Many sources claim that almost all Intel x86 CPUs back to Pentium Pro are vulnerable to the Meltdown attack. Pentium Pro was introduced to the market in 1995.

What was the state of the art knowledge on security of speculative evaluation, the basis for the Meltdown attack, at that time?

  • 1
    So this question turned out to be out of date; Meltdown has since been tried on Pentium Pro; on processors prior to the Pentium IV, speculative execution reads CPU registers rather than kernel memory; namely it's possible to read the location of the page table itself in physical RAM and the error trap addresses and a few other things out of CR* registers. I saw an attack on speculative execution in 1998 able to steal SSH or SSL keys by instruction timings alone against Hyperthreading; which is before the Pentium IV release.
    – Joshua
    Sep 14, 2021 at 19:44

1 Answer 1


The state of the art was non-existent.

At the time of the Pentium Pro, the World Wide Web was four years old. Widespread use of shared hosting was about ten years in the future; if you suggested that people would want to run untrusted code provided by random third parties, they'd look at you like you'd grown a second head. Memory protection was about preventing one crashing program from taking down the whole system, not about letting programs hide data from one another. Speculative execution was not seen as having any security implications whatsoever -- it was simply a way of avoiding performance-killing pipeline stalls.

  • 2
    Could the speculative execution used by the Pentium Pro extend as far as using speculatively-fetched data in the computation of addresses for subsequent speculative fetches? And did it allow speculative execution to ignore memory permissions? It is the combination of those things which creates the vulnerabilities, and I doubt the first chip to have any kind of speculative execution would extend its reach that far.
    – supercat
    Jan 5, 2018 at 3:00
  • 1
    Also, as far as I understand, the pipeline itself would have to be long enough too, so that several instructions could even reach the stage that requires the final speculative fetch before the branch is retired. Pentium Pro's pipeline was short compared to later chips. However, Alex Ionescu claims that it indeed has the same problem, and I think I saw some article explicitly stating that Intel's speculative execution did not check permissions even back then—hence my question.
    – liori
    Jan 5, 2018 at 4:08
  • 1
    @liori: I wouldn't doubt that the Pentium Pro performed speculative fetches without performing security checks first. I would find it very surprising, however, if the first x86 processor to use speculative execution was able to handle multiple outstanding conditions simultaneously. The complexity required to do that would seem much greater than the complexity required to handle one, and given 1995 memory speeds I don't see what the payoff would have been.
    – supercat
    Jan 5, 2018 at 16:11
  • 2
    @supercat Checked some facts. L2 miss penalty was 50 cycles. PPro could retire 3 instructions per cycle, of which one could be a load/store. The out-of-order engine could handle up to 40 instructions. So actually seems like plenty of time, and if results of one instruction could not be reused for another waiting instruction, 40 sounds like a waste given the limited number of registers in x86. Also, the retirement register file, where results of instructions are stored, can indeed be used by subsequent speculative instructions. I'm quite convinced myself now.
    – liori
    Jan 5, 2018 at 21:17
  • 1
    @supercat, the advantage of allowing speculation to proceed past an invalid memory access is that you don't need to check access validity until it's time to turn the speculative execution into real execution, in the processor's retirement unit. This simplifies CPU design and speeds up execution.
    – Mark
    Jan 5, 2018 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .