jeanclaude
/
BachelorThesis
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

IMPROVE: rewrite stuff

This commit is contained in:
Jean-Claude 2022-07-22 21:30:29 +02:00
parent 53199e3d58
commit f51e44e586
Signed by: jeanclaude
GPG Key ID: 8A300F57CBB9F63E
14 changed files with 1001 additions and 1230 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
chapters/10-introduction.tex
View File

@ -7,29 +7,24 @@
\section{Motivation}
\label{sec:motivation}
% The motivation to write this thesis was \dots
Modern processors use speculation and pipelining to speed up processing.
While having great performance benefits, Meltdown \cite{meltdown} and Spectre \cite{spectre} have shown the security vulnerabilities these design principle have.
On a regular basis new vulnerabilities are found and exploited using well-crafted attacks.
Manufactures and kernel developers are working hard to mitigate them via kernel patches.
\retbleed{} is a new vulnerability belonging to the family of \techterm{transient execution attacks}, that has started with \techterm{Meltdown}\cite{meltdown} and \techterm{Spectre}\cite{spectre}.
It leaks arbitrary kernel memory from systems of various microarchitectures from both Intel and AMD, running the latest kernel\footnote{As of today, mitigations have been released in kernel version 5.19.} and employing all available mitigations.
\retbleed{} allows an attacker to hijack branches, using \ac{bti}, similarly to Spectre V2\cite{spectre}.
The main difference to Spectre V2 is, that \retbleed{} targets return instructions.
One of such an attack is \retbleed\cite{retbleed}, a transient execution attack that leaks arbitrary kernel memory from patched Linux systems with the latest kernel\footnote{As of today, \retbleed{} got mitigated in kernel version 5.19.}
It is similar to spectre v2 / Spectre-\acs*{bti} in the way that it mistrains the \ac{btb}.
However, unlike spectre v2 it exploits return instruction.
While there has been a number of return-based spectre attacks, \retbleed{} is the first one which does not exploit the \ac{rsb} but the \ac{btb} directly.
In an early version of the \retbleed{} paper, a \ac{pf}-based mitigation was introduced.
While it has the advantage that the induced overhead is practically zero, kernel developers apprehended that the mitigation is incomplete and a more in-depth solution is required.
To justify the more elaborate patches, it is required to know if the \ac{pf}-based mitigation is indeed incomplete and for a cost-value estimate it is a necessity to know the overhead of the mitigation.
The \retbleed{} version presented by \todo{retbleed authors} is not only easy to mitigate, but also introduces practically zero-overhead.
Nevertheless, kernel developers mitigate the issue with a rather involved patches which introduce large overheads.
In this paper we want to discuss if the elaborate patches with their huge overheads are justified, or if the simpler mitigation is more appropriate.
\section{Challenges}
\section{Challenges\todo{call research question}}
\label{sec:challenges}
\todo{Rather call it Research Questions?}
% Describe the challenges.
\retbleed{} is mitigated by AMD, Intel and kernel developers via a rather involved set of kernel patches, which introduce a significant overhead.
However, \retbleed{} also mentions a solution which introduces practically zero overhead.
It depends on \ac{pf} raised when the attacker tries to mistrain the \ac{btb}.
They argue that the mitigation is incomplete as the \ac{btb} can be poisoned without causing a \ac{pf}.
\retbleed{} is mitigated by AMD, Intel and kernel developers via a rather involved set of kernel patches.
While the actual overhead is not known, it appears to be rather significant
The solution initially suggested by \retbleed's authors employs \ac{ibpb} on \acp{pf}, which are raised during the poisoning of the \ac{bpu}.
We will refer to this mitigation as \techterm{\ac{ibpb}-on-\ac{pf}}.
It has the clear advantage that the overhead is practically zero as \acp{pf} are never raised during normal execution.
Kernel developers argue that the mitigation is not sufficient as the \ac{btb} can be poisoned without causing a \ac{pf}.
This leads us to our first research question:
\begin{tcolorbox}
\paragraph{Research Question (RS1).}
@ -37,14 +32,6 @@ This leads us to our first research question:
Because the \techterm{\ac{ibpb}-on-\ac{pf}} mitigation for \retbleed{} is said to be incomplete, can we verify that this is true by building a variant of \retbleed{} that does not rely on \acp{pf}?
\end{tcolorbox}
To achieve the first research question, the following challenges have to be accomplished.
\begin{itemize}
\item Reproduce the original \retbleed{} PoC
\item Create a page fault free training primitive for \retbleed.
\end{itemize}
\todo{Rewrite listing of challenges}
After working out whether \techterm{\ac{ibpb}-on-\ac{pf}} is indeed not fully mitigating the issue, we want to gain a better understanding of released patches.
Most notably, what are the overheads and how are they impacted by the underlying microarchitectures?
Therefore, our second research question is:
@ -54,37 +41,22 @@ Therefore, our second research question is:
What is the performance cost for an in-depth \retbleed{} mitigation?
\end{tcolorbox}
For the performance analysis, we need to:
\begin{itemize}
\item Compile patched and unpatched kernel
\item Take benchmark
\end{itemize}
\todo{Rewrite listing of challenges}
\section{Solution}
\label{sec:solution}
% Give a brief overview of your system/mitigation/attack and how it addresses the aforementioned challenges.
To develop a version of \retbleed{} which does no rely on \acs{pf}, we need to modify the training phase where the malicious branch in injected in the \ac{btb}.
To achieve that, we make use of speculative execution of the \techterm{speculation primitive}.
This prevents any \acp{pf} from being raised while still allowing the injection across privilege boundaries.
To answer this first research question, we need to show that both of \retbleed's primitives can be executed without causing \acp{pf}.
For that we make us of the two PoCs provided by \retbleed, namely \textsc{Ret}-\ac{bti} and \ac{cp}-\ac{bti}\cite{retbleedRepo}.
Me make use of speculative \ac{bti} as this way not \acp{pf} can be raised.
To answer our second research question, we need to get insights in to the performance cost of the in-depth \retbleed{} mitigations. For that we run performance benchmarks on them and deduce the overhead by comparing them to the result of the unpatched kernel.
\section{Contributions}
\label{sec:contributions}
The contributions of this paper are the following:
\begin{itemize}
\item We show that speculative \ac{bti} works in the same user space as well as across privilege boundaries for several microarchitectures and condict a basic comparison the non-speculative \ac{bti}.
\item We develop a version of \retbleed{} which does not rely on \acp{pf} and hence, requires in-depth mitigation.
\item We analyze the overhead induced by the in-depth mitigations.
\item We make a cost-benefit analysis of \retbleed{} mitigations.
\end{itemize}
To answer our second research question, we need to get insights in to the performance cost of the in-depth \retbleed{} mitigations.
We benchmark systems of various microarchitectures with \retbleed{} mitigations enabled and disabled and compare the scores.
This allows us to calculate the induced overhead.
\section{Overview}
\label{sec:overview}
% Chapter~\ref{cha:background} describes \dots, Chapter~\ref{cha:design} presents \dots
After this short induction (\autoref{cha:introduction}), the thesis proceeds as follows.
In \autoref{cha:background} we discuss preliminary information, namely memory addressing (\ref{sec:memAddrAndPf}), caches (\ref{sec:cache}) and attacks on them, \aclp{pf} (\ref{sec:pageFault}), speculative execution (\ref{sec:specularExecution}) with a discussion on various \techterm{transient execution attacks}.
Great important is put on \retbleed (\ref{subsubsec:retbleed}).
Great important is put on \retbleed (\ref{subsubsec:retbleed}).\todo{Update overview}
In \autoref{cha:specRetbleed} we try to answer research question one (\ref{para:rs1}) by developing spec \cpbti.
In \autoref{cha:retbleedMitigation} we evaluate the overhead for the in-depth mitigation, to answer our second research question (\ref{para:rs2}).

28
chapters/32-overview.tex
View File

@ -2,17 +2,23 @@
\section{Overview}
\retbleed{} causes the return instruction predictor to stop using the \ac{rsb} but to fall back to the \ac{btb}.
By \ac{bti}, they are able to speculatively steer the return to gadget, which gets executed speculatively.
The aim of the attacker is to leak data across privilege boundaries.
By poisoning the \ac{btb} an attacker is subsequently able to steer the speculative destination of a return instruction executed in kernel space.
This leads to micro-architectural traces which are inferred using a side-channel attack.
\paragraph{Why \aclp{pf}?}
The attacker hijacks the kernel branch by injecting a \ac{btb} entry which gets used by the return instruction predictor.
It will use the destination of the injected entry to as the most likely destination of the branch.
The source of the malicious branch is selected in such a way that it collides with the address of the return instruction which the attacker wants to hijack.
The destination is the address of the gadget.
Due to \ac{smap} and \ac{smep} the kernel cannot execute arbitrary user space code and therefore, the gadget itself must reside in kernel space.
Therefore, the poisonous branch has a source residing in the attacker's user space and the destinations is in kernel space.
I.e. the attacker must do \ac{bti} across privilege boundaries.
As a user is not allowed to jump to an arbitrary location in kernel space, a \ac{pf} is raised and the \ac{pf} handler takes over to inform the user about the privilege boundary contempt.
To achieve that hijacking, the attacker must poison the particular \ac{btb} entry used by the return instruction, to point to the gadget's location.
For that the speculation primitive contains a return whose source collides with the address of the return which we want to hijack, and the destination is the location of the gadget.
Naturally, this causes a \ac{pf} as a jump from userspace to an arbitrary location in kernel space is prohibited.
\paragraph{The Plan.}
As stated in our first research question (\ref{para:rs1}), we want to crate a primitive which does the described \ac{bti} without causing a \acp{pf}.
Our idea is to execute the speculation primitive itself speculatively, as no \acp{pf} can be raised during speculation, but the \ac{bti} should still work\footnote{To our best knowledge this has never been explicitly shown before.}.
This leads us to the development of a speculative version of \cpbti \footnote{Also referred to as \ac{utk} \ac{bti} in the \retbleed{} paper.}.
If it works, what is its performance and success rate and how does it compare to the non-speculative \ac{bti}?
We will discuss the creation of the PoCs for Intel and AMD.
Our idea is to do speculative \ac{bti}, meaning that poisonous branch of the speculation primitive itself executed speculatively.
While the jump is only executed speculatively and is invalid in the sense that it crosses privilege boundaries, it is still picked up by the \ac{btb}.
If speculative \ac{bti} works\footnote{To the best of our knowledge this has never been explicitly shown before.}, the speculatively executed and actually, invalid branch, is picked up by the \ac{btb} without any \acs{pf} being raised.
This leads us to the development of a speculative version of the \cpbti{} PoC\footnote{Also referred to as \ac{utk} \ac{bti} PoC in the \retbleed{} paper.}.
We will discuss the creation of the PoCs for both Intel and AMD.

