12 ms·
AMD ships microcode update to disable some branch prediction
- jacksmith21006 9y agoDoes any of the big cloud providers offer AMD instances?
- hlandau 9y agoThis seems to contradict the previous assertions that AMD CPUs aren't affected.
- Pr0ject217 9y agoExactly what I was thinking...
- AngeloR 9y agoBranch prediction is related to the Spectre attack. I believe AMD is only unaffected by Meltdown.
- dogma1138 9y agoDisabling branch prediction isn't mitigation it is effectively a recall without having to worry about logistics because if you disable branch prediction completely you might as well throw Zen based CPUs to the trash. I really hope that this is just poor wording and that branch prediction is either disabled in extremely rare circumstances or they just exposed some control mechanism like Intel did which allows you to control the branching. EDIT: AMD's response was that mitigation from their side isn't needed for SPECTRE either: http://www.guru3d.com/news-story/amd-rsponds-on-amd-processor-security-status.html http://www.guru3d.com/news-story/amd-rsponds-on-amd-processo... I really wonder what has changed, and if now they are vulnerable to variant 2, have they underestimated MELTDOWN as well? I'm also looking forward for people to look into the victim cache that AMD has implemented with Zen and if InfinityFabric and the added latency between CCXs can't be exploited for side channels attacks.
- AngeloR 9y agoI might be reading that link wrong, but it looks like it says that Variant 2 is a possibility, just not demonstrated yet. This may be preemptive on their end.. or maybe they were able to replicate it in-house.
- ars 9y agoThat's because those previous assertions were incorrect. AMD is not affected by Meltdown, true, but Meltdown is also easier to fix. The other issues do affect AMD, and are MUCH harder to fix (also harder to use it should be pointed out). Meltdown was disclosed first, so everyone was excited to bash Intel. But that was premature.
- anfilt 9y agoIntel is affected by spectre as well though.
- deleted 9y ago[deleted]
- dogma1138 9y agoWait AMD had to disable branch prediction completely on 17h (Zen)?!
- dvt 9y agoI'm also confused. Disabling all branch prediction would obliterate performance.
- srcmap 9y agoLove to see actual benchmark results from this with various applications - databases, network stack, apache, ngnix, etc.
- apetresc 9y agoPhoronix is doing a ton of very thorough benchmarking for a variety of software. So far just on Intel CPUs but he will surely get to AMD too.
- AstralStorm 9y agoWhat they added is a magic switch that disables indirect prediction across context switch and kernel half of memory space from non privileged cobtext. It is done somewhat as a hack. Overhead on system calls should be relatively low still.
- deleted 9y ago[deleted]
- CoolGuySteve 9y agoMaybe I'm misunderstanding something. I thought the attack was from returning from a fault and reading back cached data from before the fault. So the branch predictor only needs to be cleared after any interrupt or syscall return.
- kbwt 9y agoRead up on the "out of bounds" and "indirect branch" variants. Spectre doesn't have much to do with mode switches.
- bzbarsky 9y agoThere are at least three separate attacks involved, and the reporting has been pretty confusing. See http://robert.ocallahan.org/2018/01/meltdownspectre-needs-better-disclosure.html http://robert.ocallahan.org/2018/01/meltdownspectre-needs-be...
- binaryapparatus 9y agoThis is all getting rather silly, right? I was the first one to mock Richard Stallman for being too radical, dramatic and paranoid but I can now confirm he wasn't. Every word he said in last 15 or so years is true. This all simply makes all our IT related work just kids playing make-pretend security. I am literally trying to figure out what other processors exist that can be used in everyday BSD/Linux work. Sparc? Some ARM branch? Any suggestions welcome.
- ThinkBeat 9y agoCame here to say the same thing. Richard Stallman was right and I wish we would learn to listen but I doubt that will happen.
- sp332 9y agoThis problem was discoverable for the last 20 years. Of all the confidential tech that goes into a CPU, this wasn't it.
- smacktoward 9y agoSo the question becomes, why didn't anyone discover it?
- usrusr 9y agoToo good to be shared perhaps? I don't like this conspiracy theory way of thinking, but post-Snowden it's difficult to draw a line.
