IBM POWER9 CPUs Need To Flush Their L1 Cache Between Privilege Boundaries Due To New Bug

[AsuMagic]

Stop me if i'm understanding it wrong, but doesn't this mean L1 flush on every syscall?
Isn't that pretty catastrophic for performance?

[ms178]

No, it's not. Did you intentionally forget about dozens of other Intel vulnerabilities?

I didn't claim that Intel was safer, I just said that POWER9 lost one of its selling points. The performance implications are huge for the affected use cases, at least for the those who care about the security at all.

By the way, just look at the new entries to the TOP500 and you'll notice that there is no POWER system among them. Don't get me wrong, I am all for more choice and competition on the ISA-level. IBM's efforts though so far don't seem to be convincing enough for the target audience, I also haven't heard of a new super computing deal with POWER10 yet.

[Duve]

IBM's efforts though so far don't seem to be convincing enough for the target audience, I also haven't heard of a new super computing deal with POWER10 yet.

I'll be honest I don't expect that right now, there's yet to be produced silicon in it for the moment and given the state of the market at the high end it's going to take quite a bit to shake power 10 back into the discussion. Huge power savings might do that given how much we know about the 7nm node right now...

I'm glad that this has surfaced now, so that they have time to deal with it on the chip before Power10 comes out next year.

It might be too late to be addressed, but we're going to have to see when the full details of power 10 chips come up.

[PublicNuisance]

There it goes... the "we are safer than Intel" argument gets flushed for POWER9.

How does having this one issue negate the many issues Intel has ? If one CPU has one major flaw and the other has many they can still claim to be safer and it would be true. They just can't claim they have no bugs which I never have seen them do anyway. I would still love to have a Power9 CPU over an Intel, AMD or ARM CPU any day because of the more open nature of them.

[ms178]

How does having this one issue negate the many issues Intel has ? If one CPU has one major flaw and the other has many they can still claim to be safer and it would be true. They just can't claim they have no bugs which I never have seen them do anyway. I would still love to have a Power9 CPU over an Intel, AMD or ARM CPU any day because of the more open nature of them.

I haven't claimed that, it just shows that no CPU implementation is 100% secure and that security was a major selling point for going the POWER route. You might argue that there are enough other Intel-platform security issues which make them still a less secure platform overall, but an attacker only needs to find one hole in the fence to break in, it doesn't matter if there are plenty of other holes which he could crawl through. This POWER9 issue seems to have serious implications on performance and possibly other side-channel attacks exploiting behaviour in the core implementation.

It is somewhat unfortunate for the customers that all major CPU vendors have to deal with more or less severe security issues. But I can think that these customers still demand to get to 100% security with reasonable performance which means: back to the drawing board for the CPU designers to come up with something better in the future.

[AdrianBc]

I didn't claim that Intel was safer, I just said that POWER9 lost one of its selling points. The performance implications are huge for the affected use cases, at least for the those who care about the security at all.

By the way, just look at the new entries to the TOP500 and you'll notice that there is no POWER system among them. Don't get me wrong, I am all for more choice and competition on the ISA-level. IBM's efforts though so far don't seem to be convincing enough for the target audience, I also haven't heard of a new super computing deal with POWER10 yet.

There are no *new* entries, which is to be expected, as POWER9 is already quite old. I would expect any new entries to appear only when POWER10 is introduced.

Nevertheless, after the new Fujitsu system in the 1st place, the next few entries are still POWER9 + NVIDIA Volta, while the first x86 entries come lower (AMD Epyc + NVIDIA Ampere).

[abott]

If only there was hardware oversight by people who would catch these things. Possibly even provided by a technologically advanced community of people who love open stuff.