Intel Blocked Collaboration On Spectre/Meltdown Fixes, Says Linux Kernel Developer (eweek.com) 83
This week in Vancouver, Linux kernel developer Greg Kroah-Hartman criticized Intel's slow initial response to the Spectre and Meltdown bugs in a talk at the Open Source Summit North America. An anonymous reader quotes eWeek:
Kroah-Hartman said that when Intel finally decided to tell Linux developers, the disclosure was siloed.... "Intel siloed SUSE, they siloed Red Hat, they siloed Canonical. They never told Oracle, and they wouldn't let us talk to each other." For an initial set of vulnerabilities, Kroah-Hartman said the different Linux vendors typically work together. However, in this case they ended up working on their own, and each came up with different solutions. "It really wasn't working, and a number of us kernel developers yelled at [Intel] and pleaded, and we finally got them to allow us to talk to each other the last week of December [2017]," he said. "All of our Christmas vacations were ruined. This was not good. Intel really messed up on this," Kroah-Hartman said...
"The majority of the world runs Debian or they run their own kernel," Kroah-Hartman said. "Debian was not allowed to be part of the disclosure, so the majority of the world was caught with their pants down, and that's not good." To Intel's credit, Kroah-Hartman said that after Linux kernel developers complained loudly to the company in December 2017 and into January 2018, it fixed its disclosure process for future Meltdown- and Spectre-related vulnerabilities... "Intel has gotten better at this," he said.
An interesting side effect of the Meltdown and Spectre vulnerabilities is that Linux and Windows developers are now working together, since both operating systems face similar risks from the CPU vulnerabilities. "Windows and Linux kernel developers now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," Kroah-Hartman said. "We are working well together. We have always wanted that."
"The majority of the world runs Debian or they run their own kernel," Kroah-Hartman said. "Debian was not allowed to be part of the disclosure, so the majority of the world was caught with their pants down, and that's not good." To Intel's credit, Kroah-Hartman said that after Linux kernel developers complained loudly to the company in December 2017 and into January 2018, it fixed its disclosure process for future Meltdown- and Spectre-related vulnerabilities... "Intel has gotten better at this," he said.
An interesting side effect of the Meltdown and Spectre vulnerabilities is that Linux and Windows developers are now working together, since both operating systems face similar risks from the CPU vulnerabilities. "Windows and Linux kernel developers now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," Kroah-Hartman said. "We are working well together. We have always wanted that."
To Intel's credit... (Score:2)
Re: (Score:3)
Re: (Score:2)
I read that as, "They have made improvements to paper over future vulnerabilities."
Re: (Score:1)
And I'll disregard anybody who uses ad hominem attacks and an appeal to authority rather than actual arguments.
If you are posting as Anonymous Coward, you aren't really in a position to criticize his pseudonym, either.
Re: (Score:2)
Improved does not equal fixed. .00000001% of a fix is an improvement over 0. It's also shit useless.
Re: (Score:1)
First "hardware" fixes are in Whiskey Lake (mobile) and Cascade Lake (Xeons) - https://www.techpowerup.com/img/ZBajKtbXMPCysTL5.jpg
And in the EPYC and Ryzen chips too.
In fact, just get those.
Re: (Score:1)
Yeah, every AMD-designed CPU doesn't speculate past a privilege check while Intel ones do, checking only when the speculative path is the correct one, but that's too late...
Re: (Score:2)
And my first thought was "I wonder what *amazing* new holes they've opened in those models.". I don't *know* that they've intentionally introduced new bugs...but their entire process in this last case (which they have "improved" on paper after the fact) causes me to doubt their intentions.
But perhaps AMD just hasn't been caught yet. Any chip that requires a "management engine" is dubious, even if you call it a "trust zone" or some such. It's a sign that they're trying to rent you the CPU rather than sell
Re: (Score:2)
Will a whole new architecture need to be designed?
