From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on archive.lwn.net X-Spam-Level: X-Spam-Status: No, score=-5.8 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by archive.lwn.net (Postfix) with ESMTP id 8834C7D2EF for ; Fri, 7 Jun 2019 08:09:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727450AbfFGIJG (ORCPT ); Fri, 7 Jun 2019 04:09:06 -0400 Received: from merlin.infradead.org ([205.233.59.134]:47632 "EHLO merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725978AbfFGIJF (ORCPT ); Fri, 7 Jun 2019 04:09:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=T2+J8KOCU8D0FrF3JsY6TcG0OhfOJ0h4LqGgdXA+AZ0=; b=UkJpC7dnl6p1BOyZG/oCTfAsK MCq5N2Nkf5FTQ36Pp2TRqbmVMpzuneO72NDYNJpinfN4KhVjvnSMi1SGmTI84SdmvdHpZxj3DpDlS l4oFrtTyTTWpHOt+Byrg8AY5dgn5Qmbsg7JVMYHaxNEm9eICXvy4+QVioPIenEOX5990R58OWw6E9 2lwQs5Ub8efcU5WDrtjgCEPFkcvXjXaa/0b1m2HwGBwS+mMml6ETFXG7W9uC0T+hOFNtLMQCLXjLj k5K1dJQurVg95jcGZz8Uj7b4tJk14Th7RH7f6n09w9n57k5QK+4OXn9HCEx2swAN+cRTvcI0oKEpY im/2HQGTg==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=hirez.programming.kicks-ass.net) by merlin.infradead.org with esmtpsa (Exim 4.92 #3 (Red Hat Linux)) id 1hZ9vO-0006Rr-2q; Fri, 07 Jun 2019 08:08:34 +0000 Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id B1910202CD6B2; Fri, 7 Jun 2019 10:08:32 +0200 (CEST) Date: Fri, 7 Jun 2019 10:08:32 +0200 From: Peter Zijlstra To: Yu-cheng Yu Cc: x86@kernel.org, "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H.J. Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin Subject: Re: [PATCH v7 03/14] x86/cet/ibt: Add IBT legacy code bitmap setup function Message-ID: <20190607080832.GT3419@hirez.programming.kicks-ass.net> References: <20190606200926.4029-1-yu-cheng.yu@intel.com> <20190606200926.4029-4-yu-cheng.yu@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190606200926.4029-4-yu-cheng.yu@intel.com> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org On Thu, Jun 06, 2019 at 01:09:15PM -0700, Yu-cheng Yu wrote: > Indirect Branch Tracking (IBT) provides an optional legacy code bitmap > that allows execution of legacy, non-IBT compatible library by an > IBT-enabled application. When set, each bit in the bitmap indicates > one page of legacy code. > > The bitmap is allocated and setup from the application. > +int cet_setup_ibt_bitmap(unsigned long bitmap, unsigned long size) > +{ > + u64 r; > + > + if (!current->thread.cet.ibt_enabled) > + return -EINVAL; > + > + if (!PAGE_ALIGNED(bitmap) || (size > TASK_SIZE_MAX)) > + return -EINVAL; > + > + current->thread.cet.ibt_bitmap_addr = bitmap; > + current->thread.cet.ibt_bitmap_size = size; > + > + /* > + * Turn on IBT legacy bitmap. > + */ > + modify_fpu_regs_begin(); > + rdmsrl(MSR_IA32_U_CET, r); > + r |= (MSR_IA32_CET_LEG_IW_EN | bitmap); > + wrmsrl(MSR_IA32_U_CET, r); > + modify_fpu_regs_end(); > + > + return 0; > +} So you just program a random user supplied address into the hardware. What happens if there's not actually anything at that address or the user munmap()s the data after doing this?