[xen master] {hyper,multi}call: further limit arguments to just 5

[patchbot@xxxxxxx]

commit e81baffaff115c88f33097d171e5e7262e581c2d
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri May 2 09:43:23 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri May 2 09:43:23 2025 +0200

    {hyper,multi}call: further limit arguments to just 5
    
    Multicall compat translation and hypercall continuation handling can
    also be shrunk to the processing of just (up to) 5 arguments.
    
    Take the opportunity to
    - make exceeding the limit noisy in hypercall_create_continuation(),
    - use speculation-safe array access in hypercall_create_continuation(),
    - avoid a Misra C:2012 Rule 19.1 violation in xlat_multicall_entry(),
    - further tidy xlat_multicall_entry() and __trace_multicall_call()
      style-wise.
    
    Amends: 2f531c122e95 ("x86: limit number of hypercall parameters to 5")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Stefano Stabellini <sstabellini@xxxxxxxxxx> # arm
---
 xen/arch/arm/domain.c         | 10 +++++++---
 xen/arch/x86/hypercall.c      | 11 +++++++----
 xen/common/compat/multicall.c | 14 +++++++++-----
 xen/include/public/xen.h      |  4 ++++
 4 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/xen/arch/arm/domain.c b/xen/arch/arm/domain.c
index 23cf8729f1..45aeb8bddc 100644
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -391,7 +391,11 @@ unsigned long hypercall_create_continuation(
     if ( mcs->flags & MCSF_in_multicall )
     {
         for ( i = 0; *p != '\0'; i++ )
-            mcs->call.args[i] = NEXT_ARG(p, args);
+        {
+            if ( i >= ARRAY_SIZE(mcs->call.args) )
+                goto bad_fmt;
+            array_access_nospec(mcs->call.args, i) = NEXT_ARG(p, args);
+        }
 
         /* Return value gets written back to mcs->call.result */
         rc = mcs->call.result;
@@ -416,7 +420,7 @@ unsigned long hypercall_create_continuation(
                 case 2: regs->x2 = arg; break;
                 case 3: regs->x3 = arg; break;
                 case 4: regs->x4 = arg; break;
-                case 5: regs->x5 = arg; break;
+                default: goto bad_fmt;
                 }
             }
 
@@ -439,7 +443,7 @@ unsigned long hypercall_create_continuation(
                 case 2: regs->r2 = arg; break;
                 case 3: regs->r3 = arg; break;
                 case 4: regs->r4 = arg; break;
-                case 5: regs->r5 = arg; break;
+                default: goto bad_fmt;
                 }
             }
 
diff --git a/xen/arch/x86/hypercall.c b/xen/arch/x86/hypercall.c
index d292376b19..dc0a90ca09 100644
--- a/xen/arch/x86/hypercall.c
+++ b/xen/arch/x86/hypercall.c
@@ -41,7 +41,11 @@ unsigned long hypercall_create_continuation(
     if ( mcs->flags & MCSF_in_multicall )
     {
         for ( i = 0; *p != '\0'; i++ )
-            mcs->call.args[i] = NEXT_ARG(p, args);
+        {
+            if ( i >= ARRAY_SIZE(mcs->call.args) )
+                goto bad_fmt;
+            array_access_nospec(mcs->call.args, i) = NEXT_ARG(p, args);
+        }
     }
     else
     {
@@ -65,7 +69,7 @@ unsigned long hypercall_create_continuation(
                 case 2: regs->rdx = arg; break;
                 case 3: regs->r10 = arg; break;
                 case 4: regs->r8  = arg; break;
-                case 5: regs->r9  = arg; break;
+                default: goto bad_fmt;
                 }
             }
         }
@@ -81,7 +85,7 @@ unsigned long hypercall_create_continuation(
                 case 2: regs->rdx = arg; break;
                 case 3: regs->rsi = arg; break;
                 case 4: regs->rdi = arg; break;
-                case 5: regs->rbp = arg; break;
+                default: goto bad_fmt;
                 }
             }
         }
@@ -177,7 +181,6 @@ int hypercall_xlat_continuation(unsigned int *id, unsigned 
int nr,
             case 2: reg = &regs->rdx; break;
             case 3: reg = &regs->rsi; break;
             case 4: reg = &regs->rdi; break;
-            case 5: reg = &regs->rbp; break;
             default: BUG(); reg = NULL; break;
             }
             if ( (mask & 1) )
diff --git a/xen/common/compat/multicall.c b/xen/common/compat/multicall.c
index b17739d218..26ea82e1ea 100644
--- a/xen/common/compat/multicall.c
+++ b/xen/common/compat/multicall.c
@@ -14,9 +14,13 @@ typedef int ret_t;
 
 static inline void xlat_multicall_entry(struct mc_state *mcs)
 {
-    int i;
-    for (i=0; i<6; i++)
-        mcs->compat_call.args[i] = mcs->call.args[i];
+    unsigned int i;
+    typeof(mcs->compat_call.args[0]) args[ARRAY_SIZE(mcs->call.args)];
+
+    for ( i = 0; i < ARRAY_SIZE(args); i++ )
+        args[i] = mcs->call.args[i];
+
+    memcpy(mcs->compat_call.args, args, sizeof(args));
 }
 
 #define multicall_entry      compat_multicall_entry
@@ -29,8 +33,8 @@ static inline void xlat_multicall_entry(struct mc_state *mcs)
 
 static void __trace_multicall_call(multicall_entry_t *call)
 {
-    xen_ulong_t args[6];
-    int i;
+    xen_ulong_t args[ARRAY_SIZE(call->args)];
+    unsigned int i;
 
     for ( i = 0; i < ARRAY_SIZE(args); i++ )
         args[i] = call->args[i];
diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h
index 75b1c1d597..82b9c05a76 100644
--- a/xen/include/public/xen.h
+++ b/xen/include/public/xen.h
@@ -640,7 +640,11 @@ DEFINE_XEN_GUEST_HANDLE(mmu_update_t);
  */
 struct multicall_entry {
     xen_ulong_t op, result;
+#ifndef __XEN__
     xen_ulong_t args[6];
+#else /* Only 5 arguments are supported in reality. */
+    xen_ulong_t args[5], unused;
+#endif
 };
 typedef struct multicall_entry multicall_entry_t;
 DEFINE_XEN_GUEST_HANDLE(multicall_entry_t);
--
generated by git-patchbot for /home/xen/git/xen.git#master