[caf]

It's not timing the segfault delivery itself, the idea is to time another read of your own address space after the fault to see if it's been prefetched or not.

Maybe you could CLFLUSH on segfault delivery though.

[caf]

Turns out "maybe" is "not" - if you put the faulting read at a mispredicted branch target, you don't take the fault.