Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

raspberrypi.org

Post reply on HN
Print view View original

21–30 of 232 posts

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#21

Post by crispinb »

SomeHacker44 wrote: post #4

This is a good overview of modern, superscalar, out-of-order, speculative CPUs that literally any programmer could easily understand. Recommended reading for every single engineer in the whole world (who doesn't already understand this stuff from reading source material e.g., Google Zero post).

Yes, CPU architecture is one of many subjects I don't know enough about, and this was both interesting & has added to my reading list.

It's also quite fun to think that the little Pi I have chugging away in a tiny corner doing a variety of background tasks, which was already the most trouble-free machine I own, may also be the safest (OK I know that's an oversimplification, but I'm feeling affectionate towards it).

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#22

Post by jtchang »

This is a fantastic read. Timing attacks are insidious and tend to crop it in the oddest places. I first learned of them when learning how to securely compare strings (used a lot with passwords). A naive implementation means that you can easily guess if a character is correct depending on how fast the compare function returns.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#24

Post by edsouza »

blattimwind wrote: post #12

> The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used in Raspberry Pi render us immune to attacks of the sort. I didn't check, but these will almost certainly have branch prediction. What they probably lack is a predictor advanced enough to speculate on indirect branches, which AIUI is the primary vector of Spectre.

ARM Ltd has a list of vulnerable cores [1], the above are not listed.

[1] https://developer.arm.com/support/security-update

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#25

Post by trynewideas »

blattimwind wrote: post #12

> The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used in Raspberry Pi render us immune to attacks of the sort. I didn't check, but these will almost certainly have branch prediction. What they probably lack is a predictor advanced enough to speculate on indirect branches, which AIUI is the primary vector of Spectre.

Eben delves into some unaffected speculative ARM features in the comments, and why they're not vulnerable. His responses in the comments in general are also worth a read, in case folks skip comments as a rule.

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#27

Post by styfle »

I understood everything up until the "suppose we flush our cache before executing the code" part which is probably the most important part.

There was a comment below the article that explained this part a little further:

> Imagine the value at the kernel address, which gets loaded into _w, was 0xabde3167. Then the value of _x is 0x100, and address user_mem[0x100] will end up in the cache. A subsequent load of user_mem[0x100] will be fast.

> Now imagine the value at the kernel address, which gets loaded into _w, was 0xabde3067. Then the value of _x is 0x000, and address user_mem[0x000] will end up in the cache. A subsequent load of user_mem[0x100] will be slow.

> So we can use the speed of a read from user_mem[0x100] to discriminate between the two options. Information has leaked, via a side channel, from kernel to user.

https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...

Re: Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown

#30

Post by trynewideas »

Demiurge wrote: post #23
tomxor wrote: post #16

Technical details aside, I find it quite amusing that the hardware in my pi zero is more secure than my desktop that is two orders of magnitude more expensive

And yet, my abacus is even more secure ;-)

Only if you wear gloves while using it and shake it after finishing a calculation.
Post reply on HN