6 ms·

Intel won’t release Spectre patches for some older chips after all

143 points by awiesenhofer 9y ago

antisthenes 9y ago
Unfortunate, but not unexpected. A shame about Bloomfield and Gulftown, but the rest of the products seem to be firmly in the legacy/obsolete category.
- eropple 9y ago
  Bloomfield's a decade old, Gulftown only moderately less. I'm pretty sure I'd put them in the legacy category today (and I have a 975 around here, so I'm a little bummed, but I get it).
- yuhong 9y ago
  Afaik Westmere was the first to support PCID in the first place.
jumelles 9y ago
I think this means we've only seen the beginning of the full effects of Spectre. I'm expecting consequences for years to come.
DCKing 9y ago
The support list [1] is weird. Gulftown (Core i7) and Westmere-EP (Xeon) are essentially the same chips yet only the latter is patched. The distinction between Gulftown and Westmere-EP actually was barely ever made until now. And Intel's confusing product line has lasted until today - the Xeon W3690 is apparently Gulftown (the only Xeon) and is not patched [2], yet the Xeon W3670 and W3680 are Westmere-EP and will receive their microcode updates [3]. According to this document, make sure to read your CPU's model numbers carefully. It doesn't reflect well on Intel that the line does not appear to be drawn based on technical capability, but apparently on contractual obligations. Many CPUs in the unsupported list still make very serviceable hardware in 2018. It's a shame a security issue will only add to their obsoletion, or make people using this hardware more vulnerable. Spectre variant 2 is difficult to exploit in practice, but that sounds like some famous last words. [1]: https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... [2]: On page 8 [3]: On page 16
- pasbesoin 9y ago
  If Intel doesn't come through consistently across the board, regardless of "contractual obligations", people are going to be looking at Apple's rumored transition away from Intel all the more favorably. And yes, by saying this, in part I'm hoping to put it into people's minds. And, if there's enough of that, into pressure on Intel. P.S. My concern extends to what may happen to coverage if/when succeeding rounds of fixes are needed. In general, we don't appear to be done with this class of problem in extant products. Not that Apple's "the solution". But lack of support will prompt people to consider alternatives.
  - Phlarp 9y ago
    Apple designed ARM silicon does not preclude being vulnerable to Spectre (or other hardware level bugs). Both Intel and Apple have large talent pools of excellent silicon and lithography engineers but that hardly makes them immune to bugs, and some bugs will end up being vulnerabilities.
    - Arnavion 9y ago
      The parent's point is not that Apple's chips won't have bugs, but that Apple's chips will have bugfixes.
      - pasbesoin 9y ago
        I don't know to what extent I trust Apple's follow-through. But, purchasers will have more choices. And, Apple's silicon development appears to be top-notch. In addition, the company professes and demonstrates some ongoing concern about security. So, depending on Apple's ongoing hardware developments, Intel may face technical pressures on the security front with respect to processors and SoC. And Intel needs to match its technical developments with demonstrated concern for its users' security and not allowing its products to compromise same. Anyway... I hope the pressure stays on Intel. Going through the current process -- not just with Intel, but with system vendors -- wondering whether my several year old but still quite functional systems will be updated, and when. And right before that, the struggle to know what to do about the ME vulnerabilities. Some people have to be getting kind of tired of this. And now to carry continued tension, waiting for the next shoe to drop. In the phone world, Apple users don't seem to worry as much as Android users with respect to vulnerabilities. Because Apple usually patches them fairly quickly, and Apple also has used its muscle to bypass carriers' horrendously bad update support as witnessed in the Android world. Computer users aren't going to want to worry whether they're going to get a full life out of their computer, or have to stop using it for X months until a problem gets patched. Right now, most of them are pretty oblivious to the current chip problems. These problems start turning into active exploits, and that's going to change. Ok. Ramble over.
yborg 9y ago
