3 ms·

I'm disappointed that Intel is getting all the attention here. ARM64 chips like A72 have meltdown/spectre issues too. Chips like the ones the current lineup of

I'm disappointed that Intel is getting all the attention here. ARM64 chips like A72 have meltdown/spectre issues too. Chips like the ones the current lineup of ARM Chromebooks. Nobody is backporting Meltdown fixes to kernel before 4.16(?)[1], Google isn't updating Chrome OS kernel from 4.4 for these Rockchip devices, and that's because the closed source Mali GPU drivers only work on a fixed kernel version: 4.4. Furthermore, a kernel update isn't sufficient, there needs to be an update to the firmware too.[2] I suspect this means the chromebook must be opened, and a write protect screw will need to be removed to flash a new read only BIOS. Intel has 32[3] separate class action lawsuits over this issue. AFAIK, nothing is happening to the companies selling broken hardware, with no fix, or plans to fix. Very disappointed. [1] http://kroah.com/log/blog/2018/01/06/meltdown-status/ http://kroah.com/log/blog/2018/01/06/meltdown-status/ [2] https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update [3]https://arstechnica.com/gadgets/2018/02/32-class-action-suits-filed-against-intel-over-spectre-and-meltdown-flaws/ https://arstechnica.com/gadgets/2018/02/32-class-action-suit...

gruez 9y ago
>ARM64 chips like A72 have meltdown/spectre issues too. meltdown/spectre are two different exploits (as much as intel likes to group the two together distribute blame). meltdown only affects intel.
- jsheard 9y ago
  ARM themselves say that Cortex-A75 is affected by Meltdown, check link [2] in OPs post. > Cortex-A75: Variant 3 (rogue data cache load) - Yes
- chapill 9y ago
  You are wrong. See [2] above. Variant 3a is meltdown. A proof of concept is here, https://github.com/lgeek/spec_poc_arm https://github.com/lgeek/spec_poc_arm I've tried it personally. It is vulnerable.
- rbanffy 9y ago
  Also, the ARM market is much more fragmented, with hundreds of different implementations. This is an excellent article on why the parts used in the Raspberry Pi series are not vulnerable to Spectre: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...
red_phone 9y ago
Are you certain Chromebooks have a read-only BIOS? They recently shipped firmware updates to fix a widespread TPM vulnerability.[1] [1] https://www.chromium.org/chromium-os/tpm_firmware_update#TOC-Chrome-OS-versions-including-the-firmware-update https://www.chromium.org/chromium-os/tpm_firmware_update#TOC...
- chapill 9y ago
  TPM is not the bios. There is a write protect screw in the motherboard of your chromebook. It must be removed to flash the RO BIOS. https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware https://www.chromium.org/chromium-os/developer-information-f...
shasheene 9y ago
> and that's because the closed source Mali GPU drivers only work on a fixed kernel version: 4.4. There's an easy fix: add a fourth ChromeOS software channel (currently there's stable, beta and dev) that ships an image without a GPU blob and with a modern kernel. There are plenty of users willing to disassemble, disable write-protect, flash new firmware and re-enable write-protect. Inconvenience, and disabling hardware acceleration for video decoding is a small price to pay for security.
- chapill 9y ago
  Why not both?.gif https://lwn.net/Articles/738225/ https://lwn.net/Articles/738225/ "It was said that everybody within ARM is in favor of solving the problem by open-sourcing ARM's driver — except for one recalcitrant high-level manager." Now would be a good opportunity to lean on that one person. Chromebooks can run mainline kernel without GPU now. It's just not ChromeOS. And you have to be able to install Arch Linux. And build/install your own kernel from source. There's just a very small fraction of a percent of ChromeOS users interested or even capable of that. https://www.chromium.org/chromium-os/how-tos-and-troubleshooting/mainline-kernel-on-kevin-chromebook-plus https://www.chromium.org/chromium-os/how-tos-and-troubleshoo...

gruez 9y ago

>ARM64 chips like A72 have meltdown/spectre issues too. meltdown/spectre are two different exploits (as much as intel likes to group the two together distribute blame). meltdown only affects intel.

jsheard 9y ago
ARM themselves say that Cortex-A75 is affected by Meltdown, check link [2] in OPs post. > Cortex-A75: Variant 3 (rogue data cache load) - Yes
chapill 9y ago
You are wrong. See [2] above. Variant 3a is meltdown. A proof of concept is here, https://github.com/lgeek/spec_poc_arm https://github.com/lgeek/spec_poc_arm I've tried it personally. It is vulnerable.
rbanffy 9y ago
Also, the ARM market is much more fragmented, with hundreds of different implementations. This is an excellent article on why the parts used in the Raspberry Pi series are not vulnerable to Spectre: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...

red_phone 9y ago

Are you certain Chromebooks have a read-only BIOS? They recently shipped firmware updates to fix a widespread TPM vulnerability.[1] [1] https://www.chromium.org/chromium-os/tpm_firmware_update#TOC-Chrome-OS-versions-including-the-firmware-update https://www.chromium.org/chromium-os/tpm_firmware_update#TOC...

chapill 9y ago
TPM is not the bios. There is a write protect screw in the motherboard of your chromebook. It must be removed to flash the RO BIOS. https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware https://www.chromium.org/chromium-os/developer-information-f...

shasheene 9y ago

> and that's because the closed source Mali GPU drivers only work on a fixed kernel version: 4.4. There's an easy fix: add a fourth ChromeOS software channel (currently there's stable, beta and dev) that ships an image without a GPU blob and with a modern kernel. There are plenty of users willing to disassemble, disable write-protect, flash new firmware and re-enable write-protect. Inconvenience, and disabling hardware acceleration for video decoding is a small price to pay for security.

chapill 9y ago
Why not both?.gif https://lwn.net/Articles/738225/ https://lwn.net/Articles/738225/ "It was said that everybody within ARM is in favor of solving the problem by open-sourcing ARM's driver — except for one recalcitrant high-level manager." Now would be a good opportunity to lean on that one person. Chromebooks can run mainline kernel without GPU now. It's just not ChromeOS. And you have to be able to install Arch Linux. And build/install your own kernel from source. There's just a very small fraction of a percent of ChromeOS users interested or even capable of that. https://www.chromium.org/chromium-os/how-tos-and-troubleshooting/mainline-kernel-on-kevin-chromebook-plus https://www.chromium.org/chromium-os/how-tos-and-troubleshoo...