• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

PC Hardware: CPU Security bug, Fix causes up to 30% performance.

ector

Neo Member
So most affected going by that would be load times, perhaps texture streaming and likely games that do lots of separate draw calls (so basically what Vulkan and DX12 aim to improve).

Nah, it's the opposite. Unless very strangely designed, games that use modern APIs generally end up using *less* syscalls to submit stuff to the GPU. So besides load times which may very well be affected by I/O getting slowed down, modern games will barely be affected at all by the OS workaround (not gonna call it a fix, heh), at least not their rendering paths.
 
Are the experts saying that Intel intentionally did this, or has known about it for years, and it's only now coming to light? Or is this a classic example of a bug that is discovered and exploited by researchers and then companies scramble to mitigate it before it is leaked to the public? The way people are talking about lawsuits it sounds as if something malicious is involved.

I'm not talking about that' dude's stock sell-off, that's only tangentially related.
 
Are the experts saying that Intel intentionally did this, or has known about it for years, and it's only now coming to light? Or is this a classic example of a bug that is discovered and exploited by researchers and then companies scramble to mitigate it before it is leaked to the public?
The latter.
 

Meh3D

Member
  • Damage Control: Intel accuses media of being inaccurate and says saying it's not just it's own processors claiming the "processors are susceptible to the exploit" without naming them. (Press Release.)
  • The UK's National Cyber Security Centre (NCSC) says this is a problem with Intel processors specifically. LINK
  • ARM confirmed that Cortex-A processors are affected LINK
 

Meh3D

Member
Exploits have been undisclosed: Meltdown and Spectre. First discovered by University of Graz in Austria, German security firm Cerberus Security, and Google's Project Zero a year ago.
LINK

Meltdown
The first problem, Meltdown, is the one that stimulated the flurry of operating system patches. It uses speculative execution to leak kernel data to regular user programs....

The researchers say they haven't been able to perform the same kind of kernel memory-based speculation on AMD or ARM processors, though they hold out some hope that some way of using this speculation offensively will be developed. While AMD has stated specifically that its chips don't speculate around kernel addresses in this way, ARM has said that some of its designs may be vulnerable, and ARM employees have contributed patches to Linux to protect against Meltdown.

For systems with Intel chips, the impact is quite severe, as potentially any kernel memory can be read by user programs...

Spectre

Owners of AMD and ARM systems shouldn't rest easy, though, and that's thanks to Spectre. Spectre is a more general attack, based on a wider range of speculative execution features. The paper describes using speculation around, for example, array bounds checks and branches instructions to leak information, with proof-of-concept attacks being successful on AMD, ARM, and Intel systems.


In the immediate term, it looks like most systems will shortly have patches for Meltdown. At least for Linux and Windows, these patches allow end-users to opt out if they would prefer. The most vulnerable users are probably cloud service providers; Meltdown and Spectre can both in principle be used to further attacks against hypervisors, making it easier for malicious user to break out of their virtual machines.
 

Meh3D

Member
Been reading a mention of Spectre variant 1 which is patched and variant 2 primarily affects Intel with no current solution. However I can't find links to any sources.
 

Paracelsus

Member
If it's affecting IO as much as they claim it does, they basically crippled cloud and ssd market for a decade if not more. How will Intel not be legally put out of business as in "you're done, out, go away and never come back" is beyond me.
 

caffeware

Banned
Apparently there are two sploits.

One affects Intel cpus only, called Meltdown.

The other, Spectre, affects all modern cpus, including AMD and ARM. Which means almost all phones, tablets, laptops and pcs are vulnerable!

And while Meltdown can be patched at software level (and cause slowdown up to 30%), Spectre is a fundamental hardware design flaw, dating back to around a decade!

As I understand, experts are still figuring out how to deal with the latter.

https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html?m=1
 

Blam

Member
If it's affecting IO as much as they claim it does, they basically crippled cloud and ssd market for a decade if not more. How will Intel not be legally put out of business as in "you're done, out, go away and never come back" is beyond me.

