7 ms·

Intel Security Issue Update: Initial Performance Data Results for Client Systems

86 points by taspeotis 9y ago

tedunangst 9y ago
With what mitigation config? IBRS? IBPB?
YouKnowBetter 9y ago
Surely this is written by his PR department and the techies are ashamed of the numbers & interpertation.
PeterStuer 9y ago
Even in these PR figures, the SYSMark 2014 SE Responsiveness test results, a benchmark addition which was specifically created to unearth pain-points in typical everyday user activities, gets a serious wallop.
- mkagenius 9y ago
  > New “Responsiveness” scenario. Workloads include: application launches, file launches, web browsing with multiple tabs, multi-tasking, file copying, photo manipulation, file encryption + compression, and gone down to 86% :-(
teamhappy 9y ago
The performance hit is (supposedly) much more significant on Haswell and older, which they forgot to include.
- hrrsn 9y ago
  How convenient.
- deleted 9y ago
  [deleted]
- hoffs 9y ago
  I own haswell and haven't felt any performance impact...
  - teamhappy 9y ago
    > For context, on newer CPUs such as on Skylake and > beyond, Intel has refined the instructions used to > disable branch speculation to be more specific to > indirect branches, reducing the overall performance > penalty of the Spectre mitigation. https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/ https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/...
    - dogma1138 9y ago
      Haswell and Broadwell introduced INVPCID support, unless there were further undocumented improvements I'm not entirely sure what this is based on.
- revelation 9y ago
  Specifically, the oldest generation they tested (Skylake) is the first to have the PCID feature that avoids the complete TLB flush on every syscall. Continuing with their strategy of full transparency..
  - kogepathic 9y ago
    > (Skylake) is the first to have the PCID feature PCID was introduced with Westmere (2010). [1] However it wasn't used in the Linux kernel until 4.14 because no one saw the need. [2] [1] https://www.realworldtech.com/westmere/ https://www.realworldtech.com/westmere/ [2] https://stackoverflow.com/questions/20155304/does-linux-use-x86-cpus-pcid-feature-for-tlb-if-not-why https://stackoverflow.com/questions/20155304/does-linux-use-...
    - vardump 9y ago
      But only Haswell added INVPCID.
      - deleted 9y ago
        [deleted]
      - blinkingled 9y ago
        This is the key. Without INVPCID PCID is good as useless.
a012 9y ago
> As of today, we still have not received any information that these exploits have been used to obtain customer data. We know our customers are eager for updates, and via this blog, I will personally communicate with you the information that we have to share today and in the future. Seriously? To Intel, all of the world is just overreacted?
- detaro 9y ago
  The original Project Zero announcement also contained the fact that they aren't aware of in-the-wild exploits, does that mean they say they themselves are overreacting, or are they merely providing information?
  - a012 9y ago
    It's too early to say, it's not known _yet_. Are you waiting for a first case to fix your bugs?
    - detaro 9y ago
      Where are they saying anything about not fixing bugs? And like it or not, with the issues of the available patches breaking machines, virus scanner incompatibilities, ..., organisations will have to make decisions about when to patch.
      - a012 9y ago
        I said they said like "the world is just overreacted, and if you insist to promptly applying patch they'll provide". It's about their tone in their first statement. And you're misleading my point here.
        detaro 9y ago
        And I really do not see how you get a "the world just overreacted" tone from this post or specifically your quote, I did not intend to mislead from your point. Their overall communication strategy has been pretty bad, but this instance seems fine to me. It's providing information. I guess they should even provide more information against patching, since they don't talk about the issues fixes can cause.
sho_hn 9y ago
Much more so than the bugs themselves it seriously undermines my confidence in Intel that in this time of emergency, they can't bring themselves to address customers with straight talk. Clear information should take precedence over mitigating liability. Yet it's fallen to others to explain defects in their products, and people are even mostly left guessing what their attempts to fix things actually do. Screwups happen. But do I want to go live through the consequences of one with this vendor at my side ever again?
- HugoDaniel 9y ago
  Do you really think this was a screwup ? Intel is a company that has a highly hierarchical structure and a very thorough process of product development and market approach. Add to that that they are historically one of the key examples of a company that plans their strategy many years ahead and I find it way more sane to default Meltdown to a premeditated conscious decision/tarde-off of their part. Like VW emissions scandal but worse. "We think long term at Epic. We're like Intel. We look at what we're going to do in five to ten years from now, and set our direction that way..." Tim Sweeney in a Kotaku interview 2011
  - cjbprime 9y ago
    It's not obvious (at least to me) that Meltdown is caused by a performance optimization. The fix to Meltdown introduces a pessimization, sure, but that's not necessarily the same thing. Meltdown could be a simple bug that doesn't incur a perf loss when designed for properly, but happens to require an expensive fix in the field. Does anyone know?
