Will cache buffering interfere with Meltdown?

Question

If the new processors had a cache buffer that was only tied to the actual CPU cache, if instructions were ever executed, would attacks like Meltdown be possible?

The suggestion is to make speculative execution possible to load from memory, but not write to CPU caches until they are executed.

Answer 1

TL: DR: yes, I think Specter (and Meltdown) will solve this in their current form (using the side channel + clear cache time to copy secret data from the physical register), but it will probably be too expensive (in the cost of electricity , and maybe in performance) to be a likely implementation.

(, , SMT), ALU/port-pressure, , ALU . Meltdown , + . ( Meltdown, Spectre, , ).

, . , . (.. ALU , , , ​​ ; ), , , .

SMT (, Intel i5 Intel) ALU Spectre, , . ( Meltdown ALU Linux perf, ).

---

Meltdown , , .

; , TLB, , , , , 0 - TLB .

, ( secret) touch array[secret*4096] , . , . ( ALU/port-pressure.)

"" - , , KASLR, , . Meltdown.

---

, , , . , " ", , , . ( , , .)

( , , , . L1D .)

, L1D. ( L1D , , , , , , ).

, . ( , Skylake-X 64- ZMM-, . - , 64 * entries , .. , - . , , , , )

, Intel L1D 2 + 1 . (, , , L2 ? Intel Skylake.)

L1D , , , , , .

, L1D, L1D, , , 2 . (MOB , + x86). L1D , , , L1D .

MOB ( ), . , MOB Intel -. (Haswell 72 42 ).

---

Hmm, , MOB . , / , L1D.

, " " , , : , MOB .

, L1D . , , + , -.

( , , . , , , , , -. L1D / , , .)

---

: . , , , OoO exec Meltdown/Spectre, .

, . , . Meltdown/Spectre . OoO CPU , , ; .

, ALU (, , ), , " ", . L1D , - ( ).

, , , , , . , , , . , , .

, "" , - . , .

- - , . , .

, Specter : , . , , /uops. , ( ); DLL Windows Linux.

Answer 2

, specEx/?

( ) - , - !