This list includes the Penryns used in most Mac laptops and the Mac Minis up to ~2010 vintage. I still use mine to host various Internet-facing utility services, which it does handily.
chapill 9y ago
So, all the Libreboot laptops are done. Frog boiled. Freedom's last holdout now are Coreboot ARM machines like the latest ARM Chromebooks.
- deleted 9y ago
  [deleted]
- SparkleBunny 9y ago
  RISC-V: A new hope
  - colejohnson66 9y ago
    Until you can run x86_64 at native speeds, replacing it will take a long time.
    - zaarn 9y ago
      Doesn't have to be native, only fast enough to power gaming, office and extensive image collections. Only one of those requires lots of computing horse and that mainly on the GPU (though there are some offenders like PUBG or Minecraft, the later also slurping up a significant chunk of memory bandwidth)
    - SparkleBunny 9y ago
      I wouldn't even bother mentioning X86(64) in the context of RISC-V. When RISC-V becomes financially viable for manufacturers they'll switch. Cost alone is enough to justify the change. Most of the innovation happening these days is in the mobile sector with mobile devices replacing more and more of the average consumer's computing needs. This alone has made for some pretty nimble software already. Every device sold with one of those ARM-based processors has an Arm holding "tax." ALL vendors are happy to not pay that tax and will be even happier to have nothing to do with ARM Holdings at all (I've heard they're shit to work with). Arm and RISC-V are both RISC architecture; not hard for software to switch. What happens in the mobile sector will trickle down to the rest of the tech industry. Microsoft has even embraced RISC with Windows on snapdragon devices. I doubt the consumer will even notice a difference.
ken 9y ago
This list includes the base model CPU in the 2009, 2010, and 2012 Mac Pros, as well as some of the BTO upgrades. I'm disappointed, but not surprised. The 2012 Mac Pros, in particular, were still being sold less than 5 years ago, so this means it's still officially supported by Apple. I wonder if there's some awkward conversations happening between the two companies about that. Fortunately, it's possible to upgrade the CPU in a Mac Pro to a newer part which is still supported by Intel.
- SparkleBunny 9y ago
  I think the "awkward conversations" are already over: https://news.ycombinator.com/item?id=16737072 https://news.ycombinator.com/item?id=16737072
slavik81 9y ago
The Bloomfield i7s are still perfectly serviceable processors. People will almost certainly continue using them unpatched.
bitmapbrother 9y ago
Has AMD released Spectre patches for all of their old chips? I'm guessing they haven't so it looks likes Intel has company.
- Paianni 9y ago
  If I'm not mistaken, the weaknesses of AMD processors with regards to Spectre were less pronounced than Intel's, so maybe they could get by.
  - bitmapbrother 9y ago
    According to Wikipedia, AMD CPU's are just as vulnerable to Spectre variant 1 and 2 as is Intel. The confusion that AMD was not vulnerable to variant 2 was due to a mistake made by AMD and later corrected by them 9 days later after verifying they were also vulnerable to variant 2. AMD originally acknowledged vulnerability to one of the Spectre variants (GPZ variant 1), but stated that vulnerability to another (GPZ variant 2) had not been demonstrated on AMD processors, claiming it posed a "near zero risk of exploitation" due to differences in AMD architecture. In an update nine days later, AMD said that "GPZ Variant 2…is applicable to AMD processors" and defined upcoming steps to mitigate the threat. Several sources took AMD's news of the vulnerability to GPZ variant 2 as a change from AMD's prior claim, though AMD maintained that their position had not changed.
    - goisa 9y ago
      Their position didn't change. AMD architecture simply doesn't prefetch data that requires elevated permissions to execute.
deleted 9y ago
[deleted]
tomxor 9y ago
Oh fucking great... my CPU's on the list, they didn't ask me but apparently I don't mind someone stealing all of my credentials from my main computer... what kind of BS non user said that. I will never buy another Intel CPU, fuck you very much Intel. If you have an old macbook you might want to check that list, the various flavours of C2Duos on that list were pretty common.
compsciphd 9y ago
My Q6600 based desktop (g0 stepping) died right before all this news came out after a decade of dedicated use. Guess it would have had to be retired anyways.
deleted 9y ago
[deleted]

