<story><title>Reading privileged memory with a side-channel</title><url>https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html</url></story><parent_chain><item><author>ErikAugust</author><text>I&amp;#x27;ve thrown the C code in the Spectre paper up if anyone wants to feel the magic: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;ErikAugust&amp;#x2F;724d4a969fb2c6ae1bbd7b2a9e3d4bb6&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;ErikAugust&amp;#x2F;724d4a969fb2c6ae1bbd7b2a9...&lt;/a&gt;</text></item><item><author>jotux</author><text>Papers describing each attack:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;meltdownattack.com&amp;#x2F;meltdown.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;meltdownattack.com&amp;#x2F;meltdown.pdf&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;spectreattack.com&amp;#x2F;spectre.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;spectreattack.com&amp;#x2F;spectre.pdf&lt;/a&gt;&lt;p&gt;From the spectre paper:&lt;p&gt;&amp;gt;As  a  proof-of-concept,   JavaScript  code  was  written
that,  when  run  in  the  Google  Chrome  browser,  allows
JavaScript  to  read  private  memory  from  the  process
in  which  it  runs  (cf.  Listing  2).&lt;p&gt;Scary stuff.</text></item></parent_chain><comment><author>dpwm</author><text>Just tested this on systems of varying age.&lt;p&gt;Works on processors going back as far as 2007 (the oldest I have access to now is an Athlon 64 X2 6000+), but the example code relies on an instruction that the Atom D510 does not suport.&lt;p&gt;Because Spectre seems to be an intrinsic problem with out-of-order execution, which is almost as old as the FDIV bug in intel processors, I would be very surprised if the Atom D510 did not turn out to be susceptible using other methods as outlined in the paper.&lt;p&gt;EDIT: I originally suspected this instruction was CLFLUSH and erroneously claimed the D510 doesn&amp;#x27;t support sse2. It does support sse2, so it must be that it does not support the RDTSCP instruction used for timing.&lt;p&gt;EDIT: This gets very interesting. I made some modifications to use a CPUID followed by RDTSC, which now runs without illegal instructions and works everywhere the previous version worked. Except on the D510, this runs but I cannot get the leak to happen despite exploring values of CACHE_HIT_THRESHOLD. Could the Atom D510 really be immune from Spectre?</text></comment>
<story><title>Reading privileged memory with a side-channel</title><url>https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html</url></story><parent_chain><item><author>ErikAugust</author><text>I&amp;#x27;ve thrown the C code in the Spectre paper up if anyone wants to feel the magic: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;ErikAugust&amp;#x2F;724d4a969fb2c6ae1bbd7b2a9e3d4bb6&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;ErikAugust&amp;#x2F;724d4a969fb2c6ae1bbd7b2a9...&lt;/a&gt;</text></item><item><author>jotux</author><text>Papers describing each attack:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;meltdownattack.com&amp;#x2F;meltdown.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;meltdownattack.com&amp;#x2F;meltdown.pdf&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;spectreattack.com&amp;#x2F;spectre.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;spectreattack.com&amp;#x2F;spectre.pdf&lt;/a&gt;&lt;p&gt;From the spectre paper:&lt;p&gt;&amp;gt;As  a  proof-of-concept,   JavaScript  code  was  written
that,  when  run  in  the  Google  Chrome  browser,  allows
JavaScript  to  read  private  memory  from  the  process
in  which  it  runs  (cf.  Listing  2).&lt;p&gt;Scary stuff.</text></item></parent_chain><comment><author>ojiikun</author><text>Thanks for this.  Would love an annotated version of this if anyone is up for it.  My C is pretty good, but some high level &amp;quot;what is being done here&amp;quot; and &amp;quot;this is what shouldn&amp;#x27;t work&amp;quot; comments would be cool to see.</text></comment>