Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

raspberrypi.org

Post reply on HN
Print view View original

11–20 of 232 posts

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#11

Post by Fronzie »

Osiris wrote: post #2

With all the news about these attacks lately, this is one of the best posts I've seen in explaining to less knowledgable people how exactly speculation causes a problem. One question I still have that gets glossed over is how timing of instructions is captured.

in order to exploit it from a script running in a web-browser: there's a high-resolution timer in javascript. This one is limited to 5 to 20 us resolution to prevent such attacks.

Recently a shared-memory extension has been proposed. one javascript thread just increments a counter in the shared memory, functioning as a clock for the other thread.

In both cases, (Spectre) attacks can be prevented by browser updates, so any performance impact is not system wide.

This is different from Meltdown, which (only?) affects intel. That one requires kernel changes which cause system-wide performance degradation.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#12

Post by blattimwind »

> The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used in Raspberry Pi render us immune to attacks of the sort.

I didn't check, but these will almost certainly have branch prediction. What they probably lack is a predictor advanced enough to speculate on indirect branches, which AIUI is the primary vector of Spectre.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#14

Post by vinn124 »

SomeHacker44 wrote: post #4

This is a good overview of modern, superscalar, out-of-order, speculative CPUs that literally any programmer could easily understand. Recommended reading for every single engineer in the whole world (who doesn't already understand this stuff from reading source material e.g., Google Zero post).

agreed

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#15

Post by blattimwind »

Fronzie wrote: post #11
Osiris wrote: post #2

With all the news about these attacks lately, this is one of the best posts I've seen in explaining to less knowledgable people how exactly speculation causes a problem. One question I still have that gets glossed over is how timing of instructions is captured.

in order to exploit it from a script running in a web-browser: there's a high-resolution timer in javascript. This one is limited to 5 to 20 us resolution to prevent such attacks. Recently a shared-memory extension has been proposed. one javascript thread just increments a counter in the shared memory, functioning as a clock for the other thread. In both cases, (Spectre) attacks can be prevented by browser updates, s…

> This one is limited to 5 to 20 us resolution to prevent such attacks.

* make such attacks more difficult.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#17

Post by pslam »

The cores in (all versions of?) Raspberry Pi do speculatively execute. It's just that the window of opportunity is tiny - just a few cycles (and maybe up to twice that many instructions) - and there's (probably) no way to get an indirected side-effect.

I wouldn't write off the ability to get a useful side-effect signal. The variants widely documented are not the only possible methods of inducing speculative side-effects.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#18

Post by Zaak »

tomxor wrote: post #16

Technical details aside, I find it quite amusing that the hardware in my pi zero is more secure than my desktop that is two orders of magnitude more expensive

Well, the vulnerabilities are directly connected to performance-enhancing architectural features, so...
Post reply on HN