New Instructions and Updated Security

When a new generation of processors is launched, alongside the physical design and layout changes made, this is usually the opportunity to also optimize instruction flow, increase throughput, and enhance security.

Core Instructions

When Intel first stated to us in our briefings that by-and-large, aside from the caches, the new core was identical to the previous generation, we were somewhat confused. Normally we see something like a common math function get sped up in the ALUs, but no – the only additional changes made were for security.

As part of our normal benchmark tests, we do a full instruction sweep, covering throughput and latency for all (known) supported instructions inside each of the major x86 extensions. We did find some minor enhancements within Willow Cove.

  • CLD/STD - Clearing and setting the data direction flag - Latency is reduced from 5 to 4 clocks
  • REP STOS* - Repeated String Stores - Increased throughput from 53 to 62 bytes per clock
  • CMPXCHG16B - compare and exchange bytes - latency reduced from 17 clocks to 16 clocks
  • LFENCE - serializes load instructions - throughput up from 5/cycle to 8/cycle

There were two regressions:

  • REP MOVS* - Repeated Data String Moves - Decreased throughput from 101 to 93 bytes per clock
  • SHA256MSG1 - SHA256 message scheduling - throughput down from 5/cycle to 4/cycle

It is worth noting that Willow Cove, while supporting SHA instructions, does not have any form of hardware-based SHA acceleration. By comparison, Intel’s lower-power Tremont Atom core does have SHA acceleration, as does AMD’s Zen 2 cores, and even VIA’s cores and VIA’s Zhaoxin joint venture cores. I’ve asked Intel exactly why the Cove cores don’t have hardware-based SHA acceleration (either due to current performance being sufficient, or timing, or power, or die area), but have yet to receive an answer.

From a pure x86 instruction performance standpoint, Intel is correct in that there aren’t many changes here. By comparison, the jump from Skylake to Cannon Lake was bigger than this.

Security and CET

On the security side, Willow Cove will now enable Control-Flow Enforcement Technology (CET) to protect against a new type of attack. In this attack, the methodology takes advantage of control transfer instructions, such as returns, calls and jumps, to divert the instruction stream to undesired code.

CET is the combination of two technologies: Shadow Stacks (SS) and Indirect Branch Tracking (IBT).

For returns, the Shadow Stack creates a second stack elsewhere in memory, through the use of a shadow stack pointer register, with a list of return addresses with page tracking - if the return address on the stack is called and not matched with the return address expected in the shadow stack, the attack will be caught. Shadow stacks are implemented without code changes, however additional management in the event of an attack will need to be programmed for.

New instructions are added for shadow stack page management:

  • INCSSP: increment shadow stack pointer (i.e. to unwind shadow stack)
  • RDSSP: read shadow stack pointer into general purpose register
  • SAVEPREVSSP/RSTORSSP: save/restore shadow stack (i.e. thread switching)
  • WRSS: Write to Shadow Stack
  • WRUSS: Write to User Shadow Stack
  • SETSSBSY: Set Shadow Stack Busy Flag to 1
  • CLRSSBSY: Clear Shadow Stack Busy Flag to 0

Indirect Branch Tracking is added to defend against equivalent misdirected jump/call targets, but requires software to be built with new instructions:

  • ENDBR32/ENDBR64: Terminate an indirect branch in 32-bit/64-bit mode

Full details about Intel’s CET can be found in Intel’s CET Specification.

At the time of presentation, we were under the impression that CET would be available for all of Intel’s processors. However we have since learned that Intel’s CET will require a vPro enabled processor as well as operating system support for Hardware-Enforced Stack Protection. This is currently available on Windows 10’s Insider Previews. I am unsure about Linux support at this time.

Update: Intel has reached out to say that their text implying that CET was vPro only was badly worded. What it was meant to say was 'All CPUs support CET, however vPro also provides additional security such as Intel Hardware Shield'.

 

AI Acceleration: AVX-512, Xe-LP, and GNA2.0

One of the big changes for Ice Lake last time around was the inclusion of an AVX-512 on every core, which enabled vector acceleration for a variety of code paths. Tiger Lake retains Intel’s AVX-512 instruction unit, with support for the VNNI instructions introduced with Ice Lake.

