5

Many sources claim that almost all Intel x86 CPUs back to Pentium Pro are vulnerable to the Meltdown attack. Pentium Pro was introduced to the market in 1995.

What was the state of the art knowledge on security of speculative evaluation, the basis for the Meltdown attack, at that time?

12

The state of the art was non-existent.

At the time of the Pentium Pro, the World Wide Web was four years old. Widespread use of shared hosting was about ten years in the future; if you suggested that people would want to run untrusted code provided by random third parties, they'd look at you like you'd grown a second head. Memory protection was about preventing one crashing program from taking down the whole system, not about letting programs hide data from one another. Speculative execution was not seen as having any security implications whatsoever -- it was simply a way of avoiding performance-killing pipeline stalls.

  • 2
    Could the speculative execution used by the Pentium Pro extend as far as using speculatively-fetched data in the computation of addresses for subsequent speculative fetches? And did it allow speculative execution to ignore memory permissions? It is the combination of those things which creates the vulnerabilities, and I doubt the first chip to have any kind of speculative execution would extend its reach that far. – supercat Jan 5 '18 at 3:00
  • 1
    Also, as far as I understand, the pipeline itself would have to be long enough too, so that several instructions could even reach the stage that requires the final speculative fetch before the branch is retired. Pentium Pro's pipeline was short compared to later chips. However, Alex Ionescu claims that it indeed has the same problem, and I think I saw some article explicitly stating that Intel's speculative execution did not check permissions even back then—hence my question. – liori Jan 5 '18 at 4:08
  • 1
    @liori: I wouldn't doubt that the Pentium Pro performed speculative fetches without performing security checks first. I would find it very surprising, however, if the first x86 processor to use speculative execution was able to handle multiple outstanding conditions simultaneously. The complexity required to do that would seem much greater than the complexity required to handle one, and given 1995 memory speeds I don't see what the payoff would have been. – supercat Jan 5 '18 at 16:11
  • 2
    @supercat Checked some facts. L2 miss penalty was 50 cycles. PPro could retire 3 instructions per cycle, of which one could be a load/store. The out-of-order engine could handle up to 40 instructions. So actually seems like plenty of time, and if results of one instruction could not be reused for another waiting instruction, 40 sounds like a waste given the limited number of registers in x86. Also, the retirement register file, where results of instructions are stored, can indeed be used by subsequent speculative instructions. I'm quite convinced myself now. – liori Jan 5 '18 at 21:17
  • 1
    @supercat, the advantage of allowing speculation to proceed past an invalid memory access is that you don't need to check access validity until it's time to turn the speculative execution into real execution, in the processor's retirement unit. This simplifies CPU design and speeds up execution. – Mark Jan 5 '18 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.