- SAI_Peregrinus 9y agoBecause it's difficult. Sure, it's obvious in hindsight, but it's a flaw in a small part of a very large and complex system.
- pkaye 9y agoWhat happened to all the theorem proving software that are supposed to absolutely guarantee correctness of code. I guess they are only as accurate as the assumptions input into them?
- AnssiH 9y agoThis related RHEL article contains some information about the various mitigations they use (PTI, IBRS, IBPB, i.e. Page Table Isolation, Indirect Branch Restricted Speculation, and Indirect Branch Prediction Barriers) and their relation to the Intel and AMD microcode updates: https://access.redhat.com/articles/3311301 https://access.redhat.com/articles/3311301 It does not really answer all my questions about the microcode updates, but I have not seen any more comprehensive writeups yet.
- JdeBP 9y agoYou might want to visit https://news.ycombinator.com/item?id=16079910 https://news.ycombinator.com/item?id=16079910 .
- matthewmacleod 9y agoThis is surely a misunderstanding - the Zen pipeline is 19 stages deep, and disabling branch prediction would utterly destroy performance.
- dralley 9y agoMy understanding is that it only disables indirect branch prediction, and only within the Kernel. Could be wrong, though.
- matthewmacleod 9y agoRighto, that makes some more sense. Still going to be awful for performance though!
- dralley 9y agoSo will the Intel IBRS patches. >99% branch prediction accuracy -> 77% accuracy from what I've heard.
- gameshot911 9y agoAs a consumer, will I have the ability to avoid using or disable the IBRS patches? To be honest I don't really care about some theoretical attack that almost certainly won't be used to target me, and if they do, they can have it. I'd rather have the performance.
- br1 9y agoIf everybody else is patched, bad buys don't have much incentive to write attacks. It's herd immunity. You have chosen no to vaccinate.
- rorosaurus 9y agohttps://en.wikipedia.org/wiki/Herd_immunity#Free_riding https://en.wikipedia.org/wiki/Herd_immunity#Free_riding
- faragon 9y agoI hope that's related to some specific branch prediction type, and not disabling branch prediction completely. I.e. if it is not a mistake in the SUSE comment, it could be painful: branch prediction is fundamental for modern OooE CPUs delivering their potential.
- bratao 9y agoThis can´t be true. Disabling branch prediction would completely destroy the CPU performance
- tomc1985 9y agoWould be pretty funny if it were
- std_throwaway 9y agoExcept we're living inside the joke like goldfish in a glass.
- deleted 9y ago[deleted]
- deepnotderp 9y agoWhat. The. Fuck. I never thought I'd see this headline in my life.
- sulam 9y agoIt’s wrong (at time of comment).
- jcadam 9y agoWell, I was feeling nostalgic for the goold ol' days of computing. Looks like we'll be living them again soon. Perhaps that smurftower PowerMac G3 tucked into the back of the closet that's been gathering dust will be useful again.
- ztjio 9y agoIt's affected by the bug and will never be patched.
- jcadam 9y agoDamn (though the G3 has a fairly short pipeline if memory serves), how far back do I need to go? I may have an old Amiga 500 somewhere around here...
- Macha 9y agoYou can get a Pentium 1. Or a 2012 Atom.
- hawski 9y agoOr you can buy AMD Zen and use it with branch prediction disabled ;)
- arcticbull 9y agoG3/750 have a 4-stage pipeline [1]. They were really cool chips actually, they used them in the GameCube (the 750CXe). [1] https://arstechnica.com/features/2004/10/ppc-2/ https://arstechnica.com/features/2004/10/ppc-2/
- planteen 9y agoThe RAD750 PPC (radiation hardened variant) is also used in a ton of satellites. It was state of the art until about a year ago for space.
- 9y ago
- deleted 9y ago[deleted]
- dmitrygr 9y ago> AMD ships microcode update to disable branch prediction Mods, please fix the title. The patch adds ability to disable indirect branch prediction sometimes. This is not nearly the same as disabling all branch prediction always.
