Info Meltdown and Spectre Vulnerabilities Information

[goldstone77]

2009 I think, but not for all CPUs released in that timeframe.

My motherboard wasn't included. And I think that is going to be the deal. How far back are motherboard vendors required to update a product. ~warranty/last unit produced.

BIOS
Version 2104
2013/09/164.4 MBytes
P8Z77-V BIOS 2104
https://www.asus.com/us/Motherboards/P8Z77V/HelpDesk_Download/

 

[Turb0Yoda]

my r710 got an update for meltdown/spectre, but I assume because it's an enterprise thing, not consumer...

 

[randomizer]

My motherboard wasn't included. And I think that is going to be the deal. How far back are motherboard vendors required to update a product. ~warranty/last unit produced.

Probably as far back as they feel like. I haven't had a BIOS update since 2011. Not that it makes any difference as Intel decided not to provide microcode updates for my chip.

 

[goldstone77]

I've reached out to ASUS support following a chat with Intel Support. I did this via live chat link provided by Intel Support, and this is a email response from that live chat. I also have transcripts from the live chat. Here is too hoping they do something!

Hello ------------,

Thank you for contacting ASUS Product Support.
My name is Patrick M. and I understand you would like to know if there will be a bios update for P8Z77-V motherboard regarding Spectre Variant 2 issue. I apologize for the inconvenience you are experiencing and I will do my best to assist you.

I have escalated your case further to our higher technical department. The processing time for the escalation should take 24-48 hours and you should be contacted within that time frame.

If you have any other questions, please feel free to contact us again for assistance.
Thanks again for choosing ASUS and have a great day.

Best Regards,
Patrick M.

ASUS Product Support
http://www.asus.com/us/support/

 

[imrazor]

@goldstone77 Please let us know if you find a BIOS update. I have a P8Z77-V LK that needs patching as well.

 

[-Fran-]

Still some news about updates for both problems in Win10:

https://techreport.com/news/33561/windows-10-update-has-spectre-fixes-for-haswell-broadwell-and-skylake
https://www.tomshardware.com/news/microsoft-spectre-microcode-updates,36954.html

Cheers!

 

[goldstone77]

@goldstone77 Please let us know if you find a BIOS update. I have a P8Z77-V LK that needs patching as well.

Thank you for reaching out to Asus customer Support. My name is Eugene D. the supervisor handling your case. We would like to extend our sincerest apology for all the inconveniences that you might have experience with your ASUS product. We are happy to help you resolve your issue by providing you with the best possible solution. We would like to inform you that this motherboard is no longer in production and at the moment we have dedicated all our resources for Spectre/Meltdown fix for newest models.

If you have any further questions, comments or concerns please do not hesitate to let us know, we will be more than happy to assist you. Thanks for choosing ASUS products and services.

Best Regards,
Eugene D.

ASUS Product Support
http://www.asus.com/us/support/

Looks like no update for older boards.

 

[randomizer]

Well they said:

We are happy to help you resolve your issue by providing you with the best possible solution.

So tell them that is a BIOS update.

 

[goldstone77]

Well they said:

We are happy to help you resolve your issue by providing you with the best possible solution.

So tell them that is a BIOS update.

Right!

 

[goldstone77]

Eight new Spectre Variant Vulnerabilities for Intel Discovered - four of them critical
by Hilbert Hagedoorn on: 05/03/2018 10:55 AM
http://www.guru3d.com/news-story/eight-new-spectre-variant-vulnerabilities-for-intel-discovered-four-of-them-critical.html

 

[aldaia]

Eight new Spectre Variant Vulnerabilities for Intel Discovered - four of them critical
by Hilbert Hagedoorn on: 05/03/2018 10:55 AM
http://www.guru3d.com/news-story/eight-new-spectre-variant-vulnerabilities-for-intel-discovered-four-of-them-critical.html

Wow!
That sentence sounds scary

The newly discovered vulnerabilities would make it really easy to exploit a host from a simple VM.

 

[-Fran-]

Sounds like the infrastructure teams will have a fun night soon.

Also:

I died with that image.

Cheers!

 

[gamerk316]

I repeat: This is going to get really bad before all is said and done. On-die security was something that was never really considered, but here we are. This is the tip of the iceberg, because now people are actively looking for holes.

