secretbyte you want to read is stored at inaccessible memory location
- The sender triggers an access exception by attempting to access
- Due to out-of-order execution, the load of
secretand its access in step 4 may happen before the exception fires.
- Calculate an
offsetinto a known array
secretby the width of a cache line.
- This forces the cache to load
probe[offset], caching exactly one chunk of our array.
- The exception fires, clearing the modified registers, but cached data is not excised.
- Iterate over all 256 offsets into
probeto find out which one loads fast. You've determined the value of