23
chapters/33-implementation.tex
View File

@ -2,31 +2,29 @@
\section{Implementation}
\label{sec:implementation}
We use the PoCs provided by \retbleed{} as a basis for our PoCs\footnote{We will consider a slightly modified version of the \retbleed{} PoCs where we have done some simplifications / cleanup.}.
But before we tackle the spec \cpbti{} PoC, we want to verify that speculative \ac{bti} actually works in the same privilege domain.
We use the PoCs provided by \retbleed{} as a basis for our PoCs\footnote{We will consider a slightly modified version of the \retbleed{} PoCs where we have done some simplifications.}.
But before we develop a speculative version of the \cpbti{} PoC, we want to verify that speculative \ac{bti} actually works in the same privilege domain.
For that, we modify the \retbti{} PoC to create a version of if, in which the \ac{bti} is done speculatively.
We will refer to it as Spec \retbti.
If we are successfully, we proceed by creating a speculative version of \cpbti{} to see if the speculative \ac{bti} works across privilege domains, as it does with non-speculative \ac{bti}.
If we succeed, we proceed by creating a speculative version of \cpbti{} to see if the speculative \ac{bti} works across privilege domains, as it does with non-speculative \ac{bti}.
\retbleed{} causes the return instruction predictor to fall back to the \ac{btb}.
Both, AMD and Intel fall back to using the \ac{btb} for return instruction in certain causes, though the used methodology to cause that behaviour is vastly different.
Both, AMD and Intel microarchitectures fall back to using the \ac{btb} for return instruction in certain causes, but the cases differ.
For Intel, this is achieved by underflowing the \ac{rsb}, which happens if too many return instructions are encountered in a row.
The mechanism we use to achieve that, we referee to as \techterm{return cycle}.
Besides underflowing the \ac{rsb}, it has in additional the purpose of creating a ``normalized'' branch history.
Besides underflowing the \ac{rsb}, it has the additional the purpose of creating a ``normalized'' branch history.
With that we mean that the \ac{bhb} is set into a known and easily reproducible state.
This is important, since the \ac{btb} is indexed using the \ac{bhb}.
Without a similar branch history, the \ac{bpu} will not use the injected entry during speculation.
To create the \techterm{return cycle}, a memory address holding a return instruction is repeatedly pushed to the stack.
An initial return instruction starts the recursive cycle, and at the end it returns to the address stored on the stack prior to pushing the return address.
This is shown in \autoref{lst:createReturnCycle}.
\autoref{lst:createReturnCycle} shows the used method.
Alternatively, the return cycle can also be creating using a recursive function call.
The length of the return cycle is micro-architecture dependant it turns out that $28$ is optimal for Coffee Lake and $29$ for Coffee Lake Refresh.\cite{retbleed} \todo{is this selected for the rsb or bhb?}
The length of the return cycle is micro-architecture dependent and the authors of \retbleed{} worked out that $28$ cycles is optimal for Coffee Lake and $29$ for Coffee Lake Refresh.\cite{retbleed} \todo{Is this number given by the size of the RSB or coverage of BHB?}
One of the two approaches is used in the \retbleed{} PoCs and we will use them too, without going in-depth into them again.
\begin{lstlisting}[style=CStyle,caption={The address to which we return after the \techterm{return cycle} is pushed to the stack. Next, we creat the \techterm{return cycle} itself by repeatedly pushing the address {\lstinline[basicstyle=\ttfamily]+RET_PATH+} where a return instrution is stored, to the stack. An initial return instruction starts the cycle.},label={lst:createReturnCycle}]
\begin{lstlisting}[style=CStyle,caption={Creation of a \techterm{return cycle}. The address to which we return after the \techterm{return cycle} is pushed to the stack first. Next, the \techterm{return cycle} is created by repeatedly pushing the address \lstinline+RET_PATH+, where a return instruction is stored, to the stack. An initial return instruction starts the cycle.},label={lst:createReturnCycle}]
// Store return instruction to memory location RET_PATH
memcpy((u8*)RET_PATH, "\xc3", 1);
@ -47,4 +45,7 @@ asm(
\end{lstlisting}
%stopzone
AMD CPUs resort back to the \ac{btb} for return instruction in case they collide with a previously encountered indirect branch. \todo{what about the indexing using the BHB?}
AMD CPUs resort back to the \ac{btb} for return instruction in case they collide with a previously encountered indirect branch.
The cycle is also not required for setting up the branch history, as the \ac{btb} does not seem to be indexed using any kind of branch history.
Instead, the \ac{btb} is indexed by the start and end addresses of the branch, which can be thought of as a ``basic block''.
\todo{Is this correctly explained? Better explanation}

77
chapters/34-specRetBti.tex
View File

@ -3,64 +3,65 @@
\subsection{Speculative \retbti}
\label{subsubsec:specRetBti}
We will discuss the design of our speculative version of \retbti{}.
We will discuss the design of the Spec \retbti{} PoC.
The purpose of this PoC is the verify that speculative \ac{bti} works in the same privilege domain.
But before working on spec \retbti{} we will discuss how the plain \retbti{} PoC works.
But before working on Spec \retbti{} we will discuss how the plain \retbti{} PoC works.
\paragraph{\retbti{} in detail.}
\todo{Wrong, should be return not indirect jump in gadget}
After the return cycle, which spins on \verb+TRAIN_PATH+, we get to \verb+BR1+.
Here, the speculation primitive, an indirect jump, is located.
During training, this indirect jump brings us to the \techterm{speculation gadget}, stored at \verb+TRAIN+.
However, in the speculation phase, since the \ac{pc} is the same (=\verb+BR1+) and the history is equivalent, the indirect branch predictor predicts erroneously that the destination is \verb+TRAIN+ instead of \verb+SPEC+.
After the \techterm{return cycle}, which spins on a certain memory location, we get to \verb+BR1+.
Here, the speculation primitive, a return instruction, is located.
During training, this return brings us to the \techterm{speculation gadget}, stored at \verb+TRAIN+.
However, in the speculation phase, since the \ac{pc} is the same (\verb+BR1+ in both cases) and the history is equivalent, thanks to the return cycle, the indirect branch predictor predicts erroneously that the destination is \verb+TRAIN+ instead of \verb+SPEC+.
This causes the \techterm{speculation gadget} to get execution.
These proceeding is depicted in \autoref{fig:retbti}.
\begin{figure}[htp]
\begin{figure}[ht]
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/ret_bti_train}
\caption{The training phase of \retbti{} underflows the \ac{rsb}, brings the \ac{bhb} into a known state and poisons the \ac{btb}.}
\caption{In the training phase, the branch from \lstinline+BR1+ to \lstinline+TRAIN+ is taken up by the \acs{btb}.}
\label{fig:retbtiTrain}
\end{subfigure}
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/ret_bti_spec}
\caption{In the speculation phase of \retbti{}, a \ac{rsb} underflow is caused and the state of the \ac{bhb} is set to one similar to the \ac{bhb} state during training. This cause the \ac{bpu} to mispredict and speculatively execute the attackers gadget, which then leaks arbitrary data. The speculation is indicated in red.}
\caption{When the control flow reaches \lstinline+BR1+ in the speculation phase, the \acs{pc} as well as the branch history are equivalent, and therefore the return instruction predictor will use the \acs{btb} entry leading to \lstinline+TRAIN+, which was injected in the training phase. The speculation is indicated in red.}
\label{fig:retbtiSpec}
\end{subfigure}
\caption{The training phase of \retbti{}, depicted in (a), poisons the \ac{bpu}. This causes the victim to speculate into the gadget, as visible in (b). The architectural branches are black, while the speculatively executed ones are red.}
\caption{Control flow of the \retbti{} PoC for Intel. The training phase poisons the \ac{bpu} is depicted in (a). This causes the victim to mispredict into the gadget, as visible in (b). A \techterm{return cycle} is used in both phases to underflow the \ac{rsb} and normalize branch history.}
\label{fig:retbti}
\end{figure}
As discussed in \autoref{sec:implementation}, no return cycle is needed for AMD.
Therefore, the training phase is equivalent to the one of Intel except that the return cycle was removed.
This inserts a regular entry into the \ac{btb}.
By returning form an address, which collides with \verb+BR1+, call it \verb+BR2+, the return instruction predictor falls back from using the \ac{rsb} to the \ac{btb} and uses the injected entry for its prediction.
As discussed in \autoref{sec:implementation}, no return cycle is needed for AMD as the \ac{rsb} fallback is caused by an address collision and the branch history is also not needed for indexing the \ac{btb}.
Therefore, the primitive form Intel is adapted as follows.
The return cycles are removed.
The return from \verb+BR1+ to \verb+TRAIN+ is replaced by an indirect jump.
This is already sufficient to poison the \ac{btb} and hijack any return instruction located at \verb+BR2+, which collides with \verb+BR1+.
\todo{Add schematic for AMD?}
\paragraph{Spec \retbti.}
For the speculative version, we want that the indirect jump from \verb+BR1+ to \verb+TRAIN+ is not executed architecturally but only speculatively.
For the speculative version, we want that the return from \verb+BR1+ to \verb+TRAIN+ is not executed architecturally but only speculatively.
As in the non-speculative version, the return cycle brings us to \verb+BR1+.
To cause a speculation during which the speculation primitive can be executed, we exploit the return instruction predictor.
From \verb+BR1+ we call the ``rogue'' function located at \verb+ROGUE+, which rewriting the stack such that when returning, we return to \verb+END+ instead of getting back to \verb+BR1+.
To cause a speculation window during which the primitive can be executed, we exploit the return instruction predictor using SpectreRSB\cite{spectreRsb}, as explained in \autoref{subsubsec:spectreRsb}.
From \verb+BR1+ we call the ``rogue'' function located at \verb+ROGUE+.
We change the return address such that it returns to \verb+END+ instead of getting back to \verb+BR1+.
We increment the \verb+rsp+ by $8$, to let it skip the actual return address and point it to a location which we have pushed to the stack prior to calling \verb+ROGUE+.
As discussed in \autoref{subsubsec:funcReturnPrediction}, the return instruction predictor will predict that the function returns back to \verb+BR1+ and therefore, speculatively execute the indirect jump, which does the poisoning.
To make the speculation window large enough for the indirect jump to fully execute, we use the \verb+clflush+ instruction remove the actual return address, appointed by the \verb+rsp+, from all layers of the cache, as visible in the rogue function in \autoref{lst:roguePrimitive}.
This way, the CPU has to fetch it from memory, incurring a delay.
To make the speculation window large enough for the indirect jump to fully execute, we use the \verb+clflush+ instruction remove the actual return address, appointed by the \verb+rsp+, from all layers of the cache.
This way, the CPU has to fetch it from memory, incurring a larger delay.
To make the indirect jump at \verb+BR1+ speculatively take the branch to \verb+TRAIN+ during the speculation phase, three things must be fulfilled.
First and foremost, the branch to \verb+TRAIN+ must have been injected, what we have done in the training phase.
To make the \ac{btb} indexing work, not only must the \ac{pc} be equal, but the branch history must be ``similar enough'' too.
First and foremost, the branch to \verb+TRAIN+ must have been injected. This we have done in the training phase.
Secondly, the \ac{pc} of the return instruction which we want to hijack must be the same as during training.
And lastly, the branch history at the time branch must be the same.
This means that during the training phase we must retain the rogue function, however without it modifying the stack and causing any speculation, and importantly, without it introducing any branches.
We were able to implement that part oft the \techterm{speculation primitive} using the \verb+cmove+ instruction.
It allows us to modify the stack depending on whether we are in the training or speculation phase, indicated by the state of some register.
The rogue function is displayed in \autoref{lst:roguePrimitive} and the control flow of both, training and speculation phase are in \autoref{fig:retbti}.
When returning to \verb+BR1+ from the rogue function, the \verb+PC+ and \ac{bhb} are equal to the training phase and therefore, the predictor will use the malicious entry erroneously guide the indirect jump to the gadget at \verb+TRAIN+.
The whole procedure is visualized in \autoref{fig:specRetbti}.
\begin{lstlisting}[style=CStyle,caption={Rogue function using \texttt{cmove} to conditionally overwrit the stack. This has the effect that the branch history of the training and speculation are equivalent.},label={lst:roguePrimitive}]
\begin{lstlisting}[style=CStyle,caption={Rogue function which causes a speculation window by employing SpectreRSB\cite{spectreRsb}. To maintain a consistant branch history for training and speculation phase, this function must be executed in both phases. Depending on the state of \lstinline+rsi+ the \lstinline+cmove+ instruction increments the \lstinline+rsp+ by $8$, skipping the actual return address. The speculation window is enlarged by using the \lstinline+clflush+ instruction.},label={lst:roguePrimitive}]
asm(
".align 0x80000\n\t"
"rogue_spec_dst:\n\t"
@ -83,23 +84,25 @@ asm(
);
\end{lstlisting}
\begin{figure}[htp]
\begin{figure}[ht]
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/ret_spec_bti_train}
\caption{After underflowing the \ac{rsb} and setting the \ac{bhb} into a know state, the \techterm{return instruction predictor} is exploited to cause a speculation. That speculation window is used to poison the \ac{btb} with a malicious entry. This completes the training phase of spec-\retbti.}
\incfig[0.75]{../figures/ret_spec_bti_train}
\caption{Depicts the training phase. A rogue function, located at \lstinline+ROGUE+, causes a speculation window. It allows the speculative execution of the poisonous return from \lstinline+BR1+ to \lstinline+TRAIN+.}
\label{fig:specRetbtiTrain}
\end{subfigure}
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/ret_spec_bti_spec}
\caption{The conditional overwritting of the stack in the rogue function leads to an perfect equivalent history between training and speculation phase. The injection during the training is successful and we are able to speculate to the gadget.}
\incfig[0.75]{../figures/ret_spec_bti_spec}
\caption{To make sure that histories are equivalent, the rogue function is also executed during the speculation phase. But in contrast to the training phase, no speculation window is created. After returning from the rogue function, the return instruction is mispredicted using the injected entry pointing to \lstinline+TRAIN+.}
\label{fig:specRetbtiSpec}
\end{subfigure}
\caption{During the training phase of spec \retbti{}, depictec in (a), a malicious branch is injected into the \ac{btb}. Even while only executed speculatively, the poisoning leads to the speculative execution of the gadgat, as visible in (b). Speculatively executed branches are indicated in red while the architectural branches are black.}
\caption{Control flow of the Spec \retbti{} PoC for Intel. During the training phase, depicted in (a), a speculatively executed return poisons the \ac{btb}. The speculative \ac{bti} leads to the hijacking of a return instruction, as visible in (b). Speculatively executed branches are indicated in red while the architectural branches are black.}
\label{fig:specRetbti}
\end{figure}
The AMD version uses the same primitive as the Intel version, with the difference that the return instruction in the training phases is located on \verb+BR2+, which collides with \verb+BR1+.
Adapting \retbti{} PoC for AMD is more simple than for Intel, as the branch history is not relevant for indexing into the \ac{btb}.
While the speculation phase of Spec \retbti{} remains unchanged, we add a rogue function to the training phase.
The function differs from the one for Intel in the way that it does not conditionally overwrite the \verb+rsb+, but speculation is cased every time.
\todo{Add schematic for AMD?}
We comment on the results of this PoC later in \autoref{sec:evaluation} and \ref{sec:discussion}.

