SPECTRE and MELTDOWN: Bug rocks Intel / ARM CPUs

[Brighttail]

When you also want to mitigate Speculative Store Bypass (SSBDWindowsSupportEnabledSystemWide : True) you have to use these values for the reg:
Tested with my i8700 Coffee Lake
"FeatureSettingsOverrideMask"=dword:00000403
"FeatureSettingsOverride"=dword:00000408

Does this give you any measurable increase in M.2 / SSD speed?

[pokuly]

Does this give you any measurable increase in M.2 / SSD speed?

If anything it decreases performance by a minimal amount since you mitigate another vulnerability.
CrytalDiskMark is pretty much the same with my RAMdrive and still by the same amount faster against non activated recent kernel changes.
The MS script outputs:

BTIHardwarePresent : True
BTIWindowsSupportPresent : True
BTIWindowsSupportEnabled : True
BTIDisabledBySystemPolicy : False
BTIDisabledByNoHardwareSupport : False
BTIKernelRetpolineEnabled : False
BTIKernelImportOptimizationEnabled : True
KVAShadowRequired : True
KVAShadowWindowsSupportPresent : True
KVAShadowWindowsSupportEnabled : True
KVAShadowPcidEnabled : True
SSBDWindowsSupportPresent : True
SSBDHardwareVulnerable : True
SSBDHardwarePresent : True
SSBDWindowsSupportEnabledSystemWide : True
L1TFHardwareVulnerable : True
L1TFWindowsSupportPresent : True
L1TFWindowsSupportEnabled : True
L1TFInvalidPteBit : 45
L1DFlushSupported : True

[Brighttail]

Honestly I don't concern myself with SPECTRE too much. If I could disable all checks/precautions/fixes for it and gain back the original speed I would but alas we can't do that. So if it isn't going to impact performance I'll leave it as it is now. Thanks!

If anything it decreases performance by a minimal amount since you mitigate another vulnerability.
CrytalDiskMark is pretty much the same with my RAMdrive and still by the same amount faster against non activated recent kernel changes.
The MS script outputs:

BTIHardwarePresent : True
BTIWindowsSupportPresent : True
BTIWindowsSupportEnabled : True
BTIDisabledBySystemPolicy : False
BTIDisabledByNoHardwareSupport : False
BTIKernelRetpolineEnabled : False
BTIKernelImportOptimizationEnabled : True
KVAShadowRequired : True
KVAShadowWindowsSupportPresent : True
KVAShadowWindowsSupportEnabled : True
KVAShadowPcidEnabled : True
SSBDWindowsSupportPresent : True
SSBDHardwareVulnerable : True
SSBDHardwarePresent : True
SSBDWindowsSupportEnabledSystemWide : True
L1TFHardwareVulnerable : True
L1TFWindowsSupportPresent : True
L1TFWindowsSupportEnabled : True
L1TFInvalidPteBit : 45
L1DFlushSupported : True

[pokuly]

With build 17763.348 1809 Microsoft introduced kernel optimizations like retpoline to get some speed back.
For my Coffee Lake retpoline doesn't work but enabling the new optimizations in registry does set
"BTIKernelImportOptimizationEnabled : True" and brings back a little performance.
https://techcommunity.microsoft.com/...ws/ba-p/295618

ImgDisk RAMdrive behaves like that:

Before
Attachment 79317
After
Attachment 79318

Apropos "brings back performance"
Always a pleasure to see the performance vanishing. ZombieLoad takes more again.
Newly patched WIN 1903 µC B4 for the 8700k

[geneo]

CDM with RAM cache isn't a good measure of anything.

[pokuly]

CDM with RAM cache isn't a good measure of anything.

It shows the performance hits of the mitigations pretty well so far with every change while for example audio encoding software reacts very different to the patches.

[R5Eandme]

I have an old BIOS (3701) on the R5E that pre-dates the announcement of Meltdown and Spectre vulnerabilities. A year ago GRC InSpectre found that I was vulnerable to Spectre, which requires a cpu microcode update. I was surprised to find recently that InSpectre reports that I am now protected against BOTH Meltdown and Spectre (don't know which Spectre variants)





I know that Windows Updates have provided new cpu microcode to mitigate against both Spectre and Meltdown. Some on this thread has said the BIOS should be updated anyway because Windows OS loads the microcode on each boot in volatile memory. Is that true? I had thought that the OS can in fact re-flash parts of BIOS, and InSpectre reports that the hardware has been updated. Just curious about this. If Windows updates have in fact re-flashed parts of the BIOS, then re-flashing with an older BIOS (e.g. 3902) will wipe out the microcode mitigations that Windows updates have done. With Spectre we are up to at least 4 vulnerability variants and more being discovered, so I am thinking that relying on Windows updates will be more current than flashing with old BIOS images. Any thoughts?

Of interest, here are Windows documents titled "Windows UEFI firmware update platform" and "Updating Device Firmware using Windows Update"

https://docs.microsoft.com/en-us/win...pdate-platform

https://docs.microsoft.com/en-us/win...windows-update

[raju2529]

if you uninstall Windows microcode update , then the spectra and meltdown will be un protected . Hence you need to update the new Microcode Bios firmware.
Moreover Microsoft provided registry keys for temporary protection for above vulnerability

[geneo]

Microcode is loaded into the processor by the BIOS. If an installed Microsoft update has a newer version of the Microcode than what was loaded by the BIOS, then Windows loads that updated Microcode into the processor early in the boot. If someone has the level of access to your system to alter the microcode, they already have enough access to do your system harm anyway.

You often do not get these microcode updates from Microsoft automatically through Windows Update - you need to fetch the update and install it manually. As mentioned, if you uninstall the microcode update, it won't be loaded and may leave you open to someone exploiting the vulnerability it protected against.

[R5Eandme]

Microcode is loaded into the processor by the BIOS. If an installed Microsoft update has a newer version of the Microcode than what was loaded by the BIOS, then Windows loads that updated Microcode into the processor early in the boot. If someone has the level of access to your system to alter the microcode, they already have enough access to do your system harm anyway.

You often do not get these microcode updates from Microsoft automatically through Windows Update - you need to fetch the update and install it manually. As mentioned, if you uninstall the microcode update, it won't be loaded and may leave you open to someone exploiting the vulnerability it protected against.

Thanks guys,

So then according to your comments re-flashing BIOS with an old, Spectre mitigated BIOS (vers 3902 for R5E), will not be detrimental to the more recent mitigations that are available from Windows update. That's what I needed to know.