6 ms·

>Finally, AMD CPUs utilize other proprietary technologies known as Infinity Fabric/Architecture for their on-chip interconnect. Investigating the feasibility of

>Finally, AMD CPUs utilize other proprietary technologies known as Infinity Fabric/Architecture for their on-chip interconnect. Investigating the feasibility of our attack on these platforms requires future work. However, the techniques we use to build our contention model can be applied on these platforms too. I notice often that when coverage of these side-channels start spreading Intel takes a hit and AMD thrives. While the majority of these side-channel attacks are tuned to Intel chips, the theory behind them along with a decent amount of work can often make them applicable to AMD as well, and in some cases even other architectures(ARM, MIPS, SPARC, etc).

josephg 6y ago
Yep. I wish I could remember the details, but in one of the episodes of the On The Metal podcast they talked to someone who backported meltdown/spectre to a bunch of CPUs which are decades old, or really exotic. I don’t know why, but there’s something really surprising to me about how far reaching the issues are, when you pull them back to first principles.
- p_l 6y ago
  A big difference between impact on Intel and AMD was due to only part of the recent attacks being a new class opening new ground - namely the generic speculative execution part. A big group that turned it into "Intel fail" was due to various errors on Intel part, like moving verification of memory accesses to instruction retirement and similar things that even to uneducated person like me look like "tricks to make single-core performance shine".
  - thu2111 6y ago
    Those weren't Intel fails - no CPU manufacturer had any kind of generic rule against that sort of microarchitectural optimisation and it's hard to imagine what sort of rule would have blocked such optimisations by policy which wouldn't also rule out all speculative execution. The only reason AMD wasn't hit by Meltdown too is their cores are/were less optimised.
    - p_l 6y ago
      Moving memory access verification to instruction retirement is the kind of risky optimization one should beware immediately, even if spectre and the like weren't yet known. If only because the risks if you get it wrong are that much higher.
      - rrss 6y ago
        Ok, but "Intel fail" indicates meltdown was specific to Intel processors, when it was also present of IBM and some Arm designs.
        p_l 6y ago
        I specifically separated the "new class of microarchitecture timing attacks", which was common across many systems (including AMD, POWER and ARM), from "Intel fail" where too aggressive optimization tricks did turn out to be bad idea.
        jeffbee 6y ago
        "Too aggressive" is just, like, your opinion, man. There are tons of workloads where only maximum throughput or lowest latency are important and the operators of those systems don't care one jot about side channel attacks.
        wizzwizz4 6y ago
        And PC / general-purpose CPUs aren't such a workload.
        cthalupa 6y ago
        They aren't? I know a significant number of people who have disabled spectre and meltdown protections in favor of higher performance because they are not concerned at all about side channel attacks. Single tenant workloads that run no untrusted code that are not public facing are not exactly a unicorn.
  - avianes 6y ago
    Not sure if the checks of all loads are done at instruction retirement, but yes they are done after the (speculative) execution of the load. We can also talk about the Store-to-Load Forwarding involving a partially check physical address, exploited by the Fallout attack, which is an optimization patented by Intel since 2006 [1]. All these Intel optimizations are old, and sometimes patented (which reduces the chance that IBM, ARM or AMD will do the same) and are totally valid and safe as long as it's assumed that it is impossible to recover data used during the speculative execution. The recovery of this data becomes possible only when the side channel Flush+Reload is discovered in 2014 [2] (which originally didn't target speculative executions). It is only 3 years later that Meltdown attack use Flush+Reload as a covert channel to exfiltrate data during speculative execution. It seems to me that this timeline shows that it was not possible in 2006 to anticipate this issue. So it's not just a lack of education. Perhaps a lack of security research at Intel to continuously challenge their optimizations? But please note that there is no theory to simply determine whether these optimizations are a good idea or not. Criticism is easier afterwards when you know how the attacks are produced. But in 2017 this type of attack was something new. That said, some of Intel's responses to the flaws (partial correction of vulnerabilities, lack of dialogue with researchers, etc.) are very worrying and I think these criticisms are much more legitimate. [1] : https://patents.google.com/patent/US20080082765A1 https://patents.google.com/patent/US20080082765A1 [2] : https://eprint.iacr.org/2013/448.pdf https://eprint.iacr.org/2013/448.pdf
    - p_l 6y ago
      Thanks for the in-depth explanation! I will admit that I'm not an expert in microarchitecture design, so to me the expected flaw would be "we do something wrong in speculative execution and end up bypassing the checks in destructive way", not through side channels. Didn't know about patents involved. And of course timing attacks make everything worse for all of us :/
- chr15p 6y ago
  That was Jon Masters who led the technical Spectre/Meltdown response for Red Hat, and was talking about porting it to SPARC, and Itanium, and maybe others as well https://oxide.computer/podcast/on-the-metal-8-jon-masters/ https://oxide.computer/podcast/on-the-metal-8-jon-masters/
afrcnc 6y ago
Because AMD has a tiny market share. Trust me, if AMD would be on top, it would be riddled with holes, just like Intel
- deleted 6y ago
  [deleted]
- neogodless 6y ago
  https://www.techspot.com/news/87436-amd-chipping-away-intel-cpu-market-share.html https://www.techspot.com/news/87436-amd-chipping-away-intel-... After checking a few sites, it looks like AMD may have between 20 and 37% of PC market share. I do not consider that "tiny."
  - thu2111 6y ago
    It's true. I've read one side channel attack paper that admitted towards the end that the researchers didn't actually even have access to AMD hardware to test with, but thought it should work in principle. Fact is Intel takes the brunt of these attacks because their HW is more available especially in semi-standardised environments like universities. Also, Intel fund researchers (this paper was part funded by Intel), and their technical documentation is better than AMDs, at least in my experience. That makes it easier to understand the CPU internals, which is a big part of these papers.
  - wolrah 6y ago
    In the server market Intel had 92.9% for Q4 2020. AMD is actually up a lot in that market, Intel had 95.5% in 2019, but outside of a few specific use cases Intel still owns the market most likely to contain interesting information an attacker might want. This attack as it stands does not seem to apply to Intel server hardware from Skylake to present due to a different interconnect architecture, though the researchers indicate a belief the attack may be portable it would also be more limited. Complete rectal estimation here, but I'd imagine executive laptops to probably be the next juiciest target as the end user station most likely to contain "interesting" data. While AMD has been making incredible inroads in the laptop market with Zen 2 and especially Zen 3, as opposed to the Bulldozer era when seeing an AMD sticker on a laptop let you know it was the cheapest one on the shelf, they still haven't made it to the models commonly bought by businesses. AMD is absolutely killing it in the DIY desktop space, deservedly so (this post typed from a 3900X that I love), but on the OEM side of things you still generally have to go out of your way to find them in anything not marketed at gamers.
londons_explore 6y ago
Intel CPU's are more widely deployed, especially on the types of systems under more attack. That's why attacks are designed for them.
- orclev 6y ago
  Considering the shift to AMD from Intel that has happened over the last couple years it will be interesting to see if we'll see AMD as more of a priority target in the future. AMD has certainly been leading in sales in most demographics for the last year or two, and there's little sign of Intel closing that gap. AMD has even made some moves recently that indicate some desire to chase Intel out of the lead in the few niches they still control, like the x86 low power/cost device market that has been dominated by atom/celeron.
Klwohu 6y ago
Turns out exploiting these issues seems to be easier on Intel. Perhaps since it's so dominant, Intel is where the majority of the research is focused. But perhaps, the huge architectural differences which made Intel more vulnerable to more Spectre variants are responsible. It's clear Intel has been taking many shortcuts with its CPU design in favor of speed and has been for decades.

josephg 6y ago

Yep. I wish I could remember the details, but in one of the episodes of the On The Metal podcast they talked to someone who backported meltdown/spectre to a bunch of CPUs which are decades old, or really exotic. I don’t know why, but there’s something really surprising to me about how far reaching the issues are, when you pull them back to first principles.

p_l 6y ago
A big difference between impact on Intel and AMD was due to only part of the recent attacks being a new class opening new ground - namely the generic speculative execution part. A big group that turned it into "Intel fail" was due to various errors on Intel part, like moving verification of memory accesses to instruction retirement and similar things that even to uneducated person like me look like "tricks to make single-core performance shine".
- thu2111 6y ago
  Those weren't Intel fails - no CPU manufacturer had any kind of generic rule against that sort of microarchitectural optimisation and it's hard to imagine what sort of rule would have blocked such optimisations by policy which wouldn't also rule out all speculative execution. The only reason AMD wasn't hit by Meltdown too is their cores are/were less optimised.
  - p_l 6y ago
    Moving memory access verification to instruction retirement is the kind of risky optimization one should beware immediately, even if spectre and the like weren't yet known. If only because the risks if you get it wrong are that much higher.
    - rrss 6y ago
      Ok, but "Intel fail" indicates meltdown was specific to Intel processors, when it was also present of IBM and some Arm designs.
      - p_l 6y ago
        I specifically separated the "new class of microarchitecture timing attacks", which was common across many systems (including AMD, POWER and ARM), from "Intel fail" where too aggressive optimization tricks did turn out to be bad idea.
        jeffbee 6y ago
        "Too aggressive" is just, like, your opinion, man. There are tons of workloads where only maximum throughput or lowest latency are important and the operators of those systems don't care one jot about side channel attacks.
        wizzwizz4 6y ago
        And PC / general-purpose CPUs aren't such a workload.
        cthalupa 6y ago
        They aren't? I know a significant number of people who have disabled spectre and meltdown protections in favor of higher performance because they are not concerned at all about side channel attacks. Single tenant workloads that run no untrusted code that are not public facing are not exactly a unicorn.
- avianes 6y ago
  Not sure if the checks of all loads are done at instruction retirement, but yes they are done after the (speculative) execution of the load. We can also talk about the Store-to-Load Forwarding involving a partially check physical address, exploited by the Fallout attack, which is an optimization patented by Intel since 2006 [1]. All these Intel optimizations are old, and sometimes patented (which reduces the chance that IBM, ARM or AMD will do the same) and are totally valid and safe as long as it's assumed that it is impossible to recover data used during the speculative execution. The recovery of this data becomes possible only when the side channel Flush+Reload is discovered in 2014 [2] (which originally didn't target speculative executions). It is only 3 years later that Meltdown attack use Flush+Reload as a covert channel to exfiltrate data during speculative execution. It seems to me that this timeline shows that it was not possible in 2006 to anticipate this issue. So it's not just a lack of education. Perhaps a lack of security research at Intel to continuously challenge their optimizations? But please note that there is no theory to simply determine whether these optimizations are a good idea or not. Criticism is easier afterwards when you know how the attacks are produced. But in 2017 this type of attack was something new. That said, some of Intel's responses to the flaws (partial correction of vulnerabilities, lack of dialogue with researchers, etc.) are very worrying and I think these criticisms are much more legitimate. [1] : https://patents.google.com/patent/US20080082765A1 https://patents.google.com/patent/US20080082765A1 [2] : https://eprint.iacr.org/2013/448.pdf https://eprint.iacr.org/2013/448.pdf
  - p_l 6y ago
    Thanks for the in-depth explanation! I will admit that I'm not an expert in microarchitecture design, so to me the expected flaw would be "we do something wrong in speculative execution and end up bypassing the checks in destructive way", not through side channels. Didn't know about patents involved. And of course timing attacks make everything worse for all of us :/
chr15p 6y ago
That was Jon Masters who led the technical Spectre/Meltdown response for Red Hat, and was talking about porting it to SPARC, and Itanium, and maybe others as well https://oxide.computer/podcast/on-the-metal-8-jon-masters/ https://oxide.computer/podcast/on-the-metal-8-jon-masters/

afrcnc 6y ago

Because AMD has a tiny market share. Trust me, if AMD would be on top, it would be riddled with holes, just like Intel

deleted 6y ago
[deleted]
neogodless 6y ago
https://www.techspot.com/news/87436-amd-chipping-away-intel-cpu-market-share.html https://www.techspot.com/news/87436-amd-chipping-away-intel-... After checking a few sites, it looks like AMD may have between 20 and 37% of PC market share. I do not consider that "tiny."
- thu2111 6y ago
  It's true. I've read one side channel attack paper that admitted towards the end that the researchers didn't actually even have access to AMD hardware to test with, but thought it should work in principle. Fact is Intel takes the brunt of these attacks because their HW is more available especially in semi-standardised environments like universities. Also, Intel fund researchers (this paper was part funded by Intel), and their technical documentation is better than AMDs, at least in my experience. That makes it easier to understand the CPU internals, which is a big part of these papers.
- wolrah 6y ago
  In the server market Intel had 92.9% for Q4 2020. AMD is actually up a lot in that market, Intel had 95.5% in 2019, but outside of a few specific use cases Intel still owns the market most likely to contain interesting information an attacker might want. This attack as it stands does not seem to apply to Intel server hardware from Skylake to present due to a different interconnect architecture, though the researchers indicate a belief the attack may be portable it would also be more limited. Complete rectal estimation here, but I'd imagine executive laptops to probably be the next juiciest target as the end user station most likely to contain "interesting" data. While AMD has been making incredible inroads in the laptop market with Zen 2 and especially Zen 3, as opposed to the Bulldozer era when seeing an AMD sticker on a laptop let you know it was the cheapest one on the shelf, they still haven't made it to the models commonly bought by businesses. AMD is absolutely killing it in the DIY desktop space, deservedly so (this post typed from a 3900X that I love), but on the OEM side of things you still generally have to go out of your way to find them in anything not marketed at gamers.

londons_explore 6y ago

Intel CPU's are more widely deployed, especially on the types of systems under more attack. That's why attacks are designed for them.

orclev 6y ago
Considering the shift to AMD from Intel that has happened over the last couple years it will be interesting to see if we'll see AMD as more of a priority target in the future. AMD has certainly been leading in sales in most demographics for the last year or two, and there's little sign of Intel closing that gap. AMD has even made some moves recently that indicate some desire to chase Intel out of the lead in the few niches they still control, like the x86 low power/cost device market that has been dominated by atom/celeron.

Klwohu 6y ago

Turns out exploiting these issues seems to be easier on Intel. Perhaps since it's so dominant, Intel is where the majority of the research is focused. But perhaps, the huge architectural differences which made Intel more vulnerable to more Spectre variants are responsible. It's clear Intel has been taking many shortcuts with its CPU design in favor of speed and has been for decades.