Rocksolid Light

Welcome to Rocksolid Light

mail  files  register  newsreader  groups  login

Message-ID:  

Matter cannot be created or destroyed, nor can it be returned without a receipt.


devel / comp.arch / Re: Another security vulnerability

SubjectAuthor
* Another security vulnerabilityStephen Fuld
+* Re: Another security vulnerabilityMitchAlsup1
|+* Re: Another security vulnerabilityStefan Monnier
||`- Re: Another security vulnerabilityMichael S
|`- Re: Another security vulnerabilityMichael S
+* Re: Another security vulnerabilityLawrence D'Oliveiro
|+- Re: Another security vulnerabilityStefan Monnier
|`* Re: Another security vulnerabilityStephen Fuld
| `* Re: Another security vulnerabilityLawrence D'Oliveiro
|  +* Re: Another security vulnerabilityMitchAlsup1
|  |`* Re: Another security vulnerabilityLawrence D'Oliveiro
|  | `* Re: Another security vulnerabilityStephen Fuld
|  |  `* Re: Another security vulnerabilityLawrence D'Oliveiro
|  |   `- Re: Another security vulnerabilityMitchAlsup1
|  `- Re: Another security vulnerabilityMichael S
+* Re: Another security vulnerabilityThomas Koenig
|+* Re: Another security vulnerabilityAnton Ertl
||`* Re: Another security vulnerabilityScott Lurndal
|| +* Re: Another security vulnerabilityLawrence D'Oliveiro
|| |`* Re: Another security vulnerabilityScott Lurndal
|| | `- Re: Another security vulnerabilityAnton Ertl
|| `* Re: Another security vulnerabilityAnton Ertl
||  `* Re: Another security vulnerabilityScott Lurndal
||   `- Re: Another security vulnerabilityAnton Ertl
|+- Re: Another security vulnerabilityMichael S
|`- Re: Another security vulnerabilityScott Lurndal
+* Re: Another security vulnerabilityAnton Ertl
|`* Re: Another security vulnerabilityMichael S
| `* Re: Another security vulnerabilityThomas Koenig
|  +* Re: Another security vulnerabilityEricP
|  |+* Re: Another security vulnerabilityThomas Koenig
|  ||`* Re: Another security vulnerabilityEricP
|  || `- Re: Another security vulnerabilityThomas Koenig
|  |`* Re: Another security vulnerabilityAnton Ertl
|  | `* Re: Another security vulnerabilityEricP
|  |  `* Re: Another security vulnerabilityMitchAlsup1
|  |   `* Re: Another security vulnerabilityEricP
|  |    +* Re: Another security vulnerabilityMitchAlsup1
|  |    |`* Re: Another security vulnerabilityPaul A. Clayton
|  |    | `* Re: Another security vulnerabilityScott Lurndal
|  |    |  `* Re: Another security vulnerabilityPaul A. Clayton
|  |    |   `* Re: Another security vulnerabilityScott Lurndal
|  |    |    `- Re: Another security vulnerabilityMitchAlsup1
|  |    `* Re: Another security vulnerabilityStefan Monnier
|  |     `* Re: Another security vulnerabilityThomas Koenig
|  |      +* Re: Another security vulnerabilityMitchAlsup1
|  |      |`* Re: Another security vulnerabilityThomas Koenig
|  |      | `* Re: Another security vulnerabilityMitchAlsup1
|  |      |  +* Re: Another security vulnerabilityScott Lurndal
|  |      |  |`- Re: Another security vulnerabilityMitchAlsup1
|  |      |  `* Re: Another security vulnerabilityPaul A. Clayton
|  |      |   `- Re: Another security vulnerabilityMitchAlsup1
|  |      `* Re: Another security vulnerabilityStefan Monnier
|  |       `- Re: Another security vulnerabilityMitchAlsup1
|  `* Re: Another security vulnerabilityAnton Ertl
|   `* Re: Another security vulnerabilityScott Lurndal
|    `- Re: Another security vulnerabilityScott Lurndal
`* Re: Another security vulnerabilityJohn Savard
 `* Re: Another security vulnerabilityMichael S
  `- Re: Another security vulnerabilityLawrence D'Oliveiro

