From a7952a320c1e202a218702bfdb14f75132f04894 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Mon, 5 Oct 2020 12:46:30 +0100 Subject: [PATCH] x86/smpboot: Don't unconditionally call memguard_guard_stack() in cpu_smpboot_alloc() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit cpu_smpboot_alloc() is designed to be idempotent with respect to partially initialised state. This occurs for S3 and CPU parking, where enough state to handle NMIs/#MCs needs to remain valid for the entire lifetime of Xen, even when we otherwise want to offline the CPU. For simplicity between various configuration, Xen always uses shadow stack mappings (Read-only + Dirty) for the guard page, irrespective of whether CET-SS is enabled. Unfortunately, the CET-SS changes in memguard_guard_stack() broke idempotency by first writing out the supervisor shadow stack tokens with plain writes, then changing the mapping to being read-only. This ordering is strictly necessary to configure the BSP, which cannot have the supervisor tokens be written with WRSS. Instead of calling memguard_guard_stack() unconditionally, call it only when actually allocating a new stack. Xenheap allocates are guaranteed to be writeable, and the net result is idempotency WRT configuring stack_base[]. Fixes: 91d26ed304f ("x86/shstk: Create shadow stacks") Reported-by: Marek Marczykowski-Górecki Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/smpboot.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c index 5708573c41..67e727cebd 100644 --- a/xen/arch/x86/smpboot.c +++ b/xen/arch/x86/smpboot.c @@ -997,16 +997,18 @@ static int cpu_smpboot_alloc(unsigned int cpu) memflags = MEMF_node(node); if ( stack_base[cpu] == NULL ) + { stack_base[cpu] = alloc_xenheap_pages(STACK_ORDER, memflags); - if ( stack_base[cpu] == NULL ) - goto out; + if ( !stack_base[cpu] ) + goto out; + + memguard_guard_stack(stack_base[cpu]); + } info = get_cpu_info_from_stack((unsigned long)stack_base[cpu]); info->processor_id = cpu; info->per_cpu_offset = __per_cpu_offset[cpu]; - memguard_guard_stack(stack_base[cpu]); - gdt = per_cpu(gdt, cpu) ?: alloc_xenheap_pages(0, memflags); if ( gdt == NULL ) goto out; -- 2.39.5