- Posts
- 5,432
- Reaction score
- 8,769
![www.tomshardware.com](https://cdn.mos.cms.futurecdn.net/nFb7CCtfNb7u6jZ8SciUU-1200-80.jpg)
All AMD Zen CPUs Vulnerable, Might Need to Disable SMT
Side-channel SQUIP vulnerability affects all SMT-enabled Zen CPUs.
![www.tomshardware.com](https://vanilla.futurecdn.net/tomshardware/518546/apple-touch-icon.png)
Yeah, I’ve mentioned it before - SMT better be very much worth it performance-wise, because it’s almost impossible to insulate it from side channel attacks. Most of the things you would do to prevent them would also hamstring performance (like resetting all state elements every time you switch threads, not starting the next thread until all instructions of the prior thread are fully retired, etc. etc.)Speaking of good reasons why Apple might want to skip SMT…
I will be curious what happens here as my Windows PC is a Ryzen 5600 system.
it’s not an area-efficient solution to the x86 problem of difficult instruction scheduling, but it likely is less susceptible to side-channel attacks. They can also then quote some bullshit “peak ops” number as if they can keep all the cores busy.I suspect we are at the point now where intel and AMD are likely to abandon SMT and just throw additional efficiency cores at the “help get more work done without catastrophic security impact” problem.
I know that you're not, in general, a security engineer. However, you have mentioned in the past how you've taken a specific interest in side-channel attacks of this nature. From what I gather, you and other knowledgeable folks have said that Apple's performance cores would see little to no benefit from SMT, and perhaps even a performance hit, under some circumstances. I believe that you've also said that, again under special circumstances, the efficiency cores could theoretically benefit from some form of SMT, but that's not entirely certain. Please correct me if I am wrong and am misremembering what has been said on this subject. Even if the E-cores could benefit in some way, or even the P-cores in some future implementation, I haven't seen anyone knowledgeable suggesting that Apple's engineers should put effort or resources into SMT, both in terms of manpower and die space, which would be better served elsewhere.it’s not an area-efficient solution to the x86 problem of difficult instruction scheduling, but it likely is less susceptible to side-channel attacks. They can also then quote some bullshit “peak ops” number as if they can keep all the cores busy.
it’s not an area-efficient solution to the x86 problem of difficult instruction scheduling, but it likely is less susceptible to side-channel attacks. They can also then quote some bullshit “peak ops” number as if they can keep all the cores busy.
I know that you're not, in general, a security engineer. However, you have mentioned in the past how you've taken a specific interest in side-channel attacks of this nature. From what I gather, you and other knowledgeable folks have said that Apple's performance cores would see little to no benefit from SMT, and perhaps even a performance hit, under some circumstances. I believe that you've also said that, again under special circumstances, the efficiency cores could theoretically benefit from some form of SMT, but that's not entirely certain. Please correct me if I am wrong and am misremembering what has been said on this subject. Even if the E-cores could benefit in some way, or even the P-cores in some future implementation, I haven't seen anyone knowledgeable suggesting that Apple's engineers should put effort or resources into SMT, both in terms of manpower and die space, which would be better served elsewhere.
Again, correct me if I am wrong about anything I stated above. Regardless, how much impact have these side-channel vulnerabilities had in the real world? Benchmarking has shown that x86 CPUs can take a substantial performance impact from these patches, mainly in the form of a BIOS microcode or Windows update, after applied to affected systems. Sometimes, the impact is as great as perhaps an entire CPU class or more, such as the difference between an i9 and an i5. I know I wouldn't be pleased if a UEFI update, assuming the motherboard manufacturer actually supplies one, gimped a two-year old CPU designed to compete at the high-end and then suddenly became the equivalent of today's budget i3 chip.
I get that many of the performance tricks done by CPU engineers are going to potentially have vulnerabilities, Intel seems to have applied more cheats than anyone else, including AMD, but nobody is immune. Dumping UEFI, moving users to iBoot, and avoiding SMT mine fields are part of Apple Silicon's current and future benefits. Apple doing their best to avoid unfixable vulnerabilities, such as those within the T2, are another. (You pointed out that the much ballyhooed Nuvia chips that Qualcomm is working on is being spearheaded by "trade secrets guy", who oversaw the T2 and hence the permanent flaw found within its design.)
In that regard, it seems much simpler to get the average user to install a new "emergency" update to Adobe Flash, a one-click jail-break for Android, or an app that gives the user easy access to Sexy Singles in Your Area™. In other words, why bother with side-channel attacks when simple social engineering will do?
As a consumer who probably does internet banking on their machine, are you willing to bet your entire bank balance on these side channel attacks being nothing to worry about?Again, correct me if I am wrong about anything I stated above. Regardless, how much impact have these side-channel vulnerabilities had in the real world? Benchmarking has shown that x86 CPUs can take a substantial performance impact from these patches, mainly in the form of a BIOS microcode or Windows update, after applied to affected systems. Sometimes, the impact is as great as perhaps an entire CPU class or more, such as the difference between an i9 and an i5. I know I wouldn't be pleased if a UEFI update, assuming the motherboard manufacturer actually supplies one, gimped a two-year old CPU designed to compete at the high-end and then suddenly became the equivalent of today's budget i3 chip.
