Hector Martin

On first glance it looks like many CPUs are vulnerable to same-privilege mis-speculation leaks (e.g. in JIT engines - disable eBPF jit if you have it enabled), but Intel has the real SNAFU in letting it leak across privilege modes.

Then there's the branch target misprediction attack; it seems to rely a lot on the details of Intel branch prediction, but it's unclear whether other CPUs are affected by variants of it. Maybe this is patchable in microcode?

Considering branch prediction & speculative loading is very likely on the hot path, I don’t think it’s implemented in microcode :/

But if the problem is branch predictor injection, they can just flush branch predictor state on kernel/userspace transitions. That likely wouldn't have a massive performance impact.

I may be wrong but I don’t think there is any mechanism in place to do that. And even then by the time the context switch is actually executed, you may already have speculatively executed further instructions