Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754797AbeAIAo1 (ORCPT + 1 other); Mon, 8 Jan 2018 19:44:27 -0500 Received: from mga04.intel.com ([192.55.52.120]:3051 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750966AbeAIAo0 (ORCPT ); Mon, 8 Jan 2018 19:44:26 -0500 X-Amp-Result: UNKNOWN X-Amp-Original-Verdict: FILE UNKNOWN X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,333,1511856000"; d="scan'208";a="8304666" Date: Mon, 8 Jan 2018 16:44:15 -0800 From: Andi Kleen To: Linus Torvalds Cc: "Woodhouse, David" , "linux-kernel@vger.kernel.org" , "tim.c.chen@linux.intel.com" , "peterz@infradead.org" , "tglx@linutronix.de" , "riel@redhat.com" , "keescook@google.com" , "gnomes@lxorguk.ukuu.org.uk" , "pjt@google.com" , "dave.hansen@intel.com" , "luto@amacapital.net" , "jikos@kernel.org" , "gregkh@linux-foundation.org" Subject: Re: [PATCH v6 11/10] x86/retpoline: Avoid return buffer underflows on context switch Message-ID: <20180109004415.GG6718@tassilo.jf.intel.com> References: <1515363085-4219-1-git-send-email-dwmw@amazon.co.uk> <1515455051.15588.7.camel@infradead.org> <1515455902.4423.59.camel@amazon.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: > So I was really hoping that in places like context switching etc, we'd > be able to instead effectively kill off any exploits by clearing > registers. > > That should make it pretty damn hard to then find a matching "gadget" > that actually does anything interesting/powerful. > > Together with Spectre already being pretty hard to take advantage of, > and the eBPF people making those user-proivided gadgets inaccessible, > it really should be a pretty powerful fix. > > Hmm? Essentially the RSB are hidden registers, and the only way to clear them is the FILL_RETURN_BUFFER sequence. I don't see how clearing anything else would help? -Andi