Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict
 Indirect Branch Speculation
To:     Liran Alon <liran.alon@oracle.com>
References: <7c0b0879-3448-43e4-8380-4708fc787113@default>
Cc:     labbott@redhat.com, luto@kernel.org, Janakarajan.Natarajan@amd.com,
        bp@suse.de, torvalds@linux-foundation.org,
        asit.k.mallick@intel.com, rkrcmar@redhat.com, karahmed@amazon.de,
        hpa@zytor.com, jun.nakajima@intel.com, mingo@redhat.com,
        x86@kernel.org, ashok.raj@intel.com, arjan.van.de.ven@intel.com,
        tim.c.chen@linux.intel.com, pbonzini@redhat.com,
        ak@linux.intel.com, linux-kernel@vger.kernel.org,
        dwmw2@infradead.org, peterz@infradead.org, tglx@linutronix.de,
        gregkh@linuxfoundation.org, mhiramat@kernel.org,
        arjan@linux.intel.com, thomas.lendacky@amd.com,
        dan.j.williams@intel.com, joro@8bytes.org, aarcange@redhat.com,
        kvm@vger.kernel.org
From:   Dave Hansen <dave.hansen@intel.com>
Message-ID: <50c5d627-8975-184b-b50f-4cc02c5816c5@intel.com>
Date:   Thu, 25 Jan 2018 18:23:51 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <7c0b0879-3448-43e4-8380-4708fc787113@default>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 01/25/2018 06:11 PM, Liran Alon wrote:
> It is true that attacker cannot speculate to a kernel-address, but it
> doesn't mean it cannot use the leaked kernel-address together with
> another unrelated vulnerability to build a reliable exploit.

The address doesn't leak if you can't execute there.  It's the same
reason that we don't worry about speculation to user addresses from the
kernel when SMEP is in play.