4 ms·

Oof. The Cortex-A75 has a hardware security bug before any silicon with it has been released. On the other hand, this luckily means that software mitigations ca

by DCKing 9y ago

Oof. The Cortex-A75 has a hardware security bug before any silicon with it has been released. On the other hand, this luckily means that software mitigations can be included before release. Luckily for most unpatched Android phones, they use Cortex A53 and Cortex A7 in-order chips which are not affected because they lack the speculative execution required for this vulnerability.

Symmetry 9y ago
Cortex A53 certainly have speculative execution because they have branch predictors. The branch predictor of the A53 is probably the most sophisticated thing about it and other in-order ARM cores like the A8 are vulnerable. But apparently something about the A53 design prevents speculating of indirect loads making them safe.
- fulafel 9y ago
  Speculative execution in computer architecture terminology is reserved for speculating past branches.
  - Symmetry 9y ago
    Yes, and the A53 speculatively executes past branches, otherwise there's little point in having a branch predictor. The difference between it and an out of order processor is that the depth of speculation is limited by the pipeline length rather than the reorder buffer. EDIT: The pipeline layout severely constrains what sort of speculation can happen and, thinking about it more, I'm really surprised that the A8 can finish load and issue a second one before the mis-speculated branch is resolved and the loads are quashed. EDIT2: Well, that's not the only difference obviously. The big one that makes a processor in order versus out of order is whether a stalled instruction causes all subsequent instructions in the stream to stall or just ones with data dependencies on it. But the problem of quashing bad instructions is shared by all processors that are pipelined and which can throw exceptions, not just those that continue speculatively issuing past predicted branches.
    - fulafel 9y ago
      I'm not familiar with the A53, maybe it is some kind of hybrid, but certainly there are branch predictors in pipelined in-order superscalar processors that don't speculate past branches, like Pentium or 21064. The advantage is that a correctly predicted branch can be executed quickly and the following instruction can be fetched & decoded. This doesn't yet require register renaming, reservation stations etc.
      - Symmetry 9y ago
        I think we have a conflict of definition? I would call instruction fetch and decode behind an unresolved branch speculation. If you have a machine with a single execution stage which can't issue instructions in parallel with the branch then of course you can't have these speculated instructions execute because whether they are valid will always be resolved before they get to the execution or writeback stages. But the mechanics of putting instructions into the pipeline on the basis of speculation and quashing them if the branch resolves differently than predicted is the same and re-use the same hardware mechanisms that handle exceptions, making the speculative issuing of instructions a clear win from a design perspective. It's the details of the pipeline that determine whether it's possible to trigger the Spectre vulnerability before the branch resolves. Register renaming isn't required for speculation and you can even design out of order micro architectures without it. On an in-order processor you just have to make sure that writeback occurs after the branch is resolved and just flush the pipeline above the branch if the branch resolves incorrectly. No need to mess about with checkpoints because the register state is always valid. Well, there are some considerations with store commands too if you're using superscalar execution but it's still pretty easy. But again, these are all mechanisms you need in any event because your processor has to deal with interrupts that might be thrown at any moment by external triggers or memory faults. EDIT: I suppose it's possible in theory that you could look at an upcoming branch, predict how it will resolve, and then fetch the relevant instruction data into your instruction cache. But I'd tend to call that an instruction pre-fetcher by analogy to the data pre-fetcher eveyone uses rather than a branch predictor. And I'm not aware of anyone every having done that.
        9y ago

by DCKing 9y ago

Symmetry 9y ago

Cortex A53 certainly have speculative execution because they have branch predictors. The branch predictor of the A53 is probably the most sophisticated thing about it and other in-order ARM cores like the A8 are vulnerable. But apparently something about the A53 design prevents speculating of indirect loads making them safe.

fulafel 9y ago
Speculative execution in computer architecture terminology is reserved for speculating past branches.
- Symmetry 9y ago
  Yes, and the A53 speculatively executes past branches, otherwise there's little point in having a branch predictor. The difference between it and an out of order processor is that the depth of speculation is limited by the pipeline length rather than the reorder buffer. EDIT: The pipeline layout severely constrains what sort of speculation can happen and, thinking about it more, I'm really surprised that the A8 can finish load and issue a second one before the mis-speculated branch is resolved and the loads are quashed. EDIT2: Well, that's not the only difference obviously. The big one that makes a processor in order versus out of order is whether a stalled instruction causes all subsequent instructions in the stream to stall or just ones with data dependencies on it. But the problem of quashing bad instructions is shared by all processors that are pipelined and which can throw exceptions, not just those that continue speculatively issuing past predicted branches.
  - fulafel 9y ago
    I'm not familiar with the A53, maybe it is some kind of hybrid, but certainly there are branch predictors in pipelined in-order superscalar processors that don't speculate past branches, like Pentium or 21064. The advantage is that a correctly predicted branch can be executed quickly and the following instruction can be fetched & decoded. This doesn't yet require register renaming, reservation stations etc.
    - Symmetry 9y ago
      I think we have a conflict of definition? I would call instruction fetch and decode behind an unresolved branch speculation. If you have a machine with a single execution stage which can't issue instructions in parallel with the branch then of course you can't have these speculated instructions execute because whether they are valid will always be resolved before they get to the execution or writeback stages. But the mechanics of putting instructions into the pipeline on the basis of speculation and quashing them if the branch resolves differently than predicted is the same and re-use the same hardware mechanisms that handle exceptions, making the speculative issuing of instructions a clear win from a design perspective. It's the details of the pipeline that determine whether it's possible to trigger the Spectre vulnerability before the branch resolves. Register renaming isn't required for speculation and you can even design out of order micro architectures without it. On an in-order processor you just have to make sure that writeback occurs after the branch is resolved and just flush the pipeline above the branch if the branch resolves incorrectly. No need to mess about with checkpoints because the register state is always valid. Well, there are some considerations with store commands too if you're using superscalar execution but it's still pretty easy. But again, these are all mechanisms you need in any event because your processor has to deal with interrupts that might be thrown at any moment by external triggers or memory faults. EDIT: I suppose it's possible in theory that you could look at an upcoming branch, predict how it will resolve, and then fetch the relevant instruction data into your instruction cache. But I'd tend to call that an instruction pre-fetcher by analogy to the data pre-fetcher eveyone uses rather than a branch predictor. And I'm not aware of anyone every having done that.
      - 9y ago