Pages:123
Re: Another security vulnerability

<uukcpe$4g83$2@dont-email.me>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38216&group=comp.arch#38216

  copy link   Newsgroups: comp.arch
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: tkoenig@netcologne.de (Thomas Koenig)
Newsgroups: comp.arch
Subject: Re: Another security vulnerability
Date: Wed, 3 Apr 2024 20:05:02 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 12
Message-ID: <uukcpe$4g83$2@dont-email.me>
References: <utpoi2$b6to$1@dont-email.me>
<2024Mar25.082534@mips.complang.tuwien.ac.at>
<20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me>
<VpVMN.731075$p%Mb.618266@fx15.iad>
<2024Mar27.191411@mips.complang.tuwien.ac.at>
<HH_MN.732789$p%Mb.8039@fx15.iad>
<5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org>
<TfhNN.110764$_a1e.90012@fx16.iad>
<jwvedbmco81.fsf-monnier+comp.arch@gnu.org>
Injection-Date: Wed, 03 Apr 2024 20:05:02 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="444ecd996ba17c8a0c9281729e348bfe";
logging-data="147715"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+oQAqc0YrbufaBA2rbotH+yoQfMn9MUSU="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:iYP2laevhCiMEGPpxdPxqHzyP6A=
 by: Thomas Koenig - Wed, 3 Apr 2024 20:05 UTC

Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>> Since each chased pointer starts back at LSQ, the cost is no different
>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>> having been applied first.
>
> I thought the important difference is that the decision to prefetch or
> not can be done dynamically based on past history.

Programmers and compilers are notoriously bad at predicting
branches (except for error branches), but ought to be quite good
at predicting prefetches. If a pointer is loaded, chances are
very high that are it will be dereferenced.

Re: Another security vulnerability

<561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38219&group=comp.arch#38219

  copy link   Newsgroups: comp.arch
Date: Wed, 3 Apr 2024 21:37:13 +0000
Subject: Re: Another security vulnerability
From: mitchalsup@aol.com (MitchAlsup1)
Newsgroups: comp.arch
X-Rslight-Site: $2y$10$Q0KBeeDw8PtBBkvT9fNaJ.htRLkdwsMQSHxliC2rlmPNJUvysy77W
X-Rslight-Posting-User: ac58ceb75ea22753186dae54d967fed894c3dce8
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <utpoi2$b6to$1@dont-email.me> <2024Mar25.082534@mips.complang.tuwien.ac.at> <20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me>
Organization: Rocksolid Light
Message-ID: <561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org>
 by: MitchAlsup1 - Wed, 3 Apr 2024 21:37 UTC

Thomas Koenig wrote:

> Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>>> Since each chased pointer starts back at LSQ, the cost is no different
>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>> having been applied first.
>>
>> I thought the important difference is that the decision to prefetch or
>> not can be done dynamically based on past history.

> Programmers and compilers are notoriously bad at predicting
> branches (except for error branches),

Which are always predicted to have no error.

> but ought to be quite good
> at predicting prefetches.

What makes you think programmers understand prefetches any better than
exceptions ??
> If a pointer is loaded, chances are
> very high that are it will be dereferenced.

What if the value loaded is NULL.

Re: Another security vulnerability

<uumpan$pq1o$1@dont-email.me>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38225&group=comp.arch#38225

  copy link   Newsgroups: comp.arch
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: tkoenig@netcologne.de (Thomas Koenig)
Newsgroups: comp.arch
Subject: Re: Another security vulnerability
Date: Thu, 4 Apr 2024 17:51:19 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 39
Message-ID: <uumpan$pq1o$1@dont-email.me>
References: <utpoi2$b6to$1@dont-email.me>
<2024Mar25.082534@mips.complang.tuwien.ac.at>
<20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me>
<VpVMN.731075$p%Mb.618266@fx15.iad>
<2024Mar27.191411@mips.complang.tuwien.ac.at>
<HH_MN.732789$p%Mb.8039@fx15.iad>
<5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org>
<TfhNN.110764$_a1e.90012@fx16.iad>
<jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me>
<561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org>
Injection-Date: Thu, 04 Apr 2024 17:51:19 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="e2ad545fe6137ff6f00be81ed6b5bafa";
logging-data="845880"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/PPR220OwBws2YBuov1NVDW9BaIlVuaME="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:sDo73j54LSHqY9A0U7VEyJuv+fs=
 by: Thomas Koenig - Thu, 4 Apr 2024 17:51 UTC

MitchAlsup1 <mitchalsup@aol.com> schrieb:
> Thomas Koenig wrote:
>
>> Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>>>> Since each chased pointer starts back at LSQ, the cost is no different
>>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>>> having been applied first.
>>>
>>> I thought the important difference is that the decision to prefetch or
>>> not can be done dynamically based on past history.
>
>> Programmers and compilers are notoriously bad at predicting
>> branches (except for error branches),
>
> Which are always predicted to have no error.

