Spectre and Meltdown

Back in early January, just as APC Towers was coming back to life following the summer break, stories began to break about a pair of far-reaching CPU vulnerabilities. As we rubbed our collective bleary eyes, unsure if we were still sleeping off those festive excesses, more details began to emerge: 20 years of chips from Intel, AMD and ARM were affected, there would be no simple remedy, patches were not ready. Spectre and Meltdown, as they were termed, had been kept under wraps for months while researchers scrambled to put together a fix.

Spectre abuses a CPU feature known as branch prediction, which speculatively executes branches of code even though the results may not be required. The idea is if those results aren’t needed then they can just be thrown away with minimal wasted effort (speculation is scheduled to not get in the way of other computations) and if those results do turn out to be needed then we’re winning. The effect at the heart of Spectre is that this branch prediction can be gamed, and that by carefully timing subsequent computations (to see if their results were already cached, having already been speculatively executed) potentially privileged information can be gleaned. So the ghost (spectre) with a stick (branch) logo is pretty inspired.

Several Spectre variants have since been discovered, and it’s widely accepted that patches to compilers and kernels, and even microcode and firmware updates are merely piecemeal workarounds. Nothing short of a hardware redesign will squash the weakness entirely. Speculative and eager execution have been vital in getting processors to perform as fast as they do, but this speed has come at a price.