Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751616AbeADBA7 (ORCPT + 1 other); Wed, 3 Jan 2018 20:00:59 -0500 Received: from mail-ua0-f194.google.com ([209.85.217.194]:32790 "EHLO mail-ua0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751397AbeADBA6 (ORCPT ); Wed, 3 Jan 2018 20:00:58 -0500 X-Google-Smtp-Source: ACJfBouT1noLRbTBqDrTs36O8dtqvDX0zFVunCYnOR2WDnhJFGOmH6BfBLksMzkonWBES/fENVihejZLBkbYA+aUnGo= MIME-Version: 1.0 In-Reply-To: References: <20180103230934.15788-1-andi@firstfloor.org> From: Paul Turner Date: Wed, 3 Jan 2018 17:00:26 -0800 Message-ID: Subject: Re: Avoid speculative indirect calls in kernel To: Linus Torvalds Cc: Andi Kleen , tglx@linuxtronix.de, Greg Kroah-Hartman , "Woodhouse, David" , Tim Chen , Linux Kernel Mailing List , Dave Hansen Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Wed, Jan 3, 2018 at 3:51 PM, Linus Torvalds wrote: > On Wed, Jan 3, 2018 at 3:09 PM, Andi Kleen wrote: >> This is a fix for Variant 2 in >> https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html >> >> Any speculative indirect calls in the kernel can be tricked >> to execute any kernel code, which may allow side channel >> attacks that can leak arbitrary kernel data. > > Why is this all done without any configuration options? > > A *competent* CPU engineer would fix this by making sure speculation > doesn't happen across protection domains. Maybe even a L1 I$ that is > keyed by CPL. > > I think somebody inside of Intel needs to really take a long hard look > at their CPU's, and actually admit that they have issues instead of > writing PR blurbs that say that everything works as designed. > > .. and that really means that all these mitigation patches should be > written with "not all CPU's are crap" in mind. > > Or is Intel basically saying "we are committed to selling you shit > forever and ever, and never fixing anything"? > > Because if that's the case, maybe we should start looking towards the > ARM64 people more. > > Please talk to management. Because I really see exactly two possibibilities: > > - Intel never intends to fix anything > > OR > > - these workarounds should have a way to disable them. > > Which of the two is it? > > Linus With all of today's excitement these raced slightly with a post we are making explaining the technique and its application. The modifications are mostly at the compiler level, to produce binaries which can safely execute on an affected target. (Discussing how such a binary could be cross-compiled for vulnerable and non-vulnerable targets is an interesting discussion, but right now, all targets are obviously vulnerable.) Let me finish getting the post up and I'll bring back more context here. - Paul