Slashdot Mirror
Intel Details Cascade Lake, Hardware Mitigations for Meltdown, Spectre (extremetech.com)
An anonymous reader shares a report: Ever since Meltdown and Spectre were disclosed, Intel's various customers have been asking how long it would take for hardware fixes to these problems to ship. The fixes will deploy with Cascade Lake, Intel's next server platform due later this year, but the company is finally lifting the lid on some of those improvements and security enhancements at Hot Chips this week.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre. It's hard to quantify exactly what this looks like, because the impact tends to be extremely workload-dependent. But Intel's guidance has been in the 5-10 percent range, depending on workload and platform, and with the understanding that older CPUs were sometimes hit harder than newer ones. Intel wasn't willing to speak to exactly what kind of uplift users should expect, but Lisa Spelman, VP of Intel's Data Center Group, told AnandTech that the new hardware solutions would have an "impact" on the performance hit from mitigation, and that overall performance would improve at the platform level regardless. Variant 1 will still require software-level protections, while Variant 2 (that's the "classic" Spectre attack) will require a mixture of hardware and software protection. Variant 3 (Meltdown) will be blocked in hardware, 3a (discovered by ARM) patched via firmware, with Variant 5 (Foreshadow) also patched in hardware.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre. It's hard to quantify exactly what this looks like, because the impact tends to be extremely workload-dependent. But Intel's guidance has been in the 5-10 percent range, depending on workload and platform, and with the understanding that older CPUs were sometimes hit harder than newer ones. Intel wasn't willing to speak to exactly what kind of uplift users should expect, but Lisa Spelman, VP of Intel's Data Center Group, told AnandTech that the new hardware solutions would have an "impact" on the performance hit from mitigation, and that overall performance would improve at the platform level regardless. Variant 1 will still require software-level protections, while Variant 2 (that's the "classic" Spectre attack) will require a mixture of hardware and software protection. Variant 3 (Meltdown) will be blocked in hardware, 3a (discovered by ARM) patched via firmware, with Variant 5 (Foreshadow) also patched in hardware.
Use AMD instead.
From the slide in the FA, Variant 1 (Bounds-Check Bypass, one of the worst variants), Variant 2 (Branch-Target Injection), and Variant 4 (Speculative-Store Bypass) are all still relying on OS/VMM mitigations --- which means that Intel has done absolutely nothing to try to address them.
Still. Broken.
Real fixes require a new security-first attitude at Intel, and a complete chip redesign based on that attitude.
That will take many years to materialize. In the meantime expect to see more vulnerabilities to pop-up (already have) and more ad hoc fixes.
No patches for me. The whole unit is flawed. Just rip the damn thing out.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre.
It's like getting back the "A" grade you lost after they found out you've been cheating. Sure it's a major concern because now you'll actually have to work for your grade. Meanwhile, there are other students who didn't cheat in the first place. Guess which one I'm going to hire?
Escher was the first MC and Giger invented the HR department.
A lot of huge customers, like cloud providers, are likely to upgrade their servers as soon as possible. Not seeing any sign they're moving to AMD, and AMD isn't 100% immune to these either.
/., fark, etc etc daily, but all my logins for those are snotnose with the same password. To be honest, send me an email with a funny joke and I'll tell you the password, I don't fricken care at this level of web activity.
So, has the expected surge in demand been factored into the price of the stock, or is now a good time to buy?
Conversely, there will soon be a bunch of Intel based servers flooding the surplus market. About the time I'll be looking to upgrade my desktop box. Can I pop a graphics card into one of these servers and make a nifty, cheap gaming box? I'm perfectly capable of moving a motherboard to a new chassis, I'm less capable at adding a PCI slot to an existing board.
As a home user do I care about these vulnerabilities? I do banking stuff once a month. I do Amazon maybe twice a year. I do
If Intel marketing started claiming higher percentage gains with the HW mitigations on new chips, then the 5-10 percent they say we lose today. Buy now, it's 20 percent faster clock for clock then previous generation chips!
We finally have a tool to show Intel that it's not OK to treat us how they did. ... is unacceptable, and makes the legal system that allowed this just as criminal.
I will be using it for quite some time. At least until 2037 (2018+19), given that Intel’s dickishness has harmed since 1999 (2018-19), when they murdered three out of the four mainboard manufacturers who dared to sell Athlon mainboards. (The other ones didn’t even dare, given Intels threat to hold Intel chipsets to bankrupt them.)
The fact that Intel wasn't shut down as a company... (the "corporations are people" equivalent of somebody getting the chair for murdering several people and threatening to murder a whole community)
This seems like an effort to stick a bunch of fingers in holes in a dam when the dam has a systemic design flaw. What are the chances that other problems will be discovered after tape-out of the new processors?
These bugs are an indictment of the complexity of the speedup techniques Intel has used. With complexity comes extra design expense, reductions in yield, reductions in reliability, and now, security issues that were not very foreseeable.
Adding more complexity in the form of changes to address all these little problems does not give comfort that the syndrome is fixed.
This was serious enough to warrant going back to the drawing board and designing in changes that eliminate this class of problems, not the individual problems that we know of. This is a disappointing effort.
I'm not surprised that Intel announces such hardware mitigation measures - but whether this is just some quick PR attempt at keeping people from replacing Intel CPUs, and quickly so, still remains to be seen. After all, we have not yet read about any L1TF fix for the VM-to-VM attack case that would cost less than 50% performance.
then yes.
But then you’ll become the enemy of everyone, who was a victim of Intel. Which, at this time, is pretty much everyone who used a PC.
... if they submitted samples of the CPUs to researchers to find these kind of flaws BEFORE they commit to making the first 100 million of them?
Either way Intel will win big time with this one because everyone is going to need new servers except for the few that run old AMDs and atoms! Hell I even still have a few working T42 non-pae laptops kicking around which can serve up stuff in a pinch if necessary. Might be a little slower than a hacked intel setup, but at least I know it will not be used to influence the next US election by someone in a cyber war command post redirected through a .tk purchased by and redirected to a .ru! Like the last bullshit hack that tried to hose this camper with a spector variant!
Seems like many chips have similarities but affect some of them more then others. What's more interesting is that none of this is really being exploited even months after disclosure. obviously a good ideal to try and mitigate what has been found to be weaknesses. But its hardly a huge threat to anyone yet. You can buy into a ARM or AMD and feel secure now, but what about down the road? I don't see any real fixes on the hardware side, only with OS, microcode and bios updates as we move forward for at least the next few years.
The fix is to separate the kernel's memory completely from user processes using what's called Kernel Page Table Isolation, or KPTI. At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers.