[PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[Andrew Cooper]

Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
SETSSBSY, there must not be any CALL or RET instructions.

Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
and thus suffers #DF during boot.

Make the MSR and shstk helpers always_inline.  They ought to have been this
way all along.

Reported-by: Roger Pau Monné <roger@xenproject.org>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger@xenproject.org>
CC: Teddy Astie <teddy.astie@vates.tech>

No change in the compiled binary at -O2, except for the line numbers embedded
into *_param() names.

With -fno-early-inlining, the resulting delta is:
  add/remove: 8/9 grow/shrink: 13/50 up/down: 360/-736 (-376)
---
 xen/arch/x86/include/asm/msr.h   | 8 ++++----
 xen/arch/x86/include/asm/shstk.h | 4 ++--
 xen/arch/x86/setup.c             | 5 +++++
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/include/asm/msr.h b/xen/arch/x86/include/asm/msr.h
index 1377d156f4e1..d5cec5509faa 100644
--- a/xen/arch/x86/include/asm/msr.h
+++ b/xen/arch/x86/include/asm/msr.h
@@ -47,7 +47,7 @@ static always_inline uint64_t rdmsr(unsigned int msr)
        val = a__ | ((u64)b__<<32); \
 } while(0)
 
-static inline void wrmsr(unsigned int msr, uint64_t val)
+static always_inline void wrmsr(unsigned int msr, uint64_t val)
 {
     uint32_t lo = val, hi = val >> 32;
 
@@ -56,7 +56,7 @@ static inline void wrmsr(unsigned int msr, uint64_t val)
 #define wrmsrl(msr, val) wrmsr(msr, val)
 
 /* Non-serialising WRMSR, when available.  Falls back to a serialising WRMSR. */
-static inline void wrmsrns(uint32_t msr, uint64_t val)
+static always_inline void wrmsrns(uint32_t msr, uint64_t val)
 {
     uint32_t lo = val, hi = val >> 32;
 
@@ -72,7 +72,7 @@ static inline void wrmsrns(uint32_t msr, uint64_t val)
 }
 
 /* rdmsr with exception handling */
-static inline int rdmsr_safe(unsigned int msr, uint64_t *val)
+static always_inline int rdmsr_safe(unsigned int msr, uint64_t *val)
 {
     uint64_t lo, hi;
 
@@ -113,7 +113,7 @@ static inline int rdmsr_safe(unsigned int msr, uint64_t *val)
 }
 
 /* wrmsr with exception handling */
-static inline int wrmsr_safe(unsigned int msr, uint64_t val)
+static always_inline int wrmsr_safe(unsigned int msr, uint64_t val)
 {
     uint32_t lo = val, hi = val >> 32;
 
diff --git a/xen/arch/x86/include/asm/shstk.h b/xen/arch/x86/include/asm/shstk.h
index 9160fe9f0e99..22bbbb2faf37 100644
--- a/xen/arch/x86/include/asm/shstk.h
+++ b/xen/arch/x86/include/asm/shstk.h
@@ -15,7 +15,7 @@
  */
 #define SSP_NO_SHSTK 1
 
-static inline unsigned long rdssp(void)
+static always_inline unsigned long rdssp(void)
 {
     unsigned long ssp;
 
@@ -24,7 +24,7 @@ static inline unsigned long rdssp(void)
     return ssp;
 }
 
-static inline void wrss(unsigned long val, unsigned long *ptr)
+static always_inline void wrss(unsigned long val, unsigned long *ptr)
 {
     asm ( "wrssq %[val], %[ptr]"
           : [ptr] "=m" (*ptr)
diff --git a/xen/arch/x86/setup.c b/xen/arch/x86/setup.c
index fef3c2dd4423..446cd8127693 100644
--- a/xen/arch/x86/setup.c
+++ b/xen/arch/x86/setup.c
@@ -915,6 +915,11 @@ static void __init noreturn reinit_bsp_stack(void)
          */
         local_irq_disable();
 
+        /*
+         * There must be no CALL or RET instructions between writing
+         * MSR_S_CET.SHSTK_EN and establishing SSP with RSTORSSP or SETSSBSY
+         * below.  All helpers must be forced inline.
+         */
         wrmsrl(MSR_S_CET, xen_msr_s_cet_value());
 
         /*

base-commit: 7e020a4dd6ed30eb6c91a9abe2767034e2bb270a
-- 
2.39.5

Re: [PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[Teddy Astie]

[-- Attachment #1.1: Type: text/plain, Size: 592 bytes --]

Le 19/10/2026 à 18:00, Andrew Cooper a écrit :
> Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
> SETSSBSY, there must not be any CALL or RET instructions.
> 
> Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
> and thus suffers #DF during boot.
> 
> Make the MSR and shstk helpers always_inline.  They ought to have been this
> way all along.
> 
> Reported-by: Roger Pau Monné <roger@xenproject.org>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Teddy Astie <teddy.astie@vates.tech>

Teddy

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 665 bytes --]

Re: [PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[Roger Pau Monné]

On Mon, Oct 19, 2026 at 04:59:59PM +0100, Andrew Cooper wrote:
> Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
> SETSSBSY, there must not be any CALL or RET instructions.
> 
> Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
> and thus suffers #DF during boot.
> 
> Make the MSR and shstk helpers always_inline.  They ought to have been this
> way all along.
> 
> Reported-by: Roger Pau Monné <roger@xenproject.org>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Roger Pau Monné <roger@xenproject.org>

Originally this was reported by Stefano, so it should likely have his
reported-by tag also.

Thanks, Roger.

Re: [PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[Andrew Cooper]

On 19/10/2026 5:52 pm, Roger Pau Monné wrote:
> On Mon, Oct 19, 2026 at 04:59:59PM +0100, Andrew Cooper wrote:
>> Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
>> SETSSBSY, there must not be any CALL or RET instructions.
>>
>> Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
>> and thus suffers #DF during boot.
>>
>> Make the MSR and shstk helpers always_inline.  They ought to have been this
>> way all along.
>>
>> Reported-by: Roger Pau Monné <roger@xenproject.org>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Reviewed-by: Roger Pau Monné <roger@xenproject.org>
>
> Originally this was reported by Stefano, so it should likely have his
> reported-by tag also.

Fine.  I can adjust on commit.

Thanks,

~Andrew

Re: [PATCH] x86/shstk: Fix possible crash while enabling Shadow Stacks

[Roger Pau Monné]

On Mon, Oct 19, 2026 at 04:59:59PM +0100, Andrew Cooper wrote:
> Between writing MSR_S_CET.SHSTK_EN and establishing SSP using RSTORSSP or
> SETSSBSY, there must not be any CALL or RET instructions.
> 
> Building Xen with -fno-early-inlining causes wrmsr() to become out-of-line,
> and thus suffers #DF during boot.
> 
> Make the MSR and shstk helpers always_inline.  They ought to have been this
> way all along.
> 
> Reported-by: Roger Pau Monné <roger@xenproject.org>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Sorry seems like I'm a bit slow today.  Also worth adding:

Fixes: b60ab42db2f0 ("x86/shstk: Activate Supervisor Shadow Stacks").

Thanks, Roger.