8 ms·

PCID is now a critical performance/security feature on x86

164 points by pedro84 9y ago

MBCook 9y ago
I saw a post in the last few days that said that most Macintoshes have this feature and Apple has been using it. Can anyone confirm that?
- raattgift 9y ago
  Yes to the latter, kinda to the former. In reverse order: This file goes back several OS versions: https://github.com/apple/darwin-xnu/blob/master/osfmk/x86_64/pmap_pcid.c https://github.com/apple/darwin-xnu/blob/master/osfmk/x86_64... sysctl machdep.cpu.features | grep PCID (cf. xnu/osfmk/i386/cpuid.[hc], ibid.)
jimktrains2 9y ago
I hate that you can't even view Google groups without an account. It also requires us to do nothing but show text. To me groups and blogger has always represented what a terrible web application is.
- aceoflzlz 9y ago
  I don't have an account and I could read that just fine.
- dmm 9y ago
  Google only asks you to login if it knows you have an account.
  - jimktrains2 9y ago
    That still feels like a problem to me. Just show it as unauthenticated if I'm not authenticated.
  - mrguyorama 9y ago
    I find the fact that google feels it's okay to track you like that disturbing
  - dingo_bat 9y ago
    Somehow that's even worse.
  - Analemma_ 9y ago
    That doesn’t make it ok. If anything that’s worse.
  - acdha 9y ago
    The problem is that they completely botched the user experience a decade ago and since it's yet another orphaned product it's never been improved. How it should work following a “build your first web app” tutorial: 1. User opens page 2. You detect an old login cookie and discretely ask if they want to login 3. If they do so, you see the previous page with more UI (e.g. subscribe, reply, etc.) How it works now: 1. Users opens page 2. Instead of looking at the content they wanted to see, the user is automatically redirected over to a login page with a mandatory full two-factor check even if you've recently logged in to other Google properties 3. After completing that process, you're dumped on the groups.google.com homepage 4. Since there were a bunch of redirects, you have to know how to use your browser's history to go back 3-4 pages because simply hitting back will just redirect you to the homepage again.
- dingo_bat 9y ago
  Blogger doesn't even load if you have js disabled.
- neonate 9y ago
  Hey! this works: http://archive.is/ma8Iw http://archive.is/ma8Iw. I didn't expect it to.
  - dang 9y ago
    Let's try changing the URL to that from https://groups.google.com/forum/m/#!topic/mechanical-sympathy/L9mHTbeQLNU https://groups.google.com/forum/m/#!topic/mechanical-sympath.... I don't like obscuring the original domain but agree that Google Groups URLs posted to HN have consistently been annoying.
  - makomk 9y ago
    I think archive.is do a lot of magic on the backend so that stuff like this just works for users.
- igravious 9y ago
  God I hate Google Groups. I actually need some info from some of those groups and because of account b0rkage and shenanigans it is just too much of a hassle. Weren't they originally Usenet groups or something? Initially they were being decent Web stewards of them (_that_ was a long time ago) but then they got subsumed into the corp. as all things must. It's as inevitable as night follows day. Utter shame.
  - nas 9y ago
    They screwed them up in pretty impressive fashion. Years ago, Google Groups used to be a great interface for searching Usenet archives. Now, it is near useless. As an example, I wanted to do some research on early language features of Python (e.g. around 1993). The info is in Usenet postings of that time, surely present in Google Groups years ago. Now, I can't find anything useful. A advanced search using dates doesn't return anything. Their user interface is horribly bad compared to what it used to be. Another example: I did some research on Deep Blue and Deep Thought, after reading Crazy Bird's book. With the old Google Groups, I could follow the discussion of the Deep Blue tournament, in chronological order. There was all sorts of interesting things like computer chess programmers speculating on how Deep Blue worked and people posting analysis of chess positions. All that is now gone or at least not searchable. So sad that all of this knowledge has apparently disappeared. There was loads of information shared on Usenet and the storage space required to preserve it would be trivial.
    - igravious 9y ago
