From nobody Fri Mar 29 11:09:52 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1602701287; cv=none; d=zohomail.com; s=zohoarc; b=OdcdtPfTtUNVZQSFX3juoTh2FnX2G/r8qDm8X0sioK9Gu4bpMcPrkumhu+iPgNOpP6/WXY+J5295feYeKxCNEylBrq8t4L/jPK1GtFMaWZ2TUVWzQxe1qi9yP1zMku4m3E7QGbjfmlyQnZRuSoToR3R8/y/69pNcDw3/ME1Tdc4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1602701287; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=FAIC/18EzSge2/Y4p0jYNXclfALxAwnsxcbwPwX+E6U=; b=LuIJswxPdnWV0VcCfwVpP4DIHnZJvkbrbW2qyb6GkH81PrIun2+SN/MslYCyYqW31tHFo4ZsY56Kn1OOO/voBHxostGO8q8DEKIRVDVka5yxNGIu5P7QK0JjtRWiND1lkibpmGbQhzk1p2T8C7TuMwPLUkLVL5X3cDZLfNEz00g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1602701287137938.3618748436965; Wed, 14 Oct 2020 11:48:07 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.6976.18249 (Exim 4.92) (envelope-from ) id 1kSlo8-0002Qg-IR; Wed, 14 Oct 2020 18:47:28 +0000 Received: by outflank-mailman (output) from mailman id 6976.18249; Wed, 14 Oct 2020 18:47:28 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1kSlo8-0002QZ-F9; Wed, 14 Oct 2020 18:47:28 +0000 Received: by outflank-mailman (input) for mailman id 6976; Wed, 14 Oct 2020 18:47:27 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1kSlo7-0002QU-Eo for xen-devel@lists.xenproject.org; Wed, 14 Oct 2020 18:47:27 +0000 Received: from esa5.hc3370-68.iphmx.com (unknown [216.71.155.168]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 9b4b0977-021b-4c29-8908-6aa544b91eda; Wed, 14 Oct 2020 18:47:26 +0000 (UTC) Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1kSlo7-0002QU-Eo for xen-devel@lists.xenproject.org; Wed, 14 Oct 2020 18:47:27 +0000 Received: from esa5.hc3370-68.iphmx.com (unknown [216.71.155.168]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 9b4b0977-021b-4c29-8908-6aa544b91eda; Wed, 14 Oct 2020 18:47:26 +0000 (UTC) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 9b4b0977-021b-4c29-8908-6aa544b91eda DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1602701246; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=ozywa+G0/TlhuCvUoxhNXtJO/nG4bu9hmnl3Wc/T6ok=; b=QLRjF33OD7NK/lkNmAh5YYTO7DS0HKeuJDa45jx6wfyXbBLNrileG8Xp yTKbzaZqtLs7n3aC+h7SdjeARKm8vRNkQ+Ipfvw9zqs6Ijo7qTtdH7zsO H420Eq0YgzWLdT/fpeIxl/0IZ/TxBanhaJXvBhi7ExfOjxTlGtU2qN/Nj 4=; Authentication-Results: esa5.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: svv+OPWgN8+e9erZVqILrhC1QXfsVBPkj5JDfFlIy7Pg7r8O2Bc01NSDiEtVsSZAs80BTLq+cJ twgfw1O0RKmlCQ3i/VgqIciDSFfm/lsSgqXT0dg0yqA5aKY9yp+ZEdG9x4N69NICQwUKSuiXtw 2PB2do/pPnOzhf9w6PI5b0mT4HTOv8SYs0Y3jI2isyKOZznGiwOaMc+3+eo6MlLRcaf3MlY4YM bp9Qy2VcmuQqqX/l95YA/Bm5xa+F130f9k4rQGsasGCr+qdDk6TzBGLIQvt9+Y6+waC9zTRjZ2 QHk= X-SBRS: 2.5 X-MesageID: 29081389 X-Ironport-Server: esa5.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.77,375,1596513600"; d="scan'208";a="29081389" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Wei Liu Subject: [PATCH v2] x86/smpboot: Don't unconditionally call memguard_guard_stack() in cpu_smpboot_alloc() Date: Wed, 14 Oct 2020 19:47:08 +0100 Message-ID: <20201014184708.17758-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) cpu_smpboot_alloc() is designed to be idempotent with respect to partially initialised state. This occurs for S3 and CPU parking, where enough state = to handle NMIs/#MCs needs to remain valid for the entire lifetime of Xen, even when we otherwise want to offline the CPU. For simplicity between various configuration, Xen always uses shadow stack mappings (Read-only + Dirty) for the guard page, irrespective of whether CET-SS is enabled. Unfortunately, the CET-SS changes in memguard_guard_stack() broke idempoten= cy by first writing out the supervisor shadow stack tokens with plain writes, then changing the mapping to being read-only. This ordering is strictly necessary to configure the BSP, which cannot have the supervisor tokens be written with WRSS. Instead of calling memguard_guard_stack() unconditionally, call it only when actually allocating a new stack. Xenheap allocates are guaranteed to be writeable, and the net result is idempotency WRT configuring stack_base[]. Fixes: 91d26ed304f ("x86/shstk: Create shadow stacks") Reported-by: Marek Marczykowski-G=C3=B3recki Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 CC: Wei Liu This can more easily be demonstrated with CPU hotplug than S3, and the abse= nce of bug reports goes to show how rarely hotplug is used. v2: * Don't break S3/CPU parking in combination with CET-SS. v1 would, for S3, turn the BSP shadow stack into regular mappings, and #DF as soon as the = TLB shootdown completes. For CPU Parking, it would invalidate the shadow st= ack of the parked CPUs, causing a #DF on the next NMI/#MC to hit the thread. --- xen/arch/x86/smpboot.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c index 5708573c41..67e727cebd 100644 --- a/xen/arch/x86/smpboot.c +++ b/xen/arch/x86/smpboot.c @@ -997,16 +997,18 @@ static int cpu_smpboot_alloc(unsigned int cpu) memflags =3D MEMF_node(node); =20 if ( stack_base[cpu] =3D=3D NULL ) + { stack_base[cpu] =3D alloc_xenheap_pages(STACK_ORDER, memflags); - if ( stack_base[cpu] =3D=3D NULL ) - goto out; + if ( !stack_base[cpu] ) + goto out; + + memguard_guard_stack(stack_base[cpu]); + } =20 info =3D get_cpu_info_from_stack((unsigned long)stack_base[cpu]); info->processor_id =3D cpu; info->per_cpu_offset =3D __per_cpu_offset[cpu]; =20 - memguard_guard_stack(stack_base[cpu]); - gdt =3D per_cpu(gdt, cpu) ?: alloc_xenheap_pages(0, memflags); if ( gdt =3D=3D NULL ) goto out; --=20 2.11.0