Horn: Racing against the clock

Jann Horn describesin great detail the process he went through to exploit a tiny racewindow in the kernel.

Luckily for us, the race window contains the first few memoryaccesses to the struct file; therefore, by making sure that thestruct file is not present in the fastest CPU caches, we can widenthe race window by as much time as the memory accesses take. Thestandard way to do this is to use an eviction pattern / evictionset; but instead we can also make the cache line dirty on anothercore.