Messages in this thread | | | From | "Van De Ven, Arjan" <> | Subject | RE: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation | Date | Fri, 26 Jan 2018 02:55:07 +0000 |
| |
> -----Original Message----- > From: Liran Alon [mailto:liran.alon@oracle.com] > Sent: Thursday, January 25, 2018 6:50 PM > To: Hansen, Dave <dave.hansen@intel.com> > Cc: labbott@redhat.com; luto@kernel.org; Janakarajan.Natarajan@amd.com; > torvalds@linux-foundation.org; bp@suse.de; Mallick, Asit K > <asit.k.mallick@intel.com>; rkrcmar@redhat.com; karahmed@amazon.de; > hpa@zytor.com; mingo@redhat.com; Nakajima, Jun > <jun.nakajima@intel.com>; x86@kernel.org; Raj, Ashok <ashok.raj@intel.com>; > Van De Ven, Arjan <arjan.van.de.ven@intel.com>; tim.c.chen@linux.intel.com; > pbonzini@redhat.com; ak@linux.intel.com; linux-kernel@vger.kernel.org; > dwmw2@infradead.org; peterz@infradead.org; tglx@linutronix.de; > gregkh@linuxfoundation.org; mhiramat@kernel.org; arjan@linux.intel.com; > thomas.lendacky@amd.com; Williams, Dan J <dan.j.williams@intel.com>; > joro@8bytes.org; kvm@vger.kernel.org; aarcange@redhat.com > Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect > Branch Speculation > >
> Google P0 blog-post > (https://googleprojectzero.blogspot.co.il/2018/01/reading-privileged-memory- > with-side.html) claims that BTB & BHB only use <31 low bits of the address of > the source instruction to lookup into the BTB. In addition, it claims that the > higher bits of the predicated destination change together with the higher bits of > the source instruction. > > Therefore, it should be possible to leak the low bits of high predicition-mode > code BTB/BHB entries from low prediction-mode code. Because the predicted > destination address will reside in user-space. > > What am I missing?
I thought this email thread was about the RSB...
| |