I currently have a 2014 MacBook Pro, but it needs to go in for service and, rather than renting one for a week, I was thinking of buying a cheap backup (maybe from 2011 or 2012). What is the oldest model that would incorporate Intel's complete set of patches for Meltdown/Spectre (aka Speculative Store Bypass Variants 1–3)?

According to what I've read (see details and sources, below), patches are available from Intel for the chips used in the 2010 and later 15"/17" MBP's, and for the 2011 and later 13" MBPs.

[DETAILS AND SOURCES: According to Intel's patch guidance (https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf), patches have been offered for Sandy Bridge and Arrandale, but not for Penryn. And according to https://en.wikipedia.org/wiki/MacBook_Pro (go to "Table of second generation MacBook Pro models" and click "Show"), the 2011's all use Sandy Bridge. With the 2010's, it gets a bit tricky: The 2010 MBP's used either 2.4 GHz (P8600) or 2.66 GHz (P8800) Penryn chips; or 2.4 GHz (520M), 2.53 GHz (540M), or 2.66 GHz (620M) Arrandale chips. And, according to https://everymac.com/systems/apple/macbook_pro/macbook-pro-unibody-faq/differences-between-macbook-pro-13-15-17-inch-early-2011-and-mid-2010.html, the Penryns are in the 13", while the Arrandles are in the 15"/17"; if that's correct, patches are available for the chips used in the 2010 15"/17" models, but not the 2010 13" ones. The models from 2009 and earlier all use Penryn or earlier, so none of these are patched.]

However, it's not sufficient that Intel offers the patches. It also needs to be the case that Apple has incorporated those patches into the latest OS the chip family is capable of running. According to this chart (https://www.apple.com/lae/macos/how-to-upgrade/#hardware-requirements), one can run High Sierra on all MBP's from 2010 onward. But that doesn't necessarily mean that Apple, within High Sierra, has made available patches going as far back as possible (i.e., that High Sierra contains Intel's Sandy Bridge & Arrandale patches). I assume it has, but I'd like confirmation.

Further, there's a practical performance question: I've not noticed a performance difference with the patch on my mid-2014 MBP. But is the percentage degradation in performance significantly higher with older chips? ["We may see a marginal impact and take a bit of a hit, but the newer processors don't have a huge loss. Older processors have more of an impact." ——John Michener, Chief Scientist, Casaba Security. Source: https://www.wired.com/story/meltdown-and-spectre-patches-take-toll/ ] [I don't know if he means that older processors show more percentage degradation, or simply that older processors, being slower to start with, have less performance headroom.]

Pragmatically, I'd like it to be decently-usable (rather than marginally usable) with Office 365 (even my top-of-the-line 2.8 GHz mid-2014 15" model struggles a bit with Office).

  • 1
    I'm not following how performance and patch line up because you either patch your system or you don’t patch your system. Doesn't the architecture change govern performance and If you are shopping for performance, just spend a little more or wait for the right unit? Basically, what’s the practical question here to solve - are you really just looking for a benchmark for some un-named mac? – bmike Aug 8 '18 at 23:38
  • @bmike I don't know how the patches work so, with regard to your first question, I have no idea whether the performance differential is actually architecture-dependent. [It seems not out of the realm of possibility, since the speculative execution the exploit targets could be implemented differently in different architectures, and thus patching this exploit could perhaps have different effects on different architectures.] My concern was motivated by the quote I just added to the end of my question. [And yes, a benchmark would be very helpful in addressing this.] – theorist Aug 8 '18 at 23:58
  • Observing your moving of the requirements after an answer is posted is not personal in anyway. Pointing out the high opportunity cost of the endeavor is likewise, not personal. They are bits of constructive feedback and perhaps you might consider those points. Then again, far be it from me to discourage someone from swimming upstream. – Allan Aug 9 '18 at 15:08
  • Your statement is incorrect. I did not move the requirements. Check the edit history. I said, from the start that (a) I was thinking of an MBP from maybe 2011 or 2012; (b) I wanted to know the earliest MPB that had the patch; (c) I wanted to know the performance hits. How does this change the goalposts? And your comment was not constructive. Saying "Either you get it without the patch and preserve whatever performance you have or you patch it and live with the perceived hit" is both presumptuous and, as I explained below, represents a false dichotomy. – theorist Aug 9 '18 at 15:15
  • 1
    With the edits, I'm not sure there's a practical question here to be answered within the scope of a couple short paragraphs. I'm not voting to close this unilaterally, but it's not clear what the practical question being asked is anymore to me. – bmike Aug 12 '18 at 18:33

Apple incorporates these patches into their macOS updates.

Meltdown and Spectre were addressed with the following security updates:

  • macOS High Sierra 10.13.6,
  • Security Update 2018-004 Sierra
  • Security Update 2018-004 El Capitan

Since the MacBook Pros from 2011 and newer are all capable of running High Sierra, you can be certain that the patch has/will be applied if you run an up-to-date version of El Capitan, Sierra, or High Sierra.

As for performance, according to MacRumors, per Apple, there's no noticeable impact on performance.

Spectre and Meltdown take advantage of the speculative execution mechanism of a CPU. As these use hardware-based flaws, operating system manufacturers are required to implement software workarounds. These software workarounds can impact processor performance, but according to Apple, the Meltdown fix has no measurable performance reduction across several benchmarks.

  • Thanks for your reply. Do the details of the security updates specifically mention Sandy Bridge? Also, the MacRumors link in your answer is broken, but I assume you're referring to this: macrumors.com/2018/01/04/… The problem there is that it doesn't specifically mention they had tested older devices. Most likely these benchmarks were done on current models but, without specific info, there's no way to tell. – theorist Aug 9 '18 at 0:13
  • 1
    Just being a pragmatist for a moment....Why does it matter? It's a 7 year old machine which you intend to use as a backup. Either you get it without the patch and preserve whatever performance you have or you patch it and live with the perceived hit. If performance is that critical, a 7 y/o machine is not a good solution in either scenario. That said, I would avoid the 2011s altogether as they suffer from major GPU issues and go with a 2012 Retina or an Early 2013 where the SSD was still upgradeable – Allan Aug 9 '18 at 0:25
  • My user name notwithstanding :), I'm a pragmatist as well. And, for my use case, the choice is not binary (high-perf vs. not), as you describe. Rather, it's trinary: I'm not getting it for high perf but, within the non-high-perf category, there's a diff. between decently-useable and marginally-useable. I've added that pragmatic clarification to my question. And wrt GPU issues: Yes, I myself had a 2011 go bad b/c the discrete graphics chip failed. BUT: I thought this was not an issue with the 2011 MBP's generally, but only the 15"/17" ones (the 13" lack discrete graphics). Is that not correct? – theorist Aug 9 '18 at 5:28
  • I was looking at this from the perspective of a performance users (you wanted the GPU for higher performance). That said, I have a 2010 MBP with GPU that's been patched, upgraded to 8GB RAM and a 120GB SSD and I see no noticeable drop in performance. I don't have benchmarks, but being a backup computer, I don't see that as critical. – Allan Aug 9 '18 at 10:32
  • Apple is careful to say the updates "mitigate" against the concept of spectre - saying Intel chip is "patched" or os is "patched" seems foolhardy since side channel leakage and exploitation seems like something baked into the hardware and not something that can be patched away with software to me. – bmike Aug 12 '18 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .