Messages in this thread | | | Date | Wed, 9 Aug 2023 13:58:29 +0200 | From | Peter Zijlstra <> | Subject | Re: [RFC][PATCH 00/17] Fix up the recent SRSO patches |
| |
On Wed, Aug 09, 2023 at 11:04:15AM +0100, Andrew.Cooper3@citrix.com wrote: > On 09/08/2023 8:12 am, Peter Zijlstra wrote: > > Since I wasn't invited to the party (even though I did retbleed), I get to > > clean things up afterwards :/ > > > > Anyway, this here overhauls the SRSO patches in a big way. > > > > I claim that AMD retbleed (also called Speculative-Type-Confusion > > Branch Type Confusion.
Durr, I shoud've double checked, and yes, too damn many different things and not enough sleep.
> > -- not to be > > confused with Intel retbleed, which is an entirely different bug) is > > fundamentally the same as this SRSO -- which is also caused by STC. And the > > mitigations are so similar they should all be controlled from a single spot and > > not conflated like they are now. > > BTC and SRSO are certainly related, but they're not the same. > > With BTC, an attacker poisons a branch type prediction to say "that > thing (which isn't actually a ret) is a ret". > > With SRSO, an attacker leaves a poisoned infinite-call-loop prediction. > Later, a real function (that is architecturally correct execution and > will retire) trips over the predicted infinite loop, which overflows the > RSB/RAS/RAP replacing the correct prediction on the top with the > attackers choice of value. > > So while branch type confusion is used to poison the top-of-RSB value, > the ret that actually goes wrong needs a correct type=ret prediction for > the SRSO attack to succeed.
Yes, this is what I meant, and I clearly failed to express myself better. The point was that branch-type-confusion is involved with both, just in different ways.
| |