      I thought their mission statement was, "organise the world's information and make it accessible" or something like that. Didn't know there was an asterisk–but not Usenet…
  - hinkley 9y ago
    Google bought Deja News and turned it into Groups.
    - igravious 9y ago
bogomipz 9y ago
I had a question, the author states: >"The PCID (Processor-Context ID) feature on x86-64 works much like the more generic ASID (Address Space IDs)" Is ASID the RISC instruction that accomplishes the same thing that PCID does on x86 then?
- puzzle 9y ago
  ASID is not an instruction. It's basically an attribute in how MMU tables are set up. Processes usually get different ASIDs from each other and all their MMU pages are tagged with it.
  - bogomipz 9y ago
    Sorry I didn't mean instruction. It's the RISC equivalent attribute then?
    - monocasa 9y ago
      It's not a RISC/CISC thing. They're called ASIDs in AMD land as well.
      - bogomipz 9y ago
        I guess I am confused was to why there is both an ASID and PCID for x86 then?
        monocasa 9y ago
        They're Intel and AMD extensions respectively. They're tacked onto the virtualization extensions, and since every implementor (Xen, KVM, etc.) has just wrote separate backends for VT and SVM anyway, Intel and AMD haven't found the need to negotiate cross licensing.
        bogomipz 9y ago
        Thank you this makes sense. Cheers
tveita 9y ago
This will be good to keep in mind when looking at performance reports. The main performance numbers I've seen so far are from two kinds of sources: 1. Local benchmarks like the Phoronix benchmarks, which I think are all on physical hardware with PCID. 2. Reports from cloud customers like https://forums.aws.amazon.com/thread.jspa?threadID=269858 https://forums.aws.amazon.com/thread.jspa?threadID=269858 and https://twitter.com/chanian/status/949457156071288833 https://twitter.com/chanian/status/949457156071288833. These are with a patched host, but with an unpatched guest OS. The best case scenario here seems to be that it doesn't degrade much further when the guest OS is patched. I don't think I've seen any numbers yet for AWS with a patched guest OS - this would be interesting to see on instances with and without PCID support.
davidf18 9y ago
For practical purposes, I believe 4th Gen Intel (Haswell) was the first to implement PCID. The 2015 15" MacBook Pro uses Haswell.
dannyw 9y ago
Can PCID (like HyperThreading, full L3 cache, or extra PCI-e slots in the latest i7s and i9s) be enabled with an update that blows those (e)fuses.
- pgeorgi 9y ago
  efuses typically have a final efuse to be blown in manufacturing to prevent any further modification of the entire block. Otherwise there's way too high a risk of some broken code accidentally changing the configuration.
- monocasa 9y ago
  I don't think it's a feature that's binned off. Intel used to bin off virtualization support (which PCID is technically part off), but they added PCID after they stopped binning on virtualization support.
- loeg 9y ago
  PCID is supported by low end consumer CPUs since 2010 or so. I don't believe it exists in a disabled form on any hardware. (Maybe I'm mistaken.)
unitboolean 9y ago
Many people said that if your processor support PCID, the performance will not be reduced a lot by the new patches. However, after installing new updates for windows and for my very new CPU 7600U everything becomes extremely slow. My laptop is now literally unusable. Even the simplest tasks are very slow. Before this update I was able to watch youtube videos in 4K, now I'm struggling even to watch 480p... I will never buy Intel processors again. In the last few months I only hear lies from Intel regarding Meltdown, Management Engine and other "holes" in their products. Now I can throw my super expensive laptop in garbage. Thank you Intel.
- MBCook 9y ago
  Ah, memories of /.
hannob 9y ago
Can anyone confirm that the way to identify if a linux system has pcid support is to check /proc/cpuinfo? Or is that merely to identify if the hw supports it, independent of the kernel support? I checked two ubuntu servers, one 14.04, the other 16.04, both have it. Which seems odd given the claim that it's only been added recently to the kernel. Also I see nothing showing up in dmesg, no config option and no proc interface on any system.
- ajross 9y ago
  Indeed /proc/cpuinfo is telling you only the capabilities of the hardware, that's what it's for.
- pkaye 9y ago
  Linux kernels did not make use of PCID until version 4.14 but your hardware was capable on processors from 2010 onwards.
