With the value recorded on entry there's no need anymore to go hunt for
the respective exception frame on the shadow stack. By deriving "ptr"
from that field (without any offset), it then ends up pointin one slot
lower than before. Therefore all array indexes need incrementing, nicely
doing away with all the negative ones.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
Indentation of the prior inner (but not innermost) if()'s body is
deliberately left untouched, to aid review. It'll be adjusted in a
separate follow-on patch.
---
v2: IS_ENABLED() -> #ifdef. Re-base.
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -690,19 +690,6 @@ unsigned long get_stack_trace_bottom(uns
}
}
-static unsigned long get_shstk_bottom(unsigned long sp)
-{
- /* SAF-11-safe */
- switch ( get_stack_page(sp) )
- {
-#ifdef CONFIG_XEN_SHSTK
- case 0: return ROUNDUP(sp, IST_SHSTK_SIZE) - sizeof(unsigned long);
- case 5: return ROUNDUP(sp, PAGE_SIZE) - sizeof(unsigned long);
-#endif
- default: return sp - sizeof(unsigned long);
- }
-}
-
unsigned long get_stack_dump_bottom(unsigned long sp)
{
switch ( get_stack_page(sp) )
@@ -1187,26 +1174,28 @@ void asmlinkage noreturn do_unhandled_tr
static void fixup_exception_return(struct cpu_user_regs *regs,
unsigned long fixup, unsigned long stub_ra)
{
- if ( IS_ENABLED(CONFIG_XEN_SHSTK) )
+#ifdef CONFIG_XEN_SHSTK
{
- unsigned long ssp, *ptr, *base;
+ unsigned long ssp = rdssp();
- if ( (ssp = rdssp()) == SSP_NO_SHSTK )
- goto shstk_done;
+ if ( ssp != SSP_NO_SHSTK )
+ {
+ unsigned long *ptr = _p(regs->entry_ssp);
+ unsigned long primary_shstk =
+ (ssp & ~(STACK_SIZE - 1)) +
+ (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8;
- ptr = _p(ssp);
- base = _p(get_shstk_bottom(ssp));
+ BUG_ON((regs->entry_ssp ^ primary_shstk) >> PAGE_SHIFT);
- for ( ; ptr < base; ++ptr )
- {
/*
- * Search for %rip. The shstk currently looks like this:
+ * The shstk currently looks like this:
*
* tok [Supervisor token, == &tok | BUSY, only with FRED inactive]
* ... [Pointed to by SSP for most exceptions, empty in IST cases]
* %cs [== regs->cs]
* %rip [== regs->rip]
- * SSP [Likely points to 3 slots higher, above %cs]
+ * SSP [Pointed to by entry_ssp; Likely points to 3 slots
+ * higher, above %cs]
* ... [call tree to this function, likely 2/3 slots]
*
* and we want to overwrite %rip with fixup. There are two
@@ -1219,13 +1208,10 @@ static void fixup_exception_return(struc
*
* Check for both regs->rip and regs->cs matching.
*/
- if ( ptr[0] == regs->rip && ptr[1] == regs->cs )
- {
- unsigned long primary_shstk =
- (ssp & ~(STACK_SIZE - 1)) +
- (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8;
+ BUG_ON(ptr[1] != regs->rip || ptr[2] != regs->cs);
- wrss(fixup, ptr);
+ {
+ wrss(fixup, &ptr[1]);
if ( !stub_ra )
goto shstk_done;
@@ -1242,7 +1228,7 @@ static void fixup_exception_return(struc
* - if we're on an IST stack, we need to increment the
* original SSP.
*/
- BUG_ON((ptr[-1] ^ primary_shstk) >> PAGE_SHIFT);
+ BUG_ON((ptr[0] ^ primary_shstk) >> PAGE_SHIFT);
if ( (ssp ^ primary_shstk) >> PAGE_SHIFT )
{
@@ -1251,39 +1237,30 @@ static void fixup_exception_return(struc
* addresses actually match. Then increment the interrupted
* context's SSP.
*/
- BUG_ON(stub_ra != *(unsigned long*)ptr[-1]);
- wrss(ptr[-1] + 8, &ptr[-1]);
+ BUG_ON(stub_ra != *(unsigned long*)ptr[0]);
+ wrss(ptr[0] + 8, &ptr[0]);
goto shstk_done;
}
/* Make sure the two return addresses actually match. */
- BUG_ON(stub_ra != ptr[2]);
+ BUG_ON(stub_ra != ptr[3]);
/* Move exception frame, updating SSP there. */
- wrss(ptr[1], &ptr[2]); /* %cs */
- wrss(ptr[0], &ptr[1]); /* %rip */
- wrss(ptr[-1] + 8, &ptr[0]); /* SSP */
+ wrss(ptr[2], &ptr[3]); /* %cs */
+ wrss(ptr[1], &ptr[2]); /* %rip */
+ wrss(ptr[0] + 8, &ptr[1]); /* SSP */
/* Move all newer entries. */
- while ( --ptr != _p(ssp) )
- wrss(ptr[-1], &ptr[0]);
+ while ( ptr-- != _p(ssp) )
+ wrss(ptr[0], &ptr[1]);
/* Finally account for our own stack having shifted up. */
asm volatile ( "incsspd %0" :: "r" (2) );
-
- goto shstk_done;
}
}
-
- /*
- * We failed to locate and fix up the shadow IRET frame. This could
- * be due to shadow stack corruption, or bad logic above. We cannot
- * continue executing the interrupted context.
- */
- BUG();
-
}
shstk_done:
+#endif /* CONFIG_XEN_SHSTK */
/* Fixup the regular stack. */
regs->rip = fixup;On 08/04/2026 1:23 pm, Jan Beulich wrote:
> With the value recorded on entry there's no need anymore to go hunt for
> the respective exception frame on the shadow stack. By deriving "ptr"
> from that field (without any offset), it then ends up pointin one slot
pointing
> --- a/xen/arch/x86/traps.c
> +++ b/xen/arch/x86/traps.c
> @@ -1187,26 +1174,28 @@ void asmlinkage noreturn do_unhandled_tr
> static void fixup_exception_return(struct cpu_user_regs *regs,
> unsigned long fixup, unsigned long stub_ra)
> {
> - if ( IS_ENABLED(CONFIG_XEN_SHSTK) )
> +#ifdef CONFIG_XEN_SHSTK
> {
> - unsigned long ssp, *ptr, *base;
> + unsigned long ssp = rdssp();
>
> - if ( (ssp = rdssp()) == SSP_NO_SHSTK )
> - goto shstk_done;
> + if ( ssp != SSP_NO_SHSTK )
> + {
> + unsigned long *ptr = _p(regs->entry_ssp);
> + unsigned long primary_shstk =
> + (ssp & ~(STACK_SIZE - 1)) +
> + (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8;
>
> - ptr = _p(ssp);
> - base = _p(get_shstk_bottom(ssp));
> + BUG_ON((regs->entry_ssp ^ primary_shstk) >> PAGE_SHIFT);
This BUG() isn't correct.
We can be in a fixup while in an IST handler, at which point SSP does
not point to the primary shstk. e.g. wrmsr_safe() in #MC.
If you're looking to at least roughly bound it, check that it's any
where in the stack range. The WRSS below will #PF if SSP isn't
referring to a shadow stack.
Alternatively, add an is_shstk_page() predicate which checks for
get_stack_page() == 5,0 which are the two shstk frames in the block of 8.
~Andrew
© 2016 - 2026 Red Hat, Inc.