- api 9y ago
  Intel is in trouble. They've lost mobile and they're in danger of losing desktop/laptop and cloud. While AMD is some threat there, the much larger threat comes from high performance ARM64 cores. Intel would rather see AMD take market share from them than ARM, since at least AMD Ryzen is still an x64 core and will keep the architectural center of gravity in Intel's area. Of course their longer term strategy seems to be to get ahead in areas like quantum and neuromorphic computing. This is going to keep them relevant in the long term, but in the medium to short term they could have difficulties.
jonplackett 9y ago
“users who use web applications that involve complex JavaScript operations may see a somewhat higher impact (up to 10 percent based on our initial measurements).“ Ok so that’s probably most websites these days?
- mtgx 9y ago
  Yeah, my first thought was "Oh, so Gmail will be much slower then?" Intel seems to be trying as hard as possible to define narrow scenarios in which the performance drop isn't too big and only mentioning those. In its first benchmarks, for instance, it only tested a six-core 8700K, one of its highest-end consumer products, because obviously the percentage drop would be lower on high-performance machines than on slower ones.
- Scottn1 9y ago
  I have to say I am pretty PO'd regarding this. A month ago I JUST finally bought a nice new i3-7100 PC to replace my 10yo Core2Duo for Christmas. Office tasks, web games for kid, work, etc. I have measurably noticed the decrease in speed in various web benchmarks. Enough to make it feel like I was mislead in what I thought I had purchased. I wrote down two tests I did the day I first brought PC home and have run them many times since the first patches hit Windows 10. I got two clear hits - A small hit with the Windows 10 patch, then another hit with the PCU microcode update (through a BIOS update released by Lenovo). Windows10 x64 1709 Edge: Jetstream: 271 in Dec, 246 today. -9.2% MotionMark: 307 to 245. -20%! Firefox: Jetstream: 199 In dec on FF-57, 175 today FF-57.0.4. -12% That is bad enough to me that I would just take this PC back to store for money back if it was still within return timeframe. I'd rather just wait for this to be fixed at the hardware level now or wait for a Zen APU in a few months. Imagine you bought a car a month ago and today got 9-20% LESS horsepower because of a "Fix". I can only imagine how upset cloud providers must be at this. Or any company needing every ounce of CPU performance they paid for. AutoCAD farms/rendering comes to mind. I hope there is a class action lawsuit for anyone who bought Intel CPU's. Obviously pro-rated by how long ago you purchased. I'd definitely sign up at this point for some $ back. Problem is it will only be like $5 in my pocket after lawyers get their payday.
djhworld 9y ago
I'm having trouble reading the table, surely they could have presented it as a graph?
Keyframe 9y ago
OT, but that guy's picture seems amazingly inappropriate for the topic and unsettling in general.
- nerdponx 9y ago
  It's not that off-topic. It's really bizarre in this context; it's the kind of appeal to "ethos" that you see in all sorts of B2B marketing.
FollowSteph3 9y ago
Any data on older processors? For example I run a sandy bridge 3930k but didn’t see anything? Also how far back are they going to patch?
- teamhappy 9y ago
  > [...] Intel expects to have issued updates for more > than 90 percent of processor products introduced within > the past five years. https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/ https://newsroom.intel.com/news-releases/intel-issues-update... Sandy Bridge is older than that.
  - gravypod 9y ago
    Is SB going to remain unpatched? Those systems are still perfectly fine for consumer use. I hope business starts selling them off cheap.
    - teamhappy 9y ago
      Looks like Sandy Bridge is going to remain unpatched. That doesn't mean that your OS, compiler and so on won't get updates though.
discreditable 9y ago
It's interesting to think that every CPU comparison benchmark online is invalid now. With these number, I wonder how AMD is shaping up to Intel? When I bought a 7700k over the summer, I went by benchmarks which showed it over Ryzen for most non-parallel workloads. I suspect these numbers bring Ryzen much closer if not beyond. With all these old benchmarks online, CPU shoppers are likely to be misled. Thinking further, I wonder how benchmarkers patch machines? Will they keep anti-virus enabled so that they receive the 2018-01 patch?
sector777 9y ago
Is this fixable in the next generation in hardware, or is this a permanent tax on performance going forward? What I mean is (using a hypothetical): Suppose there's a flaw in the arithmetic unit (e.g. integer division). There's a microcode update, all integer divisions are correct, but run at 86% of previous performance. In next generation, the hardware is fixed and performance will be back up to 100% of designed performance. Does the same type of handwaving apply to these types of security exploits?
- pkaye 9y ago
  I think Intel can take the same approach as AMD for some of the issues. For this remaining issue, I think there might be solutions with minimal performance impact when you are doing a full chip redesign. For example, have a separate branch prediction hardware for privileged code execution? An additional cache area for speculated reads?

