Persons finding flaws, be they bugs or vulnerabilities, and disclosing these privately to the companies concerned - in this case Intel and perhaps MS and the Linux manager etc would not IMHO be a criminal. However, publicly disclosing it is IMHO criminal. I know there are grey areas, such as posting how to build explosives. But someone has to draw the line somewhere, and providing the details is just not as bad as actually committing the crime.
The details haven't been disclosed yet, but as the sections affected (speculative execution and TLB) have already been mentioned (and it's difficult to avoid that, in preparation for the update), it's enough to point to where to look. And then it's not so difficult to understand what happens. In any case the precursor to the whole thing was disclosed as "something to worry about" a year ago or more. But as far as I know (although things are changing by the hour), there's no widely available exploit code out there yet. The patch should happen before that. But then things slow down, and that won't recover much until hardware gets replaced.
Back in the 70's, the mini I worked with was sold to two competing companies, on the basis they could share the mini while keeping their data secret between each other. This worked successfully until the mini was replaced.
Do you really think the same mini could reliably keep the data seperate? Most everyone believed so. Field Engineers and Programmers alike did not know how this could be breached. However I knew the mini completely, and I can tell you now that I could have breached the system. But to do so I would consider to be a crime, as I would consider disclosing information to do so would also be a crime (an enabling disclosure). I was not under any NDA back then either.
Returning to Intel, yes they should have plugged the vulnerability for subsequent silicon once discovered.
As for the reduced performance, it should not be a mandatory upgrade. The user should have the option.
This is quite different to the VW saga. In that case, VW deliberately "fixed" the testing to pass the tests, knowing full well that the car failed the actual requirements. The ultimate fix was mandatory, and the result was less performance than was sold to the purchaser. Hence, IMHO a case for class action.
What about Windoze?
As the version gets older, magically (presumed via updates) Windoze performance slows. Every new release that comes along, the older versions continue to get slower.
I don't think anyone has found any proof for this, but it's a result that I have seen often!
The way it looks now I don't think it's much of an option not to update. Just browsing the net makes you vulnerable in a way not seen since Conficker (I think it was). I first thought that I would leave my Linux kernel unpatched and fast, and just do my browsing from a VM. Now it looks like it may be possible for the VM to break out of the hypervisor (at least for XEN), and if that becomes a reality then there's no choice unless you have an old system that will never be networked or updated.
Whilst a patch for Windows 10 is ready, other versions will be updated Patch Tuesday on January 9.
One source told Forbes out-of-support operating systems like Windows XP will not get the update.
They should be aware, however, that Microsoft is only making the updates available to those with compatible antivirus products. As Microsoft noted in a blog post: "The compatibility issue is caused when antivirus applications make unsupported calls into Windows kernel memory. These calls may cause stop errors (also known as blue screen errors) that make the device unable to boot." If users are running an incompatible antivirus, Microsoft recommended they get in touch with their AV vendor to determine what steps to take. Cybersecurity practitioner Kevin Beaumont has created a useful open list of those antivirus products that are compatible, along with details on plans from those who aren't.
Intel is also publishing firmware updates for its processors. You’ll need to snag them from your PC, laptop, or motherboard maker (like HP or Gigabyte) rather than Intel itself. Intel’s support page for the flaw links to firmware updates and information from the PC manufacturers it works with. By January 12, Intel expects to have released firmware updates for 90 percent of processors released in the past five years. The company hasn’t announced its plans for older CPUs like the venerable Core i7-2600K or processors from last decade.
Will these fixes slow down my PC or Mac?
It’s complicated, but if you’re not working on intensive tasks, it’s looking like you won’t take much of a hit.
More recent Intel processors from the Haswell (4th-gen) era onward have a technology called PCID (Process-Context Identifiers) enabled and are said to suffer less of a performance hit. Plus, some applications—most notably virtualization and data center/cloud workloads—are affected more than others. Intel confirmed that the performance loss will be dependent on workload, and “should not be significant” for average home computer users.
“Obviously it depends on just exactly what you do,” Linux creator Linus Torvalds wrote in the Linux Kernel Mailing List. “Some loads will hardly be affected at all, if they just spend all their time in user space. And if you do a lot of small system calls, you might see double-digit slowdown.”
