10 ms·

Intel Security Issue Update: Addressing Reboot Issues

259 points by bcantrill 9y ago

monochromatic 9y ago
“We rushed a patch out and it’s causing problems we don’t understand yet. We’ll rush out an updated patch as soon as we can, so please don’t hesitate to install that.”
- neom 9y ago
  "It could be true hardware and software orchestration requires an understanding of how components will work in concert, we apologize we did not rehearse in advance. "
- dang 9y ago
  Please don't use quotation marks to make it look like you're quoting someone when you're not.
  - miles 9y ago
    It's clear that monochromatic's "quotation" was ironic. A possible convention for ironic quotes: https://english.stackexchange.com/a/3471/207671 https://english.stackexchange.com/a/3471/207671 > To avoid the potential for confusion between ironic quotes and direct quotations, some style guides specify single quotation marks for [irony], and double quotation marks for verbatim speech.
  - loeg 9y ago
    Is HN an authority on the proper way to write English? Ironic quotation marks are a fixture of the language. In context it is very clear that the use is sarcastic, given how tight-lipped Intel has been about admitting any fault so far.
  - monochromatic 9y ago
    I think it was pretty clear from context that this was lighthearted and not a real quotation. Hell, I didn’t even include a source for where the quote allegedly came from.
deleted 9y ago
[deleted]
bcantrill 9y ago
This is -- to say the least -- frustrating. First, the busted microcode is still available on the Intel Download Center[1], without any warning that they recommend that you not, in fact, install it. Second, the press release is still being evasive: they have not merely "received reports"; they in fact know that it's causing issues, and the press release is avoiding the much stronger language that Intel is giving privately (namely, don't install this). The broken microcode is (at some level, anyway) forgivable; Intel's ongoing inability to communicate transparently and honestly with its customers during this crisis of its creation is much less so. [1] https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?product=52214 https://downloadcenter.intel.com/download/27431/Linux-Proces...
- Aloha 9y ago
  if you're going to make the accusation that they're lying, at least provide a source - near as I can tell they are being as transparent as is reasonable.
  - nl 9y ago
    bcantrill is https://en.wikipedia.org/wiki/Bryan_Cantrill https://en.wikipedia.org/wiki/Bryan_Cantrill If he is saying that Intel is giving other advice privately then you are welcome not to believe him (and note that it is you who is using the much stronger term "lying" here). Personally I think un-sourced statements from him are worth listening to.
    - Aloha 9y ago
      My general attitude is to presume good faith - both on intels part, and on the part of commenters online. I had no idea who he was till you raised the point with me - had he I identified some source for his assertions (even first had observation on a large number of systems), I probably wouldn't have said anything.
  - loeg 9y ago
    Not that it's a source you can point to, but I have also heard the much stronger language — don't push this microcode — trickle out of Intel.
benjarrell 9y ago
“We have received reports from a few customers of higher system reboots after applying firmware updates.” What does higher mean here?
- dboreham 9y ago
  Means whoever typed that can't write.
- IvyMike 9y ago
  more frequent
  - kbenson 9y ago
    With the implication that random reboots of a lesser, but non-zero frequency are okay, it's at least expected? Odd wording for sure.
    - ahoka 9y ago
      If you have Intel wireless or display drivers installed then it is perfectly normal for a computer to randomly reboot.
      - clarry 9y ago
        How often? I have 495 days of uptime here with intel graphics & wireless.
        Avamander 9y ago
        Reboot your PC mate, the kernel needs updating.
        yjftsjthsd-h 9y ago
        Kpatch?
ksec 9y ago
Sorry If i had this wrong, they knew of the issues in June, and they only fix it in Jan. I can hardly call this rushed.
- dboreham 9y ago
  The fixes weren't widely run until this week.
  - itronitron 9y ago
    presumably because Intel does not have access to the necessary hardware configurations to test the fixes on?
    - deleted 9y ago
      [deleted]
    - cyphar 9y ago
      I highly doubt this, given how much hardware they appear have lying around to throw at the Linux 0day Test Bot (which does full kernel compiles, boots, and integration tests for dozens of hardware configurations for every patch sent to most LKML lists).
    - ksec 9y ago
      I couldn't accept this as an excuse when you have possibly the worst CPU bug in x86 history, or perhaps all CPU history, with ample of man power and resources, along with 6 months time frame. Rush isn't a word I would use.
    - dboreham 9y ago
      No, because they don't have access to all the software in the world.
DrScump 9y ago
I just had a hard crash/reboot on a Dell running Windows 10 on an AMD processor, followed by a couple of auto updates. There was no indication of updates being available before the crash.
- mtremsal 9y ago
  Out of curiosity, how do you suppose an Intel microcode update caused a blue screen on your system running an AMD processor?
  - drewm1980 9y ago
    These issues aren't limited to Intel, and the people developing the mitigations are probably sharing ideas with each other.
  - mlvljr 9y ago
    Stolen IP, that's how! <waves a tinfoil hat>
- JdeBP 9y ago
  As I have just written elsewhere on this very page, you need to pay attention to the several KnowledgeBase and web log articles that Microsoft has been publishing on this subject as things develop. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
rusbus 9y ago
I think it's a bit ironic that the text, in a sense, blames Google for these problems by calling them the "Google Project Zero Exploits" as if Google was some sort of cyber crime syndicate using their evil powers to exploit intel.
- 9935c101ab17a66 9y ago
  Wow, that's a good point. "...the exploits uncovered by Google Project Zero" would be much, much more appropriate.
  - Animats 9y ago
    The "Intel CPU fundamental design defects uncovered by Google" is more like it.
    - HugoDaniel 9y ago
      "Intel CPU deliberate design defects now uncovered by Google"
  - deleted 9y ago
    [deleted]
- cookiecaper 9y ago
  Yeah I thought that was interesting too. I think they are most likely name dropping Google just because they want to reinforce whatever type of association with Google that they can get. Lots of people won't register this as a bad thing per se, and will just think "Wow it's super cool that Intel is working with The Googles on something". As developers, we should know this phenomenon well by now, as it's dictated an ever-increasing portion of our toolchain. "Oh, you say Google uses this thing?! I use it too then! Google and me are best buds!". (This applies equally to Facebook, and to a lesser extent, Amazon. Compare one of my son's favorite YouTube videos at [0]). Alternatively, they may want customers to think "Oh boy you have to be a super genius guy like the Googles to beat up Intel so this isn't a big deal", or "How could Google do this to a nice company like Intel". So many possibilities, but really all of them turn out well for Intel. [0] https://youtu.be/6x0yWfmh-zk?t=19 https://youtu.be/6x0yWfmh-zk?t=19
partycoder 9y ago
I think it's hard to see how this will affect Intel in the long term. When Samsung phones were blowing up, I thought that was it, but somehow people kept preferring the phones.
- madez 9y ago
  It raises awareness about issues. Change takes time. Look at the fight of blacks and women for equality in society. We must not stop pointing out the issues, and always demand change.
- partycoder 9y ago
  Now, in retrospective, the Samsung battery issue affected only a small portion of users, whereas this will affect every single user in the form of decreased performance.
Twirrim 9y ago
Well this promises to be fun, especially for cloud providers (and those running instances on the cloud, who now potentially get to suffer through host instability)
- jlgaddis 9y ago
  Intel's adaptation of Netflix's Chaos Monkey [0]? [0]: https://en.wikipedia.org/wiki/Chaos_Monkey https://en.wikipedia.org/wiki/Chaos_Monkey
  - numbsafari 9y ago
    I was thinking the same thing as I read this. “Chaos engineering” has served some customers very well here. From speaking in my circles, I get the impression that those of us without our own data centers to worry about are much better off than those who do.
- sebazzz 9y ago
  It is not clear if Xeon server processors are affected.
  - Twirrim 9y ago
    Intel has made such a complicated product line it's really difficult to figure out what is and isn't affected. As per the Lenovo update mentioned elsewhere in this thread: "*3 – (Broadwell E, H, U/Y; Haswell standard, Core Extreme, ULT) Symptom: Intel has received reports of unexpected page faults, which they are currently investigating. Out of an abundance of caution, Intel requested Lenovo to stop distributing this firmware." So far as I can figure, Xeons are covered by "Haswell standard". Core Extreme was those ridiculously overpriced i7s. ULT is the "Ultra Low TDP" chips. https://en.wikipedia.org/wiki/Haswell_%28microarchitecture%29#Server_processors https://en.wikipedia.org/wiki/Haswell_%28microarchitecture%2... It looks like from the desktop and mobile processor fields, if there is anything special about the core they put a suffix on denoting it, so Xeon may well classify as "Haswell standard"?
ericzawo 9y ago
Doesn’t exactly reassure you, does it.
compsciphd 9y ago
My broadwell (i5-2500k) windows desktop has started blue screening like crazy if I do large continous network transfers (i.e. saturating gigabit ethernet). I didn't have this problem before I rebooted for my most recent update. I thought it might be memory, but an 8+ hour memory scan (windows internal one, not the normal linux one) didn't tickle any bad bits and its not erorring in any unique component, each time, it seems to be a different one (first I caught the blue screen, it was the network driver, that made sense, so I upgraded it, just in case), but then it started being ntfs and other things. wondering if its just limited to those arches, or others.
- Narishma 9y ago
  > My broadwell (i5-2500k) That's Sandy Bridge, 3 generations older than Broadwell.
  - compsciphd 9y ago
    you are correct, I actually looked it up, and meant sandy bridge (hence why I wrote "limited to those arches, or others"), but brain farted while writing.
  - compsciphd 9y ago
    and apparently with the latest news, it perhaps wasn't all in my head https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/ https://newsroom.intel.com/news/firmware-updates-and-initial...
gesman 9y ago
Happy face on profile of that post is a bit out of context with the customer's feelings...
intelhearts 9y ago
Not very surprised of the wording considering this guy held fundraisers for Trump.. dump intel I really wonder how many rape-parties this califag has been to
mrsaint 9y ago
Uhm, what a mess. This, just when Linux vendors began pushing updated intel-microcode packages (Ubuntu just released intel-microcode 3.20180108.0). Should we put the update on hold until this issue is hopefully resolved, or should we still update as suggested in the last paragraph of this Intel press release, somehow believing that the random reboots don't apply to "end users"?
- JdeBP 9y ago
  It is a mess. I suggest that you and anyone else asking these questions pay attention to Microsoft a little bit, to receive all of the information that there is to be had on this. Microsoft has been telling people about problems with the mitigations up-front. There are, for starters, Microsoft KnowledgeBase articles detailing problems with older AMD CPUs and with anti-virus softwares that behave like rootkit viruses resulting in systems that will not boot, and web log articles discussing the performance considerations for server systems. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
- lower 9y ago
  Lenovo has put out an advisory about what to do with the BIOS updates that contain the microcode: https://pcsupport.lenovo.com/de/en/product_security/PS500151 https://pcsupport.lenovo.com/de/en/product_security/PS500151 Withdrawn CPU Microcode Updates: Intel provides to Lenovo the CPU microcode updates required to address Variant 2, which Lenovo then incorporates into BIOS/UEFI firmware. Intel recently notified Lenovo of quality issues in two of these microcode updates, and concerns about one more. These are marked in the product tables with “Earlier update X withdrawn by Intel” and a footnote reference to one of the following: 1 – (Kaby Lake U/Y, U23e, H/S/X) Symptom: Intermittent system hang during system sleep (S3) cycling. If you have already applied the firmware update and experience hangs during sleep/wake, please flash back to the previous BIOS/UEFI level, or disable sleep (S3) mode on your system; and then apply the improved update when it becomes available. If you have not already applied the update, please wait until the improved firmware level is available. 2 – (Broadwell E) Symptom: Intermittent blue screen during system restart. If you have already applied the update, Intel suggests continuing to use the firmware level until an improved one is available. If you have not applied the update, please wait until the improved firmware level is available. 3 – (Broadwell E, H, U/Y; Haswell standard, Core Extreme, ULT) Symptom: Intel has received reports of unexpected page faults, which they are currently investigating. Out of an abundance of caution, Intel requested Lenovo to stop distributing this firmware.
Animats 9y ago
Spin control. By "higher system reboots" they mean "the OS crashes after their CPU 'fix'".
zimmerfrei 9y ago
To be fair, it can well be that some sloppy OEM drivers take too many assumptions on reserved bits in registers (which the new microcode may be legitimately changing) or on undocumented timing side-effects related to some instructions (which the new microcode may affect, being that the root problem in the first place!). These symptoms are also the classic ones you get when you install an OS on a new-generation, well-functioning CPU.
- joenathanone 9y ago
  Don't speculate, it adds nothing but confusion.
  - zimmerfrei 9y ago
    My comment is no more speculative than those blaming the new microcode for causing reboots. The real bad quality, bad update process and unjustified binary nature of OEM firmware is too often overlooked.
pQd 9y ago
probably related news from Dell: "NOTE 1: 13G, select 12G, and select DSS server BIOS files have been pulled from http://dell.com/support http://dell.com/support. This note and article will be updated as soon as more information is available" [1] the pulled out BIOS update files for 13th gen were released on 5th of Jan. [1] http://www.dell.com/support/article/us/en/04/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en http://www.dell.com/support/article/us/en/04/sln308588/micro...
sateesh 9y ago
I think all the more jarring is the smiling face of the spokesperson next to this announcement. Atleast can't the announcement be not with a photo or have a serious looking photo of the spokesperson.
- AngeloAnolin 9y ago
  The photo seems to remind me of someone saying, "that's all you get suckers" coupled with an evil grin.
mtgx 9y ago
Intel's "security pledge" is hilarious, when ME/AMT continues to be used as a backdoor. This just in: https://business.f-secure.com/intel-amt-security-issue https://business.f-secure.com/intel-amt-security-issue
throwawaymanbot 9y ago
And we would have got away with it if it wasnt for you pesky kids......
rmetzler 9y ago
I heard from my colleague that he had boot issues with a server (new Centos7 kernel) and a RAID he set up today.

259 points by bcantrill 9y ago

“We rushed a patch out and it’s causing problems we don’t understand yet. We’ll rush out an updated patch as soon as we can, so please don’t hesitate to install that.”

neom 9y ago
"It could be true hardware and software orchestration requires an understanding of how components will work in concert, we apologize we did not rehearse in advance. "
dang 9y ago
Please don't use quotation marks to make it look like you're quoting someone when you're not.
- miles 9y ago
  It's clear that monochromatic's "quotation" was ironic. A possible convention for ironic quotes: https://english.stackexchange.com/a/3471/207671 https://english.stackexchange.com/a/3471/207671 > To avoid the potential for confusion between ironic quotes and direct quotations, some style guides specify single quotation marks for [irony], and double quotation marks for verbatim speech.
- loeg 9y ago
  Is HN an authority on the proper way to write English? Ironic quotation marks are a fixture of the language. In context it is very clear that the use is sarcastic, given how tight-lipped Intel has been about admitting any fault so far.
- monochromatic 9y ago
  I think it was pretty clear from context that this was lighthearted and not a real quotation. Hell, I didn’t even include a source for where the quote allegedly came from.

deleted 9y ago

[deleted]

bcantrill 9y ago

This is -- to say the least -- frustrating. First, the busted microcode is still available on the Intel Download Center[1], without any warning that they recommend that you not, in fact, install it. Second, the press release is still being evasive: they have not merely "received reports"; they in fact know that it's causing issues, and the press release is avoiding the much stronger language that Intel is giving privately (namely, don't install this). The broken microcode is (at some level, anyway) forgivable; Intel's ongoing inability to communicate transparently and honestly with its customers during this crisis of its creation is much less so. [1] https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?product=52214 https://downloadcenter.intel.com/download/27431/Linux-Proces...

Aloha 9y ago
if you're going to make the accusation that they're lying, at least provide a source - near as I can tell they are being as transparent as is reasonable.
- nl 9y ago
  bcantrill is https://en.wikipedia.org/wiki/Bryan_Cantrill https://en.wikipedia.org/wiki/Bryan_Cantrill If he is saying that Intel is giving other advice privately then you are welcome not to believe him (and note that it is you who is using the much stronger term "lying" here). Personally I think un-sourced statements from him are worth listening to.
  - Aloha 9y ago
    My general attitude is to presume good faith - both on intels part, and on the part of commenters online. I had no idea who he was till you raised the point with me - had he I identified some source for his assertions (even first had observation on a large number of systems), I probably wouldn't have said anything.
- loeg 9y ago
  Not that it's a source you can point to, but I have also heard the much stronger language — don't push this microcode — trickle out of Intel.

benjarrell 9y ago

“We have received reports from a few customers of higher system reboots after applying firmware updates.” What does higher mean here?

dboreham 9y ago
Means whoever typed that can't write.
IvyMike 9y ago
more frequent
- kbenson 9y ago
  With the implication that random reboots of a lesser, but non-zero frequency are okay, it's at least expected? Odd wording for sure.
  - ahoka 9y ago
    If you have Intel wireless or display drivers installed then it is perfectly normal for a computer to randomly reboot.
    - clarry 9y ago
      How often? I have 495 days of uptime here with intel graphics & wireless.
      - Avamander 9y ago
        Reboot your PC mate, the kernel needs updating.
        yjftsjthsd-h 9y ago
        Kpatch?

ksec 9y ago

Sorry If i had this wrong, they knew of the issues in June, and they only fix it in Jan. I can hardly call this rushed.

dboreham 9y ago
The fixes weren't widely run until this week.
- itronitron 9y ago
  presumably because Intel does not have access to the necessary hardware configurations to test the fixes on?
  - deleted 9y ago
    [deleted]
  - cyphar 9y ago
    I highly doubt this, given how much hardware they appear have lying around to throw at the Linux 0day Test Bot (which does full kernel compiles, boots, and integration tests for dozens of hardware configurations for every patch sent to most LKML lists).
  - ksec 9y ago
    I couldn't accept this as an excuse when you have possibly the worst CPU bug in x86 history, or perhaps all CPU history, with ample of man power and resources, along with 6 months time frame. Rush isn't a word I would use.
  - dboreham 9y ago
    No, because they don't have access to all the software in the world.

DrScump 9y ago

I just had a hard crash/reboot on a Dell running Windows 10 on an AMD processor, followed by a couple of auto updates. There was no indication of updates being available before the crash.

mtremsal 9y ago
Out of curiosity, how do you suppose an Intel microcode update caused a blue screen on your system running an AMD processor?
- drewm1980 9y ago
  These issues aren't limited to Intel, and the people developing the mitigations are probably sharing ideas with each other.
- mlvljr 9y ago
  Stolen IP, that's how! <waves a tinfoil hat>
JdeBP 9y ago
As I have just written elsewhere on this very page, you need to pay attention to the several KnowledgeBase and web log articles that Microsoft has been publishing on this subject as things develop. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660

rusbus 9y ago

I think it's a bit ironic that the text, in a sense, blames Google for these problems by calling them the "Google Project Zero Exploits" as if Google was some sort of cyber crime syndicate using their evil powers to exploit intel.

9935c101ab17a66 9y ago
Wow, that's a good point. "...the exploits uncovered by Google Project Zero" would be much, much more appropriate.
- Animats 9y ago
  The "Intel CPU fundamental design defects uncovered by Google" is more like it.
  - HugoDaniel 9y ago
    "Intel CPU deliberate design defects now uncovered by Google"
- deleted 9y ago
  [deleted]
cookiecaper 9y ago
Yeah I thought that was interesting too. I think they are most likely name dropping Google just because they want to reinforce whatever type of association with Google that they can get. Lots of people won't register this as a bad thing per se, and will just think "Wow it's super cool that Intel is working with The Googles on something". As developers, we should know this phenomenon well by now, as it's dictated an ever-increasing portion of our toolchain. "Oh, you say Google uses this thing?! I use it too then! Google and me are best buds!". (This applies equally to Facebook, and to a lesser extent, Amazon. Compare one of my son's favorite YouTube videos at [0]). Alternatively, they may want customers to think "Oh boy you have to be a super genius guy like the Googles to beat up Intel so this isn't a big deal", or "How could Google do this to a nice company like Intel". So many possibilities, but really all of them turn out well for Intel. [0] https://youtu.be/6x0yWfmh-zk?t=19 https://youtu.be/6x0yWfmh-zk?t=19

partycoder 9y ago

I think it's hard to see how this will affect Intel in the long term. When Samsung phones were blowing up, I thought that was it, but somehow people kept preferring the phones.

madez 9y ago
It raises awareness about issues. Change takes time. Look at the fight of blacks and women for equality in society. We must not stop pointing out the issues, and always demand change.
partycoder 9y ago
Now, in retrospective, the Samsung battery issue affected only a small portion of users, whereas this will affect every single user in the form of decreased performance.

Twirrim 9y ago

Well this promises to be fun, especially for cloud providers (and those running instances on the cloud, who now potentially get to suffer through host instability)

jlgaddis 9y ago
Intel's adaptation of Netflix's Chaos Monkey [0]? [0]: https://en.wikipedia.org/wiki/Chaos_Monkey https://en.wikipedia.org/wiki/Chaos_Monkey
- numbsafari 9y ago
  I was thinking the same thing as I read this. “Chaos engineering” has served some customers very well here. From speaking in my circles, I get the impression that those of us without our own data centers to worry about are much better off than those who do.
sebazzz 9y ago
It is not clear if Xeon server processors are affected.
- Twirrim 9y ago
  Intel has made such a complicated product line it's really difficult to figure out what is and isn't affected. As per the Lenovo update mentioned elsewhere in this thread: "*3 – (Broadwell E, H, U/Y; Haswell standard, Core Extreme, ULT) Symptom: Intel has received reports of unexpected page faults, which they are currently investigating. Out of an abundance of caution, Intel requested Lenovo to stop distributing this firmware." So far as I can figure, Xeons are covered by "Haswell standard". Core Extreme was those ridiculously overpriced i7s. ULT is the "Ultra Low TDP" chips. https://en.wikipedia.org/wiki/Haswell_%28microarchitecture%29#Server_processors https://en.wikipedia.org/wiki/Haswell_%28microarchitecture%2... It looks like from the desktop and mobile processor fields, if there is anything special about the core they put a suffix on denoting it, so Xeon may well classify as "Haswell standard"?

ericzawo 9y ago

Doesn’t exactly reassure you, does it.

compsciphd 9y ago

My broadwell (i5-2500k) windows desktop has started blue screening like crazy if I do large continous network transfers (i.e. saturating gigabit ethernet). I didn't have this problem before I rebooted for my most recent update. I thought it might be memory, but an 8+ hour memory scan (windows internal one, not the normal linux one) didn't tickle any bad bits and its not erorring in any unique component, each time, it seems to be a different one (first I caught the blue screen, it was the network driver, that made sense, so I upgraded it, just in case), but then it started being ntfs and other things. wondering if its just limited to those arches, or others.

Narishma 9y ago
> My broadwell (i5-2500k) That's Sandy Bridge, 3 generations older than Broadwell.
- compsciphd 9y ago
  you are correct, I actually looked it up, and meant sandy bridge (hence why I wrote "limited to those arches, or others"), but brain farted while writing.
- compsciphd 9y ago
  and apparently with the latest news, it perhaps wasn't all in my head https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/ https://newsroom.intel.com/news/firmware-updates-and-initial...

gesman 9y ago

Happy face on profile of that post is a bit out of context with the customer's feelings...

intelhearts 9y ago

Not very surprised of the wording considering this guy held fundraisers for Trump.. dump intel I really wonder how many rape-parties this califag has been to

mrsaint 9y ago

Uhm, what a mess. This, just when Linux vendors began pushing updated intel-microcode packages (Ubuntu just released intel-microcode 3.20180108.0). Should we put the update on hold until this issue is hopefully resolved, or should we still update as suggested in the last paragraph of this Intel press release, somehow believing that the random reboots don't apply to "end users"?

JdeBP 9y ago
It is a mess. I suggest that you and anyone else asking these questions pay attention to Microsoft a little bit, to receive all of the information that there is to be had on this. Microsoft has been telling people about problems with the mitigations up-front. There are, for starters, Microsoft KnowledgeBase articles detailing problems with older AMD CPUs and with anti-virus softwares that behave like rootkit viruses resulting in systems that will not boot, and web log articles discussing the performance considerations for server systems. * https://news.ycombinator.com/item?id=16076660 https://news.ycombinator.com/item?id=16076660
lower 9y ago
Lenovo has put out an advisory about what to do with the BIOS updates that contain the microcode: https://pcsupport.lenovo.com/de/en/product_security/PS500151 https://pcsupport.lenovo.com/de/en/product_security/PS500151 Withdrawn CPU Microcode Updates: Intel provides to Lenovo the CPU microcode updates required to address Variant 2, which Lenovo then incorporates into BIOS/UEFI firmware. Intel recently notified Lenovo of quality issues in two of these microcode updates, and concerns about one more. These are marked in the product tables with “Earlier update X withdrawn by Intel” and a footnote reference to one of the following: 1 – (Kaby Lake U/Y, U23e, H/S/X) Symptom: Intermittent system hang during system sleep (S3) cycling. If you have already applied the firmware update and experience hangs during sleep/wake, please flash back to the previous BIOS/UEFI level, or disable sleep (S3) mode on your system; and then apply the improved update when it becomes available. If you have not already applied the update, please wait until the improved firmware level is available. 2 – (Broadwell E) Symptom: Intermittent blue screen during system restart. If you have already applied the update, Intel suggests continuing to use the firmware level until an improved one is available. If you have not applied the update, please wait until the improved firmware level is available. 3 – (Broadwell E, H, U/Y; Haswell standard, Core Extreme, ULT) Symptom: Intel has received reports of unexpected page faults, which they are currently investigating. Out of an abundance of caution, Intel requested Lenovo to stop distributing this firmware.

Animats 9y ago

Spin control. By "higher system reboots" they mean "the OS crashes after their CPU 'fix'".

zimmerfrei 9y ago

To be fair, it can well be that some sloppy OEM drivers take too many assumptions on reserved bits in registers (which the new microcode may be legitimately changing) or on undocumented timing side-effects related to some instructions (which the new microcode may affect, being that the root problem in the first place!). These symptoms are also the classic ones you get when you install an OS on a new-generation, well-functioning CPU.

joenathanone 9y ago
Don't speculate, it adds nothing but confusion.
- zimmerfrei 9y ago
  My comment is no more speculative than those blaming the new microcode for causing reboots. The real bad quality, bad update process and unjustified binary nature of OEM firmware is too often overlooked.

pQd 9y ago

probably related news from Dell: "NOTE 1: 13G, select 12G, and select DSS server BIOS files have been pulled from http://dell.com/support http://dell.com/support. This note and article will be updated as soon as more information is available" [1] the pulled out BIOS update files for 13th gen were released on 5th of Jan. [1] http://www.dell.com/support/article/us/en/04/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en http://www.dell.com/support/article/us/en/04/sln308588/micro...

sateesh 9y ago

I think all the more jarring is the smiling face of the spokesperson next to this announcement. Atleast can't the announcement be not with a photo or have a serious looking photo of the spokesperson.

AngeloAnolin 9y ago
The photo seems to remind me of someone saying, "that's all you get suckers" coupled with an evil grin.

mtgx 9y ago

Intel's "security pledge" is hilarious, when ME/AMT continues to be used as a backdoor. This just in: https://business.f-secure.com/intel-amt-security-issue https://business.f-secure.com/intel-amt-security-issue

throwawaymanbot 9y ago

And we would have got away with it if it wasnt for you pesky kids......

rmetzler 9y ago

I heard from my colleague that he had boot issues with a server (new Centos7 kernel) and a RAID he set up today.