Which new CPUs are immune to 2018’s new “Spectre class” vulnerabilities?
From Intel?
From AMD?
And which ARM-core parts are immune?
There was a flurry of articles about this back around Jan 11. And again in July and August. But very little since then.
So, forum, where are we today?
To recap:
2018 saw a series of related security flaws discovered in modern CPUs, beginning with the disclosure of the Spectre and Meltdown vulnerabilities on Jan 2.
Intel announced, back on March 18, that they would have "security at the silicon level” to mitigate these vulnerabilities, starting with “8th Generation Intel Core processors expected to ship in the second half of 2018”.
But, that announcement was made before the group of “Spectre NG” vulnerabilities was published in May. Before the Intel-specific Foreshadow exploit was published in August.
And long before the first “Systematic Evaluation of Transient Execution Attacks” was published in November.
So, what have Intel, AMD, and ARM learned during the course of the year?
Do any of them have new CPUs that fully mitigate this class of attacks?
How many older CPUs now have microcode patches available?
And what was the final word on the performance penalty incurred by installing those patches?
Edit:
Aug 8, '18 Intel Microcode Updates list:
Most recent I could find.
Edit: Added links.
1 Like
There are software fixes for some of the vulnerabilities, but no hardware fixes exist yet because you need to make architectural changes, and as AMD has proven, that can take 5 years.
So, if you want to have a CPU that’s secure from these vulns, take the performance hit or wait.
2 Likes
I feel like the safest option is disable hyperthreading / w/e amd calls it. While this is an issue would mostly be worried with sharing a server with someone else or with different security level vms.
2 Likes
That’s why I’m on the lookout for the first generation of new, redesigned silicon.
Apparently the performance impact of hyperthreading is workload-dependent.
But it can be pretty significant. I think Phoronix did a performance comparison…
Here it is:
https://www.phoronix.com/scan.php?page=article&item=intel-ht-2018&num=1
And, once we get redesigned silicon, we won’t have to take OS-level performance hits.
Linux kernel 4.19:
https://www.phoronix.com/scan.php?page=article&item=linux-419-mitigations&num=1
Linux kernel 4.20:
https://www.phoronix.com/scan.php?page=article&item=linux-420-bisect&num=1
https://www.phoronix.com/scan.php?page=article&item=linux-420-stibp&num=1
Win10 performance is less clear. But it now has Google’s “retpoline” mitigation:
www.zdnet.com/article/windows-10-will-banish-spectre-slowdowns-with-googles-retpoline-patch
RE: the HT tests, it looks pretty clear that HT is beneficial for pretty much all workloads, except ones that do not scale past X threads.
I’d look to 2020 for that, frankly.
2 Likes
Whaaat?!
You mean to say you don’t have full confidence in the promises of since-ousted Intel CEO Brian Krzanich?
Look, he said in March that they’d have it fixed, in silicon, by H2 2018.
That gave him a whole threeeee months to git 'er done.
Plenty of time!
I mean, they just would have have had to redesign all the out-of-order execution logic that’s been in place, and getting increasingly complex, since the Pentium II era.
And get those designs fabricated. And tested for compatibility with existing x86 code…
Should be no problem for a go-getter like Krzanich.
In fact, he’s such a stand-up guy, with so much confidence in his own leadership talent and the organization behind him, that he sold a bunch of Intel stock (about 890,000 shares) in November 2017, long after Intel was informed of the Spectre/Meltdown issues, but 2 months before they were public knowledge. See? Now, there’s a manager who knows an edge when he sees one.
And it’s perfectly legal, because the SEC hadn’t issued guidelines saying that CEOs shouldn’t do that until after Krzanich’s sale, and after public disclosure of Spectre and Meltdown.
How can you not trust a guy like that?
kek
The type of branch prediction these exploits use is very core to the architecture so they can’t just fuse the vuln off without fusing off the entire core. so, they’d have to redesign and test the silicon.
I want Intel to have secure CPUs, but I just don’t believe it’s possible yet.