Part numbers of CPU's without the meltdown and spectre bugs?

[AdamK47]

Some may think this is just Intel defending themselves, but I do think they are correct in their response.

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.

 

[richaron]

Some may think this is just Intel defending themselves, but I do think they are correct in their response.

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

Sure they are correct. They would also be correct in saying:

Intel CPUs are the only desktop and datacentre CPUs affected by an exploit which needs to be fixed in software. This software fix causes up to 30% decrease in performance.

 

[maddie]

Did you read how they are fixing the chips?

"Intel also is fixing the problem in future chips, starting with products that will arrive later this year, Smith said. Intel is effectively taking the software fixes being released now and building them directly into hardware, he said."

Designing a safe version of speculative execution that is as fast and aggressive as it is now might take years, but no imaginary bridges are required to hack in some cache clearing.

I was responding to a very specific post as shown below, not in general, so please follow the order of posts that led to mine.

Quote:
"Intel says the issue has already been fixed in hardware.
Possibly this is the reason 10nm was delayed so long?"

I am starting to get the impression that there is beginning an effort in trying to suppress negative views on Intel and it's handling of this problem.

 

[LTC8K6]

I was responding to a very specific post as shown below, not in general, so please follow the order of posts that led to mine.

Quote:
"Intel says the issue has already been fixed in hardware.
Possibly this is the reason 10nm was delayed so long?"

I am starting to get the impression that there is beginning an effort in trying to suppress negative views on Intel and it's handling of this problem.

What could Intel have done about chips that have been exploited while working as intended and designed, other than work on patches?

 

[richaron]

What could Intel have done about chips that have been exploited while working as intended and designed, other than work on patches?

(Bold added by me)

As I said before.

...Intel CPUs have a bug.

The architecture is designed so it doesn't allow lower level processes to access privileged data. Intel put lots of time and effort and silicone into not allowing lower level processes to access privileged data. And everyone thought they achieved their design goals. But they missed something which resulted in an exploit:

Therefore intel CPUs have a bug.

It should be obvious intel CPUs are not working as designed or intended. They were intended and designed to not allow lower level processes to access privileged data. They missed something and that means the CPUs have a bug.

I'm sorry to have to keep saying this over and over. But I don't understand why so many people are defending this bug.

 

[DaveSimmons]

To me this is more like an advance in encryption breaking that renders a formerly secure algorithm or key length insecure. The design was secure at the time it was implemented, then researchers came up with a new line of attack, like with the Row Hammer exploit for RAM.

It wasn't a weakness that could be reasonably foreseen without hindsight, or a coding bug like a buffer overrun. But if you want to call it a bug, fine. This new kind of attack does compromise security, and it does expose a weakness in the design.

 

[richaron]

To me this is more like an advance in encryption breaking that renders a formerly secure algorithm or key length insecure. The design was secure at the time it was implemented, then researchers came up with a new line of attack, like with the Row Hammer exploit for RAM.

I would supply another reasoning.

If the old "formerly secure algorithm or key length" was broken it means the former system had a bug. It had a bug because it was without a doubt designed to be secure, but the designers missed something which made it insecure. The fact it took some time to work it out has no effect on whether the initial design has a bug, since the initial design allows an action it was specifically designed and intended not to allow.

Same thing with intel CPUs; They were intended and designed to not allow lower level processes to access privileged data. But intel missed something and they ended up with a bug in their CPU.

 

[LTC8K6]

(Bold added by me)

As I said before.

It should be obvious intel CPUs are not working as designed or intended. They were intended and designed to not allow lower level processes to access privileged data. They missed something and that means the CPUs have a bug.

I'm sorry to have to keep saying this over and over. But I don't understand why so many people are defending this bug.

Sorry, I just don't see it that way at all. There's nothing wrong with the chips, imo. There is also no real worry for home users.

 

[DaveSimmons]

I would supply another reasoning.

If the old "formerly secure algorithm or key length" was broken it means the former system had a bug. It had a bug because it was without a doubt designed to be secure, but the designers missed something which made it insecure. The fact it took some time to work it out has no effect on whether the initial design has a bug, since the initial design allows an action it was specifically designed and intended not to allow.

Same thing with intel CPUs; They were intended and designed to not allow lower level processes to access privileged data. But intel missed something and they ended up with a bug in their CPU.

So AMD and ARM designs also have bugs? Then apparently no one knows how to design a modern "bug-free" CPU, at least one that will remain "bug-free" for a decade after release.