Fortunately, a growing number of tests seem to support Intel’s contention that everyday PC users won’t see dramatic slowdowns, although storage read performance appears to take a hit. It’s worth noting that the results we’re about to cite were all conducted on CPUs released over the past couple of years—no older chips were tested.
Yes, the Intel chips have downloadable microcode. As does AMD. They have done for a decade or so. Where have you been?
No there is no publicly available documentation on that micro-code.
Basically they had to implement a way to dynamically change the behavior of their chips because after the the FOOF bug and other errors they realized things were far too complex to get right first time and recalling millions of chips is expensive.
Strangely enough at this very moment I am halfway through watching this video: "34C3 - Everything you want to know about x86 microcode, but might have been afraid to ask"
Where they present their work on reverse engineering and hacking the x86 microcode. They have gleaned a lot about the microcode architecture.
Makes me think there are a lot more x86 vulnerabilities coming down the pipe!
The Intel processors have loadable microcode? Is there a spec for the microcode instruction set and architecture?
Yes. As Heater said, there doesn't seem to be any documentation. Not so strange, because as far as I know the internals of the Intel CPUs have varied widely over the years. The x86 architecture and instruction set isn't what the actual CPU looks like.. for one, it has tons of registers the x86 programmer never sees. The x86 we, er, love.. is implemented via the microcode. And occasionally bugs are fixed via loadable microcode updates.
Yes, the Intel chips have downloadable microcode. As does AMD. They have done for a decade or so. Where have you been?
No there is no publicly available documentation on that micro-code.
Basically they had to implement a way to dynamically change the behavior of their chips because after the the FOOF bug and other errors they realized things were far too complex to get right first time and recalling millions of chips is expensive.
Strangely enough at this very moment I am halfway through watching this video: "34C3 - Everything you want to know about x86 microcode, but might have been afraid to ask"
Where they present their work on reverse engineering and hacking the x86 microcode. They have gleaned a lot about the microcode architecture.
Makes me think there are a lot more x86 vulnerabilities coming down the pipe!
Interesting. I knew there was microcode. I just didn't know it was loadable. I figured it was in ROM on the chip.
... I just didn't know it was loadable. I figured it was in ROM on the chip.
That is one feature that really stood out for me.
Indeed the microcode is held in ROM. After all, the chip has to be bootable from cold and that requires non-volatile microcode.
But there is also some microcode RAM into which patches can be installed when your machine boots. By the BIOS or whatever boot loader or Linux etc.
And then there are those "match registers", also in RAM. Such that if a particular opcode and it's operands match some condition the microcode execution jumps out of the ROM to the patch in RAM.
Which is very convenient if you are a reverse engineer or hacker because you don't need to create an entire microcode image with your changes in it.
It also means that microcode patches can be installed that normally do nothing. Until the user of the machine visits a website that delivers some Javascript that just just happens to trigger the match condition with some magic 64 bit number as an operand. And boom, the javascript owns you!
So, the security of your machine depends on that chain of trust from Intel/AMD to the BIOS vendors to whatever website you download that BIOS update from!
A question asked at the end of the presentation was about totally changing the instruction set with a microcode patch. Seems to me that it's probably possible to totally reprogram an x86 to run an instruction set like RISC-V. After all it's only a hand full of simple instructions.
Which would be sweet. No need to fabricate high end RISC-V chips!
...
A question asked at the end of the presentation was about totally changing the instruction set with a microcode patch. Seems to me that it's probably possible to totally reprogram an x86 to run an instruction set like RISC-V. After all it's only a hand full of simple instructions.
based on performance engineering, I'd doubt intel has anything close to 100% microcode coverage.
Someone has designed a microcoded x86 in FPGA, in under 500 LE, but it needs close to 20 sysclks per emulated opcode.
So yes, it is small but no, it is not fast.
That means intel chooses the rare, hardly used opcodes and targets those for microcode. Main program flows would not be microcoded.
Is there enough microcode installed to emulate RISC-V ? - perhaps, but it seems in loading RISC-V, you would break x86 compatible operation, and all that software would crash.