86 points by taspeotis 9y ago

tedunangst 9y ago

With what mitigation config? IBRS? IBPB?

YouKnowBetter 9y ago

Surely this is written by his PR department and the techies are ashamed of the numbers & interpertation.

PeterStuer 9y ago

Even in these PR figures, the SYSMark 2014 SE Responsiveness test results, a benchmark addition which was specifically created to unearth pain-points in typical everyday user activities, gets a serious wallop.

mkagenius 9y ago
> New “Responsiveness” scenario. Workloads include: application launches, file launches, web browsing with multiple tabs, multi-tasking, file copying, photo manipulation, file encryption + compression, and gone down to 86% :-(

teamhappy 9y ago

The performance hit is (supposedly) much more significant on Haswell and older, which they forgot to include.

hrrsn 9y ago
How convenient.
deleted 9y ago
[deleted]
hoffs 9y ago
I own haswell and haven't felt any performance impact...
- teamhappy 9y ago
  > For context, on newer CPUs such as on Skylake and > beyond, Intel has refined the instructions used to > disable branch speculation to be more specific to > indirect branches, reducing the overall performance > penalty of the Spectre mitigation. https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/ https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/...
  - dogma1138 9y ago
    Haswell and Broadwell introduced INVPCID support, unless there were further undocumented improvements I'm not entirely sure what this is based on.
revelation 9y ago
Specifically, the oldest generation they tested (Skylake) is the first to have the PCID feature that avoids the complete TLB flush on every syscall. Continuing with their strategy of full transparency..
- kogepathic 9y ago
  > (Skylake) is the first to have the PCID feature PCID was introduced with Westmere (2010). [1] However it wasn't used in the Linux kernel until 4.14 because no one saw the need. [2] [1] https://www.realworldtech.com/westmere/ https://www.realworldtech.com/westmere/ [2] https://stackoverflow.com/questions/20155304/does-linux-use-x86-cpus-pcid-feature-for-tlb-if-not-why https://stackoverflow.com/questions/20155304/does-linux-use-...
  - vardump 9y ago
    But only Haswell added INVPCID.
    - deleted 9y ago
      [deleted]
    - blinkingled 9y ago
      This is the key. Without INVPCID PCID is good as useless.

a012 9y ago

> As of today, we still have not received any information that these exploits have been used to obtain customer data. We know our customers are eager for updates, and via this blog, I will personally communicate with you the information that we have to share today and in the future. Seriously? To Intel, all of the world is just overreacted?

detaro 9y ago
The original Project Zero announcement also contained the fact that they aren't aware of in-the-wild exploits, does that mean they say they themselves are overreacting, or are they merely providing information?
- a012 9y ago
  It's too early to say, it's not known _yet_. Are you waiting for a first case to fix your bugs?
  - detaro 9y ago
    Where are they saying anything about not fixing bugs? And like it or not, with the issues of the available patches breaking machines, virus scanner incompatibilities, ..., organisations will have to make decisions about when to patch.
    - a012 9y ago
      I said they said like "the world is just overreacted, and if you insist to promptly applying patch they'll provide". It's about their tone in their first statement. And you're misleading my point here.
      - detaro 9y ago
        And I really do not see how you get a "the world just overreacted" tone from this post or specifically your quote, I did not intend to mislead from your point. Their overall communication strategy has been pretty bad, but this instance seems fine to me. It's providing information. I guess they should even provide more information against patching, since they don't talk about the issues fixes can cause.

sho_hn 9y ago

Much more so than the bugs themselves it seriously undermines my confidence in Intel that in this time of emergency, they can't bring themselves to address customers with straight talk. Clear information should take precedence over mitigating liability. Yet it's fallen to others to explain defects in their products, and people are even mostly left guessing what their attempts to fix things actually do. Screwups happen. But do I want to go live through the consequences of one with this vendor at my side ever again?

HugoDaniel 9y ago
Do you really think this was a screwup ? Intel is a company that has a highly hierarchical structure and a very thorough process of product development and market approach. Add to that that they are historically one of the key examples of a company that plans their strategy many years ahead and I find it way more sane to default Meltdown to a premeditated conscious decision/tarde-off of their part. Like VW emissions scandal but worse. "We think long term at Epic. We're like Intel. We look at what we're going to do in five to ten years from now, and set our direction that way..." Tim Sweeney in a Kotaku interview 2011
- cjbprime 9y ago
  It's not obvious (at least to me) that Meltdown is caused by a performance optimization. The fix to Meltdown introduces a pessimization, sure, but that's not necessarily the same thing. Meltdown could be a simple bug that doesn't incur a perf loss when designed for properly, but happens to require an expensive fix in the field. Does anyone know?
api 9y ago
Intel is in trouble. They've lost mobile and they're in danger of losing desktop/laptop and cloud. While AMD is some threat there, the much larger threat comes from high performance ARM64 cores. Intel would rather see AMD take market share from them than ARM, since at least AMD Ryzen is still an x64 core and will keep the architectural center of gravity in Intel's area. Of course their longer term strategy seems to be to get ahead in areas like quantum and neuromorphic computing. This is going to keep them relevant in the long term, but in the medium to short term they could have difficulties.