86
chapters/35-specCpBti.tex
View File

@ -1,83 +1,81 @@
% !TEX root = ../thesis.tex
\subsection{Speculative \cpbti}
\label{subsubsec:specCpBti}
The development of the speculative version of \cpbti{} is of main interest to as, if successful, it helps us to answer the first research question (\ref{para:rs1}). To familiarize ourselves with the latter, we will have a look at the plain \cpbti{} PoC before discussing the design of the speculative variant.
The development of the speculative version of \cpbti{} is of main interest to us.
It shows if Spec \ac{bti} works across privilege boundaries and therefore demonstrates if \retbleed's primitives can be implemented without raining any \acp{pf}.
A successful implementation of Spec \cpbti{} implies a positive answer to our first research question (\ref{para:rs1}).
We were not able to get the spec \cpbti{} version to work for AMD. Therefore, we will not discuss it in the following.
These PoCs consist of a user space program and a kernel module.
The user space program is the attacker who poisons the \ac{btb} across privilege domain to hijack a return branch executed by the kernel.
The kernel modes servers providing the \techterm{speculation primitive} and \techterm{speculation gadget} at predetermined and optimal\footnote{In the way that we can easily find a colliding branch.} locations.
Before discussing the speculative variant, we will have a look at the plain \cpbti{} PoC to set foundation on which we can build on.
\paragraph{\cpbti{} in detail.}
The \cpbti{} PoC consists of a userspace program and a kernel module.
The kernel modes servers the purpose of providing the \techterm{speculation primitive} and \techterm{speculation gadget} at predetermined locations.
Similarly to the \retbti{}, a return cycle is setup to spin on \verb+RET1+ and returns to \verb+KBR_DST+ after the final return instruction.
\verb+KBR_DST+ is the location of the speculation gadget and it is stored in the kernel space.
Since a jump to an arbitrary location in kernel space is prohibited, the \ac{pf} handler takes over, raises a \ac{pf} and jumps back to user space.
Similarly to the \retbti{}, a return cycle is set up to spin on \verb+KBR_SRC'+ and returns to \verb+KBR_DST+ after the final return instruction.
\verb+KBR_DST+ is the location of the speculation gadget, and it is stored in the kernel space.
Since a jump to an arbitrary location in kernel space is prohibited, the \ac{pf} handler takes over, raises a \ac{pf} and informs the user.
Even if the branch to the gadget was not successful, it has still influenced the \ac{btb} by injecting an entry.
\autoref{fig:cpBtiTrain} shows the described training phase, while \autoref{fig:cpBtiSpec} depicts the speculation phase, which we will discuss next.
To make use of the poisoned \ac{bpu}, we first jump to the speculation primitive in kernel space.
To build up the return cycle, a recursive function is used, as described in \autoref{sec:implementation}. \todo{why do we use a recursive function here?}
The return cycle has a length of $30$ entries and spins on \verb+KBR_SRC+.
One key difference to the \retbti{} PoC is that the address from where we inject the malicious branch and the address from where we want the misprediction to happen, are different.
Namely, in the training phase it is \verb+RET1+ which resides in user space, while in the speculation phase it is \verb+KBR_SRC+.
For this to work, \verb+RET1+ has to be selected such that it collides with \verb+KBR_SRC+ in the \ac{btb}. \todo{ellaborate. is this even correct?}
To make use of the poisoned \ac{btb}, control must be handed over to the kernel, which starts executing the \techterm{return cycle} located at \verb+KBR_SRC+.
Similarly, as with the \retbti{} PoC for AMD, the source of the branch to be hijacked and the source from where the poisoning is done differ.
To make the hijacking works, \verb+KBR_SRC'+ is selected in such a way that it collides with \verb+KBR_SRC+.
Therefore, as the \acp{pc} collide and the histories are similar, the \ac{bpu} will use the malicious entry for its prediction, guiding the control flow to \verb+KBR_DST+.
Since the \acp{pc} collide and the histories are similar, the \ac{bpu} will use the malicious entry for its prediction, guiding the controlflow to the gadget at \verb+KBR_DST+.
The version for AMD only differs in the way that no return cycle is used.
\begin{figure}[htp]
\begin{figure}[ht]
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/cp_bti_train}
\caption{While a jump from userspace to kernel space is forbidden and caught by the \ac{pf} handler, it still recorded by the \ac{btb}.}
\incfig[0.75]{../figures/cp_bti_train}
\caption{While a jump from userspace to kernel space is forbidden and caught by the \ac{pf} handler, indicated in blue, it still recorded by the \ac{btb}. This way, a branch from \lstinline+KBR_SRC'+ to \lstinline+KBR_DST+ in injected in the training phase.}
\label{fig:cpBtiTrain}
\end{subfigure}
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/cp_bti_spec}
\caption{A recursive call creates the return cycle. The final return speculates into the gadget, which was injected from user space during the training phase. The speculation is indicated in red.}
\incfig[0.75]{../figures/cp_bti_spec}
\caption{The injected branch, whose source \lstinline+KBR_SRC'+ is selected in such a way that is collides with \lstinline+KBR_SRC+, leads to a misspeculation even when injected from a different privilege domain. The speculation is indicated in red.}
\label{fig:cpBtiSpec}
\end{subfigure}
\caption{Schematic of \cpbti. A jump to an arbitrary kernel address from userspace results in a \ac{pf}, as shown in (a). But, as visible in (b), such branches are still recorded by the \ac{btb}, and can be exploited by attackers.}
\caption{Control flow of \cpbti{} for Intel. A jump to an arbitrary kernel address from userspace results in a \ac{pf}, as shown in (a). However, it is still taken up by the \ac{btb} and can lead to misprediction across privilege boundaries, as shown in (b). \lstinline+KBR_SRC'+ is selected such that it collides with \lstinline+KBR_SRC+.}
\label{fig:cpBti}
\end{figure}
\todo{AMD Version}
\paragraph{Spec \cpbti.}
Similarly, as for spec \retbti{}, we want to inject the branch to the gadget speculatively.
At first, a recursive function call is used to create the return cycle.
In contrast to the non-speculative version, the final return does not do the injection itself, but it jumps to \todo{location}, where we use a rogue function, similar to the one of spec \retbti{} to cause a speculation.
By modifying the stack, the function changes the architectural path to go to \verb+END+ when executing the return.
However, the return instruction predictor predicts that the function returns to \todo{location}, from where a return instruction injects the \ac{btb} entry with a target of \verb+KBR_DST+.
Similarly, as for Spec \retbti{}, we want to modify the \cpbti{} PoC, such that the \ac{bti} is done speculatively.
In contrast to the non-speculative version, the final return does not do the injection itself, but it brings us to \verb+KBR_SRC'+, which collides with address \verb+KBR_SRC+ of the branch we want to inject a target for.
As the branch from \verb+KBR_SRC'+ to \verb+KBR_DST+ should be executed speculative, we create a speculation window.
This is done by the function at \verb+ROGUE+ which employs SpectreRSB\cite{spectreRsb} to exploit the return instruction predictor and cause a speculative return to \verb+KBR_SRC'+.
From here a return instruction injects the \ac{btb} entry with a target of \verb+KBR_DST+.
While this branch is invalid as it crosses privilege boundaries, due to being executed speculatively, \textbf{no \ac{pf} is raised}.
And even though it was executed only speculatively, the branch has still been recorded by the \ac{btb}.
This process is visualized in \autoref{fig:specCpBtiTrain}.
The rogue function is much simpler for spec \cpbti{} compared to spec \retbti{} as two different functions are executed for the training and speculation phase.
The rogue function is simpler for Spec \cpbti{} than for Spec \retbti{} as it causes a speculation window in any case.
After having seed how the \ac{btb} can be poisoned from userspace without causing any \acp{pf}, we will discuss next, how can possible lead to the leakage of data from kernel space.
We start with a jump to kernel space, where a recursive function build a return cycle of length $30$.
After initiating the cycle, it spins on \verb+KBR_SRC+, which, as in the non-speculative case, collides with \verb+RET1+.
The key challenge is to make the branch history during the speculation phase similar enough to the training phase, such that the injected \ac{btb} entry is used.
Again, we make use of the ``dummy'' function \verb+FAKE_ROGUE+ whose sole purpose is to compensate for the branches introduced by the rogue function.
After that function returns, we are at \todo{location}, which collides with \todo{location} from where we have injected the \ac{btb} entry.
As the \acp{pc} are colliding and the histories are similar, the malicious \ac{btb} entry is used to predict the destination of the return.
After having seed how the \ac{btb} can be poisoned from user space without causing any \acp{pf}, we will discuss next, how the injected \ac{btb} entry can impact the control flow of the kernel module.
After switching to the kernel module and executing the return cycle, \verb+KBR_DST+ is reached.
To make the branch history similar to history of the training phase, we need to mimic the branches introduced by the rogue function.
This is done by the ``dummy'' function \verb+FAKE_ROGUE+ which does nothing but just returns back to \verb+KBR_SRC+ where a return instruction is executed next.
Since the return instruction predictor has fallen back to the \ac{btb}, the \ac{pc} collides with the source of the injected branch, and the history is similar to the one during injection, the injected \ac{btb} entry will be used for the branch prediction.
Therefore, the gadget stored at \verb+KBR_DST+ is executed speculatively.
The training phase is visible in \autoref{fig:specCpBtiSpec}.
\begin{figure}[htp]
We have developed a Spec \cpbti{} version for AMD too.
It is equivalent to the version of Intel, with the return cycle and fake rogue function removed.
\begin{figure}[ht]
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/cp_spec_bti_train}
\caption{By rewriting the stack, speculation is caused, which can be used to poison the \ac{bpu}. No \ac{pf} is raised due to the speculative execution.}
\incfig[0.75]{../figures/cp_spec_bti_train}
\caption{Depicts the training phase. The rogue function \lstinline+ROGUE+ causes a speculation window. it allows the speculative execution of the poisonous return from \lstinline+KBR_SRC'+ to \lstinline+KBR_DST+. While this branch crosses privilege boundaries, no \ac{pf} is raised due to the speculative execution.}
\label{fig:specCpBtiTrain}
\end{subfigure}
\begin{subfigure}{\textwidth}
\centering
\incfig{../figures/cp_spec_bti_spec}
\caption{The make the branch history as similar as possible to the training phase, the return cackle is followed by a ``dummy'' function which mimics the rogue function from the training phase. This way we are able to observe a speculation to the gadget.}
\caption{The make the branch history as similar to the training phase, a ``dummy'' function mimics the rogue function from the training phase. The injected \ac{btb} entry is use to predict the target of the subsequent return, causing a speculative execution of \lstinline+KBR_DST+.}
\label{fig:specCpBtiSpec}
\end{subfigure}
\caption{In the training phase, shown in (a), a malicious branch in injected into the \ac{btb} while speculating. This prevents any \ac{pf} from being raised due to privilege restrains. The poisonous branch is recorded across privilege domain and can be used to speculate into the gadget, in (b). architectural branches are black while speculatively executed ones are drawn in red.}
\caption{Control flow of \cpbti{} for Intel. In the training phase, shown in (a), speculative \ac{bti} is employed to hijack a return instruction executed in kernel space, shown in (b). Address \lstinline+KBR_SRC'+ is selected such that it collides with \lstinline+KBR_SRC+. Architectural branches are black while speculatively executed ones are drawn in red.}
\label{fig:specCpBti}
\end{figure}

