https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html
introduction to virtual memory layout, chaotic style:
On so-called 64-bit platforms, unlike on 32-bit platforms, by convention the kernel is placed in virtual memory directly before userspace memory. Negative addresses refer to kernel memory, positive addresses refer to userspace memory. For example, on x86-64 Linux without KASLR, the kernel text mapping is at -0x80000000. When hardware capabilities expand to accomodate larger virtual addresses, the address space grows in both directions.
Looks like KPTI isn't being very "helpful" to mitigate prefetch attacks after all.
https://www.willsroot.io/2022/12/entrybleed.html
Also for those interested, the PoC code for both the prefetch technique and the CEA stack attack can be found here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=2351
Cool work!