On the second or third time, certainly. Hmmm... given hot/cold
splitting which is fairly standard by now, do branch predictors
take this into account?

>> but ought to be quite good
>> at predicting prefetches.
>
> What makes you think programmers understand prefetches any better than
> exceptions ??

Pointers are used in many common data structures; linked list,
trees, ... A programmer who does not know about dereferencing
pointers should be kept away from computer keyboards, preferably
at a distance of at least 3 m.

>
>> If a pointer is loaded, chances are
>> very high that are it will be dereferenced.
>
> What if the value loaded is NULL.

Then it should be trivially predicted that it should not be prefetched.

Re: Another security vulnerability

<2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38228&group=comp.arch#38228

  copy link   Newsgroups: comp.arch
Date: Thu, 4 Apr 2024 20:09:39 +0000
Subject: Re: Another security vulnerability
From: mitchalsup@aol.com (MitchAlsup1)
Newsgroups: comp.arch
X-Rslight-Site: $2y$10$qIQvS7iLGgTE1Xw3t5fSl.YToG8vdG7k8PeapvYuRlWwHSerHOmXi
X-Rslight-Posting-User: ac58ceb75ea22753186dae54d967fed894c3dce8
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <utpoi2$b6to$1@dont-email.me> <2024Mar25.082534@mips.complang.tuwien.ac.at> <20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me> <561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org> <uumpan$pq1o$1@dont-email.me>
Organization: Rocksolid Light
Message-ID: <2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org>
 by: MitchAlsup1 - Thu, 4 Apr 2024 20:09 UTC

Thomas Koenig wrote:

> MitchAlsup1 <mitchalsup@aol.com> schrieb:
>> Thomas Koenig wrote:
>>
>>> Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>>>>> Since each chased pointer starts back at LSQ, the cost is no different
>>>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>>>> having been applied first.
>>>>
>>>> I thought the important difference is that the decision to prefetch or
>>>> not can be done dynamically based on past history.
>>
>>> Programmers and compilers are notoriously bad at predicting
>>> branches (except for error branches),
>>
>> Which are always predicted to have no error.

There I mean that the programmer wrote the code::

if( no error so far )
{
then continue
}
else
{
deal with the error
}

Many times, the "deal with the error" code is never even fetched.

> On the second or third time, certainly. Hmmm... given hot/cold
> splitting which is fairly standard by now, do branch predictors
> take this into account?

First we are talking about predicting branches at compile time and
the way the programmer writes the source code, not about the dynamic
predictions of HW.

Given that it is compile time, one either predicts it is taken
(loops) or not taken (errors and initialization) and arrange
the code such that fall through is the predicted pattern (except
for loops).

Then at run time, all these branches are predicted with the standard
predictors present in the core.
Initialization stuff is mispredicted once or twice
error code is only mispredicted when an error occurs
loops are mispredicted once or twice per entrance.

Also note:: With an ISA like My 66000, one can preform branching using
predication and neither predict the branch nor modify where FETCH is
fetching. Ideally, predication should deal with hard to predict branches
and all flow control where the then and else clauses are short. When
these are removed from the predictor, prediction should improve--maybe
not in the number of predictions that are correct, but in the total time
wasted on branching (including both repair and misfetching overheads).

>>> but ought to be quite good
>>> at predicting prefetches.
>>
>> What makes you think programmers understand prefetches any better than
>> exceptions ??

> Pointers are used in many common data structures; linked list,
> trees, ... A programmer who does not know about dereferencing
> pointers should be kept away from computer keyboards, preferably
> at a distance of at least 3 m.

3Km ??

