7 ms·

Dragonfly went a little further with this as well.. very precarious future ahead for us, I think.. http://lists.dragonflybsd.org/pipermail/commits/2018-June/67

Dragonfly went a little further with this as well.. very precarious future ahead for us, I think.. http://lists.dragonflybsd.org/pipermail/commits/2018-June/672325.html http://lists.dragonflybsd.org/pipermail/commits/2018-June/67...

koolba 8y ago
I find it amazing how clean the diff for something like this is within the BSD source tree: http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9474cbef7fcb61cd268019694d94db6a75af7dbe http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9474...
- tomxor 8y ago
  :) Some people go to great lengths to make commit history produce nice clean diffs... although I doubt anyone ever reads mine. Rebase, squash and split, your future self will thank you!
- bonzini 8y ago
  Here's the Linux patch for this: https://patchwork.kernel.org/patch/10202865/ https://patchwork.kernel.org/patch/10202865/ It was done in February for Spectre ("variant 2"). Strange that Dragonfly is only starting now to clear registers.
throwaway2048 8y ago
I wonder if even this will be enough, it seems that modern x86 has hundreds/thousands of non externally visible hidden registers it uses for fast store/load (rather than a call to cache/ram). https://en.wikipedia.org/wiki/Register_renaming https://en.wikipedia.org/wiki/Register_renaming
- caf 8y ago
  Once the architectural registers are zeroed in a path that can't be speculatively skipped, the other values in the register file are dead and can't be exposed.
  - throwaway2048 8y ago
    Sure but these bugs are about side effects of speculation that happens before any kind of "deadening" of untaken branches occurs. What if the processor is speculating using these hidden registers, couldn't similar information be exposed?
    - caf 8y ago
      The code in question unconditionally zeroes the architecturally-visible registers on entry to the syscall path. If any mis-speculation happens, it has to happen after this point, at which point any user-supplied data left over in the register file isn't accessible to speculated code, because even speculated code can only use architectural names to address registers.

koolba 8y ago

I find it amazing how clean the diff for something like this is within the BSD source tree: http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9474cbef7fcb61cd268019694d94db6a75af7dbe http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9474...

tomxor 8y ago
:) Some people go to great lengths to make commit history produce nice clean diffs... although I doubt anyone ever reads mine. Rebase, squash and split, your future self will thank you!
bonzini 8y ago
Here's the Linux patch for this: https://patchwork.kernel.org/patch/10202865/ https://patchwork.kernel.org/patch/10202865/ It was done in February for Spectre ("variant 2"). Strange that Dragonfly is only starting now to clear registers.

throwaway2048 8y ago

I wonder if even this will be enough, it seems that modern x86 has hundreds/thousands of non externally visible hidden registers it uses for fast store/load (rather than a call to cache/ram). https://en.wikipedia.org/wiki/Register_renaming https://en.wikipedia.org/wiki/Register_renaming

caf 8y ago
Once the architectural registers are zeroed in a path that can't be speculatively skipped, the other values in the register file are dead and can't be exposed.
- throwaway2048 8y ago
  Sure but these bugs are about side effects of speculation that happens before any kind of "deadening" of untaken branches occurs. What if the processor is speculating using these hidden registers, couldn't similar information be exposed?
  - caf 8y ago
    The code in question unconditionally zeroes the architecturally-visible registers on entry to the syscall path. If any mis-speculation happens, it has to happen after this point, at which point any user-supplied data left over in the register file isn't accessible to speculated code, because even speculated code can only use architectural names to address registers.