On Tue 2018-01-09 13:04:20, David Woodhouse wrote:
> On Mon, 2018-01-08 at 19:27 -0800, Andy Lutomirski wrote:
> > >
> > > If SMEP is not active, speculation can go anywhere, including to a user
> > > controlled gadget which can reload any registers it needs, including
> > > with immediate constants.
> >
> > I thought that, even on pre-SMEP hardware, the CPU wouldn't
> > speculatively execute from NX pages. And PTI marks user memory NX
> > in kernel mode.
>
> Hm, now that could be useful.
>
> Do *all* the KPTI backports (some of which are reimplementations rather
> than strictly backports) mark user memory NX?
Hmm. We'd still want to do something on 32-bit, and those might not
even have NX support in hardware.
Pentium 4 (and such) is probably advanced enough to be vulnerable to
spectre, but not new enough to support NX...
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures)
http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