It is easy to argue that since AVX-512 has been around for a number of years, particularly in the server space, we haven’t yet seen it propagate into the consumer ecosphere in any large way – most efforts for AVX-512 have been primarily by software companies in close collaboration with Intel, taking advantage of Intel’s own vector gurus and ninja programmers. Out of the 19-20 or so software tools that Intel likes to promote as being AI accelerated, only a handful focus on the AVX-512 unit, and some of those tools are within the same software title (e.g. Adobe CC).

There has been a famous ruckus recently with the Linux creator Linus Torvalds suggesting that ‘AVX-512 should die a painful death’, citing that AVX-512, due to the compute density it provides, reduces the frequency of the core as well as removes die area and power budget from the rest of the processor that could be spent on better things. Intel stands by its decision to migrate AVX-512 across to its mobile processors, stating that its key customers are accustomed to seeing instructions supported across its processor portfolio from Server to Mobile. Intel implied that AVX-512 has been a win in its HPC business, but it will take time for the consumer platform to leverage the benefits. Some of the biggest uses so far for consumer AVX-512 acceleration have been for specific functions in Adobe Creative Cloud, or AI image upscaling with Topaz.

Intel has enabled new AI instruction functionality in Tiger Lake, such as DP4a, which is an Xe-LP addition. Tiger Lake also sports an updated Gaussian Neural Accelerator 2.0, which Intel states can offer 1 Giga-OP of inference within one milliwatt of power – up to 38 Giga-Ops at 38 mW. The GNA is mostly used for natural language processing, or wake words. In order to enable AI acceleration through the AVX-512 units, the Xe-LP graphics, and the GNA, Tiger Lake supports Intel’s latest DL Boost package and the upcoming OneAPI toolkit.

10nm SuperFin, Willow Cove, Xe, and new SoC Cache Architecture: The Effect of Increasing L2 and L3
Comments Locked

253 Comments

View All Comments

  • deil - Thursday, September 17, 2020 - link

    not rip as intel did respond already few times taking their 5% lead back against ryzen stack.
    Remember this chip will fight against zen3, which should be ~20% gains on AMD side.
    This would be a great chip a year ago it would obliterate 3000 mobile on all fronts BUT against 4800u it seems like a strong contender, but it does not dethrone 4800u as best mobile chip, as you compare 15W with 28W here. This wins in thick bois, while AMD still is unrivaled for thin and light laptops.
  • FreckledTrout - Thursday, September 17, 2020 - link

    Lets not go overboard there buddy. You have TGL in laptops beating AMD's almost 2 year old architectures since they run a little over a year behind using the prior generation architecture in the case of the GPU over 2 years old. When AMD moves to using current architectures in APU's I think things will be pretty darn close CPU side and AMD should win hands down with RDNA2.
  • senttoschool - Thursday, September 17, 2020 - link

    Zen3 on mobile is probably at least 9 months away. So TGL is competing against Renoir.
  • AMDSuperFan - Thursday, September 17, 2020 - link

    Fortunately we have Big Navi to help us out. I am looking forward to putting Intel back in their shoes with Big Navi.
  • Showtime - Friday, September 18, 2020 - link

    Who is "us" lol. Please go back to back AyMD reddit. We don't condone fanboism here.
  • San Pedro - Friday, September 18, 2020 - link

    I'm wondering if AMD is trying to push this forward.
    For now it seems like consumers can choose TGL or Renoir based on their use scenario.
  • AMDSuperFan - Monday, September 21, 2020 - link

    Would it not be glorious for Zen 3 to come in at 5 watts with 50% performance as we can expect? 20% isn't so much but 50% would really change things.
  • TheinsanegamerN - Thursday, September 17, 2020 - link

    I wouldnt go that far. GPU wise Intel needs way more power to compete with the 15W reinor. Not to mention any laptop with sufficient thermal headroom can use thirde party software to raise TDP for ryzen 4000 mobile, gaining 15-20% performance in games.

    Other benchmarks go back and forth. On the surface intel might have a decent chip, but OEM implementation may not have the same performance.
  • Spunjji - Friday, September 18, 2020 - link

    You hit the nail on the head here - it's going to be *highly* dependent on how OEMs implement it. Still, good to see they finally sorted their process out - the efficiency of this is markedly improved, it's basically what I expected from Ice Lake in the first place.
  • AnarchoPrimitiv - Saturday, September 26, 2020 - link

    Maybe for literally 3 more weeks until Zen3 comes out, then it's just more embarrassment for Intel added to years of embarrassment... Being beaten by a company with less than a tenth of the resources, there's literally no excuse for it

Log in

Don't have an account? Sign up now