I mean spectre seems even worse then Intel's problems since that seems like it can't even be patched out completely since it's a hardware problem.
 

twisted89

Member
If it's affecting IO as much as they claim it does, they basically crippled cloud and ssd market for a decade if not more. How will Intel not be legally put out of business as in "you're done, out, go away and never come back" is beyond me.

So you want a PC market ruled solely by AMD? Don't be ridiculous.
 

Xdrive05

Member
I may have missed this in the news, but is it possible to NOT take the software patch on Intel? Or will it be forced in a Windows update or something like that?

Because if I just use my computer for gaming (and I don't only use it for gaming; thought experiment), and I want the most performance, I'd possibly rather roll the dice with the exploits.
 

joesiv

Member
Seems like gaming impact is next to nil, thankfully. Some games like assasins creed maybe -3% at 1080p with 1080Ti low preset.

Some games seem to have positive 1% gains, though this is likely due to other updates in windows rolled out at the same time?
 
I may have missed this in the news, but is it possible to NOT take the software patch on Intel? Or will it be forced in a Windows update or something like that?

Because if I just use my computer for gaming (and I don't only use it for gaming; thought experiment), and I want the most performance, I'd possibly rather roll the dice with the exploits.

Microsoft rolled the fix into today's cumulative update. So unless you stop installing updates altogether (which isn't even possible on the consumer versions of Windows 10) you will get the update installed.

As mentioned gaming seems largely unaffected. Certain corporate workloads see a much bigger hit.

As for how big - it depends. 50 % seems to be the upper limit in case a program basically only does syscalls but that's not true of gaming and should not be encountered outside of synthetic benchmarks doing exactly that.

It seems most workloads regular users at home will see is in the range of low single digit impacts if it's outside the measurement tolerance at all.
 

johntown

Banned
Microsoft rolled the fix into today's cumulative update. So unless you stop installing updates altogether (which isn't even possible on the consumer versions of Windows 10) you will get the update installed.
You can disable the Windows Update service on home PC's to prevent the patch.
 
Sounds like gaming wont be impacted but I have noticed my cpu running hotter, for no reason, while idling now. Also see random cpu usage spikes that didn't happen before.
 

nkarafo

Member
I assume i won't getting this patch since i still use Windows 7? I don't remember the last time i updated that, lol.
 

Elsolar

Member
Sounds like gaming wont be impacted but I have noticed my cpu running hotter, for no reason, while idling now. Also see random cpu usage spikes that didn't happen before.

This shouldn't really affect temperatures either. I'm a bit fuzzy on the details (I slept through some of my OS classes...), but the performance hit for syscalls seems to be due to keeping the kernel and user in different address spaces, so there's a big cache swap associated with moving between modes. So your processor should basically spend most of that time waiting on memory, which isn't actually stressing the processor or generating heat. If anything, this patch should cause CPUs to run (negligibly) cooler, since you're giving the processor a little break every time you make a syscall.
 

magnumpy

Member
https://www.youtube.com/watch?v=s7W5zsLp7xY

this is a critical vulnerability, the problem isn't software but the hardware. so this affects potentially every console gamer and basically every pc gamer

basically the fix will involve patching software and ultimately ensuring that all future laptops/consoles/whatever don't have the vulnerability :/
 

ReBurn

Gold Member
I wonder what the risk is to consoles, though. You can only install software on them from an approved source. I wonder how realistic it would be for an attacker to compromise a console with this?
 

Twinsen343

Member
I would have thought there would have been many more benchmarks with the performance impact when gaming?

My Assassin's Creed Origins benchmark lost a few FPS, from 59 to 56
4770, 980ti
 

llien

Member

Actual security flaw has been discovered in a number of Intel CPUs.
CPUs by other manufacturers also could be "at risk".

