaTJwPQxVZIPzXMP//nUmsuXU9mf5pWxeaKNdkZ0ixopNhLDb8j6FrLphUewnD3DaTy y2fHQwc+bvWu4Yw/dTE2fKEooOuH7csF0ZWBTCGv7O/NC2c9Wu/245QFu2PeGmFBm/z/ayjY 8RTzu39b6JbzAob7dIkHuY517866vvuu6Ren1ZtE3j8Zli2Dq9tfyud1s5Vu6wRnrJUtGNag K5UFgW27VlRBP7YLQ== IronPort-HdrOrdr: A9a23:9/AWbKlf9L53ofy0ilBXyWESM3jpDfIu3DAbv31ZSRFFG/Fxl6 iV8sjztCWE8Qr5N0tBpTntAsW9qDbnhPtICOoqTNGftWvdyQiVxehZhOOIqVDd8m/Fh4pgPM 9bAs9D4bbLbGSS4/yU3ODBKadD/OW6 X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554412" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 61/70] x86/setup: Read CR4 earlier in __start_xen() Date: Mon, 14 Feb 2022 12:51:18 +0000 Message-ID: <20220214125127.17985-62-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 This is necessary for read_cr4() to function correctly. Move the EFER caching at the same time. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/setup.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 735f69d2cae8..2b1192d85b77 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -888,6 +888,9 @@ void __init noreturn __start_xen(unsigned long mbi_p) /* Full exception support from here on in. */ + rdmsrl(MSR_EFER, this_cpu(efer)); + asm volatile ( "mov %%cr4,%0" : "=r" (get_cpu_info()->cr4) ); + /* Enable NMIs. Our loader (e.g. Tboot) may have left them disabled. */ enable_nmis(); @@ -934,9 +937,6 @@ void __init noreturn __start_xen(unsigned long mbi_p) parse_video_info(); - rdmsrl(MSR_EFER, this_cpu(efer)); - asm volatile ( "mov %%cr4,%0" : "=r" (get_cpu_info()->cr4) ); - /* We initialise the serial devices very early so we can get debugging. */ ns16550.io_base = 0x3f8; ns16550.irq = 4; From patchwork Mon Feb 14 12:51:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745598 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 97E71C433FE for ; Mon, 14 Feb 2022 13:17:18 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271983.466768 (Exim 4.92) (envelope-from ) id 1nJbE5-0006xh-07; Mon, 14 Feb 2022 13:17:09 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271983.466768; Mon, 14 Feb 2022 13:17:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbE4-0006vj-Jh; Mon, 14 Feb 2022 13:17:08 +0000 Received: by outflank-mailman (input) for mailman id 271983; Mon, 14 Feb 2022 13:17:07 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4W-0008IH-3o for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:16 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 07836415-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:15 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 07836415-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844035; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=jps309UDFtvBnS2vB6J17zehQG0mfCWoSwDISbfAtm8=; b=WkuQcdxDcNY2e0oa0OuLTpkOrEvR4Spbijk1YRlzjPkITWY2AXz69vCk Eu48qIUarVrFhHR8vBrxSHVtNrF2cWpxJf3tA8mox0OYqsd2qm6q8zemh lIiulFDG7ELVSB4V/ZXB35Ym4A7kISoUMAQ32vS0h+xtdEdcukV+2G0Li k=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: ko5IQb6bZCnugSJnIDF7eW4dHGG87aQ4j7t+iJ8PKixd8YXLxGStcqqRJ079tgSQbu1uCvS29m cmwCzXTcqn0BIlQ6fKCJNjAMPzVETEUYaIz0SS81HaCvT4E55eCrhZKHn95eAi7XhSIwoPIcyh DR+UWluqr0Bt9E4r+sq+WycE6ZMYUH2SnySRKW/eFfhSuEkXYw4TKl4Qp404/DPJOE4lAtNp9O EmovnB4DBZeS9BJdNLQ7YBEZR13yCi70pRJkxb0ALd3gKfZHWryp89un8+9/frkbEXXE/aPFQQ mjvCPs7YHaq64ntxY1DwCasM X-SBRS: 5.1 X-MesageID: 64554392 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:FD0i26leoa/36sBGXLEXd0jo5gyZIURdPkR7XQ2eYbSJt1+Wr1Gzt xJJDWiOPPrfYjT8eYslboTi90sCscPWx4UySAtk+C0wFSMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 PMVjJ2tZiwiB5Hv3+A3VwZHDQZ3B7ITrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qDO pZCOGAHgBLoShllY3MFAYMFwfr4wXTBTid9q2+enP9ii4TU5FMoi+W8WDbPQfSaSMMQkkuGq 2bu+2XiHgpcJNGZ0SCC8H+nmqnIhyyTZW4JPOTmrLgw2gTVnzFNTk1NPbemnRWnomjmYtNCB GcfwxYN6qwY8FO0UP70ZQLt9RZooSUgc9ZXFuQ77iSExazV/xuVCwA4c9JRVDA1nJRoHGJ3j zdli/usXGUy6+PNFRpx45/J9WvaBMQDEYMVicbopyMh6sKrnow8hwmnoj1LQP/s1Y2d9d0dL lm3QMkCa1c70JRjO0aTpwmvb9eQSn/hFFBd2+kvdjj5hj6Vnab8D2BS1XDV7OxbMKGSRUSbs X4PlqC2tb5SUc7dxHHQGLxWRtlFAspp1xWG3zZS82QJrWzxqxZPg6gMiN2BGKuZGpldImK4C KMikQhQ+IVSLBOXgVxfOOqM5zAR5fG4T7zND6mMBvIXO8QZXFLXrUlGOB/Lt0iwwRdErE3KE crCGSpaJS1BUvoPIfvfb7p17ILHMQhgmTKNFcijlUzPPHj3TCf9dIrp+WCmNogRhJ5oai2Mr I432xKix0oNXevgTDPQ9IJPf1kGIWJiXcL9qtBNd/7FKQ1jQTlzB/jUyLInWopkg6UKybuYo iDjAhdVmAjlmHnKCQSWcXQ/Ornhaoly8CAgNis2MFf2h3V6OdSz7L0SfoccdKU88LAx1uZ9S vQIIp3SAvlGRjnd1S4aaJ3x8N5reBix3FrcNCu5ejkvOZVnQlWRqNPjewLu8ggIDza26pRi8 +HxiFuDTMNaFQp4DcvQZPa+9H+LvCAQyLBoQk/FAthPY0GwooJkHDP8060sKMYWJBSdmjbDj 1SKAQ0VrPXmqpMu9IWbnriNqoqkHrcsHkdeGGWHv7+6OTODozimyI5EFu2JYSrcRCX//6D7P bdZyPT1MfsmmldWstUjT+Y3nPxmv9a/9aVHyglEHWnQawX5A7xtFXCKwM1Tu/Af3bReowa3B hqC99Qy1W9l4y85/Ir9/DYYU9k= IronPort-HdrOrdr: A9a23:Dc6u8qGNS2/7soq6pLqE6seALOsnbusQ8zAXP0AYc3Jom62j5r mTdZsgtSMc5Ax8ZJhko6HkBEDiewK7yXcW2/hzAV7KZmCP0wHEEGgh1/qH/9SJIVyYygc378 ZdmsZFZ+EYdWIK7/rH3A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554392" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper Subject: [PATCH v2 62/70] x86/alternatives: Clear CR4.CET when clearing CR0.WP Date: Mon, 14 Feb 2022 12:51:19 +0000 Message-ID: <20220214125127.17985-63-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 This allows us to have CET active much earlier in boot. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/alternative.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/alternative.c b/xen/arch/x86/alternative.c index 436047abe021..ec24692e9595 100644 --- a/xen/arch/x86/alternative.c +++ b/xen/arch/x86/alternative.c @@ -333,9 +333,13 @@ static int __init cf_check nmi_apply_alternatives( */ if ( !(alt_done & alt_todo) ) { - unsigned long cr0; + unsigned long cr0, cr4; cr0 = read_cr0(); + cr4 = read_cr4(); + + if ( cr4 & X86_CR4_CET ) + write_cr4(cr4 & ~X86_CR4_CET); /* Disable WP to allow patching read-only pages. */ write_cr0(cr0 & ~X86_CR0_WP); @@ -345,6 +349,9 @@ static int __init cf_check nmi_apply_alternatives( write_cr0(cr0); + if ( cr4 & X86_CR4_CET ) + write_cr4(cr4); + alt_done |= alt_todo; } From patchwork Mon Feb 14 12:51:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745597 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BD19BC433EF for ; Mon, 14 Feb 2022 13:17:17 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271981.466763 (Exim 4.92) (envelope-from ) id 1nJbE4-0006s8-Em; Mon, 14 Feb 2022 13:17:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271981.466763; Mon, 14 Feb 2022 13:17:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbE4-0006ra-8Z; Mon, 14 Feb 2022 13:17:08 +0000 Received: by outflank-mailman (input) for mailman id 271981; Mon, 14 Feb 2022 13:17:06 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3j-0008IH-HO for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:27 +0000 Received: from esa6.hc3370-68.iphmx.com (esa6.hc3370-68.iphmx.com [216.71.155.175]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e97f508c-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:26 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e97f508c-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843986; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nFVbC/4CTKrt9ePns4OmTby9fRX+JlbtvMjTI8nUB74=; b=G1ndp5xIyBMM1jx8qgAdJciOCeLvyMC7DK0peGismD3YL5hCMS35Eut3 rq2x4xnJpHaKDkc1bcoC9WOV9ptsTBTYxqmckTH8qxynddPnIB6LC9QzO m5rjk/py9GlateWSD2xyMvtekAptnnpN+HqnNXPPlRVwsz1RqylRzY8Nc U=; Authentication-Results: esa6.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: p1VJNay5+0TErJJlwhNVrDKyw911DBe46SFZfny+G1zGNcpra+QSgvbh3R4TpIu/E4DsDN95Fx nigN90rokMgW7BknA+b15rBCsGQsU4Cz2gCvzlq6s1PYwXtseCtQgH3kuspus9x2f/iMMUB7hF FQDtydm69u0mVPire4SFMveSYHRrwnJyEu+7IjDWtS4Thp3v8kW6OQja9FanHNmDbaWfluBkfa AoevsD/u/GXiq7iLu72VKJKIeF/sbQhT0XngIghxOGHmm3sS6A8uxwoxzELDvrV2tGLZh/muSR 6w5kwkW8KO1Gfdh5I4YEw5Nd X-SBRS: 5.1 X-MesageID: 64050671 X-Ironport-Server: esa6.