Re:GhostRace: Exploiting and Mitigating Speculative Race Con...
by hanyragab on Saturday March 16, 2024 @06:12PM
(#39729938)
Memory order is only preserved on the architectural level, but on the microarchitectural level, all kinds of reordering, optimizations, and speculations are done to maximize the execution thought. Section 7 of the paper I'm linking below could help to understand how these microarchitectural optimizations could break the memory order beyond the rollback point, causing indeed a Machine Clear (Nuke) of the entire pipeline. We have analyzed the entire class of Machine Clear and showed how the different types can create transient execution paths where memory could be transiently leaked.
The basic way it works is that pretty much any reordered is allowed, speculatively, even if it violates the explicit or implicit barriers, but then the operations are tracked in a memory order buffer (MOB) until retirement which can detect whether the reordering was detectable and if so flush the pipeline (so-called "memory order nuke", visible in performance counters).