Hector Martin

On first glance it looks like many CPUs are vulnerable to same-privilege mis-speculation leaks (e.g. in JIT engines - disable eBPF jit if you have it enabled), but Intel has the real SNAFU in letting it leak across privilege modes.

Then there's the branch target misprediction attack; it seems to rely a lot on the details of Intel branch prediction, but it's unclear whether other CPUs are affected by variants of it. Maybe this is patchable in microcode?

Considering branch prediction & speculative loading is very likely on the hot path, I don’t think it’s implemented in microcode :/

But if the problem is branch predictor injection, they can just flush branch predictor state on kernel/userspace transitions. That likely wouldn't have a massive performance impact.

I may be wrong but I don’t think there is any mechanism in place to do that. And even then by the time the context switch is actually executed, you may already have speculatively executed further instructions

There is no *user-accessible* architecturally defined mechanism for that that I'm aware of, but it's entirely possible they have a way of doing it in microcode. "Flush/disable/whatever the BTB" sounds like the kind of chicken bit they'd have. Hence microcode fix.

I can’t think of a μcode fix besides “flush any cache line touched by an incorrect prediction IF it wasn’t there before” and I highly doubt the μcode has enough memory to keep track of all that in something in the hot path