6 ms·

The headline feels a bit too click-baity, but this really is serious stuff. One of the most fundamental instructions of x86, the Jcc conditional jump, can appa

The headline feels a bit too click-baity, but this really is serious stuff. One of the most fundamental instructions of x86, the Jcc conditional jump, can apparently be executed incorrectly by most Intel CPUs out there. What's worse, part of Intel's strategy for mitigation is to push compiler toolchain changes that, if deployed as they desire, will punish the performance of everybody on x86, including those who are using unaffected processors (cough AMD cough).

smitty1e 7y ago
This is why we must protect our right to bear ARMs.
- cesarb 7y ago
  ARM is no better. One of the most popular ARM boards (the Raspberry Pi) uses a core which is affected by an errata which also needs a workaround on the assembler/linker. I don't have my RPi with me at the moment, so I don't know the errata number (it's one of the two printed by the kernel during boot).
  - yabadabadoes 7y ago
    One errata on a broadcom(?) chip makes ARM no better than Intel? I think RPi has had to explain a few times why they choose problematic chips.
    - cesarb 7y ago
      The errata is not from Broadcom, it's on the Cortex-A53 core from ARM it uses. From a quick search, it's probably errata 843419 (see https://static.docs.arm.com/epm048406/200/Cortex-A53_MPCore_Software_Developers_Errata_Notice_v20.pdf https://static.docs.arm.com/epm048406/200/Cortex-A53_MPCore_...), worked around by passing the --fix-cortex-a53-843419 parameter to the linker. And like this Intel errata, it's instruction-address-dependent: one of the conditions to trigger it is when the relevant instruction is near the end of a 4K page. One workaround being "put the instruction somewhere else".
      - yabadabadoes 7y ago
        Well that is an ARM errata, but if I understand correctly it's basically if you drop caching in a way only a privileged thing like hypervisor is allowed to do so this workaround is in some specific code.. The initial reports and secrecy around the Intel issue makes it sound like they need to be mitigating all the time in normal modes.. But I guess it will take some time to see what is really going on.
damageboy 7y ago
OP from twitter here. I'll take the blame for the click-baity-ness, but I was really shocked and this was in real-time in my defense. I'm assuming it will get resolved, as the errata suggests by shoving lots of 0x2c segment overrides to re-align those jumps. The price won't be 0, but will definitely less than the very extreme 20% edge case I stumbled upon. I'm more "worried" or annoyed by older binaries that will never get updated. But hey... (；⌣̀_⌣́)
- chris_overseas 7y ago
  For those not understanding the context of the parent's comment, this HN post originally linked to @damageboy's https://twitter.com/damageboy/status/1194751035136450560 https://twitter.com/damageboy/status/1194751035136450560 tweet showing a 20% performance hit, but was later changed by mods to link to the phoronix.com article.
icebraining 7y ago
I wonder if it'll start making sense to ship different binaries for Intel CPUs.
- bArray 7y ago
  It'll confuse the hell out of people, but I think it's probably the way to go. I hope for example that Linux based package managers split the "amd64" so that we all don't get hit by this crap.
  - yabadabadoes 7y ago
    The naming AMD64 correctly was visionary, but what do we call broken x64?
    - cassianoleal 7y ago
      Clearly, intel64
      - saagarjha 7y ago
        Why not “Intel Architecture 64-bit” to be clear? You can even shorten it to “IA-64”.
        roblabla 7y ago
        Unsure if this is a joke and I'm about to be wooshed, but for anyone who doesn't know: Unfortunately, IA-64 is already taken for the itanium architecture. That's why the Intel Software Developer Manual names it IA32-E and not IA64. IA32 is x86, IA32-E is x86 Extended, or x86_64. Thanks intel, I guess.
        saagarjha 7y ago
        It's a joke ;)
    - 7y ago
my123 7y ago
If only the microcode workaround affected just Jcc... > The MCU prevents jump instructions from being cached in the Decoded ICache when the jump instructions cross a 32-byte boundary or when they end on a 32-byte boundary. In this context, Jump Instructions include all jumptypes: conditional jump (Jcc), macro-fusedop-Jcc(where opis one ofcmp, test, add, sub, and, inc, ordec), direct unconditional jump, indirect jump, direct/indirect call, and return These patches are just to recover some of the performance penalty...
cesarb 7y ago
> including those who are using unaffected processors (cough AMD cough). A more recent Phoronix article ("Intel's Assembler Changes For JCC Erratum Are Not Hurting AMD", https://www.phoronix.com/scan.php?page=news_item&px=AMD-With-Intel-JCC-Assembler https://www.phoronix.com/scan.php?page=news_item&px=AMD-With...) says otherwise.
deleted 7y ago
[deleted]

smitty1e 7y ago

This is why we must protect our right to bear ARMs.

