> Right, but how far away from "val = array[attacker_controlled_index];" > in the instruction stream do you need to look before you're > comfortable there's no 'val' dependent reads in the speculation window > on all possible architectures. Until we have variable annotations and > compiler help my guess is that static analysis has an easier time > pointing us to the first potentially bad speculative access. On x86 the researchers are saying up to 180 or so simple instructions. I've not seen any Intel or AMD official quoted value. It's enough that you need to peer across functions. Alan
