Re: [PATCH v6 11/10] x86/retpoline: Avoid return buffer underflows on context switch

[Pavel Machek]

On Tue 2018-01-09 13:04:20, David Woodhouse wrote:
> On Mon, 2018-01-08 at 19:27 -0800, Andy Lutomirski wrote:
> > > 
> > > If SMEP is not active, speculation can go anywhere, including to a user
> > > controlled gadget which can reload any registers it needs, including
> > > with immediate constants.
> > 
> > I thought that, even on pre-SMEP hardware, the CPU wouldn't
> > speculatively execute from NX pages.  And PTI marks user memory NX
> > in kernel mode.
> 
> Hm, now that could be useful. 
> 
> Do *all* the KPTI backports (some of which are reimplementations rather
> than strictly backports) mark user memory NX?

Hmm. We'd still want to do something on 32-bit, and those might not
even have NX support in hardware.

Pentium 4 (and such) is probably advanced enough to be vulnerable to
spectre, but not new enough to support NX...

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html