You had mentioned previously about your focus on side-channel attacks, but I had no idea the extent which you were familiar, and the wild story behind it. That's like something out of a technical courtroom drama. It sounds like you were way ahead of the industry on this issue, perhaps a little too far ahead, because it didn't become a serious problem until the past half-decade or so. While low-level CPU exploits have been a problem for everyone, it seems like Intel was the one to play fast and loose the most, at least it appears that way from publicly available information. They cut a lot of corners and now it's biting them in the ass, not that everyone has a perfect record, Intel just seems the most egregious.My introduction to side channel attacks occurred while in law school.
While the drive-by attacks may be more impactful, I would think they would be patched reasonably quickly. What I find the most terrifying is the idea that you have a VM hosted on a third-party service. A malicious actor just so happens to rent some VM space on those same servers, in an attempt to target other VMs, perhaps a specific organization, rather than a fishing expedition. I realize that it's more complex than that, and not easy to do, but a determined malicious actor could possibly achieve it.Some of the attacks have been more impactful than others. At least one could be triggered in a drive-by fashion, for example by viewing a website with malicious javascript in it. Others can occur pretty easily in server farm settings where you are sharing a machine with other users.
I would imagine that if you're being targeted by a nation-state then you've got bigger problems than a few edge case side-channel attacks. Not something pleasant to think about.And some are probably not very useful other than to nation-states or in situations where a computer has really super valuable information on it and for whatever reason simpler attacks aren’t possible.
Yeah, in another discussion you referred to him as "trade secrets guy". There was a lot of "Apple is doomed" chatter over at the other place when the ex-Apple engineers left to form Nuvia, and then again when Qualcomm purchased them. You thoroughly debunked that notion when you went through your personal list of colleagues you knew that are still working for Apple, hence ruining the narrative that the brain drain isn't as impactful as the doom sayers had predicted.Manu? He’s the guy I worked with pretty closely at AMD.
Definitely not. My intent wasn't to downplay the threat and imperative in fixing side-channel attacks. I was simply curious about the relative complexity and what level of skill is required compared to simple social engineering.As a consumer who probably does internet banking on their machine, are you willing to bet your entire bank balance on these side channel attacks being nothing to worry about?
As I said to @Cmaier above, that's far more concerning, considering how much harder I would think it is to pinpoint the intrusion, compared to a mass attack with indiscriminate drive-bys. I would hope that every organization has a plan for this, especially given how publicized SMT attacks are, but then there are still organizations that require employees to use Internet Explorer.Never mind enterprise doing virtualisation of hundreds of virtual servers on a single box.
I fully agree. I'm a reasonably paranoid person, not tin-foil hat wearing levels, but I want all the fixes applied despite performance hits, even if my i3 Mac mini gets downgraded to a, well, even slower i3. The only benefit to a pokey i3 is that it doesn't use SMT, hence it may not be vulnerable to some of those issues. SMT has always come off as a bit of a kludge, something that @Cmaier and other engineers have pointed out in regards to x86 and its many deficiencies.Personally i'll take the potential performance/efficiency compromise of not using SMT (if i was making a design trade-off) - for most people processors have been fast enough for a decade now; plenty of people are still running i5-2600k or i7-2700k even on their gaming rigs. Sure there are performance demands beyond that today but most of those are handled by GPU acceleration or add on co-processors or dedicated instructions these days.
As I said to @Cmaier above, that's far more concerning, considering how much harder I would think it is to pinpoint the intrusion, compared to a mass attack with indiscriminate drive-bys. I would hope that every organization has a plan for this, especially given how publicized SMT attacks are, but then there are still organizations that require employees to use Internet Explorer.
Yeah, in another discussion you referred to him as "trade secrets guy".
I agree with Cliff that social engineering is probably much easier to accomplish than getting some of these vulnerabilities to work. But JavaScript and cloud VMs are probably the biggest risks. Doesn't some browser (Edge?) now have the option to run JavaScript in an interpreter instead of JIT compiled?
What I really wonder is how many vulnerabilities Apple Silicon CPUs have, since I believe there isn't much information.
I know that Apple Silicon has a totally different implementation that the standard ARM cores, which is why I would be interested if they have vulnerabilities, too.
I only assumed that out-of-order execution and longer pipelines were an indicator, because, e.g. Cortex-A57 has vulnerabilities, but Cortex-A53 has not. The latter has a much shorter pipeline (almost half the stages, although still long enough to count as a "super pipeline" similar to the MIPS R4000) and it has no out-of-order execution, since it's the low-power core.
I almost wanted to ask if there is any speculative load operations without out-of-order execution, but then I remembered that IA-64 defined an explicit instruction for that, IIRC.
But I'm derailing the thread that started out about AMD. Sorry about that...
Good to know, let's talk about Pringles then ;-)Nobody here cares if the thread evolves to talk about other chips![]()
Nobody here cares if the thread evolves to talk about other chips![]()
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.