1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Dismiss Notice

Spectre

Discussion in 'General Discussions' started by Silent-Hunter, Jan 7, 2018.

  1. Silent-Hunter

    Silent-Hunter Advanced Member

    Joined:
    May 29, 2010
    Messages:
    2,529
    Tags:
  2. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    8,355
    Location:
    Somewhere off the coast of the EU
    Most of the information on these boards about this is captured here already: https://pyra-handheld.com/boards/threads/intelpocalypse.82304/

    But it's perhaps worth having a thread for ARM spectre. Unfortunately thus far I've not been able to compile the exploits on my Pandora due to them including some x86 constants at the very least.
     
  3. Letalis Sonus

    Letalis Sonus Very Active Member

    Joined:
    Mar 5, 2009
    Messages:
    916
    Don't worry about the Pandora, it is absolutely immune to those vulnerabilities. The Cortex-A8 has an in-order architecture, it does not use any kind of speculative execution. This kind of prediction mechanism only makes sense on an out-of-order architecture - which is why the early Intel Atoms are not affected as well.
     
  4. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    8,355
    Location:
    Somewhere off the coast of the EU
    That's not what ARM says at the link above. However, I've looked up the second variant of attack that's identified as CVE2018-5715 and desribed by ARM as 'branch target injection'. However, I've looked it up on NIST and there it says it's 'Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.'

    If, as you say the A8 is an in-order processor (I was unable to verify this or disprove it when I last checked) then I don't see how ARM reckons it can affect that processor, but there you go.
     
  5. Letalis Sonus

    Letalis Sonus Very Active Member

    Joined:
    Mar 5, 2009
    Messages:
    916
    Check this Cortex-A comparison on Wikipedia, the Cortex-A9 was the first one to introduce an out-of-order architecture. You can check this on ARM's own product page of the A8 as well. It is the only in-order CPU in that list, maybe they just mixed things up, the Cortex-A8 and its direct offsprings are the only Cortex-A class CPUs with an in-order architecture.

    There's a lot of confusion going on around the whole issue, including Intel doing some serious PR bullshit trying to reduce the impact on their reputation. If you've got an idea about what all of this is about, take a look at their FAQ page about the issue - it cringes the hell out of me. And that one was even created *after* Torvalds ranted about Intel's PR bullshit due to them trying to enable the Meltdown workaround for all x86 CPUs.
     
    levi likes this.
  6. Silent-Hunter

    Silent-Hunter Advanced Member

    Joined:
    May 29, 2010
    Messages:
    2,529
    I'm just wondering what will need to be done to mitigate this on the Pyra. The link mentions some compiler changes, and recompiling code with those.
     
  7. sebt3

    sebt3 homebrew player (P. & C.)

    Joined:
    Sep 9, 2008
    Messages:
    4,699
    Location:
    France
    From us ? Probably just make sure we're using the right configurations options for the kernel.
    Debian have already updated its toolchains even the cross-compiling ones. I havent updated my pyra yet, but i'm pretty sure what need to be recompiled already have been updated by the debian security team
     
    FBnil likes this.
  8. Letalis Sonus

    Letalis Sonus Very Active Member

    Joined:
    Mar 5, 2009
    Messages:
    916
    Apparently there are some corner cases where the Meldown/Spectre issue (or at least something along the same line) may affect in-order architectures as well. The IBM Xenon CPU of the Xbox 360 has a custom prefetch instruction to bypass the L2 cache by making the L1 caches incoherent on purpose in order to save some of the limited L2 space for hardcore game optimizations - this instruction is already very dangerous to use in itself, but they screwed up wiring it up with the branch prediction as well: https://randomascii.wordpress.com/2018/01/07/finding-a-cpu-design-bug-in-the-xbox-360/
     
    FBnil likes this.
  9. hns

    hns Very Active Member

    Joined:
    Jul 16, 2012
    Messages:
    286
    Location:
    Oberhaching
    There is an official document by ARM which says everything we can do: https://developer.arm.com/support/security-update
    It seems as if Cortex A15 is affected but we can't change transistors :)
    So we can only wait until the Linux kernel is hardened.
     
  10. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    8,355
    Location:
    Somewhere off the coast of the EU
    From what little I've picked up thus far, the kernel patches are mainly targetting meltdown flaws, in that they protect the kernel from being read by nasty user processes. There's also spectre flaws that let you e.g. read all RAM including other userspaces, and that ARM advisory seems focussed on those flaws to me.

    But really the news thus far seems mostly designed to confuse anyone trying to work out which of their hardware is flawed and how exactly. I'm hoping the trend will be towards more concrete advice as the weeks go on.
     
  11. lukey

    lukey Rare Species

    Joined:
    Jun 17, 2015
    Messages:
    450
    Location:
    Germany
  12. xnopasaranx

    xnopasaranx Superbad!

    Joined:
    Jan 31, 2006
    Messages:
    3,095
    in related news: a German journalist had apparently not quite understood the magnitude of the issue or what chip design actually means, because why bother to inform yourself before you blabber absurd shit. so she stated her opinion that "the look of the chips apparently is more important than security".
    https://www.watson.ch/amp/!345905102 (article is in German)
    hilarious
     
    JDTAY likes this.

Share This Page

Loading...