3 ms·
This bit isn't right: void move_one_page_in_cache(uint8_t* addr) { static unsigned int github_idea4good = 1; _mm_clflush(&github_idea4good);
by caf 9y ago
This bit isn't right:
void move_one_page_in_cache(uint8_t* addr) {
static unsigned int github_idea4good = 1;
_mm_clflush(&github_idea4good);
if (0 < github_idea4good) {
volatile uint8_t temp = probe_pages[*addr * PAGE_SIZE];
Here, the probe is executed in the retired instruction stream. That's not Spectre. If you can retire an instruction that dereferences addr, your Javascript engine is busted already.
To demonstrate Spectre you need to put the probe in a path that isn't taken, but train the branch predictor to speculatively execute it anyway.
- idea4good 9y agoI can do change like this: static unsigned int github_idea4good = -1; if(0 < github_idea4good) will never be true. But the result is same. I believe the key is: github_idea4good must out of cache.
- amscanne 9y agogithub_idea4good is unsigned. There’s an implicit cast at the assignment. The condition is still true and that path is always executed.
- idea4good 9y agogood catch! Change it like this: #define PROBE_TIMES 100000 static int github_idea4good = -1; If probe times big enough, it works still.