3 ms·
Branch prediction alone is insufficient. Speculative execution alone is insufficient. You need speculative memory loads for any of these attacks to work. The C
by Scaevolus 9y ago
Branch prediction alone is insufficient. Speculative execution alone is insufficient. You need speculative memory loads for any of these attacks to work.
The Cortex-A53 branch predictor [1] does prefetching to keep the core fed. This ensures that the instructions are ready for decoding, but has no architectural effects beyond the L1 instruction cache, which is already a well-studied timing sidechannel.
[1]: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0500d/CJHEICEB.html http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....
- bazizbaziz 9y agoWhat about the fact that these instructions might get partially executed in the pipeline before the branch gets resolved and the pipeline flushed? If a mis-fetched instruction can reach the LSU stage before the pipeline gets flushed, it might serve as a speculative memory load...
- Scaevolus 9y agoThey're not partially executed. The branch predictor only fetches instructions. They might be decoded, but it's not an out-of-order processor-- pipeline stages only proceed if the previous phase is correct. Here's the Cortex-A53 pipeline: https://www.anandtech.com/show/11441/dynamiq-and-arms-new-cpus-cortex-a75-a55/4 https://www.anandtech.com/show/11441/dynamiq-and-arms-new-cp... It's an in-order CPU, so that "issue" phase (pipeline step 5) stalls until the instruction pointer is resolved. Instructions must be issued to the "AGU Load" functional unit, which is what actually performs the read and pulls data into the cache hierarchy. Note also that a single speculative memory load is insufficient for Spectre. You need two speculative memory loads.