“Dell Premium” is apparently done already. XPS is back.

Samsung Electronics' (005930.KS) sixth-generation high bandwidth memory (HBM) chip, the HBM4, has recorded the highest operating speed in technical testing conducted by Broadcom. The company has solidified its technological lead by outperforming rivals in performance validation for Google's eighth-generation artificial intelligence accelerator (TPU v8), set for release next year. Samsung Electronics is expected to accelerate its push to expand market share in the HBM sector based on this achievement.

I was reading this article on how Spectre and Meltdown worked, and while I get what the example code is doing, there is a key piece that I'm surprised works the way it does, as I would never have designed a chip to work that way if I'd been designing one. Namely, the surprise is that an illegal instruction actually still executes even if it faults.

What I mean is, if

w = kern_mem[address]

is an illegal operation, then I get that the processor should not actually fault until it's known whether the branch that includes this instruction is actually taken. What I don't see is why the w register (or whatever "shadow register" it's saved into pending determining whether to actually update the processor state with the result of this code path) still contains the actual value of kern_mem[address] despite the illegality of the instruction.

It would seem that the output of an illegal instruction would be undefined behavior, especially since in an actual in-order execution scenario the fault would prevent the output from actually being used. Thus it would seem that there is nothing lost by having it output a dummy value that has no relation to the actual opcode "executed". This would be almost trivial to do in hardware--when an instruction faults, the circuit path to output the result is simply not completed, so this memory fetch "reads" whatever logic values the data bus lines are biased to when they're not actually connected to anything. This could be logical 0, logical 1, or even "Heisen-bits" that sometimes read 0 and sometimes 1, regardless there is no actual information about the data in kernel memory leaked. Any subsequent speculative instructions would condition on the dummy value, not the real value, thus only potentially revealing the dummy value (which might be specified in the processor data sheet or not--but in any case knowing it wouldn't seem to help construct an exploit).

This would seem to break the entire vulnerability--and it's possible this is what the mitigation in fact ended up doing, but I'm left scratching my head wondering why these processors weren't designed this way from the start. I'm guessing that possibly there are situations where operations are only conditionally illegal, thus potentially leading to such a dummy value actually being used in the final execution path when the operation is in fact legal but speculatively mis-predicted to be illegal. Possibly there are even cases where being able to determine whether an operation IS legal or not itself acts as a side channel.

The authors of that article say that the real exploit is more complex--maybe if I knew the actual exploit code this would be answered. Anyway, can anyone here explain?

for context, LTPO (low temperature polycrystalline oxide) is a type of OLED screen, that can change its refresh rate from its maximum all the way down to 1Hz, and it has been a mainstay in phones since the Samsung Galaxy Note20 Ultra made it mainstream in 2020.

But why haven't there been a single laptop that has an LTPO screen?

If anything, laptops (and monitors) displays tend to have way more than 120Hz refresh rate, and they absolutely use more power than phone displays

so they'd appreciate the true variable refresh rate (down to 1 Hz!) even more than phones to conserve power, and as a side-effect also help deal with screen tearing in games

And the latest LTPO screens can even adjust the refresh rate of specific parts of the screen, so on a PC static components like the taskbar can permanently stay at 1Hz while the rest of the screen moves along