- anarazel 9y agodang: ^
- derekp7 9y agoFrom what I understand of this set of bugs, is that code executed by the branch prediction logic can access privileged memory that it normally wouldn't have access to. And that the CPU can't generate a protection fault, because it isn't known at that time if the code really would have tried to access that memory. So would it be possible (through a microcode update) to mask the memory values, so that ANY read from privileged gets a NULL value returned? Or could that cause issues, due to the fact that a branch that doesn't currently have access to a memory segment, may be granted legitimate access to it by the time it would normally be executed?
- simcop2387 9y agoA fence of some kind that stops the speculation on access to protected address space would be better. Trying to stub out values would mean you have to throw the speculation out anyway, and a fence could be setup to prevent access. This might still allow an attack on kaslr since you could use the timing of the speculation to determine if a fence got hit or not.
- AstralStorm 9y agoIt it's just one of timing attacks possible on x86. Cache miss timing has been used in the past to create covert channels and exfiltrate keys. Memory controller issues have been explored too. Modern general purpose CPUs sacrificed some security for performance. There are few security or performance guarantees. It is not an architecture geared to realtime and fully deterministic operation.
- akira2501 9y ago> Modern general purpose CPUs sacrificed some security for performance. I don't think that's a fair way of stating it. I think it's a case of independent performance improvements in branch prediction, cache architecture and out-of-order instruction retirement that on their own have negligible security impact but when combined in a single system reveal emergent behavior.
- deepnotderp 9y ago
- taspeotis 9y agoI've heard back from AMD.... At least this PR person is saying: . “Disabling branch prediction” is definitely not an accurate description and we are working to address with SUSE now. https://www.phoronix.com/forums/forum/phoronix/general-discussion/999103-more-linux-kernel-gcc-patches-come-out-in-the-wake-of-spectre-meltdown/page4 https://www.phoronix.com/forums/forum/phoronix/general-discu...
- seriouslydoode 9y agoHere's the openSUSE/kernel-source/commit in question: https://github.com/openSUSE/kernel-source/commit/14b04164b2ff91035a9a8f4672f4d86b929697ce https://github.com/openSUSE/kernel-source/commit/14b04164b2f... Search for amd.com for AMD related changes.
- taspeotis 9y ago114 changed files with 12,403 additions and 23 deletions. That's a pretty big patch (although some of those lines are .patch file pre- and post-amble). I feel bad for the people that had to develop/qa/signoff all of that in such a short timeframe. There's got to be at least one mistake in there somewhere.
- azernik 9y agoAlmost all of this commit is .patch files. Going through them, it seems to be about 10 from AMD, a few from IBM (for S390 processors), a bunch from Intel, and a few from kernel core maintainers. It's a giant workload, but seems to have been distributed pretty widely.
- oneweekwonder 9y agoAm I seeing this right. They called the entry points paranoid* as in "unreasonably or obsessively anxious, suspicious, or mistrustful"? Funny,
- MBCook 9y agoI’m curious if anyone knows: Less say we take a recent CPU and just totally turn off speculative execution. Just how bad a performance hit would that likely be? 30%? 50%? 75%? 90%? Does anyone even know for modern processors?
- eximius 9y agoProbably pretty bad. Branch prediction is usually right and we branch a lot. Your pipeline wouldn't be filled MOST of the time, I bet.
- Everlag 9y agoI just finished up a senior Computer Architecture class last term and a flavor of this was a popular question for past exams. For a more fun answer than an exam, consider that the real estate on a CPU is typically dominated by two things, cache and out-of-order speculation hardware(predictors and such). Then, turning off speculative execution would be like turning off a third of your CPU. As to the actual performance impact, it'd be massive. There's a reason why no modern processor is in-order.
- mhkool 9y agoThe Mill CPU which is currently being developed is in-order and its performance target is higher that current Intel CPUs while using 1/10th of the power. out-of-order is just one way that a hardware vendor choose to increase performance. Mill choose an other way.
- FartyMcFarter 9y ago> There's a reason why no modern processor is in-order. You can still have out-of-order execution without branch prediction. That said, I'm inclined to believe you're right about a massive performance impact (for many programs at least).
- arcticbull 9y agoThe real issue is the speculative execution of loads and stores which cannot be rolled back in the event a branch is not taken.
- xchip 9y agoOnly for the "AMD family 17h processor"
- bobcallme 9y ago> SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-8=1 I guess that AMD uCode updates are applicable to the Raspberry PI.