Messages in this thread | | | Date | Thu, 10 Aug 2023 13:51:48 +0200 | From | Borislav Petkov <> | Subject | Re: [RFC][PATCH 02/17] x86/cpu: Clean up SRSO return thunk mess |
| |
On Wed, Aug 09, 2023 at 09:12:20AM +0200, Peter Zijlstra wrote: > Where Zen1/2 flush the BTB using the instruction decoder trick > (test,movabs) Zen3/4 use instruction aliasing. SRSO adds RSB (RAP in
BTB aliasing.
> AMD speak) stuffing to force a return mis-predict.
No it doesn't. It causes BTB aliasing which evicts any potentially poisoned entries.
> That is; the AMD retbleed is a form of Speculative-Type-Confusion > where the branch predictor is trained to use the BTB to predict the > RET address, while AMD inception/SRSO is a form of > Speculative-Type-Confusion where another instruction is trained to be > treated like a CALL instruction and poison the RSB (RAP).
Nope, Andy explained it already in the 0th message.
> Pick one of three options at boot.
Yes, provided microarchitecturally that works, I'm all for removing the __ret alternative.
Thx.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |