On Wed, 21 Feb 2018 09:03:00 +0000 > The thing I like about rate limiting (for everyone including root) is > that it does not break anybody's workflow (unless EFI variable access > occurs on a hot path, in which case you're either a) asking for it, or > b) the guy trying to DoS us), and that it can make exploitation of any > potential Spectre v1 vulnerabilities impractical at the same time. At b) doesn't make spectre v1 much harder alas. What matters there is that you turn on the right CPU protections before calling into EFI and turn them off afterwards. EFI firmware internally isn't built with retpoline anyway. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
