On Sun, 2017-09-10 at 18:46 -0700, Andy Lutomirski wrote: > > No, nothing stops the problematic speculative load. Here's the > issue. > One CPU removes a reference to a page table from a higher-level page > table, flushes, and then frees the page table. Then it re-allocates > it and writes something unrelated there. Another CPU that has CR3 > pointing to the page hierarchy in question could have a reference to > the freed table in its paging structure cache. Even if it's > guaranteed to not try to access the addresses in question (because > they're user addresses and the other CPU is in kernel mode, etc), but > there is never a guarantee that the CPU doesn't randomly try to fill > its TLB for the affected addresses. This results in invalid PTEs in > the TLB, possible accesses using bogus memory types, and maybe even > reads from IO space.
Good point, I had forgotten all about memory accesses that do not originate with software behavior.