>>
>>> If a pointer is loaded, chances are
>>> very high that are it will be dereferenced.
>>
>> What if the value loaded is NULL.

> Then it should be trivially predicted that it should not be prefetched.

Re: Another security vulnerability

<4aEPN.165923$46Te.41285@fx38.iad>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38229&group=comp.arch#38229

  copy link   Newsgroups: comp.arch
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!feeder.usenetexpress.com!tr2.iad1.usenetexpress.com!peer01.iad!feed-me.highwinds-media.com!news.highwinds-media.com!fx38.iad.POSTED!not-for-mail
X-newsreader: xrn 9.03-beta-14-64bit
Sender: scott@dragon.sl.home (Scott Lurndal)
From: scott@slp53.sl.home (Scott Lurndal)
Reply-To: slp53@pacbell.net
Subject: Re: Another security vulnerability
Newsgroups: comp.arch
References: <utpoi2$b6to$1@dont-email.me> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me> <561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org> <uumpan$pq1o$1@dont-email.me> <2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org>
Lines: 59
Message-ID: <4aEPN.165923$46Te.41285@fx38.iad>
X-Complaints-To: abuse@usenetserver.com
NNTP-Posting-Date: Thu, 04 Apr 2024 20:35:12 UTC
Organization: UsenetServer - www.usenetserver.com
Date: Thu, 04 Apr 2024 20:35:12 GMT
X-Received-Bytes: 2834
 by: Scott Lurndal - Thu, 4 Apr 2024 20:35 UTC

mitchalsup@aol.com (MitchAlsup1) writes:
>Thomas Koenig wrote:
>
>> MitchAlsup1 <mitchalsup@aol.com> schrieb:
>>> Thomas Koenig wrote:
>>>
>>>> Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>>>>>> Since each chased pointer starts back at LSQ, the cost is no different
>>>>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>>>>> having been applied first.
>>>>>
>>>>> I thought the important difference is that the decision to prefetch or
>>>>> not can be done dynamically based on past history.
>>>
>>>> Programmers and compilers are notoriously bad at predicting
>>>> branches (except for error branches),
>>>
>>> Which are always predicted to have no error.
>
>There I mean that the programmer wrote the code::
>
> if( no error so far )
> {
> then continue
> }
> else
> {
> deal with the error
> }
>
>Many times, the "deal with the error" code is never even fetched.
>
>> On the second or third time, certainly. Hmmm... given hot/cold
>> splitting which is fairly standard by now, do branch predictors
>> take this into account?
>
>First we are talking about predicting branches at compile time and
>the way the programmer writes the source code, not about the dynamic
>predictions of HW.

gcc provides a way to "annotate" a condition with the expected
common result:

#define likely(x) __builtin_expect(!!(x), 1)
#define unlikely(x) __builtin_expect(!!(x), 0)

if (likely(bus_enable.s.enabled)) {
do something
} else {
do something else
}

This will affect the layout of the code (e.g. deferring generation
of the else clause with the result that it ends up in a different
cache line or page).

It's used in the linux kernel, and in certain cpu bound applications.

Re: Another security vulnerability

<0574ba752b8642130dc751c693b1f86b@www.novabbs.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38230&group=comp.arch#38230

  copy link   Newsgroups: comp.arch
Date: Thu, 4 Apr 2024 20:57:45 +0000
Subject: Re: Another security vulnerability
From: mitchalsup@aol.com (MitchAlsup1)
Newsgroups: comp.arch
X-Rslight-Site: $2y$10$WDTq2v5Qjc36FHn2jvJdDu9aIhOdmExGYnK.K9HV5j4F9HZQMr7tq
X-Rslight-Posting-User: ac58ceb75ea22753186dae54d967fed894c3dce8
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <utpoi2$b6to$1@dont-email.me> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me> <561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org> <uumpan$pq1o$1@dont-email.me> <2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org> <4aEPN.165923$46Te.41285@fx38.iad>
Organization: Rocksolid Light
Message-ID: <0574ba752b8642130dc751c693b1f86b@www.novabbs.org>
 by: MitchAlsup1 - Thu, 4 Apr 2024 20:57 UTC

Scott Lurndal wrote:

> mitchalsup@aol.com (MitchAlsup1) writes:
>>Thomas Koenig wrote:
>>
>>> MitchAlsup1 <mitchalsup@aol.com> schrieb:
>>>> Thomas Koenig wrote:
>>>>
>>>>> Stefan Monnier <monnier@iro.umontreal.ca> schrieb:
>>>>>>> Since each chased pointer starts back at LSQ, the cost is no different
>>>>>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>>>>>> having been applied first.
>>>>>>
>>>>>> I thought the important difference is that the decision to prefetch or
>>>>>> not can be done dynamically based on past history.
>>>>
>>>>> Programmers and compilers are notoriously bad at predicting
>>>>> branches (except for error branches),
>>>>
>>>> Which are always predicted to have no error.
>>
>>There I mean that the programmer wrote the code::
>>
>> if( no error so far )
>> {
>> then continue
>> }
>> else
>> {
>> deal with the error
>> }
>>
>>Many times, the "deal with the error" code is never even fetched.
>>
>>> On the second or third time, certainly. Hmmm... given hot/cold
>>> splitting which is fairly standard by now, do branch predictors
>>> take this into account?
>>
>>First we are talking about predicting branches at compile time and
>>the way the programmer writes the source code, not about the dynamic
>>predictions of HW.

> gcc provides a way to "annotate" a condition with the expected
> common result:

> #define likely(x) __builtin_expect(!!(x), 1)
> #define unlikely(x) __builtin_expect(!!(x), 0)

> if (likely(bus_enable.s.enabled)) {
> do something
> } else {
> do something else
> }

> This will affect the layout of the code (e.g. deferring generation
> of the else clause with the result that it ends up in a different
> cache line or page).

> It's used in the linux kernel, and in certain cpu bound applications.

Thank you for pointing this out.

Re: Another security vulnerability

<jwvcyr3bwca.fsf-monnier+comp.arch@gnu.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38235&group=comp.arch#38235

  copy link   Newsgroups: comp.arch
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: monnier@iro.umontreal.ca (Stefan Monnier)
Newsgroups: comp.arch
Subject: Re: Another security vulnerability
Date: Fri, 05 Apr 2024 12:54:50 -0400
Organization: A noiseless patient Spider
Lines: 38
Message-ID: <jwvcyr3bwca.fsf-monnier+comp.arch@gnu.org>
References: <utpoi2$b6to$1@dont-email.me>
<2024Mar25.082534@mips.complang.tuwien.ac.at>
<20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me>
<VpVMN.731075$p%Mb.618266@fx15.iad>
<2024Mar27.191411@mips.complang.tuwien.ac.at>
<HH_MN.732789$p%Mb.8039@fx15.iad>
<5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org>
<TfhNN.110764$_a1e.90012@fx16.iad>
<jwvedbmco81.fsf-monnier+comp.arch@gnu.org>
<uukcpe$4g83$2@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain
Injection-Date: Fri, 05 Apr 2024 16:57:25 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="92dc925e5ec2cd5b979165abe0b32d58";
logging-data="1580301"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+gTGAT7Ddw7KGMfNA6epgdyQn7yBEwtsg="
User-Agent: Gnus/5.13 (Gnus v5.13)
Cancel-Lock: sha1:Gxw6PF98mD8/8H/o0oHYs0mEZAU=
sha1:+OhSfJrGhiy9k0BL7rAJFmzcU5Y=
 by: Stefan Monnier - Fri, 5 Apr 2024 16:54 UTC

>>> Since each chased pointer starts back at LSQ, the cost is no different
>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>> having been applied first.
>> I thought the important difference is that the decision to prefetch or
>> not can be done dynamically based on past history.
> Programmers and compilers are notoriously bad at predicting
> branches (except for error branches), but ought to be quite good
> at predicting prefetches. If a pointer is loaded, chances are
> very high that are it will be dereferenced.

I don't think it's that simple: prefetches only bring the data into L1
cache, so they're only useful if:

- The data is not already in L1.
- The data will be used soon (i.e. before it gets thrown away from the cache).
- The corresponding load doesn't occur right away.

In all other cases, the prefetch will be just wasted work.

It's easy for programmers to "predict" those (dependent) loads which will occur
right away, but those don't really benefit from a prefetch.
E.g. if the dependent load is done 2 cycles later, performing a prefetch
lets you start the memory access 2 cycles early, but since that access
is not in L1 it'll take more than 10 cycles, so shaving
2 cycles off isn't of great benefit.

