RE: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-08 Thread David Laight
From: Ard Biesheuvel > Sent: 08 January 2018 14:38 > To: Will Deacon > Cc: linux-arm-ker...@lists.infradead.org; Catalin Marinas; Marc Zyngier; > Lorenzo Pieralisi; > Christoffer Dall; Linux Kernel Mailing List; Laura Abbott > Subject: Re: [PATCH v2 01/11] arm64: use RET instr

Re: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-08 Thread Ard Biesheuvel
On 8 January 2018 at 14:45, Will Deacon wrote: > On Mon, Jan 08, 2018 at 02:38:00PM +, Ard Biesheuvel wrote: >> On 8 January 2018 at 14:33, Will Deacon wrote: >> > On Sat, Jan 06, 2018 at 01:13:23PM +, Ard Biesheuvel wrote: >> >> On 5 January 2018 at 13:12, Will Deacon wrote: >> >> > Spe

Re: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-08 Thread Will Deacon
On Mon, Jan 08, 2018 at 02:38:00PM +, Ard Biesheuvel wrote: > On 8 January 2018 at 14:33, Will Deacon wrote: > > On Sat, Jan 06, 2018 at 01:13:23PM +, Ard Biesheuvel wrote: > >> On 5 January 2018 at 13:12, Will Deacon wrote: > >> > Speculation attacks against the entry trampoline can pote

Re: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-08 Thread Ard Biesheuvel
On 8 January 2018 at 14:33, Will Deacon wrote: > On Sat, Jan 06, 2018 at 01:13:23PM +, Ard Biesheuvel wrote: >> On 5 January 2018 at 13:12, Will Deacon wrote: >> > Speculation attacks against the entry trampoline can potentially resteer >> > the speculative instruction stream through the indi

Re: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-08 Thread Will Deacon
On Sat, Jan 06, 2018 at 01:13:23PM +, Ard Biesheuvel wrote: > On 5 January 2018 at 13:12, Will Deacon wrote: > > Speculation attacks against the entry trampoline can potentially resteer > > the speculative instruction stream through the indirect branch and into > > arbitrary gadgets within the

Re: [PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-06 Thread Ard Biesheuvel
On 5 January 2018 at 13:12, Will Deacon wrote: > Speculation attacks against the entry trampoline can potentially resteer > the speculative instruction stream through the indirect branch and into > arbitrary gadgets within the kernel. > > This patch defends against these attacks by forcing a mispr

[PATCH v2 01/11] arm64: use RET instruction for exiting the trampoline

2018-01-05 Thread Will Deacon
Speculation attacks against the entry trampoline can potentially resteer the speculative instruction stream through the indirect branch and into arbitrary gadgets within the kernel. This patch defends against these attacks by forcing a misprediction through the return stack: a dummy BL instruction