5 ms·

What kind of performance penalty do all of these patches combined have on intel chips? I’m curious how much slower an intel chip is now versus before meltdown.

the8472 7y ago
There's no single number since it depends on your workload. Something that is syscall- and interrupt-heavy or does lots of task-switching will see far more overhead than pure number-crunching with properly allocated threads. Synthetic benchmarks can get you a penalty from anywhere from 1.001x and beyond 2x. Your workload also influences which mitigations you can safely turn off. If you're running a single-tenant system and don't need isolated security domains then you can turn them off. Future software improvements (io_uring!) may also recover some of those losses.
- cookiecaper 7y ago
  >If you're running a single-tenant system and don't need isolated security domains then you can turn them off. This is the dirty secret that no one will let out because its ramifications on "the cloud" are very serious, and Microsoft, Amazon, et al have staked their futures on rent-seeking via cloud. These hardware bugs make the risks of multi-tenancy incontrovertible, and I would expect enterprise security departments to be clamoring for the return of hardware control. My popcorn is out to watch as the frantic inquisition against cloud heretics kicks into high[er] gear.
  - kccqzy 7y ago
    What? Single-tenancy and the cloud are pretty orthogonal. I can request single-tenant machines on EC2; they just cost more. But I still have the benefit of being able to create and delete an instance in just minutes.
    - cookiecaper 7y ago
      Multi-tenant is the cloud's linchpin and it's disingenuous to pretend otherwise. The offerings of and outlook for cloud providers would be very different without multi-tenancy. While single-tenant options may be available for some configurations, you'll pay through the nose, and there are many limitations (e.g., EBS-backed volumes attached to your single-tenant instances still run on multi-tenant hosts). Moreover, few if any of the managed cloud services, which are what really drive cloud adoption, have any concept of single tenancy. Even after all this, the risk is only partially mitigated, because you're trusting Amazon's management toolkit and staff to respect these boundaries and to not have any bugs that may inadvertently expose access or data to third parties. Considering single-tenancy is such a small segment of their business, I doubt this is a major consideration, and even if it is, it's a lot of eggs to put into a basket that's completely out of your control. There just isn't much of an argument for a group that's serious about security to commit hardcore to "the cloud", yet virtually every company I've encountered in the last few years is pushing this hard, and actively ostracizing anyone who tries to inject some moderation or sanity into it. I appreciate the convenience of cloud offerings as much as the next guy, but it's out of control, and the complete disregard for the implications of hardware bugs that fundamentally undermine the supposed security model is a great representation of that.
- mort96 7y ago
  I don't know that there are many computers out there which don't need isolated security domains. Users run javascript all the time, cloud servers obviously need security domains, regular bare metal servers generally run internet-facing applications such as web servers as unprivileged users in case they contain RCE bugs.
  - kccqzy 7y ago
    High performance computing, machine learning training servers, CI/CD build servers, most database servers, home media servers, computers for industrial control, etc.
citilife 7y ago
It looks like there is generally a 18% - 40% performance hit with meltdown[1]: > On Linux distributions like Ubuntu 18.10 and Clear Linux the mitigation costs were about ~18% while both RHEL 8 Beta and openSUSE 15.0 had a nearly 40% hit. If we look at MDS mitigation for older MACs[2], it could be 40%: > Intel MDS Vulnerabilities Affecting 7th Gen And Below May Slow Macs By Up To 40%, Apple Warns If we look at MDS mitigation generally (if Intel is to be believed) we are looking at ~10% for most use cases[3] > Intel's benchmarks show a 6-14 percent drop in storage performance on a couple of Xeon processors, both with Hyper Threading enabled. Assuming that Intel is not showing a worst case scenario in any of these benchmarks, the hit to storage could be even bigger. > It's in workstations and data centers that mitigations are likely to have the biggest performance impact, depending on the workload. In a separate graph, for example, Intel shows a 19 percent drop in "server side Java" performance after disabling Hyper Threading on a Xeon Platinum 8180 processor (compared to having it turned on). In other words... total I have no idea what we'll be seeing. However, if we don't look at just "raw performance" in benchmarks when buying CPUs, AMD is likely a better purchase for most use cases at this point. [1] https://www.phoronix.com/scan.php?page=article&item=spec-melt-8way&num=2 https://www.phoronix.com/scan.php?page=article&item=spec-mel... [2] https://wccftech.com/intel-mds-vulnerabilities-affecting-7th-gen-and-below-may-slow-macs-by-up-to-40-apple-warns/ https://wccftech.com/intel-mds-vulnerabilities-affecting-7th... [3] https://www.pcgamer.com/intel-posts-benchmarks-showing-performance-impact-of-new-cpu-flaws/ https://www.pcgamer.com/intel-posts-benchmarks-showing-perfo...
- the8472 7y ago
  Phoronix just released new benchmarks covering MDS mitigations and the combined costs of all mitigations . https://www.phoronix.com/scan.php?page=article&item=mds-zombieload-mit&num=1 https://www.phoronix.com/scan.php?page=article&item=mds-zomb...
  - nullwasamistake 7y ago
    For the lazy: "If looking at the geometric mean for the tests run today, the Intel systems all saw about 16% lower performance out-of-the-box now with these default mitigations and obviously even lower if disabling Hyper Threading for maximum security. The two AMD systems tested saw a 3% performance hit with the default mitigations. While there are minor differences between the systems to consider, the mitigation impact is enough to draw the Core i7 8700K much closer to the Ryzen 7 2700X and the Core i9 7980XE to the Threadripper 2990WX." Not looking good for Intel at the moment. It should also be noted that there's believable rumors that the mitigations are not fully effective unless hyperthreading is disabled.
bArray 7y ago
I would be very interested to see those numbers arrogated, I have no idea whether these numbers are percentages of 100% original CPU performance or percentages of the remaining performance from the last bug. Either way, that's some serious performance loss. Even your normal light-weight users are going to start noticing slowdown. It appears as if nobody at Intel is doing anything other than cursory security analysis of processors. So far the cost has been performance, but I imagine there may be some bugs without micro-code mitigation. Not only this but it appears to be only a matter of time until Intel ME is broken too.
- writelikeaYou 7y ago
  Why do you write like a moron? Use normal language instead of coming across like a piece of skit. You think it looks great but it looks like skit. And I am way more intelligent than you. Drop all the imposter syndrome bullskits. It's for your own good. You look like a tediot. In all walks of life. Please readjust and reassess.