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:T9o8dKj3gPBK031rkfVcT9nyX161XxcKZh0ujC45NGQN5FlHY01je htvWW6DOaqPZGanc91yb4nn8x5Q7MTTzoNhG1Y/pX1jFisb9cadCdqndUqhZCn6wu8v7a5EA 2fyTvGacajYm1eF/k/F3oAMKRCQ7InQLlbGILes1htZGEk0GE/NtTo5w7Rj2tQx3YDga++wk YiaT/P3aQfNNwFcagr424rbwP+4lK2v0N+wlgVWicFj5DcypVFMZH4sDfjZw0/DaptVBoaHq 9Prl9lVyI97EyAFUbtJmp6jGqEDryW70QKm0hK6UID66vROS7BbPg/W+5PwZG8O4whlkeydx /0RqsaCGAZuApfhhcgbbBgADjhfLfFZreqvzXiX6aR/zmXDenrohf5vEFs3LcsT/eMf7WNmr KJCbmpXN1ba2rzwkOnTpupE36zPKOHCOo8Ft24m5jbeFfs8GrjIQrnQ5M8e1zA17ixLNaiCP 5dBN2U2BPjGSxNTI3ASIrgApt3rqVjOSgIGmWCepZNitgA/yyQuieOwYbI5YOeiWsF9jkue4 GXc8AzRIDsXKdiewjqt6W+3i6nEmiaTcJIfEvi0++BnhHWXx3cPE1sGWF2ju/67h0WiHdVFJ CQpFjEG9PZoshbxF5+kAkP+8CXsUgMgt8R4T/Jg2lCMjZbuzhu1AFcFFiNYScx6q5pjLdA17 WOhk9TsDD1plbSaT3OB67uZxQ+P1TgpwXwqPnFdE1ZcizX3iMRq10+UEI4/eEKgpoCtQVnNL ya2QD/Sbln5peoCzO2F8F/OmFpATbCZH1dutm07so9Ihz6VhbJJhaT1szA3Dt4ade51q2VtW 1BexaCjABgmV83lqcB0aLxl8EuVz/iEKibAplVkAoMs8T+gk1b6I9wMv2EueRoxa51eEdMMX KM0kVkPjKK/wVPwNfMnC25PI5hCIVfc+STNCamPM4smjmlZfw6b5iB+DXN8LEi2+HXAZZoXY M/BGe71VC5yIf0+kFKeGrdMuZd2l3tW7T6CGvjGI+GPjOP2iIi9EuxebjNjr4kRscu5neki2 4gDaZXakUgDOAA8CwGOmbMuwZkxBSBTLfjLRwZ/L7DrztNOFD5zBvnP76kmfoA5za1Zmv2Rp iO2W1NCyUq5jnrCcF3YZndmYbLpfJB+sXNkYnB8YQf2gyAuMdS18aMSV5orZr17puZt+uF5E qsecMKaD/URFjmeo2YBbYPwpZBJfQiwgV7cJDKsZTUyJsYyRwHA9tL+UBHo8S0CUni+ucck+ uXy3QLHW5sTAQ9lCZ+OOv6oylqwu1kbmf5zABSUcoUCJh20/dEzeSLrj/IxL8UdEjn5x2OXh 1SMHBMVhejRuItpotPHsr+J8tWyGOxkE0sEQ2SCteSqNTPX93aIyJNbVLraZijUUW759fnwZ ehRyP2gYvQLkEwT7th5Grdvi6k/+8Hut/lRyQE9RCfHaFGiC7VBJHia3JYQ6v0Rl+EB4QbmC FiS/tR6OKmSPJK3GVEcEwMpc+Cf2KxGgTLV9/k0fB336SIfEGBriqmO081gUBBgEYY= IronPort-HdrOrdr: A9a23:fKjZt6H6mGE1OkcApLqE0MeALOsnbusQ8zAXP0AYc3Jom6uj5r mTdZUgpHnJYVkqOE3I9ertBEDEewK4yXcX2/h3AV7BZniEhILAFugLhuGO/9SjIVybygc079 YZT0EUMrzN5DZB4voSmDPIceod/A== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64050671" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 63/70] x86/traps: Rework write_stub_trampoline() to not hardcode the jmp Date: Mon, 14 Feb 2022 12:51:20 +0000 Message-ID: <20220214125127.17985-64-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 For CET-IBT, we will need to optionally insert an endbr64 instruction at the start of the stub. Don't hardcode the jmp displacement assuming that it starts at byte 24 of the stub. Also add extra comments describing what is going on. The mix of %rax and %rsp is far from trivial to follow. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Retain the rounding up to 16 bytes. --- xen/arch/x86/x86_64/traps.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/xen/arch/x86/x86_64/traps.c b/xen/arch/x86/x86_64/traps.c index d661d7ffcaaf..edc6820b85c7 100644 --- a/xen/arch/x86/x86_64/traps.c +++ b/xen/arch/x86/x86_64/traps.c @@ -293,30 +293,39 @@ static unsigned int write_stub_trampoline( unsigned char *stub, unsigned long stub_va, unsigned long stack_bottom, unsigned long target_va) { + unsigned char *p = stub; + + /* Store guest %rax into %ss slot */ /* movabsq %rax, stack_bottom - 8 */ - stub[0] = 0x48; - stub[1] = 0xa3; - *(uint64_t *)&stub[2] = stack_bottom - 8; + *p++ = 0x48; + *p++ = 0xa3; + *(uint64_t *)p = stack_bottom - 8; + p += 8; + /* Store guest %rsp in %rax */ /* movq %rsp, %rax */ - stub[10] = 0x48; - stub[11] = 0x89; - stub[12] = 0xe0; + *p++ = 0x48; + *p++ = 0x89; + *p++ = 0xe0; + /* Switch to Xen stack */ /* movabsq $stack_bottom - 8, %rsp */ - stub[13] = 0x48; - stub[14] = 0xbc; - *(uint64_t *)&stub[15] = stack_bottom - 8; + *p++ = 0x48; + *p++ = 0xbc; + *(uint64_t *)p = stack_bottom - 8; + p += 8; + /* Store guest %rsp into %rsp slot */ /* pushq %rax */ - stub[23] = 0x50; + *p++ = 0x50; /* jmp target_va */ - stub[24] = 0xe9; - *(int32_t *)&stub[25] = target_va - (stub_va + 29); + *p++ = 0xe9; + *(int32_t *)p = target_va - (stub_va + (p - stub) + 4); + p += 4; /* Round up to a multiple of 16 bytes. */ - return 32; + return ROUNDUP(p - stub, 16); } DEFINE_PER_CPU(struct stubs, stubs); From patchwork Mon Feb 14 12:51:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745573 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CB79FC433EF for ; Mon, 14 Feb 2022 13:06:55 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271773.466487 (Exim 4.92) (envelope-from ) id 1nJb43-0006YN-16; Mon, 14 Feb 2022 13:06:47 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271773.466487; Mon, 14 Feb 2022 13:06:46 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb42-0006WT-M2; Mon, 14 Feb 2022 13:06:46 +0000 Received: by outflank-mailman (input) for mailman id 271773; Mon, 14 Feb 2022 13:06:45 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2Y-0008IH-01 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:14 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id bcf89745-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:05:11 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: bcf89745-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843911; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Cb4WkVIG42hm90giM2dEHS2eAP2rQxieWFvRijYUUxU=; b=FbrFc222LRIEcWeBZM7QgWdF4h0S6ZQVQtuphCeLtlitzZLzfoVVfjHA KjbaoxaeReZay+dPj422rQS8o1bEvzKxsR/FEcxfO2BUjjP1o6YTh6cha T42i+8bus38bYOGN8UWTsrd5hQ6rMjppIUeyzJ+0Eo63vlBqriLVXMghx U=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: wvcz5bMK2UNc6Djov4mmUECl6mDnGKEv3tUrl94xvEahsrs/JatFGMdXPJrvx3ZJIxG52eQLWL k346EmRYivTwBnIVonTvBAkUgmhtzIjl8qmx6/YaXC9Bd04SXSJYP7X5NLTbuKbddu3QxWO0G0 ZKIDsqMN0LShsRLQZ1DN7aq4kWmhkQe3wLWZTYNoOTe7ovMOecYEjL5t2lE3krlE8+7C2HStlv 2XYtdgGErsv1R4kRhxkq0/0vYqNEZe1szKr8V3fsAl3QTt9/aYrFJ9KMO8k4x4UHWVMTdIAzJO iQYnyMPtW5KKlSwzull1mLKp X-SBRS: 5.1 X-MesageID: 64149369 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:MBRlNapPvE+CF00xvMzhsXynCJ5eBmIkYhIvgKrLsJaIsI4StFCzt garIBnQPfzcYmX2KNxwOY22oxhU6peDy9AwQQo4+H00Qy9Bo5uZCYyVIHmrMnLJJKUvbq7GA +byyDXkBJppJpMJjk71atANlZT4vE2xbuKU5NTsY0idfic5Dndx4f5fs7Rh2NQw24HlW1rlV e7a+KUzBnf0g1aYDUpMg06zgEsHUCPa4W5wUvQWPJinjXeG/5UnJMt3yZKZdhMUdrJ8DO+iL 9sv+Znilo/vE7XBPfv++lrzWhVirrc/pmFigFIOM0SpqkAqSiDfTs/XnRfTAKtao2zhojx/9 DlCnY2BUQF3IKHDo+8MAwlzQygjbIFA3aCSdBBTseTLp6HHW37lwvEoB0AqJ4wIvO1wBAmi9 9RBdmpLNErawbvrnvTrEYGAhex6RCXvFKoZtmtt0nfyCvE+TIqYa67L+cVZzHE7gcUm8fP2O ZZANWs0MkWojxtnJ0w3Grslg8uS33TDKjBVuQqRjLBuyj2GpOB2+Oe0a4eEEjCQfu1Kmm6Iq 2SA+H72ajk4HtGCzTuO8lq3m/TC2yj8Xeo6BLC+s/JnnlCX7mgSEwENE0u2p+GjjUyzUM4ZL FYbkhfCtoBrqhbtFIOkGUTl/jjU5XbwRua8DcUr2RmLlLTY7D2SFzgUZW5INY0KsuopEGlCO kCyo/vlAjlmsbuwQH2b96uJoT7aBRX5PVPudgdfE1JbvoCLTJUby0uWE409SPLdYsjdRGmoq w1muhTSkFn6YSQj86ygtW7KjDu3znQiZl5kv16HNo5JA+4QWWJEW2BKwQWBhRqjBNzAJrVkg JTjs5LAhN3i9bnXyESwrBwlRdlFHcqtPjzGmkJIFJI87Tmr8HPLVdkOvG0hdBc0b55dImWBj KrvVeR5vsE7AZdXRfUvP9LZ5zoCkcAM6ugJptiLN4ETM/CdhSeM/T10ZF744oweuBNErE3LA r/CKZzEJS9DUcxPlWPqL89Age5D7n1vngv7GMGkpylLJJLDPRZ5v59eawDQBg34hYvZyDjoH yF3aZfUlUUFDbGWj+u+2dd7EG3m5EMTXfjew/G7vMbZSua/MG1+WfLX3507fIlpw/ZcmuvSp ynvUU5E0lvvw3bALFzSOHxkbbruW7d5rG46YnNwbQr5hSB7bNb99robers2YaIjqL5pw8lrQ qRXYM6HGPlOFGjKomxPcZnnoYV+Xx23ngbSbTG9aT0ycsc4FQzE89PpZCX18ywKAnblvMcyu eT4hAjaXYACV0JpC8OPMKCjyFa4vH48nuNuXhSXfokPKRu0qIUzcn7/lP46Jc0IOC7v/DrC2 lbEGwocqMnMv5QxrIvDi5ebotr7COB5BEdbQTXWtO7kKSnA82O/6oZcS+LULyvFXWb59aj+N +VYy/bwbK8OkFpQ6tcuFr9qyeQ15sf1pq8cxQNhRS2ZY1OuA7JmA3+HwcgQ6fEdmu4H4VO7C hCV591XGbSVI8e0QlceKT0sYvmHyfxJyCLZ6u44IRmi6SJ6lFZdvZ6+4/VYZPRhEYZI IronPort-HdrOrdr: A9a23:MNCOx62XGtYMj2syZTLDUgqjBLAkLtp133Aq2lEZdPRUGvb3qy nOpoVj6faaslYssR0b9exofZPwJE80lqQFh7X5X43SPzUO0VHAROoJgLcKgQeQfxEWntQtsp uIGJIeNDSfNzdHZL7BkWuFL+o= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149369" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 64/70] x86: Introduce helpers/checks for endbr64 instructions Date: Mon, 14 Feb 2022 12:51:21 +0000 Message-ID: <20220214125127.17985-65-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 ... to prevent the optimiser creating unsafe code. See the code comment for full details. