Re:Reading privileged memory with a side-channel
by ethbro on Wednesday January 03, 2018 @07:36PM
(#16066906)
My read is that vulnerable processors generally have to:
1. Have out of order execution
2. Have aggressive speculative memory load / caching behavior
3. Be able to speculatively cache memory not owned by the current process (either kernel or otherwise)
4. Have deterministic ways of triggering a speculative load / read to the same memory location
2 is probably the saving grace in ARM / low power land, given they don't have the power budget to trade speculative loads for performance (in the event they're even out of order in the first place).
Caveat: I'm drinking pretty strong Belgian beer while reading through these papers.
1. Have out of order execution
2. Have aggressive speculative memory load / caching behavior
3. Be able to speculatively cache memory not owned by the current process (either kernel or otherwise)
4. Have deterministic ways of triggering a speculative load / read to the same memory location
2 is probably the saving grace in ARM / low power land, given they don't have the power budget to trade speculative loads for performance (in the event they're even out of order in the first place).
Caveat: I'm drinking pretty strong Belgian beer while reading through these papers.