Foreshadow

wolfie138 · 15 Aug 2018 at 07:30

https://www.bbc.co.uk/news/technology-45191697

for crying out loud, is someone doing this on purpose?

humbug · 15 Aug 2018 at 10:29

What do you mean? Since Meltdown and Spectre yes people are deliberately testing to security of CPU's.

pandem0nium · 15 Aug 2018 at 11:30

Yeesh, another performance hit.

I'm not going to upgrade until these are fixed properly in hardware.

Vince · 15 Aug 2018 at 22:10

I suspect this is not the end. By the time we are finished bulldozer will be faster

Panos · 15 Aug 2018 at 22:26

Vince said:
I suspect this is not the end. By the time we are finished bulldozer will be faster

Already if all patches applied is something like 25%. However not all mobo manufacturers have put out all the microcode patches.

Vince · 15 Aug 2018 at 22:30

Panos said:
Already if all patches applied is something like 25%. However not all mobo manufacturers have put out all the microcode patches.

You're telling me. I'm rocking like 12 xeons in dl380 G7's... The business case has been growing to replace them but replacing them with already flawed cpu's? No thanks. EPYC is looking more and more like the better option. Holding out for Gen 2 and then it's game on. Personally I have a budget to replace them this financial year but unless I see gen 2 HP hardware then I might just not spend the money.

Panos · 15 Aug 2018 at 22:43

Vince said:
You're telling me. I'm rocking like 12 xeons in dl380 G7's... The business case has been growing to replace them but replacing them with already flawed cpu's? No thanks. EPYC is looking more and more like the better option. Holding out for Gen 2 and then it's game on. Personally I have a budget to replace them this financial year but unless I see gen 2 HP hardware then I might just not spend the money.

True. Given the price of the EPYC indeed. Makes more sense

opethdisciple · 15 Aug 2018 at 23:08

Vince said:
You're telling me. I'm rocking like 12 xeons in dl380 G7's... The business case has been growing to replace them but replacing them with already flawed cpu's? No thanks. EPYC is looking more and more like the better option. Holding out for Gen 2 and then it's game on. Personally I have a budget to replace them this financial year but unless I see gen 2 HP hardware then I might just not spend the money.

We are rocking DL360's and 380 G7's too. The budget is there to refresh them, but I have argued we should be waiting for when Intel release the new chips with this vulnerabilities mitigated at a hardware level. (Later on in the year)

At first I was laughed at for the suggestion. The money was there and had to be spent. But due to bios updates becoming available we have managed to postpone the purchases and as new vulnerabilities are appearing my suggestion of waiting this out is becoming more and more acknowledged as correct.

I even suggested AMD but that was laughed at too. We also run Red Hat 6 and 7 and Red Hat are in partnership with Intel as far as I understand so we are probably gonna stick with Intel.

CAT-THE-FIFTH · 15 Aug 2018 at 23:29

Phoronix have tested the effects of the flaws under Linux:

https://www.phoronix.com/scan.php?page=article&item=l1tf-early-look&num=1

sideways14a · 15 Aug 2018 at 23:43

wolfie138 said:
https://www.bbc.co.uk/news/technology-45191697

for crying out loud, is someone doing this on purpose?

Yes Intel

Vince · 15 Aug 2018 at 23:50

CAT-THE-FIFTH said:
Phoronix have tested the effects of the flaws under Linux:

https://www.phoronix.com/scan.php?page=article&item=l1tf-early-look&num=1

It doesn't look great does it? I mean it's not earth shattering in terms of hit but keep stacking them up like this and some of our fast workloads start becoming slower workloads and already slower workloads become even slower workloads. It just means messing about with timings on scheduled jobs or throwing more hardware at the machines which if your already stretched or over subbed simply might not be an option. I know I didn't sign up to ever degrading performance when I bought the hardware, it's like the opposite of the "fine wine" analogy.

Panos · 16 Aug 2018 at 00:04

@Vince if you get EPYC especially dual CPU ones, get few litres of Novec and overclock

Here is how.....

Vince · 16 Aug 2018 at 00:14

Panos said:
@Vince if you get EPYC especially dual CPU ones, get few litres of Novec and overclock
Here is how.....

I have run many of our workloads on threadripper 1950x! I'm pretty certain there won't be much point in overclocking them

There is enough grunt and cores there to heavily over spec every server with cores to spare, that's before you look at quad vs octa chanel memory. I recon with the exception of a few database loads the epyc will be every bit as good and reliable as our current infrastructure and with that many cores will cope a lot better with growth. Not to mention they will be in a air conditioned server room which is a nice 17/18 degrees.

When the next gen of dl385 drops ill buy one and tell you

If they are good I'll buy many. It might finally force me off of the last version of esxi supported by vsphere onto that god awful new implementation as well

Panos · 16 Aug 2018 at 01:03

Vince said:
I have run many of our workloads on threadripper 1950x! I'm pretty certain there won't be much point in overclocking them There is enough grunt and cores there to heavily over spec every server with cores to spare, that's before you look at quad vs octa chanel memory. I recon with the exception of a few database loads the epyc will be every bit as good and reliable as our current infrastructure and with that many cores will cope a lot better with growth. Not to mention they will be in a air conditioned server room which is a nice 17/18 degrees.

