From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225zPsh6RSGFheecWqB/22hdZV3PHOnp7kcL/GEZc1zDKOXeYZhzxKvKwlQzemKpGkPYdMwm ARC-Seal: i=1; a=rsa-sha256; t=1516935086; cv=none; d=google.com; s=arc-20160816; b=oryYT5obs0kAuOSD1J0PoP5YL+45F7T4NCvAZPJvWx53GHDobu5/H+Bo1BFLNs8U8+ 3FyxhJzxt1F/+61LKqKbOAKZupavMvSN3n3oAf9zLyJ64tHOs6DOvAmUauyyyGcCAnE/ ynvMxHVJG3RVTv4N36Myqhs5EUXcRZGDAHIPp+34CZssGbu46qpy5IVq+ToTiiwoKFKA 8joOa/iMwl4gWnwwPIkVLvoI5X4vKF+/Eq86iF9AY0a4spBtwajtYLvWyvRzYGOFVgfy gbxX8d7V70tM+vH4EirtpIYXJ7Gg9FnhAxJ1X5S4IvSbrNS1qgzTBxglhgLe5lamnLgO +eSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-disposition:content-transfer-encoding:subject:cc:to:from :date:message-id:mime-version:dkim-signature :arc-authentication-results; bh=5wpfo2Qzm+4+9SDX6w6rFw/1sYRzaq0nJVu14ANZO1g=; b=IG5UDEf3yQbj/JhGcdouF68byjTI+mnVRwK9DZs/OBnmEyoj8NgZgOON81+ecwZCSU 3MF1hZxvwRh+wCSP3nLhr9kyacjvq9QwypWsWXd1zpFmsA7linbFNN9bbsCByHdzpfLT L4APRPmv7KWlJLCFaCvoSiGt7nduVrBP3cUU4K/1AxtDRgNwllyzDJHvQKTbyuTg3qwf Zmp4G/tahQd0QksXJjCayuQSGwfyg+TtQiBYKLdamNkbCsKbORr/MVxLopquV3RBuSYV v/sABN9iMjno2Wfair1NvANzGmAf8xG7F2yCLmuxU30ylc1YOEf7XDl1XxjDhhszZNOX oDXQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2017-10-26 header.b=BqMpp/YX; spf=pass (google.com: domain of liran.alon@oracle.com designates 141.146.126.78 as permitted sender) smtp.mailfrom=liran.alon@oracle.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com Authentication-Results: mx.google.com; dkim=pass header.i=@oracle.com header.s=corp-2017-10-26 header.b=BqMpp/YX; spf=pass (google.com: domain of liran.alon@oracle.com designates 141.146.126.78 as permitted sender) smtp.mailfrom=liran.alon@oracle.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=oracle.com MIME-Version: 1.0 Message-ID: <23aae227-461c-4d0d-8ccb-df01bae98b2e@default> Date: Thu, 25 Jan 2018 18:50:27 -0800 (PST) From: Liran Alon To: Cc: , , , , , , , , , , , , , , , , , , , , , , , , , , , , Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation X-Mailer: Zimbra on Oracle Beehive Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8785 signatures=668655 X-Proofpoint-Spam-Details: rule=notspam policy=default score=1 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=1 mlxscore=1 mlxlogscore=217 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1801260034 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590140582166248265?= X-GMAIL-MSGID: =?utf-8?q?1590621725121192376?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: ----- dave.hansen@intel.com wrote: > On 01/25/2018 06:11 PM, Liran Alon wrote: > > It is true that attacker cannot speculate to a kernel-address, but > it > > doesn't mean it cannot use the leaked kernel-address together with > > another unrelated vulnerability to build a reliable exploit. >=20 > The address doesn't leak if you can't execute there. It's the same > reason that we don't worry about speculation to user addresses from > the > kernel when SMEP is in play. Maybe I misunderstand BTB & BHB internals. Will be glad if you could pinpoi= nt my error. Google P0 blog-post (https://googleprojectzero.blogspot.co.il/2018/01/readi= ng-privileged-memory-with-side.html) claims that BTB & BHB only use <31 low= bits of the address of the source instruction to lookup into the BTB. In a= ddition, it claims that the higher bits of the predicated destination chang= e together with the higher bits of the source instruction. Therefore, it should be possible to leak the low bits of high predicition-m= ode code BTB/BHB entries from low prediction-mode code. Because the predict= ed destination address will reside in user-space. What am I missing? Thanks, -Liran