Re:Breaking the x86 Instruction Set: how to find undocumente...
by greenpenguin on Monday September 11, 2017 @05:43AM
(#15217250)
I'm not really qualified to answer this, but I suspect the instruction decoder(s?) would be decoupled from register state as much as possible (unless x86 is even weirder than I thought).
Given this, I suspect wiring in a path all the way from the relevant versions of the relevant registers might be quite expensive. Plus part of the decode logic now needs to block on a register value - so a timing based attack might find these.
Re:Breaking the x86 Instruction Set: how to find undocumente...
by dfox on Monday September 11, 2017 @08:01AM
(#15217822)
i386 instruction decoding at least partially depend on what descriptor is loaded into (shadow) CS. For example the effects of 0x66 prefix are reversed between 16b and 32b code.
Given this, I suspect wiring in a path all the way from the relevant versions of the relevant registers might be quite expensive. Plus part of the decode logic now needs to block on a register value - so a timing based attack might find these.
More qualified comments welcome...