Can anyone who follows the space help to round up the status of Spectre+Meltdown (esp. Spectre-V1) mitigations as relevant to the recent surge of hyper threading all the way down to value processors? I thought that hyper threading enables the exploit environments. I did not find recent claims for the new hardware to mitigate all known variants. Are we still in the state of “suffer SW mitigation overhead or disable HT”?
1 Like
Hi Vldid,
I’ve tried reading up on this in the past but it seems to be a mess of articles out on the internet and there is a bunch of new exploits coming out all the time.
That being said, many of the existing mitigations will already be built in to the newer 10 series intel chips when they come out as well as motherboard UEFI.
Not all, but most of these exploits require physical access to your machine as well. I think unless you’re using your computer in a server environment it really doesn’t matter.
Hi Mafflez,
Yes, that is the mess I of articles I backed off of making sense of. My issue is that “many already built in” is not very comforting - but more importantly the cost per factual performance is clear as mud. Reviewers do not care to mention the mitigations and, more importantly, the performance tax of what is left to software. So if you use it for anything but gaming - and all of us do when working from home - then, say (out of thin air) 8% performance loss makes it worth consideration to buy a different chip and platform.
I, personally, take an exception to the brush off that its is all in data center and it does not matter at home. It is not true. Even before working from home we had multiple accounts on a more powerful desktop - personal ones, and separate for finance. Now also work accounts are separate. That separation is relying on the Linux’s (in our case) account separations. Once a vulnerability gets scripted (the hard step) then it is not as hard to, say, target the keyboard or similar driver - with some goodies for the baddies. Especially sensitive now during the work from home.
It reminds me of when in early 2000s I heard about then uncommon “phishing” and colleagues kept telling it is so rare it is nothing to worry about. And then many people missed the point when it got too easy for the breakers.
Thank you for taking time to answer and kinda confirming that it is not just me looking in the wrong places.
1 Like
Unless you’re still on an Intel CPU, you don’t have anything to worry about. “Meltdown” was never an issue on Ryzen. The one (1) Spectre vulnerability earlier Ryzens had was patched in AGESA firmware long ago. I don’t even think it applies to Zen2, IIRC. Neither Spectre nor Meltdown affects Ryzen cpus. Additionally, there are no Win10 microcode patches for Ryzen–but literally dozens of them for Intel cpus.
3 Likes
As I understand it, disabling Hyper-threading is the only option that’s workable on the consumer side.
There really should be a central location where you can check the status of resolutions for known vulnerabilities at the hardware level for successive generations of CPU’s.
1 Like
I thought the performance penalty was closer to 40%. I don’t remember where I heard that, since it was somewhat long ago now.
I was pretty upset my Ivybridges lost so much future proof value overnight. I’m still upset about it.
A central site with a CPU over vulnerability status matrix would indeed be a great thing to have. To also have mitigation impacts there would be ideal. Unfortunately, it is a lofty undertaking, and CPU manufacturers have little incentive for that AFAIK.
Because it is a heavy lift, I am not sure review/benchmark sites can pull it off. Although Level1, Phoronix, and to the lesser extent GamersNexus are right there where the audience for that information is.
This topic was automatically closed 273 days after the last reply. New replies are no longer allowed.