lkml.org 
[lkml]   [2018]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation
Date




> -----Original Message-----
> From: Liran Alon [mailto:liran.alon@oracle.com]
> Sent: Thursday, January 25, 2018 6:50 PM
> To: Hansen, Dave <dave.hansen@intel.com>
> Cc: labbott@redhat.com; luto@kernel.org; Janakarajan.Natarajan@amd.com;
> torvalds@linux-foundation.org; bp@suse.de; Mallick, Asit K
> <asit.k.mallick@intel.com>; rkrcmar@redhat.com; karahmed@amazon.de;
> hpa@zytor.com; mingo@redhat.com; Nakajima, Jun
> <jun.nakajima@intel.com>; x86@kernel.org; Raj, Ashok <ashok.raj@intel.com>;
> Van De Ven, Arjan <arjan.van.de.ven@intel.com>; tim.c.chen@linux.intel.com;
> pbonzini@redhat.com; ak@linux.intel.com; linux-kernel@vger.kernel.org;
> dwmw2@infradead.org; peterz@infradead.org; tglx@linutronix.de;
> gregkh@linuxfoundation.org; mhiramat@kernel.org; arjan@linux.intel.com;
> thomas.lendacky@amd.com; Williams, Dan J <dan.j.williams@intel.com>;
> joro@8bytes.org; kvm@vger.kernel.org; aarcange@redhat.com
> Subject: Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect
> Branch Speculation
>
>

> Google P0 blog-post
> (https://googleprojectzero.blogspot.co.il/2018/01/reading-privileged-memory-
> with-side.html) claims that BTB & BHB only use <31 low bits of the address of
> the source instruction to lookup into the BTB. In addition, it claims that the
> higher bits of the predicated destination change together with the higher bits of
> the source instruction.
>
> Therefore, it should be possible to leak the low bits of high predicition-mode
> code BTB/BHB entries from low prediction-mode code. Because the predicted
> destination address will reside in user-space.
>
> What am I missing?


I thought this email thread was about the RSB...

\
 
 \ /
  Last update: 2018-01-26 03:55    [W:0.043 / U:0.728 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site