Spectre Attacks: Exploiting Speculative Execution∗
Total Page:16
File Type:pdf, Size:1020Kb

Load more
Recommended publications
-
Computer Science 246 Computer Architecture Spring 2010 Harvard University
Computer Science 246 Computer Architecture Spring 2010 Harvard University Instructor: Prof. David Brooks [email protected] Dynamic Branch Prediction, Speculation, and Multiple Issue Computer Science 246 David Brooks Lecture Outline • Tomasulo’s Algorithm Review (3.1-3.3) • Pointer-Based Renaming (MIPS R10000) • Dynamic Branch Prediction (3.4) • Other Front-end Optimizations (3.5) – Branch Target Buffers/Return Address Stack Computer Science 246 David Brooks Tomasulo Review • Reservation Stations – Distribute RAW hazard detection – Renaming eliminates WAW hazards – Buffering values in Reservation Stations removes WARs – Tag match in CDB requires many associative compares • Common Data Bus – Achilles heal of Tomasulo – Multiple writebacks (multiple CDBs) expensive • Load/Store reordering – Load address compared with store address in store buffer Computer Science 246 David Brooks Tomasulo Organization From Mem FP Op FP Registers Queue Load Buffers Load1 Load2 Load3 Load4 Load5 Store Load6 Buffers Add1 Add2 Mult1 Add3 Mult2 Reservation To Mem Stations FP adders FP multipliers Common Data Bus (CDB) Tomasulo Review 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 LD F0, 0(R1) Iss M1 M2 M3 M4 M5 M6 M7 M8 Wb MUL F4, F0, F2 Iss Iss Iss Iss Iss Iss Iss Iss Iss Ex Ex Ex Ex Wb SD 0(R1), F0 Iss Iss Iss Iss Iss Iss Iss Iss Iss Iss Iss Iss Iss M1 M2 M3 Wb SUBI R1, R1, 8 Iss Ex Wb BNEZ R1, Loop Iss Ex Wb LD F0, 0(R1) Iss Iss Iss Iss M Wb MUL F4, F0, F2 Iss Iss Iss Iss Iss Ex Ex Ex Ex Wb SD 0(R1), F0 Iss Iss Iss Iss Iss Iss Iss Iss Iss M1 M2 -
The James Bond Quiz Eye Spy...Which Bond? 1
THE JAMES BOND QUIZ EYE SPY...WHICH BOND? 1. 3. 2. 4. EYE SPY...WHICH BOND? 5. 6. WHO’S WHO? 1. Who plays Kara Milovy in The Living Daylights? 2. Who makes his final appearance as M in Moonraker? 3. Which Bond character has diamonds embedded in his face? 4. In For Your Eyes Only, which recurring character does not appear for the first time in the series? 5. Who plays Solitaire in Live And Let Die? 6. Which character is painted gold in Goldfinger? 7. In Casino Royale, who is Solange married to? 8. In Skyfall, which character is told to “Think on your sins”? 9. Who plays Q in On Her Majesty’s Secret Service? 10. Name the character who is the head of the Japanese Secret Intelligence Service in You Only Live Twice? EMOJI FILM TITLES 1. 6. 2. 7. ∞ 3. 8. 4. 9. 5. 10. GUESS THE LOCATION 1. Who works here in Spectre? 3. Who lives on this island? 2. Which country is this lake in, as seen in Quantum Of Solace? 4. Patrice dies here in Skyfall. Name the city. GUESS THE LOCATION 5. Which iconic landmark is this? 7. Which country is this volcano situated in? 6. Where is James Bond’s family home? GUESS THE LOCATION 10. In which European country was this iconic 8. Bond and Anya first meet here, but which country is it? scene filmed? 9. In GoldenEye, Bond and Xenia Onatopp race their cars on the way to where? GENERAL KNOWLEDGE 1. In which Bond film did the iconic Aston Martin DB5 first appear? 2. -
Första Bilderna Från Inspelningen Av SPECTRE
Första bilderna från inspelningen av SPECTRE SPECTRE - THE 24TH JAMES BOND ADVENTURE WATCH FIRST FOOTAGE FROM THE SET OF SPECTRE ON www.007.com FIRST LOOK IMAGE OF DANIEL CRAIG IN SPECTRE AVAILABLE ON www.sffilm.se At 07:00 on Thursday 12th February, watch the first exciting footage of SPECTRE from Austria on www.007.com. Featuring behind the scenes action with Daniel Craig, Léa Seydoux, Dave Bautista and Director Sam Mendes. Associate Producer, Gregg Wilson says "We have to deliver an amazing sequence and this is going to be one of the major action sequences of the movie, a jewel in the crown so to speak. It's going to be spectacular and Austria seemed to offer everything that we needed to pull it off." Production Designer Dennis Gassner adds, "The thing that Sam and I talked about was how we are going to top SKYFALL, it's going to be SPECTRE and so far it's a great start. I think that we are going to continue the history of the Bond films, making things that are exciting for the audience to look at and what could be more exciting than to be on top of the world." SYNOPSIS: A cryptic message from Bond's past sends him on a trail to uncover a sinister organisation. While M battles political forces to keep the secret service alive, Bond peels back the layers of deceit to reveal the terrible truth behind SPECTRE. SPECTRE will be released on November 6, 2015 Also available on the official James Bond social channels facebook.com/JamesBond007 and @007 About Albert R. -
Spectre, Connoting a Denied That This Was a Reference to the Earlier Films