the8472 9y ago
It seems to be a double win for bare metal machines. They always have PCID and they're less at risk in the first place since they don't share the hardware. Virtualbox seems to lack PCID too.
- MBCook 9y ago
  The machine may have PCID but that doesn’t mean the OS was using it.
  - loeg 9y ago
    Can you name a mainstream OS (for any definition of "mainstream" you like, really) that doesn't use PCID?
    - LinuxBender 9y ago
      Someone please correct me if I am incorrect, but that would be any mainstream linux not using the 4.14 kernel. Redhat, CentOS, Suse at least. Looks like CoreOS that is on 4.14 is on a minor release just prior to the PCID patch. It looks like Ubuntu 18 Bionic Beaver may have it. (4.15) I suppose some folks use Ubuntu in a datacenter, but more likely the LTS releases and 18 is not likely in many production datacenters. Can you confirm that Redhat backported that newer PCID code into the 3.10 kernel branch? If so, people should not be seeing a performance hit on the KPTI patch.
      - loeg 9y ago
        Ah, I didn't realize Linux was so behind in supporting PCID here. Thanks! For what it's worth, Fedora Linux is on kernel 4.14.11 already. Curiously enough, FreeBSD has had PCID support since 2013 (r255060). We found it improved performance in microbenchmarks: > In the microbenchmarks, using the PCID decreased latency of the context switches by ~30% on SandyBridge class desktop CPUs, measured with the lat_ctx program from lmbench. > If available, use INVPCID instruction when a TLB entry in non-current address space needs to be invalidated. The instruction is typically available on the Haswell.
brendangregg 9y ago
+1 yes, pcid makes a big improvement (I've been testing the KPTI patches with and without pcid).
KerrickStaley 9y ago
One thing I still don't understand about all this: Why is there still a (smaller) performance hit from the KPTI patch when PCID is used?
- deleted 9y ago
  [deleted]
- dmitrygr 9y ago
  with PCID, you only flush the kernel mappings out of the TLB (as user mappings are the same). Without PCID you can only flush TLB or not, so you do, and thus user mappings are gone too and need to be repopulated.
- ploxiln 9y ago
  You still have to switch the page tables via the CR3 register. It costs. And the code around there is more complicated now and has more conditionals ... as they say, it'll be opimized over time, this was the fastest reasonable solution they could put in there (and it still took some time). Also keep in mind that the reason PCID wasn't used by Linux until 4.14 is that the most obvious way of using it incurred more overhead managing the IDs than it saved by not flushing the TLB between different userland processes. This is the land of fiddly details where theory and practice collide and theory often loses in practice.
snaky 9y ago
> I did manage to pull out an old Lenovo ThinkPad W510 with an Intel Core i7 720QM Clarksfield that is from 2009 and lacks PCID but is affected by this cpu_insecure issue. > On that old Clarksfield-era ThinkPad I wasn't going to be surprised if the performance was disastrous, but it wound up being better than I had anticipated given all the ongoing drama... In general purpose workloads there was no reportable performance difference in our frequent benchmark test cases. Under I/O, the PTI-using kernel did yield some slower results but not by the margins seen on the newer systems with faster storage. The laptop consumer-grade HDD in this laptop appeared to be the main bottleneck and kernel inefficiencies weren't causing as dramatic slowdowns. > To some surprise, when carrying out network benchmarks with netperf/iperf3, in at least those contexts PTI didn't have a noticeable impact on the network throughput performance. https://www.phoronix.com/scan.php?page=article&item=linux-more-x86pti&num=1 https://www.phoronix.com/scan.php?page=article&item=linux-mo...
earenndil 9y ago
Desktop link: https://archive.fo/KkmED https://archive.fo/KkmED / https://groups.google.com/forum/#!topic/mechanical-sympathy/L9mHTbeQLNU https://groups.google.com/forum/#!topic/mechanical-sympathy/...
Szpadel 9y ago
I created script for detecting system status against Meltdown issue if anyone is interested if system is patched: https://gist.github.com/Szpadel/003798ac7f4d98bc3583c2a5f3064cb3 https://gist.github.com/Szpadel/003798ac7f4d98bc3583c2a5f306...
yuhong 9y ago
One problem is cross-vendor migration, because AMD don't support PCID.

