[xen staging-4.20] x86/shstk: Fix possible crash while enabling Shadow Stacks

[patchbot@xxxxxxx]

commit 660417f3889ad4d7d1dc566c294ca24971ae863e
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Thu Oct 29 13:32:23 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Oct 29 13:32:23 2026 +0100

    x86/shstk: Fix possible crash while enabling Shadow Stacks
    
    Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
    SETSSBSY, there must not be any CALL or RET instructions.
    
    Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
    and thus suffers #DF during boot.
    
    Make the MSR and shstk helpers always_inline.  They ought to have been this
    way all along.
    
    Fixes: b60ab42db2f0 ("x86/shstk: Activate Supervisor Shadow Stacks")
    Fixes: 3037d8b7eb3e ("x86/boot: Use RSTORSSP to establish SSP")
    Reported-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Teddy Astie <teddy.astie@xxxxxxxxxx>
    Reviewed-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
    master commit: 30e2d8b4c54f07480a00523ae830343ff8232034
    master date: 2026-10-22 13:40:20 +0100
---
 xen/arch/x86/include/asm/msr.h   | 4 ++--
 xen/arch/x86/include/asm/shstk.h | 4 ++--
 xen/arch/x86/setup.c             | 5 +++++
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/xen/arch/x86/include/asm/msr.h b/xen/arch/x86/include/asm/msr.h
index 7b00a4db5d..c6a50401b3 100644
--- a/xen/arch/x86/include/asm/msr.h
+++ b/xen/arch/x86/include/asm/msr.h
@@ -39,7 +39,7 @@ static inline void wrmsrl(unsigned int msr, uint64_t val)
 }
 
 /* Non-serialising WRMSR, when available.  Falls back to a serialising WRMSR. 
*/
-static inline void wrmsr_ns(uint32_t msr, uint32_t lo, uint32_t hi)
+static always_inline void wrmsr_ns(uint32_t msr, uint32_t lo, uint32_t hi)
 {
     /*
      * WRMSR is 2 bytes.  WRMSRNS is 3 bytes.  Pad WRMSR with a redundant CS
@@ -67,7 +67,7 @@ static inline void wrmsr_ns(uint32_t msr, uint32_t lo, 
uint32_t hi)
     rc_; })
 
 /* wrmsr with exception handling */
-static inline int wrmsr_safe(unsigned int msr, uint64_t val)
+static always_inline int wrmsr_safe(unsigned int msr, uint64_t val)
 {
     int rc;
     uint32_t lo, hi;
diff --git a/xen/arch/x86/include/asm/shstk.h b/xen/arch/x86/include/asm/shstk.h
index 9160fe9f0e..22bbbb2faf 100644
--- a/xen/arch/x86/include/asm/shstk.h
+++ b/xen/arch/x86/include/asm/shstk.h
@@ -15,7 +15,7 @@
  */
 #define SSP_NO_SHSTK 1
 
-static inline unsigned long rdssp(void)
+static always_inline unsigned long rdssp(void)
 {
     unsigned long ssp;
 
@@ -24,7 +24,7 @@ static inline unsigned long rdssp(void)
     return ssp;
 }
 
-static inline void wrss(unsigned long val, unsigned long *ptr)
+static always_inline void wrss(unsigned long val, unsigned long *ptr)
 {
     asm ( "wrssq %[val], %[ptr]"
           : [ptr] "=m" (*ptr)
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index 8555c72ee3..9f72cd9de8 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -913,6 +913,11 @@ static void __init noreturn reinit_bsp_stack(void)
 
         wrmsrl(MSR_PL0_SSP,
                (unsigned long)stack + (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 
8);
+        /*
+         * There must be no CALL or RET instructions between writing
+         * MSR_S_CET.SHSTK_EN and establishing SSP with SETSSBSY below.
+         * All helpers must be forced inline.
+         */
         wrmsrl(MSR_S_CET, xen_msr_s_cet_value());
         asm volatile ("setssbsy" ::: "memory");
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.20