From nobody Tue Mar 3 05:11:49 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1772234229; cv=none; d=zohomail.com; s=zohoarc; b=Fa5N6Ub8/mLWvm/U8RxZpjDKE48kDRrRJvYuFTechSW1eRtCpgPVUoth+IVL4IFlJnTAGhh0QnslO0K2inVVwZU5UulQ68cElhEG7bW+hpdOkfy5/vB73+nnBWGgitHwAH3mV+RrgWZYyFJIZAbebA2idWkibtMaF++yMogT8Zg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1772234229; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0CZO8VvFJTkoemSFkzFWEvoCyFq1y2gQ5xOPrI9dn3A=; b=gEmdwOkSsKC1dWu8zQe1aWr83EP8xPQ/bFPch5EcXtK2Lt7Pc3tuTbJEvt54CXx5RRuM0OVXEOYmp2Xueiw3viE6XaidTgem2zMp7U/4ORnXcPo0ITU7nDVpypuyeXy4hGRexdEcf4AoMYgznqVPQhXFXaxpfvL7CM5+AN8KQsU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1772234229911971.9572442289502; Fri, 27 Feb 2026 15:17:09 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1243146.1543189 (Exim 4.92) (envelope-from ) id 1vw74o-00029Q-4i; Fri, 27 Feb 2026 23:16:54 +0000 Received: by outflank-mailman (output) from mailman id 1243146.1543189; Fri, 27 Feb 2026 23:16:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1vw74n-00029E-W6; Fri, 27 Feb 2026 23:16:53 +0000 Received: by outflank-mailman (input) for mailman id 1243146; Fri, 27 Feb 2026 23:16:52 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1vw74m-0001Do-0J for xen-devel@lists.xenproject.org; Fri, 27 Feb 2026 23:16:52 +0000 Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [2a00:1450:4864:20::42b]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id 641b136d-1432-11f1-9ccf-f158ae23cfc8; Sat, 28 Feb 2026 00:16:48 +0100 (CET) Received: by mail-wr1-x42b.google.com with SMTP id ffacd0b85a97d-43994aa265eso1501203f8f.3 for ; Fri, 27 Feb 2026 15:16:48 -0800 (PST) Received: from localhost.localdomain (host-92-22-18-152.as13285.net. [92.22.18.152]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4399c70e8e8sm9680306f8f.10.2026.02.27.15.16.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 27 Feb 2026 15:16:46 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 641b136d-1432-11f1-9ccf-f158ae23cfc8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1772234208; x=1772839008; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0CZO8VvFJTkoemSFkzFWEvoCyFq1y2gQ5xOPrI9dn3A=; b=dweHs6CDlyA5ruvLcqqzr5Zu5mYbhtimbFNBp2lpIBiMIXDjKa7DrsopvcWKSNt2lH ODbWCWBzPbLkLnP/+ZcbSxAeP4MR9RN+AUjD9wX8ptpPP47f1agyFG7HI/d3j12dI/05 /EyVuvt/EA0G2i+CbYWuJVK1y9kUg3BYlAS7s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772234208; x=1772839008; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=0CZO8VvFJTkoemSFkzFWEvoCyFq1y2gQ5xOPrI9dn3A=; b=Tj3fXQep3FnfwEvoDFzLMI6BYuBL5xP//0wtoXcS0guckHB6nqZ7v7FM8hahGUDrhK 4ajERYCbsDAW8Mq54uwSRBvWVjNDGBN+N+oNXmUI/6ET07Bb1m4Ofy7EfP74p2e7FD3n nVrXmyGWXh/KTtrPgFoqOv82MI9lquSPH/fTHiJ+GkLgH5P5tMso9D59B+cNtJgPtNRf KJ5oV0eq2TqqLzInPi30h4V48G1cviONL8MhwiRs6Mlm0/3uCM5Nf5hXc73h8/5a30fE BijuHCnO7qOP5iSHUC9XydYJFPC9MLyNAZGCL/rZYGqFakLrNwbdch9POW770QHILRRq IYTw== X-Gm-Message-State: AOJu0YxKO9McFlP/WRhAsEPQWKY+0J2jfjotLVqJ4LwqgUyXhRIy7Iqw OVULngWr9lUSRMXWSmOx2Ra8ArYMn1vIjy/HPKm8NxK+ZnTge0gK5lgx/M5LGYSujlxjdF5Z+HV MyPfT X-Gm-Gg: ATEYQzxij0quOpjKrHY/jT0jQUkNrDLuUECa1kNEY2eNmdUm/dLOtcuDZDt+dL4FO0u 2ieoeIKaKY41qfhogoKpvOwDXGIlg9cMonogHQcjqEe3LDwKBgYn/OFiPoBu90OzjuaUJ2uHhm+ 7BgBeL/nRckCiCmAaGFjgNOnvfOH2y6dg3+P3fNfu3rHJ2RklguTBw+XUihBVbe5salxZ0mNtzH WPvBmfcb1aVyYUBwb7ZYiJS4SXvDbwNkiQorGv1ooQbLZEJd6CHoMiViBPh6kLW02OeuLibldLa ZVNHvwWK/SxEoHRfdpk8IjEyAPBUuUc9unOLeWeGg/6pLUoz1VBJUfNKaMZ2IKiCi48bURgmVXC alurzysNBTq4xdAV5cEMJPF0xcU0CeSQBXJP+M3svVNpqWYd6T2VpCuCuAOCSUHvbD0DEWRoE51 g62Yx6UYZrIoSY0GgVBnbiM5L/0yblNtJeReR52pHQDfc/1LkruyxFLKTWXMbEutOQy35HVJo= X-Received: by 2002:a05:6000:18a9:b0:439:8e2f:689e with SMTP id ffacd0b85a97d-4399de2c5demr7687079f8f.43.1772234207185; Fri, 27 Feb 2026 15:16:47 -0800 (PST) From: Andrew Cooper To: Xen-devel Cc: Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Subject: [PATCH v4 06/14] x86/traps: Don't configure Supervisor Shadow Stack tokens in FRED mode Date: Fri, 27 Feb 2026 23:16:28 +0000 Message-Id: <20260227231636.3955109-7-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260227231636.3955109-1-andrew.cooper3@citrix.com> References: <20260227231636.3955109-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) X-ZM-MESSAGEID: 1772234230457158500 FRED doesn't use Supervisor Shadow Stack tokens. This means that: 1) memguard_guard_stack() should not write Supervisor Shadow Stack Tokens. 2) cpu_has_bug_shstk_fracture is no longer relevant when deciding whether = or not to enable Shadow Stacks in the first place. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 v4: * Adjust for cpu_has_bug_shstk_fracture. * Reworked entirely in light of the prior 3 patches. The SDM explicitly points out the shstk fracture vs FRED case, yet PTL enumerates CET-SSS (immunity to shstk fracture). I can only assume that th= ere are other Intel CPUs with FRED but without CET-SSS. --- xen/arch/x86/mm.c | 14 +++++++++++--- xen/arch/x86/setup.c | 16 ++++++++++------ 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 0d0d5292953b..4c404b6c134f 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -129,6 +129,7 @@ #include #include #include +#include #include =20 #include @@ -6441,8 +6442,15 @@ static void write_sss_token(unsigned long *ptr) =20 void memguard_guard_stack(void *p) { - /* IST Shadow stacks. 4x 1k in stack page 0. */ - if ( IS_ENABLED(CONFIG_XEN_SHSTK) ) + ASSERT(opt_fred >=3D 0); /* Confirm that FRED-ness has been resolved */ + + /* + * IST Shadow stacks. 4x 1k in stack page 0. + * + * With IDT delivery, we need Supervisor Shadow Stack tokens at the ba= se + * of each stack. With FRED delivery, these no longer exist. + */ + if ( IS_ENABLED(CONFIG_XEN_SHSTK) && !opt_fred ) { write_sss_token(p + (IST_MCE * IST_SHSTK_SIZE) - 8); write_sss_token(p + (IST_NMI * IST_SHSTK_SIZE) - 8); @@ -6453,7 +6461,7 @@ void memguard_guard_stack(void *p) =20 /* Primary Shadow Stack. 1x 4k in stack page 5. */ p +=3D PRIMARY_SHSTK_SLOT * PAGE_SIZE; - if ( IS_ENABLED(CONFIG_XEN_SHSTK) ) + if ( IS_ENABLED(CONFIG_XEN_SHSTK) && !opt_fred ) write_sss_token(p + PAGE_SIZE - 8); =20 map_pages_to_xen((unsigned long)p, virt_to_mfn(p), 1, PAGE_HYPERVISOR_= SHSTK); diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c index 0816a713e1c8..8e59c9801afe 100644 --- a/xen/arch/x86/setup.c +++ b/xen/arch/x86/setup.c @@ -1412,15 +1412,19 @@ void asmlinkage __init noreturn __start_xen(void) boot_cpu_data.x86_vendor =3D=3D X86_VENDOR_INTEL && !boot_cpu_has(X86_FEATURE_CET_SSS); =20 + ASSERT(opt_fred >=3D 0); /* Confirm that FRED-ness has been resolv= ed */ + /* - * On bare metal, assume that Xen won't be impacted by shstk - * fracturing problems. Under virt, be more conservative and disa= ble - * shstk by default. + * If FRED is in use, Supervisor Shadow Stack tokens are not used = and + * shstk fracturing is of no consequence. Otherwise: + * - On bare metal, assume that Xen won't be impacted by shstk + * fracturing problems. + * - Under virt, be more conservative and disable shstk by default. */ if ( opt_xen_shstk =3D=3D -1 ) opt_xen_shstk =3D - cpu_has_hypervisor ? !cpu_has_bug_shstk_fracture - : true; + opt_fred || (cpu_has_hypervisor ? !cpu_has_bug_shstk_fract= ure + : true); =20 if ( opt_xen_shstk ) { @@ -1925,7 +1929,7 @@ void asmlinkage __init noreturn __start_xen(void) =20 system_state =3D SYS_STATE_boot; =20 - bsp_stack =3D cpu_alloc_stack(0); + bsp_stack =3D cpu_alloc_stack(0); /* Needs to know IDT vs FRED */ if ( !bsp_stack ) panic("No memory for BSP stack\n"); =20 --=20 2.39.5