L1 Terminal Fault - The Latest Speculative Execution Side Channel Attack

[cybertraveler]

L1TF is in the same category of bugs as Meltdown and Spectre, so to believe what you're saying, this whole class of bugs had to have been planted by the NSA a decade ago with some cooperation from multiple vendors or their employees, only to be found recently and in this case be self-disclosed now. Except for certain variants of Spectre, all the other flaws only show up in Intel chips.

I guess you can believe what you want. I think it's much more likely that Intel did have 12 year olds designing processors.

WesternSemiConductor didn't claim that these security-sensitive bugs were created by the intelligence agencies, so you don't need to believe him. He just pointed out that it's plausible that they are responsible for these bugs and some of the arguments that they could not have been responsible are weak.

If the intelligence agencies did create these bugs, they wouldn't be the first humans on planet earth to have set in motion a plan which will pay them off well in the future. Anyone living in a cold country should have this very process etched into their DNA: their ancestors will have had to prepare well in advance of winter if they wanted to survive winter and remain comfortable during it.

Remember: neither myself or WesternSemiConductor have made a claim or even stated our belief that an intelligence agency is behind this. We're just presenting plausible scenarios.

You don't have to have beliefs about things which you don't have all the facts for. It's OK to not know the answer and just consider the options.

If you look into these subjects a little you'll find that there is a well documented history of infiltration, sabotage, co-opting and manipulation that occurs in the shadows. It doesn't take a genius to see that if you can get secret hardware level vulnerabilities into Intel chips that only "your side" knows about, you have a very powerful tool at your disposal with almost limitless applications.

[audir8]

WesternSemiConductor didn't claim that these security-sensitive bugs were created by the intelligence agencies, so you don't need to believe him. He just pointed out that it's plausible that they are responsible for these bugs and some of the arguments that they could not have been responsible are weak.

If the intelligence agencies did create these bugs, they wouldn't be the first humans on planet earth to have set in motion a plan which will pay them off well in the future. Anyone living in a cold country should have this very process etched into their DNA: their ancestors will have had to prepare well in advance of winter if they wanted to survive winter and remain comfortable during it.

Remember: neither myself or WesternSemiConductor have made a claim or even stated our belief that an intelligence agency is behind this. We're just presenting plausible scenarios.

You don't have to have beliefs about things which you don't have all the facts for. It's OK to not know the answer and just consider the options.

If you look into these subjects a little you'll find that there is a well documented history of infiltration, sabotage, co-opting and manipulation that occurs in the shadows. It doesn't take a genius to see that if you can get secret hardware level vulnerabilities into Intel chips that only "your side" knows about, you have a very powerful tool at your disposal with almost limitless applications.

I might buy this if we didn't know about Intel ME, which is also a decade old now, and is a much cleaner and more powerful backdoor. We would have at least seen hints of a Spectre V2 JIT-based exploits in the NSA hacks, and we didn't. Why would the NSA bother with something so indirect when there are more direct exploits available in the form of ME or other numerous browser-based exploits? So, yeah, I don't even find this line of thinking plausible. Intel choose speed over security, even more so than others. The software fixes to reign in speculative execution are in fact novel and haven't been thought of before, which also tells me this was something the whole industry just didn't pay enough attention to.

[cybertraveler]

I might buy this if we didn't know about Intel ME, which is also a decade old now, and is a much cleaner and more powerful backdoor. We would have at least seen hints of a Spectre V2 JIT-based exploits in the NSA hacks, and we didn't. Why would the NSA bother with something so indirect when there are more direct exploits available in the form of ME or other numerous browser-based exploits? So, yeah, I don't even find this line of thinking plausible. Intel choose speed over security, even more so than others. The software fixes to reign in speculative execution are in fact novel and haven't been thought of before, which also tells me this was something the whole industry just didn't pay enough attention to.

You seem to be assuming that they wouldn't have multiple attack vectors.

You also seem to be assuming that there would be hints of these attacks in the leaks made so far. I don't know why you would assume that. There are layers of secrecy within organisations like that, as WesternSemiConductor pointed out.