164 points by pedro84 9y ago

I saw a post in the last few days that said that most Macintoshes have this feature and Apple has been using it. Can anyone confirm that?

raattgift 9y ago
Yes to the latter, kinda to the former. In reverse order: This file goes back several OS versions: https://github.com/apple/darwin-xnu/blob/master/osfmk/x86_64/pmap_pcid.c https://github.com/apple/darwin-xnu/blob/master/osfmk/x86_64... sysctl machdep.cpu.features | grep PCID (cf. xnu/osfmk/i386/cpuid.[hc], ibid.)

jimktrains2 9y ago

I hate that you can't even view Google groups without an account. It also requires us to do nothing but show text. To me groups and blogger has always represented what a terrible web application is.

aceoflzlz 9y ago
I don't have an account and I could read that just fine.
dmm 9y ago
Google only asks you to login if it knows you have an account.
- jimktrains2 9y ago
  That still feels like a problem to me. Just show it as unauthenticated if I'm not authenticated.
- mrguyorama 9y ago
  I find the fact that google feels it's okay to track you like that disturbing
- dingo_bat 9y ago
  Somehow that's even worse.
- Analemma_ 9y ago
  That doesn’t make it ok. If anything that’s worse.
- acdha 9y ago
  The problem is that they completely botched the user experience a decade ago and since it's yet another orphaned product it's never been improved. How it should work following a “build your first web app” tutorial: 1. User opens page 2. You detect an old login cookie and discretely ask if they want to login 3. If they do so, you see the previous page with more UI (e.g. subscribe, reply, etc.) How it works now: 1. Users opens page 2. Instead of looking at the content they wanted to see, the user is automatically redirected over to a login page with a mandatory full two-factor check even if you've recently logged in to other Google properties 3. After completing that process, you're dumped on the groups.google.com homepage 4. Since there were a bunch of redirects, you have to know how to use your browser's history to go back 3-4 pages because simply hitting back will just redirect you to the homepage again.
dingo_bat 9y ago
Blogger doesn't even load if you have js disabled.
neonate 9y ago
Hey! this works: http://archive.is/ma8Iw http://archive.is/ma8Iw. I didn't expect it to.
- dang 9y ago
  Let's try changing the URL to that from https://groups.google.com/forum/m/#!topic/mechanical-sympathy/L9mHTbeQLNU https://groups.google.com/forum/m/#!topic/mechanical-sympath.... I don't like obscuring the original domain but agree that Google Groups URLs posted to HN have consistently been annoying.
- makomk 9y ago
  I think archive.is do a lot of magic on the backend so that stuff like this just works for users.
igravious 9y ago
God I hate Google Groups. I actually need some info from some of those groups and because of account b0rkage and shenanigans it is just too much of a hassle. Weren't they originally Usenet groups or something? Initially they were being decent Web stewards of them (_that_ was a long time ago) but then they got subsumed into the corp. as all things must. It's as inevitable as night follows day. Utter shame.
- nas 9y ago
  They screwed them up in pretty impressive fashion. Years ago, Google Groups used to be a great interface for searching Usenet archives. Now, it is near useless. As an example, I wanted to do some research on early language features of Python (e.g. around 1993). The info is in Usenet postings of that time, surely present in Google Groups years ago. Now, I can't find anything useful. A advanced search using dates doesn't return anything. Their user interface is horribly bad compared to what it used to be. Another example: I did some research on Deep Blue and Deep Thought, after reading Crazy Bird's book. With the old Google Groups, I could follow the discussion of the Deep Blue tournament, in chronological order. There was all sorts of interesting things like computer chess programmers speculating on how Deep Blue worked and people posting analysis of chess positions. All that is now gone or at least not searchable. So sad that all of this knowledge has apparently disappeared. There was loads of information shared on Usenet and the storage space required to preserve it would be trivial.
  - igravious 9y ago
    I thought their mission statement was, "organise the world's information and make it accessible" or something like that. Didn't know there was an asterisk–but not Usenet…
- hinkley 9y ago
  Google bought Deja News and turned it into Groups.
  - igravious 9y ago

bogomipz 9y ago

I had a question, the author states: >"The PCID (Processor-Context ID) feature on x86-64 works much like the more generic ASID (Address Space IDs)" Is ASID the RISC instruction that accomplishes the same thing that PCID does on x86 then?

