※ 引述《bf000777966 (joe)》之铭言：
: LINUS 本人证实苏妈的说法，在新的核心补丁里面排除了AMD的CPU
: "Exclude AMD from the PTI enforcement. Not necessarily a fix, but if AMD is so c
: onfident that they are not affected, then we should not burden users with the ov
: erhead - x86/cpu, x86/pti: Do not enable PTI on AMD processors"
: "AMD processors are not subject to the types of attacks that the kernel page tab
: le isolation feature protects against. The AMD microarchitecture does not allow
: memory references, including speculative references, that access higher privileg
: ed data when running in a lesser privileged mode when that access would result i
: n a page fault."
: Linus Torvalds Trusts Lisa Su's Commitment to AMD CPU Security
: http://go.newsfusion.com/security/item/1108590
Meltdown的原文(PDF论文): https://meltdownattack.com/meltdown.pdf
原理就是利用speculative execution跟out-of-order execution的特性
在产生exception之前赶快把资料读走
论文里还有用intel的TSX隐藏住exception，不让系统发现
6.4 Limitations on ARM and AMD
论文说在AMD跟ARM上虽然也能跑，但是读不出结果
苏妈的说法是他家的CPU禁止任何违法的reference
可信度其实很高(跟论文说的一致)
另一个漏洞叫 Spectre
比meltdown更不直观，也很难patch掉
不过攻击原理很类似(改用机率统计判读)
目前任何有speculative execution的CPU都会中奖
而且要patch的也许不仅是OS而已
一般软件有资安顾虑的都要修改
结论:
Meltdown是重大的漏洞一定要修(至少从第一代的core i就有的)
Spectre也是很大的洞，连手机都会中，不过比较难利用，也很难Patch掉QQ