Messages in this thread | | | From | "Van De Ven, Arjan" <> | Subject | RE: [PATCH 0/7] IBRS patch series | Date | Thu, 4 Jan 2018 21:22:34 +0000 |
| |
> On Thu, Jan 4, 2018 at 11:19 AM, David Woodhouse <dwmw2@infradead.org> > wrote: > > > > On Skylake the target for a 'ret' instruction may also come from the > > BTB. So if you ever let the RSB (which remembers where the 'call's came > > from get empty, you end up vulnerable. > > That sounds like it could cause mispredicts, but it doesn't sound _exploitable_. > > Sure, interrupts in between the call instruction and the 'ret' could > overflow the return stack. And we could migrate to another CPU. And so > apparently SMM clears the return stack too. > > ... but again, none of them sound even remotely _exploitable_. >
this is about a level of paranoia you are comfortable with.
Retpoline on Skylake raises the bar for the issue enormously, but there are a set of corner cases that exist and that are not trivial to prove you dealt with them.
personally I am comfortable with retpoline on Skylake, but I would like to have IBRS as an opt in for the paranoid.
| |