Intel Released "Coffee Lake" Knowing it Was Vulnerable to Spectre and Meltdown

[efikkan]

Speculation "If this didn't reach the public would the public know after they resolved it"?

Intel regularly updates their errata, just look at this long list for skylake.
A lot of small bugs are normal for CPUs, if they fixed it "silently", nobody would have noticed it in the list.

 

[GreiverBlade]

Why do I have a feeling that things are blowing out of proportions again...

actually it's refreshing ....

usually it's ...
"oh it's Intel, no biggies, we can forgive them"
"what? AMD has a bug in their CPU? BURN DOWN THE WITCHE!"

actually considering financial disparities between these two ... i consider Intel blunder to be unforgivable

 

[David Fallaha]

Thank god I still have an atom n450 netbook

Anyway...
There would be no point in halting the release of coffee lake, especially when ES/QS cpus are being provided, and all partners already have working prototypes of new platform.

Er excuse me? Then announce the flaw then try selling it, or don't sell it at all. What planet do you come from?

 

[R0H1T]

Er excuse me? Then announce the flaw then try selling it, or don't sell it at all. What planet do you come from?

Would definitely love to know how many would raise their hands knowing Intel chips had a meltdown bug, with a fix probably six months away? Pretty sure the loss in sales would be in the tens of billions, with a capital B, as it stands right now they might get away with just a slap on the wrist - like the last so many times! In fact their server sales would also be devastated, I'd say Google saved them anywhere between 10 to 30 billion in lost sales over the last 6 months.

 

[lexluthermiester]

Er excuse me? Then announce the flaw then try selling it, or don't sell it at all. What planet do you come from?

It's called capitalism. Welcome to planet Earth.

Would definitely love to know how many would raise their hands knowing Intel chips had a meltdown vulnerability

Fixed that for you. The difference is that the CPU's in question operate perfectly, so not a bug. But the fact that software can be made to take advantage of a CPU's normal functionality in a malicious way is a vulnerability. And it's likely the same number of people who would buy anything else that has/had a known problem, like iPhones with their battery problems and Windows for example.

 

[R0H1T]

It's called capitalism. Welcome to planet Earth.

Fixed that for you. The difference is that the CPU's in question operate perfectly, so not a bug. But the fact that software can be made to take advantage of a CPU's normal functionality in a malicious way is a vulnerability. And it's likely the same number of people who would buy anything else that has/had a known problem, like iPhones with their battery problems and Windows for example.

Both spectre & meltdown are vulnerabilities, except AMD doesn't need a meltdown fix because it doesn't allow a rogue data cache load in the way Intel does. Hence the bug(gy) part wrt Intel.

This isn't true for meltdown as can be seen with AMD chips right now.

 

[lexluthermiester]

Both Spectre & Meltdown are vulnerabilities

True.

except AMD doesn't need a meltdown fix because it doesn't allow a rogue data cache load in the way Intel does.

Actually, that is an incorrect conclusion.

Hence the bug(gy) part wrt Intel.

Meltdown is a vulnerability. A vulnerability is not "bug", nor a flaw, nor a defect of design. You are mixing up and confusing proper terminology.

This isn't true for meltdown as can be seen with AMD chips right now.

My information and understanding comes from the people who discovered the problems, have been researching and documenting it.
https://meltdownattack.com/
That website is one they created to publish the information for everyone to read. According to them and the documentation they have provided, your conclusions are incorrect.

 

[R0H1T]

Actually, that is an incorrect conclusion.

How so?

Meltdown is a vulnerability. A vulnerability is not "bug", nor a flaw, nor a defect of design. You are mixing up and confusing proper terminology.

Am I? Intel chips allow user apps to read data from the kernel memory but AMD does not, so how is that not a bug or defective design?

My information and understanding comes from the people who discovered the problems, have been researching and documenting it.
https://meltdownattack.com/
That website is one they created to publish the information for everyone to read. According to them and the documentation they have provided, your conclusions are incorrect.

I've read everything from Ars, AMD, project zero, the register & no where does it say that meltdown was a feature of OoO chips. The unintended feature you're talking is speculative branching i.e. spectre.

Spoiler

On Wed, Jan 3, 2018 at 3:09 PM, Andi Kleen <andi@firstfloor.org> wrote:
> This is a fix for Variant 2 in
> https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
>
> Any speculative indirect calls in the kernel can be tricked
> to execute any kernel code, which may allow side channel
> attacks that can leak arbitrary kernel data.

Why is this all done without any configuration options?

A *competent* CPU engineer would fix this by making sure speculation
doesn't happen across protection domains. Maybe even a L1 I$ that is
keyed by CPL.

I think somebody inside of Intel needs to really take a long hard look
at their CPU's, and actually admit that they have issues instead of
writing PR blurbs that say that everything works as designed.

.. and that really means that all these mitigation patches should be
written with "not all CPU's are crap" in mind.

Or is Intel basically saying "we are committed to selling you shit
forever and ever, and never fixing anything"?

Because if that's the case, maybe we should start looking towards the
ARM64 people more.

Please talk to management. Because I really see exactly two possibibilities:

- Intel never intends to fix anything

OR

- these workarounds should have a way to disable them.

Which of the two is it?

Linus

 

[I No]

And again things are getting blown out of proportion .... give it a rest .... not even the involved parties aren't making such a big fuss out of this

 

[goodeedidid]

Ouch another one, not good at all

Ouch what, don't be silly. What the whole industry should stop working because of a bug? Do you commit suicide when you cough once?

 

[eidairaman1]

Ouch what, don't be silly. What the whole industry should stop working because of a bug? Do you commit suicide when you cough once?

Intel launched serveral products that had this architecture flaw and they knew about it. That is criminal period. This will impact their wallets across the board.

By the way welcome to my ignore list.

 

[HammerON]

Ouch what, don't be silly. What the whole industry should stop working because of a bug? Do you commit suicide when you cough once?

Not the best analogy there. You can get your point across without using such an analogy. Sometimes it is okay to agree to disagree and then move on. Do so in this case.

 

[Berfs1]

Similarly to the GTX 970 incident, Intel needs to partially reimburse the customer of these CPUs, as it affects the performance now.

 

[64K]

Similarly to the GTX 970 incident, Intel needs to partially reimburse the customer of these CPUs, as it affects the performance now.

Not really similar to the 970 though. The 970 performed exactly the same in reviews before and after the the deception by Nvidia was made known.

In this case we have CPUs that don't perform exactly the same as before and after the news broke of it's security vulnerabilities and the patch and the potential risks on down the road. At least thus far.

 

[eidairaman1]

Not really similar to the 970 though. The 970 performed exactly the same in reviews before and after the the deception by Nvidia was made known.

In this case we have CPUs that don't perform exactly the same as before and after the news broke of it's security vulnerabilities and the patch and the potential risks on down the road. At least thus far.

Considering that card was falsely advertised as having 4 gigs when in fact it only had 3.5

 

[64K]

It did have 4 GB VRAM and you probably noticed that Nvidia continued to advertise it as a 4 GB card even after the class action lawsuit was settled out of court. Where Nvidia deceived, and eventually paid up for with $30 rebates per card, is in failing to disclose that the last .5 GB VRAM ran 7 times slower that the rest of VRAM. But, in any case, what Intel has done is a bit more far reaching in consequences imo. We'll see.

 

[eidairaman1]

It did have 4 GB VRAM and you probably noticed that Nvidia continued to advertise it as a 4 GB card even after the class action lawsuit was settled out of court. Where Nvidia deceived, and eventually paid up for with $30 rebates per card, is in failing to disclose that the last .5 GB VRAM ran 7 times slower that the rest of VRAM. But, in any case, what Intel has done is a bit more far reaching in consequences imo. We'll see.

