[PATCH v2] x86/domain: restrict context switch hooks for the idle domain

[Roger Pau Monne <roger@xxxxxxxxxxxxxx>]

From: Grygorii Strashko <grygorii_strashko@xxxxxxxx>

The arch_init_idle_domain() initializes struct arch_csw idle_csw as:

    static const struct arch_csw idle_csw = {
        .from = paravirt_ctxt_switch_from,
        .to   = paravirt_ctxt_switch_to,
        .tail = idle_loop,
    };

but only place where d->arch.ctxt_switch->{to,from}() are used is
__context_switch() where they are both guarded by !is_idle_domain(pd)
which makes the callbacks in idle_csw unreachable.

Introduce a new poison value to be used in unreachable function hooks, and
set the from/to fields of idle_csw to it.  Use a different value from the
currently defined ones for easy differentiation.

Signed-off-by: Grygorii Strashko <grygorii_strashko@xxxxxxxx>
Signed-off-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
---
Changes since v1:
 - Introduce and use a poison value instead of the implicit NULL.
---
 xen/arch/x86/domain.c             | 4 ++--
 xen/arch/x86/include/asm/config.h | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 996b50af7a17..6ebe6c5052b3 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -813,8 +813,8 @@ static bool emulation_flags_ok(const struct domain *d, 
uint32_t emflags)
 void __init arch_init_idle_domain(struct domain *d)
 {
     static const struct arch_csw idle_csw = {
-        .from = paravirt_ctxt_switch_from,
-        .to   = paravirt_ctxt_switch_to,
+        .from = FUNCTION_POISON,
+        .to   = FUNCTION_POISON,
         .tail = idle_loop,
     };
 
diff --git a/xen/arch/x86/include/asm/config.h 
b/xen/arch/x86/include/asm/config.h
index 1b28349a427b..bf82cd082a59 100644
--- a/xen/arch/x86/include/asm/config.h
+++ b/xen/arch/x86/include/asm/config.h
@@ -56,6 +56,9 @@
 #define LIST_POISON1  ((void *)0x0100100100100100UL)
 #define LIST_POISON2  ((void *)0x0200200200200200UL)
 
+/* Poison unreachable function hooks with a non-canonical value. */
+#define FUNCTION_POISON ((void *)0xDEAD0000DEAD0000UL)
+
 #include <xen/const.h>
 
 #define PML4_ENTRY_BITS  39
-- 
2.55.0