the8472 7y ago

There's no single number since it depends on your workload. Something that is syscall- and interrupt-heavy or does lots of task-switching will see far more overhead than pure number-crunching with properly allocated threads. Synthetic benchmarks can get you a penalty from anywhere from 1.001x and beyond 2x. Your workload also influences which mitigations you can safely turn off. If you're running a single-tenant system and don't need isolated security domains then you can turn them off. Future software improvements (io_uring!) may also recover some of those losses.

cookiecaper 7y ago
>If you're running a single-tenant system and don't need isolated security domains then you can turn them off. This is the dirty secret that no one will let out because its ramifications on "the cloud" are very serious, and Microsoft, Amazon, et al have staked their futures on rent-seeking via cloud. These hardware bugs make the risks of multi-tenancy incontrovertible, and I would expect enterprise security departments to be clamoring for the return of hardware control. My popcorn is out to watch as the frantic inquisition against cloud heretics kicks into high[er] gear.
- kccqzy 7y ago
  What? Single-tenancy and the cloud are pretty orthogonal. I can request single-tenant machines on EC2; they just cost more. But I still have the benefit of being able to create and delete an instance in just minutes.
  - cookiecaper 7y ago
    Multi-tenant is the cloud's linchpin and it's disingenuous to pretend otherwise. The offerings of and outlook for cloud providers would be very different without multi-tenancy. While single-tenant options may be available for some configurations, you'll pay through the nose, and there are many limitations (e.g., EBS-backed volumes attached to your single-tenant instances still run on multi-tenant hosts). Moreover, few if any of the managed cloud services, which are what really drive cloud adoption, have any concept of single tenancy. Even after all this, the risk is only partially mitigated, because you're trusting Amazon's management toolkit and staff to respect these boundaries and to not have any bugs that may inadvertently expose access or data to third parties. Considering single-tenancy is such a small segment of their business, I doubt this is a major consideration, and even if it is, it's a lot of eggs to put into a basket that's completely out of your control. There just isn't much of an argument for a group that's serious about security to commit hardcore to "the cloud", yet virtually every company I've encountered in the last few years is pushing this hard, and actively ostracizing anyone who tries to inject some moderation or sanity into it. I appreciate the convenience of cloud offerings as much as the next guy, but it's out of control, and the complete disregard for the implications of hardware bugs that fundamentally undermine the supposed security model is a great representation of that.
mort96 7y ago
I don't know that there are many computers out there which don't need isolated security domains. Users run javascript all the time, cloud servers obviously need security domains, regular bare metal servers generally run internet-facing applications such as web servers as unprivileged users in case they contain RCE bugs.
- kccqzy 7y ago
  High performance computing, machine learning training servers, CI/CD build servers, most database servers, home media servers, computers for industrial control, etc.