Key Terms and Consider INTERTEXTUALITY Consider NARRATIVE conventions The white tuxedo intertextually references earlier Bond Behind Bond, image of a man wearing a skeleton mask and films (previous Bonds, including Roger Moore, have worn bone design on his jacket. Skeleton has connotations of Central image, protag- the white tuxedo, however this poster specifically refer- death and danger and the mask is covering up someone’s onist, hero, villain, title, ences Sean Connery in Goldfinger), providing a sense of identity, someone who wishes to remain hidden, someone star appeal, credit block, familiarity, nostalgia and pleasure to fans who recognise lurking in the shadows. It is quite easy to guess that this char- frame, enigma codes, the link. acter would be Propp’s villain and his mask that is reminis- signify, Long shot, facial Bond films have often deliberately referenced earlier films cent of such holidays as Halloween or Day of the Dead means expression, body lan- in the franchise, for example the ‘Bond girl’ emerging he is Bond’s antagonist and no doubt wants to kill him. This guage, colour, enigma from the sea (Ursula Andress in Dr No and Halle Berry in acts as an enigma code for theaudience as we want to find codes. Die Another Day). Daniel Craig also emerged from the sea out who this character is and why he wants Bond. The skele- in Casino Royale, his first outing as Bond, however it was ton also references the title of the film, Spectre, connoting a denied that this was a reference to the earlier films. ghostly, haunting presence from Bond’s past. -
OS and Compiler Considerations in the Design of the IA-64 Architecture
OS and Compiler Considerations in the Design of the IA-64 Architecture Rumi Zahir (Intel Corporation) Dale Morris, Jonathan Ross (Hewlett-Packard Company) Drew Hess (Lucasfilm Ltd.) This is an electronic reproduction of “OS and Compiler Considerations in the Design of the IA-64 Architecture” originally published in ASPLOS-IX (the Ninth International Conference on Architectural Support for Programming Languages and Operating Systems) held in Cambridge, MA in November 2000. Copyright © A.C.M. 2000 1-58113-317-0/00/0011...$5.00 Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full cita- tion on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permis- sion and/or a fee. Request permissions from Publications Dept, ACM Inc., fax +1 (212) 869-0481, or [email protected]. ASPLOS 2000 Cambridge, MA Nov. 12-15 , 2000 212 OS and Compiler Considerations in the Design of the IA-64 Architecture Rumi Zahir Jonathan Ross Dale Morris Drew Hess Intel Corporation Hewlett-Packard Company Lucas Digital Ltd. 2200 Mission College Blvd. 19447 Pruneridge Ave. P.O. Box 2459 Santa Clara, CA 95054 Cupertino, CA 95014 San Rafael, CA 94912 [email protected] [email protected] [email protected] [email protected] ABSTRACT system collaborate to deliver higher-performance systems. -
Selective Eager Execution on the Polypath Architecture
Selective Eager Execution on the PolyPath Architecture Artur Klauser, Abhijit Paithankar, Dirk Grunwald [klauser,pvega,grunwald]@cs.colorado.edu University of Colorado, Department of Computer Science Boulder, CO 80309-0430 Abstract average misprediction latency is the sum of the architected latency (pipeline depth) and a variable latency, which depends on data de- Control-flow misprediction penalties are a major impediment pendencies of the branch instruction. The overall cycles lost due to high performance in wide-issue superscalar processors. In this to branch mispredictions are the product of the total number of paper we present Selective Eager Execution (SEE), an execution mispredictions incurred during program execution and the average model to overcome mis-speculation penalties by executing both misprediction latency. Thus, reduction of either component helps paths after diffident branches. We present the micro-architecture decrease performance loss due to control mis-speculation. of the PolyPath processor, which is an extension of an aggressive In this paper we propose Selective Eager Execution (SEE) and superscalar, out-of-order architecture. The PolyPath architecture the PolyPath architecture model, which help to overcome branch uses a novel instruction tagging and register renaming mechanism misprediction latency. SEE recognizes the fact that some branches to execute instructions from multiple paths simultaneously in the are predicted more accurately than others, where it draws from re- same processor pipeline, while retaining maximum resource avail- search in branch confidence estimation [4, 6]. SEE behaves like ability for single-path code sequences. a normal monopath speculative execution architecture for highly Results of our execution-driven, pipeline-level simulations predictable branches; it predicts the most likely successor path of a show that SEE can improve performance by as much as 36% for branch, and evaluates instructions only along this path. -
Igpu: Exception Support and Speculative Execution on Gpus
