3 ms·

Having the source for anything in the cpu here won't help when the architecture design itself is at issue. If you have to respin new silicon, all the software i

Having the source for anything in the cpu here won't help when the architecture design itself is at issue. If you have to respin new silicon, all the software in the world won't help you. Ever see a wire on pcb boards going from one end of the board to another? Thats the hardware equivalent of a: "we can't fix this properly, but we can hack a fix on until we can fix it right in the next revision" hack.

BuildTheRobots 9y ago
Without wanting to side track the the conversation too much, I'm guessing I'm right in my assumption that implementing x86 cores on an FPGA (so we can add wire traces to the cpu after the fact) is still way to slow and expensive to even be close to a reality?
- monocasa 9y ago
  Yeah, for something like a modern x86 core, you'd need something like this. https://www.cadence.com/content/cadence-www/global/en_US/home/tools/system-design-and-verification/acceleration-and-emulation/palladium-z1.html https://www.cadence.com/content/cadence-www/global/en_US/hom... It'll cost you ~$1M and run at a few MHz.
- mitchty 9y ago
  Correct, FPGA simulation of a 3.0Ghz processor means you'd be waiting on the order of weeks to boot into linux. I work for a company that works with Intel on new things. Lets just say the FPGA's they use are... really expensive, and despite being capable of simulating a design fast, are still very slow. By expensive I found out $20 million per FPGA simulator was on the low end. And I think that would simulate at the rate of about 10mhz for the amount of transistors/internal setup present. Fpgas are cool, but a poor choice for fixing this issue. You could probably do it for up to an 80386 with some $400ish dollar FPGA's.
  - BuildTheRobots 9y ago
    Weeks! - Thank you, I knewit was slower, but that's such an order of magnitude slower I don't even know how to calculate it :)
    - mitchty 9y ago
      Processor bring up is fun to learn about, then you learn you don't want to know how that sausage is made any longer. >.<
mmjaa 9y ago
These CVE's have been exploitable for a long time. This is the first open discovery of this golden key to every single computer, everywhere .. but there has been ample time for this to have been catastrophic. If Intel were open about yes, even the microcode, maybe we would've seen this issue sooner - more openly. What we have is paltry in comparison to the way it would be if, in a Stallman universe, software was 100% open, always.
- joosters 9y ago
  That's just not true. Having access to the microcode isn't going to help you here, there won't be a line of code you can point to and say 'this is a bug!' Rather, it's the assumptions that all chip-makers have chosen that were wrong, and those choices have been out in the open and known about for all this time. No-one was demanding that speculative execution should be hardened against timing attacks because no-one had discovered that timing attacks were even possible.
ealexhudson 9y ago
We're talking about microcode here - this isn't a question of hardware. If AMD can fix something like this, Stallman would say the end user should be able to as well. He has a point, and the number of useless IoT devices we're already seeing is testament to that fact.

BuildTheRobots 9y ago

Without wanting to side track the the conversation too much, I'm guessing I'm right in my assumption that implementing x86 cores on an FPGA (so we can add wire traces to the cpu after the fact) is still way to slow and expensive to even be close to a reality?

monocasa 9y ago
Yeah, for something like a modern x86 core, you'd need something like this. https://www.cadence.com/content/cadence-www/global/en_US/home/tools/system-design-and-verification/acceleration-and-emulation/palladium-z1.html https://www.cadence.com/content/cadence-www/global/en_US/hom... It'll cost you ~$1M and run at a few MHz.
mitchty 9y ago
Correct, FPGA simulation of a 3.0Ghz processor means you'd be waiting on the order of weeks to boot into linux. I work for a company that works with Intel on new things. Lets just say the FPGA's they use are... really expensive, and despite being capable of simulating a design fast, are still very slow. By expensive I found out $20 million per FPGA simulator was on the low end. And I think that would simulate at the rate of about 10mhz for the amount of transistors/internal setup present. Fpgas are cool, but a poor choice for fixing this issue. You could probably do it for up to an 80386 with some $400ish dollar FPGA's.
- BuildTheRobots 9y ago
  Weeks! - Thank you, I knewit was slower, but that's such an order of magnitude slower I don't even know how to calculate it :)
  - mitchty 9y ago
    Processor bring up is fun to learn about, then you learn you don't want to know how that sausage is made any longer. >.<

mmjaa 9y ago

These CVE's have been exploitable for a long time. This is the first open discovery of this golden key to every single computer, everywhere .. but there has been ample time for this to have been catastrophic. If Intel were open about yes, even the microcode, maybe we would've seen this issue sooner - more openly. What we have is paltry in comparison to the way it would be if, in a Stallman universe, software was 100% open, always.

joosters 9y ago
That's just not true. Having access to the microcode isn't going to help you here, there won't be a line of code you can point to and say 'this is a bug!' Rather, it's the assumptions that all chip-makers have chosen that were wrong, and those choices have been out in the open and known about for all this time. No-one was demanding that speculative execution should be hardened against timing attacks because no-one had discovered that timing attacks were even possible.

ealexhudson 9y ago

We're talking about microcode here - this isn't a question of hardware. If AMD can fix something like this, Stallman would say the end user should be able to as well. He has a point, and the number of useless IoT devices we're already seeing is testament to that fact.