I see legal suits in their future

 

[xorbe]

Similarly to the GTX 970 incident, Intel needs to partially reimburse the customer of these CPUs, as it affects the performance now.

Technically, it's the OS that slowed down ...

 

[lexluthermiester]

Technically, it's the OS that slowed down ...

It was more than the OS. In games, whenever that last 512mb of VRAM were accessed the game itself would stutter and chug. Never understood why and thought it was a driver problem until after the info went public. But it was an unpleasantness for sure. I will not touch that card because of the inconsistent performance. It would literally have been better to release the card with only 3.5GB of ram.

 

[evernessince]

It is OK to blame Intel for releasing Meltdown-vulnerable processors. But since it can be solved with Linux KPTI and Windows kernel rework, and Intel did finish those work with Linux team and Microsoft in time, it's kinda less unacceptable.

But hell no, you can’t blame Intel for Spectre vulnerability. It affects ALL modern processors with speculative execution and is simply impossible to fix (unless every app developer cooperates). The only way we currently know is to drop speculative execution and get back to stone age (80x86). We need another breakthrough in computer science in the following years to fix it.

It's not in any way acceptable. They released a product they knew would take a performance hit and would get bad publicity during the holiday season to reap maximum sales before customers could realize what was up. That's not even the full picture either, we are getting reports of 8000 series processors getting up to 30% less performance on lower end motherboards. It definitely looks like Intel essentially released these processors with only their top end motherboards and super lower base clocks because they knew people would buy based off reviews, regardless of whether or not they are actually getting that performance on their lower end motherboards.

The last 2 years for Intel have been nothing but shit from the thin PCB of skylake bending, to their shitty TIM, to IME issues, and now this (the biggest of them all). I know this list is missing allot but people get the point.

It did have 4 GB VRAM and you probably noticed that Nvidia continued to advertise it as a 4 GB card even after the class action lawsuit was settled out of court. Where Nvidia deceived, and eventually paid up for with $30 rebates per card, is in failing to disclose that the last .5 GB VRAM ran 7 times slower that the rest of VRAM. But, in any case, what Intel has done is a bit more far reaching in consequences imo. We'll see.

In most cases, Companies are not required to admit fault, merely they are required to pay money. It's shitty but it's the way the system works. Companies are granted far more rights and power than individuals.

It's called capitalism. Welcome to planet Earth.

Fixed that for you. The difference is that the CPU's in question operate perfectly, so not a bug. But the fact that software can be made to take advantage of a CPU's normal functionality in a malicious way is a vulnerability. And it's likely the same number of people who would buy anything else that has/had a known problem, like iPhones with their battery problems and Windows for example.

Well, when you say it like that you make it sounds like one of the most horrible economic systems out there. Granted, we are definitely seeing how bad unmitigated capitalism can really be.

 

[I No]

It's not in any way acceptable. They released a product they knew would take a performance hit and would get bad publicity during the holiday season to reap maximum sales before customers could realize what was up. That's not even the full picture either, we are getting reports of 8000 series processors getting up to 30% less performance on lower end motherboards. It definitely looks like Intel essentially released these processors with only their top end motherboards and super lower base clocks because they knew people would buy based off reviews, regardless of whether or not they are actually getting that performance on their lower end motherboards.

Giving the circumstances you would've done the same thing. Let's see ... Coffee Lake is built upon Kaby Lake which is built upon Skylake and the list goes on, they share the same arch. Now Intel would have to scrap the whole arch and send it back to the drawing board thus sending the arch back into development stages... that would be what 6-8 months? Also there are contracts and deadlines that they need to deliver that would not only mean an impact on sales but also would result in the company owing money to 3rd parties for a deadline breach. Would you put the company in a more awkward position than it already is? Bad publicity can be mitigated while shipping out trucks worth of money for contract breaches cannot. You're making this sound like they didn't intend to fix anything regarding both Meltdown and Specter although the public statement was due today. The only reason this is news is because someone decided to blow the horn early otherwise the statement given today would be "we had some vulnerabilities and they've been patched" .
It's not Intel's motherboards, it's Intel's chipset granted, the rest is handled by AIB's, last time I checked Intel wasn't in charge of that. Furthermore would you get a 8700k and stick it on a $20 MB?.
Any company out there would've done the same thing in Intel's position and if the Data Centers can live with it I'm betting so can the average user who won't notice the difference. If Intel cocked-up which they did they will pay there's no way around that. Mind posting the links to those 30% less performance benches? Asking out of sheer curiosity.

