Reverse Engineering Branch Prediction Capabilities in Modern Micro-Architectures

Caches (and cache hierarchies) are an important aspect in modern hardware design. Caches also have a strong influence in the security of a modern platform, and in recent years there was a wave of new speculative side-channels discovered since the class was unveiled [1].This paper discusses reverse engineering techniques used by the authors to identify relevant cache characteristics that are necessary to mount some of the recently disclosed speculative side-channel attacks. The techniques are then applied on the latest interaction of Intel’s Hardware mitigation eIBRS (the "enhanced" IBRS), uncovering how it really works and how it differs, even if subtly, from the mitigations it is said to replace - retpoline (having weaknesses never discussed before). The findings open a new area for research in the speculative side-channels and how they are mitigated.