Re: [PATCH v2 2/3] x86/traps: use entry_ssp in fixup_exception_return()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 08/04/2026 1:23 pm, Jan Beulich wrote:
> With the value recorded on entry there's no need anymore to go hunt for
> the respective exception frame on the shadow stack. By deriving "ptr"
> from that field (without any offset), it then ends up pointin one slot

pointing

> --- a/xen/arch/x86/traps.c
> +++ b/xen/arch/x86/traps.c
> @@ -1187,26 +1174,28 @@ void asmlinkage noreturn do_unhandled_tr
>  static void fixup_exception_return(struct cpu_user_regs *regs,
>                                     unsigned long fixup, unsigned long 
> stub_ra)
>  {
> -    if ( IS_ENABLED(CONFIG_XEN_SHSTK) )
> +#ifdef CONFIG_XEN_SHSTK
>      {
> -        unsigned long ssp, *ptr, *base;
> +        unsigned long ssp = rdssp();
>  
> -        if ( (ssp = rdssp()) == SSP_NO_SHSTK )
> -            goto shstk_done;
> +        if ( ssp != SSP_NO_SHSTK )
> +        {
> +            unsigned long *ptr = _p(regs->entry_ssp);
> +            unsigned long primary_shstk =
> +                (ssp & ~(STACK_SIZE - 1)) +
> +                (PRIMARY_SHSTK_SLOT + 1) * PAGE_SIZE - 8;
>  
> -        ptr = _p(ssp);
> -        base = _p(get_shstk_bottom(ssp));
> +            BUG_ON((regs->entry_ssp ^ primary_shstk) >> PAGE_SHIFT);

This BUG() isn't correct.

We can be in a fixup while in an IST handler, at which point SSP does
not point to the primary shstk.  e.g. wrmsr_safe() in #MC.

If you're looking to at least roughly bound it, check that it's any
where in the stack range.  The WRSS below will #PF if SSP isn't
referring to a shadow stack.

Alternatively, add an is_shstk_page() predicate which checks for
get_stack_page() == 5,0 which are the two shstk frames in the block of 8.

~Andrew