The last 2 years for Intel have been nothing but shit from the thin PCB of skylake bending, to their shitty TIM, to IME issues, and now this (the biggest of them all). I know this list is missing allot but people get the point.

Skylake sold, Kaby sold, Coffee sold. If a product is inferior by any means in your opinion you have other options which now you do: Ryzen. The only one responsible for Intel's tight grip on the market is whom? If the answer is the lack of competition you are right and I'm not sure if Intel is worried about AMD at this point either since they still control the enterprise segment and they will as long as contracts are still running.
The rest is politics which I won't get into.

 

[eidairaman1]

Giving the circumstances you would've done the same thing. Let's see ... Coffee Lake is built upon Kaby Lake which is built upon Skylake and the list goes on, they share the same arch. Now Intel would have to scrap the whole arch and send it back to the drawing board thus sending the arch back into development stages... that would be what 6-8 months? Also there are contracts and deadlines that they need to deliver that would not only mean an impact on sales but also would result in the company owing money to 3rd parties for a deadline breach. Would you put the company in a more awkward position than it already is? Bad publicity can be mitigated while shipping out trucks worth of money for contract breaches cannot. You're making this sound like they didn't intend to fix anything regarding both Meltdown and Specter although the public statement was due today. The only reason this is news is because someone decided to blow the horn early otherwise the statement given today would be "we had some vulnerabilities and they've been patched" .
It's not Intel's motherboards, it's Intel's chipset granted, the rest is handled by AIB's, last time I checked Intel wasn't in charge of that. Furthermore would you get a 8700k and stick it on a $20 MB?.
Any company out there would've done the same thing in Intel's position and if the Data Centers can live with it I'm betting so can the average user who won't notice the difference. If Intel cocked-up which they did they will pay there's no way around that. Mind posting the links to those 30% less performance benches? Asking out of sheer curiosity.



Skylake sold, Kaby sold, Coffee sold. If a product is inferior by any means in your opinion you have other options which now you do: Ryzen. The only one responsible for Intel's tight grip on the market is whom? If the answer is the lack of competition you are right and I'm not sure if Intel is worried about AMD at this point either since they still control the enterprise segment and they will as long as contracts are still running.
The rest is politics which I won't get into.

Well it put them in an even more awkward position because of multiple security breaches in the architecture, they were not upfront about it but tried hiding it.

 

[trparky]

The last 2 years for Intel have been nothing but shit from the thin PCB of skylake bending, to their shitty TIM, to IME issues, and now this (the biggest of them all). I know this list is missing allot but people get the point.

Don't get me started on that crap. All of these issues and yet we still have people around here defending Intel and going so far as to still recommend people to buy their processors. Where is the hate for Intel? Where is the kind of hate that everyone loves to spew in Microsoft's direction? Oh yeah... I forgot. *crickets*

 

[lexluthermiester]

they were not upfront about it but tried hiding it.

Rubbish. The release of information was done in a responsible and coordinated way working with the researchers. They had no intention of hiding anything.
EDIT sorry for the late response, didn't see it earlier..

 

[eidairaman1]

Rubbish. The release of information was done in a responsible and coordinated way working with the researchers. They had no intention of hiding anything.
EDIT sorry for the late response, didn't see it earlier..

Ok

Rubbish. The release of information was done in a responsible and coordinated way working with the researchers. They had no intention of hiding anything.
EDIT sorry for the late response, didn't see it earlier..

For it to date back as far as it has that is pretty serious and they were hiding it