Stuffing the return stack buffer [LWN.net]

Stuffing the return stack buffer

Posted Jul 24, 2022 17:18 UTC (Sun) by izbyshev (subscriber, #107996)
In reply to: Stuffing the return stack buffer by izbyshev
Parent article: Stuffing the return stack buffer

And indeed, quoting the patch:

+ * The shift count might cause this to be off by one in either direction,
+ * but there is still a cushion vs. the RSB depth. The algorithm does not
+ * claim to be perfect and it can be speculated around by the CPU, but it
+ * is considered that it obfuscates the problem enough to make exploitation
+ * extremly difficult.

to post comments

Stuffing the return stack buffer

Posted Jul 24, 2022 17:44 UTC (Sun) by Paf (subscriber, #91811) [Link] (1 responses)

Which seems fine, since if the CPU designers were involved, it’s probably ok for existing CPUs and fixed in future, right?

Stuffing the return stack buffer

Posted Jul 24, 2022 18:14 UTC (Sun) by izbyshev (subscriber, #107996) [Link]

I can't find any indications of Intel CPU designers being involved in this mitigation, but from what I could understand, the newest CPUs are not affected, so, indeed, the mitigation has to work only on a known set of CPUs.

Stuffing the return stack buffer

Posted Jul 26, 2022 0:24 UTC (Tue) by developer122 (guest, #152928) [Link] (2 responses)

In other words, "it's fixed until we discover otherwise"

Stuffing the return stack buffer

Posted Jul 26, 2022 13:47 UTC (Tue) by mss (subscriber, #138799) [Link] (1 responses)

Some knowledgeable people already say that:

Retpoline is not safe on Skylake-era CPUs, and we knew this before the Spectre/Meltdown embargo broke in Jan '18.

RSB stuffing relies on retpolines for Spectre v2 mitigation.

Stuffing the return stack buffer

Posted Jul 26, 2022 14:47 UTC (Tue) by izbyshev (subscriber, #107996) [Link]

> RSB stuffing relies on retpolines for Spectre v2 mitigation.

FWIW, it's vice versa: retpolines rely on RSB stuffing to make them less broken on Skylake.

But yeah, the general sentiment of that email is that apparently retpolines would be unsafe on Skylake even if RSB stuffing were added in all cases when the RSB might become empty.