 

[-Fran-]

Haha, I already asked out internal teams about the news. They were SO happy about it, hahaha.

Having to patch more than 200 VMs (backed by around 50+ servers) in a single day is what they live for, they said. Seems like this is one of those that can't be rolled out with the automatic patching they have in place.

Cheers!

 

[sunsanvil]

Wasn't sure if I should ask here or start a separate thread...

One thing I haven't been able to understand is when might this whole thing get "designed out"? By that I mean, can it be "fixed" in next generation (i5-9xxx or whatever) or is our current architecture so deeply rooted (no pun intended) that it will be a decade before this is thought of as a thing of the past?

Phrased more practically, is there any point to putting off a CPU upgrade at this time?

 

[goldstone77]

Wasn't sure if I should ask here or start a separate thread...

One thing I haven't been able to understand is when might this whole thing get "designed out"? By that I mean, can it be "fixed" in next generation (i5-9xxx or whatever) or is our current architecture so deeply rooted (no pun intended) that it will be a decade before this is thought of as a thing of the past?

Phrased more practically, is there any point to putting off a CPU upgrade at this time?

That is a real good question, and most comments I've seen suggest it will be a long time before this is fixed. Intel said they have a hardware fix coming for Spectre variant 2 and Meltdown. Spectre variant 1 is going to be the harder problem to solve. Currently, I don't know of any time table or product that has these vulnerabilities being fixed in hardware.

 

[-Fran-]

The problem of "Smeltdown" for regular consumers is not that big compared to say Cloud services providers or big Corporations, since security wise, it's harder for hackers to target regular people than big corps. It's a "big numbers" type of justification. Plus, as long as you have a healthy habit for browsing sites and keep your system up to date, the chances of getting "hacked" by the use of these vulnerabilities is still very low. You'd have to, literally, put your head in the lion's mouth.

At least, that is my take. I believe gamerk and several others might have a similar view/take on these.

Cheers!

 

[sunsanvil]

The problem of "Smeltdown" for regular consumers is not that big compared to say Cloud services providers or big Corporations, since security wise, it's harder for hackers to target regular people than big corps.

I must confess I'm less concerned about the security side of it since (it seems at least) that microcode updates have been and will continue to be released.

I'd just hate to invest in coffee lake today (which comes hand in hand with all those perf shaving microcode updates on the boards) if, hypothetically, something truly "fixed" were around the corner. I'd wait up to a while year myself but if its going to be longer than that...

 

[gamerk316]

The problem here is that Specter attacks the branch predictor, which is a major source of performance improvements on modern CPUs. There's no magic fix thats going to address the vulnerabilities that won't negatively affect performance. And with AMD suddenly competitive on performance, Intel is under a lot of pressure to increase performance, not decrease it.

My opinion is that it's time for Intel to move on from Core and come up with something new. [My *real* opinion is it's time to kill off x86/x86-64, but that ain't happening sadly.]

 

[sunsanvil]

(...) the branch predictor, which is a major source of performance improvements on modern CPUs. There's no magic fix thats going to address the vulnerabilities that won't negatively affect performance.

Yea that's what I'm getting at. Its all well and good for them to keep spewing "microcode fixes", but that's a band-aid which applies to older CPUs as well as brand spanking new ones so the real question for me is "where do we go from here?". Clearly they cant just snip-snip something out of the current design (not without taking a massive step back in performance) so where is the long-game plan? I hate to sound like a wingnut but maybe all these delays with 10mn are being exaggerated to buy some time for their teams to regroup and figure out a tenable redesign.

Buying into a platform is a 5-6 year term for me (I'm on an aging Ivy Bridge right now) so this whole thing is really giving me a bad case of purchase paralysis. How long do I hold off waiting for Intel (and AMD) to come up with something more interesting than "we are coming out with slightly faster chips....which STILL have the same spectre/meltdown problems"

 

[randomizer]

I hate to sound like a wingnut but maybe all these delays with 10mn are being exaggerated to buy some time for their teams to regroup and figure out a tenable redesign.

Intel isn't going to can its medium term product roadmap because of some performance penalties.

 

[goldstone77]

I hate to sound like a wingnut but maybe all these delays with 10mn are being exaggerated to buy some time for their teams to regroup and figure out a tenable redesign.

Intel isn't going to can its medium term product roadmap because of some performance penalties.

