[xen staging-4.21] platform-op/XSM: move resource-{,un}plug-core checks

[patchbot@xxxxxxx]

commit 42d062839d10992b303521ba14a0a8d038ab9e43
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:39:05 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:07:36 2026 +0100

    platform-op/XSM: move resource-{,un}plug-core checks
    
    Integrate the checking with flask_platform_op(); there never really was a
    need to defer these checks, as the sub-op has always been known to the
    function. As a positive side effect, permissions are then checked at the
    same early point with and without Flask.
    
    This is CVE-2026-62427 / part of XSA-499.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-By: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 4ef45cbe31427bb3cedb11be45c90b1706205ee9)
---
 xen/arch/x86/platform_hypercall.c | 16 ----------------
 xen/xsm/flask/hooks.c             |  9 ++++++---
 2 files changed, 6 insertions(+), 19 deletions(-)

diff --git a/xen/arch/x86/platform_hypercall.c 
b/xen/arch/x86/platform_hypercall.c
index 79bb99e0b6..40783a8d53 100644
--- a/xen/arch/x86/platform_hypercall.c
+++ b/xen/arch/x86/platform_hypercall.c
@@ -706,10 +706,6 @@ ret_t do_platform_op(
     {
         int cpu = op->u.cpu_ol.cpuid;
 
-        ret = xsm_resource_plug_core(XSM_HOOK);
-        if ( ret )
-            break;
-
         if ( cpu >= nr_cpu_ids || !cpu_present(cpu) ||
              clocksource_is_tsc() )
         {
@@ -732,10 +728,6 @@ ret_t do_platform_op(
     {
         int cpu = op->u.cpu_ol.cpuid;
 
-        ret = xsm_resource_unplug_core(XSM_HOOK);
-        if ( ret )
-            break;
-
         if ( cpu == 0 )
         {
             ret = -EOPNOTSUPP;
@@ -760,20 +752,12 @@ ret_t do_platform_op(
     }
 
     case XENPF_cpu_hotadd:
-        ret = xsm_resource_plug_core(XSM_HOOK);
-        if ( ret )
-            break;
-
         ret = cpu_add(op->u.cpu_add.apic_id,
                       op->u.cpu_add.acpi_id,
                       op->u.cpu_add.pxm);
         break;
 
     case XENPF_mem_hotadd:
-        ret = xsm_resource_plug_core(XSM_HOOK);
-        if ( ret )
-            break;
-
         ret = memory_add(op->u.mem_add.spfn,
                       op->u.mem_add.epfn,
                       op->u.mem_add.pxm);
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ae33e324bd..953297c959 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1244,6 +1244,7 @@ static int cf_check flask_pci_config_permission(
 
 }
 
+#if defined(CONFIG_SYSCTL) || defined(CONFIG_X86)
 static int cf_check flask_resource_plug_core(void)
 {
     return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, 
RESOURCE__PLUG, NULL);
@@ -1253,6 +1254,7 @@ static int cf_check flask_resource_unplug_core(void)
 {
     return avc_current_has_perm(SECINITSID_DOMXEN, SECCLASS_RESOURCE, 
RESOURCE__UNPLUG, NULL);
 }
+#endif /* CONFIG_SYSCTL || CONFIG_X86 */
 
 #ifdef CONFIG_SYSCTL
 static int flask_resource_use_core(void)
@@ -1573,12 +1575,13 @@ static int cf_check flask_platform_op(uint32_t op)
     switch ( op )
     {
 #ifdef CONFIG_X86
-    /* These operations have their own XSM hooks */
     case XENPF_cpu_online:
-    case XENPF_cpu_offline:
     case XENPF_cpu_hotadd:
     case XENPF_mem_hotadd:
-        return 0;
+        return flask_resource_plug_core();
+
+    case XENPF_cpu_offline:
+        return flask_resource_unplug_core();
 #endif
 
     case XENPF_settime32:
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.21