x86/ioemul: Rewrite stub generation to be shadow stack compatible
authorAndrew Cooper <andrew.cooper3@citrix.com>
Mon, 27 Apr 2020 12:19:21 +0000 (13:19 +0100)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Tue, 26 May 2020 13:33:06 +0000 (14:33 +0100)
commitd89e5e65f305740b2f7bd56e6f3b6c9c52ee0707
tree144e3eba6d2831865ab8db9a0ac3aff97d2e8136
parentd9b29088603f8438160eb4852cedd85cb7c61a19
x86/ioemul: Rewrite stub generation to be shadow stack compatible

The logic is completely undocumented and almost impossible to follow.  It
actually uses return oriented programming.  Rewrite it to conform to more
normal call mechanics, and leave a big comment explaining thing.  As well as
the code being easier to follow, it will execute faster as it isn't fighting
the branch predictor.

Move the ioemul_handle_quirk() function pointer from traps.c to
ioport_emulate.c.  There is no reason for it to be in neither of the two
translation units which use it.  Alter the behaviour to return the number of
bytes written into the stub.

Introduce a new nocall annotation using __attribute__((error)) to prohibit
calls being made.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
xen/arch/x86/ioport_emulate.c
xen/arch/x86/pv/emul-priv-op.c
xen/arch/x86/pv/gpr_switch.S
xen/arch/x86/traps.c
xen/include/asm-x86/io.h
xen/include/xen/compiler.h