citilife 7y ago

It looks like there is generally a 18% - 40% performance hit with meltdown[1]: > On Linux distributions like Ubuntu 18.10 and Clear Linux the mitigation costs were about ~18% while both RHEL 8 Beta and openSUSE 15.0 had a nearly 40% hit. If we look at MDS mitigation for older MACs[2], it could be 40%: > Intel MDS Vulnerabilities Affecting 7th Gen And Below May Slow Macs By Up To 40%, Apple Warns If we look at MDS mitigation generally (if Intel is to be believed) we are looking at ~10% for most use cases[3] > Intel's benchmarks show a 6-14 percent drop in storage performance on a couple of Xeon processors, both with Hyper Threading enabled. Assuming that Intel is not showing a worst case scenario in any of these benchmarks, the hit to storage could be even bigger. > It's in workstations and data centers that mitigations are likely to have the biggest performance impact, depending on the workload. In a separate graph, for example, Intel shows a 19 percent drop in "server side Java" performance after disabling Hyper Threading on a Xeon Platinum 8180 processor (compared to having it turned on). In other words... total I have no idea what we'll be seeing. However, if we don't look at just "raw performance" in benchmarks when buying CPUs, AMD is likely a better purchase for most use cases at this point. [1] https://www.phoronix.com/scan.php?page=article&item=spec-melt-8way&num=2 https://www.phoronix.com/scan.php?page=article&item=spec-mel... [2] https://wccftech.com/intel-mds-vulnerabilities-affecting-7th-gen-and-below-may-slow-macs-by-up-to-40-apple-warns/ https://wccftech.com/intel-mds-vulnerabilities-affecting-7th... [3] https://www.pcgamer.com/intel-posts-benchmarks-showing-performance-impact-of-new-cpu-flaws/ https://www.pcgamer.com/intel-posts-benchmarks-showing-perfo...

the8472 7y ago
Phoronix just released new benchmarks covering MDS mitigations and the combined costs of all mitigations . https://www.phoronix.com/scan.php?page=article&item=mds-zombieload-mit&num=1 https://www.phoronix.com/scan.php?page=article&item=mds-zomb...
- nullwasamistake 7y ago
  For the lazy: "If looking at the geometric mean for the tests run today, the Intel systems all saw about 16% lower performance out-of-the-box now with these default mitigations and obviously even lower if disabling Hyper Threading for maximum security. The two AMD systems tested saw a 3% performance hit with the default mitigations. While there are minor differences between the systems to consider, the mitigation impact is enough to draw the Core i7 8700K much closer to the Ryzen 7 2700X and the Core i9 7980XE to the Threadripper 2990WX." Not looking good for Intel at the moment. It should also be noted that there's believable rumors that the mitigations are not fully effective unless hyperthreading is disabled.

bArray 7y ago

I would be very interested to see those numbers arrogated, I have no idea whether these numbers are percentages of 100% original CPU performance or percentages of the remaining performance from the last bug. Either way, that's some serious performance loss. Even your normal light-weight users are going to start noticing slowdown. It appears as if nobody at Intel is doing anything other than cursory security analysis of processors. So far the cost has been performance, but I imagine there may be some bugs without micro-code mitigation. Not only this but it appears to be only a matter of time until Intel ME is broken too.

writelikeaYou 7y ago
Why do you write like a moron? Use normal language instead of coming across like a piece of skit. You think it looks great but it looks like skit. And I am way more intelligent than you. Drop all the imposter syndrome bullskits. It's for your own good. You look like a tediot. In all walks of life. Please readjust and reassess.