271
figures/cp_bti_spec.svg
View File

@ -2,12 +2,12 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="66.186012mm"
width="60.222492mm"
height="21.7964mm"
viewBox="0 0 66.186015 21.7964"
viewBox="0 0 60.222495 21.7964"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="cp_bti_spec.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
@ -26,10 +26,10 @@
showgrid="true"
showborder="true"
inkscape:zoom="9.2293236"
inkscape:cx="121.94827"
inkscape:cy="54.446027"
inkscape:cx="116.8558"
inkscape:cy="54.554377"
inkscape:window-width="3836"
inkscape:window-height="1038"
inkscape:window-height="2082"
inkscape:window-x="0"
inkscape:window-y="34"
inkscape:window-maximized="1"
@ -41,30 +41,11 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.06726"
originy="-9.1329477" />
originx="250.06728"
originy="-9.1329484" />
</sodipodi:namedview>
<defs
id="defs2">
<marker
style="overflow:visible"
id="marker30479"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477" />
</marker>
<inkscape:path-effect
effect="bspline"
id="path-effect23711"
@ -213,44 +194,6 @@
apply_no_weight="true"
apply_with_weight="true"
only_selected="false" />
<marker
style="overflow:visible"
id="marker30479-8"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477-4" />
</marker>
<marker
style="overflow:visible"
id="marker30479-8-0"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477-4-3" />
</marker>
<inkscape:path-effect
effect="bspline"
id="path-effect18450-6"
@ -449,65 +392,6 @@
inkscape:original-d="m -250,10 c 6.66698,3.333597 13.33371,6.666932 20.00016,10"
inkscape:path-effect="#path-effect20560"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#ff0000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-9-2)"
d="m -209.99987,20 c 6.66694,0 13.33362,0 20.00003,0"
id="path20556-0-9"
inkscape:original-d="m -209.99987,20 c 6.66694,2.65e-4 13.33362,2.65e-4 20.00003,0"
inkscape:path-effect="#path-effect20560-6-8"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-219.99985"
y="22.5"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-219.99985"
y="22.5"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-202.49985"
y="27.5"
id="text30881-9-0-6"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-202.49985"
y="27.5"
id="tspan30987-0">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-199.99985"
y="22.5"
id="text30881-9-0-6-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-199.99985"
y="22.5"
id="tspan30987-0-6">ret</tspan></text>
<g
id="g1010"
transform="matrix(1,0,0,-1,1.6e-4,30)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -230,10 c 8.04676,-5.0249313 -3.75991,-9.68513516 -2.42136,-2.4805849"
id="path37486"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479-8)"
d="m -230,10 c 11.30858,-5.160651 -4.80013,-13.1224352 -3.64542,-3.7814467"
id="path37486-5"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479-8-0)"
d="m -230,10 c 15.14429,-7.5 -5.26352,-16.6120804 -4.64086,-5.8303655"
id="path37486-5-6"
sodipodi:nodetypes="cc" />
</g>
<g
id="g1010-7"
transform="matrix(1,0,0,-1,20.00016,30)">
@ -527,17 +411,6 @@
id="path37486-5-6-3"
sodipodi:nodetypes="cc" />
</g>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-187.96768"
y="12.575636"
id="text30881-9-1-4-5-3"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-187.96768"
y="12.575636">END</tspan></text>
<path
style="fill:none;stroke:#ff6600;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:0.793749, 0.793749;stroke-dashoffset:0;stroke-opacity:1"
d="m -249.99987,15 h 60"
@ -570,65 +443,83 @@
id="path20556-3"
inkscape:original-d="m -229.99984,20 c 6.66693,2.65e-4 13.3336,2.65e-4 20,0"
inkscape:path-effect="#path-effect20560-75" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225.13779"
y="29.9646"
id="text1481"><tspan
sodipodi:role="line"
id="tspan1479"
x="-225.13779"
y="29.9646"
style="stroke-width:0.264583">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-240.13779"
y="14.399414"
id="text1481-6"><tspan
sodipodi:role="line"
id="tspan1479-2"
x="-240.13779"
y="14.399414"
style="stroke-width:0.264583">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-232.74521"
y="17.5"
id="text1617"><tspan
sodipodi:role="line"
id="tspan1615"
x="-232.74521"
y="17.5"
style="stroke-width:0.264583">RET2</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-217.49985"
y="17.5"
id="text1621"><tspan
sodipodi:role="line"
id="tspan1619"
x="-217.49985"
y="17.5"
style="stroke-width:0.264583">KBR\_SRC</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99985"
y="22.5"
id="text1625"><tspan
sodipodi:role="line"
id="tspan1623"
x="-189.99985"
y="22.5"
style="text-align:center;text-anchor:middle;stroke-width:0.264583">KBR\_DST</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -209.99984,20 c 10,0 10,-10.0000001 20,-10.0000001"
id="path1073"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99982"
y="19.470833"
id="text26369"><tspan
sodipodi:role="line"
id="tspan26367"
style="stroke-width:0.264583"
x="-219.99982"
y="19.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-204.47066"
y="28.558334"
id="text26373"><tspan
sodipodi:role="line"
id="tspan26371"
style="stroke-width:0.264583"
x="-204.47066"
y="28.558334">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-201.66855"
y="18.906265"
id="text26377"><tspan
sodipodi:role="line"
id="tspan26375"
style="stroke-width:0.264583"
x="-201.66855"
y="18.906265">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99982"
y="12.5"
id="text26381"><tspan
sodipodi:role="line"
id="tspan26379"
style="stroke-width:0.264583"
x="-189.99982"
y="12.5">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99982"
y="22.5"
id="text26385"><tspan
sodipodi:role="line"
id="tspan26383"
style="stroke-width:0.264583"
x="-189.99982"
y="22.5">KBR\_DST</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99982"
y="18.558334"
id="text26389"><tspan
sodipodi:role="line"
id="tspan26387"
style="stroke-width:0.264583"
x="-209.99982"
y="18.558334">KBR\_SRC</tspan></text>
<path
style="fill:none;stroke:#ff0000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-9-2)"
d="m -209.99987,20 c 6.66694,0 13.33362,0 20.00003,0"
id="path20556-0-9"
inkscape:original-d="m -209.99987,20 c 6.66694,2.65e-4 13.33362,2.65e-4 20.00003,0"
inkscape:path-effect="#path-effect20560-6-8"
sodipodi:nodetypes="cc" />
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 21 KiB

