Lines Matching refs:branch
6 Spectre is a class of side channel attacks that exploit branch prediction
18 use branch prediction and speculative execution.
55 buffers, and branch predictors. Malicious software may be able to
70 of speculative execution that bypasses conditional branch instructions
92 The branch target injection attack takes advantage of speculative
94 branch predictors inside the processor used to guess the target of
103 branches in the victim to gadget code by poisoning the branch target
104 buffer of a CPU used for predicting indirect branch addresses. Such
106 with the address offset of the indirect branch under the attacker's
107 control. Since the branch prediction on impacted hardware does not
108 fully disambiguate branch address and uses the offset for prediction,
109 this could cause privileged code's indirect branch to jump to a gadget
127 from the sibling thread, as level 1 cache and branch target buffer
130 steer its indirect branch speculations to gadget code, and measure the
135 Branch History Buffer (BHB) to speculatively steer an indirect branch
137 associated with the source address of the indirect branch. Specifically,
162 is invalid, but bound checks are bypassed in the code branch taken
173 An attacker can train the branch predictor to speculatively skip the
203 A spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
205 After entering the kernel, the kernel could use the poisoned branch
214 The kernel can protect itself against consuming poisoned branch
244 :ref:`poisoning <poison_btb>` the branch target buffer. This can
245 influence the indirect branch targets for a victim process that either
250 by using the prctl() syscall to disable indirect branch speculation
252 from polluting the branch target buffer by disabling the process's
253 indirect branch speculation. This comes with a performance cost
254 from not using indirect branch speculation and clearing the branch
256 indirect branch speculation disabled, Single Threaded Indirect Branch
258 sibling thread from controlling branch target buffer. In addition,
260 branch target buffer when context switching to and from such process.
263 This prevents the branch target buffer from being used for branch
285 <poison_btb>` the branch target buffer or return stack buffer, causing
289 for indirect branches to bypass the poisoned branch target buffer,
294 indirect branch speculation disabled via prctl(). The branch target
310 :ref:`poisoning <poison_btb>` the branch target buffer or the return
316 and clearing the branch target buffer before switching to a new guest.
320 by turning off the unsafe guest's indirect branch speculation via
396 - Indirect branch prediction barrier (IBPB) status for protection between
404 'IBPB: conditional' Use IBPB on SECCOMP or indirect branch restricted tasks
407 - Single threaded indirect branch prediction (STIBP) status for protection
415 'STIBP: conditional' Use STIBP on SECCOMP or indirect branch restricted tasks
489 -mindirect-branch=thunk-extern -mindirect-branch-register options.
504 indirect branch predictor entry, and although branch predictor entries are
509 On Intel's enhanced IBRS systems, this includes cross-thread branch target
521 On x86, indirect branch restricted speculation is turned on by default
537 This protects them from consuming poisoned entries in the branch
542 can disable indirect branch speculation via prctl() (See
546 flush the branch target buffer when switching to/from the program.
548 Restricting indirect branch speculation on a user program will
554 Programs that disable their indirect branch speculation will have
572 poisoned entries in branch target buffer left by rogue guests. It also
574 stack buffer underflow so poisoned branch target buffer could be used,
578 the branch target buffer is sanitized by flushing before switching
585 its indirect branch speculation disabled by administrator via prctl().
607 (indirect branch prediction) vulnerability. System may
615 (indirect branch speculation) vulnerability.
645 retpoline,lfence LFENCE; indirect branch
690 disabling indirect branch speculation when the program is running
697 off by disabling their indirect branch speculation when they are run
699 This prevents untrusted programs from polluting the branch target
710 overhead as indirect branch speculations for all programs will be
713 On x86, branch target buffer will be flushed with IBPB when switching
719 whose indirect branch speculation is explicitly disabled,
721 program to clear the branch target buffer (See "ibpb" option in
741 … Retpoline: A branch target injection mitigation <https://software.intel.com/security-software-gui…
745 …ntel.com/security-software-guidance/insights/deep-dive-single-thread-indirect-branch-predictors>`_.
751 [5] `AMD64 technology indirect branch control extension <https://developer.amd.com/wp-content/resou…
771 [9] `Retpoline: a software construct for preventing branch-target-injection <https://support.google…