Welcome to Pathfinder Discussions!

[hoseinyavarzadeh]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

[maheshhari]

I have question on the CLEAR_PHR macro in attack.nasm.

My understanding is that to clear the PHR we need to execute n(size of PHR) taken jumps and the branch address is i bits aligned and target address is j bits aligned such that the footprint is zero. Your research in half&half shows that n is 193, i is 16 and j is 6 for Alder Lake.

In the CLEAR_PHR macro the target address(clear_phr_loop:) is aligned to 1<<6(as expected), but the branch address(jnz clear_phr_loop) is at (1<<16)-1.
Why is the branch address not exactly 1<<16 bits aligned? Am I missing something here?

; https://github.com/hoseinyavarzadeh/Pathfinder_Attack/blob/main/source/attack/attack.nasm
%macro CLEAR_PHR 0
    ; ---------------- Start of CLEAR PHR
    mov r10, 193
    jmp clear_phr_loop
    align 1<<16
    %rep (1<<16)-64
     nop
    %endrep
    clear_phr_loop:
    %rep 60
     nop
    %endrep
    dec r10
    jnz clear_phr_loop
    ; ---------------- END of CLEAR PHR
%endmacro

[hoseinyavarzadeh]

Hi there,

Great question!

In Intel CPUs, the address of the last byte of an instruction is used to update the PHR value. To clear the PHR, you would need to execute 194 taken branches where the branch address (the last byte) is aligned to 1<<16, and the target address is aligned to 1<<6.

If you use "objdump" to examine the assembly code, you'll notice that the branch address is aligned to (1<<16 - 1). Since a branch instruction (in this case) is 2 bytes long, the address of the last byte is indeed aligned to 1<<16.

Feel free to reach out if you have any more questions!

[maheshhari]

Thanks for your reply,

That is a very interesting detail. If I am understanding this correctly, the last byte of the instruction has to be aligned, e.g. a branch instruction of 6 bytes should be aligned to (1<<16 - 5).
Out of curiosity, how did you find out that the last byte had to be aligned? Did you design any experiment to find this?

[hoseinyavarzadeh]

That's correct.
One simple experiment is to align different bytes of the instruction and see when you can CLEAR the PHR value. By doing that, we found we can clear the PHR only when its last byte is aligned!