4 ms·
OK so this might be only partially related, but earlier today I checked out the poc code for spectre and saw that it uses that instruction to discard a cache li
by iforgotpassword 9y ago
OK so this might be only partially related, but earlier today I checked out the poc code for spectre and saw that it uses that instruction to discard a cache line. That reminded me of that performance issue ryzen had after launch in some game I don't remember the name of, which was tracked down to the same instruction for flushing a cache line. In the case of that game, the instruction was for some reason emitted by the vc++ compiler in a tight loop for a variable that was accessed therein. On Intel CPUs that didn't do any harm, because these actually don't evict the line from cache but just mark it as least recently used, while ryzen actually invalidated the cache line and had to repeatedly load the data back from ram.
Back then I already wondered how many valid use cases there are for these kind of instructions, apart from synthetic benchmarks. And even if you can use it to make an algorithm faster, how many times is it used incorrectly because someone just thought it would be better without benchmarking properly, (or because they mess up some compiler).
So my (naive) thought back then was "why not just noop all those cache related instructions in the CPU itself?" Then during 2017 I saw a talk about using these very same instructions for creating a side channel between two VMs in Amazon's cloud, and now this here. I am aware you could still make sure the data is not cached by just thrashing the cache (which would make this attack much slower than it already is) but really, what have these flush and prefetch instructions ever done for us?
- Retr0spectrum 9y agoI think the various flush and prefetch instructions are mainly a vestigial artifact from before modern CPUs got good at cache management. In certain specific conditions, they can be used to increase performance, but these days this is increasingly rare because the hardware cache management is surprisingly intelligent.
- cesarb 9y ago> what have these flush and prefetch instructions ever done for us? Flushing the cache is important when the data must be in the main memory, for instance when an I/O device does DMA to it and is not coherent with the caches. As for prefetch instructions, they are hard to use correctly, but in some cases can make an algorithm much faster.
- iforgotpassword 9y agoGood point, so could we make it "just write back but don't evict", something like fsync() for memory...?
- cesarb 9y agoThat works only for the CPU->device direction. For the device->CPU direction, you have to evict so the next load will get the data the device wrote.
- AnimalMuppet 9y agoIt occurs to me that a better solution, rather than having the CPU know when something else is going to write to the memory, is to have the memory tell the CPU when something else wrote to it. That would take a whole new memory protocol, though, and a new generation of CPU chips to use it...
- david-gpu 9y agoIf you are interested about this sort of thing, I suggest reading "Computer Architecture: A quantitative approach" by Hennessy and Patterson.
- ethbro 9y agoWe used "Computer Organization and Design: the Hardware/Software Interface" (also Hennessy and Patterson) as our comp arch textbook. I'd recommend it (any moderately recent version) for simply learning as well. Learning the internals of everything between memory and functional CPU subunits is fun (and useful). And the ideas don't change that quickly (e.g. the TLB and ROBs that were attacked here have been around for decades in similar form). There's only so many clever things you can do when a one bit buffer is expensive.
- esaym 9y agoWhich edition? I think we used the 3rd edition in our class 5 or so years ago. It would not be something I'd "recommend" but I haven't looked elsewhere ( just assuming there is something better out there)
- angersock 9y agoIt might seem silly to have them with, say, a single core on a single processor--but, consider the case where multiple cores (or dies, or even sockets!) are sharing the same main memory.
- iforgotpassword 9y agoWouldn't that be something the os scheduler had to do, since the process doesn't know when it's moving from one CPU to another? So it could be a privileged instruction.
- rcxdude 9y agoThese instructions are just a more convenient (and faster) way to manipulate the cache. An attacker can still manipulate the cache without these instructions by manipulating their access patterns.