On Thu, 2024-10-31 at 16:03 -0700, Pawan Gupta wrote: > On Thu, Oct 31, 2024 at 04:39:24PM +0100, Amit Shah wrote: > > From: Amit Shah <amit.shah@xxxxxxx> > > > > Remove explicit RET stuffing / filling on VMEXITs and context > > switches on AMD CPUs with the ERAPS feature (Turin+). > > > > With the Enhanced Return Address Prediction Security feature, any > > hardware TLB flush results in flushing of the RSB (aka RAP in AMD > > spec). > > This guarantees an RSB flush across context switches. > > Is it that the mov to CR3 triggers the RSB flush? The INVPCID instruction, that causes the TLB flush, is the trigger here. > > Feature documented in AMD PPR 57238. > > I couldn't find ERAPS feature description here, I could only manage > to find > the bit position: > > 24 ERAPS. Read-only. Reset: 1. Indicates support for enhanced > return > address predictor security. > > Could you please point me to the document/section where this is > described? Unfortunately, that's all we have right now in the official documentation. I've put up some notes in https://amitshah.net/2024/11/eraps-reduces-software-tax-for-hardware-bugs/ Thanks, Amit
