[Cryptography] Speculation considered harmful?

[Jerry Leichter]

> Eh. In the context of Spectre, the CPU knows which cachelines it loaded in a speculative fetch. It should simply mark them invalid when unrolling the speculation.
John Levine already pointed out the root of the problem - and the right solution:  Speculated code must run *in exactly the same way as non-speculated code*.  In particular, a speculated path needs to stop immediately if it attempts a forbidden memory access.  There's absolutely no point in continuing down this path, as it can't possibly be committed in any case:  It will terminate at this point with a memory access exception.

If the inaccessible data is never read into the cache (because the request to load it never makes it to memory), there's nothing to forget.  If other side channels might leak information about that data ... they would leak it along non-speculative paths as well - which would obviously be an ever more serious bug!

Reading this data into the cache has to go through the same mapping hardware whether it's during speculation or not.  The same access information is potentially available.  The access has to be checked before the speculative path is committed anyway.

It's not clear to me exactly what gets saved in the hardware design by handling memory accesses in speculative mode this way.  Maybe the idea is to allow speculation across mode changes - a potential speedup, though a very dangerous one.

The design of the speculation mechanism has to carefully list all state that may be modified along the speculative path so that it gets discarded if the speculative path is discarded.  Clearly the contents of cache was not considered to be part of this state because it can't be read except by going through the access checks.  But these attacks show that was false reasoning:  Timing analysis *does* let unprivileged code effectively read the contents of the cache.  If you get the resources you need to protect wrong, your whole protection regime crumbles....
                                                        -- Jerry