That's actually a valid viewpoint. It's considered a truism that all software programs of significant size contain bugs. The hope in releasing the programs is that the bugs are not significant enough to outweigh the usefulness of the program.

in other words, nothing in life is 100% perfect.

 

[richaron]

Sorry, I just don't see it that way at all. There's nothing wrong with the chips, imo. There is also no real worry for home users.

Sure... If someone designs a program which is intended to perform a loop 10 times, but they accidently write "<10" rather than "=10" in their code so it only really runs 9 times will you will also defend it?

The code is designed to do something, but doesn't do what it's intended to do. It does in fact compile and run so I can legitimately argue it "runs as intended" i.e. I can argue the code is doing what it's supposed to (like many here). At the same time the program also obviously has a bug.

Same thing here and by the same reasoning intel CPUs also have a bug in hardware. They simply don't function as designed or intended because intel made a mistake.

 

[Topweasel]

I'd like to point out this is wrong. Intel CPUs have a bug.

The architecture is designed so it doesn't allow lower level processes to access privileged data. Intel put lots of time and effort and silicone into not allowing lower level processes to access privileged data. And everyone thought they achieved their design goals. But they missed something which resulted in an exploit:

Therefore intel CPUs have a bug.

The problem is people lumping Spectre and Meltdown into the same bin.

Spectre as an exploit targets a particular architectural decision (OoO, speculative processing). Which isn't a bug, is a general security issue that needs to be resolved.

Meltdown is an exploit that targets a specific bug or design deficit on Intel processors. Intel CPU's are not doing what they are supposed to be doing and Meltdown takes advantage of that.

Both of these exploits use the same design work to penetrate information that they should not be privy to, but only meltdown works because a CPU isn't doing what it is supposed to do.

 

[Topweasel]

In any case how many of us are actually even affected by this anyway? Maybe it is just too soon to tell right now.

If you work in IT everybody. If you don't, almost nobody.

The biggest issue for normal users isn't the security flaw, it is the fix. Certain desktop single user use cases will see performance decreases due to the patches that clears up the security issues. That is the effect.

The biggest scale of people affected are the Cloud Services companies like Amazon and Microsoft. They both are hit with the security flaw that is very important for them to clear up (as the information that can be gleaned is very sensitive to their use case). Then they are hit with the largest of the performance penalties.

 

[LTC8K6]

Sure... If someone designs a program which is intended to perform a loop 10 times, but they accidently write "<10" rather than "=10" in their code so it only really runs 9 times will you will also defend it?

The code is designed to do something, but doesn't do what it's intended to do. It does in fact compile and run so I can legitimately argue it "runs as intended" i.e. I can argue the code is doing what it's supposed to (like many here). At the same time the program also obviously has a bug.

Same thing here and by the same reasoning intel CPUs also have a bug in hardware. They simply don't function as designed or intended because intel made a mistake.

You just said it was intended to do the loop 10 times...and it isn't doing the loop 10 times...
A program can be rewritten.
Hardware can't.

Not sure where your argument is going.

I'm confident that the problem is mostly non-existent for me and my Haswell/AMD FX home systems.
I'm glad I did not build anything newer.

I'm confident that Intel will satisfy it's big customers and they will stay with Intel.

Intel has stated that the problem has already been fixed in hardware in the chips that will come out later this year. If that doesn't happen, that will be very interesting.

 

[Topweasel]

You just said it was intended to do the loop 10 times...and it isn't doing the loop 10 times...
A program can be rewritten.
Hardware can't.

Not sure where your argument is going.
.

This isn't a winnable discussion from either side. But he is on point. When it comes to Meltdown that exploit explicitly works because a CPU isn't doing what it supposed to be doing. That is a bug. Like the pentium bug before, not some randomly throw things at it till it errors out bug, but a functionality of the CPU not working like it is supposed and because of that the error is easily repeatable. Unlike the Pentium bug it's its easily repeatable circumstance of not doing what it is supposed to do that makes it vulnerable to exploitation.

 

[LTC8K6]

This isn't a winnable discussion from either side. But he is on point. When it comes to Meltdown that exploit explicitly works because a CPU isn't doing what it supposed to be doing. That is a bug. Like the pentium bug before, not some randomly throw things at it till it errors out bug, but a functionality of the CPU not working like it is supposed and because of that the error is easily repeatable. Unlike the Pentium bug it's its easily repeatable circumstance of not doing what it is supposed to do that makes it vulnerable to exploitation.

