[xen stable-4.12] x86/boot: Fix load_system_tables() to be NMI/#MC-safe

[patchbot@xxxxxxx]

commit 218a19b911c28e79fdb8dc73436cdddc5f42d934
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jun 24 17:11:08 2020 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jun 24 17:11:08 2020 +0200

    x86/boot: Fix load_system_tables() to be NMI/#MC-safe
    
    During boot, load_system_tables() is used in reinit_bsp_stack() to switch 
the
    virtual addresses used from their .data/.bss alias, to their directmap 
alias.
    
    The structure assignment is implemented as a memset() to zero first, then a
    copy-in of the new data.  This causes the NMI/#MC stack pointers to
    transiently become 0, at a point where we may have an NMI watchdog running.
    
    Rewrite the logic using a volatile tss pointer (equivalent to, but more
    readable than, using ACCESS_ONCE() for all writes).
    
    This does drop the zeroing side effect for holes in the structure, but the
    backing memory for the TSS is fully zeroed anyway, and architecturally, they
    are all reserved.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 9f3e9139fa6c3d620eb08dff927518fc88200b8d
    master date: 2020-05-27 16:44:04 +0100
---
 xen/arch/x86/cpu/common.c | 49 ++++++++++++++++++++++-------------------------
 1 file changed, 23 insertions(+), 26 deletions(-)

diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c
index 9bd9e3e24e..7a21941e40 100644
--- a/xen/arch/x86/cpu/common.c
+++ b/xen/arch/x86/cpu/common.c
@@ -749,11 +749,12 @@ void __init early_cpu_init(void)
  */
 void load_system_tables(void)
 {
-       unsigned int cpu = smp_processor_id();
+       unsigned int i, cpu = smp_processor_id();
        unsigned long stack_bottom = get_stack_bottom(),
                stack_top = stack_bottom & ~(STACK_SIZE - 1);
 
-       struct tss64 *tss = &this_cpu(tss_page).tss;
+       /* The TSS may be live.  Disuade any clever optimisations. */
+       volatile struct tss64 *tss = &this_cpu(tss_page).tss;
        seg_desc_t *gdt =
                this_cpu(gdt_table) - FIRST_RESERVED_GDT_ENTRY;
        seg_desc_t *compat_gdt =
@@ -768,30 +769,26 @@ void load_system_tables(void)
                .limit = (IDT_ENTRIES * sizeof(idt_entry_t)) - 1,
        };
 
-       *tss = (struct tss64){
-               /* Main stack for interrupts/exceptions. */
-               .rsp0 = stack_bottom,
-
-               /* Ring 1 and 2 stacks poisoned. */
-               .rsp1 = 0x8600111111111111ul,
-               .rsp2 = 0x8600111111111111ul,
-
-               /*
-                * MCE, NMI and Double Fault handlers get their own stacks.
-                * All others poisoned.
-                */
-               .ist = {
-                       [IST_MCE - 1] = stack_top + IST_MCE * PAGE_SIZE,
-                       [IST_DF  - 1] = stack_top + IST_DF  * PAGE_SIZE,
-                       [IST_NMI - 1] = stack_top + IST_NMI * PAGE_SIZE,
-                       [IST_DB  - 1] = stack_top + IST_DB  * PAGE_SIZE,
-
-                       [IST_MAX ... ARRAY_SIZE(tss->ist) - 1] =
-                               0x8600111111111111ul,
-               },
-
-               .bitmap = IOBMP_INVALID_OFFSET,
-       };
+       /*
+        * Set up the TSS.  Warning - may be live, and the NMI/#MC must remain
+        * valid on every instruction boundary.  (Note: these are all
+        * semantically ACCESS_ONCE() due to tss's volatile qualifier.)
+        *
+        * rsp0 refers to the primary stack.  #MC, #DF, NMI and #DB handlers
+        * each get their own stacks.  No IO Bitmap.
+        */
+       tss->rsp0 = stack_bottom;
+       tss->ist[IST_MCE - 1] = stack_top + IST_MCE * PAGE_SIZE;
+       tss->ist[IST_DF  - 1] = stack_top + IST_DF  * PAGE_SIZE;
+       tss->ist[IST_NMI - 1] = stack_top + IST_NMI * PAGE_SIZE;
+       tss->ist[IST_DB  - 1] = stack_top + IST_DB  * PAGE_SIZE;
+       tss->bitmap = IOBMP_INVALID_OFFSET;
+
+       /* All other stack pointers poisioned. */
+       for ( i = IST_MAX; i < ARRAY_SIZE(tss->ist); ++i )
+               tss->ist[i] = 0x8600111111111111ul;
+       tss->rsp1 = 0x8600111111111111ul;
+       tss->rsp2 = 0x8600111111111111ul;
 
        BUILD_BUG_ON(sizeof(*tss) <= 0x67); /* Mandated by the architecture. */
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.12