[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen staging] x86/logdirty: CFI hardening
commit 82081d6ef72b287d7e41807f50f070e0ebd408fe Author: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> AuthorDate: Fri Oct 29 17:35:26 2021 +0100 Commit: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> CommitDate: Wed Feb 23 15:33:43 2022 +0000 x86/logdirty: CFI hardening Control Flow Integrity schemes use toolchain and optionally hardware support to help protect against call/jump/return oriented programming attacks. Use cf_check to annotate function pointer targets for the toolchain. Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Acked-by: Jan Beulich <jbeulich@xxxxxxxx> --- xen/arch/x86/mm/hap/hap.c | 6 +++--- xen/arch/x86/mm/shadow/common.c | 12 ++++++------ xen/arch/x86/mm/shadow/none.c | 6 +++--- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/xen/arch/x86/mm/hap/hap.c b/xen/arch/x86/mm/hap/hap.c index de4b13565a..ed5112b00b 100644 --- a/xen/arch/x86/mm/hap/hap.c +++ b/xen/arch/x86/mm/hap/hap.c @@ -180,7 +180,7 @@ out: * NB: Domain that having device assigned should not set log_global. Because * there is no way to track the memory updating from device. */ -static int hap_enable_log_dirty(struct domain *d, bool_t log_global) +static int cf_check hap_enable_log_dirty(struct domain *d, bool log_global) { struct p2m_domain *p2m = p2m_get_hostp2m(d); @@ -211,7 +211,7 @@ static int hap_enable_log_dirty(struct domain *d, bool_t log_global) return 0; } -static int hap_disable_log_dirty(struct domain *d) +static int cf_check hap_disable_log_dirty(struct domain *d) { paging_lock(d); d->arch.paging.mode &= ~PG_log_dirty; @@ -228,7 +228,7 @@ static int hap_disable_log_dirty(struct domain *d) return 0; } -static void hap_clean_dirty_bitmap(struct domain *d) +static void cf_check hap_clean_dirty_bitmap(struct domain *d) { /* * Switch to log-dirty mode, either by setting l1e entries of P2M table to diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c index 83dedc8870..071a19adce 100644 --- a/xen/arch/x86/mm/shadow/common.c +++ b/xen/arch/x86/mm/shadow/common.c @@ -40,9 +40,9 @@ DEFINE_PER_CPU(uint32_t,trace_shadow_path_flags); -static int sh_enable_log_dirty(struct domain *, bool log_global); -static int sh_disable_log_dirty(struct domain *); -static void sh_clean_dirty_bitmap(struct domain *); +static int cf_check sh_enable_log_dirty(struct domain *, bool log_global); +static int cf_check sh_disable_log_dirty(struct domain *); +static void cf_check sh_clean_dirty_bitmap(struct domain *); /* Set up the shadow-specific parts of a domain struct at start of day. * Called for every domain from arch_domain_create() */ @@ -3016,7 +3016,7 @@ static int shadow_test_disable(struct domain *d) /* Shadow specific code which is called in paging_log_dirty_enable(). * Return 0 if no problem found. */ -static int sh_enable_log_dirty(struct domain *d, bool log_global) +static int cf_check sh_enable_log_dirty(struct domain *d, bool log_global) { int ret; @@ -3044,7 +3044,7 @@ static int sh_enable_log_dirty(struct domain *d, bool log_global) } /* shadow specfic code which is called in paging_log_dirty_disable() */ -static int sh_disable_log_dirty(struct domain *d) +static int cf_check sh_disable_log_dirty(struct domain *d) { int ret; @@ -3058,7 +3058,7 @@ static int sh_disable_log_dirty(struct domain *d) /* This function is called when we CLEAN log dirty bitmap. See * paging_log_dirty_op() for details. */ -static void sh_clean_dirty_bitmap(struct domain *d) +static void cf_check sh_clean_dirty_bitmap(struct domain *d) { paging_lock(d); /* Need to revoke write access to the domain's pages again. diff --git a/xen/arch/x86/mm/shadow/none.c b/xen/arch/x86/mm/shadow/none.c index 79889b926a..463a0e3e89 100644 --- a/xen/arch/x86/mm/shadow/none.c +++ b/xen/arch/x86/mm/shadow/none.c @@ -1,19 +1,19 @@ #include <xen/mm.h> #include <asm/shadow.h> -static int _enable_log_dirty(struct domain *d, bool log_global) +static int cf_check _enable_log_dirty(struct domain *d, bool log_global) { ASSERT(is_pv_domain(d)); return -EOPNOTSUPP; } -static int _disable_log_dirty(struct domain *d) +static int cf_check _disable_log_dirty(struct domain *d) { ASSERT(is_pv_domain(d)); return -EOPNOTSUPP; } -static void _clean_dirty_bitmap(struct domain *d) +static void cf_check _clean_dirty_bitmap(struct domain *d) { ASSERT(is_pv_domain(d)); } -- generated by git-patchbot for /home/xen/git/xen.git#staging
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |