Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752082AbeAOSK6 (ORCPT + 1 other); Mon, 15 Jan 2018 13:10:58 -0500 Received: from mail-pg0-f45.google.com ([74.125.83.45]:46334 "EHLO mail-pg0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752228AbeAOSKC (ORCPT ); Mon, 15 Jan 2018 13:10:02 -0500 X-Google-Smtp-Source: ACJfBouLArq17Eyw+LB1Oy/b6TDuwb4ipwnNlJHXlfhkdUZiI7Dt/w7BUHTelz/eUX5Qfqk2OySk4w== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) Subject: Re: Improve retpoline for Skylake From: Andy Lutomirski X-Mailer: iPhone Mail (15C202) In-Reply-To: <1516039672.4937.13.camel@infradead.org> Date: Mon, 15 Jan 2018 10:10:00 -0800 Cc: Andrew Cooper , Jon Masters , Henrique de Moraes Holschuh , Andi Kleen , tglx@linutronix.de, x86@kernel.org, linux-kernel@vger.kernel.org, pjt@google.com, torvalds@linux-foundation.org, gregkh@linux-foundation.org, peterz@infradead.org, thomas.lendacky@amd.com, arjan.van.de.ven@intel.com Content-Transfer-Encoding: 8BIT Message-Id: <794A4D67-43FC-4909-8B41-3A9765C5F2A0@amacapital.net> References: <20180112184550.6573-1-andi@firstfloor.org> <1515784373.22302.492.camel@infradead.org> <20180112192126.su2evwfefdfeaa6g@two.firstfloor.org> <20180112220349.7dorb3lde4tffsjm@khazad-dum.debian.net> <985f979e-0740-5d8a-d6b8-b023105aa021@jonmasters.org> <445ec6c6-a835-fbdc-dca3-222a73d19816@citrix.com> <1516039672.4937.13.camel@infradead.org> To: David Woodhouse Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: > On Jan 15, 2018, at 10:07 AM, David Woodhouse wrote: > >> On Mon, 2018-01-15 at 10:06 -0800, Andy Lutomirski wrote: >> >>> Refill or not, you are aware that a correctly timed SMI in a leaf >>> function will cause the next ret to speculate into userspace, because >>> there is guaranteed peturbance in the RSB? (On the expectation that the >>> SMM handler isn't entirely devoid of function calls). >> >> Couldn't firmware fill the RSB with a some known safe address, maybe >> even 0, and then immediately do RSM? > > Why don't we just unconditionally declare that *all* firmware that uses > SMI for anything at all is broken? > Because then Intel would need a new reference design for EFI authenticated variables. Of course, this is totally doable and should be done anyway. Also, Paolo reports that some misdesign or other makes it important to use SMI on CPU hotplug.