Shipping in the second half of this year, the next generation of Xeon Scalable Processors (codenamed Cascade Lake) will contain hardware fixes for the Meltdown attack and certain variants of the Spectre attack. So, too, will a range of processors using the same 8th generation Core branding that some processors are already using.
Earlier this year, attacks that exploit the processor’s speculative execution were published with the names Meltdown and Spectre, prompting a reaction from hardware and software companies.
The Spectre attack has two variants, numbered version 1 and version 2. Spectre version 1 attacks will need software fixes, and the nature of these attacks means that they may always need software fixes. Applications that try to build sandboxes—locked-down environments used for running potentially hostile code, such as JavaScript in the browser—will need to be examined and updated to provide robust protection against Spectre version 1.
Spectre version 2 attacks are amenable to hardware fixes. Presently, protection uses a mix of operating system alterations and processor microcode. The microcode updates give new capabilities to the operating system that allow the operating system to apply certain restrictions to the processor’s speculative execution hardware. It’s not yet clear what Intel’s long-term hardware solution is. On the one hand, it could simply bake in (and perhaps improve the performance of) the features that currently require microcode updates. Alternatively, the company could change the way its speculative execution works to prevent the problematic speculations.
The Meltdown attack currently has a robust software protection. However, the impact of this protection varies. On old chips under certain workloads, the overhead from the Meltdown protection can be substantial (double-digit percentage drops in performance); on modern chips under most workloads, the overhead is negligible. The software protection could be disabled with a hardware fix, eliminating its overhead.
As for those Spectre variant 2 microcode updates, Intel is going back even further in time. Currently, the company is shipping microcode updates for everything with a Sandy Bridge architecture or newer; Sandy Bridge was branded “2nd generation Intel Core,” along with various Pentium, Celeron, and Xeon brandings. The company has now said that it’s performing early beta testing of microcode updates for the Nehalem and Westmere architectures, which were the first generation of processors to use the generational Core brandings. This update will also cover the various other brandings and variants of these architectures.
Intel has also said that it is planning to release a microcode for 45nm processors using the Core architecture (codename Penryn, Wolfdale, Yorkfield, Harpertown, and Dunnington) branded as Core 2, along with their variants. These processors first hit the market in 2007. This would leave only the 65nm Core architecture chips, also branded as Core 2 (codename Conroe, Mermon, Allendale, Woodcrest, Kentsfield, Clovertown, and Tigerton), as the only members of Intel’s modern, tick-tock-developed, post-Pentium 4, 64-bit processors without microcode fixes.
