3 ms·
Do remember that Meltdown and Spectre affected literally everyone else in the industry (including POWER, ARM, and SPARC) and it's only by chance that AMD's bran
by paulmd 7y ago
Do remember that Meltdown and Spectre affected literally everyone else in the industry (including POWER, ARM, and SPARC) and it's only by chance that AMD's branch predictor happens to be relatively difficult to train to follow a predictable path (which is a necessary condition for some of these exploits). Intel isn't cheating any more than anyone else, AMD got lucky.
Cascade Lake and the latest Coffee Lake (and Comet Lake) steppings have hardware mitigations for all the previously known exploits (although there is a new batch) including some for which AMD still requires software mitigations themselves (Spectre V2).
- NicoJuicy 7y agoSo, AMD got lucky 218 times? https://windowsreport.com/amd-intel-security-vulnerabilities/ https://windowsreport.com/amd-intel-security-vulnerabilities...
- paulmd 7y agoMost of those exploits are software/driver vulnerabilities, and AMD has plenty of their own. Like when Threadripper drivers installed an out-of-date web server running with SYSTEM privileges, or when a series of PSP and BIOS bugs let an attacker escalate from VM guest to control of the PSP and BIOS persistence. If you're not finding vulnerabilities in your software, you're not looking. Intel is in a lot more verticals than AMD is - networking, storage, etc - and all of those get their own CVE number. But that's a more nuanced approach than "big number bad" isn't it? Specifically, Intel is finding a lot because they're doing an enterprise-wide initiative to lock down their IPs. Is AMD making the same effort, or are there more vulnerabilities in those GPU drivers or in the chipset drivers that they're not looking for? After all, a year ago they were at the stage where they were installing an out-of-date Apache instance along with your motherboard drivers... doesn't sound like security is priority #1 for them. Again, low number sounds good. But if you're not looking, it's actually not good. And researchers are not looking on AMD much either. AMD is less than 5% of the server market right now, you get the big headlines from finding vulnerabilities in Intel now, not AMD. Give it another 5 years and there will be more scrutiny on AMD's hardware/software.
- LargoLasskhyfv 7y ago> Specifically, Intel is finding a lot because they're doing an enterprise-wide initiative to lock down their IPs. Do they now? Why may that be? Not voluntarily i guess, with all the mess, others have found first, they fear losing ground, and shareholders blood thirst.
- Retric 7y agoLast I read AMD processors aren't affected by the Meltdown bug. And the overall performance hit was 9x as large for Intel. However, if that’s wrong I would love to read about it.
- paulmd 7y agoLike I said, AMD was unique on Meltdown in that their branch predictor uses a neural-net based approach that is difficult to train to follow a specific path. It affected everyone else in the industry - Intel, IBM, ARM, Oracle, everyone.
- Retric 7y agoIf that’s what you meant then saying ‘Meltdown and Spectre affected literally everyone in the industry’ was literally false. Perhaps you could say almost everyone else in the industry in the future. As to being lucky, I have no idea what their internal process is or what they considered. But luck seems like an odd way to talk about such things.
- tomp 7y agoIsn't the reason that AMD isn't affected, that they don't prefetch / cache pages before checking instruction's access privileges?
- Eopia 7y agoI think you are confusing Meltdown with Spectre V2.
- NicoJuicy 7y agoSo researchers aren't checking AMD. A bit later, AMD was uniquely not affected. But they were investigated, yes? Seems like you like Intel more than AMD. No problems with that, I'm the other way around :)