jonplackett 9y ago

“users who use web applications that involve complex JavaScript operations may see a somewhat higher impact (up to 10 percent based on our initial measurements).“ Ok so that’s probably most websites these days?

mtgx 9y ago
Yeah, my first thought was "Oh, so Gmail will be much slower then?" Intel seems to be trying as hard as possible to define narrow scenarios in which the performance drop isn't too big and only mentioning those. In its first benchmarks, for instance, it only tested a six-core 8700K, one of its highest-end consumer products, because obviously the percentage drop would be lower on high-performance machines than on slower ones.
Scottn1 9y ago
I have to say I am pretty PO'd regarding this. A month ago I JUST finally bought a nice new i3-7100 PC to replace my 10yo Core2Duo for Christmas. Office tasks, web games for kid, work, etc. I have measurably noticed the decrease in speed in various web benchmarks. Enough to make it feel like I was mislead in what I thought I had purchased. I wrote down two tests I did the day I first brought PC home and have run them many times since the first patches hit Windows 10. I got two clear hits - A small hit with the Windows 10 patch, then another hit with the PCU microcode update (through a BIOS update released by Lenovo). Windows10 x64 1709 Edge: Jetstream: 271 in Dec, 246 today. -9.2% MotionMark: 307 to 245. -20%! Firefox: Jetstream: 199 In dec on FF-57, 175 today FF-57.0.4. -12% That is bad enough to me that I would just take this PC back to store for money back if it was still within return timeframe. I'd rather just wait for this to be fixed at the hardware level now or wait for a Zen APU in a few months. Imagine you bought a car a month ago and today got 9-20% LESS horsepower because of a "Fix". I can only imagine how upset cloud providers must be at this. Or any company needing every ounce of CPU performance they paid for. AutoCAD farms/rendering comes to mind. I hope there is a class action lawsuit for anyone who bought Intel CPU's. Obviously pro-rated by how long ago you purchased. I'd definitely sign up at this point for some $ back. Problem is it will only be like $5 in my pocket after lawyers get their payday.

djhworld 9y ago

I'm having trouble reading the table, surely they could have presented it as a graph?

Keyframe 9y ago

OT, but that guy's picture seems amazingly inappropriate for the topic and unsettling in general.

nerdponx 9y ago
It's not that off-topic. It's really bizarre in this context; it's the kind of appeal to "ethos" that you see in all sorts of B2B marketing.

FollowSteph3 9y ago

Any data on older processors? For example I run a sandy bridge 3930k but didn’t see anything? Also how far back are they going to patch?

teamhappy 9y ago
> [...] Intel expects to have issued updates for more > than 90 percent of processor products introduced within > the past five years. https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/ https://newsroom.intel.com/news-releases/intel-issues-update... Sandy Bridge is older than that.
- gravypod 9y ago
  Is SB going to remain unpatched? Those systems are still perfectly fine for consumer use. I hope business starts selling them off cheap.
  - teamhappy 9y ago
    Looks like Sandy Bridge is going to remain unpatched. That doesn't mean that your OS, compiler and so on won't get updates though.

discreditable 9y ago

It's interesting to think that every CPU comparison benchmark online is invalid now. With these number, I wonder how AMD is shaping up to Intel? When I bought a 7700k over the summer, I went by benchmarks which showed it over Ryzen for most non-parallel workloads. I suspect these numbers bring Ryzen much closer if not beyond. With all these old benchmarks online, CPU shoppers are likely to be misled. Thinking further, I wonder how benchmarkers patch machines? Will they keep anti-virus enabled so that they receive the 2018-01 patch?

sector777 9y ago

Is this fixable in the next generation in hardware, or is this a permanent tax on performance going forward? What I mean is (using a hypothetical): Suppose there's a flaw in the arithmetic unit (e.g. integer division). There's a microcode update, all integer divisions are correct, but run at 86% of previous performance. In next generation, the hardware is fixed and performance will be back up to 100% of designed performance. Does the same type of handwaving apply to these types of security exploits?

pkaye 9y ago
I think Intel can take the same approach as AMD for some of the issues. For this remaining issue, I think there might be solutions with minimal performance impact when you are doing a full chip redesign. For example, have a separate branch prediction hardware for privileged code execution? An additional cache area for speculated reads?