3 ms·

AMD did things the "right" way, not because they understood the security implication, but because it was very hard to achieve such high level of speculation, an

AMD did things the "right" way, not because they understood the security implication, but because it was very hard to achieve such high level of speculation, and I think the performance gains didn't justify the effort for them.

pas 9y ago
How do you know this? I think it's worth noting that it's entirely possible, that if you are a CPU execution pipeline designer that you think about memory loads/stores, L1 cache, branch prediction and speculative execution, and it occurs to you that the cache gets polluted by spec exec, and the branches can be security checks. But the solution is simple. If the branch is important, wait for it. (Load it into L1 cache before the branch - use a memory barrier.) The fact that this is not in any ISA docs is a likely pointer toward the possibility that it in fact hadn't occurred to them. These attacks are the same as any new invention. Easy to see once you've grasped the concept.
pja 9y ago
Have you got a reference for that statement? Because my interpretation of what has been said so far is that AMD deliberately chose not to allow speculative dependent loads that crossed privilege boundaries by enforcing permission checks on all reads whereas Intel chose to permit all loads & rely on the fixup at the retirement stage of the pipeline to enforce privilege boundaries. Happy to be proven wrong however.
- thecompilr 9y ago
  I don't have hard evidence, but A) they are vulnerable to two out of the three attacks, which indicates they did not in fact consider speculative execution a danger B) it is hard to believe that if they researched the topic at AMD, they wouldn't find this vulnerability in Intel processors a long time ago
  - jacksmith21006 9y ago
    They did across priv boundaries which was the point.
  - pja 9y ago
    I note in passing that the AMD processor manual is explicit that all reads are checked against the privilege bit before being issued. It’s this protection that means that AMD processors are not subject to meltdown. All CPU manufacturers appear to have been caught on the hop by Spectre (branch prediction history side channels).

pas 9y ago

How do you know this? I think it's worth noting that it's entirely possible, that if you are a CPU execution pipeline designer that you think about memory loads/stores, L1 cache, branch prediction and speculative execution, and it occurs to you that the cache gets polluted by spec exec, and the branches can be security checks. But the solution is simple. If the branch is important, wait for it. (Load it into L1 cache before the branch - use a memory barrier.) The fact that this is not in any ISA docs is a likely pointer toward the possibility that it in fact hadn't occurred to them. These attacks are the same as any new invention. Easy to see once you've grasped the concept.

pja 9y ago

Have you got a reference for that statement? Because my interpretation of what has been said so far is that AMD deliberately chose not to allow speculative dependent loads that crossed privilege boundaries by enforcing permission checks on all reads whereas Intel chose to permit all loads & rely on the fixup at the retirement stage of the pipeline to enforce privilege boundaries. Happy to be proven wrong however.

thecompilr 9y ago
I don't have hard evidence, but A) they are vulnerable to two out of the three attacks, which indicates they did not in fact consider speculative execution a danger B) it is hard to believe that if they researched the topic at AMD, they wouldn't find this vulnerability in Intel processors a long time ago
- jacksmith21006 9y ago
  They did across priv boundaries which was the point.
- pja 9y ago
  I note in passing that the AMD processor manual is explicit that all reads are checked against the privilege bit before being issued. It’s this protection that means that AMD processors are not subject to meltdown. All CPU manufacturers appear to have been caught on the hop by Spectre (branch prediction history side channels).