puzzle 9y ago
ASID is not an instruction. It's basically an attribute in how MMU tables are set up. Processes usually get different ASIDs from each other and all their MMU pages are tagged with it.
- bogomipz 9y ago
  Sorry I didn't mean instruction. It's the RISC equivalent attribute then?
  - monocasa 9y ago
    It's not a RISC/CISC thing. They're called ASIDs in AMD land as well.
    - bogomipz 9y ago
      I guess I am confused was to why there is both an ASID and PCID for x86 then?
      - monocasa 9y ago
        They're Intel and AMD extensions respectively. They're tacked onto the virtualization extensions, and since every implementor (Xen, KVM, etc.) has just wrote separate backends for VT and SVM anyway, Intel and AMD haven't found the need to negotiate cross licensing.
        bogomipz 9y ago
        Thank you this makes sense. Cheers

tveita 9y ago

This will be good to keep in mind when looking at performance reports. The main performance numbers I've seen so far are from two kinds of sources: 1. Local benchmarks like the Phoronix benchmarks, which I think are all on physical hardware with PCID. 2. Reports from cloud customers like https://forums.aws.amazon.com/thread.jspa?threadID=269858 https://forums.aws.amazon.com/thread.jspa?threadID=269858 and https://twitter.com/chanian/status/949457156071288833 https://twitter.com/chanian/status/949457156071288833. These are with a patched host, but with an unpatched guest OS. The best case scenario here seems to be that it doesn't degrade much further when the guest OS is patched. I don't think I've seen any numbers yet for AWS with a patched guest OS - this would be interesting to see on instances with and without PCID support.

davidf18 9y ago

For practical purposes, I believe 4th Gen Intel (Haswell) was the first to implement PCID. The 2015 15" MacBook Pro uses Haswell.

dannyw 9y ago

Can PCID (like HyperThreading, full L3 cache, or extra PCI-e slots in the latest i7s and i9s) be enabled with an update that blows those (e)fuses.

pgeorgi 9y ago
efuses typically have a final efuse to be blown in manufacturing to prevent any further modification of the entire block. Otherwise there's way too high a risk of some broken code accidentally changing the configuration.
monocasa 9y ago
I don't think it's a feature that's binned off. Intel used to bin off virtualization support (which PCID is technically part off), but they added PCID after they stopped binning on virtualization support.
loeg 9y ago
PCID is supported by low end consumer CPUs since 2010 or so. I don't believe it exists in a disabled form on any hardware. (Maybe I'm mistaken.)

unitboolean 9y ago

Many people said that if your processor support PCID, the performance will not be reduced a lot by the new patches. However, after installing new updates for windows and for my very new CPU 7600U everything becomes extremely slow. My laptop is now literally unusable. Even the simplest tasks are very slow. Before this update I was able to watch youtube videos in 4K, now I'm struggling even to watch 480p... I will never buy Intel processors again. In the last few months I only hear lies from Intel regarding Meltdown, Management Engine and other "holes" in their products. Now I can throw my super expensive laptop in garbage. Thank you Intel.

MBCook 9y ago
Ah, memories of /.

hannob 9y ago

Can anyone confirm that the way to identify if a linux system has pcid support is to check /proc/cpuinfo? Or is that merely to identify if the hw supports it, independent of the kernel support? I checked two ubuntu servers, one 14.04, the other 16.04, both have it. Which seems odd given the claim that it's only been added recently to the kernel. Also I see nothing showing up in dmesg, no config option and no proc interface on any system.

ajross 9y ago
Indeed /proc/cpuinfo is telling you only the capabilities of the hardware, that's what it's for.
pkaye 9y ago
Linux kernels did not make use of PCID until version 4.14 but your hardware was capable on processors from 2010 onwards.

the8472 9y ago

It seems to be a double win for bare metal machines. They always have PCID and they're less at risk in the first place since they don't share the hardware. Virtualbox seems to lack PCID too.

