[xen master] xen/ioreq: Use guest_cmpxchg64() instead of cmpxchg()

[patchbot@xxxxxxx]

commit 94aeaaa77e6eba6ca50f7bd742f2f356efb85926
Author:     Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
AuthorDate: Fri Jan 29 03:48:41 2021 +0200
Commit:     Julien Grall <jgrall@xxxxxxxxxx>
CommitDate: Fri Jan 29 16:55:23 2021 +0000

    xen/ioreq: Use guest_cmpxchg64() instead of cmpxchg()
    
    The cmpxchg() in ioreq_send_buffered() operates on memory shared
    with the emulator domain (and the target domain if the legacy
    interface is used).
    
    In order to be on the safe side we need to switch
    to guest_cmpxchg64() to prevent a domain to DoS Xen on Arm.
    The point to use 64-bit version of helper is to support Arm32
    since the IOREQ code uses cmpxchg() with 64-bit value.
    
    As there is no plan to support the legacy interface on Arm,
    we will have a page to be mapped in a single domain at the time,
    so we can use s->emulator in guest_cmpxchg64() safely.
    
    Thankfully the only user of the legacy interface is x86 so far
    and there is not concern regarding the atomics operations.
    
    Please note, that the legacy interface *must* not be used on Arm
    without revisiting the code.
    
    Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
    Acked-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    Reviewed-by: Paul Durrant <paul@xxxxxxx>
    CC: Julien Grall <julien.grall@xxxxxxx>
    [On Arm only]
    Tested-by: Wei Chen <Wei.Chen@xxxxxxx>
---
 xen/common/ioreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/common/ioreq.c b/xen/common/ioreq.c
index de3066a0ba..07572a5c32 100644
--- a/xen/common/ioreq.c
+++ b/xen/common/ioreq.c
@@ -29,6 +29,7 @@
 #include <xen/trace.h>
 #include <xen/vpci.h>
 
+#include <asm/guest_atomics.h>
 #include <asm/ioreq.h>
 
 #include <public/hvm/ioreq.h>
@@ -1185,7 +1186,7 @@ static int ioreq_send_buffered(struct ioreq_server *s, 
ioreq_t *p)
 
         new.read_pointer = old.read_pointer - n * IOREQ_BUFFER_SLOT_NUM;
         new.write_pointer = old.write_pointer - n * IOREQ_BUFFER_SLOT_NUM;
-        cmpxchg(&pg->ptrs.full, old.full, new.full);
+        guest_cmpxchg64(s->emulator, &pg->ptrs.full, old.full, new.full);
     }
 
     notify_via_xen_event_channel(d, s->bufioreq_evtchn);
--
generated by git-patchbot for /home/xen/git/xen.git#master