I don't know for certain of course, but I suspect that it actually *is* close to 100% microcode. Because the actual Intel CPU architecture is so totally different from the old x86. Some even call it an x86 VM that runs on top of an engine that is optimized to emulate the x86. But not all aspects are handled by microcode - microcode can't change where the ring0 protection switches on in the pipeline (or something like that), which is why this Meltdown flaw can't simply be fixed by microcode. They have to flush the TLB from the operating system, and that's done from software with a little help from the microcode patch Intel is working on.
According to video presentation there are something like six instruction decoders. Only one of them is the microcode engine. The others are hardware decoders. No doubt for speed as you say. But there is a mechanism to bypass the hardware decode and get the work done by a microcode patch. This happens when an instruction matches something in those match registers.
This makes sense, the whole point of the microcode is to be able to work around errors in the hardware logic.
In short, any x86 instruction can be "repaired" with a microcode patch.
Is there enough microcode installed to emulate RISC-V ? - ...
I have no idea how much microcode space there is. The RISC-V instruction set is very small so we are in with a chance.
...perhaps, but it seems in loading RISC-V, you would break x86 compatible operation, and all that software would crash.
Well yes. That is the whole point. Total instruction set replacement.
We can run Linux on a RISC-V machine. No need for all that x86 junk.
Yes. That is about the best description of the issues that I have seen. After the mass of hand waving, speculation and down right wrongness that has been written about it in the last few days.
Yes. That is about the best description of the issues that I have seen. After the mass of hand waving, speculation and down right wrongness that has been written about it in the last few days.
Here is another enlightening article about the bugs:
Today despite my settings and being on a metered connection, windoze has tried to force me to upgrade windoze (10) to the latest revision so it can then upgrade the security patches.
After the message popped up, my start/shutdown only gave me the option to power down or restart with upgrade. I didn't select either, and later a message popped up asking when it could do the upgrade... now or remind me later ... I am on the merry-go-round
So now I decide to shutdown... Now start menu only has a "power" button, no other choices. So, I expect windoze is lying and will upgrade when I go to power off. No choice as to whether I want the upgrade/fix or not.
Well, it certainly downloaded despite being on a metered wifi !!!
I turned off my wifi hotspot after which, the start menu shutdown changed again, to sleep, shutdown after installing updates, and restart after installing updates. I had no alternative but to shutdown with install. Took something like 15-30 minutes. Then powered on for some more install completion.
Really beginning to hate the fact that I bought the laptop, but MS "owns" it, and does what they want when they want to do it !!! I take second fiddle to MS when it comes to who gets to use the laptop.
FWIW just before Xmas, my wife's work laptop decided to do an update, and without any notice or permission, took over her laptop for 4 hours doing updates. She just had to waste those 4 hours.
Surely some smart lawyer can make MS responsible (and I absolutely hate lawyers)!
Well, it certainly downloaded despite being on a metered wifi !!!
I turned off my wifi hotspot after which, the start menu shutdown changed again, to sleep, shutdown after installing updates, and restart after installing updates. I had no alternative but to shutdown with install. Took something like 15-30 minutes. Then powered on for some more install completion.
Really beginning to hate the fact that I bought the laptop, but MS "owns" it, and does what they want when they want to do it !!! I take second fiddle to MS when it comes to who gets to use the laptop.
FWIW just before Xmas, my wife's work laptop decided to do an update, and without any notice or permission, took over her laptop for 4 hours doing updates. She just had to waste those 4 hours.
Surely some smart lawyer can make MS responsible (and I absolutely hate lawyers)!
Do you get the impression that I am really *****!
What can't you do in Linux that you can do in LoseDoze? (Please don't say OfficeXXX). Other than my old Protel 99SE which I can run in WINXP on VirtualBox there is hardly anything I need to have MS for. Even Netflix supports Chrome and Firefox in Linux on an old otherwise underpowered i3 laptop that is hooked up to the TV. In fact most people just use a browser, various readers and viewers, office software etc and all this and much more is included as standard in most Linux distros. I even run PNut under WIne without any problems and Quartus and other such programs runs exceedingly well.