After

Width:  |  Height:  |  Size: 17 KiB

291
figures/cp_bti_train.svg
View File

@ -2,13 +2,13 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="65.03981mm"
height="24.844971mm"
viewBox="0 0 65.039812 24.844971"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
sodipodi:docname="cp_bti_train.svg"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
id="svg5"
version="1.1"
viewBox="0 0 60.491456 24.018948"
height="24.018948mm"
width="60.491455mm"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
@ -25,13 +25,13 @@
inkscape:document-units="mm"
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="124.95945"
inkscape:cy="60.60265"
inkscape:zoom="11.771818"
inkscape:cx="86.775042"
inkscape:cy="65.537881"
inkscape:window-width="3836"
inkscape:window-height="1038"
inkscape:window-height="2082"
inkscape:window-x="0"
inkscape:window-y="1076"
inkscape:window-y="34"
inkscape:window-maximized="1"
inkscape:current-layer="layer1">
<inkscape:grid
@ -41,17 +41,37 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.00017"
originy="1.755371" />
originx="250.00018"
originy="0.92934723" />
</sodipodi:namedview>
<defs
id="defs2">
<inkscape:path-effect
effect="bend_path"
id="path-effect34505"
is_visible="true"
lpeversion="1"
bendpath="M -189.99983,9.9999999 C -200.04189,22.522909 -224.99983,15 -224.99983,15"
prop_scale="1"
scale_y_rel="false"
vertical="false"
hide_knot="false" />
<inkscape:path-effect
effect="bend_path"
id="path-effect34342"
is_visible="true"
lpeversion="1"
bendpath="m -224.99983,15 35,-5.0000001"
prop_scale="1"
scale_y_rel="false"
vertical="false"
hide_knot="false" />
<marker
style="overflow:visible"
id="marker30479"
refX="0"
refY="0"
orient="auto-start-reverse"
refX="2"
refY="-0.5"
orient="-45"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
@ -191,24 +211,6 @@
apply_no_weight="true"
apply_with_weight="true"
only_selected="false" />
<marker
style="overflow:visible"
id="TriangleStart-9-2"
refX="3"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5"
markerHeight="5.7803469"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:0.5pt"
d="M 2.885,0 -1.44,2.5 v -5 z"
id="path135-3-2" />
</marker>
<inkscape:path-effect
effect="bspline"
id="path-effect20560-6-8"
@ -362,7 +364,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,1.7553711)">
transform="translate(250,0.92934727)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -250,10 c 6.66693,0 13.3336,0 20,0"
@ -380,73 +382,11 @@
inkscape:path-effect="#path-effect20560" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-9)"
d="m -230,10 c 3.33365,3.333598 6.66703,6.666931 10.00015,10"
d="m -230,10 c 6.66705,3.333493 13.33377,6.666825 20.00018,10"
id="path20556-0"
inkscape:original-d="m -230,10 c 3.33365,3.333597 6.66703,6.666932 10.00015,10"
inkscape:original-d="m -230,10 c 6.66699,3.333598 13.33372,6.666931 20.00018,10"
inkscape:path-effect="#path-effect20560-6"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-9-2)"
d="M -209.99987,20 C -203.33314,16.666613 -196.66652,13.333281 -190,10"
id="path20556-0-9"
inkscape:original-d="M -209.99987,20 C -203.33298,16.666932 -196.66636,13.333597 -190,10"
inkscape:path-effect="#path-effect20560-6-8"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-232.49986"
y="12.5"
id="text30881"><tspan
sodipodi:role="line"
id="tspan30879"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-232.49986"
y="12.5">RET1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-223.91064"
y="13.98561"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-223.91064"
y="13.98561"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-200.85574"
y="14.025313"
id="text30881-9-0-2"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-200.85574"
y="14.025313"
id="tspan32570">pf</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="text30881-9-0-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="tspan30987-7">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="text30881-9-0-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="tspan30987-9">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -230,10 c 8.04676,-5.0249313 -3.75991,-9.68513516 -2.42136,-2.4805849"
@ -462,32 +402,10 @@
d="m -230,10 c 15.14429,-7.5 -5.26352,-16.6120804 -4.64086,-5.8303655"
id="path37486-5-6"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-187.49986"
y="12.5"
id="text30881-9-1-4-5-3"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-187.49986"
y="12.5">END</tspan></text>
<path
style="fill:none;stroke:#ff6600;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:0.793749, 0.793749;stroke-dashoffset:0;stroke-opacity:1"
d="m -249.99987,15 h 60"
id="path556" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-224.99985"
y="22.5"
id="text2149"><tspan
sodipodi:role="line"
id="tspan2147"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-224.99985"
y="22.5">KBR\_DST</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#ff6600;stroke-width:0.264583"
@ -502,34 +420,133 @@
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#ff6600;stroke-width:0.264583"
x="-250.24522"
x="-250.21712"
y="17.4646"
id="text4364"><tspan
id="text4356-7"><tspan
sodipodi:role="line"
id="tspan4362"
style="fill:#ff6600;stroke-width:0.264583"
x="-250.24522"
y="17.4646">Kernel</tspan></text>
x="-250.21712"
y="17.4646"
id="tspan4358-3">Kernel</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#ff6600;stroke-width:0.264583"
x="-247.71712"
y="-27.5354"
id="text4356-8"
transform="scale(1,-1)"><tspan
sodipodi:role="line"
style="fill:#ff6600;stroke-width:0.264583"
x="-247.71712"
y="-27.5354"
id="tspan4358-9" /></text>
<g
aria-label=""
id="text7675"
style="font-size:2.5px;line-height:1;letter-spacing:0px;word-spacing:0px;stroke-width:0.115314"
transform="matrix(2.2944639,0,0,2.2944639,311.63271,-28.315135)">
style="font-size:2.5px;line-height:1;letter-spacing:0px;word-spacing:0px;fill:#ff8a00;fill-opacity:1;stroke-width:0.115314"
transform="matrix(2.2944639,0,0,2.2944639,309.16236,-27.075163)">
<path
d="m -231.26572,18.615723 q 0.0256,0.0293 0.01,0.06348 l -0.75317,1.61377 q -0.0183,0.03418 -0.0586,0.03418 -0.004,0 -0.011,-0.0012 -0.006,-0.0012 -0.009,-0.0012 -0.0232,-0.0073 -0.0354,-0.02686 -0.011,-0.01953 -0.006,-0.0415 l 0.27465,-1.12793 -0.5664,0.141602 q -0.006,0 -0.0171,0 -0.0256,0 -0.0427,-0.01465 -0.0244,-0.01953 -0.0183,-0.05371 l 0.28077,-1.152344 q 0.0122,-0.04395 0.061,-0.04395 h 0.45776 q 0.0269,0 0.0439,0.01709 0.0183,0.01709 0.0183,0.0415 0,0.0098 -0.006,0.02441 l -0.23926,0.646973 0.55298,-0.136719 q 10e-4,0 0.007,-0.0012 0.006,-0.0012 0.01,-0.0012 0.0256,0 0.0464,0.01953 z"
id="path399"
style="stroke-width:0.115314" />
style="fill:#ff8a00;fill-opacity:1;stroke-width:0.115314" />
</g>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-215.24521"
y="21.9104"
id="text602"><tspan
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99982"
y="22.5"
id="text9565"><tspan
sodipodi:role="line"
id="tspan600"
x="-215.24521"
y="21.9104"
style="stroke-width:0.264583">PF\_HANDLER</tspan></text>
id="tspan9563"
style="stroke-width:0.264583"
x="-209.99982"
y="22.5">KBR\_DST</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-224.69772"
y="1.9354329"
id="text9589"><tspan
sodipodi:role="line"
id="tspan9587"
style="stroke-width:0.264583"
x="-224.69772"
y="1.9354329">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-239.99983"
y="9.4708338"
id="text9593"><tspan
sodipodi:role="line"
id="tspan9591"
style="stroke-width:0.264583"
x="-239.99983"
y="9.4708338">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-220.93121"
y="14.255371"
id="text9597"><tspan
sodipodi:role="line"
id="tspan9595"
style="stroke-width:0.264583"
x="-220.93121"
y="14.255371">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99983"
y="9.4708338"
id="text9605"><tspan
sodipodi:role="line"
id="tspan9603"
style="stroke-width:0.264583"
x="-189.99983"
y="9.4708338">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-210.24519"
y="22.4646"
id="text22133"><tspan
sodipodi:role="line"
id="tspan22131"
style="stroke-width:0.264583"
x="-210.24519"
y="22.4646" /></text>
<path
style="fill:none;fill-opacity:1;stroke:#008080;stroke-width:0.323705;stroke-dasharray:none;marker-start:url(#marker30479);paint-order:stroke fill markers;stop-color:#000000"
d="m -189.94364,9.929469 c -0.0972,0.469851 -0.40667,0.790654 -0.85303,0.95462 -0.44581,0.163765 -0.6915,0.497762 -0.86822,0.940357 -0.17696,0.443214 -0.58824,0.639456 -1.04675,0.738566 -0.45831,0.09906 -0.7042,0.463383 -0.95462,0.865675 -0.25062,0.402625 -0.72911,0.464624 -1.18861,0.515677 -0.45923,0.05086 -0.71795,0.452064 -1.03257,0.799116 -0.31422,0.346817 -0.8275,0.276974 -1.27937,0.296212 -0.45156,0.01908 -0.73561,0.453279 -1.10047,0.730484 -0.36397,0.276682 -0.88287,0.08793 -1.32103,0.08988 -0.0556,2.61e-4 -0.10896,0.0076 -0.16072,0.02067 -0.36067,0.09091 -0.64869,0.461112 -0.99387,0.634218 -0.39516,0.198065 -0.89677,-0.08317 -1.3288,-0.08095 -0.43242,0.0023 -0.78358,0.465544 -1.19993,0.587091 -0.41674,0.12161 -0.89585,-0.228589 -1.32244,-0.215859 -0.42657,0.01273 -0.8129,0.468438 -1.24104,0.513677 -0.42812,0.04523 -0.88157,-0.348372 -1.30704,-0.318013 -0.42546,0.03036 -0.84266,0.460811 -1.27361,0.432768 -0.43095,-0.02804 -0.8592,-0.438435 -1.28672,-0.386333 -0.42753,0.0521 -0.8674,0.439338 -1.29405,0.344061 -0.0869,-0.01942 -0.1732,-0.05157 -0.25907,-0.08981 -0.33585,-0.149508 -0.66267,-0.391394 -1.006,-0.332206 -0.43176,0.07453 -0.88678,0.402397 -1.30475,0.246779 -0.4189,-0.156076 -0.81049,-0.528063 -1.2487,-0.434896 -0.4378,0.09321 -0.90131,0.346931 -1.30808,0.13771 -0.40713,-0.209246 -0.79071,-0.535773 -1.23735,-0.429317 -0.44712,0.106418 -0.91024,0.272375 -1.30304,0.01914 -0.39311,-0.253245 -0.77634,-0.52091 -1.23185,-0.408395 -0.36868,0.09093 -0.73493,0.15342 -1.06212,0.02275 -0.0777,-0.03105 -0.15324,-0.07301 -0.22586,-0.12807 -0.37835,-0.286876 -0.76893,-0.486421 -1.23213,-0.377276 -0.46332,0.109175 -0.90033,0.07435 -1.2631,-0.23825 -0.0656,-0.05651 -0.1325,-0.107082 -0.2009,-0.151472 0,0 0,0 0,0 -0.24809,-0.160998 -0.51491,-0.240365 -0.80886,-0.228464 0,0 0,0 0,0 -0.0732,0.003 -0.14805,0.0116 -0.22494,0.02584"
title="t sin(15*t)"
id="path31313-2"
inkscape:path-effect="#path-effect34505"
inkscape:original-d="m -213.59585,0.08686745 c 0.4746,-0.21509698 0.94965,-0.19240585 1.42425,0.0214683 0.4746,0.21387437 0.94965,0.1459921 1.42426,-0.06415466 0.4746,-0.21014066 0.94964,-0.09786568 1.42425,0.10608477 0.4746,0.20395022 0.94965,0.0485934 1.42425,-0.14676938 0.47461,-0.19536791 0.94921,0.00125072 1.42426,0.18573701 0.47461,0.18448846 0.9492,-0.0510794 1.42425,-0.22252957 0.47461,-0.17145025 0.94921,0.10031123 1.42426,0.2567104 0.4746,0.15640062 0.94921,-0.1483619 1.42425,-0.28787997 0.47461,-0.13951844 0.94921,0.19467716 1.42381,0.31567557 0.47505,0.12099975 0.94966,-0.23870684 1.42426,-0.33977238 0.47504,-0.10106161 0.94965,0.27994314 1.42425,0.35988369 0.47505,0.0799412 0.94965,-0.3178929 1.42426,-0.37577222 0.47504,-0.0578844 0.94965,0.35211506 1.42426,0.38725882 0.47459,0.035144 0.94964,-0.38221152 1.42425,-0.39420828 0.4746,-0.0119898 0.94964,0.40782897 1.42425,0.39653308 0.4746,-0.0112929 0.94965,-0.42865964 1.42426,-0.39420604 0.4746,0.03445319 0.94964,0.44446751 1.42425,0.38725954 0.47461,-0.057209 0.9492,-0.45506753 1.42425,-0.37577497 0.47461,0.07929191 0.94921,0.46032794 1.42426,0.35988299 0.4746,-0.10044455 0.94921,-0.46019048 1.42425,-0.33976918 0.47461,0.12042085 0.94921,0.45465945 1.42425,0.31567427 0.47461,-0.13898644 0.94922,-0.44379986 1.42382,-0.28788032 0.47504,0.15591886 0.94965,0.42773587 1.42425,0.2567092 0.47505,-0.17102776 0.94966,-0.40665544 1.42426,-0.2225297 0.47504,0.18413003 0.94965,0.38081108 1.42425,0.18573835 0.47504,-0.19507037 0.94965,-0.35049724 1.42426,-0.14676939 0.4746,0.20372629 0.94965,0.31607701 1.42425,0.10608477 0.4746,-0.2099938 0.94965,-0.27795235 1.42426,-0.06415341 0.4746,0.21379944 0.94964,0.23656585 1.42425,0.0214683"
class="UnoptimicedTransforms"
sodipodi:nodetypes="cssssccccccccsssssccccccccsssc"
transform="matrix(0.85890245,0,0,1,-26.768493,0)" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-202.74518"
y="19.9646"
id="text41243"><tspan
sodipodi:role="line"
id="tspan41241"
style="stroke-width:0.264583"
x="-202.74518"
y="19.9646">PF Handler</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-226.4415"
y="10"
id="text42975"><tspan
sodipodi:role="line"
id="tspan42973"
style="stroke-width:0.264583"
x="-226.4415"
y="10">KBR\_SRC'</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 18 KiB