I have to agree with randomizer on this one. Intel has already spent time in money on designs for the next 3 generations. Cannon Lake is a port of Skylake to 10nm. Die shrinks provide lower power consumption and better performance using the same architecture. Intel has leveraged a process lead over AMD for ~20 years to help create and maintain a performance gap. They would not willingly give up this advantage, because it is giving away revenue to AMD.

Die shrinks are the key to improving price/performance at semiconductor companies such as Intel, AMD (including the former ATI), NVIDIA, and Samsung. Examples in the 2000s include the codenamed Cedar Mill Pentium 4 processors (from 90 nm CMOS to 65 nm CMOS) and Penryn Core 2 processors (from 65 nm CMOS to 45 nm CMOS), the codenamed Brisbane Athlon 64 X2 processors (from 90 nm SOI to 65 nm SOI), and various generations of GPUs from both ATI and NVIDIA. In January 2010, Intel released Clarkdale Core i5 and Core i7 processors fabricated with a 32 nm process, down from a previous 45 nm process used in older iterations of the Nehalem processor microarchitecture. Intel, in particular, formerly focused on leveraging die shrinks to improve product performance at a regular cadence through its Tick-Tock model. In this business model, every new microarchitecture (tick) is followed by a die shrink (tock) to improve performance with the same microarchitecture.[1]

https://en.wikipedia.org/wiki/Die_shrink

 

[sunsanvil]

I have to agree with randomizer on this one. Intel has already spent time in money on designs for the next 3 generations.

Oh, I agree of course, but that's really my question: how many generations or years will it take for the investment in the current architecture to run its course? Phrased another way, if hypothetically they right now start working on something really "new" to address the whole spectre/meltdown thing, how long before that bears fruit? You could be right in saying 3 gens. Its an interesting question to ponder anyway.

 

[gamerk316]

I have to agree with randomizer on this one. Intel has already spent time in money on designs for the next 3 generations.

Oh, I agree of course, but that's really my question: how many generations or years will it take for the investment in the current architecture to run its course? Phrased another way, if hypothetically they right now start working on something really "new" to address the whole spectre/meltdown thing, how long before that bears fruit? You could be right in saying 3 gens. Its an interesting question to ponder anyway.

The problems that we know now are ingrained in a fundamental part of the architecture. Until Intel retires Core, which likely won't happen until after either 7nm/4nm, I doubt you're going to see a full HW fix.

 

[Gon Freecss]

I hate to sound like a wingnut but maybe all these delays with 10mn are being exaggerated to buy some time for their teams to regroup and figure out a tenable redesign.

Intel isn't going to can its medium term product roadmap because of some performance penalties.

I have to agree with randomizer on this one. Intel has already spent time in money on designs for the next 3 generations. Cannon Lake is a port of Skylake to 10nm. Die shrinks provide lower power consumption and better performance using the same architecture. Intel has leveraged a process lead over AMD for ~20 years to help create and maintain a performance gap. They would not willingly give up this advantage, because it is giving away revenue to AMD.

Die shrinks are the key to improving price/performance at semiconductor companies such as Intel, AMD (including the former ATI), NVIDIA, and Samsung. Examples in the 2000s include the codenamed Cedar Mill Pentium 4 processors (from 90 nm CMOS to 65 nm CMOS) and Penryn Core 2 processors (from 65 nm CMOS to 45 nm CMOS), the codenamed Brisbane Athlon 64 X2 processors (from 90 nm SOI to 65 nm SOI), and various generations of GPUs from both ATI and NVIDIA. In January 2010, Intel released Clarkdale Core i5 and Core i7 processors fabricated with a 32 nm process, down from a previous 45 nm process used in older iterations of the Nehalem processor microarchitecture. Intel, in particular, formerly focused on leveraging die shrinks to improve product performance at a regular cadence through its Tick-Tock model. In this business model, every new microarchitecture (tick) is followed by a die shrink (tock) to improve performance with the same microarchitecture.[1]

https://en.wikipedia.org/wiki/Die_shrink

Again, wrong. Cannonlake isn't Skylake ported onto 10nm exactly as it is. It has architectural improvements. Historically (at least since the first generation since that's what I know), die shrinks provided <=5% IPC improvements.

And you're grossly wrong about Intel maintaining its performance lead mainly thanks to the process. It's the architecture first and foremost, then the process.