The researchers say they haven't been able to perform the same kind of kernel memory-based speculation on AMD or ARM processors, though they hold out some hope that some way of using this speculation offensively will be developed

Yet AMD has stated specifically their chips don't speculate about kernel addresses.
ARM stated some revisions could be vulnerable.

Blatant "cover Intel's arse" FUD.


What does it have to do with consoles? Maybe Switch has an issue, but it has been sorta hacked (using backdoor left by nVidia) already anyhow.
 

magnumpy

Member
well it looks like microsoft will be following the usual "patch tuesday" deal, and an update will be released this next tuesday? disaster averted, yay? since this is now a known exploit I have no doubt that the consoles will receive similar updates.

only thing is, they are saying this "fix" will disable a portion of the cpu, early tests show a reduction in performance of up to ~30%? :eek:
 

blu

Wants the largest console games publisher to avoid Nintendo's platforms.
well it looks like microsoft will be following the usual "patch tuesday" deal, and an update will be released this next tuesday? disaster averted, yay? since this is now a known exploit I have no doubt that the consoles will receive similar updates.

only thing is, they are saying this "fix" will disable a portion of the cpu, early tests show a reduction in performance of up to ~30%? :eek:
Nothing disables a portion of the CPU, but fix makes certain OS things that used to run at a certain speed before much slower now, and depending on how much your software uses those things, your software can be affected too. Games and computational software are fairly safe (negligible hit, if any), but software that does plenty of I/O (i.e. mainly server software) can be hit seriously.

The big uproar brought about this entire issue comes from the fact that most of the servers in the world use CPUs from the vendor that is affected the most from the OS slowdown in the fix.
 

joesiv

Member
Nothing disables a portion of the CPU, but fix makes certain OS things that used to run at a certain speed before much slower now, and depending on how much your software uses those things, your software can be affected too. Games and computational software are fairly safe (negligible hit, if any), but software that does plenty of I/O (i.e. mainly server software) can be hit seriously.
I wonder though... I mean someone could release a demo in the marketplace that has some code to exploit it. Apparently web browsers are also exploitable too since it can be done via javascript, so popular gaming site gets hacked, some evil javascript is ran on console browsers.

Leads to the question, what could really be stolen that's of any value in a console?
Perhaps saved credit card information, passwords, your gamerscore (kidding). Perhaps your online identity, address?
 

magnumpy

Member
Leads to the question, what could really be stolen that's of any value in a console?
Perhaps saved credit card information, passwords, your gamerscore (kidding). Perhaps your online identity, address?

phone number and name?

cell phone information?
 

magnumpy

Member
Nothing disables a portion of the CPU, but fix makes certain OS things that used to run at a certain speed before much slower now, and depending on how much your software uses those things, your software can be affected too. Games and computational software are fairly safe (negligible hit, if any), but software that does plenty of I/O (i.e. mainly server software) can be hit seriously.

The big uproar brought about this entire issue comes from the fact that most of the servers in the world use CPUs from the vendor that is affected the most from the OS slowdown in the fix.

seems to be a big nothingburger at the end of the day

but stay tuned, situation is evolving rapidly...
 

Yoshi

Headmaster of Console Warrior Jugendstrafanstalt
I see the potential for spyware, but other than that, what I get about this bug, it is one that is not primarily to the disadvantage of the user, but one that can lead to security breaches from the content provider's perspective. Breaking security of encryption by having access to the machine itself could be very interesting for people trying to circumvent copy protection or to break open closed environments like consoles.
 
I see the potential for spyware, but other than that, what I get about this bug, it is one that is not primarily to the disadvantage of the user, but one that can lead to security breaches from the content provider's perspective.

Spyware can be quite a big disadvantage to users - think of identity theft, stolen credit card details, account takeovers, etc. The consequences of those things should not be taken litely (honestly - my machine being used to send Spam is in my mind far less of an issue than the data potentially being taken).
 
Top Bottom