On first glance it looks like many CPUs are vulnerable to same-privilege mis-speculation leaks (e.g. in JIT engines - disable eBPF jit if you have it enabled), but Intel has the real SNAFU in letting it leak across privilege modes.
There is no *user-accessible* architecturally defined mechanism for that that I'm aware of, but it's entirely possible they have a way of doing it in microcode. "Flush/disable/whatever the BTB" sounds like the kind of chicken bit they'd have. Hence microcode fix.
-
-
I doubt flushing the branch prediction on syscalls will have nearly as much impact as flushing TLBs/changing pagetables as KPTI is doing. Branch state is a lot more transient and relevant to tight loops than page tables.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
I may be missing something but wouldn’t flushing the BTB not only not fix the issue, but makes it easier to exploit by making the behavior of the BP its default?
-
The Spectre exploit is "priming" the branch predictor with a bogus (exploit) target address. There is no default.
End of conversation
New conversation -
-
-
I can’t think of a μcode fix besides “flush any cache line touched by an incorrect prediction IF it wasn’t there before” and I highly doubt the μcode has enough memory to keep track of all that in something in the hot path
-
I'm not talking about Meltdown, I'm talking about Spectre. Meltdown is mitigated by KPTI (with perf impact) on Intel. I speculate Spectre may be mitigatable in microcode.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.