From: Yang Weijiang Correct the parameter passed to invlpg. The invlpg instruction should take a virtual address instead of a physical address when flushing TLBs. Using shstk_phys results in TLBs associated with the virtual address (shstk_virt) not being flushed, and the virtual address may not be treated as a shadow stack address if there is a stale TLB. So, subsequent shadow stack accesses to shstk_virt may cause a #PF, which terminates the test unexpectedly. Signed-off-by: Yang Weijiang Signed-off-by: Chao Gao Signed-off-by: Mathias Krause Signed-off-by: Sean Christopherson --- x86/cet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x86/cet.c b/x86/cet.c index 42d2b1fc..51a54a50 100644 --- a/x86/cet.c +++ b/x86/cet.c @@ -100,7 +100,7 @@ int main(int ac, char **av) *ptep |= PT_DIRTY_MASK; /* Flush the paging cache. */ - invlpg((void *)shstk_phys); + invlpg((void *)shstk_virt); /* Enable shadow-stack protection */ wrmsr(MSR_IA32_U_CET, ENABLE_SHSTK_BIT); -- 2.52.0.rc1.455.g30608eb744-goog