Speaking as a layman in terms of processor engineering, it's more than a mask tweak but less than a new architecture. Given that Intel already has to tear up its entire 10nm fab line to fix the yield issues, this processor re-engineering will probably be done in parallel without delaying Ice Lake any more than it already is, but that is scant comfort. Intel already has hardware fixes [digitaltrends.com] for Whiskey Lake laptop processors. Chances are, Intel will just grin and bear it with their desktop and server parts. For th
Re: (Score:2)
Correction, Intel will provide hardware mitigation for Meltdown with its Cascade Lake 14nm parts announced last week without any details, including no release date more precise than "later this year." Benchmark wars with Epyc promise to be, well, epic.
Re: (Score:3)
To me, there appears to be very little, if anything, to Intel's credit in this whole CPU disaster. Performance instead of security.
Given that, when the news came out, their first (and second, and third) thought was to put Marketing in charge of any response... that was to be expected.
Re: (Score:3)
But officially that won't happen next time. Believe it if you want to. Certainly it's proper to trust Intel's honesty and care for users.
Broadly speaking, yes a different architecture (Score:3)
Intel can fix the specific Spectre-class vulnerabilities that have recently received a lot of attention, with some impact on performance. AMD wasn't vulnerable, and Intel can do something similar to what AMD did.
On the other hand, if you want to speak more broadly about issues like Meltdown and the various types of Spectre, AMD does have some vulnerabilities and is likely that EVERY high-performance CPU in the next five to ten years will have similar issues. Not precisely the same, but in the same general c
Re: (Score:2)
I have not encountered any trustworthy references to the effect that any company besides Intel had the Meltdown problem. Spectre, yes, to a small (I'm not sure how small) degree, but not Meltdown. And only some variants of Spectre.
Re: (Score:2)
Re: (Score:2)
ARM may license some technology from Intel, AMD licenses a lot by definition, but ARM has always had their own unique designs, governed from the very beginning by low power usage. Back then, it was so that they could use inexpensive plastic instead of ceramic packaging for their desktop computer target, they beat their target by a factor of two. That's one of the main reasons ARM chips now own the mobile market.
If your claim was true, it wouldn't explain why every other one of their earlier out-of-order d
Re: (Score:2)
Yes, but as another comment indicated, only the chips based on Intel designs had the Meltdown problem, so I still tend to think of it as an Intel defect. Were I considering purchasing an ARM, of course, the manufacturer would be more significant.
Since I'm not, to me that's still an Intel defect. Where you draw the line is, in a sense, arbitrary...or at least situational.
Re: (Score:2)
Could you point out the comment that indicated both ARM and IBM's RISC designs were "based" on Intel designs, I couldn't remember it, and I just reviewed the 0 or higher scored them and couldn't find one.
The fundamental design that's gotten everyone into trouble including AMD, which copied the Pentium Pro (just not the Meltdown part), goes back to IBM in 1967 [wikipedia.org] when they were creating the highest end System/36
Re: (Score:2)
Sorry, I didn't mean to include current IBM designs. I know nothing about them. Are you saying that they are vulnerable to Meltdown?
As for the 1967 design problem, I believe that's about when the problem was originally identified...though at the time the exploits were considered only theoretically possible, not actually possible. Still, that was when mitigation measures were first considered.
Re: (Score:3)
IBM says they've vulnerable to Meltdown [ibm.com]. And, hmmm, adding this item from them [ibm.com] it's much worse than the one new microarchitecture ARM discovered was vulnerable to a Meltdown variant, looks like POWER 7+, 8, and 9 processors, can't confirm if 7 is affected, but this is clearly pretty much all of their currently supported CPUs. The first item also implies problems, without mentioning Meltdown specifically, with POWER 4 through 6 CPUs. Ah, and following a link in that first one, per RedHat z/Architecture C [redhat.com]
Re: (Score:2)
Yi! I'm going to guess that IBM has some sort of technology sharing arrangement with Intel, but that's admittedly a guess. It's hard to believe that IBM would make that kind of tech goof on it's own.