It's likely that we will hear about more of this type of problem in the future. There are likely more such exploits out there waiting to be made public.

 

[Topweasel]

It's likely that we will hear about more of this type of problem in the future. There are likely more such exploits out there waiting to be made public.

Agreed. That wasn't a pile on Intel post. Just more of a clarification post. Meltdown doesn't exist if the CPU was doing what it was supposed to do. Spectre on the other hand would, because it is a problem with an architectural philosophy.

 

[LTC8K6]

Heck, I wish BK had sold all of his stock long ago and left...

 

[Snowleopard3000]

Allot of good discussion here even though it moved away from part numbers for CPU's that are not affected by this "design" whether the CPU is working as designed or not, but allowing exploits.

I guess I want to know what systems explicitly do not have this issue? If it means going back to my Mac Plus with 2 floppy drives and a Motorola Processor; Or it means going back to a Power PC? or an Intel itanium, or god forbid a Sparc Station or a Dec Alpha workstation or an SGI indigo2.

Intel, AMD and Arm are not the only companies out there with CPU's.

I could have allot of fun with half a dozen Sparc Stations....

 

[DaveSimmons]

Allot of good discussion here even though it moved away from part numbers for CPU's that are not affected by this "design" whether the CPU is working as designed or not, but allowing exploits.

I guess I want to know what systems explicitly do not have this issue? If it means going back to my Mac Plus with 2 floppy drives and a Motorola Processor; Or it means going back to a Power PC? or an Intel itanium, or god forbid a Sparc Station or a Dec Alpha workstation or an SGI indigo2.

Intel, AMD and Arm are not the only companies out there with CPU's.

I could have allot of fun with half a dozen Sparc Stations....

Or just install the OS software updates, be safe, forget about it.

I'm still trying to understand why you'd rather try to do your work on a "safe" Pentium 133 MHz instead of an equally safe (thanks to software patches) Coffee Lake i7-8700 with 6 cores at up to 4.5 GHz. Can you explain?

(Though the Micron P133 MHz system I bought back in 1995 was rather nice: https://forums.anandtech.com/threads/nostalgia-my-4-168-micron-pc-1995.2513823/ )

 

[Topweasel]

Allot of good discussion here even though it moved away from part numbers for CPU's that are not affected by this "design" whether the CPU is working as designed or not, but allowing exploits.

I guess I want to know what systems explicitly do not have this issue? If it means going back to my Mac Plus with 2 floppy drives and a Motorola Processor; Or it means going back to a Power PC? or an Intel itanium, or god forbid a Sparc Station or a Dec Alpha workstation or an SGI indigo2.

Intel, AMD and Arm are not the only companies out there with CPU's.

I could have allot of fun with half a dozen Sparc Stations....

Because the question is obtuse and doesn't paint a picture of what you want to accomplish. If it is a paranoid "What can I run that won't have this security flaw", then the Pentium MMX or Itanium. Every other CPU including a Sparc, Alpha (as a lot of their CPU design went into the Athlon, even the SGI (but not the Cray Supercomputers), Power PC and so on has this security flaw. Basically anything from 97 on and like I mentioned with some of the small market stuff even before that. It's not even really a security flaw. OoO execution with multiple pipelines, is an important part of CPU development and it's process's like that, that are going to take us into the next stage of CPU's. So almost 20 years after implementation someone found a way that it can be exploited. Besides the potential on all but Meltdown, the actual abuse is very limited and while the repercussions about finding the exploit might last for years, the security risk now is pretty minimal. Cept for Meltdown. Even with Meltdown the potential for security risks is quite limited as even worse case scenario on a desktop the potential the data that can be accessed is only really of use of use on the computer, which means physical access which means you have already been compromised. The only situations that are at any real risk is on servers, specifically VM's, and specifically VM servers that are hosting VM's with users with administrative access that are also hosting other people's or sensitive servers. So Cloud server organizations or large corporations with VM farms that give employee's development VM's.

So if this is about avoiding CPU's that will possibly see a large hit on performance. Stay away from Intel x86 computers that running an Windows 7 or newer. OSX or any recent Linux Kernel. Those will be patched for Meltdown and some Spectre like attacks and the Meltdown patches are the ones that you will lose performance in (which can't really be measured at this point but most consumer use cases should see a minimal hit).