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Fix include to let the header be standalone * Add earlyclobber to asm v1.1: * New --- xen/arch/x86/include/asm/endbr.h | 53 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 xen/arch/x86/include/asm/endbr.h diff --git a/xen/arch/x86/include/asm/endbr.h b/xen/arch/x86/include/asm/endbr.h new file mode 100644 index 000000000000..6b6f46afaf29 --- /dev/null +++ b/xen/arch/x86/include/asm/endbr.h @@ -0,0 +1,53 @@ +/****************************************************************************** + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; If not, see . + * + * Copyright (c) 2021-2022 Citrix Systems Ltd. + */ +#ifndef XEN_ASM_ENDBR_H +#define XEN_ASM_ENDBR_H + +#include + +/* + * In some cases we need to inspect/insert endbr64 instructions. + * + * The naive way, mem{cmp,cpy}(ptr, "\xf3\x0f\x1e\xfa", 4), optimises unsafely + * by placing 0xfa1e0ff3 in an imm32 operand, and marks a legal indirect + * branch target as far as the CPU is concerned. + * + * gen_endbr64() is written deliberately to avoid the problematic operand, and + * marked __const__ as it is safe for the optimiser to hoist/merge/etc. + */ +static inline uint32_t __attribute_const__ gen_endbr64(void) +{ + uint32_t res; + + asm ( "mov $~0xfa1e0ff3, %[res]\n\t" + "not %[res]\n\t" + : [res] "=&r" (res) ); + + return res; +} + +static inline bool is_endbr64(const void *ptr) +{ + return *(const uint32_t *)ptr == gen_endbr64(); +} + +static inline void place_endbr64(void *ptr) +{ + *(uint32_t *)ptr = gen_endbr64(); +} + +#endif /* XEN_ASM_ENDBR_H */ From patchwork Mon Feb 14 12:51:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745599 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EC323C433EF for ; Mon, 14 Feb 2022 13:17:20 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271986.466780 (Exim 4.92) (envelope-from ) id 1nJbE6-0007Tw-Gp; Mon, 14 Feb 2022 13:17:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271986.466780; Mon, 14 Feb 2022 13:17:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbE6-0007Rq-8S; Mon, 14 Feb 2022 13:17:10 +0000 Received: by outflank-mailman (input) for mailman id 271986; Mon, 14 Feb 2022 13:17:08 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4a-0008IH-4W for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:20 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 095611f6-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:18 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 095611f6-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844038; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=aoU1tlx3/7aKi+MsHLxvtpIMc2l5mgsFiREtPDfU0UA=; b=NknLRxWQTo0jT/I6xWYXDTnmbQ8+DINujBwbqTaJE8V75uoeeUoA4gJP Gaxe2t6ZDcoaGhlkGbhjMq9uEgr4Wb2s4oiUOzWjulfsA8e023O8nREts yGyk0zT1ERKa7rupWbsQdDVZTbumERexSZRP3IEpiGtEpkwJo1rl/pe7H o=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: yZ/WHagyhkmgZH6D/G6afvcrch+YSiqNBZREZVVz8msHnzsKLXfI+mDHdHRoVFlkGAZ1qjZFZx zQiokczxcLCoeLkhlx3zXBgvgQD4yow7vdsgzhrPAT3up8x0y0g7qOX2vcXKzKhhMDzXY6Ga6H h7U7OQqWIx1cVA7q/g2JwgSYMFxeXUudRzkNUH4rAita1abD//RYph06KlptLlM9f0cN2o+4Vf Rwb1MD3ZYNGiSuvo+QIEjA9AEp0LM7Iqx/VGSZ7xt2ZZfkbpA4aywwKAw3Fu5yLEXObOcNE3Cv f7IlpOmPvSKjGyAIJvnKCiMD X-SBRS: 5.1 X-MesageID: 64554404 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:Au+0GqtXFkkzplbLcH5d5PcgbufnVG9ZMUV32f8akzHdYApBsoF/q tZmKW6PO62IZmr3Lo1+b9i2pElS75PVztdlHgY6ryBmFX8X+JbJXdiXEBz9bniYRiHhoOOLz Cm8hv3odp1coqr0/0/1WlTZQP0VOZigHtIQMsadUsxKbVIiGHdJZS5LwbZj2NYy2IThWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Npl7rWaEgx4brT1lac/WTJzIRBdGZBWweqSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DFYUToHx/ixreCu4rW8vrSKTW/95Imjw3g6iiGN6AO 5dENWY3MHwsZTUIF3QzDrVugt26qVfYaRZbhE+Nh4kOtj27IAtZj+G2bYu9lsaxbdpRtlaVo CTB5WuRKjMwOcGbyDGF2mmxneKJliT+MKoCGbv9+vN0jVm7wm0IFAZQRVa9ueO+iEO1R5RYM UN8x8Y1hfFsrgrxFIC7BkDm5i7f1vIBZzZOO7YTwlqGm/rN2gvaJGIvZQxwS/gbpPZjEFTGy WS1t9/uADVutpicRnSc6qqYoFuOBMQFEYMRTXRaFFVYurEPtKl210uSFYg7TMZZm/WoQWmY/ tyckMQpa1z/Z+Yv3r7zw13IiinESnPhHl9svVW/so5IA2pEiG+Zi26AtAKzARVodt/xory9U J8swZb20Qz2JcvR/BFhuc1UdF1T296LMSfHnXlkFIQ7+jKm9haLJN4MvG4udBo0ap9fI1cFh XM/XisLuvdu0IaCN/crM+pd9ex2pUQfKTgVfq+NNYcfCnSAXASG4DtvdSatM5PFyyARfVUEE c7DK66EVC9CYYw+lWbeb7pNgNcDm3FlrUuOFM+T8vhS+efHDJJjYexeawXmgyFQxP7snTg5B P4Ba5rUm00HCrWWj+u+2dd7EG3m5EMTXfjew/G7vMbafFQO9LgJB6CDzLU/VZZimqgJxO7E8 mvkAh1TyUblhG2BIgKPMygxZLTqVJd5jHQ6IS1zYgr4hyl9Od6ivPUFap86Xbg77+g/n/R6e OYIJpebCfNVRzWZpzlENcvhrJZvfQiAjB6VO3b3eyA2epNtHlSb+tLtcgb12jMJCy676Zk3r 7G6j1uJSpsfXQVySs3Rbav3nV+2uHEcnsN0XlfJfYYPKBm9rtAyJnWo3PEtIswKJRHS/Reg1 l6bUUUCuO3Ag44p692V16qKmJikTrllFU1AEmiFsbvvbXvG/nCuyJNrWfqTeWyPT3v9/aiva LkHz/z4N/Fbzl9Gv5AlTuRuxKM6odDuu6Vb3kJvG3CSNwanDbZpI3+n28hTt/ISmu8F6FXuA k/fqMNHPbipOd/+FA9DLQUoWe2PyPUIl2SA9v8yOkj7uHd68bfvvZ++5PVQZPix9IdIDb4= IronPort-HdrOrdr: A9a23:6a/Zlao2AYSbUfE5zhv9VCgaV5opeYIsimQD101hICG8cqSj+f xG/c5rrCMc5wxwZJhNo7y90ey7MBbhHP1OkO8s1NWZLWrbUQKTRekIh+bfKn/baknDH4ZmpM BdmsNFaeEYY2IUsS+D2njbL+od X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554404" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 65/70] x86/emul: Update emulation stubs to be CET-IBT compatible Date: Mon, 14 Feb 2022 12:51:22 +0000 Message-ID: <20220214125127.17985-66-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 All indirect branches need to land on an endbr64 instruction. For stub_selftests(), use endbr64 unconditionally for simplicity. For ioport and instruction emulation, add endbr64 conditionally. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Use local endbr64 define rather than raw opcodes in stub_selftest() v1.1: * Update to use endbr helpers --- xen/arch/x86/extable.c | 12 +++++++----- xen/arch/x86/pv/emul-priv-op.c | 7 +++++++ xen/arch/x86/x86_emulate.c | 13 +++++++++++-- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/extable.c b/xen/arch/x86/extable.c index 4d1875585f9d..4913c4a6dd5d 100644 --- a/xen/arch/x86/extable.c +++ b/xen/arch/x86/extable.c @@ -129,20 +129,22 @@ search_exception_table(const struct cpu_user_regs *regs) static int __init cf_check stub_selftest(void) { static const struct { - uint8_t opc[4]; + uint8_t opc[8]; uint64_t rax; union stub_exception_token res; } tests[] __initconst = { - { .opc = { 0x0f, 0xb9, 0xc3, 0xc3 }, /* ud1 */ +#define endbr64 0xf3, 0x0f, 0x1e, 0xfa + { .opc = { endbr64, 0x0f, 0xb9, 0xc3, 0xc3 }, /* ud1 */ .res.fields.trapnr = TRAP_invalid_op }, - { .opc = { 0x90, 0x02, 0x00, 0xc3 }, /* nop; add (%rax),%al */ + { .opc = { endbr64, 0x90, 0x02, 0x00, 0xc3 }, /* nop; add (%rax),%al */ .rax = 0x0123456789abcdef, .res.fields.trapnr = TRAP_gp_fault }, - { .opc = { 0x02, 0x04, 0x04, 0xc3 }, /* add (%rsp,%rax),%al */ + { .opc = { endbr64, 0x02, 0x04, 0x04, 0xc3 }, /* add (%rsp,%rax),%al */ .rax = 0xfedcba9876543210, .res.fields.trapnr = TRAP_stack_error }, - { .opc = { 0xcc, 0xc3, 0xc3, 0xc3 }, /* int3 */ + { .opc = { endbr64, 0xcc, 0xc3, 0xc3, 0xc3 }, /* int3 */ .res.fields.trapnr = TRAP_int3 }, +#undef endbr64 }; unsigned long addr = this_cpu(stubs.addr) + STUB_BUF_SIZE / 2; unsigned int i; diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c index c46c072f93db..22b10dec2a6e 100644 --- a/xen/arch/x86/pv/emul-priv-op.c +++ b/xen/arch/x86/pv/emul-priv-op.c @@ -26,6 +26,7 @@ #include #include +#include #include #include #include @@ -111,6 +112,12 @@ static io_emul_stub_t *io_emul_stub_setup(struct priv_op_ctxt *ctxt, u8 opcode, p = ctxt->io_emul_stub; + if ( cpu_has_xen_ibt ) + { + place_endbr64(p); + p += 4; + } + APPEND_BUFF(prologue); APPEND_CALL(load_guest_gprs); diff --git a/xen/arch/x86/x86_emulate.c b/xen/arch/x86/x86_emulate.c index 60191a94dc18..720740f29b84 100644 --- a/xen/arch/x86/x86_emulate.c +++ b/xen/arch/x86/x86_emulate.c @@ -17,6 +17,7 @@ #include #include /* cpu_has_amd_erratum() */ #include +#include /* Avoid namespace pollution. */ #undef cmpxchg @@ -29,11 +30,19 @@ cpu_has_amd_erratum(¤t_cpu_data, AMD_ERRATUM_##nr) #define get_stub(stb) ({ \ + void *ptr; \ BUILD_BUG_ON(STUB_BUF_SIZE / 2 < MAX_INST_LEN + 1); \ ASSERT(!