After

Width:  |  Height:  |  Size: 22 KiB

311
figures/cp_spec_bti_spec.svg
View File

@ -2,12 +2,12 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="86.186043mm"
width="80.222542mm"
height="26.456652mm"
viewBox="0 0 86.186047 26.456652"
viewBox="0 0 80.222546 26.456652"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="cp_spec_bti_spec.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="181.80795"
inkscape:cy="41.602072"
inkscape:cx="167.55752"
inkscape:cy="41.908533"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -41,30 +41,11 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.06729"
originy="-9.132948" />
originx="250.0673"
originy="-9.1329481" />
</sodipodi:namedview>
<defs
id="defs2">
<marker
style="overflow:visible"
id="marker30479"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477" />
</marker>
<inkscape:path-effect
effect="bspline"
id="path-effect23711"
@ -213,44 +194,6 @@
apply_no_weight="true"
apply_with_weight="true"
only_selected="false" />
<marker
style="overflow:visible"
id="marker30479-8"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477-4" />
</marker>
<marker
style="overflow:visible"
id="marker30479-8-0"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="TriangleStart"
markerWidth="5.3244081"
markerHeight="6.155385"
viewBox="0 0 5.3244081 6.1553851"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path30477-4-3" />
</marker>
<inkscape:path-effect
effect="bspline"
id="path-effect18450-6"
@ -510,58 +453,6 @@
inkscape:original-d="m -189.99982,20 c 6.66694,2.65e-4 13.33362,2.65e-4 20.00003,0"
inkscape:path-effect="#path-effect20560-6-8-2"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-219.99985"
y="22.5"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-219.99985"
y="22.5"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-202.49985"
y="27.5"
id="text30881-9-0-6"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-202.49985"
y="27.5"
id="tspan30987-0">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-199.99985"
y="22.5"
id="text30881-9-0-6-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-199.99985"
y="22.5"
id="tspan30987-0-6">ret</tspan></text>
<g
id="g1010"
transform="matrix(1,0,0,-1,1.6e-4,30)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -230,10 c 8.04676,-5.0249313 -3.75991,-9.68513516 -2.42136,-2.4805849"
id="path37486"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479-8)"
d="m -230,10 c 11.30858,-5.160651 -4.80013,-13.1224352 -3.64542,-3.7814467"
id="path37486-5"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479-8-0)"
d="m -230,10 c 15.14429,-7.5 -5.26352,-16.6120804 -4.64086,-5.8303655"
id="path37486-5-6"
sodipodi:nodetypes="cc" />
</g>
<g
id="g1010-7"
transform="matrix(1,0,0,-1,20.00016,30)">
@ -581,17 +472,6 @@
id="path37486-5-6-3"
sodipodi:nodetypes="cc" />
</g>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-167.96765"
y="12.575636"
id="text30881-9-1-4-5-3"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-167.96765"
y="12.575636">END</tspan></text>
<path
style="fill:none;stroke:#ff6600;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:0.793749, 0.793749;stroke-dashoffset:0;stroke-opacity:1"
d="m -249.99987,15 h 80.00005"
@ -625,61 +505,6 @@
id="path20556-3"
inkscape:original-d="m -229.99984,20 c 6.66693,2.65e-4 13.3336,2.65e-4 20,0"
inkscape:path-effect="#path-effect20560-75" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225.13779"
y="29.9646"
id="text1481"><tspan
sodipodi:role="line"
id="tspan1479"
x="-225.13779"
y="29.9646"
style="stroke-width:0.264583">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-240.13779"
y="14.399414"
id="text1481-6"><tspan
sodipodi:role="line"
id="tspan1479-2"
x="-240.13779"
y="14.399414"
style="stroke-width:0.264583">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-232.74521"
y="17.5"
id="text1617"><tspan
sodipodi:role="line"
id="tspan1615"
x="-232.74521"
y="17.5"
style="stroke-width:0.264583">RET2</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-217.49985"
y="17.5"
id="text1621"><tspan
sodipodi:role="line"
id="tspan1619"
x="-217.49985"
y="17.5"
style="stroke-width:0.264583">KBR\_SRC</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-169.99982"
y="22.5"
id="text1625"><tspan
sodipodi:role="line"
id="tspan1623"
x="-169.99982"
y="22.5"
style="text-align:center;text-anchor:middle;stroke-width:0.264583">KBR\_DST</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-5)"
d="m -189.99982,20 c -2.5,5 -2.5,7.5 0,12.5"
@ -697,47 +522,113 @@
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99982"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99979"
y="19.470833"
id="text45941"><tspan
sodipodi:role="line"
id="tspan45939"
style="stroke-width:0.264583"
x="-219.99979"
y="19.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99979"
y="18.412498"
id="text45945"><tspan
sodipodi:role="line"
id="tspan45943"
style="stroke-width:0.264583"
x="-189.99979"
y="18.412498">KBR\_SRC</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99979"
y="35"
id="text5591"><tspan
id="text45949"><tspan
sodipodi:role="line"
id="tspan5589"
x="-189.99982"
y="35"
style="text-align:center;text-anchor:middle;stroke-width:0.264583">FAKE\_ROGUE</tspan></text>
id="tspan45947"
style="stroke-width:0.264583"
x="-189.99979"
y="35">FAKE\_ROGUE</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-194.32628"
y="27.159424"
id="text10297"><tspan
x="-169.9998"
y="22.5"
id="text45953"><tspan
sodipodi:role="line"
id="tspan10295"
x="-194.32628"
y="27.159424"
style="stroke-width:0.264583">call</tspan></text>
id="tspan45951"
style="stroke-width:0.264583"
x="-169.9998"
y="22.5">KBR\_DST</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-186.03"
y="27.118195"
id="text10301"><tspan
x="-169.99979"
y="12.5"
id="text45957"><tspan
sodipodi:role="line"
id="tspan10299"
x="-186.03"
y="27.118195"
style="stroke-width:0.264583">ret</tspan></text>
id="tspan45955"
style="stroke-width:0.264583"
x="-169.99979"
y="12.5">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-180.04037"
y="18.921932"
id="text10305"><tspan
x="-199.99979"
y="19.470833"
id="text45961"><tspan
sodipodi:role="line"
id="tspan10303"
x="-180.04037"
y="18.921932"
style="stroke-width:0.264583">ret</tspan></text>
id="tspan45959"
style="stroke-width:0.264583"
x="-199.99979"
y="19.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-187.49979"
y="27.5"
id="text45969"><tspan
sodipodi:role="line"
id="tspan45967"
style="stroke-width:0.264583"
x="-187.49979"
y="27.5">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:end;letter-spacing:0px;word-spacing:0px;text-anchor:end;stroke-width:0.264583"
x="-192.49979"
y="27.5"
id="text45973"><tspan
sodipodi:role="line"
id="tspan45971"
style="stroke-width:0.264583"
x="-192.49979"
y="27.5">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-204.99979"
y="30"
id="text45977"><tspan
sodipodi:role="line"
id="tspan45975"
style="stroke-width:0.264583"
x="-204.99979"
y="30">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-180.52895"
y="18.558334"
id="text1458"><tspan
sodipodi:role="line"
id="tspan1456"
style="stroke-width:0.264583"
x="-180.52895"
y="18.558334">ret</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 25 KiB

After

Width:  |  Height:  |  Size: 21 KiB

203
figures/cp_spec_bti_train.svg
View File

@ -2,12 +2,12 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="62.539841mm"
height="27.851416mm"
viewBox="0 0 62.539842 27.851416"
width="60.155418mm"
height="25.474236mm"
viewBox="0 0 60.15542 25.474235"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="cp_spec_bti_train.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="9.2293236"
inkscape:cx="150.33604"
inkscape:cy="61.380446"
inkscape:cx="140.04277"
inkscape:cy="62.030548"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -41,8 +41,8 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.0002"
originy="4.7618158" />
originx="250.00021"
originy="4.8846351" />
</sodipodi:namedview>
<defs
id="defs2">
@ -391,7 +391,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,4.7618153)">
transform="translate(250,4.884635)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -250,10 c 6.66693,0 13.3336,0 20,0"
@ -420,50 +420,6 @@
inkscape:original-d="m -210.0715,-2.4641709 c 6.69082,-0.011678 13.38138,-0.023622 20.07167,-0.035829"
inkscape:path-effect="#path-effect20560-6-8"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-232.49986"
y="12.5"
id="text30881"><tspan
sodipodi:role="line"
id="tspan30879"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-232.49986"
y="12.5">RET1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-219.99983"
y="12.5"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-219.99983"
y="12.5"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="text30881-9-0-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="tspan30987-7">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="text30881-9-0-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="tspan30987-9">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -230,10 c 8.04676,-5.0249313 -3.75991,-9.68513516 -2.42136,-2.4805849"
@ -479,17 +435,6 @@
d="m -230,10 c 15.14429,-7.5 -5.26352,-16.6120804 -4.64086,-5.8303655"
id="path37486-5-6"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99983"
y="-1e-07"
id="text30881-9-1-4-5-3"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99983"
y="-1e-07">END</tspan></text>
<path
style="fill:none;stroke:#ff6600;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:0.793749, 0.793749;stroke-dashoffset:0;stroke-opacity:1"
d="m -249.99987,15 h 60"
@ -518,22 +463,11 @@
y="17.4646">Kernel</tspan></text>
<path
style="fill:none;stroke:#ff0000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-9)"
d="m -209.99983,10 c 3.33365,3.333598 6.66703,6.666931 10.00015,10"
d="m -209.99983,10 c 6.667,3.333494 13.33367,6.666824 20.00004,10"
id="path20556-0"
inkscape:original-d="m -209.99983,10 c 3.33365,3.333597 6.66703,6.666932 10.00015,10"
inkscape:original-d="m -209.99983,10 c 6.66695,3.333599 13.33362,6.666931 20.00004,10"
inkscape:path-effect="#path-effect20560-6"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-204.99968"
y="22.5"
id="text2149"><tspan
sodipodi:role="line"
id="tspan2147"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-204.99968"
y="22.5">KBR\_DST</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -209.99983,9.9999998 c -2.5,-4.9999999 -2.5,-7.4999999 0,-12.4999999"
@ -547,51 +481,112 @@
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-210.01253"
y="-2.9063466"
id="text6002"><tspan
x="-239.9998"
y="9.4708347"
id="text45251"><tspan
sodipodi:role="line"
id="tspan6000"
id="tspan45249"
style="stroke-width:0.264583"
x="-210.01253"
y="-2.9063466">ROGUE</tspan></text>
x="-239.9998"
y="9.4708347">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-203.68408"
y="14.42189"
id="text9797"><tspan
x="-219.9998"
y="9.4708347"
id="text45255"><tspan
sodipodi:role="line"
id="tspan9795"
id="tspan45253"
style="stroke-width:0.264583"
x="-203.68408"
y="14.42189">ret</tspan></text>
x="-219.9998"
y="9.4708347">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-224.47064"
y="1.970834"
id="text45259"><tspan
sodipodi:role="line"
id="tspan45257"
style="stroke-width:0.264583"
x="-224.47064"
y="1.970834">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-206.66853"
y="1.4062667"
id="text45263"><tspan
sodipodi:role="line"
id="tspan45261"
style="stroke-width:0.264583"
x="-206.66853"
y="1.4062667">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-207.4998"
y="10.000001"
id="text45279"><tspan
sodipodi:role="line"
id="tspan45277"
style="stroke-width:0.264583"
x="-207.4998"
y="10.000001">KBR\_SRC'</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-214.5257"
y="4.6992383"
id="text9801"><tspan
x="-189.9998"
y="5e-07"
id="text45283"><tspan
sodipodi:role="line"
id="tspan9799"
id="tspan45281"
style="stroke-width:0.264583"
x="-214.5257"
y="4.6992383">call</tspan></text>
x="-189.9998"
y="5e-07">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:end;letter-spacing:0px;word-spacing:0px;text-anchor:end;stroke-width:0.264583"
x="-212.49979"
y="5.0000005"
id="text45720"><tspan
sodipodi:role="line"
id="tspan45718"
style="stroke-width:0.264583"
x="-212.49979"
y="5.0000005">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-205.5558"
y="0.81297868"
id="text9805"><tspan
x="-209.99979"
y="-3.0291662"
id="text45724"><tspan
sodipodi:role="line"
id="tspan9803"
id="tspan45722"
style="stroke-width:0.264583"
x="-205.5558"
y="0.81297868">ret</tspan><tspan
x="-209.99979"
y="-3.0291662">ROGUE</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:end;letter-spacing:0px;word-spacing:0px;text-anchor:end;stroke-width:0.264583"
x="-194.99979"
y="20"
id="text1069"><tspan
sodipodi:role="line"
id="tspan1067"
style="stroke-width:0.264583"
x="-205.5558"
y="3.3129787"
id="tspan9807" /></text>
x="-194.99979"
y="20">KBR\_DST</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-199.99979"
y="14.470834"
id="text1286"><tspan
sodipodi:role="line"
id="tspan1284"
style="stroke-width:0.264583"
x="-199.99979"
y="14.470834">ret</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 20 KiB