Given that we're talking about performing a prefetch on the result of
a previous load, and loads tend to already have a fairly high latency
(3-5 cycles), "2 cycles later" really means "5-7 cycles after the
beginning of the load of that pointer". That can easily translate to 20
instructions later.

My gut feeling is that it's difficult for programmers to predict what
will happen more than 20 instructions further without looking at
detailed profiling.

Stefan

Re: Another security vulnerability

<6111de53d996b394a458b86328fcd59f@www.novabbs.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38237&group=comp.arch#38237

  copy link   Newsgroups: comp.arch
Date: Fri, 5 Apr 2024 21:28:59 +0000
Subject: Re: Another security vulnerability
From: mitchalsup@aol.com (MitchAlsup1)
Newsgroups: comp.arch
X-Rslight-Site: $2y$10$h.YeYUj2nw.Y6HKyDbk32OTP6i0O7kdnGxPslLinQG04I8Danx8cK
X-Rslight-Posting-User: ac58ceb75ea22753186dae54d967fed894c3dce8
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <utpoi2$b6to$1@dont-email.me> <2024Mar25.082534@mips.complang.tuwien.ac.at> <20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me> <jwvcyr3bwca.fsf-monnier+comp.arch@gnu.org>
Organization: Rocksolid Light
Message-ID: <6111de53d996b394a458b86328fcd59f@www.novabbs.org>
 by: MitchAlsup1 - Fri, 5 Apr 2024 21:28 UTC

Stefan Monnier wrote:

>>>> Since each chased pointer starts back at LSQ, the cost is no different
>>>> than an explicit Prefetch instruction, except without (a),(b) and (c)
>>>> having been applied first.
>>> I thought the important difference is that the decision to prefetch or
>>> not can be done dynamically based on past history.
>> Programmers and compilers are notoriously bad at predicting
>> branches (except for error branches), but ought to be quite good
>> at predicting prefetches. If a pointer is loaded, chances are
>> very high that are it will be dereferenced.

> I don't think it's that simple: prefetches only bring the data into L1
> cache, so they're only useful if:

> - The data is not already in L1.
> - The data will be used soon (i.e. before it gets thrown away from the cache).
> - The corresponding load doesn't occur right away.

> In all other cases, the prefetch will be just wasted work.

> It's easy for programmers to "predict" those (dependent) loads which will occur
> right away, but those don't really benefit from a prefetch.
> E.g. if the dependent load is done 2 cycles later, performing a prefetch
> lets you start the memory access 2 cycles early, but since that access
> is not in L1 it'll take more than 10 cycles, so shaving
> 2 cycles off isn't of great benefit.

> Given that we're talking about performing a prefetch on the result of
> a previous load, and loads tend to already have a fairly high latency
> (3-5 cycles), "2 cycles later" really means "5-7 cycles after the
> beginning of the load of that pointer". That can easily translate to 20
> instructions later.

> My gut feeling is that it's difficult for programmers to predict what
> will happen more than 20 instructions further without looking at
> detailed profiling.

Difficult becomes impossible when the code has to operate "well" over
a range of implementations. {{With some suitable definition of "well"}}

Consider deciding how far into the future (counting instructions) a
prefetch has to be placed so that the data arrives before use. Then
consider the smallest execution window is 16 instructions and the
largest execution window is 300 instructions; and you want the same
code to be semi-optimal on both.

> Stefan

Re: Another security vulnerability

<uuv2me$30pf8$1@dont-email.me>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38244&group=comp.arch#38244