You're not buying. I'm not selling. I'm just offering 1 possible, plausible explanation for free. Your assumptions offered make it no less plausible.

Of course these issues could just be over-sights and mistakes. I'm not jumping to any conclusions or beliefs either way.

[oiaohm]

In-order would make the CPU extremely slow. IBM tried already a similar experiment and it was total failure.

To be clear: I'm talking about general purpose computing, not supercomputers, which nobody here really gives a crap about. You know, the kind of thing with millions of branches all over the place and very little straight parallelization potential. That's why VLIW was a failure in this context.

Weasel please note IBM still makes the power cpu with the 8 hyperthreads per cpu core. This is different the a cray barrel engine/thread management core the big difference between what IBM did and what risc-v prototype does is that you in fact have thread priorities in the risc-v one just like the cray barrel. So higher priority threads in the risc-v prototype gets faster access back to cpu for processing once the issue that caused them to stall has passed.

IBM power is effective divide cpu max speed by 8 of course this is not good. X86 with speculative is not getting 100 percent either speculative in fact consume memory bandwidth and is design that you have more memory bandwidth than application code would normally use

Please note what I said speculative is designed that you have more memory bandwidth than cpu processing will normal use. Take a close look with the multi core X86 you have more application demand on memory than memory bandwidth so you are no longer getting ideal performance gain by speculative because speculative is consuming up a resource you are short of being memory bandwidth on processing you are throwing away.

Also when IBM failed people were not designing programs for multi core being mulit thread. Its not like on modern x86 you get faster by design single threaded in fact that is how be in many cases slower than older x86 chips on newer x86 chips.

In order with multi instruction processing per cycle with thread management engine with current day applications may in fact be faster than speculative execution why simply that this in order processing is not using any memory access that will not be used. So you are not bottlenecking performance as much between caches and the mmu.

VLIW fails for a different reason VLIW was depending on compiler to order instructions correctly and when a compiler does not fill instruction each instruction is quite large so high performance hit also VLIW is not a general instruction set VLIW are design for particular silicon designs where a CISC or a RISC is a general instruction set that can be run on multi silicon designs. VLIW is still used in some fields. VLIW has simplered filed the CPU core so the CPU itself cannot stack instructions at run-time. VLIW runs into trouble because it consuming all the processing ports inside the cpu with each instruction. So you cannot really multi thread per cycle a VLIW. Yes VLIW are in order by they are not in order with instruction read head or in order with barrel multi threading.

Cray Barrel multi threading if you have left over ports to process stuff in a barrel set up you can look at the other threads if there is something you can execute on that port now. So yes you are inorder but not quite. So with a multi threaded program you can get quite high cpu core usage.

You have two historic ways to fill the processing capabilities of the cpu core. Speculative execution and Cray barrel multi threading. Barrel multi threaded is also like how risc-v vector is done except you extend this cross multi threads the cpu core is processing.

Speculative has history perform better on single threaded code that you with to make run faster at the cost of wasting some cpu time and wasting some memory bandwidth. Barrel multi threaded has historically performed well on mulit threaded workloads with no wasted cpu time or no wasted memory accesses but is hindered when stuck without enough thread to process as it end up not filling the cpu processing as much as it can. Funny part is barrel multi threading can in fact work out faster than Speculative due to not wasting memory access or cpu time.

As more of a general applications come multi threaded there has to come a time when barrel multi threading is better performing than speculative execution. Of course barrel multi threaded does not have any of the security problems caused by reading memory for wasted processing.

In some ways a Ideal chip would be able to switch between speculative and barrel multi threading on fly. Use barrel when you have a lot of threads to process so you are not wasting cpu and memory access. Use speculative when you only have a small number of threads to process where wasting some cpu and memory will not a problem.

But if you cannot make speculative secure the over head of barrel multi threaded without enough threads could be lower than the cost of fixing up speculative security faults in software. This is the question those designing current day RISC-V silicon are asking themselfs. Are we to the point where the way programs work today suite barrel multi threading in cpu better than speculative? If the answer to this is yes we don't need to bother about doing speculative even that the risc-v instruction set was designed to be suitable for speculative.

Basically its time to revisit the old methods and see if they suite the current day and future general processing better. General processing applications requirements from 10 years ago are different to now . Just go back to 2010 are notice how many applications had single thread processing compared to now yes single thread processing is reducing this is tipping the balance in the barrel multi threaded direction.

[starshipeleven]

Remember: neither myself or WesternSemiConductor have made a claim or even stated our belief that an intelligence agency is behind this. We're just presenting plausible scenarios.

Please apply Occam's Razor for once, why you seem to support all bullshit tinfoil theories?

The most likely reason is stupidity, not over-arching evil scheming. Besides, three-letter agencies have already the Intel ME to play with, they don't need much more than full access to everything.

And in this case we have a pretty obvious "stupidity" theory.

Word on the streets has been that Intel hardware QA was being limited for the sake of not hampering performance. Intel needed and still needs to make CPUs with more performance than the older gens to sell.

[Weasel]

Weasel please note IBM still makes the power cpu with the 8 hyperthreads per cpu core.

Which is completely useless for general purpose computing and that is the reason you won't find these CPUs there.

I wonder if you guys realize that supercomputers execute stupidly simple code, but a lot of it. They don't execute complex code with thousands of branches and other complexities: they execute simple equations and brute force calculate them in parallel. Yet a lot of people think that supercomputers, somehow, must be extremely complex beasts and executing stuff that's so complicated for the feeble desktop minds. In fact a high-end desktop CPU is likely to be faster than a supercomputer's CPU at a single-threaded task and that's the kind of tasks you need for general purpose computing.

Which is a completely different thing than single-threaded performance, and that's what you need for general purpose computing. Otherwise, just use a GPU for general purpose computing and see where it gets you?

Speculative execution exists to increase SINGLE THREADED performance. Stop this bullshit with 8 threads per core, that is NOT SINGLE THREADED performance so it's NOT an option. Literally comparing apples with oranges.

[cybertraveler]

Please apply Occam's Razor for once,

Firstly; I do apply Occam's razor to problems.

Secondly; how do you know I haven't applied it to this situation? For literally the third time now: I have not stated what I believe or even what I think is most likely. I just stated a plausible scenario, without assigning any kind of probability to it that it's true.

why you seem to support all bullshit tinfoil theories?

No reasonable and free thinker would use that kind of sophistry in a conversation with someone they disagree with. It's a form of poisoning the well and it's a minor ad-hominem. You're not out-right stating it, but you're also implying that the theory I presented earlier is a bullshit tinfoil-hat wearing theory. This is an extremely low form of argument. You either don't know any better, or you're trying to manipulate the minds of onlookers who don't know how to defend themself from this kind of sophistry.

Your comments are a signal to me that you might have a wikipedian-mind or that you're just an oficialdom-repeater. IE you don't truly think for yourself, you just regurgitate what your perception of officialdom tells you to and you stay away from anything which might get you mocked or attacked by officialdom. I will ignore your comments from here on out when it comes to subjects like this, because I already know what officialdom and wikipedia have to say on topics like this. I don't need to have that information repeated back to me or be insulted by people like yourself. I'm certainly not getting anything of value from your comments on these matters.

The most likely reason is stupidity, not over-arching evil scheming. Besides, three-letter agencies have already the Intel ME to play with, they don't need much more than full access to everything.

Maybe, yeah. I'm wondering if you're aware that you made a claim above that the three letter agencies have been involved in over-arching evil scheming when it comes to the Intel ME. Sounds like a "bullshit tinfoil theory" to me. /s

And in this case we have a pretty obvious "stupidity" theory.

If I personally was assigned the job of covertly compromising the hardware of popular CPUs, I would consider it desirable to have no links leading back to me and I'd want there to be a plausible alternative explanation for the bugs.

I wouldn't have to engineer these bugs myself if I was tasked with creating them. I could bring about these bugs by various means in a management role:

• reduce the testing process to "save money".
• increase stress on engineers by increasing work hours / demands to "get more value out of our engineers".
• encourage re-use of a base design that I know is buggy because "it's cost effective" and "faster than making a new design".
• fire people or promote people to new positions who are looking into fixing the existing bugs because "alternative reasons".