(stb).ptr); \ (stb).addr = this_cpu(stubs.addr) + STUB_BUF_SIZE / 2; \ - memset(((stb).ptr = map_domain_page(_mfn(this_cpu(stubs.mfn)))) + \ - ((stb).addr & ~PAGE_MASK), 0xcc, STUB_BUF_SIZE / 2); \ + (stb).ptr = map_domain_page(_mfn(this_cpu(stubs.mfn))) + \ + ((stb).addr & ~PAGE_MASK); \ + ptr = memset((stb).ptr, 0xcc, STUB_BUF_SIZE / 2); \ + if ( cpu_has_xen_ibt ) \ + { \ + place_endbr64(ptr); \ + ptr += 4; \ + } \ + ptr; \ }) #define put_stub(stb) ({ \ if ( (stb).ptr ) \ From patchwork Mon Feb 14 12:51:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745592 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 96726C433EF for ; Mon, 14 Feb 2022 13:16:59 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271946.466709 (Exim 4.92) (envelope-from ) id 1nJbDm-0004LE-5W; Mon, 14 Feb 2022 13:16:50 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271946.466709; Mon, 14 Feb 2022 13:16:50 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbDm-0004Kv-1S; Mon, 14 Feb 2022 13:16:50 +0000 Received: by outflank-mailman (input) for mailman id 271946; Mon, 14 Feb 2022 13:16:49 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb4Y-0008IH-5d for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:07:18 +0000 Received: from esa1.hc3370-68.iphmx.com (esa1.hc3370-68.iphmx.com [216.71.145.142]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 07a6f83c-8d97-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:07:16 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 07a6f83c-8d97-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644844036; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=k8U/gxV+rj8X4mP8GQMoApxTfQmXJsHdNzSIbDiqWyI=; b=AuwxoD3Wf/wJWz+/9VAN+EUQc86BWO44hzhGsqyYjxLKI0NMcgDpj6f3 VmKLT+C2+R99F9OKY3RYsIfGlh3Bl67dxM/uf5A/FPE0MYHSqIN9VLtV/ RJd4RoN+I/BTsLmMtANgO3ycOo28j3KLzFEKU2zLOW3FEsuyW/NugIkiu I=; Authentication-Results: esa1.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: h7a1MSeXC3XEmwgZ4ZAxmHOIfpWElDoESvzTEb5rO0ehdcGjxnQX1xouB/k5GmGjcJ2aN1gGSY pq42uQ9LcVOW6eUdpU/wN92HJqDb+3rD9sv/IgPIgtlEll7+4dc8qGv6lNw9RD9N1tke2cOO5d 1mmF1T3Bqr04MCzFAZnyFhCT4Uy2f3daSV8spMgFgjbZKs/ql4Zp+ZMocfkt/QqC8ze4zK8T/+ V59Asfpy2b57KzGWwnIWVEdl0mccn+WHAPmCUOOszRgR/LXLSjqauA2M3r7z3Bts4pcjVKHjJS YPV72dFa6E4S3rdr6t2FGpR7 X-SBRS: 5.1 X-MesageID: 64554396 X-Ironport-Server: esa1.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:xpfeua5lPQ20LX0YavtzrQxRtAHAchMFZxGqfqrLsTDasY5as4F+v mobWj2Ga//eZGH3fdAkOouypkgD6pPUn9U1SAY+qygxHi5G8cbLO4+Ufxz6V8+wwmwvb67FA +E2MISowBUcFyeEzvuV3zyIQUBUjclkfJKlYAL/En03FV8MpBsJ00o5wbZj29Iw2LBVPivW0 T/Mi5yHULOa82Yc3lI8s8pvfzs24ZweEBtB1rAPTagjUG32zhH5P7pGTU2FFFPqQ5E8IwKPb 72rIIdVXI/u10xF5tuNyt4Xe6CRK1LYFVDmZnF+A8BOjvXez8CbP2lS2Pc0MC9qZzu1c99Z5 NNfmbm2UV8TY4LHiuISfzR5TSZTIvgTkFPHCSDXXc27ykTHdz3nwul0DVFwNoodkgp1KTgQr 7pCcmlLN03dwbLtqF64YrAEasALBc/nJo4A/FpnyinUF60OSpHfWaTao9Rf2V/cg+gQQauDO 5FIN1KDajzjMz5LZVVGNKs+nbeWoGPnVCF9rm+K8P9fD2/7k1UqjemF3MDuUsOObdVYmACfv G2u10bTDwweNdef4SGY6X/qjejK9QvrVYRXGLCm+/pChFyI2ndVGBAQTUG8o/Sylgi5Qd03F qAP0nNw9+5orhXtF4SjGU3jyJKZgvICc/ZWAcEf7hnV8Pf76BSfCUQpb2BGRcNz4afaWgcW/ lOOmtroAxlmv7uUVW+R+9+okN+iBcQGBTRcPHFZFGPp9/Gm+dhu1UyXEr6PBYbo1oWdJN3m/ 9ydQMHSbZ03hNVD6ai09Euvb9mE9smQFV5dCuk6swuYAuJFiGyNOtbABbvzt68owGOlor6p5 iZspiRmxLpSZaxhbQTUKAn3IJmn5uyeLBrXikN1Ep8q+lyFoiD/Id8AsGwjfB4yaK7onAMFh 2eJ52tsCGJ7ZiP2PcebnartYyjV8UQQPYu8Da2FBja/SpNwaBWG7ElTib24hAjQfLwXufhnY /+zKJ/0ZV5DUPgP5GfmFo81jO5wrghjlDy7eHwO50n+uVZoTCXOEult3ZrnRr1R0Z5oVy2Lr 4cBZ5PSkU03vS+XSnC/zLP/5GsidRATba0aYeQOKL/rztNOFD5zBvnP76kmfoA5za1Zmv2Rp iO2W1NCyUq5jnrCcF3YZndmYbLpfJB+sXNkYnB8YQf2gyAuMdS18aMSV5orZr17puZt+uF5E qsecMKaD/URFjmeo2YBbYPwpZBJfQiwgV7cJDKsZTUyJsYyRwHA9tL+UBHo8S0CUni+ucck+ uXy3QLHW5sTAQ9lCZ+OOv6oylqwu1kbmf5zABSUcoUCJh20/dEzeSLrj/IxL8UdEjn5x2OXh 1SMHBMVhejRuItpotPHsr+J8tWyGOxkE0sEQ2SCteSqNTPX93aIyJNbVLraZijUUW759fnwZ ehRyP2gYvQLkEwT7th5Grdvi6k/+8Hut/lRyQE9RCfHaFGiC7VBJHia3JYQ6v0Rl+EB4QbmC FiS/tR6OKmSPJK3GVEcEwMpc+Cf2KxGgTLV9/k0fB336SIfEGBriqmO081gUBBgEYY= IronPort-HdrOrdr: A9a23:PNCfPaysgKPtZIQE1C9cKrPwLr1zdoMgy1knxilNoRw8SKKlfq GV7Y0mPHDP6Ar5NEtNpTnEAtjkfZq+z+8S3WByB8bAYOCOggLBR+sO0WKh+UyFJ8SXzJ876U 4KSclD4bPLYmSS9fyKgjWFLw== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64554396" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 66/70] x86/entry: Make syscall/sysenter entrypoints CET-IBT compatible Date: Mon, 14 Feb 2022 12:51:23 +0000 Message-ID: <20220214125127.17985-67-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Each of MSR_{L,C}STAR and MSR_SYSENTER_EIP need to land on an endbr64 instruction. For sysenter, this is easy. Unfortunately for syscall, the stubs are already 29 byte long with a limit of 32. endbr64 is 4 bytes. Luckily, there is a 1 byte instruction which can move from the stubs into the main handlers. Move the push %rax out of the stub and into {l,c}star_entry(), allowing room for the endbr64 instruction when appropriate. Update the comment describing the entry state. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v1.1: * Update to use endbr helpers. --- xen/arch/x86/x86_64/entry.S | 18 +++++++++--------- xen/arch/x86/x86_64/traps.c | 11 +++++++---- 2 files changed, 16 insertions(+), 13 deletions(-) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 8494b97a54a2..9abcf95bd010 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -241,18 +241,17 @@ iret_exit_to_guest: * When entering SYSCALL from user mode: * Vector directly to the registered arch.syscall_addr. * - * Initial work is done by per-CPU trampolines. At this point %rsp has been - * initialised to point at the correct Xen stack, %rsp has been saved, and - * %rax needs to be restored from the %ss save slot. All other registers are - * still to be saved onto the stack, starting with RFLAGS, and an appropriate - * %ss must be saved into the space left by the trampoline. + * Initial work is done by per-CPU trampolines. + * - Guest %rax stored in the %ss slot + * - Guest %rsp stored in %rax + * - Xen stack loaded, pointing at the %ss slot */ ENTRY(lstar_enter) #ifdef CONFIG_XEN_SHSTK ALTERNATIVE "", "setssbsy", X86_FEATURE_XEN_SHSTK #endif - /* sti could live here when we don't switch page tables below. */ - movq 8(%rsp),%rax /* Restore %rax. */ + push %rax /* Guest %rsp */ + movq 8(%rsp), %rax /* Restore guest %rax */ movq $FLAT_KERNEL_SS,8(%rsp) pushq %r11 pushq $FLAT_KERNEL_CS64 @@ -288,9 +287,9 @@ ENTRY(cstar_enter) #ifdef CONFIG_XEN_SHSTK ALTERNATIVE "", "setssbsy", X86_FEATURE_XEN_SHSTK #endif - /* sti could live here when we don't switch page tables below. */ + push %rax /* Guest %rsp */ CR4_PV32_RESTORE - movq 8(%rsp), %rax /* Restore %rax. */ + movq 8(%rsp), %rax /* Restore guest %rax. */ movq $FLAT_USER_SS32, 8(%rsp) /* Assume a 64bit domain. Compat handled lower. */ pushq %r11 pushq $FLAT_USER_CS32 @@ -323,6 +322,7 @@ ENTRY(cstar_enter) jmp switch_to_kernel ENTRY(sysenter_entry) + ENDBR64 #ifdef CONFIG_XEN_SHSTK ALTERNATIVE "", "setssbsy", X86_FEATURE_XEN_SHSTK #endif diff --git a/xen/arch/x86/x86_64/traps.c b/xen/arch/x86/x86_64/traps.c index edc6820b85c7..fccfb7c17283 100644 --- a/xen/arch/x86/x86_64/traps.c +++ b/xen/arch/x86/x86_64/traps.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -295,6 +296,12 @@ static unsigned int write_stub_trampoline( { unsigned char *p = stub; + if ( cpu_has_xen_ibt ) + { + place_endbr64(p); + p += 4; + } + /* Store guest %rax into %ss slot */ /* movabsq %rax, stack_bottom - 8 */ *p++ = 0x48; @@ -315,10 +322,6 @@ static unsigned int write_stub_trampoline( *(uint64_t *)p = stack_bottom - 8; p += 8; - /* Store guest %rsp into %rsp slot */ - /* pushq %rax */ - *p++ = 0x50; - /* jmp target_va */ *p++ = 0xe9; *(int32_t *)p = target_va - (stub_va + (p - stub) + 4); From patchwork Mon Feb 14 12:51:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745603 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2F20DC433F5 for ; Mon, 14 Feb 2022 13:18:02 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272043.466834 (Exim 4.92) (envelope-from ) id 1nJbEm-0002iq-Hb; Mon, 14 Feb 2022 13:17:52 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272043.466834; Mon, 14 Feb 2022 13:17:52 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEm-0002hL-9q; Mon, 14 Feb 2022 13:17:52 +0000 Received: by outflank-mailman (input) for mailman id 272043; Mon, 14 Feb 2022 13:17:50 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3Q-0008IH-DZ for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:08 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id de5ceaad-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:07 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: de5ceaad-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843967; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=skVgVxLknOxv+80SVwWA5GN8E1fXIaaRgPjclkqsHNc=; b=dBDRWjBxD/GZz1XwKIHDYZLG1yUVtOSvRfIDuPkLZF8IA7aau5s7Mcpg CPjoJxhNVN7uK4sWVijJ8qTU3iRBuDZEjlaCxYEJOIp/RKtC5arHN2XL8 WsBosF1Uv3Xt73fY8gI15wlpHeSGfZFbznQIoTSKpe6YofyXoPsCAHfLq k=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: NEp8paYwyA+te02yyWc1DX2MXpcq6Tifjfqu7zoJPEbMHXhfEW7a9tUwfSOgQKyPiqnAPD3sOM Yooc66J92E2/d3q0uF8CWYclirm25+Q1cghSJkLll13ysMNmjZapAXPLE9oy5QT/MKvpR0n/Lw kuUkBT61uexAaBvJ8KUaBVFVisFCFSILQpQtbu6vBrGK4ltZ+zcZZE5LiLktUHiPcWaCeZcO0O mCVFtuzPkQeeSia1mpPL2b+ZPKVPLcw4IMzUelyg6wmi99LeYSmxfmMqdB/cYRcqRH6/4zR0a5 AbyHphPXe+ld+rS4SecsIa9y X-SBRS: 5.1 X-MesageID: 64149440 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:MmuzEqnTwao9Eb2wHeTxu5To5gy+IURdPkR7XQ2eYbSJt1+Wr1Gzt xIfXWiBP63ZNmWjLt10PY21909T6sCAytQxHQI+/CAxECMWpZLJC+rCIxarNUt+DCFioGGLT Sk6QoOdRCzhZiaE/n9BClVlxJVF/fngqoDUUYYoAQgsA180IMsdoUg7wbRh2Nc02YHR7z6l4 rseneWOYDdJ5BYsWo4kw/rrRMRH5amaVJsw5zTSVNgT1LPsvyB94KE3fMldG0DQUIhMdtNWc s6YpF2PEsE1yD92Yj+tuu6TnkTn2dc+NyDW4pZdc/DKbhSvOkXee0v0XRYRQR4/ttmHozx+4 M9Pp67uVTcJAqTzmsEFXjVjPwEiFoQTrdcrIVDn2SCS50jPcn+qyPRyFkAme4Yf/46bA0kXq 6ZecmpUKEne2aTmm9pXScE17ignBODtMJkSpTdLyjbBAOx9aZvCX7/L9ZlT2zJYasVmQ6qHO 5tFNWIHgBLoOURzI00pEa4EjdyOnWWuVwJGk1XIuv9ii4TU5FMoi+W8WDbPQfSVQe1Fk0Deo XjJl0zbKBwHMN2UyRKe72mhwOTImEvTSI8UUbG16PNuqFmS3XAITg0bU0Ohpvu0gVL4XMhQQ 3H44QJ38/J0rhbyCICgAVvo+xZooyLwRfJKEf8Ith296pbd3AS8HmUodRJhNPcP4ZpeqSMR6 neFmNbgBDpKubKTSG6A+rr8kQ5eKRT5PkdZO3ZaEFJtD83L5dhq00mRFooL/Lud04WtcQwc1 Qxmu8TXa187qccQn5u28lnc695HjsiYF1Vljuk7s4/M0++YWGJHT9HygbQ4xawZRGp8crVml CJa8/VyFMhUUfmweNWlGY3h5o2B6fefKyH7ilVyBZQn/DnF0yf9IdwPsGEjeR8waZxsldrVj Kj741052XOuFCHyMf8fj3yZV6zGMpQM5fy6D6uJP7Kik7B6dROd/TEGWKJj9zuFraTYqolmY c3zWZ/1VR4yUP07pBLrF7Z1+eJ6nUgWmDKMLa0XOjz6iNJyklbOEuxbWLZPB8hkhJ65TPL9r YoOaZvSk08HOAA8CwGOmbMuwZkxBSBTLfjLRwZ/L4Zv+yJqRzMsDeH/27Qkd9A3lqhZjL6Qr Hq8RlVZ2Bz0gniecVeGbXVqabXOW5djrC1kYXxwbAjwg3VzM5yy6Ko/docseeV1/uJU0vMpH eIOfN+NA6oTR22fqSgdd5T0sKdraA+v2VCVJyOgbTVmJ8xgSgXF98XKZAzq8CVSXCO7udFn+ ++r1x/BQIpFTANnVZ6EZPWqxlK3nH4chOMtABeYfogNIB3hqdE4JTbwg/k7J9A3BS/CnjbKh RyLBRo4pPXWp9Nn+tf+mq3Z/ZyiFPFzHxQGEjCDv6q2LyTT4kGq3ZREDLSTZTnYWW75pPeia OFSw62uOfELhg8X4Y91ErItxqMi/dr/4bRdy108TnnMal2qDJJmI2WHgpYT5vEcmOcBtFvkQ F+L9/lbJa6NaZHsH1MmLQY4aviOiKMPkT7I4PVpeEj36UebJlZcvZm+6/VUtBFgEQ== IronPort-HdrOrdr: A9a23:GBdeXanfJnC84FfjKRr5d5fvhcPpDfIo3DAbv31ZSRFFG/Fxl6 iV/cjztCWE8Ar5N0tQ+uxoVJPufZqYz+8Q3WBzB8baYOCFghrLEGgK1+KLqFeMdxEWtNQtsp uIG5IObuEYZmIbsS+V2meF+q4bsby6zJw= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149440" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 67/70] x86/entry: Make IDT entrypoints CET-IBT compatible Date: Mon, 14 Feb 2022 12:51:24 +0000 Message-ID: <20220214125127.17985-68-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Each IDT vector needs to land on an endbr64 instruction. This is especially important for the #CP handler, which will recurse indefinitely if the endbr64 is missing, eventually escalating to #DF if guard pages are active. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Extra newlines in asm * Reword commit message --- xen/arch/x86/x86_64/compat/entry.S | 1 + xen/arch/x86/x86_64/entry.S | 30 ++++++++++++++++++++++++++++-- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index c84ff7ea6476..5fd6dbbd4513 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -12,6 +12,7 @@ #include ENTRY(entry_int82) + ENDBR64 ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movl $HYPERCALL_VECTOR, 4(%rsp) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 9abcf95bd010..ea6f0afbc2b4 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -386,6 +386,7 @@ UNLIKELY_END(sysenter_gpf) jmp .Lbounce_exception ENTRY(int80_direct_trap) + ENDBR64 ALTERNATIVE "", clac, X86_FEATURE_XEN_SMAP pushq $0 movl $0x80, 4(%rsp) @@ -698,6 +699,7 @@ ENTRY(common_interrupt) jmp ret_from_intr ENTRY(page_fault) + ENDBR64 movl $TRAP_page_fault,4(%rsp) /* No special register assumptions. */ GLOBAL(handle_exception) @@ -872,75 +874,91 @@ FATAL_exception_with_ints_disabled: BUG /* fatal_trap() shouldn't return. */ ENTRY(divide_error) + ENDBR64 pushq $0 movl $TRAP_divide_error,4(%rsp) jmp handle_exception ENTRY(coprocessor_error) + ENDBR64 pushq $0 movl $TRAP_copro_error,4(%rsp) jmp handle_exception ENTRY(simd_coprocessor_error) + ENDBR64 pushq $0 movl $TRAP_simd_error,4(%rsp) jmp handle_exception ENTRY(device_not_available) + ENDBR64 pushq $0 movl $TRAP_no_device,4(%rsp) jmp handle_exception ENTRY(debug) + ENDBR64 pushq $0 movl $TRAP_debug,4(%rsp) jmp handle_ist_exception ENTRY(int3) + ENDBR64 pushq $0 movl $TRAP_int3,4(%rsp) jmp handle_exception ENTRY(overflow) + ENDBR64 pushq $0 movl $TRAP_overflow,4(%rsp) jmp handle_exception ENTRY(bounds) + ENDBR64 pushq $0 movl $TRAP_bounds,4(%rsp) jmp handle_exception ENTRY(invalid_op) + ENDBR64 pushq $0 movl $TRAP_invalid_op,4(%rsp) jmp handle_exception ENTRY(invalid_TSS) + ENDBR64 movl $TRAP_invalid_tss,4(%rsp) jmp handle_exception ENTRY(segment_not_present) + ENDBR64 movl $TRAP_no_segment,4(%rsp) jmp handle_exception ENTRY(stack_segment) + ENDBR64 movl $TRAP_stack_error,4(%rsp) jmp handle_exception ENTRY(general_protection) + ENDBR64 movl $TRAP_gp_fault,4(%rsp) jmp handle_exception ENTRY(alignment_check) + ENDBR64 movl $TRAP_alignment_check,4(%rsp) jmp handle_exception ENTRY(entry_CP) + ENDBR64 movl $X86_EXC_CP, 4(%rsp) jmp handle_exception ENTRY(double_fault) + ENDBR64 movl $TRAP_double_fault,4(%rsp) /* Set AC to reduce chance of further SMAP faults */ ALTERNATIVE "", stac, X86_FEATURE_XEN_SMAP @@ -966,6 +984,7 @@ ENTRY(double_fault) .pushsection .init.text, "ax", @progbits ENTRY(early_page_fault) + ENDBR64 movl $TRAP_page_fault,4(%rsp) SAVE_ALL movq %rsp,%rdi @@ -974,6 +993,7 @@ ENTRY(early_page_fault) .popsection ENTRY(nmi) + ENDBR64 pushq $0 movl $TRAP_nmi,4(%rsp) handle_ist_exception: @@ -1102,12 +1122,14 @@ handle_ist_exception: #endif ENTRY(machine_check) + ENDBR64 pushq $0 movl $TRAP_machine_check,4(%rsp) jmp handle_ist_exception /* No op trap handler. Required for kexec crash path. */ GLOBAL(trap_nop) + ENDBR64 iretq /* Table of automatically generated entry points. One per vector. */ @@ -1136,7 +1158,9 @@ autogen_stubs: /* Automatically generated stubs. */ #endif ALIGN -1: pushq $0 +1: + ENDBR64 + pushq $0 movb $vec,4(%rsp) jmp common_interrupt @@ -1146,7 +1170,9 @@ autogen_stubs: /* Automatically generated stubs. */ .elseif vec == X86_EXC_CSO || vec == X86_EXC_SPV || \ vec == X86_EXC_VE || (vec > X86_EXC_CP && vec < TRAP_nr) -1: test $8,%spl /* 64bit exception frames are 16 byte aligned, but the word */ +1: + ENDBR64 + test $8,%spl /* 64bit exception frames are 16 byte aligned, but the word */ jz 2f /* size is 8 bytes. Check whether the processor gave us an */ pushq $0 /* error code, and insert an empty one if not. */ 2: movb $vec,4(%rsp) From patchwork Mon Feb 14 12:51:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745554 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1CF43C433EF for ; Mon, 14 Feb 2022 13:05:16 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271650.466264 (Exim 4.92) (envelope-from ) id 1nJb2N-0002fZ-7t; Mon, 14 Feb 2022 13:05:03 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271650.466264; Mon, 