Slashdot Mirror
Intel Details Cascade Lake, Hardware Mitigations for Meltdown, Spectre (extremetech.com)
An anonymous reader shares a report: Ever since Meltdown and Spectre were disclosed, Intel's various customers have been asking how long it would take for hardware fixes to these problems to ship. The fixes will deploy with Cascade Lake, Intel's next server platform due later this year, but the company is finally lifting the lid on some of those improvements and security enhancements at Hot Chips this week.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre. It's hard to quantify exactly what this looks like, because the impact tends to be extremely workload-dependent. But Intel's guidance has been in the 5-10 percent range, depending on workload and platform, and with the understanding that older CPUs were sometimes hit harder than newer ones. Intel wasn't willing to speak to exactly what kind of uplift users should expect, but Lisa Spelman, VP of Intel's Data Center Group, told AnandTech that the new hardware solutions would have an "impact" on the performance hit from mitigation, and that overall performance would improve at the platform level regardless. Variant 1 will still require software-level protections, while Variant 2 (that's the "classic" Spectre attack) will require a mixture of hardware and software protection. Variant 3 (Meltdown) will be blocked in hardware, 3a (discovered by ARM) patched via firmware, with Variant 5 (Foreshadow) also patched in hardware.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre. It's hard to quantify exactly what this looks like, because the impact tends to be extremely workload-dependent. But Intel's guidance has been in the 5-10 percent range, depending on workload and platform, and with the understanding that older CPUs were sometimes hit harder than newer ones. Intel wasn't willing to speak to exactly what kind of uplift users should expect, but Lisa Spelman, VP of Intel's Data Center Group, told AnandTech that the new hardware solutions would have an "impact" on the performance hit from mitigation, and that overall performance would improve at the platform level regardless. Variant 1 will still require software-level protections, while Variant 2 (that's the "classic" Spectre attack) will require a mixture of hardware and software protection. Variant 3 (Meltdown) will be blocked in hardware, 3a (discovered by ARM) patched via firmware, with Variant 5 (Foreshadow) also patched in hardware.
Use AMD instead.
From the slide in the FA, Variant 1 (Bounds-Check Bypass, one of the worst variants), Variant 2 (Branch-Target Injection), and Variant 4 (Speculative-Store Bypass) are all still relying on OS/VMM mitigations --- which means that Intel has done absolutely nothing to try to address them.
Still. Broken.
Real fixes require a new security-first attitude at Intel, and a complete chip redesign based on that attitude.
That will take many years to materialize. In the meantime expect to see more vulnerabilities to pop-up (already have) and more ad hoc fixes.
No patches for me. The whole unit is flawed. Just rip the damn thing out.
One major concern? Putting back the performance that previous solutions have lost as a result of Meltdown and Spectre.
It's like getting back the "A" grade you lost after they found out you've been cheating. Sure it's a major concern because now you'll actually have to work for your grade. Meanwhile, there are other students who didn't cheat in the first place. Guess which one I'm going to hire?
Escher was the first MC and Giger invented the HR department.
A lot of huge customers, like cloud providers, are likely to upgrade their servers as soon as possible. Not seeing any sign they're moving to AMD, and AMD isn't 100% immune to these either.
/., fark, etc etc daily, but all my logins for those are snotnose with the same password. To be honest, send me an email with a funny joke and I'll tell you the password, I don't fricken care at this level of web activity.
So, has the expected surge in demand been factored into the price of the stock, or is now a good time to buy?
Conversely, there will soon be a bunch of Intel based servers flooding the surplus market. About the time I'll be looking to upgrade my desktop box. Can I pop a graphics card into one of these servers and make a nifty, cheap gaming box? I'm perfectly capable of moving a motherboard to a new chassis, I'm less capable at adding a PCI slot to an existing board.
As a home user do I care about these vulnerabilities? I do banking stuff once a month. I do Amazon maybe twice a year. I do
If Intel marketing started claiming higher percentage gains with the HW mitigations on new chips, then the 5-10 percent they say we lose today. Buy now, it's 20 percent faster clock for clock then previous generation chips!
This seems like an effort to stick a bunch of fingers in holes in a dam when the dam has a systemic design flaw. What are the chances that other problems will be discovered after tape-out of the new processors?
These bugs are an indictment of the complexity of the speedup techniques Intel has used. With complexity comes extra design expense, reductions in yield, reductions in reliability, and now, security issues that were not very foreseeable.
Adding more complexity in the form of changes to address all these little problems does not give comfort that the syndrome is fixed.
This was serious enough to warrant going back to the drawing board and designing in changes that eliminate this class of problems, not the individual problems that we know of. This is a disappointing effort.
... if they submitted samples of the CPUs to researchers to find these kind of flaws BEFORE they commit to making the first 100 million of them?
Seems like many chips have similarities but affect some of them more then others. What's more interesting is that none of this is really being exploited even months after disclosure. obviously a good ideal to try and mitigate what has been found to be weaknesses. But its hardly a huge threat to anyone yet. You can buy into a ARM or AMD and feel secure now, but what about down the road? I don't see any real fixes on the hardware side, only with OS, microcode and bios updates as we move forward for at least the next few years.
My understanding that most of the Intel flaws require physical access to the system. Plus, BIOS and OS updates have been quickly developed to mitigate some of the issues. I'm not sure if this is reason why there haven't been more exploits or if because of some other factor.
My understanding that most of the Intel flaws require physical access to the system.
Unclear what you mean here, obviously you don't have to poke your finger into the processor to exploit. There is a certain difficulty in exploiting these flaws, true, which is why we haven't seen much in the wild activity on them. But a lesson was learned from the Rowhammer exploit, 'they' said it was too difficult to locate an appropriate bit in memory and know when to flip it, until someone demonstrated a real attack using it. SPECTRE family is much the same, it requires a deeper level of knowledge than the commodity ransomware attackers out there. But once the details of a real attack are figured out and released it will become more important.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.