|
@danluu | |||||
|
The Google Chromium team banning our CPUs is especially ironic in retrospect since they cited security concerns.
At the time, we were mostly shipping in-order CPUs, not vulnerable to Metldown/Spectre/etc. and of course Intel is the most vulnerable these.
twitter.com/danluu/status/…
|
||||||
|
||||||
|
Dan Luu
@danluu
|
7. pro |
|
This kind of thing is why the CPU startup I worked for allowed users to change the CPUID: you get huge performance gains from putting GenuineIntel in CPUID(0), but it would be a copyright violation to distribute our CPU with GenuineIntel in the CPUID
pugetsystems.com/labs/hpc/How-T… pic.twitter.com/HRduiSyypU
|
||
|
|
||
|
Dan Luu
@danluu
|
7. pro |
|
That post blames Intel, but it's not just them. NaCl forcibly crashed (and Google refused our trivial fix!!!), random drivers wouldn't work, you had to get a patched Windows installer for multiple releases of Windows (difficult in the days of CD installers), etc.
|
||
|
|
||
|
Dan Luu
@danluu
|
9. pro |
|
BTW, if you want to try CPUID spoofing without virtualization and have a VIA processor, Agner Fog wrote this little utility:
agner.org/optimize/blog/…
Performance delta on benchmarks varies, here's an example of a ~50% gain (47%):
arstechnica.com/gadgets/2008/0… pic.twitter.com/gLK1cESeRz
|
||
|
|
||
|
Tavis Ormandy
@taviso
|
8. pro |
|
The security of NaCL required accurately predicting controlflow, and confidence it would work in adversarial conditions (e.g. someone trying to induce faults, undocumented opcodes, etc.). I said it seemed prudent to whitelist cpus we had tested, I stand by that. 🤷🏻♂️
|
||
|
|
||
|
Tavis Ormandy
@taviso
|
8. pro |
|
If someone overclocks their cpu, and an attacker does some x87 operation in a tight loop for a few minutes, how confident are you a branches won't be miscalculated? Usually no security consequences for this, so vendors didn't test, It worried me 🤷🏻♂️e.g. devblogs.microsoft.com/oldnewthing/20…
|
||
|
|
||
|
Sven Slootweg @ 36C3
@joepie91
|
8. pro |
|
Clearly the correct solution would have been to take a page from the browser book, and call your CPU "AuthenticAMD (like GenuineIntel)"!
|
||
|
|
||
|
Daniel Bilar
@daniel_bilar
|
8. pro |
|
@threadreaderapp kindly unroll
|
||
|
|
||
|
Thread Reader App
@threadreaderapp
|
8. pro |
|
Halo!, you can read it here: Thread by @danluu: This kind of thing is why the CPU startup I worked for allowed users to change the CPUID: you get… threadreaderapp.com/thread/1203450…. Share this if you think it's interesting. 🤖
|
||
|
|
||
|
Marsh Ray
@marshray
|
8. pro |
|
Did your CPU recognize any special opcodes, or in any way handle EIP differently?
It’s hard to prove a negative. I think I would have made the same call.
|
||
|
|
||
|
Andrew Bingham
@marsman2020
|
8. pro |
|
Let's make Google the gatekeepers of more stuff, that will be great.
|
||
|
|
||