Why you single intel on this, ARM and POWER also affected
https://www.ibm.com/blogs/psirt/potential-impact-processors-...
Meltdown, aka “Dear Intel, you suck”
11–20 of 176 posts
Re: Meltdown, aka “Dear Intel, you suck”
#12Why you single intel on this, ARM and POWER also affected https://www.ibm.com/blogs/psirt/potential-impact-processors-...
Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?
Re: Meltdown, aka “Dear Intel, you suck”
#13May be time for OpenBSD people ( if they have the resources ) to build a CPU from ground up with RISC-V?
You mean like https://openrisc.io/ ?
Re: Meltdown, aka “Dear Intel, you suck”
#14Why you single intel on this, ARM and POWER also affected https://www.ibm.com/blogs/psirt/potential-impact-processors-...
Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?
from what I understand AMD and ARM are also affected by the toy POC, quote
Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors.
quote
However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed
end of quote
it just need more work to make it work their
Re: Meltdown, aka “Dear Intel, you suck”
#15Why you single intel on this, ARM and POWER also affected https://www.ibm.com/blogs/psirt/potential-impact-processors-...
Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?
Having just read the Meltdown paper, but not the Spectre paper. My understanding is that yes Meltdown is much easier to exploit and more powerful. I believe Spectre requires the attacker to consistently fool the branch predictor while Meltdown enables reading kernel memory mapped into user space process via access in speculatively executed code and observing the affects on the CPU cache.
Re: Meltdown, aka “Dear Intel, you suck”
#16Earlier quoted context omitted.
Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?
from what I understand AMD and ARM are also affected by the toy POC, quote Out-of-order execution is an indispensable performance feature and present in a wide range of modern processors. quote However, for both ARM and AMD, the toy example as described in Section 3 works reliably, indicating that out-of-order execution generally occurs and instructions past illegal memory accesses are also performed end of quote it…
I saw some speculation that AMD might raise the kernel memory read exception earlier than Intel which prevents any subsequent instructions from using the value fetched from the kernel address space.
Re: Meltdown, aka “Dear Intel, you suck”
#17Is there not some sort of OS embargo consortium that could be created to resolve this?
The problem with embargoes is that they tend to run so long that users are put at risk unnecessarily. Most of the reasons for extending embargoes way beyond the time needed to prepare and test patches are just bullshit.
For example, from the conversation on the KRACK embargo:
>Q. What is the rationale on extending the embargo so long? To give vendors a chance to patch? It seems like once people in the know know about a vulnerability, the shorter an embargo time the better.
> A. There’s a couple of different interests at play.
> For instance:
> Researchers want to make a timed media splash.
> Security agencies want to evaluate the problem and make sure they get patched before anyone else.
> Vendors want time to prepare patches, yes, but that alone does not justify such a long delay.
> Reviewing the patch, testing it, and preparing it for commit and publishing erratas took only a couple of hours of my free time.
Apparently Meltdown was discovered back in June, or seven months ago. Only a select few were told about it and have been working on it. It is apparent that some are more equal than others in the "free and open source community," which ironically apparently includes Microsoft, Apple, and the three-letter agencies.
Re: Meltdown, aka “Dear Intel, you suck”
#18Why you single intel on this, ARM and POWER also affected https://www.ibm.com/blogs/psirt/potential-impact-processors-...
Everyone is affected by Spectre, but my understanding is that Meltdown is a particularly powerful "version" of Spectre that only affects Intel CPUs ?
My ELI5 attempt:
There are 3 vulnerabilities.
Meltdown is 1 of the 3. Meltdown is pretty much Intel only. Some ARM SoCs are also affected, but these are relatively rare. AMD64 is unaffected by Meltdown.
Spectre are the other 2 vulnerabilities. Spectre affects pretty much everyone.
Meltdown is more severe, and more of a blunder.
For a technical explanation, see [1]. Was recently referred to at HN as well.
[1] https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...
Re: Meltdown, aka “Dear Intel, you suck”
#19May be time for OpenBSD people ( if they have the resources ) to build a CPU from ground up with RISC-V?
Just crowdsource a few billion $ for R&D and we are good to go.
The first and most important phases of hardware design are a lot like software development. If open source folks can write an OS without much funding, then they can design a CPU.
Re: Meltdown, aka “Dear Intel, you suck”
#20May be time for OpenBSD people ( if they have the resources ) to build a CPU from ground up with RISC-V?
There are already CPUs available that aren't affected by these bugs. The problem is that most people want the fastest CPU for a given price -- and making a new, slow, expensive CPU isn't going to solve that problem.