I control the updates but most of those updates are the programs and the software is installed via the Software Manager so I don't have to go downloading and installing from dubious sites. I also have never ever run any system crippling anti-virus software which in itself is a virus of sorts. Using Linux Mint with the Cinnamon desktop manager and multiple workspaces it all just works, even the "windows" key comes up with a menu and includes automatic keyword searching.
Last time I used Windows was Windows 10 on my new XPS15 laptop at the time in 2016, but it wasn't long before I got very very annoyed with MS and upgraded to Linux. I have absolutely no regrets taking the plunge many years ago and the only regret I have is that I know we are all forced to subsidize MS every time we buy a laptop.
Comments
Back in the 70's, the mini I worked with was sold to two competing companies, on the basis they could share the mini while keeping their data secret between each other. This worked successfully until the mini was replaced.
Do you really think the same mini could reliably keep the data seperate? Most everyone believed so. Field Engineers and Programmers alike did not know how this could be breached. However I knew the mini completely, and I can tell you now that I could have breached the system. But to do so I would consider to be a crime, as I would consider disclosing information to do so would also be a crime (an enabling disclosure). I was not under any NDA back then either.
Returning to Intel, yes they should have plugged the vulnerability for subsequent silicon once discovered.
As for the reduced performance, it should not be a mandatory upgrade. The user should have the option.
This is quite different to the VW saga. In that case, VW deliberately "fixed" the testing to pass the tests, knowing full well that the car failed the actual requirements. The ultimate fix was mandatory, and the result was less performance than was sold to the purchaser. Hence, IMHO a case for class action.
As the version gets older, magically (presumed via updates) Windoze performance slows. Every new release that comes along, the older versions continue to get slower.
I don't think anyone has found any proof for this, but it's a result that I have seen often!
https://www.computerworld.com/article/3246028/microsoft-windows/win7-monthly-rollup-kb-4056894-signals-early-abbreviated-patch-tuesday.html
https://www.forbes.com/sites/thomasbrewster/2018/01/04/google-microsoft-apple-updates-for-meltdown-spectre-intel-processor-vulnerabilities/#5d1775775c31
Microsoft has released multiple advisories for both Windows machines and its Azure cloud.
Windows users can learn about the update from Microsoft here: https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892
Whilst a patch for Windows 10 is ready, other versions will be updated Patch Tuesday on January 9.
One source told Forbes out-of-support operating systems like Windows XP will not get the update.
They should be aware, however, that Microsoft is only making the updates available to those with compatible antivirus products. As Microsoft noted in a blog post: "The compatibility issue is caused when antivirus applications make unsupported calls into Windows kernel memory. These calls may cause stop errors (also known as blue screen errors) that make the device unable to boot." If users are running an incompatible antivirus, Microsoft recommended they get in touch with their AV vendor to determine what steps to take. Cybersecurity practitioner Kevin Beaumont has created a useful open list of those antivirus products that are compatible, along with details on plans from those who aren't.
I assume this refers to bios updates...
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html#FAQ
No there is no publicly available documentation on that micro-code.
Basically they had to implement a way to dynamically change the behavior of their chips because after the the FOOF bug and other errors they realized things were far too complex to get right first time and recalling millions of chips is expensive.
Strangely enough at this very moment I am halfway through watching this video: "34C3 - Everything you want to know about x86 microcode, but might have been afraid to ask"
Where they present their work on reverse engineering and hacking the x86 microcode. They have gleaned a lot about the microcode architecture.
Makes me think there are a lot more x86 vulnerabilities coming down the pipe!
Indeed the microcode is held in ROM. After all, the chip has to be bootable from cold and that requires non-volatile microcode.
But there is also some microcode RAM into which patches can be installed when your machine boots. By the BIOS or whatever boot loader or Linux etc.
And then there are those "match registers", also in RAM. Such that if a particular opcode and it's operands match some condition the microcode execution jumps out of the ROM to the patch in RAM.
Which is very convenient if you are a reverse engineer or hacker because you don't need to create an entire microcode image with your changes in it.