14 Feb 2022 13:05:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2M-0002bY-JY; Mon, 14 Feb 2022 13:05:02 +0000 Received: by outflank-mailman (input) for mailman id 271650; Mon, 14 Feb 2022 13:05:01 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb2L-0008IH-7o for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:05:01 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id b6cd002b-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:04:59 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: b6cd002b-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843899; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9zLsHHpejok3Sem3a+Qat8nhch9ye50iKMyyHAXlbbs=; b=eJxic+s/otc3Jj5qPM8P8IACeaLptYMAkJ19jqbMKkHEfm7huJKvAwaE eGwzwHC+f8NsUVYYgU4KmQ/sWM/0RpDIfMovKnXqwF1OhbXAtsGA4wz3e TYFGJOc93mm1WfgiY4f9cj6VHAQnvO0QElF0EKmM93oFDnnw/JypFRtJR 4=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: xcTQUaIPJGzv7edGZ7Uz35El+vDV1JsKrBHiS+3rDuhHYjmKuY8vv5VR5b1rrpeBzlLlCEqv0c dmfSqEI2Hig5hgrIez65nIcM5cdVKl/oRrTqarHmFJsrucJuf+BxdkapFQJpOCMtjD09Z7iPyp ukggPEGO9NVZwksBxgYgI4699HNWsDPhKz4cCdcUKlOBQthLYW7JjaF/rIjH6ZxxYzhVka9+Ng 8+8KI0+s2/Ch++Bq3glKChozkLSaMdDzMvbo+fKcsSuWLxpifzTJNnoKBdi3tF7EQ9TexNyEa/ c3UGOT9mUGx48+PptAUVkNiR X-SBRS: 5.1 X-MesageID: 64149336 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:eqHeI6Amv+P9eRVW/xXkw5YqxClBgxIJ4kV8jS/XYbTApD1zgzEAx mNKCj2AOffeY2b2ed1waITl908Hu8PRz4BqQQY4rX1jcSlH+JHPbTi7wuYcHM8wwunrFh8PA xA2M4GYRCwMo/u1Si6FatANl1ElvU2zbue6WL6s1hxZH1c+En970E47wobVv6Yz6TSHK1LV0 T/Ni5W31G+Ng1aY5UpNtspvADs21BjDkGtwUm4WPJinj3eH/5UhN7oNJLnZEpfNatI88thW5 Qr05OrREmvxp3/BAz4++1rxWhVirrX6ZWBihpfKMkQLb9crSiEai84G2PQghUh/qiu0o+sv6 +lxn4GveForH7Lcpb0cTEwNe81+FfUuFL7vJHG+tYqYzlHccmuqyPJrZK00FdRGoKAtWzgIr KFGbmBWBvyAr7veLLaTY+9gnMk8auLsO5sSoCpIxjDFF/c2B5vERs0m4PcGgG5s15sVQ54yY eJCdx9hNg3wYiZtO08QELUftbys3F3wJmgwRFW9+vNsvjm7IBZK+KfpGMrYfJqNX8o9tmSyq 3/C/m/5KgoHL9HZwj2Amlq8i+mKkS7lVYY6ELyj6uUskFCV3nYUChAdSR28u/bRt6Klc4sBc QpOoHNo9PVsshzwJjXgY/GmiF+agyInBflsL8cn9zDQyIvL8zvAB3dRG1atd+canMMxQDUr0 HqAkNXoGSFjvdWpdJ6NyluHhWjsYHZIdAfucQdBFFJYuIe7/OnfmzqSFo4LLUKjsjHi9dgcK RiupTN2ubgchNVjO06TrQGe2GLESnQko2cICuTrsoCNs1kRiG2NPdXABb3nARFodtjxc7V5l CJY8/VyFchXZX13qASDQf8WAJai7OufPTvXjDZHRsd9q2v9qyP+JdkLulmSwXuF1e5eJ1fUj LL741sNtPe/wlP2BUOIX25BI5tzlvWxfTgUfvvVcsBPcvBMmPyvp0lTibqr9zm1yiAEyPhnU b/CKJrEJStKWMxPkWvtL89AgOBD+8zL7T6KLXwN50/8iuT2ib/8YeptDWZimchnsP3a8F+Ir 76y9aKikn1ibQE3WQGPmaZ7ELzABSRT6Unep5MFe+idDBBhHW19Wfbdzal4I95unrhPl/eO9 Xa4AxcKxF36jHzBCAOLdnE8N++/Acch9So2bX42IFKl+3k/eoLzvq0RQIQ6IOs8/+t5wP8qE /RcI5ecAu5CQyjs8igGacWvt5RrcRmm3FrcPyesbDUlUYRnQgjFpo3tcgf1rXFcBSurr8ou5 ban01qDE5YEQg1jCufQae6ukAzt7SRMxroqUhKRcNdJeUjq/Ix7EADLj6c6c5MWNBHO5jqGz ALKUx0WkvbA/t0u+97TiKHa84rwS7liHlBXFnXw5KqtMXWI5XKqxIJNXbrafT3ZU2+oqqyua f8MkqP5OfwD2l1Lr5B9A/Bgyqdnv4njoLpTzwJFGnTXbgv0VuM8cyfehcQf5LdQwrJ5uBetX hPd89ZXDryFJcf5HQNDPwEidOmCiakZlzS6AS7Z+6kmCPubJIa6bHg= IronPort-HdrOrdr: A9a23:gzxQqKxkV11NCBrsECGWKrPwLr1zdoMgy1knxilNoRw8SKKlfq GV7Y0mPHDP6Ar5NEtNpTnEAtjkfZq+z+8S3WByB8bAYOCOggLBR+sO0WKh+UyFJ8SXzJ876U 4KSclD4bPLYmSS9fyKgjWFLw== X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149336" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 68/70] x86/setup: Rework MSR_S_CET handling for CET-IBT Date: Mon, 14 Feb 2022 12:51:25 +0000 Message-ID: <20220214125127.17985-69-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 CET-SS and CET-IBT can be independently controlled, so the configuration of MSR_S_CET can't be constant any more. Introduce xen_msr_s_cet_value(), mostly because I don't fancy writing/maintaining that logic in assembly. Use this in the 3 paths which alter MSR_S_CET when both features are potentially active. To active CET-IBT, we only need CR4.CET and MSR_S_CET.ENDBR_EN. This is common with the CET-SS setup, so reorder the operations to set up CR4 and MSR_S_CET for any nonzero result from xen_msr_s_cet_value(), and set up MSR_PL0_SSP and SSP if SHSTK_EN was also set. Adjust the crash path to disable CET-IBT too. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Asm adjustments. Add comments regarding safety. --- xen/arch/x86/acpi/wakeup_prot.S | 38 ++++++++++++++++++++++-------------- xen/arch/x86/boot/x86_64.S | 30 +++++++++++++++++----------- xen/arch/x86/crash.c | 4 ++-- xen/arch/x86/include/asm/msr-index.h | 1 + xen/arch/x86/setup.c | 17 +++++++++++++++- 5 files changed, 61 insertions(+), 29 deletions(-) diff --git a/xen/arch/x86/acpi/wakeup_prot.S b/xen/arch/x86/acpi/wakeup_prot.S index 15052c300fa1..3855ff1ddb94 100644 --- a/xen/arch/x86/acpi/wakeup_prot.S +++ b/xen/arch/x86/acpi/wakeup_prot.S @@ -63,7 +63,26 @@ ENTRY(s3_resume) pushq %rax lretq 1: -#ifdef CONFIG_XEN_SHSTK +#if defined(CONFIG_XEN_SHSTK) || defined(CONFIG_XEN_IBT) + call xen_msr_s_cet_value + test %eax, %eax + jz .L_cet_done + + /* Set up MSR_S_CET. */ + mov $MSR_S_CET, %ecx + xor %edx, %edx + wrmsr + + /* Enable CR4.CET. */ + mov $XEN_MINIMAL_CR4 | X86_CR4_CET, %ecx + mov %rcx, %cr4 + + /* WARNING! call/ret now fatal (iff SHSTK) until SETSSBSY loads SSP */ + +#if defined(CONFIG_XEN_SHSTK) + test $CET_SHSTK_EN, %al + jz .L_cet_done + /* * Restoring SSP is a little complicated, because we are intercepting * an in-use shadow stack. Write a temporary token under the stack, @@ -71,14 +90,6 @@ ENTRY(s3_resume) * reset MSR_PL0_SSP to its usual value and pop the temporary token. */ mov saved_ssp(%rip), %rdi - cmpq $1, %rdi - je .L_shstk_done - - /* Set up MSR_S_CET. */ - mov $MSR_S_CET, %ecx - xor %edx, %edx - mov $CET_SHSTK_EN | CET_WRSS_EN, %eax - wrmsr /* Construct the temporary supervisor token under SSP. */ sub $8, %rdi @@ -90,10 +101,6 @@ ENTRY(s3_resume) mov %edi, %eax wrmsr - /* Enable CET. MSR_INTERRUPT_SSP_TABLE is set up later in load_system_tables(). */ - mov $XEN_MINIMAL_CR4 | X86_CR4_CET, %ebx - mov %rbx, %cr4 - /* Write the temporary token onto the shadow stack, and activate it. */ wrssq %rdi, (%rdi) setssbsy @@ -106,8 +113,9 @@ ENTRY(s3_resume) /* Pop the temporary token off the stack. */ mov $2, %eax incsspd %eax -.L_shstk_done: -#endif +#endif /* CONFIG_XEN_SHSTK */ +.L_cet_done: +#endif /* CONFIG_XEN_SHSTK || CONFIG_XEN_IBT */ call load_system_tables diff --git a/xen/arch/x86/boot/x86_64.S b/xen/arch/x86/boot/x86_64.S index 27f52e7a7708..fa41990dde0f 100644 --- a/xen/arch/x86/boot/x86_64.S +++ b/xen/arch/x86/boot/x86_64.S @@ -30,18 +30,27 @@ ENTRY(__high_start) test %ebx,%ebx jz .L_bsp - /* APs. Set up shadow stacks before entering C. */ -#ifdef CONFIG_XEN_SHSTK - testl $cpufeat_mask(X86_FEATURE_XEN_SHSTK), \ - CPUINFO_FEATURE_OFFSET(X86_FEATURE_XEN_SHSTK) + boot_cpu_data(%rip) - je .L_ap_shstk_done + /* APs. Set up CET before entering C properly. */ +#if defined(CONFIG_XEN_SHSTK) || defined(CONFIG_XEN_IBT) + call xen_msr_s_cet_value + test %eax, %eax + jz .L_ap_cet_done /* Set up MSR_S_CET. */ mov $MSR_S_CET, %ecx xor %edx, %edx - mov $CET_SHSTK_EN | CET_WRSS_EN, %eax wrmsr + /* Enable CR4.CET. */ + mov $XEN_MINIMAL_CR4 | X86_CR4_CET, %ecx + mov %rcx, %cr4 + + /* WARNING! call/ret now fatal (iff SHSTK) until SETSSBSY loads SSP */ + +#if defined(CONFIG_XEN_SHSTK) + test $CET_SHSTK_EN, %al + jz .L_ap_cet_done + /* Derive MSR_PL0_SSP from %rsp (token written when stack is allocated). */ mov $MSR_PL0_SSP, %ecx mov %rsp, %rdx @@ -51,13 +60,12 @@ ENTRY(__high_start) or $(PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8, %eax wrmsr - /* Enable CET. MSR_INTERRUPT_SSP_TABLE is set up later in load_system_tables(). */ - mov $XEN_MINIMAL_CR4 | X86_CR4_CET, %ecx - mov %rcx, %cr4 setssbsy -#endif -.L_ap_shstk_done: +#endif /* CONFIG_XEN_SHSTK */ +.L_ap_cet_done: +#endif /* CONFIG_XEN_SHSTK || CONFIG_XEN_IBT */ + call start_secondary BUG /* start_secondary() shouldn't return. */ diff --git a/xen/arch/x86/crash.c b/xen/arch/x86/crash.c index c383f718f5bd..003222c0f1ac 100644 --- a/xen/arch/x86/crash.c +++ b/xen/arch/x86/crash.c @@ -190,8 +190,8 @@ void