MBCook 9y ago
The machine may have PCID but that doesn’t mean the OS was using it.
- loeg 9y ago
  Can you name a mainstream OS (for any definition of "mainstream" you like, really) that doesn't use PCID?
  - LinuxBender 9y ago
    Someone please correct me if I am incorrect, but that would be any mainstream linux not using the 4.14 kernel. Redhat, CentOS, Suse at least. Looks like CoreOS that is on 4.14 is on a minor release just prior to the PCID patch. It looks like Ubuntu 18 Bionic Beaver may have it. (4.15) I suppose some folks use Ubuntu in a datacenter, but more likely the LTS releases and 18 is not likely in many production datacenters. Can you confirm that Redhat backported that newer PCID code into the 3.10 kernel branch? If so, people should not be seeing a performance hit on the KPTI patch.
    - loeg 9y ago
      Ah, I didn't realize Linux was so behind in supporting PCID here. Thanks! For what it's worth, Fedora Linux is on kernel 4.14.11 already. Curiously enough, FreeBSD has had PCID support since 2013 (r255060). We found it improved performance in microbenchmarks: > In the microbenchmarks, using the PCID decreased latency of the context switches by ~30% on SandyBridge class desktop CPUs, measured with the lat_ctx program from lmbench. > If available, use INVPCID instruction when a TLB entry in non-current address space needs to be invalidated. The instruction is typically available on the Haswell.

brendangregg 9y ago

+1 yes, pcid makes a big improvement (I've been testing the KPTI patches with and without pcid).

KerrickStaley 9y ago

One thing I still don't understand about all this: Why is there still a (smaller) performance hit from the KPTI patch when PCID is used?

deleted 9y ago
[deleted]
dmitrygr 9y ago
with PCID, you only flush the kernel mappings out of the TLB (as user mappings are the same). Without PCID you can only flush TLB or not, so you do, and thus user mappings are gone too and need to be repopulated.
ploxiln 9y ago
You still have to switch the page tables via the CR3 register. It costs. And the code around there is more complicated now and has more conditionals ... as they say, it'll be opimized over time, this was the fastest reasonable solution they could put in there (and it still took some time). Also keep in mind that the reason PCID wasn't used by Linux until 4.14 is that the most obvious way of using it incurred more overhead managing the IDs than it saved by not flushing the TLB between different userland processes. This is the land of fiddly details where theory and practice collide and theory often loses in practice.

snaky 9y ago

> I did manage to pull out an old Lenovo ThinkPad W510 with an Intel Core i7 720QM Clarksfield that is from 2009 and lacks PCID but is affected by this cpu_insecure issue. > On that old Clarksfield-era ThinkPad I wasn't going to be surprised if the performance was disastrous, but it wound up being better than I had anticipated given all the ongoing drama... In general purpose workloads there was no reportable performance difference in our frequent benchmark test cases. Under I/O, the PTI-using kernel did yield some slower results but not by the margins seen on the newer systems with faster storage. The laptop consumer-grade HDD in this laptop appeared to be the main bottleneck and kernel inefficiencies weren't causing as dramatic slowdowns. > To some surprise, when carrying out network benchmarks with netperf/iperf3, in at least those contexts PTI didn't have a noticeable impact on the network throughput performance. https://www.phoronix.com/scan.php?page=article&item=linux-more-x86pti&num=1 https://www.phoronix.com/scan.php?page=article&item=linux-mo...

earenndil 9y ago

Desktop link: https://archive.fo/KkmED https://archive.fo/KkmED / https://groups.google.com/forum/#!topic/mechanical-sympathy/L9mHTbeQLNU https://groups.google.com/forum/#!topic/mechanical-sympathy/...

Szpadel 9y ago

I created script for detecting system status against Meltdown issue if anyone is interested if system is patched: https://gist.github.com/Szpadel/003798ac7f4d98bc3583c2a5f3064cb3 https://gist.github.com/Szpadel/003798ac7f4d98bc3583c2a5f306...

yuhong 9y ago

One problem is cross-vendor migration, because AMD don't support PCID.