Wednesday, January 3rd 2018
AMD Struggles to Be Excluded from Unwarranted Intel VT Flaw Kernel Patches
Intel is secretly firefighting a major hardware security vulnerability affecting its entire x86 processor lineup. The hardware-level vulnerability allows unauthorized memory access between two virtual machines (VMs) running on a physical machine, due to Intel's flawed implementation of its hardware-level virtualization instruction sets. OS kernel-level software patches to mitigate this vulnerability, come at huge performance costs that strike at the very economics of choosing Intel processors in large-scale datacenters and cloud-computing providers, over processors from AMD. Ryzen, Opteron, and EPYC processors are inherently immune to this vulnerability, yet the kernel patches seem to impact performance of both AMD and Intel processors.
Close inspection of kernel patches reveal code that forces machines running all x86 processors, Intel or AMD, to be patched, regardless of the fact that AMD processors are immune. Older commits to the Linux kernel git, which should feature the line "if (c->x86_vendor != X86_VENDOR_AMD)" (condition that the processor should be flagged "X86_BUG_CPU_INSECURE" only if it's not an AMD processor), have been replaced with the line "/* Assume for now that ALL x86 CPUs are insecure */" with no further accepted commits in the past 10 days. This shows that AMD's requests are being turned down by Kernel developers. Their intentions are questionable in the wake of proof that AMD processors are immune, given that patched software inflicts performance penalties on both Intel and AMD processors creating a crony "level playing field," even if the latter doesn't warrant a patch. Ideally, AMD should push to be excluded from this patch, and offer to demonstrate the invulnerability of its processors to Intel's mess.
Source:
Phoronix Forums
Close inspection of kernel patches reveal code that forces machines running all x86 processors, Intel or AMD, to be patched, regardless of the fact that AMD processors are immune. Older commits to the Linux kernel git, which should feature the line "if (c->x86_vendor != X86_VENDOR_AMD)" (condition that the processor should be flagged "X86_BUG_CPU_INSECURE" only if it's not an AMD processor), have been replaced with the line "/* Assume for now that ALL x86 CPUs are insecure */" with no further accepted commits in the past 10 days. This shows that AMD's requests are being turned down by Kernel developers. Their intentions are questionable in the wake of proof that AMD processors are immune, given that patched software inflicts performance penalties on both Intel and AMD processors creating a crony "level playing field," even if the latter doesn't warrant a patch. Ideally, AMD should push to be excluded from this patch, and offer to demonstrate the invulnerability of its processors to Intel's mess.
142 Comments on AMD Struggles to Be Excluded from Unwarranted Intel VT Flaw Kernel Patches
My question is this: Who here is affected by this kernel patch? For example, I've got Win 7 running on an i7-4790k, does it hit me? And how could you go about measuring the performance hit?
Also, it's pti=off now (for some reason).
newsroom.intel.com/news/intel-responds-to-security-research-findings/
Talk about full firefight mode, and trying to drag everyone else down with you.
This effects Intel and many ARM CPUs and only those.
Multiple lawsuits incoming :slap:
Like I speculated earlier, this was known well before the KAISER (now kpti) patch & might possibly have been exploited in the wild. The BK Intel share selloff seems even more dubious now!
Intel's response to this is... well, bad. Terrible. S**tty. A lot of marketing handwaving and deflection, of the exact type I hate most, that uses a lot of words to say nothing, and certainly doesn't take responsibility. Given the seriousness of the issue, the fact that it can only be averted by a performance-crippling software patch or a (potentially performance-crippling) hardware redesign, they're looking down the barrel - but that doesn't excuse the fact that they aren't being mature about this.
What is most interesting to me is that according to the research, the Meltdown vulnerability has existed undetected for quite literally decades. I wonder how many three-letter government agencies have been exploiting it for all that time? And putting my conspiracy theorist hat on - I wonder if this is a backdoor that was purposefully built into Intel CPUs at the request of government agencies, similar to how various encryption algorithms were weakened/backdoored at the request of those same agencies?
Damn, this is biiig, and Intel's gonna bleed a lot before it's all over.
github.com/torvalds/linux/blame/master/arch/x86/kernel/cpu/common.c#L926