3 ms·
Can't you executive the trapping access in a not-taken speculatively-executed branch à la Meltdown?
by caf 8y ago
Can't you executive the trapping access in a not-taken speculatively-executed branch à la Meltdown?
- cperciva 8y agoSure, but that gives you an even shorter window because the pipeline flushes as soon as the CPU realizes that it mis-speculated.
- caf 8y agoIt is my understanding that you can make that window very long by having the mis-speculated branch depend on a value that has to be loaded from main memory.
- cperciva 8y agoHmm, good point. Yes, that would probably make this much easier to exploit. Unless the CPU does a partial pipeline flush upon realizing that there would be a trap. I don't know -- do Intel CPUs check for exceptions in order?
- caf 8y agoWell, they don't for #PF at least, because that's how Meltdown works - I'm not sure if it works differently for #NM though.