Wednesday, January 3rd 2018
AMD Struggles to Be Excluded from Unwarranted Intel VT Flaw Kernel Patches
Intel is secretly firefighting a major hardware security vulnerability affecting its entire x86 processor lineup. The hardware-level vulnerability allows unauthorized memory access between two virtual machines (VMs) running on a physical machine, due to Intel's flawed implementation of its hardware-level virtualization instruction sets. OS kernel-level software patches to mitigate this vulnerability, come at huge performance costs that strike at the very economics of choosing Intel processors in large-scale datacenters and cloud-computing providers, over processors from AMD. Ryzen, Opteron, and EPYC processors are inherently immune to this vulnerability, yet the kernel patches seem to impact performance of both AMD and Intel processors.
Close inspection of kernel patches reveal code that forces machines running all x86 processors, Intel or AMD, to be patched, regardless of the fact that AMD processors are immune. Older commits to the Linux kernel git, which should feature the line "if (c->x86_vendor != X86_VENDOR_AMD)" (condition that the processor should be flagged "X86_BUG_CPU_INSECURE" only if it's not an AMD processor), have been replaced with the line "/* Assume for now that ALL x86 CPUs are insecure */" with no further accepted commits in the past 10 days. This shows that AMD's requests are being turned down by Kernel developers. Their intentions are questionable in the wake of proof that AMD processors are immune, given that patched software inflicts performance penalties on both Intel and AMD processors creating a crony "level playing field," even if the latter doesn't warrant a patch. Ideally, AMD should push to be excluded from this patch, and offer to demonstrate the invulnerability of its processors to Intel's mess.
Source:
Phoronix Forums
Close inspection of kernel patches reveal code that forces machines running all x86 processors, Intel or AMD, to be patched, regardless of the fact that AMD processors are immune. Older commits to the Linux kernel git, which should feature the line "if (c->x86_vendor != X86_VENDOR_AMD)" (condition that the processor should be flagged "X86_BUG_CPU_INSECURE" only if it's not an AMD processor), have been replaced with the line "/* Assume for now that ALL x86 CPUs are insecure */" with no further accepted commits in the past 10 days. This shows that AMD's requests are being turned down by Kernel developers. Their intentions are questionable in the wake of proof that AMD processors are immune, given that patched software inflicts performance penalties on both Intel and AMD processors creating a crony "level playing field," even if the latter doesn't warrant a patch. Ideally, AMD should push to be excluded from this patch, and offer to demonstrate the invulnerability of its processors to Intel's mess.
142 Comments on AMD Struggles to Be Excluded from Unwarranted Intel VT Flaw Kernel Patches
In fact most PC owners don't look at reviews, nor would they understand them. Even many gamers don't.
Yes, this is an important issue, but many of you are overestimating it's importance for the whole market.
I mean: isn't the main argument of Intel critics that they only provide 5% with each generation? That it's nothing, marginal, irrelevant? That Kaby Lake is just a revamped Haswell or something?
So now we have a CPU design flaw that, on average, moves us a generation back. Why is it suddenly such a deal for the same people? :)
I like the +5% yearly, so I should be pissed off when it's taken away from me. And I might be, but I'm waiting for the patch. We'll see what it does to my PC. Possibly (hopefully) not much. Of course it's a serious flaw, But there is a difference between 5% and 30% - all I'm saying. If it's 5%, most people won't even notice.
BTW:
Bullseye on auto-update. I have nothing against it. Actually, since I moved to W10 on all my PCs, I stopped worrying about the updates, I stopped reading their descriptions and so on. It saves a lot of time. You're thinking less about technical issues and more about actual problems. It's like moving from C++ to C# (although C++ evolved anyway).
Think about how incoherent people are. Almost no one cares about how a new OS version differs from the previous one. Yet, so many people freak out about updates.
I know it slightly harms your ego, because you're "an enthusiast", you want to have control over your PC and so on. But productivity-wise, it really saves a lot of time. I'm trusting a 3rd party cleaning company with my suits, so why would I not trust Microsoft or Intel with my PC? :) No, it will affect all PCs. But the issue itself is more severe on servers. (security-wise).
But here's some consolation, in case you worry too much. Performance of your desktop is compromised by server-specific needs anyway. It's been like that since the architectures were unified. :)
Performance is not the most important issue in datacenters. So yes, 5% is a bummer, but it's also not the end of the world. People will still buy Xeons. It's just that Intel may be forced to lower prices a bit to a more adequate level. No one said it doesn't suck. And BTW: from what I've seen it's at least up to 50%. So if you want to use an extreme case, do it properly. :-)
But on the other hand, fixing this will generate some costs in large datacenters and this is something with a lawsuit potential - but only for companies that still use flawed CPUs, not all that had since 2007. That's some wicked math going on. How did you estimate this? :-D
The Jig is up, just give up dude.
Though i'm now more familiar with Linux, this sort of thing is still out of my reach. They better well be. When that happens, i'd demand a nice compensation, if i were in AMD's shoes!
It will cost them millions of that's the case, lol.
I'm more interested in how old(er) OS' can be affected by it, if so then Intel's really effed o_O
Since this is a security issue, most supercomputers will be perfectly safe. Admins will simply ignore this patch. Linux kernels in supercomputers are highly customized anyway.
This is an issue for datacenters.
What I meant is that you'd have to use a faulty CPU at the moment, not just have owned it in the past. So it's not about all CPUs made since 2007. You won't be able to sue Intel for a CPU that you've thrown away, because you haven't lost anything. Please don't tempt me...
I think they should be required to replace all of those parts corps bought recently and pull all affected parts from markets till the flaws are eliminated, on top of that give discounts to users of oldest parts towards system upgrades to parts without flaws and close up all backdoors. Release said patch for intel only temporarily and not force it on everyone.
I think this is a part of the reason why Intel switched CEOs recently Yup
lkml.org/lkml/2017/12/27/2