Live data from Hacker News

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

techcrunch.com

201–204 of 204 posts

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#201

Earlier quoted context omitted.

I do not understand how you want to mitigate this issue by using the "context" given that the attack demonstration is done with a source code that makes use of the "context". The attack is fully context-agnostic since the "PACMAN gadget" in victim's code is injecting the "context" by itself. The root of the problem is the small hash size and the fact that you can "suppress" failed hash check effects to bruteforce the…

Speculative exec ruins everything again. I get the performance gainz, but when are we going to get past the formal fallacy that executing any instruction we don't need to based on actual flow is de facto a complete violation of user expectations and therefore completely unsafe to do. Like every lay person I explain speculative execution seems to be able to recognize that a pipeline stall to figure out what a value ac…

> Nowhere on Earth, will you find an organization that will execute both sides of a conditional process requiring hunans to do the work just to throw away the result. Not taken.

Speculative execution today (within modern high-end processor) does not execute both sides of a conditional branch.

It would indeed be a waste of power and it would be a much more complex micro-architecture.

Modern speculative OoO processors execute a single path and simply relies on the branch predictor accuracy. And they are pretty accurate, on the order of 3 misspredictions every 1000 instructions. The power consumption in unnecessary work due to a missprediction is quite low.

Modern processors consume much of their power in Out-of-Order instruction scheduling.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#202

Earlier quoted context omitted.

In my opinion the requirement that HN submissions match the article's title is quite absurd because of this phenomenon.

Uh, that isn't the rule, for exactly that reason. > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. https://news.ycombinator.com/newsguidelines.html

I've seen many cases where mods revert an informative title in favor of a less informative one. Also, the idea that the title of a submission should match the title of the resulting article is quite silly, since often the article is written for a different audience and the informed HN submitter can sometimes craft a title that better summarizes to HN readers why the story is interesting / worth reading / controversial.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#203
post #200

Earlier quoted context omitted.

Would it be possible instead to mitigate this by removing the side-channel: either don't leave any trace in the TLB of the speculative execution, or deny access to the TLB for user mode software?

Unwinding changes to the TLB on every mispredict would have a significant overhead and hurt overall performance. Removing valid data you just cached (speculatively or otherwise) is generally a bad idea. User mode software requires a TLB (unless you want to do a page walk for every single instruction!) Even if you could remove the TLB entirely from the CPU somehow, the attacker could just use the cache or some other m…

Well that's disappointing. Thanks for the explanation!

I never have to worry about such low level details in my day-to-day work, so this is all new to me.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#204

Earlier quoted context omitted.

Speculative exec ruins everything again. I get the performance gainz, but when are we going to get past the formal fallacy that executing any instruction we don't need to based on actual flow is de facto a complete violation of user expectations and therefore completely unsafe to do. Like every lay person I explain speculative execution seems to be able to recognize that a pipeline stall to figure out what a value ac…

> Nowhere on Earth, will you find an organization that will execute both sides of a conditional process requiring hunans to do the work just to throw away the result. Not taken. Speculative execution today (within modern high-end processor) does not execute both sides of a conditional branch. It would indeed be a waste of power and it would be a much more complex micro-architecture. Modern speculative OoO processors…

Looks like I need to go through Patterson and Hennessy again.

As I was fairly sure that as many computations were done as possible in the same cycle with the ditching of "not the case" results on subbsequent cycles, but I'll be the first to admit I haven't synced on the bleeding edge lit recently. And sipping power has become much more of a concern in recent years, do I may be due for a refresh anyway.

My favorite past time if the statistics are to be believed.

Post reply on HN