<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div><br></div><div>Hi,</div><div><br></div><div>I renamed that thread because IMHO there is a another issue related to that threat.</div><div><br></div><div>Should we upgrade our system and lost a significant amount of XFlops... ?</div><div><br></div><div>What should be consider : </div><div> - the risk</div><div> - your user population (size / type / average "knowledge" of hacking techs...)</div><div> - the isolation level from the outside (internet)</div><div><br></div><div><br></div><div>So here is me question : if this is not confidential, what will you do ?</div><div><br></div><div>I would not patch our little local cluster, contrary to all of our other servers.</div><div><br></div><div>Indeed, there is another "little" risk. If our strategy is to always upgrade/patch, in this particular case you can loose many users that will complain about perfs...</div><div><br></div><div>So another question : what is your global strategy about upgrades on your clusters ? Do you upgrade it as often as you can ? One upgrade every X months (due to the downtime issue) ... ?</div><div><br></div><div><br></div><div>Thanks,</div><div><br></div><div>Best regards</div><div>Rémy.</div><div id="composer_signature"><div style="font-size:85%;color:#575757" dir="auto"><br></div></div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Message d'origine --------</div><div>De : John Hearns via Beowulf <beowulf@beowulf.org> </div><div>Date : 03/01/2018 09:48 (GMT+01:00) </div><div>À : Beowulf Mailing List <beowulf@beowulf.org> </div><div>Objet : Re: [Beowulf] Intel CPU design bug & security flaw - kernel fix imposes performance penalty </div><div><br></div></div><div dir="ltr"><div>Thanks Chris. In the past there have been Intel CPU 'bugs' trumpeted, but generally these are fixed with a microcode update. </div><div>This looks different, as it is a fundamental part of the chips architecture.</div><div>However the Register article says: "<span style="text-align:left;color:rgb(0,0,0);text-transform:none;text-indent:0px;letter-spacing:normal;font-family:"Arimo","Arial","FreeSans","Helvetica","sans-serif";font-size:15.93px;font-style:normal;font-variant:normal;font-weight:400;text-decoration:none;word-spacing:0px;display:inline;white-space:normal;float:none;background-color:transparent">It allows normal user programs – to discern to some extent the layout or contents of protected kernel memory areas"</span></div><div><br></div><div>I guess the phrase "to some extent" is the vital one here. Are there any security exploits which use this information? I guess it is inevitable that one will be engineered now that this is known about. The question I am really asking is should we worry about this for real world systems. And I guess tha answer is that if the kernel developers are worried enough then yes we should be too. Comments please.</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 3 January 2018 at 06:56, Greg Lindahl <span dir="ltr"><<a href="mailto:lindahl@pbm.com" target="_blank">lindahl@pbm.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Wed, Jan 03, 2018 at 02:46:07PM +1100, Christopher Samuel wrote:<br>
<br>
> There appears to be no microcode fix possible and the kernel fix will<br>
> incur a significant performance penalty, people are talking about in the<br>
> range of 5%-30% depending on the generation of the CPU. :-(<br>
<br>
</span>The performance hit (at least for the current patches) is related to<br>
system calls, which HPC programs using networking gear like OmniPath<br>
or Infiniband don't do much of.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- greg<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
______________________________<wbr>_________________<br>
Beowulf mailing list, <a href="mailto:Beowulf@beowulf.org">Beowulf@beowulf.org</a> sponsored by Penguin Computing<br>
To change your subscription (digest mode or unsubscribe) visit <a href="http://www.beowulf.org/mailman/listinfo/beowulf" target="_blank" rel="noreferrer">http://www.beowulf.org/<wbr>mailman/listinfo/beowulf</a><br>
</div></div></blockquote></div><br></div>
</body></html>