  copy link   Newsgroups: comp.arch
Path: i2pn2.org!rocksolid2!news.neodome.net!news.mixmin.net!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: paaronclayton@gmail.com (Paul A. Clayton)
Newsgroups: comp.arch
Subject: Re: Another security vulnerability
Date: Sun, 7 Apr 2024 17:20:11 -0400
Organization: A noiseless patient Spider
Lines: 93
Message-ID: <uuv2me$30pf8$1@dont-email.me>
References: <utpoi2$b6to$1@dont-email.me>
<2024Mar25.082534@mips.complang.tuwien.ac.at>
<20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me>
<VpVMN.731075$p%Mb.618266@fx15.iad>
<2024Mar27.191411@mips.complang.tuwien.ac.at>
<HH_MN.732789$p%Mb.8039@fx15.iad>
<5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org>
<TfhNN.110764$_a1e.90012@fx16.iad>
<jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me>
<561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org>
<uumpan$pq1o$1@dont-email.me>
<2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Sun, 07 Apr 2024 21:20:14 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="27955524eb0c65462eca67f71f54e700";
logging-data="3171816"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/FeadWDW8qFSd7yc0WXMuIQmmc0uaAu14="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Thunderbird/91.0
Cancel-Lock: sha1:DhZyKv2K3/4q60RkSni7UC6BleM=
In-Reply-To: <2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org>
 by: Paul A. Clayton - Sun, 7 Apr 2024 21:20 UTC

On 4/4/24 4:09 PM, MitchAlsup1 wrote:> Thomas Koenig wrote:
[snip]
> Given that it is compile time, one either predicts it is taken
> (loops) or not taken (errors and initialization) and arrange
> the code such that fall through is the predicted pattern (except
> for loops).

"Boolean Formula-based Branch Prediction for Future Technologies"
(Daniel A. Jiménez et al., 2001) presents a mechanism for branch
prediction based on a static formula using global history, so *in
theory* a compiler could provide more than just taken/not-taken
predictions. ("Static Methods in Hybrid Branch Prediction", Dirk
Grunwald et al., 1998, proposed static predictor selection,
removing the selector table; Donald Lindsay, the second author of
that paper, had a PhD thesis "Static Methods in Branch Prediction".)

(A static prediction can also be used only for an agree predictor.
It is even conceivable that the dominant direction might not be
the best static agreeing prediction; e.g., if aliases would train
to an agree/disagree state that more often mispredicts the branch
[and the branch has few global entries]. Such would be a very
fragile optimization requiring considerable analysis, so it seems
very unlikely to be practical. [I have wondered if a hash of the
branch address might be XORed with predictor bits to provide a
quasi-tagging. XORing with the prediction could cause the most
interference, good for destructive aliasing; XORing with counter
or hysteresis bits would seem to moderate interfence, allowing a
prediction to be stable such that a selector would tranfer a
mispredicting branch to another table. If an expected/agree sense
was available, such tagging might be more useful.])

> Then at run time, all these branches are predicted with the
standard
> predictors present in the core.
> Initialization stuff is mispredicted once or twice

Or not at all if BTB miss generates a correct predict not taken.
(Even without that mechanism, a first encounter might be
correctly predicted by accident.)

> error code is only mispredicted when an error occurs
> loops are mispredicted once or twice per entrance.

Or never mispredicted for only-counted loops for which the
counter value is available early enough in the pipeline. (Gshare
can also predict loop exit/entry correctly for small loop counts
with few internal branches. TAGE can do better.)

> Also note:: With an ISA like My 66000, one can preform
branching using
> predication and neither predict the branch nor modify where
FETCH is
> fetching. Ideally, predication should deal with hard to predict
branches
> and all flow control where the then and else clauses are short.
When
> these are removed from the predictor, prediction should
improve--maybe
> not in the number of predictions that are correct, but in the
total time
> wasted on branching (including both repair and misfetching
overheads).

Rarely-executed blocks should presumably use branches even when
short to remove the rarely-executed code from the normal
instruction stream. I would guess that exceptional actions are
typically longer/more complicated.

(Consistent timing would also be important for some real-time
tasks and for avoiding timing side channels.)

The best performing choice would also seem to be potentially
microarchitecture-dependent. Obviously the accuracy of branch
prediction and the cost of aliasing would matter (and
perversely mispredicting a branch can _potentially_ improve
performance, though not on My 66000, I think, because more
persistent microarchitectural state is not updated until
instruction commitment).

If the predicate value is delayed and predicated operations
wait in the scheduler for this operand and the operands of one
path are available before the predicate value, branch prediction
might allow deeper speculation. For highly dynamically
predictable but short branches, deeper speculation might help
more than fetch irregularity hurts. (The predicate could be
predicted — and this prediction is needed later in the pipeline —
but not distinguishing between prediction-allowed predication
and normal predication might prevent prediction from being
implemented to avoid data-dependent timing of predication.)