machine_crash_shutdown(void) /* Reset CPUID masking and faulting to the host's default. */ ctxt_switch_levelling(NULL); - /* Disable shadow stacks. */ - if ( cpu_has_xen_shstk ) + /* Disable CET. */ + if ( cpu_has_xen_shstk || cpu_has_xen_ibt ) { wrmsrl(MSR_S_CET, 0); write_cr4(read_cr4() & ~X86_CR4_CET); diff --git a/xen/arch/x86/include/asm/msr-index.h b/xen/arch/x86/include/asm/msr-index.h index 9df1959fe5a1..3e038db618ff 100644 --- a/xen/arch/x86/include/asm/msr-index.h +++ b/xen/arch/x86/include/asm/msr-index.h @@ -117,6 +117,7 @@ #define MSR_S_CET 0x000006a2 #define CET_SHSTK_EN (_AC(1, ULL) << 0) #define CET_WRSS_EN (_AC(1, ULL) << 1) +#define CET_ENDBR_EN (_AC(1, ULL) << 2) #define MSR_PL0_SSP 0x000006a4 #define MSR_PL1_SSP 0x000006a5 diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 2b1192d85b77..f6a59d5f0412 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -670,6 +670,21 @@ static void noreturn init_done(void) startup_cpu_idle_loop(); } +#if defined(CONFIG_XEN_SHSTK) || defined(CONFIG_XEN_IBT) +/* + * Used by AP and S3 asm code to calcualte the appropriate MSR_S_CET setting. + * Do not use on the BSP before reinit_bsp_stack(), or it may turn SHSTK on + * too early. + */ +unsigned int xen_msr_s_cet_value(void) +{ + return ((cpu_has_xen_shstk ? CET_SHSTK_EN | CET_WRSS_EN : 0) | + (cpu_has_xen_ibt ? CET_ENDBR_EN : 0)); +} +#else +unsigned int xen_msr_s_cet_value(void); /* To avoid ifdefary */ +#endif + /* Reinitalise all state referring to the old virtual address of the stack. */ static void __init noreturn reinit_bsp_stack(void) { @@ -693,7 +708,7 @@ static void __init noreturn reinit_bsp_stack(void) { wrmsrl(MSR_PL0_SSP, (unsigned long)stack + (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8); - wrmsrl(MSR_S_CET, CET_SHSTK_EN | CET_WRSS_EN); + wrmsrl(MSR_S_CET, xen_msr_s_cet_value()); asm volatile ("setssbsy" ::: "memory"); } From patchwork Mon Feb 14 12:51:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A26E1C4332F for ; Mon, 14 Feb 2022 13:16:25 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.271910.466632 (Exim 4.92) (envelope-from ) id 1nJbD8-00012x-Kp; Mon, 14 Feb 2022 13:16:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 271910.466632; Mon, 14 Feb 2022 13:16:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbD8-00012q-Fs; Mon, 14 Feb 2022 13:16:10 +0000 Received: by outflank-mailman (input) for mailman id 271910; Mon, 14 Feb 2022 13:16:09 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3i-0008IH-HG for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:26 +0000 Received: from esa5.hc3370-68.iphmx.com (esa5.hc3370-68.iphmx.com [216.71.155.168]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id e951b73e-8d96-11ec-8eb8-a37418f5ba1a; Mon, 14 Feb 2022 14:06:25 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: e951b73e-8d96-11ec-8eb8-a37418f5ba1a DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843985; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=VDTB6pLtQwW15sO+arBQSOZrTwVU7NXtXfZ8CtNHRX8=; b=TxEYX1uObWL0FyPR/G3bKayqc59BmOSB3GcK4mgFj5OMBLH8F+fw1VDX mlm7JduY02jKHYybbZnAHpRFgjsc5/n+F04VwaFKgnfwx68rhp4oVIMXv dXhqSOU/cjQYiSIuU8LyX3OULLhehUBY3G0F9eH/0WGmCYlJXK/TdnluN I=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: ++CeWZB0+BNTzNsApzkSIN78zTJBzVpqspVucKLtkx8Nn8wwYLwMhAXdK9i0S/kjjiWTjQ4rln TgdYMFWA6r9PnvfS1D42xvK0RcDrNy7Yf/bVaP+EUz3ibL08gZj9vj9xa4oCYyfuxPIotZxCJ9 4M4cI3RJpH05I/RgtGYkm7V9vhp6keGY1G9GlTv/5f62AA9D6kJDFAB4m/KBjUcG9ZlaTMjOrH CLcy7lkD2FMS04sboHJ1XcXBTLUcfQug5HPZ2rhI40WRL/siGeMeP1lZEyq/2B9AdNHnwnU+FU dvlXFI1Z2pI6EJt1fOKOgGfi X-SBRS: 5.1 X-MesageID: 63592704 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:HunMRa1ROykz2ogr6vbD5ex2kn2cJEfYwER7XKvMYLTBsI5bpzAOx mJNWziCO6rbMGPyct11b4q39E9UuJXdn4BrG1RupC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhzulP1 vVGtKaKVVkGN4/wnNhGdiMFKnQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u3Z0fR6mGO 6L1bxI1UDfbR0FGB2s8J5Y/o+Kxnl75Sh1x/Qf9Sa0fvDGIkV0ZPKLWGMXRUsyHQ4NShEnwj kDs8nn9AxoaHMeC0jfD+XWp7sffkCW+VI8MGbmQ8v9xnEbV1mEVEAcRV1awvb++kEHWZj5EA xVKoGx09/F0rRH1CImmN/GlnJKalk8lZcRwGOwA0h3T5aP23wKlXU0+EwcUPbTKq/QKbTAt0 1aImfbgCjpurKCZRBqhy1uEkd+hEXNLdDFfPEfoWSNAuoC++99r0nojW/4+SPbdszHjJd3nL 9lmRgAajq5bs8ME3r7TEbvv02P1/cihouLYC2zqsoOZAuFROdTNi2+AswGzARN8wGGxFAfpg ZT8s5LChN3i9LnU/MB3fM0DHauy+9GOOyDGjFhkEvEJrmrxpyHzLd0NuGglfi+F1/ronhezP ifuVf55vscPbBNGk4crC25ONyja5fe5Tom0PhwlRtFPfoJwZGe6ENJGPiatM5TWuBF0y8kXY M7DGe71VCpyIfk3nVKeGrZGuZd2l39W+I8mbc2ip/hR+eHFPyD9pHZsGAbmU93VG4va/FSLo 44HbZPiJtc2eLSWXxQ7OLU7dTgiRUXXz7irwyCOXuLccAdgBk87DPrdneEod4B/xvwHnebU5 HCtHERfzQOn13HALAyLbFFlaa/uAskj/S5qY3R0MAb6wWUnbKau8LwbK8k9c444+bEx1vVzV fQEJZmNW6wdVjTd9j0BRpDht4g+Jg+zjAeDMnP9MjgydpJtXSLT/drgcle9/SUCFHPv58A/v 6ehxkXQRp9aH1ZuC8PfafSOyVKtvCdCxLIuDhWQetQKIRfi6olnLSD1n8QbGcBUJEWR3Cae2 iaXHQwc+bvHrbgq/YSbnquDtYqoTbdzRxIIA2nB4L+qHiDG5W7/k5RYWeOFcD2BBmP5/KKuO bdcw/3maaBVmV9Lt8x3EqpxzLJ47Nzq/ucIwgNhFXTNTlKqFrI/fSXWgZgR7vVAlu1DpA+7e kOT4d0La7yGNfTsHEMVOAd4PP+I0usZm2WK4Pk4SKkgCPSbIFZTvZ1uAiSx IronPort-HdrOrdr: A9a23:nbn1Oa4idQG2A6NCOAPXwMrXdLJyesId70hD6qhwISY6TiX4rb HWoB1173/JYVoqNE3I3OrwXZVoIkmsk6Kdg7NhXotKNTOO0ADDQb2Kr7GSpwEIcxeOkdK1vp 0AT0ERMrLN5CBB/KTH3DU= X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="63592704" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 69/70] x86/efi: Disable CET-IBT around Runtime Services calls Date: Mon, 14 Feb 2022 12:51:26 +0000 Message-ID: <20220214125127.17985-70-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 UEFI Runtime services, at the time of writing, aren't CET-IBT compatible. Work is ongoing to address this. In the meantime, unconditionally disable IBT. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu https://bugzilla.tianocore.org/show_bug.cgi?id=3726 is the upstream tracking ticket. v2: * Rewrite to be an unconditional disable. --- xen/common/efi/runtime.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/xen/common/efi/runtime.c b/xen/common/efi/runtime.c index e3ce85d118e4..13b0975866e3 100644 --- a/xen/common/efi/runtime.c +++ b/xen/common/efi/runtime.c @@ -21,6 +21,7 @@ struct efi_rs_state { * don't strictly need that. */ unsigned long __aligned(32) cr3; + unsigned long msr_s_cet; #endif }; @@ -113,6 +114,19 @@ struct efi_rs_state efi_rs_enter(void) switch_cr3_cr4(mfn_to_maddr(efi_l4_mfn), read_cr4()); + /* + * At the time of writing (2022), no UEFI firwmare is CET-IBT compatible. + * Work is under way to remedy this. + * + * Stash MSR_S_CET and clobber ENDBR_EN. This is necessary because + * SHSTK_EN isn't configured until very late on the BSP. + */ + if ( cpu_has_xen_ibt ) + { + rdmsrl(MSR_S_CET, state.msr_s_cet); + wrmsrl(MSR_S_CET, state.msr_s_cet & ~CET_ENDBR_EN); + } + return state; } @@ -122,6 +136,10 @@ void efi_rs_leave(struct efi_rs_state *state) if ( !state->cr3 ) return; + + if ( state->msr_s_cet ) + wrmsrl(MSR_S_CET, state->msr_s_cet); + switch_cr3_cr4(state->cr3, read_cr4()); if ( is_pv_vcpu(curr) && !is_idle_vcpu(curr) ) { From patchwork Mon Feb 14 12:51:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 12745605 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D87AAC433FE for ; Mon, 14 Feb 2022 13:18:10 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.272055.466863 (Exim 4.92) (envelope-from ) id 1nJbEu-0003xt-C8; Mon, 14 Feb 2022 13:18:00 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 272055.466863; Mon, 14 Feb 2022 13:18:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJbEu-0003xZ-7a; Mon, 14 Feb 2022 13:18:00 +0000 Received: by outflank-mailman (input) for mailman id 272055; Mon, 14 Feb 2022 13:17:59 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1nJb3o-00023t-R9 for xen-devel@lists.xenproject.org; Mon, 14 Feb 2022 13:06:32 +0000 Received: from esa2.hc3370-68.iphmx.com (esa2.hc3370-68.iphmx.com [216.71.145.153]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id ec7c1354-8d96-11ec-b215-9bbe72dcb22c; Mon, 14 Feb 2022 