This is great work! Very curious how you're leaking 64 bits in a single access. The Sushi Roll PMC time series trick is real neat, too. Random thought: would it be feasible to leak a whole cache line at once with an AVX-512 load + scatter?
-
-
-
I've tried a few vectorized leaks but I've always struggled with them. I'm not sure why, perhaps the operations don't play as well in speculation. But maybe that's only across int/vector units (I'd often have speculation die around movq/pinsq/pextrq)
- Još 1 odgovor
Novi razgovor -
-
-
Great post. About "why we see the 3rd and 4th levels of the page table get hit", it could be the case that the those first accesses are the "usual" ones, and then the second round (starting at ~300 cycles) are related to setting the accessed bit.
-
It has been reported that the page walking hardware has its own internal caches for some levels of the page entries, which could explain why levels 1 and 2 don't appear in the first phase. One could perhaps confirm it by doing the invlpg, but not the dirty bit clear, to see if...
- Još 9 drugih odgovora
Novi razgovor -
-
-
Great post! I faced the problem of leaking 64-bit samples too, so I can't wait to see your special sauce in a future blog post
atm I'm leaking atomically 16-bit shifted values to give them a timestamp, and I'm aggregating the data later based on common bytes and distribution.pic.twitter.com/4wCDe9oy7g
-
The special sauce post might be a long way out! I'm glad the technique is working for you! It made my day when you reproduced the results, especially in a different environment (Linux kernel driver).
Kraj razgovora
Novi razgovor -
-
-
awesome! :)
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.