(The cost of speculation can also be variable. With underutilized
resources (thermal, memory bandwidth, etc.) speculation would
generally be less expensive than with high demand on resources.)

Re: Another security vulnerability

<0b90dafcb1447704c7dbe96721ea2be5@www.novabbs.org>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=38246&group=comp.arch#38246

  copy link   Newsgroups: comp.arch
Date: Sun, 7 Apr 2024 23:50:25 +0000
Subject: Re: Another security vulnerability
From: mitchalsup@aol.com (MitchAlsup1)
Newsgroups: comp.arch
X-Rslight-Site: $2y$10$GlarYxMIiWjK/5KSOhyZHelpwYQz6BkOQJuMAxwtUsgik/9V6QhP.
X-Rslight-Posting-User: ac58ceb75ea22753186dae54d967fed894c3dce8
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <utpoi2$b6to$1@dont-email.me> <2024Mar25.082534@mips.complang.tuwien.ac.at> <20240326192941.0000314a@yahoo.com> <uu0kt1$2nr9j$1@dont-email.me> <VpVMN.731075$p%Mb.618266@fx15.iad> <2024Mar27.191411@mips.complang.tuwien.ac.at> <HH_MN.732789$p%Mb.8039@fx15.iad> <5fc6ea8088c0afe8618d2862cbacebab@www.novabbs.org> <TfhNN.110764$_a1e.90012@fx16.iad> <jwvedbmco81.fsf-monnier+comp.arch@gnu.org> <uukcpe$4g83$2@dont-email.me> <561654fafbeb5e542817dbc5f0ee993e@www.novabbs.org> <uumpan$pq1o$1@dont-email.me> <2908eb802c45ff7a998f0cc49d09f67f@www.novabbs.org> <uuv2me$30pf8$1@dont-email.me>
Organization: Rocksolid Light
Message-ID: <0b90dafcb1447704c7dbe96721ea2be5@www.novabbs.org>
 by: MitchAlsup1 - Sun, 7 Apr 2024 23:50 UTC

Paul A. Clayton wrote:

> On 4/4/24 4:09 PM, MitchAlsup1 wrote:> Thomas Koenig wrote:
> [snip]

> > Also note:: With an ISA like My 66000, one can preform
> branching using
> > predication and neither predict the branch nor modify where
> FETCH is
> > fetching. Ideally, predication should deal with hard to predict
> branches
> > and all flow control where the then and else clauses are short.
> When
> > these are removed from the predictor, prediction should
> improve--maybe
> > not in the number of predictions that are correct, but in the
> total time
> > wasted on branching (including both repair and misfetching
> overheads).

> Rarely-executed blocks should presumably use branches even when
> short to remove the rarely-executed code from the normal
> instruction stream. I would guess that exceptional actions are
> typically longer/more complicated.

If you will arrive at the join point by simply fetching there
is no reason to use a branch.

> (Consistent timing would also be important for some real-time
> tasks and for avoiding timing side channels.)

Predication is closer to fixed timing than any branching.

> The best performing choice would also seem to be potentially
> microarchitecture-dependent. Obviously the accuracy of branch
> prediction and the cost of aliasing would matter (and
> perversely mispredicting a branch can _potentially_ improve
> performance, though not on My 66000, I think, because more
> persistent microarchitectural state is not updated until
> instruction commitment).

While not committed, it is still available.

> If the predicate value is delayed and predicated operations
> wait in the scheduler for this operand and the operands of one
> path are available before the predicate value, branch prediction
> might allow deeper speculation.

Just like data forwarding, branch prediction forwarding is
easily achieved in the pipeline.

< For highly dynamically
> predictable but short branches, deeper speculation might help
> more than fetch irregularity hurts.

What can possibly be more regular than constant time ??

> (The predicate could be
> predicted — and this prediction is needed later in the pipeline —

One HAS TO assume that GBOoO machines will predict predicates.

> but not distinguishing between prediction-allowed predication
> and normal predication might prevent prediction from being
> implemented to avoid data-dependent timing of predication.)

> (The cost of speculation can also be variable. With underutilized
> resources (thermal, memory bandwidth, etc.) speculation would
> generally be less expensive than with high demand on resources.)

Pages:123
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor