[PATCH v2] x86/domain: restrict context switch hooks for the idle domain

[PATCH v2] x86/domain: restrict context switch hooks for the idle domain

[Roger Pau Monne]

From: Grygorii Strashko <grygorii_strashko@epam.com>

The arch_init_idle_domain() initializes struct arch_csw idle_csw as:

    static const struct arch_csw idle_csw = {
        .from = paravirt_ctxt_switch_from,
        .to   = paravirt_ctxt_switch_to,
        .tail = idle_loop,
    };

but only place where d->arch.ctxt_switch->{to,from}() are used is
__context_switch() where they are both guarded by !is_idle_domain(pd)
which makes the callbacks in idle_csw unreachable.

Introduce a new poison value to be used in unreachable function hooks, and
set the from/to fields of idle_csw to it.  Use a different value from the
currently defined ones for easy differentiation.

Signed-off-by: Grygorii Strashko <grygorii_strashko@epam.com>
Signed-off-by: Roger Pau Monné <roger@xenproject.org>
---
Changes since v1:
 - Introduce and use a poison value instead of the implicit NULL.
---
 xen/arch/x86/domain.c             | 4 ++--
 xen/arch/x86/include/asm/config.h | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 996b50af7a17..6ebe6c5052b3 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -813,8 +813,8 @@ static bool emulation_flags_ok(const struct domain *d, uint32_t emflags)
 void __init arch_init_idle_domain(struct domain *d)
 {
     static const struct arch_csw idle_csw = {
-        .from = paravirt_ctxt_switch_from,
-        .to   = paravirt_ctxt_switch_to,
+        .from = FUNCTION_POISON,
+        .to   = FUNCTION_POISON,
         .tail = idle_loop,
     };
 
diff --git a/xen/arch/x86/include/asm/config.h b/xen/arch/x86/include/asm/config.h
index 1b28349a427b..bf82cd082a59 100644
--- a/xen/arch/x86/include/asm/config.h
+++ b/xen/arch/x86/include/asm/config.h
@@ -56,6 +56,9 @@
 #define LIST_POISON1  ((void *)0x0100100100100100UL)
 #define LIST_POISON2  ((void *)0x0200200200200200UL)
 
+/* Poison unreachable function hooks with a non-canonical value. */
+#define FUNCTION_POISON ((void *)0xDEAD0000DEAD0000UL)
+
 #include <xen/const.h>
 
 #define PML4_ENTRY_BITS  39
-- 
2.55.0

Re: [PATCH v2] x86/domain: restrict context switch hooks for the idle domain

[Jan Beulich]

On 02.10.2026 13:20, Roger Pau Monne wrote:
> From: Grygorii Strashko <grygorii_strashko@epam.com>
> 
> The arch_init_idle_domain() initializes struct arch_csw idle_csw as:
> 
>     static const struct arch_csw idle_csw = {
>         .from = paravirt_ctxt_switch_from,
>         .to   = paravirt_ctxt_switch_to,
>         .tail = idle_loop,
>     };
> 
> but only place where d->arch.ctxt_switch->{to,from}() are used is
> __context_switch() where they are both guarded by !is_idle_domain(pd)
> which makes the callbacks in idle_csw unreachable.
> 
> Introduce a new poison value to be used in unreachable function hooks, and
> set the from/to fields of idle_csw to it.  Use a different value from the
> currently defined ones for easy differentiation.
> 
> Signed-off-by: Grygorii Strashko <grygorii_strashko@epam.com>
> Signed-off-by: Roger Pau Monné <roger@xenproject.org>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
provided this doesn't raise new Misra violations, including for rules which
aren't entirely clean yet, but which are actively being worked on.

Jan

Re: [PATCH v2] x86/domain: restrict context switch hooks for the idle domain

[Roger Pau Monné]

On Fri, Oct 02, 2026 at 01:33:42PM +0200, Jan Beulich wrote:
> On 02.10.2026 13:20, Roger Pau Monne wrote:
> > From: Grygorii Strashko <grygorii_strashko@epam.com>
> > 
> > The arch_init_idle_domain() initializes struct arch_csw idle_csw as:
> > 
> >     static const struct arch_csw idle_csw = {
> >         .from = paravirt_ctxt_switch_from,
> >         .to   = paravirt_ctxt_switch_to,
> >         .tail = idle_loop,
> >     };
> > 
> > but only place where d->arch.ctxt_switch->{to,from}() are used is
> > __context_switch() where they are both guarded by !is_idle_domain(pd)
> > which makes the callbacks in idle_csw unreachable.
> > 
> > Introduce a new poison value to be used in unreachable function hooks, and
> > set the from/to fields of idle_csw to it.  Use a different value from the
> > currently defined ones for easy differentiation.
> > 
> > Signed-off-by: Grygorii Strashko <grygorii_strashko@epam.com>
> > Signed-off-by: Roger Pau Monné <roger@xenproject.org>
> 
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
> provided this doesn't raise new Misra violations, including for rules which
> aren't entirely clean yet, but which are actively being worked on.

I've wondered the same, but since your recent change in:

68c3f7fb3a84 Eclair: relax long <-> function-pointer conversion deviation

I think it should be fine?  I will run a CI loop first anyway.

Thanks, Roger.