cesarb 7y ago
ARM is no better. One of the most popular ARM boards (the Raspberry Pi) uses a core which is affected by an errata which also needs a workaround on the assembler/linker. I don't have my RPi with me at the moment, so I don't know the errata number (it's one of the two printed by the kernel during boot).
- yabadabadoes 7y ago
  One errata on a broadcom(?) chip makes ARM no better than Intel? I think RPi has had to explain a few times why they choose problematic chips.
  - cesarb 7y ago
    The errata is not from Broadcom, it's on the Cortex-A53 core from ARM it uses. From a quick search, it's probably errata 843419 (see https://static.docs.arm.com/epm048406/200/Cortex-A53_MPCore_Software_Developers_Errata_Notice_v20.pdf https://static.docs.arm.com/epm048406/200/Cortex-A53_MPCore_...), worked around by passing the --fix-cortex-a53-843419 parameter to the linker. And like this Intel errata, it's instruction-address-dependent: one of the conditions to trigger it is when the relevant instruction is near the end of a 4K page. One workaround being "put the instruction somewhere else".
    - yabadabadoes 7y ago
      Well that is an ARM errata, but if I understand correctly it's basically if you drop caching in a way only a privileged thing like hypervisor is allowed to do so this workaround is in some specific code.. The initial reports and secrecy around the Intel issue makes it sound like they need to be mitigating all the time in normal modes.. But I guess it will take some time to see what is really going on.

damageboy 7y ago

OP from twitter here. I'll take the blame for the click-baity-ness, but I was really shocked and this was in real-time in my defense. I'm assuming it will get resolved, as the errata suggests by shoving lots of 0x2c segment overrides to re-align those jumps. The price won't be 0, but will definitely less than the very extreme 20% edge case I stumbled upon. I'm more "worried" or annoyed by older binaries that will never get updated. But hey... (；⌣̀_⌣́)

chris_overseas 7y ago
For those not understanding the context of the parent's comment, this HN post originally linked to @damageboy's https://twitter.com/damageboy/status/1194751035136450560 https://twitter.com/damageboy/status/1194751035136450560 tweet showing a 20% performance hit, but was later changed by mods to link to the phoronix.com article.

icebraining 7y ago

I wonder if it'll start making sense to ship different binaries for Intel CPUs.

bArray 7y ago
It'll confuse the hell out of people, but I think it's probably the way to go. I hope for example that Linux based package managers split the "amd64" so that we all don't get hit by this crap.
- yabadabadoes 7y ago
  The naming AMD64 correctly was visionary, but what do we call broken x64?
  - cassianoleal 7y ago
    Clearly, intel64
    - saagarjha 7y ago
      Why not “Intel Architecture 64-bit” to be clear? You can even shorten it to “IA-64”.
      - roblabla 7y ago
        Unsure if this is a joke and I'm about to be wooshed, but for anyone who doesn't know: Unfortunately, IA-64 is already taken for the itanium architecture. That's why the Intel Software Developer Manual names it IA32-E and not IA64. IA32 is x86, IA32-E is x86 Extended, or x86_64. Thanks intel, I guess.
        saagarjha 7y ago
        It's a joke ;)
  - 7y ago

my123 7y ago

If only the microcode workaround affected just Jcc... > The MCU prevents jump instructions from being cached in the Decoded ICache when the jump instructions cross a 32-byte boundary or when they end on a 32-byte boundary. In this context, Jump Instructions include all jumptypes: conditional jump (Jcc), macro-fusedop-Jcc(where opis one ofcmp, test, add, sub, and, inc, ordec), direct unconditional jump, indirect jump, direct/indirect call, and return These patches are just to recover some of the performance penalty...

cesarb 7y ago

> including those who are using unaffected processors (cough AMD cough). A more recent Phoronix article ("Intel's Assembler Changes For JCC Erratum Are Not Hurting AMD", https://www.phoronix.com/scan.php?page=news_item&px=AMD-With-Intel-JCC-Assembler https://www.phoronix.com/scan.php?page=news_item&px=AMD-With...) says otherwise.

deleted 7y ago

[deleted]