Re: [PATCH 2/2] xen/x86: address violations of Rule 11.3

[Stefano Stabellini <stefano.stabellini@xxxxxxx>]

Hi Jan,

I apologize for the confusion. I initially believed this patch would
reduce the outstanding violations to zero on x86, but in reality, there
are still 1,415 remaining.

https://gitlab.com/xen-project/people/sstabellini/xen/-/jobs/10660702979

Given this, I believe we should consider globally deviating the rule on
x86, or at least apply it opportunistically, as we have done with other
rules. In such cases, the rule is accepted but not actively scanned with
ECLAIR, and we provide alternatives, such as using GCC ASAN, along with an
explanation that misaligned access typically does not lead to crashes on
x86.



On Thu, 10 Jul 2025, Jan Beulich wrote:
> On 10.07.2025 02:35, Stefano Stabellini wrote:
> > On Wed, 9 Jul 2025, Jan Beulich wrote:
> >>> What fine grained deviation do you have in mind?
> >>
> >> Ones for almost(?) everything that is having actual code changes right now
> >> in this series.
> > 
> > We could easily deviate alternative.c based on the file name alone. But
> > for the rest:
> > 
> > emulate.c: casts from unsigned char* (byte aligned) to uint64_t* (8 bytes
> > aligned)
> 
> This one may indeed be fine to patch.
> 
> > vlapic.h: casts from uint8_t* (byte aligned) to uint32_t* (4 bytes aligned)
> 
> These only give the impression of increasing alignment. struct 
> hvm_hw_lapic_regs
> is containing solely an uint8_t[1024] array, and all instances (created from
> vlapic_init()) actually end up at page boundaries. What I don't know is 
> whether
> adding __aligned(PAGE_SIZE) to the struct vlapic field declaration would
> convince Eclair of there being no issue here. Probably not, as the array index
> used in both of the accesses isn't known (to it) to be 16-byte aligned.
> 
> > setup.c: games with symbols
> 
> The change here may again be acceptable; better may be to use memchr_inv()
> there, as being less obfuscating _and_ eliminating the cast there altogether.
> 
> > iommu_init.c: cast from uint32_t* (4 bytes aligned) to uint64_t* (8 bytes
> > aligned)
> 
> This imo would better be done by reconstructing the 64-bit value from the
> two involved 32-bit array elements.
> 
> > How would you deviate these in general terms? Or are you suggesting to
> > use SAF tags for each of them?
> 
> If no other solution can be found for the vlapic.h issue, "yes" there. For
> all others I suggested alternative approaches. Subject to other x86 folks
> possibly objecting, though.
> 
> Jan
>