3 ms·

> Intel has developed and is rapidly issuing updates for all types of Intel-based computer systems — including personal computers and servers — that render tho

by 317070 9y ago

> Intel has developed and is rapidly issuing updates for all types of Intel-based computer systems — including personal computers and servers — that render those systems immune from both exploits (referred to as “Spectre” and “Meltdown”) reported by Google Project Zero. Now I really wonder how they managed to patch both? Does someone know how you could patch something like that from Intel's side of things?

userbinator 9y ago
https://en.wiktionary.org/wiki/chicken_bit https://en.wiktionary.org/wiki/chicken_bit The first example usage given there is very illustrative: As an example, modules such as branch predictors and speculative execution units can be turned off with a variant of the “chicken bits”, control bits common to many design developments to control the activation of specific features.
- Ajedi32 9y ago
  I kinda doubt they'd be able to turn off branch prediction and speculative execution entirely and still be able to claim that > the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant
  - joeyh 9y ago
    If your workload does not branch, no performance impact AND Average user's computer is mostly idle = Above intentionally misleading PR statement.
  - bsdetector 9y ago
    All they have to do is disable memory fetching during speculative execution so there's no side effects. That probably wouldn't affect performance much, and some unusual workloads might even get faster.
herf 9y ago
Lenovo released a BIOS update[1] more than two weeks ago that mentioned CVE-2017-5715 (Spectre-related CVE). [1] https://support.lenovo.com/us/en/downloads/ds035965 https://support.lenovo.com/us/en/downloads/ds035965 for example
terom 9y ago
There's also an INTEL-SA-00088 which implies that it's only addressing the meltdown vulnerabilities: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE... > Other variants of this side-channel analysis are being addressed by Operating System and Software Vendors. For more details see: > - CVE-2017-5753 https://01.org/security/advisories/intel-oss-10002 https://01.org/security/advisories/intel-oss-10002 > - CVE-2017-5754 https://01.org/security/advisories/intel-oss-10003 https://01.org/security/advisories/intel-oss-10003 Although I think the CVEs on those two are off... based on the titles, INTEL-OSS-10003 should really be CVE-2017-5715? Both of those "other variants being addressed by Operating System and Software Vendors" issues are Spectre, not Meltdown...

by 317070 9y ago

userbinator 9y ago

https://en.wiktionary.org/wiki/chicken_bit https://en.wiktionary.org/wiki/chicken_bit The first example usage given there is very illustrative: As an example, modules such as branch predictors and speculative execution units can be turned off with a variant of the “chicken bits”, control bits common to many design developments to control the activation of specific features.

Ajedi32 9y ago
I kinda doubt they'd be able to turn off branch prediction and speculative execution entirely and still be able to claim that > the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant
- joeyh 9y ago
  If your workload does not branch, no performance impact AND Average user's computer is mostly idle = Above intentionally misleading PR statement.
- bsdetector 9y ago
  All they have to do is disable memory fetching during speculative execution so there's no side effects. That probably wouldn't affect performance much, and some unusual workloads might even get faster.

herf 9y ago

Lenovo released a BIOS update[1] more than two weeks ago that mentioned CVE-2017-5715 (Spectre-related CVE). [1] https://support.lenovo.com/us/en/downloads/ds035965 https://support.lenovo.com/us/en/downloads/ds035965 for example

terom 9y ago

There's also an INTEL-SA-00088 which implies that it's only addressing the meltdown vulnerabilities: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE... > Other variants of this side-channel analysis are being addressed by Operating System and Software Vendors. For more details see: > - CVE-2017-5753 https://01.org/security/advisories/intel-oss-10002 https://01.org/security/advisories/intel-oss-10002 > - CVE-2017-5754 https://01.org/security/advisories/intel-oss-10003 https://01.org/security/advisories/intel-oss-10003 Although I think the CVEs on those two are off... based on the titles, INTEL-OSS-10003 should really be CVE-2017-5715? Both of those "other variants being addressed by Operating System and Software Vendors" issues are Spectre, not Meltdown...