14:06:30 +0100 (CET) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: ec7c1354-8d96-11ec-b215-9bbe72dcb22c DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1644843991; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Fi1axB5uLDN6sum8D3QAzPbry9w69HfPZE5bf+cwyeI=; b=PQQq7X46NRbXGvmVSBPosFHLgyw90NQKIivGXJkLPESi1dKWbHlOsYuO Ut7xsWEMdh/okBNM+wT8/klBZBIVkiS2MYur/JvsRLiSaAuS2bAWC9HhH +ybA+W3OZ4fCcHej6awBoIOEIb3T74M4qlNluPnOlGH3N5v6wJtMahQEI I=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: QN9REi7sea3NQjbnfqcCbTAgxLnQRXYY7nAJdw3CZLM2hEi06ARdRAbUibAOeWSUqe7/XDV3pH vqpyXkGofxjgc+6Y6lMZfrTB9dhuq1YqbFxAGpfmpJnOsv1HFwVJZ4S0ZBgfjYxZ14XyM6H/dz Hr/WHjh4kGddGmmpwhxMlEZ8SZ+X2mfRGJvysY5ZS+W8IKLDA2xprjL6iZU8eOjNAsB3Q9zBus 2qzEUPciw2yKqK1+mweDSqkr1AkSI+tdxgDN9JKVGiLWt/5nFS5aWNY3AE/06RzuNoRpDjk1sZ 2apg6rjJs6nTsXaJueJHjUkK X-SBRS: 5.1 X-MesageID: 64149496 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.156.83 X-Policy: $RELAYED IronPort-Data: A9a23:g4kxga3gJS4tdbjDWvbD5ex2kn2cJEfYwER7XKvMYLTBsI5bpzFVm jBMCj3QaancYDCmfYp3Oouw9BwO65WHmNNhHAs6pC1hF35El5HIVI+TRqvS04J+DSFhoGZPt Zh2hgzodZhsJpPkS5PE3oHJ9RGQ74nRLlbHILOCanAZqTNMEn9700o5wrJh2+aEvPDia++zk YKqyyHgEAfNNw5cagr4PIra9XuDFNyr0N8plgRWicJj5TcypFFMZH4rHomjLmOQf2VhNrXSq 9Avbl2O1jixEx8FUrtJm1tgG6EAaua60QOm0hK6V0U+6/TrS+NbPqsTbZIhhUlrZzqhuPBB5 tVxrpCMURYWAa7et8MQVz1RHHQrVUFG0OevzXmXtMWSywvNcmf2wuUoB0YzVWEa0r8pWycUr 6VecW1TKEDY7w616OvTpu1Er8IvNsT0eqgYvWlt12rxBvc6W5HTBa7N4Le02R9u2pkSTKqPO aL1bxJJURfFTScXIG0TJ7Aj28GugX3zV2FH/Qf9Sa0fvDGIkV0ZPKLWGMXRUsyHQ4NShEnwj kDs8nn9AxoaHMeC0jfD+XWp7sffkCW+VI8MGbmQ8v9xnEbV1mEVEAcRV1awvb++kEHWZj5EA xVKoGx09/F0rRH1CImmN/GlnJKaljk8a/RQL/Y21Bmc9ZXX8Sm+C2wgRzEUPbTKq/QKbTAt0 1aImfbgCjpurKCZRBqhy1uEkd+hEXNLdDFfPEfoWSNAuoC++99r0nojW/4+SPbdszHjJd3nL 9lmRgAajq5bs8ME3r7TEbvv02P1/cihouLYC2zqsoOZAuFROdTNi2+AswGzARN8wGGxFAfpg ZT8s5LChN3i9LnU/MB3fM0DHauy+9GOOyDGjFhkEvEJrmrxpyHzLd0NuGglfi+F1/ronhezP ifuVf55vscPbBNGk4crC25ONyja5fe5Tom0PhwlRtFPfoJwZGe6ENJGPiatM5TWuBF0y8kXY M7DGe71VCpyIfk3nVKeGrZGuZd2l39W+I8mbc2ip/hR+eHFPyD9pHZsGAbmU93VG4va/FSLo 44HbZPiJtc2eLSWXxQ7OLU7dTgiRUXXz7iqwyCOXuLccAdgBk87DPrdneEod4B/xvwHnebU5 HCtHERfzQOn13HALAyLbFFlaa/uAskj/S5qY3R0MAb6wWUnbKau8LwbK8k9c444+bEx1vVzV fQEJZmNW6wdVjTd9j0BRpDht4g+Jg+zjAeDMnP9MjgydpJtXSLT/drgcle9/SUCFHPv58A/v 6ehxkXQRp9aH1ZuC8PfafSOyVKtvCdCxLIuDhWQetQKIRfi6olnLSD1n8QbGcBUJEWR3Cae2 iaXHQwc+bvHrbgq/YSbnquDtYqoTbdzRxIIA2nB4L+qHiDG5W7/k5RYWeOFcD2BBmP5/KKuO bdcw/3maaBVmV9Lt8x3EqpxzLJ47Nzq/ucIwgNhFXTNTlKqFrI/fSXWgZgR7vVAlu1DpA+7e kOT4d0La7yGNfTsHEMVOAd4PP+I0usZm2WK4Pk4SKkgCPSbIFZTvZ1uAiSx IronPort-HdrOrdr: A9a23:6y10gKrvUIhlEuZ8Jo6yMIkaV5opeYIsimQD101hICG8cqSj+f xG/c5rrCMc5wxwZJhNo7y90ey7MBbhHP1OkO8s1NWZLWrbUQKTRekIh+bfKn/baknDH4ZmpM BdmsNFaeEYY2IUsS+D2njbL+od X-IronPort-AV: E=Sophos;i="5.88,367,1635220800"; d="scan'208";a="64149496" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Wei Liu Subject: [PATCH v2 70/70] x86: Enable CET Indirect Branch Tracking Date: Mon, 14 Feb 2022 12:51:27 +0000 Message-ID: <20220214125127.17985-71-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20220214125127.17985-1-andrew.cooper3@citrix.com> References: <20220214125127.17985-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 With all the pieces now in place, turn CET-IBT on when available. MSR_S_CET, like SMEP/SMAP, controls Ring1 meaning that ENDBR_EN can't be enabled for Xen independently of PV32 kernels. As we already disable PV32 for CET-SS, extend this to all CET, adjusting the documentation/comments as appropriate. Introduce a cet=no-ibt command line option to allow the admin to disable IBT even when everything else is configured correctly. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monné CC: Wei Liu v2: * Rebase over change to UEFI RS handling --- docs/misc/xen-command-line.pandoc | 16 +++++++++++---- xen/arch/x86/cpu/common.c | 1 + xen/arch/x86/setup.c | 42 ++++++++++++++++++++++++++++++++++----- 3 files changed, 50 insertions(+), 9 deletions(-) diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc index 1ca817f5e1b9..92891a856971 100644 --- a/docs/misc/xen-command-line.pandoc +++ b/docs/misc/xen-command-line.pandoc @@ -271,7 +271,7 @@ enough. Setting this to a high value may cause boot failure, particularly if the NMI watchdog is also enabled. ### cet - = List of [ shstk= ] + = List of [ shstk=, ibt= ] Applicability: x86 @@ -279,6 +279,10 @@ Controls for the use of Control-flow Enforcement Technology. CET is group a of hardware features designed to combat Return-oriented Programming (ROP, also call/jmp COP/JOP) attacks. +CET is incompatible with 32bit PV guests. If any CET sub-options are active, +they will override the `pv=32` boolean to `false`. Backwards compatibility +can be maintained with the pv-shim mechanism. + * The `shstk=` boolean controls whether Xen uses Shadow Stacks for its own protection. @@ -287,9 +291,13 @@ call/jmp COP/JOP) attacks. `cet=no-shstk` will cause Xen not to use Shadow Stacks even when support is available in hardware. - Shadow Stacks are incompatible with 32bit PV guests. This option will - override the `pv=32` boolean to false. Backwards compatibility can be - maintained with the `pv-shim` mechanism. +* The `ibt=` boolean controls whether Xen uses Indirect Branch Tracking for + its own protection. + + The option is available when `CONFIG_XEN_IBT` is compiled in, and defaults + to `true` on hardware supporting CET-IBT. Specifying `cet=no-ibt` will + cause Xen not to use Indirect Branch Tracking even when support is + available in hardware. ### clocksource (x86) > `= pit | hpet | acpi | tsc` diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c index 6b674bf15e8b..bfb8cf9f100b 100644 --- a/xen/arch/x86/cpu/common.c +++ b/xen/arch/x86/cpu/common.c @@ -345,6 +345,7 @@ void __init early_cpu_init(void) if (c->cpuid_level >= 7) { cpuid_count(7, 0, &eax, &ebx, &ecx, &edx); c->x86_capability[cpufeat_word(X86_FEATURE_CET_SS)] = ecx; + c->x86_capability[cpufeat_word(X86_FEATURE_CET_IBT)] = edx; } eax = cpuid_eax(0x80000000); diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index f6a59d5f0412..f5449c972825 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -102,6 +102,12 @@ static bool __initdata opt_xen_shstk = true; #define opt_xen_shstk false #endif +#ifdef CONFIG_XEN_IBT +static bool __initdata opt_xen_ibt = true; +#else +#define opt_xen_ibt false +#endif + static int __init cf_check parse_cet(const char *s) { const char *ss; @@ -120,6 +126,14 @@ static int __init cf_check parse_cet(const char *s) no_config_param("XEN_SHSTK", "cet", s, ss); #endif } + else if ( (val = parse_boolean("ibt", s, ss)) >= 0 ) + { +#ifdef CONFIG_XEN_IBT + opt_xen_ibt = val; +#else + no_config_param("XEN_IBT", "cet", s, ss); +#endif + } else rc = -EINVAL; @@ -1118,11 +1132,33 @@ void __init noreturn __start_xen(unsigned long mbi_p) printk("Enabling Supervisor Shadow Stacks\n"); setup_force_cpu_cap(X86_FEATURE_XEN_SHSTK); + } + + if ( opt_xen_ibt && boot_cpu_has(X86_FEATURE_CET_IBT) ) + { + printk("Enabling Indirect Branch Tracking\n"); + + setup_force_cpu_cap(X86_FEATURE_XEN_IBT); + + if ( efi_enabled(EFI_RS) ) + printk(" - IBT disabled in UEFI Runtime Services\n"); + + /* + * Enable IBT now. Only require the endbr64 on callees, which is + * entirely build-time arrangements. + */ + wrmsrl(MSR_S_CET, CET_ENDBR_EN); + } + + if ( cpu_has_xen_shstk || cpu_has_xen_ibt ) + { + set_in_cr4(X86_CR4_CET); + #ifdef CONFIG_PV32 if ( opt_pv32 ) { opt_pv32 = 0; - printk(" - Disabling PV32 due to Shadow Stacks\n"); + printk(" - Disabling PV32 due to CET\n"); } #endif } @@ -1849,10 +1885,6 @@ void __init noreturn __start_xen(unsigned long mbi_p) alternative_branches(); - /* Defer CR4.CET until alternatives have finished playing with CR0.WP */ - if ( cpu_has_xen_shstk ) - set_in_cr4(X86_CR4_CET); - /* * NB: when running as a PV shim VCPUOP_up/down is wired to the shim * physical cpu_add/remove functions, so launch the guest with only