2019 sounds very, very optimistic to me for fixed hardware. Microcode fixes is probably the only thing we’ll see for some time. Lead times for Intel and AMD is years, ARM can get away with shorter time, AMD and Intel not so much. I wouldn’t be surprised if it the time frame is more like five years before we have properly fixed hardware.
For example, typical lead time for a CPU that has a taped out design is about a year if everything goes well. All info points at that we don’t have any fixed CPU design to tape out, so it needs to be re-designed first. That takes at least several months if not years.
Any idea how this works out with IBM? Their releases are less often, so I wonder if POWER10 will be fixed with this, as it was originally planned for 2020.
It does look like they are preparing to delay it though, the most recent roadmap roadmap I could find (CCC lecture linked below) shows POWER10 in 2020 or later, and no longer mentions POWER11 (though it simply might not have fit on the slide). The partner-made POWER9 will probably still be as vulnerable as the IBM, but POWER10 might be far enough in the future to be fixed.
openPower - the current state of commercial openness in CPU development Talk page, CCC video, YouTube video
~22:23 is when the Roadmap is shown.
I can’t really say. I don’t keep up with Power related news all that much.
From what I’ve seen you seem to know more than me with regards to keeping up with the Power architecture
The only difference between now and then is that all the normies have internet and read arstechnica, so Intel can’t quietly sweep this shitshow under the bed.
I expect a booming year in my small world of things May even charge more. I might go to 125 for my basic state of things cause I know I am gonna have to patch.
Interestingly, Jann Horn, the Google Project Zero researcher who was one of several to discover Meltdown and Spectre, is referenced three times in this security update.
First is for the Meltdown fix, which is as expected. But he also appears two more times, with
[drum roll please]
two new vulnerabilities
[TAADAA]
, which like the recently reported issues allowed someone to read restricted memory locations.
CVE-2018-4090 and CVE-2018-4093 have had their spots reserved on MITRE, but no descriptions are available yet. There’s no way they’re as serious as Meltdown and Spectre, and their inclusion here may be a coincidence — but similar fixes appear on other Apple platforms (iOS, tvOS), so it at the very least is more than a macOS thing. But don’t be surprised if GPZ announces something new soon.
I more find it kind of funny; I guess I’m on the chaotic side of the D&D character chart.
There is a reason I try to use the CVEs any time I’ve posted about this, especially with Spectre, where someone can tell you “oh, we patched Spectre” Oh really, which one? CVE-2017-5715 or CVE-2017-5753?
The variant 1, 2, & 3 naming scheme is also a bit annoying, since Google Project Zero uses it, but the other researchers and the formal papers do not. I also can’t get over that variant 1 is CVE…53 and variant 2 is CVE…15. Why is it backwards? These specific vulnerabilities have one official name and one name only, and that’s the bloody CVE.
AMD for me. I stopped buying or recommending Intel a couple years back. Even running Linux. Especially when using Intel iGPUs, Intel driver stack is up to date but the installer is usually not going to support .10 releases.
I bought AMD stock, and still do. I buy AMD GPUs and CPUs.
There has been an AMD CPU in my house since the early-mid 90s. All the way back to the K7 chips.
I am willing to put up with the IPC difference between AMD and Intel. Especially if the AMD chips are generally more secure than Intel (Meltdown). Intel’s ME scares the crap out of me. Banking computers have Intel ME enabled…with the security issues around Intel AMT, the ability to remotely wipe a machine via ME is nuts. And with how the AMT is so easily cracked/by-passed now…
Just be aware that you have something very similar on AMD with the ASP/PSP - and since ASP/PSP is used to bring up the cores, you can’t start the processor at all without the ASP/PSP firmware loaded in. There isn’t any work on an asp_cleaner/psp_cleaner either.
Back on topic, Lunduke read out the kernel mailinglist thread with Linus getting mad about the Intel-submitted patches; it’s good for a laugh, even if you don’t fully understand the patches they are talking about:
May even charge more. I might go to 125 for my basic state of things cause I know I am gonna have to patch.
