Re: [PATCH] x86/cet: Clear IST supervisor token busy bits on S3 resume

[Andrew Cooper <Andrew.Cooper3@xxxxxxxxxx>]

On 14/03/2022 14:16, Jan Beulich wrote:
> On 14.03.2022 12:00, Andrew Cooper wrote:
>> Stacks are not freed across S3.  Execution just stops, leaving supervisor
>> token busy bits active.  Fixing this for the primary shadow stack was done
>> previously, but there is a (rare) risk that an IST token is left busy too.
>> This will manifest as #DF next time the IST vector gets used.
> Under what (rare) condition would this happen? The only scenario I could
> come up with (which wouldn't result in a crash anyway) is the NMI watchdog
> hitting after a CPU was already taken offline, and the handler not
> managing to complete before power is cut. I think it would help to mention
> one such specific case.

Any NMI, and any #MC.  They're the only two IST vectors which are
triggered by out-of-core actions.

#MC in particular because even LMCE hits both threads.

>> --- /dev/null
>> +++ b/xen/arch/x86/include/asm/shstk.h
>> @@ -0,0 +1,46 @@
>> +/******************************************************************************
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License as published by
>> + * the Free Software Foundation; either version 2 of the License, or
>> + * (at your option) any later version.
>> + *
>> + * This program is distributed in the hope that it will be useful,
>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>> + * GNU General Public License for more details.
>> + *
>> + * You should have received a copy of the GNU General Public License
>> + * along with this program; If not, see <http://www.gnu.org/licenses/>.
>> + *
>> + * Copyright (c) 2022 Citrix Systems Ltd.
>> + */
>> +#ifndef XEN_ASM_SHSTK_H
>> +#define XEN_ASM_SHSTK_H
>> +
>> +/*
>> + * RDSSP is a nop when shadow stacks are active.
> I guess there's a "not" missing here, supported by ...
>
>>  Also, SSP has a minimum
>> + * alignment of 4 which enforced by hardware.
>> + *
>> + * We load 1 into a register, then RDSSP.  If shadow stacks are not active,
>> + * RDSSP is a nop, and the 1 is preserved.
> ... this.

Yes.

>  As an alternative I wouldn't mind if you removed the redundancy.
> Then
> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>

Thanks.  I'll see what I can to do tweak the wording, but separating the
statements of behaviour from the description of the logic was intentional.

~Andrew