lkml.org 
[lkml]   [2018]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v4 01/13] x86/retpoline: Add initial retpoline support
From
Date
On 01/04/18 18:00, David Woodhouse wrote:
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index d4fc98c..1009d1a 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -429,6 +429,19 @@ config GOLDFISH
> def_bool y
> depends on X86_GOLDFISH
>
> +config RETPOLINE
> + bool "Avoid speculative indirect branches in kernel"
> + default y
> + help
> + Compile kernel with the retpoline compiler options to guard against
> + kernel to user data leaks by avoiding speculative indirect

On first reading, I encountered a parse err^W^W <what the heck did that say>
on "kernel to user data". I get it after rereading it, but
kernel-to-user data leaks
would be better. (IMHO)

> + branches. Requires a compiler with -mindirect-branch=thunk-extern
> + support for full protection. The kernel may run slower.
> +
> + Without compiler support, at least indirect branches in assembler
> + code are eliminated. Since this includes the syscall entry path,
> + it is not entirely pointless.


--
~Randy

\
 
 \ /
  Last update: 2018-01-06 06:55    [W:0.061 / U:4.940 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site