Appears in the 39th International Symposium on Computer Architecture, 2012 iGPU: Exception Support and Speculative Execution on GPUs Jaikrishnan Menon, Marc de Kruijf, Karthikeyan Sankaralingam Department of Computer Sciences University of Wisconsin-Madison {menon, dekruijf, karu}@cs.wisc.edu Abstract the evolution of traditional CPUs to illuminate why this pro- gression appears natural and imminent. Since the introduction of fully programmable vertex Just as CPU programmers were forced to explicitly man- shader hardware, GPU computing has made tremendous age CPU memories in the days before virtual memory, for advances. Exception support and speculative execution are almost a decade, GPU programmers directly and explicitly the next steps to expand the scope and improve the usabil- managed the GPU memory hierarchy. The recent release ity of GPUs. However, traditional mechanisms to support of NVIDIA’s Fermi architecture and AMD’s Fusion archi- exceptions and speculative execution are highly intrusive to tecture, however, has brought GPUs to an inflection point: GPU hardware design. This paper builds on two related in- both architectures implement a unified address space that sights to provide a unified lightweight mechanism for sup- eliminates the need for explicit memory movement to and porting exceptions and speculation on GPUs. from GPU memory structures. Yet, without demand pag- First, we observe that GPU programs can be broken into ing, something taken for granted in the CPU space, pro- code regions that contain little or no live register state at grammers must still explicitly reason about available mem- their entry point. We then also recognize that it is simple to ory. The drawbacks of exposing physical memory size to generate these regions in such a way that they are idempo- programmers are well known. -
A Survey of Published Attacks on Intel
1 A Survey of Published Attacks on Intel SGX Alexander Nilsson∗y, Pegah Nikbakht Bideh∗, Joakim Brorsson∗zx falexander.nilsson,pegah.nikbakht_bideh,[email protected] ∗Lund University, Department of Electrical and Information Technology, Sweden yAdvenica AB, Sweden zCombitech AB, Sweden xHyker Security AB, Sweden Abstract—Intel Software Guard Extensions (SGX) provides a Unfortunately, a relatively large number of flaws and attacks trusted execution environment (TEE) to run code and operate against SGX have been published by researchers over the last sensitive data. SGX provides runtime hardware protection where few years. both code and data are protected even if other code components are malicious. However, recently many attacks targeting SGX have been identified and introduced that can thwart the hardware A. Contribution defence provided by SGX. In this paper we present a survey of all attacks specifically targeting Intel SGX that are known In this paper, we present the first comprehensive review to the authors, to date. We categorized the attacks based on that includes all known attacks specific to SGX, including their implementation details into 7 different categories. We also controlled channel attacks, cache-attacks, speculative execu- look into the available defence mechanisms against identified tion attacks, branch prediction attacks, rogue data cache loads, attacks and categorize the available types of mitigations for each presented attack. microarchitectural data sampling and software-based fault in- jection attacks. For most of the presented attacks, there are countermeasures and mitigations that have been deployed as microcode patches by Intel or that can be employed by the I. INTRODUCTION application developer herself to make the attack more difficult (or impossible) to exploit. -
SUPPORT for SPECULATIVE EXECUTION in HIGH- PERFORMANCE PROCESSORS Michael David Smith Technical Report: CSL-TR-93456 November 1992
SUPPORT FOR SPECULATIVE EXECUTION IN HIGH- PERFORMANCE PROCESSORS Michael David Smith Technical Report: CSL-TR-93456 November 1992 Computer Systems Laboratory Departments of Electrical Engineering and Computer Science Stanford University Stanford, California 94305-4055 Abstract Superscalar and superpipelining techniques increase the overlap between the instructions in a pipelined processor, and thus these techniques have the potential to improve processor performance by decreasing the average number of cycles between the execution of adjacent instructions. Yet, to obtain this potential performance benefit, an instruction scheduler for this high-performance processor must find the independent instructions within the instruction stream of an application to execute in parallel. For non-numerical applications, there is an insufficient number of independent instructions within a basic block, and consequently the instruction scheduler must search across the basic block boundaries for the extra instruction-level parallelism required by the superscalar and superpipelining techniques. To exploit instruction-level parallelism across a conditional branch, the instruction scheduler must support the movement of instructions above a conditional branch, and the processor must support the speculative execution of these instructions. We define boosting, an architectural mechanism for speculative execution, that allows us to uncover the instruction-level parallelism across conditional branches without adversely affecting the instruction count of the application -
