[PATCH RFC v2 14/14] XSM: avoid fragile assumptions in xsm_fixup_ops()

[Jan Beulich <jbeulich@xxxxxxxx>]

Using the recently introduced hook machinery, the assumptions made can be
avoided, at the expense of a significant code size increase.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---
RFC: Of course the significantly increased code size isn't nice. Yet then
     it's all .init.text bloat only.

RFC: The asm() is somewhat like RELOC_HIDE(), with an offset of 0. It
     didn't feel quite right to use that macro here, though.

The generated code I've looked at (both for x86 and Arm64) it is clear
that a similar weakness in codegen exists for the recurring accesses to
_{s,e}text[] by is_kernel_text(): A register variable each would shrink
code size significantly, yet that doesn't appear to happen at -O1. Yet
open-coding isn't an option, imo.
---
v2: New.

--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -51,15 +51,6 @@ typedef enum xsm_default xsm_default_t;
 #define XSM_MMU_MACHPHYS_UPDATE  8
 #endif /* CONFIG_X86 */
 
-/*
- * !!! WARNING !!!
- *
- * For simplicity, xsm_fixup_ops() expects that this structure is made
- * exclusively of function pointers to non-init functions.  Think carefully
- * before deviating from the pattern.
- *
- * !!! WARNING !!!
- */
 struct xsm_ops {
 
 #define XSM_HOOK0(rtype, name) rtype (*name)(void);
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -28,29 +28,35 @@ static const struct xsm_ops __initconst_
 
 void __init xsm_fixup_ops(struct xsm_ops *ops)
 {
+    const struct xsm_ops *dops = &dummy_ops;
+
     /*
-     * We make some simplifying assumptions about struct xsm_ops; that it is
-     * made exclusively of function pointers to non-init text.
-     *
-     * This allows us to walk over struct xsm_ops as if it were an array of
-     * unsigned longs.
+     * To limit the size of generated code (by avoiding the compiler using
+     * dummy_ops directly for every access), hide the relationship between
+     * dops and dummy_ops.
      */
-    unsigned long *dst = _p(ops);
-    const unsigned long *src = _p(&dummy_ops);
+    asm ( "" : "+r" (dops) );
 
-    for ( ; dst < (unsigned long *)(ops + 1); src++, dst++ )
-    {
-        /*
-         * If you encounter this BUG(), then you've most likely added a new
-         * XSM hook but failed to provide the default implementation in
-         * dummy_ops.
-         *
-         * If not, then perhaps a function pointer to an init function, or
-         * something which isn't a function pointer at all.
-         */
-        BUG_ON(!is_kernel_text(*src));
+    /*
+     * If you encounter the BUG() below, then you've most likely added a
+     * new XSM hook but failed to provide the default implementation in
+     * dummy_ops.
+     *
+     * If not, then perhaps a function pointer to an init function, or
+     * (less likely) something which isn't a function pointer at all.
+     */
+#define XSM_HOOK0(rtype, name)                    \
+    do {                                          \
+        typeof(xsm_ ## name) *dummy = dops->name; \
+        BUG_ON(!is_kernel_text(dummy));           \
+        if ( !ops->name )                         \
+            ops->name = dummy;                    \
+    } while ( false );
+#define XSM_HOOK1(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK2(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK3(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK4(rtype, name, ...) XSM_HOOK0(rtype, name)
+#define XSM_HOOK5(rtype, name, ...) XSM_HOOK0(rtype, name)
 
-        if ( !*dst )
-            *dst = *src;
-    }
+#include <xsm/hooks.h>
 }