2 ms·
I wonder if even this will be enough, it seems that modern x86 has hundreds/thousands of non externally visible hidden registers it uses for fast store/load (r
by throwaway2048 8y ago
I wonder if even this will be enough, it seems that modern x86 has hundreds/thousands of non externally visible hidden registers it uses for fast store/load (rather than a call to cache/ram).
https://en.wikipedia.org/wiki/Register_renaming https://en.wikipedia.org/wiki/Register_renaming
- caf 8y agoOnce the architectural registers are zeroed in a path that can't be speculatively skipped, the other values in the register file are dead and can't be exposed.
- throwaway2048 8y agoSure but these bugs are about side effects of speculation that happens before any kind of "deadening" of untaken branches occurs. What if the processor is speculating using these hidden registers, couldn't similar information be exposed?
- caf 8y agoThe code in question unconditionally zeroes the architecturally-visible registers on entry to the syscall path. If any mis-speculation happens, it has to happen after this point, at which point any user-supplied data left over in the register file isn't accessible to speculated code, because even speculated code can only use architectural names to address registers.