Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <cover.1543200841.git.jpoimboe@redhat.com> <20181204180835.29f9aa03@vmware.local.home>
 <EE66E7C9-5735-48B3-A001-E9FCDA46E177@amacapital.net> <20181205150422.mlrjcm5rm26ozg5j@treble>
In-Reply-To: <20181205150422.mlrjcm5rm26ozg5j@treble>
From:   Andy Lutomirski <luto@kernel.org>
Date:   Wed, 5 Dec 2018 15:36:10 -0800
Message-ID: <CALCETrVeWE8NOry6-wiy1q7C0cT8JXSAJvg8T7pwV=Vubu27bw@mail.gmail.com>
Subject: Re: [PATCH v2 0/4] Static calls
To:     Josh Poimboeuf <jpoimboe@redhat.com>
Cc:     Steven Rostedt <rostedt@goodmis.org>, X86 ML <x86@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Ard Biesheuvel <ard.biesheuvel@linaro.org>,
        Andrew Lutomirski <luto@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Jason Baron <jbaron@akamai.com>, Jiri Kosina <jkosina@suse.cz>,
        David Laight <David.Laight@aculab.com>,
        Borislav Petkov <bp@alien8.de>, julia@ni.com, jeyu@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

>> On Dec 5, 2018, at 7:04 AM, Josh Poimboeuf <jpoimboe@redhat.com> wrote:
>
>
>> Anyway, I have a new objection to Josh=E2=80=99s create_gap proposal: wh=
at on
>> Earth will kernel CET do to it?  Maybe my longjmp-like hack is
>> actually better.
>
> Does CET even care about iret?  I assumed it didn't.  If it does, your
> proposal would have the same problem, no?

I think it doesn=E2=80=99t, but it doesn=E2=80=99t really matter.  The shad=
ow stack looks like:

retaddr of function being poked
call do_int3 + 5

And, to emulate a call, you need to stick a new frame right in the
middle.  At least with a longjmp-like approach, you can clobber the
=E2=80=9Ccall do_int3 + 5=E2=80=9D part and then INCSSP on the way out.  To=
 be fair, I
think this also sucks.

PeterZ, can we abuse NMI to make this problem go away?  I don't
suppose that we have some rule that NMI handlers never wait for other
CPUs to finish doing anything?