After

Width:  |  Height:  |  Size: 20 KiB

229
figures/ret_bti_spec.svg
View File

@ -2,12 +2,12 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="82.53978mm"
height="14.844971mm"
viewBox="0 0 82.53978 14.844971"
width="80.155357mm"
height="14.018947mm"
viewBox="0 0 80.155358 14.018947"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="ret_bti_spec.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="162.80737"
inkscape:cy="24.133799"
inkscape:cx="135.53235"
inkscape:cy="21.37565"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -41,8 +41,8 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.00011"
originy="1.7553711" />
originx="250.00014"
originy="0.92934727" />
</sodipodi:namedview>
<defs
id="defs2">
@ -402,7 +402,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,1.7553711)">
transform="translate(250,0.92934727)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -250,10 c 6.66693,0 13.3336,0 20,0"
@ -424,83 +424,6 @@
id="path20556-0"
inkscape:original-d="m -230,10 c 6.66693,2.65e-4 13.3336,2.65e-4 20,0"
inkscape:path-effect="#path-effect20560-6" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-230"
y="12.5"
id="text30881"><tspan
sodipodi:role="line"
id="tspan30879"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-230"
y="12.5">TRAIN\_PATH</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-210"
y="12.5"
id="text30881-9"><tspan
sodipodi:role="line"
id="tspan30879-2"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-210"
y="12.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-190"
y="12.5"
id="text30881-9-1"><tspan
sodipodi:role="line"
id="tspan30879-2-9"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-190"
y="12.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-218.19174"
y="9.5085478"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-218.19174"
y="9.5085478"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-204.77518"
y="7.1708221"
id="text30881-9-0-2"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-204.77518"
y="7.1708221"
id="tspan32570">jmp *</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="text30881-9-0-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
id="tspan30987-7">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="text30881-9-0-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
id="tspan30987-9">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -230,10 c 8.04676,-5.0249313 -3.75991,-9.68513516 -2.42136,-2.4805849"
@ -516,45 +439,12 @@
d="m -230,10 c 15.14429,-7.5 -5.26352,-16.6120804 -4.64086,-5.8303655"
id="path37486-5-6"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99989"
y="5"
id="text30881-9-1-2"><tspan
sodipodi:role="line"
id="tspan30879-2-9-9"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99989"
y="5">SPEC</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-179.93214"
y="1.7909622"
id="text30881-9-0-2-5-7"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-179.93214"
y="1.7909622"
id="tspan45952-0">jmp</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-169.99989"
y="5"
id="text30881-9-1-4-5-3-9"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8-3"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-169.99989"
y="5">END</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-5)"
d="m -189.99989,2.5 h 20"
id="path44487-6" />
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -209.99989,10 c 10,0 9.96428,-7.4734701 20,-7.5000001"
id="path1804"
sodipodi:nodetypes="cc" />
@ -564,5 +454,104 @@
id="path20556-0-9"
inkscape:original-d="m -210,10 c 6.66693,2.65e-4 13.3336,2.65e-4 20,0"
inkscape:path-effect="#path-effect20560-6-8" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-239.99988"
y="9.4708338"
id="text2804"><tspan
sodipodi:role="line"
id="tspan2802"
style="stroke-width:0.264583"
x="-239.99988"
y="9.4708338">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99988"
y="9.4708338"
id="text2808"><tspan
sodipodi:role="line"
id="tspan2806"
style="stroke-width:0.264583"
x="-219.99988"
y="9.4708338">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:start;letter-spacing:0px;word-spacing:0px;text-anchor:start;stroke-width:0.264583"
x="-224.69777"
y="1.9354329"
id="text2812"><tspan
sodipodi:role="line"
id="tspan2810"
style="text-align:start;text-anchor:start;stroke-width:0.264583"
x="-224.69777"
y="1.9354329">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-179.99988"
y="1.9708333"
id="text2816"><tspan
sodipodi:role="line"
id="tspan2814"
style="stroke-width:0.264583"
x="-179.99988"
y="1.9708333">jmp</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-198.02904"
y="8.0291662"
id="text2820"><tspan
sodipodi:role="line"
id="tspan2818"
style="stroke-width:0.264583"
x="-198.02904"
y="8.0291662">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99988"
y="12.5"
id="text2828"><tspan
sodipodi:role="line"
id="tspan2826"
style="stroke-width:0.264583"
x="-209.99988"
y="12.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99988"
y="5"
id="text2832"><tspan
sodipodi:role="line"
id="tspan2830"
style="stroke-width:0.264583"
x="-189.99988"
y="5">SPEC</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-169.99988"
y="5"
id="text2836"><tspan
sodipodi:role="line"
id="tspan2834"
style="stroke-width:0.264583"
x="-169.99988"
y="5">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99988"
y="12.5"
id="text2840"><tspan
sodipodi:role="line"
id="tspan2838"
style="stroke-width:0.264583"
x="-189.99988"
y="12.5">TRAIN</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 18 KiB

After

Width:  |  Height:  |  Size: 18 KiB

119
figures/ret_bti_train.svg
View File

@ -2,12 +2,12 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="82.539673mm"
height="14.844971mm"
viewBox="0 0 82.539674 14.844971"
width="80.155251mm"
height="14.018947mm"
viewBox="0 0 80.155252 14.018947"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="ret_bti_train.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="160.04922"
inkscape:cy="84.200141"
inkscape:cx="130.47574"
inkscape:cy="81.595224"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -41,8 +41,8 @@
spacingx="2.5"
spacingy="2.5"
empspacing="4"
originx="250.00013"
originy="1.7553714" />
originx="250.00016"
originy="0.9293476" />
</sodipodi:namedview>
<defs
id="defs2">
@ -362,7 +362,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,1.7553711)">
transform="translate(250,0.92934727)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -250,10 c 6.66693,0 13.3336,0 20,0"
@ -392,91 +392,80 @@
inkscape:path-effect="#path-effect20560-6-8" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-230"
y="12.5"
id="text30881"><tspan
sodipodi:role="line"
id="tspan30879"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-230"
y="12.5">TRAIN\_PATH</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-210"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99986"
y="12.5"
id="text30881-9"><tspan
sodipodi:role="line"
id="tspan30879-2"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-210"
x="-209.99986"
y="12.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-190"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99986"
y="12.5"
id="text30881-9-1"><tspan
sodipodi:role="line"
id="tspan30879-2-9"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-190"
x="-189.99986"
y="12.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-218.19174"
y="9.5085478"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99986"
y="9.4708338"
id="text30881-9-0"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-218.19174"
y="9.5085478"
x="-219.99986"
y="9.4708338"
id="tspan30987">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-200.03566"
y="8.9437208"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-199.99986"
y="9.4708338"
id="text30881-9-0-2"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-200.03566"
y="8.9437208"
id="tspan32570">jmp *</tspan></text>
x="-199.99986"
y="9.4708338"
id="tspan32570">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-179.93225"
y="9.2909632"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-179.99986"
y="9.4708338"
id="text30881-9-0-2-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-179.93225"
y="9.2909632"
x="-179.99986"
y="9.4708338"
id="tspan45952">jmp</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
x="-242.49986"
y="9.4708338"
id="text30881-9-0-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60648"
y="9.2303591"
x="-242.49986"
y="9.4708338"
id="tspan30987-7">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:start;letter-spacing:0px;word-spacing:0px;text-anchor:start;stroke-width:0.264583"
x="-224.69775"
y="1.9354331"
id="text30881-9-0-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225"
y="-4.4408921e-16"
style="text-align:start;text-anchor:start;stroke-width:0.264583"
x="-224.69775"
y="1.9354331"
id="tspan30987-9">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
@ -495,18 +484,34 @@
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-170"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.5px;line-height:1;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-169.99986"
y="12.5"
id="text30881-9-1-4-5-3"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-8"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-170"
y="12.5">END</tspan></text>
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.5px;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-169.99986"
y="12.5">END</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.5px;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-169.99986"
y="15"
id="tspan1143" /></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart)"
d="m -190,10 h 20"
id="path44487" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-214.99986"
y="7.5"
id="text1884"><tspan
sodipodi:role="line"
id="tspan1882"
style="stroke-width:0.264583"
x="-214.99986"
y="7.5" /></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 17 KiB

After

Width:  |  Height:  |  Size: 18 KiB

249
figures/ret_spec_bti_spec.svg
View File

@ -2,13 +2,13 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="63.494934mm"
height="17.813694mm"
viewBox="0 0 63.494935 17.813694"
width="60.155251mm"
height="17.974236mm"
viewBox="0 0 60.155251 17.974236"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
sodipodi:docname="spec_ret_bti_spec.svg"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="ret_spec_bti_spec.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="87.417981"
inkscape:cy="61.368802"
inkscape:cx="137.37111"
inkscape:cy="62.288185"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -42,7 +42,7 @@
spacingy="2.5"
empspacing="4"
originx="250.00007"
originy="-45.275906" />
originy="-45.115364" />
</sodipodi:namedview>
<defs
id="defs2">
@ -398,40 +398,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,-45.275906)">
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99994"
y="50"
id="text30881-9-1-4-5-9"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0-6"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99994"
y="50">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-215"
y="55"
id="text30881-9-0-8-8-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-215"
y="55"
id="tspan41599-90">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-205"
y="55"
id="text30881-9-0-8-8-2-8"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-205"
y="55"
id="tspan41599-9-8">ret</tspan></text>
transform="translate(250,-45.115364)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-1-6)"
d="m -250,60 c 6.66693,0 13.3336,0 20,0"
@ -456,94 +423,6 @@
id="path20556-0-9-2-4"
inkscape:original-d="m -210,60 c 6.66693,2.65e-4 13.3336,2.65e-4 20,0"
inkscape:path-effect="#path-effect20560-6-8-4-7" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-230.00002"
y="62.5"
id="text30881-5-9"><tspan
sodipodi:role="line"
id="tspan30879-4-0"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-230.00002"
y="62.5">TRAIN\_PATH</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-210.00002"
y="62.5"
id="text30881-9-7-9"><tspan
sodipodi:role="line"
id="tspan30879-2-4-1"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-210.00002"
y="62.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-209.99854"
y="47.131374"
id="text30881-9-7-8-7"><tspan
sodipodi:role="line"
id="tspan30879-2-4-9-7"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-209.99854"
y="47.131374">ROGUE</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99994"
y="62.5"
id="text30881-9-1-4-1"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-1"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99994"
y="62.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-220.13313"
y="59.608803"
id="text30881-9-0-8-5"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-220.13313"
y="59.608803"
id="tspan30987-6-9">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-198.54961"
y="58.076904"
id="text30881-9-0-2-8-7"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-198.54961"
y="58.076904"
id="tspan32570-8-7">jmp *</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60649"
y="59.230362"
id="text30881-9-0-3-4-6"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60649"
y="59.230362"
id="tspan30987-7-3-7">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225.00002"
y="50.000004"
id="text30881-9-0-5-1-3"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225.00002"
y="50.000004"
id="tspan30987-9-4-6">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#marker30479-7-2)"
d="m -230,60 c 8.04676,-5.024931 -3.75991,-9.685135 -2.42136,-2.480585"
@ -574,5 +453,115 @@
d="M -210,59.999998 C -200,60 -200,47.5 -190,47.5"
id="path43016"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-239.99992"
y="59.470833"
id="text8719"><tspan
sodipodi:role="line"
id="tspan8717"
style="stroke-width:0.264583"
x="-239.99992"
y="59.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99992"
y="59.470833"
id="text8723"><tspan
sodipodi:role="line"
id="tspan8721"
style="stroke-width:0.264583"
x="-219.99992"
y="59.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-199.99992"
y="58.558334"
id="text8731"><tspan
sodipodi:role="line"
id="tspan8729"
style="stroke-width:0.264583"
x="-199.99992"
y="58.558334">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99992"
y="62.5"
id="text8735"><tspan
sodipodi:role="line"
id="tspan8733"
style="stroke-width:0.264583"
x="-209.99992"
y="62.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99992"
y="62.5"
id="text8739"><tspan
sodipodi:role="line"
id="tspan8737"
style="stroke-width:0.264583"
x="-189.99992"
y="62.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99992"
y="50"
id="text8743"><tspan
sodipodi:role="line"
id="tspan8741"
style="stroke-width:0.264583"
x="-189.99992"
y="50">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-215.47169"
y="54.9646"
id="text8751"><tspan
sodipodi:role="line"
id="tspan8749"
style="stroke-width:0.264583"
x="-215.47169"
y="54.9646">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-224.69781"
y="51.935432"
id="text8755"><tspan
sodipodi:role="line"
id="tspan8753"
style="stroke-width:0.264583"
x="-224.69781"
y="51.935432">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-207.49992"
y="52.5"
id="text8759"><tspan
sodipodi:role="line"
id="tspan8757"
style="stroke-width:0.264583"
x="-207.49992"
y="52.5">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99992"
y="46.970833"
id="text8763"><tspan
sodipodi:role="line"
id="tspan8761"
style="stroke-width:0.264583"
x="-209.99992"
y="46.970833">ROGUE</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 19 KiB

After

Width:  |  Height:  |  Size: 19 KiB

260
figures/ret_spec_bti_train.svg
View File

@ -2,13 +2,13 @@
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="63.494934mm"
height="17.813694mm"
viewBox="0 0 63.494935 17.813694"
width="61.152653mm"
height="17.974236mm"
viewBox="0 0 61.152654 17.974236"
version="1.1"
id="svg5"
inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
sodipodi:docname="spec_ret_bti_train.svg"
inkscape:version="1.2.1 (9c6d41e410, 2022-07-14)"
sodipodi:docname="ret_spec_bti_train.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
@ -26,8 +26,8 @@
showgrid="true"
showborder="true"
inkscape:zoom="6.5261173"
inkscape:cx="139.66957"
inkscape:cy="29.803326"
inkscape:cx="125.11268"
inkscape:cy="30.722709"
inkscape:window-width="3836"
inkscape:window-height="2082"
inkscape:window-x="0"
@ -42,7 +42,7 @@
spacingy="2.5"
empspacing="4"
originx="250.00007"
originy="-25.275906" />
originy="-25.115364" />
</sodipodi:namedview>
<defs
id="defs2">
@ -399,7 +399,7 @@
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(250,-25.275906)">
transform="translate(250,-25.115364)">
<path
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#TriangleStart-1)"
d="m -250,40 c 6.66693,0 13.3336,0 20,0"
@ -435,116 +435,6 @@
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-230.00002"
y="42.5" /></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-210.00002"
y="42.5"
id="text30881-9-7"><tspan
sodipodi:role="line"
id="tspan30879-2-4"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-210.00002"
y="42.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-209.99854"
y="27.131374"
id="text30881-9-7-8"><tspan
sodipodi:role="line"
id="tspan30879-2-4-9"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-209.99854"
y="27.131374">ROGUE</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99994"
y="42.5"
id="text30881-9-1-4"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99994"
y="42.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-189.99994"
y="30"
id="text30881-9-1-4-5"><tspan
sodipodi:role="line"
id="tspan30879-2-9-3-0"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-189.99994"
y="30">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-220.07649"
y="39.489372"
id="text30881-9-0-8"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-220.07649"
y="39.489372"
id="tspan30987-6">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-215"
y="35"
id="text30881-9-0-8-8"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-215"
y="35"
id="tspan41599">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-204.84131"
y="31.343018"
id="text30881-9-0-8-8-2"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-204.84131"
y="31.343018"
id="tspan41599-9">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-200.05449"
y="39.140522"
id="text30881-9-0-2-8"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-200.05449"
y="39.140522"
id="tspan32570-8">jmp *</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-242.60649"
y="39.230362"
id="text30881-9-0-3-4"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-242.60649"
y="39.230362"
id="tspan30987-7-3">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-225.00002"
y="30.000002"
id="text30881-9-0-5-1"><tspan
sodipodi:role="line"
style="text-align:center;text-anchor:middle;stroke-width:0.264583"
x="-225.00002"
y="30.000002"
id="tspan30987-9-4">ret</tspan></text>
<path
style="fill:none;stroke:#000000;stroke-width:0.264583px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#marker30479-7)"
d="m -230,40 c 8.04676,-5.024931 -3.75991,-9.685135 -2.42136,-2.480585"
@ -574,17 +464,6 @@
style="fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#marker30479)"
d="m -210.04411,27.614872 20.13145,-0.0789"
id="path42726" />
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-229.99994"
y="42.5"
id="text2904"><tspan
sodipodi:role="line"
id="tspan2902"
x="-229.99994"
y="42.5"
style="text-align:center;text-anchor:middle;stroke-width:0.264583">TRAIN\_PATH</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
@ -596,5 +475,126 @@
x="-196.45999"
y="22.715515"
style="stroke-width:0.264583" /></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-239.99992"
y="39.470833"
id="text8371"><tspan
sodipodi:role="line"
id="tspan8369"
style="stroke-width:0.264583"
x="-239.99992"
y="39.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-219.99992"
y="39.470833"
id="text8375"><tspan
sodipodi:role="line"
id="tspan8373"
style="stroke-width:0.264583"
x="-219.99992"
y="39.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-205.45221"
y="31.226204"
id="text8379"><tspan
sodipodi:role="line"
id="tspan8377"
style="stroke-width:0.264583"
x="-205.45221"
y="31.226204">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-217.49992"
y="32.5"
id="text8383"><tspan
sodipodi:role="line"
id="tspan8381"
style="stroke-width:0.264583"
x="-217.49992"
y="32.5" /></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-199.99992"
y="39.470833"
id="text8387"><tspan
sodipodi:role="line"
id="tspan8385"
style="stroke-width:0.264583"
x="-199.99992"
y="39.470833">ret</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99992"
y="42.5"
id="text8395"><tspan
sodipodi:role="line"
id="tspan8393"
style="stroke-width:0.264583"
x="-209.99992"
y="42.5">BR1</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99992"
y="42.5"
id="text8399"><tspan
sodipodi:role="line"
id="tspan8397"
style="stroke-width:0.264583"
x="-189.99992"
y="42.5">TRAIN</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-189.99992"
y="30"
id="text8403"><tspan
sodipodi:role="line"
id="tspan8401"
style="stroke-width:0.264583"
x="-189.99992"
y="30">END</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:center;letter-spacing:0px;word-spacing:0px;text-anchor:middle;stroke-width:0.264583"
x="-209.99992"
y="26.970833"
id="text8407"><tspan
sodipodi:role="line"
id="tspan8405"
style="stroke-width:0.264583"
x="-209.99992"
y="26.970833">ROGUE</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;text-align:end;letter-spacing:0px;word-spacing:0px;text-anchor:end;stroke-width:0.264583"
x="-213.55824"
y="35"
id="text8411"><tspan
sodipodi:role="line"
id="tspan8409"
style="stroke-width:0.264583"
x="-213.55824"
y="35">call</tspan></text>
<text
xml:space="preserve"
style="font-size:2.5px;line-height:1;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;stroke-width:0.264583"
x="-224.69781"
y="31.935432"
id="text8415"><tspan
sodipodi:role="line"
id="tspan8413"
style="stroke-width:0.264583"
x="-224.69781"
y="31.935432">ret</tspan></text>
</g>
</svg>

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 20 KiB

After

Width:  |  Height:  |  Size: 20 KiB

16
refs.bib
View File

@ -37,13 +37,25 @@
@InProceedings{retbleed,
author = "Johannes Wikner and Kaveh Razavi",
title = "{RETPLEED}: Arbitrary Speculative Code Execution with
title = "{Retbleed}: Arbitrary Speculative Code Execution with
Return Instructions",
booktitle = "31th {USENIX} Security Symposium ({USENIX} Security
22)",
year = "2022",
}
@Misc{retbleedRepo,
author = "Johannes Wikner and Kaveh Razavi",
title = "{RETBleed} Artifact",
year = "2022",
publisher = "GitHub",
journal = "GitHub repository",
howpublished = "\url{https://github.com/comsec-group/retbleed}",
note = "[Online; accessed 22-July-2022]",
commit = "23d87ad7094292653f71192566a95cf45d4fbcc9",
year = "2022",
}
@Misc{amdSpectreMitigation,
author = "{AMD}",
title = "Software Techniques For Managing Speculation on {AMD}
@ -52,6 +64,7 @@
https://developer.amd.com/wp-content/resources/90343-B_SoftwareTechniquesforManagingSpeculation_WP_7-18Update_FNL.pdf
}",
note = "[Online; accessed 14-July-2022]",
year = "2022",
}
% Cache Attacks
@ -107,4 +120,5 @@
https://en.wikichip.org/wiki/intel/microarchitectures/haswell_(client)
}",
note = "[Online; accessed 14-July-2022]",
year = "2022",
}