Or do the sane thing. Get a modern CPU. Understand that Ryzen for example isn't susceptible to Meltdown. So get that if you want to avoid the big issue which is a bad bug in Intel CPU's. Or get a Coffee Lake and understand that even after the patches and knowing that it has the rights bug, that it will still be pretty much the fastest consumer processor.

But more power to you if you are comfortable running Windows 95 on a Pentium MMX.

 

[LTC8K6]

Allot of good discussion here even though it moved away from part numbers for CPU's that are not affected by this "design" whether the CPU is working as designed or not, but allowing exploits.

I guess I want to know what systems explicitly do not have this issue? If it means going back to my Mac Plus with 2 floppy drives and a Motorola Processor; Or it means going back to a Power PC? or an Intel itanium, or god forbid a Sparc Station or a Dec Alpha workstation or an SGI indigo2.

Intel, AMD and Arm are not the only companies out there with CPU's.

I could have allot of fun with half a dozen Sparc Stations....

You are overthinking, imo.

Either just buy a new system now and make sure it's patched, if you need a new system now, or just wait a few months and see what develops.

It makes no sense whatsoever to talk about buying ancient hardware.

Besides, every system has vulnerabilities. You can't buy a system without vulnerabilities.

New vulnerabilities are being discovered all the time, and dealt with by patches.

 

[richaron]

You just said it was intended to do the loop 10 times...and it isn't doing the loop 10 times...
A program can be rewritten.
Hardware can't.

Not sure where your argument is going.

Where I was going is that even though my program compiles properly and runs, it is stupid to say the program runs as designed. Sure it compiles fine, so no obvious logic or syntax is buggy - but this doesn't mean it works as designed because the intention was to do 10 loops. Not 9.

Same with these buggy intel CPUs. Sure they were manufactured without issues and turn on, but it's equally as stupid to pretend they run as designed. Because they were designed such that they don't allow lower level processes to access privileged data.

Get the analogy? The program is made to run a loop 10 times but has a bug so it only loops 9 times. The intel CPU is designed to separate privileged data and does that in a lot of ways but has a bug so it doesn't completely work.

Being able to be re-written has nothing to do with the point I have made.

 

[LTC8K6]

Where I was going is that even though my program compiles properly and runs, it is stupid to say the program runs as designed. Sure it compiles fine, so no obvious logic or syntax is buggy - but this doesn't mean it works as designed because the intention was to do 10 loops. Not 9.

Same with these buggy intel CPUs. Sure they were manufactured without issues and turn on, but it's equally as stupid to pretend they run as designed. Because they were designed such that they don't allow lower level processes to access privileged data.

Get the analogy? The program is made to run a loop 10 times but has a bug so it only loops 9 times. The intel CPU is designed to separate privileged data and does that in a lot of ways but has a bug so it doesn't completely work.

Being able to be re-written has nothing to do with the point I have made.

No, the CPUs are working as intended, imo. This is not a bug. Someone has just found a way to exploit the way the CPU normally works. That's the way I look at it.
I think we just disagree, and this disagreement is reasonable.
And all CPUs can be exploited.
Some exploits just haven't been discovered yet, or made public yet.

 

[richaron]

No, the CPUs are working as intended, imo. This is not a bug. Someone has just found a way to exploit the way the CPU normally works. That's the way I look at it.
I think we just disagree, and this disagreement is reasonable.
And all CPUs can be exploited.
Some exploits just haven't been discovered yet, or made public yet.

Yeah. No. The CPUs are not working as intended. The CPUs are intended to prevent code accessing privileged data.

I just gave you an example of how stupid it is to claim a buggy system is working as intended. That is it's stupid to claim a system is working as intended just because it functions to some extent.

But the intel CPUs are not working as designed. Because they were designed to prevent code accessing privileged data. Intel spent a lot of time and money and silicone to prevent code accessing privileged data. But they failed because they missed something.

So the intel CPUs have a bug. We can play word games all day. Of course bugs can be exploited. Of course bugs may fall outside the normal workload. Of course bugs may not be discovered yet. But they are still bugs and they are still a huge security concern and you are still wrong to claim intel CPUs work as intended.

Again: intel CPUs were intended to prevent code accessing privileged data. They have a bug so they don't do this. So they don't work as intended. AKA they are buggy.

 

[rbk123]

Looks like Core 2 Duo, and thus my trusty Q6600's, aren't affected.

OOC, will the Meltdown OS patches slow down all chips or just Intel chips? Sucks for those on a non-affected platform but are dragged down anyways.