Re: (Score:2)
Re: (Score:2)
Performance instead of security.
Time to brush up on old jokes? [twitter.com]
Re:To Intel's discredit... (Score:1)
Intel still ignores OpenBSD.
Re: (Score:1)
That's weird, since Microsoft invented the Blue Screen of Death.
Re: (Score:2)
Re: (Score:1)
*pacefalm*
Re: (Score:2)
Re: (Score:2)
To me, there appears to be very little, if anything, to Intel's credit in this whole CPU disaster.
There definitely is something to Intel's credit. Their CPUs were faster and the security issues are ultimately non-issues for the vast majority of users. The only reason I won't consider Intel at the moment ... AMD are currently the performance kings.
To Dahmer's credit... (Score:1)
To Jefrey Dahmer's credit, he stopped killing and eating people after he was caught, convicted and imprisoned.
Re: (Score:2)
But still no Be after 20 years? FAIL.
Re: (Score:2)
And being labeled a Troll for telling the truth is certainly going to encourage him to contribute in the future.
Is there any out-of-order with speculative execution architecture family out there that doesn't have these problems? IBM's z/Architecture?? No idea, and it's been a long since anyone bought an IBM mainframe for CPU power, but the modern out-of-order design was first developed for the System/360's supercomputer FPUs. Per my reading Wikipedia just now, of the non-dead ones, there were out-of-orde
Re: (Score:2)
I haven't seen the slightest bit of evidence that Intel "licenced" this sort of technology to anyone by AMD by definition, and the basic technology goes back to the 1960s and IBM [wikipedia.org], when it FRAND licensed all its patents due to a 1940s or very early 50s lawsuit settlement, that's one of the reasons their mag tape and mechanism designs became ubiquitous, as you can see in old movies. Of course by 1993-5 with others started doing out-of-order and at least in Intel's case speculative execution based on that IBM
Re: (Score:2)
poor intel (Score:1)
This week in Vancouver, Linux kernel developer Greg Kroah-Hartman criticized Intel's slow initial response to the Spectre and Meltdown bugs in a talk at the Open Source Summit North America. An anonymous reader quotes eWeek:
Be careful there, Intel is so inept they will likely mistake you calling them slow with calling their CPUs slow, and they will send their lawyers after you with claims of illegal benchmarks.
Jokes aside, never EVER sign an NDA with Intel. Tell them to get fucked, and go talking about them anyway.
You should also consider exempting them from any responsible security disclosures. We have.
Everything gets published immediately without waiting on a reply from Intel, and in fact we won't even bother informing Int
Re: Sad. For Linux users. (Score:1)
More likely to cost Intel, if anyone. How I'm supposed to buy Intel hw if it is poorly supported by the Linux OS I need to use in my servers?
Re: (Score:2)
There have indeed been times when Intel acted in ways that benefited the Linux community. Of course, they also benefitted Intel.
OTOH, have you ever heard the term "Wintel"? They've acted detrimentally about as much as they've acted beneficially, and arguably more. They've designed systems that intentionally shut Linux out of application. They've refused to publish interface specs that they shared with a different OS vendor. Etc.
The problem with trying to assign a position to the company is that it's no
Re: (Score:2)
There have indeed been times when Intel acted in ways that benefited the Linux community.
When was that? Every time Intel does Linux development, they tie it to their own processors. They killed Meego by turning it into Moblin, which was slightly about making a new OpenGLES-based interface and mostly about making it Intel-specific (wouldn't even boot on AMD systems.)
Don't worry, customers (Score:2)
Ok, so Intel landed on the shady side of the performance/security tradeoff. That probably kept CPU prices artificially high for you for a while because it helped their market position. But don't worry, soon you will be allowed to give them more money for new processors which are less vulnerable. I'm sure this is the right incentive to never let something like this happen again.
Also, how should they know their CPUs have so many problems? NOBODY knew, apart from some geeks who write papers nobody understands.