Mitigation Overview for Potential Side- Channel Cache Exploits in Linux* White Paper
Mitigation Overview for Potential Side- Channel Cache Exploits in Linux* White Paper Revision 2.0 May, 2018 Any future revisions to this content can be found at https://software.intel.com/security-software- guidance/insights/deep-dive-mitigation-overview-side- channel-exploits-linux when new information is available. This archival document is no longer being updated. Document Number: 337034-002 Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software, or service activation. Performance varies depending on system configuration. Check with your system manufacturer or retailer or learn more at www.intel.com. All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps. The products and services described may contain defects or errors known as errata which may cause deviations from published specifications. Current characterized errata are available on request. Intel provides these materials as-is, with no express or implied warranties. Intel, the Intel logo, Intel Core, Intel Atom, Intel Xeon, Intel Xeon Phi, Intel® C Compiler, Intel Software Guard Extensions, and Intel® Trusted Execution Engine are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others. Copyright © 2018, Intel Corporation. All rights reserved. Mitigation Overview for Potential Side-Channel Cache Exploits in Linux* White Paper May 2018 -
Buy Bond Cars GET the BOND LOOK • ALL ABOUT SPECTRE
Buy Bond Cars GET THE BOND LOOK • ALL ABOUT SPECTRE The name is BOND“We wanted to be better than Skyfall” freecarmag.co.uk 1 This ISSUEweek 20 / 2015 It really is all about Bond this week and what a week this will be. SPECTRE is out and Free Car Mag has seen it. The film is brilliant, not least because there are some excellent chase sequences. This is also one of the few films where you really want the baddies' car. I mean, a Jaguar C-X75 is very sexy and so incredibly rare and all those black bad boy Land Rover Defenders Just in case you don’t know the plot, a cryptic message from Bond’s past sends him on a trail to uncover a sinister organisation. While M battles political forces to keep the secret service alive, Bond peels back the layers of deceit to reveal the terrible truth behind SPECTRE. Then all hell breaks loose. Gunfire, tyre squeals, snappy dialogue, stunning set pieces and beautiful people. 4 Bond News Events Celebs My copy of 007 James Bond In Focus cost 3/6 in 1964 was a big 6 Daniel Craig and Sam Mendes disappointment when I read it many years later. Sean Connery 8 JBond Girls & Bond Baddies may have been on the cover, but inside, apart from the exciting Bond Girl pictures, there wasn’t much in the way of motors. Just 10 Snow Stunts in Austria one small colour picture of a Rolls-Royce Phantom III and a tiny 12 Night Time Stunts in Rome black and white slither of an Aston Martin DB5 from Goldfinger. -
Media Release
MEDIA RELEASE Heineken® reveals Spectre TV ad starring Daniel Craig as James Bond, plus world’s first ever selfie from space Amsterdam, 21 September 2015 - As part of its integrated global Spectre campaign, Heineken® has unveiled a new TV ad featuring Daniel Craig as James Bond, in a high speed boat chase. In addition, it also announced an exciting digital campaign featuring the world’s first ever selfie from space, dubbed the ‘Spyfie’. Heineken®’s Spectre campaign is the brand’s largest global marketing platform of 2015. Spectre, the 24th James Bond adventure, from Albert R. Broccoli’s EON Productions, Metro-Goldwyn-Mayer Studios, and Sony Pictures Entertainment, will be released in the UK on October 26 and in the US on November 6. The Heineken® TVC will be launched mobile-first via Facebook, and will be shown on TV and cinema screens worldwide 24 hours later. Heineken® is the only Spectre partner who has created a TVC starring Daniel Craig. Heineken®’s TVC uses Spectre cinematographers and stuntmen to ensure the action sequences are authentically Bond. The added twist involves a young woman, Zara, who accidentally becomes involved in a high-speed boat chase where she helps the world’s favourite spy to save the day. Heineken®’s Spectre TVC: http://youtu.be/vuMvhJaWIUg For its digital Spectre campaign, Heineken® will once again be pushing the boundaries of modern technology, and will be taking the world’s first ever selfie from space. For the ‘Spyfie’, Heineken® has partnered with Urthecast to take ultra HD imagery using its camera on the Deimos satellite, currently in orbit 600km above the Earth’s surface.