143 points by awiesenhofer 9y ago

Unfortunate, but not unexpected. A shame about Bloomfield and Gulftown, but the rest of the products seem to be firmly in the legacy/obsolete category.

eropple 9y ago
Bloomfield's a decade old, Gulftown only moderately less. I'm pretty sure I'd put them in the legacy category today (and I have a 975 around here, so I'm a little bummed, but I get it).
yuhong 9y ago
Afaik Westmere was the first to support PCID in the first place.

jumelles 9y ago

I think this means we've only seen the beginning of the full effects of Spectre. I'm expecting consequences for years to come.

DCKing 9y ago

The support list [1] is weird. Gulftown (Core i7) and Westmere-EP (Xeon) are essentially the same chips yet only the latter is patched. The distinction between Gulftown and Westmere-EP actually was barely ever made until now. And Intel's confusing product line has lasted until today - the Xeon W3690 is apparently Gulftown (the only Xeon) and is not patched [2], yet the Xeon W3670 and W3680 are Westmere-EP and will receive their microcode updates [3]. According to this document, make sure to read your CPU's model numbers carefully. It doesn't reflect well on Intel that the line does not appear to be drawn based on technical capability, but apparently on contractual obligations. Many CPUs in the unsupported list still make very serviceable hardware in 2018. It's a shame a security issue will only add to their obsoletion, or make people using this hardware more vulnerable. Spectre variant 2 is difficult to exploit in practice, but that sounds like some famous last words. [1]: https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... [2]: On page 8 [3]: On page 16

pasbesoin 9y ago
If Intel doesn't come through consistently across the board, regardless of "contractual obligations", people are going to be looking at Apple's rumored transition away from Intel all the more favorably. And yes, by saying this, in part I'm hoping to put it into people's minds. And, if there's enough of that, into pressure on Intel. P.S. My concern extends to what may happen to coverage if/when succeeding rounds of fixes are needed. In general, we don't appear to be done with this class of problem in extant products. Not that Apple's "the solution". But lack of support will prompt people to consider alternatives.
- Phlarp 9y ago
  Apple designed ARM silicon does not preclude being vulnerable to Spectre (or other hardware level bugs). Both Intel and Apple have large talent pools of excellent silicon and lithography engineers but that hardly makes them immune to bugs, and some bugs will end up being vulnerabilities.
  - Arnavion 9y ago
    The parent's point is not that Apple's chips won't have bugs, but that Apple's chips will have bugfixes.
    - pasbesoin 9y ago
      I don't know to what extent I trust Apple's follow-through. But, purchasers will have more choices. And, Apple's silicon development appears to be top-notch. In addition, the company professes and demonstrates some ongoing concern about security. So, depending on Apple's ongoing hardware developments, Intel may face technical pressures on the security front with respect to processors and SoC. And Intel needs to match its technical developments with demonstrated concern for its users' security and not allowing its products to compromise same. Anyway... I hope the pressure stays on Intel. Going through the current process -- not just with Intel, but with system vendors -- wondering whether my several year old but still quite functional systems will be updated, and when. And right before that, the struggle to know what to do about the ME vulnerabilities. Some people have to be getting kind of tired of this. And now to carry continued tension, waiting for the next shoe to drop. In the phone world, Apple users don't seem to worry as much as Android users with respect to vulnerabilities. Because Apple usually patches them fairly quickly, and Apple also has used its muscle to bypass carriers' horrendously bad update support as witnessed in the Android world. Computer users aren't going to want to worry whether they're going to get a full life out of their computer, or have to stop using it for X months until a problem gets patched. Right now, most of them are pretty oblivious to the current chip problems. These problems start turning into active exploits, and that's going to change. Ok. Ramble over.

yborg 9y ago

This list includes the Penryns used in most Mac laptops and the Mac Minis up to ~2010 vintage. I still use mine to host various Internet-facing utility services, which it does handily.

chapill 9y ago

So, all the Libreboot laptops are done. Frog boiled. Freedom's last holdout now are Coreboot ARM machines like the latest ARM Chromebooks.

deleted 9y ago
[deleted]
SparkleBunny 9y ago
RISC-V: A new hope
- colejohnson66 9y ago
  Until you can run x86_64 at native speeds, replacing it will take a long time.
  - zaarn 9y ago
    Doesn't have to be native, only fast enough to power gaming, office and extensive image collections. Only one of those requires lots of computing horse and that mainly on the GPU (though there are some offenders like PUBG or Minecraft, the later also slurping up a significant chunk of memory bandwidth)
  - SparkleBunny 9y ago
    I wouldn't even bother mentioning X86(64) in the context of RISC-V. When RISC-V becomes financially viable for manufacturers they'll switch. Cost alone is enough to justify the change. Most of the innovation happening these days is in the mobile sector with mobile devices replacing more and more of the average consumer's computing needs. This alone has made for some pretty nimble software already. Every device sold with one of those ARM-based processors has an Arm holding "tax." ALL vendors are happy to not pay that tax and will be even happier to have nothing to do with ARM Holdings at all (I've heard they're shit to work with). Arm and RISC-V are both RISC architecture; not hard for software to switch. What happens in the mobile sector will trickle down to the rest of the tech industry. Microsoft has even embraced RISC with Windows on snapdragon devices. I doubt the consumer will even notice a difference.

ken 9y ago

This list includes the base model CPU in the 2009, 2010, and 2012 Mac Pros, as well as some of the BTO upgrades. I'm disappointed, but not surprised. The 2012 Mac Pros, in particular, were still being sold less than 5 years ago, so this means it's still officially supported by Apple. I wonder if there's some awkward conversations happening between the two companies about that. Fortunately, it's possible to upgrade the CPU in a Mac Pro to a newer part which is still supported by Intel.

SparkleBunny 9y ago
I think the "awkward conversations" are already over: https://news.ycombinator.com/item?id=16737072 https://news.ycombinator.com/item?id=16737072

slavik81 9y ago

The Bloomfield i7s are still perfectly serviceable processors. People will almost certainly continue using them unpatched.

bitmapbrother 9y ago

Has AMD released Spectre patches for all of their old chips? I'm guessing they haven't so it looks likes Intel has company.

Paianni 9y ago
If I'm not mistaken, the weaknesses of AMD processors with regards to Spectre were less pronounced than Intel's, so maybe they could get by.
- bitmapbrother 9y ago
  According to Wikipedia, AMD CPU's are just as vulnerable to Spectre variant 1 and 2 as is Intel. The confusion that AMD was not vulnerable to variant 2 was due to a mistake made by AMD and later corrected by them 9 days later after verifying they were also vulnerable to variant 2. AMD originally acknowledged vulnerability to one of the Spectre variants (GPZ variant 1), but stated that vulnerability to another (GPZ variant 2) had not been demonstrated on AMD processors, claiming it posed a "near zero risk of exploitation" due to differences in AMD architecture. In an update nine days later, AMD said that "GPZ Variant 2…is applicable to AMD processors" and defined upcoming steps to mitigate the threat. Several sources took AMD's news of the vulnerability to GPZ variant 2 as a change from AMD's prior claim, though AMD maintained that their position had not changed.
  - goisa 9y ago
    Their position didn't change. AMD architecture simply doesn't prefetch data that requires elevated permissions to execute.

deleted 9y ago

[deleted]

tomxor 9y ago

Oh fucking great... my CPU's on the list, they didn't ask me but apparently I don't mind someone stealing all of my credentials from my main computer... what kind of BS non user said that. I will never buy another Intel CPU, fuck you very much Intel. If you have an old macbook you might want to check that list, the various flavours of C2Duos on that list were pretty common.

compsciphd 9y ago

My Q6600 based desktop (g0 stepping) died right before all this news came out after a decade of dedicated use. Guess it would have had to be retired anyways.

deleted 9y ago

[deleted]