When the next gen of dl385 drops ill buy one and tell you If they are good I'll buy many. It might finally force me off of the last version of esxi supported by vsphere onto that god awful new implementation as well

I was only making a joke

But yeah, is great to have more than one option atm, we see some very interesting products at good prices for all kind of jobs.

CAT-THE-FIFTH · 16 Aug 2018 at 02:07

Vince said:
It doesn't look great does it? I mean it's not earth shattering in terms of hit but keep stacking them up like this and some of our fast workloads start becoming slower workloads and already slower workloads become even slower workloads. It just means messing about with timings on scheduled jobs or throwing more hardware at the machines which if your already stretched or over subbed simply might not be an option. I know I didn't sign up to ever degrading performance when I bought the hardware, it's like the opposite of the "fine wine" analogy.

I am fedup with all of this TBH - noticed slowdowns in my most commonly played game(modded FO4) after the Spectre/Meltdown patches on my older CPU.I was hoping to wait until 7NM/10NM CPUs were released. Sigh.

Bonjour · 16 Aug 2018 at 09:16

We're replacing our hosts and vSAN in the coming year. We'll be looking at EPYC to replace our XEONs, for sure. Eyeing up the Dell PowerEdge R6415 for the hosts, R7415 for the vSAN.

Our primary SQL server has already taken a very noticeable hit from the Spectre / Meltdown patches.

jigger · 16 Aug 2018 at 14:48

Vince said:
It doesn't look great does it? I mean it's not earth shattering in terms of hit but keep stacking them up like this and some of our fast workloads start becoming slower workloads and already slower workloads become even slower workloads. It just means messing about with timings on scheduled jobs or throwing more hardware at the machines which if your already stretched or over subbed simply might not be an option. I know I didn't sign up to ever degrading performance when I bought the hardware, it's like the opposite of the "fine wine" analogy.

And that's the thing, at what point do you draw the line and what kind of costs will the likes of HP have to add to future system sales for working through the fixes.

The issues will keep coming for years.

CAT-THE-FIFTH · 22 Aug 2018 at 16:49

Have people seen this:

https://sconedocs.github.io/microcode/
https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver/comments

That is the microcode update for Intel CPUs under Linux for the Foreshadow vulnerability which points to this:

https://downloadmirror.intel.com/28039/eng/microcode-20180807.tgz

The latest microcode updates are listed here so its a valid link:

https://downloadcenter.intel.com/download/28039/Linux-Processor-Microcode-Data-File?v=t

Now if you download,look at the license,which says this:

https://paste.ubuntu.com/p/z2F3Cj6R8Q/

3. LICENSE RESTRICTIONS. All right, title and interest in and to the Software
and associated documentation are and will remain the exclusive property of
Intel and its licensors or suppliers. Unless expressly permitted under the
Agreement, You will not, and will not allow any third party to (i) use, copy,
distribute, sell or offer to sell the Software or associated documentation;
(ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change
or create derivative works from the Software except and only to the extent as
specifically required by mandatory applicable laws or any applicable third
party license terms accompanying the Software; (iii) use or make the Software
available for the use or benefit of third parties; or (iv) use the Software on
Your products other than those that include the Intel hardware product(s),
platform(s), or software identified in the Software; or (v) publish or provide
any Software benchmark or comparison test results. You acknowledge that an
essential basis of the bargain in this Agreement is that Intel grants You no
licenses or other rights including, but not limited to, patent, copyright,
trade secret, trademark, trade name, service mark or other intellectual
property licenses or rights with respect to the Software and associated
documentation, by implication, estoppel or otherwise, except for the licenses
expressly granted above. You acknowledge there are significant uses of the
Software in its original, unmodified and uncombined form. You may not remove
any copyright notices from the Software.

Wait,wut?? People can't benchmark the effect of the microcode update??

Well other parts of the clause have also annoyed Debian:

https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_licence/

jigger · 22 Aug 2018 at 17:21

CAT-THE-FIFTH said:
Have people seen this:

https://sconedocs.github.io/microcode/
https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver/comments

That is the microcode update for Intel CPUs under Linux for the Foreshadow vulnerability which points to this:

https://downloadmirror.intel.com/28039/eng/microcode-20180807.tgz

The latest microcode updates are listed here so its a valid link:

https://downloadcenter.intel.com/download/28039/Linux-Processor-Microcode-Data-File?v=t

Now if you download,look at the license,which says this:

https://paste.ubuntu.com/p/z2F3Cj6R8Q/

Wait,wut?? People can't benchmark the effect of the microcode update??

Well other parts of the clause have also annoyed Debian:

https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_licence/

This is a lasagne of fail on Intels part.

humbug · 22 Aug 2018 at 18:21

CAT-THE-FIFTH said:
Have people seen this:

https://sconedocs.github.io/microcode/
https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver/comments

That is the microcode update for Intel CPUs under Linux for the Foreshadow vulnerability which points to this:

https://downloadmirror.intel.com/28039/eng/microcode-20180807.tgz

The latest microcode updates are listed here so its a valid link:

https://downloadcenter.intel.com/download/28039/Linux-Processor-Microcode-Data-File?v=t

Now if you download,look at the license,which says this:

https://paste.ubuntu.com/p/z2F3Cj6R8Q/

Wait,wut?? People can't benchmark the effect of the microcode update??

Well other parts of the clause have also annoyed Debian:

https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_licence/

Because they don't want people knowing the performance impact. it doesn't surprise me.

I would like to see Intel try and stop people from publishing comparisons benchmarks.