[PATCH v2 13/14] x86/pv: clear the XPTI root_pgt per-domain slot on context-switch out

[George Dunlap <dunlapg@xxxxxxxxx>]

From: George Dunlap <gwd@xxxxxxxxxxxxxx>

XPTI maintains a per-pCPU root page table (root_pgt): a restricted L4,
with Xen largely unmapped, that an XPTI domain's guest context actually
runs on.  Its guest mappings are copied in on the way back to guest
context; its per-domain slot is written by paravirt_ctxt_switch_to(),
so that it follows whichever domain is scheduled onto the pCPU.

Nothing ever clears the slot, however.  When the pCPU switches from an
XPTI PV vCPU to one that does not refresh the slot -- an HVM vCPU, or
the idle vCPU after a lazy state flush -- the last PV domain's
per-domain L3 remains referenced from root_pgt.  The reference isn't
cleared on domain destruction, so could even point to an already freed
page.

In theory, that slot should never be walked in this state; but it's
just generally safer not to leave dangling references around.
Consider that cleanup_cpu_root_pgt() frees pagetables by walking
root_pgt on CPU offline. Currently it correctly leaves slot 260 alone;
but one could easily imagine a mistake in which slot 260 is walked
erroneously.

Clear the slot in paravirt_ctxt_switch_from(), making the maintenance
a pair: cleared on the way out, installed on the way in.  The slot is
now populated only while the vCPU using it runs, and an erroneous walk
in any other state faults cleanly.  This change also makes robust
behavior simpler when we add per-vCPU areas in a subsequent patch.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: George Dunlap <gwd@xxxxxxxxxxxxxx>
---
Changes in v2:
- New patch.
---
 xen/arch/x86/domain.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 1f75d44fe0..79555e6964 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -2006,8 +2006,18 @@ static void save_segments(struct vcpu *v)
 
 void cf_check paravirt_ctxt_switch_from(struct vcpu *v)
 {
+    root_pgentry_t *root_pgt = this_cpu(root_pgt);
+
     save_segments(v);
 
+    /*
+     * Clear the XPTI per-domain slot: it is installed on the way in by
+     * paravirt_ctxt_switch_to(), and must not linger while another vCPU
+     * runs.
+     */
+    if ( root_pgt )
+        root_pgt[root_table_offset(PERDOMAIN_VIRT_START)] = l4e_empty();
+
     /*
      * Disable debug breakpoints. We do this aggressively because if we switch
      * to an HVM guest we may load DR0-DR3 with values that can cause #DE
@@ -2022,6 +2032,12 @@ void cf_check paravirt_ctxt_switch_to(struct vcpu *v)
 {
     root_pgentry_t *root_pgt = this_cpu(root_pgt);
 
+    /*
+     * If XPTI is active, install the incoming domain's per-domain area
+     * in the per-domain slot of the L4 we run on while in guest mode.
+     * The slot was cleared on the way out (see
+     * paravirt_ctxt_switch_from()).
+     */
     if ( root_pgt )
         root_pgt[root_table_offset(PERDOMAIN_VIRT_START)] =
             l4e_from_page(v->domain->arch.perdomain_l3_pg,
-- 
2.55.0