4 ms·
> The mitigation locks the entire memory bus before updating the staging buffer and only unlocks it after clearing its content. Entire memory bus as in entire
by Dunedan 6y ago
> The mitigation locks the entire memory bus before updating the staging buffer and only unlocks it after clearing its content.
Entire memory bus as in entire access to any kind of shared memory (shared CPU caches, RAM, ...)? If yes, wow, that's a pretty desperate mitigation. Doesn't that starve large parts of the whole CPU whenever an affected, but mitigated instruction is executed, as all other cores can't interact with memory anymore for the duration of this execution? Doesn't that also open the ability to "DoS" CPUs by constantly executing such instructions?
- 0x0 6y agoHmm, now I wonder if this could turn into a F00F-like bug? What would LOCK REP RDRAND or just REP CPUID do...
- strstr 6y agoYou can still acknowledge interrupts in between, so hardware watchdogs will prevent this.
- the8472 6y agoYou can already do that with split locks, which also lock the memory bus.
- rigtorp 6y agoYeah, split locks have a huge performance impact, especially with high core counts: https://rigtorp.se/split-locks/ https://rigtorp.se/split-locks/ Fortunately the Linux kernel can kill offenders with SIGBUS: https://www.phoronix.com/scan.php?page=news_item&px=Linux-Split-Locks-Detection https://www.phoronix.com/scan.php?page=news_item&px=Linux-Sp...
- avianes 6y ago> Entire memory bus as in entire access to any kind of shared memory (shared CPU caches, RAM, ...)? I guess this is the only solution for Intel (apart from an hardware fix) as one core doesn't have control over the loads of another core.
- JoachimS 6y agoExactly what I wonder too. Can't the fix be used as an attack vector. At least infer disruptions to trigger timeout events, add execution time variance. And wouldn't you be able to detect RdRand instruction execution for (for example) key generation. Pinpointing when processes perform sensitive operations. And, would it be possible to use RdRand execution as a time based exfiltration channel? Run a timing loop in one process on one core. Use RdRand reading with different frequency in a second process to (using morse code or similar) to encode information. The first process use its timing loop to recover the information.
- deleted 6y ago[deleted]