It also means that microcode patches can be installed that normally do nothing. Until the user of the machine visits a website that delivers some Javascript that just just happens to trigger the match condition with some magic 64 bit number as an operand. And boom, the javascript owns you!
So, the security of your machine depends on that chain of trust from Intel/AMD to the BIOS vendors to whatever website you download that BIOS update from!
A question asked at the end of the presentation was about totally changing the instruction set with a microcode patch. Seems to me that it's probably possible to totally reprogram an x86 to run an instruction set like RISC-V. After all it's only a hand full of simple instructions.
Which would be sweet. No need to fabricate high end RISC-V chips!
based on performance engineering, I'd doubt intel has anything close to 100% microcode coverage.
Someone has designed a microcoded x86 in FPGA, in under 500 LE, but it needs close to 20 sysclks per emulated opcode.
So yes, it is small but no, it is not fast.
That means intel chooses the rare, hardly used opcodes and targets those for microcode. Main program flows would not be microcoded.
Is there enough microcode installed to emulate RISC-V ? - perhaps, but it seems in loading RISC-V, you would break x86 compatible operation, and all that software would crash.
According to video presentation there are something like six instruction decoders. Only one of them is the microcode engine. The others are hardware decoders. No doubt for speed as you say. But there is a mechanism to bypass the hardware decode and get the work done by a microcode patch. This happens when an instruction matches something in those match registers.
This makes sense, the whole point of the microcode is to be able to work around errors in the hardware logic.
In short, any x86 instruction can be "repaired" with a microcode patch. I have no idea how much microcode space there is. The RISC-V instruction set is very small so we are in with a chance. Well yes. That is the whole point. Total instruction set replacement.
We can run Linux on a RISC-V machine. No need for all that x86 junk.
Here is another enlightening article about the bugs:
https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it/
Today despite my settings and being on a metered connection, windoze has tried to force me to upgrade windoze (10) to the latest revision so it can then upgrade the security patches.
After the message popped up, my start/shutdown only gave me the option to power down or restart with upgrade. I didn't select either, and later a message popped up asking when it could do the upgrade... now or remind me later ... I am on the merry-go-round
So now I decide to shutdown... Now start menu only has a "power" button, no other choices. So, I expect windoze is lying and will upgrade when I go to power off. No choice as to whether I want the upgrade/fix or not.
I turned off my wifi hotspot after which, the start menu shutdown changed again, to sleep, shutdown after installing updates, and restart after installing updates. I had no alternative but to shutdown with install. Took something like 15-30 minutes. Then powered on for some more install completion.
Really beginning to hate the fact that I bought the laptop, but MS "owns" it, and does what they want when they want to do it !!! I take second fiddle to MS when it comes to who gets to use the laptop.
FWIW just before Xmas, my wife's work laptop decided to do an update, and without any notice or permission, took over her laptop for 4 hours doing updates. She just had to waste those 4 hours.
Surely some smart lawyer can make MS responsible (and I absolutely hate lawyers)!
Do you get the impression that I am really *****!
What can't you do in Linux that you can do in LoseDoze? (Please don't say OfficeXXX). Other than my old Protel 99SE which I can run in WINXP on VirtualBox there is hardly anything I need to have MS for. Even Netflix supports Chrome and Firefox in Linux on an old otherwise underpowered i3 laptop that is hooked up to the TV. In fact most people just use a browser, various readers and viewers, office software etc and all this and much more is included as standard in most Linux distros. I even run PNut under WIne without any problems and Quartus and other such programs runs exceedingly well.
I control the updates but most of those updates are the programs and the software is installed via the Software Manager so I don't have to go downloading and installing from dubious sites. I also have never ever run any system crippling anti-virus software which in itself is a virus of sorts. Using Linux Mint with the Cinnamon desktop manager and multiple workspaces it all just works, even the "windows" key comes up with a menu and includes automatic keyword searching.
Last time I used Windows was Windows 10 on my new XPS15 laptop at the time in 2016, but it wasn't long before I got very very annoyed with MS and upgraded to Linux. I have absolutely no regrets taking the plunge many years ago and the only regret I have is that I know we are all forced to subsidize MS every time we buy a laptop.