These agencies in the past have apparently done stuff as crazy as surgically implant a cat with a listening devices and released the cat near an embassy to gather intel (look it up). I'm sure if someone at one of these agencies brought up the idea of "secretly compromising hardware by reducing internal QA", that's going to be at least considered.

[starshipeleven]

Secondly; how do you know I haven't applied it to this situation?

Because you didn't. Sorry but I don't bite all the wrapping in "it's just a theory", if it's at the same level of bullshit of "the jews did it" it does not even warrant mentioning.

Really, back in the good old days it was evil spirits, then it was daemons, then it was the jews, now it's NSA or the greys, same bullshit. There is no evil plotting behind the curtain, it's 99.9999% human stupidity.

No reasonable and free thinker would use that kind of sophistry in a conversation with someone they disagree with.

I'm a truthseeker, please. I don't think freely, I search truth. Thinking freely makes you fall into the pits of your own mind, your main enemy is yourself.

I will ignore your comments from here on out when it comes to subjects like this,

Yeah, ignore all the people who dissent with your ideas, that's a great way to self-validate your beliefs. A great way to fall in the pits of your own mind.

Maybe, yeah. I'm wondering if you're aware that you made a claim above that the three letter agencies have been involved in over-arching evil scheming when it comes to the Intel ME. Sounds like a "bullshit tinfoil theory" to me. /s

No, it's our friend Occam's Razor again. If NSA wanted to do some shit would they

-do some weird-ass shenanigans with low-level silicon design that are a total pain in the ass to actually exploit, and can be patched with microcode updates
-take control of something that is basically a hardware-level backdoor and is relatively easily exploitable as all research so far has shown, and rely on something that is seldom if ever updated (board firmware)

What is the easiest and most likely to work well? Hmm?

If I personally was assigned the job of covertly compromising the hardware of popular CPUs, I would consider it desirable to have no links leading back to me and I'd want there to be a plausible alternative explanation for the bugs.

The same applies to ME or UEFI bugs. There is nothing that plainly states that these bugs were planted by someone either, but they allow so much more control over the system that they dwarf Meltdown by orders of magnitude.

I wouldn't have to engineer these bugs myself if I was tasked with creating them. I could bring about these bugs by various means in a management role:

• reduce the testing process to "save money".
• increase stress on engineers by increasing work hours / demands to "get more value out of our engineers".
• encourage re-use of a base design that I know is buggy because "it's cost effective" and "faster than making a new design".
• fire people or promote people to new positions who are looking into fixing the existing bugs because "alternative reasons".

These agencies in the past have apparently done stuff as crazy as surgically implant a cat with a listening devices and released the cat near an embassy to gather intel (look it up). I'm sure if someone at one of these agencies brought up the idea of "secretly compromising hardware by reducing internal QA", that's going to be at least considered.

Again, you are doing the opposite of Occam's Razor, take the most crazy, complex bullshit ideas and try to execute them, when there are far more easy and manageable ways with higher chances of success available.

Planting a bug somewhere is as easy as using the old trick of the trade also used by decent criminal organizations.
You "convince" someone to do it with convincing threats to him/family, AND you pay him handsomely for his "service". This way he cannot just flip it and call the cops on you as if that happened you could just dig up the payment and mysteriously hand this information to the investigators.

Of course this does not require showing up at his door with official NSA cars and official NSA officers with official NSA badges shown in his face.

[cybertraveler]

Because you didn't. Sorry but I don't bite all the wrapping in "it's just a theory"

Ascribing motive to your opponent so you can strawman argue against the the motive you ascribed. Yeah; I'm done with you.

[starshipeleven]

Ascribing motive to your opponent so you can strawman argue against the the motive you ascribed.

Sorry what? "ascribing motive" means that I assumed why you did it.

I didn't do that, I have no way of knowing why you post bullshit.

I observed what you did and commented on what reasoning failures you must have made to even consider that theory as worthy of discussion, assuming you actually used reasoning at all.

Because really, it has the same likelihood of being all a Jew plot. I mean, look at all the ties they have to jews in the USA and in Israel. Must be yet another plot of dem'jews to take over the world, right?