6 ms·

MDS Mitigation Costs on an Intel Dual Core and HT Laptop

132 points by monort 7y ago

polskibus 7y ago
Would love to see similar in-depth analyses for Windows and MacOS. 25% perf loss in everyday work is a lot.
tompic823 7y ago
> Context switching on this Core i7 Broadwell CPU takes seven times longer since these mitigations. Wow. This is of course a laptop, but anything remotely IO intensive is going to seriously suffer. Does anyone know the context switch delta for desktop and server processors?
atemerev 7y ago
Spectre/Meltdown is a serious problem, but they matter only in shared environments (virtual hosting with multiple accounts per physical machine). Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/
- als0 7y ago
  It does exist in single user environments. What about a desktop/phone that runs untrusted code? e.g. every browser that supports JavaScript.
  - atemerev 7y ago
    Yes, and this code is contained within the Javascript engine. Mitigations could be enabled only there.
    - danarmak 7y ago
      Disabling HT can't be done per-process. Since per-frame browser processes need to be protected from one another, you can't even run two browser processes on the same core in HT. And scheduling a browser process while leaving the second HT slot on the same core empty is even slower than turning HT off.
      - gmueckl 7y ago
        Somebody please explain to me why ripping out the JS JIT wouldn't work.
        dfrage 7y ago
        In the most recent discussion of this it was reported that is no longer an easy option with Firefox: https://news.ycombinator.com/item?id=20012750 https://news.ycombinator.com/item?id=20012750 There's also a general impression that would be too slow for many web pages, and that comment noted it took minutes for logins using JavaScript cryptography to execute.
        gpderetta 7y ago
        It seems to me that most people will be willing to pay for slower js as opposed to an overall slower system.
        zzzcpan 7y ago
        Does it even need to be slower? Almost every single website out there is not a javascript app and so side channel attacks can be mitigated by simply having an rlimit-style CPU time limit after say a user action on a tab.
    - zzzcpan 7y ago
      Browsers rely on kernel/hardware mitigations. Google people even claimed it's impossible to fully mitigate those vulnerabilities in existing Javascript implementation in Chrome.
- danieldk 7y ago
  Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). Most desktops and laptops run a boatload of untrusted code in the form of JavaScript.
  - atemerev 7y ago
    How about enabling mitigations in Javascript engines?
    - danarmak 7y ago
      There aren't such mitigations to enable. There aren't even purely software kernel-level mitiations.
      - atemerev 7y ago
        > There aren't even purely software kernel-level mitiations. Some are there, otherwise they couldn't be disabled in Linux kernel for faster performance. Which means that they could be enabled on demand.
        danarmak 7y ago
        Some are there, yes, but they're insufficient to provide security. You need both them, and the microcode changes, and to disable HT. I'm not sure what if anything the software changes do alone, they may mitigate some of the attacks, but not all of them.
    - ggg2 7y ago
      why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have no control. You probably have apps in your phone runnig rigth now that ship with their own JS engine for advertising purposes. Do you expect them to have all the necessary safeguards?
    - 7y ago
- geofft 7y ago
  > P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ I like this website because, like its namesake, it promotes a simplistic solution to a symptom of an underlying problem, as if the symptom were itself the problem, in a manner that appeals to those who believe that a just world only has simple problems with simple solutions, and with no discussion of unintended consequences and serious security risks and no consideration of why those who have actually studied the problem in depth advocate different, more complicated solutions.
- tasubotadas 7y ago
  Is there a way to do the same for windows?
_Understated_ 7y ago
From a purely non-scientific standpoint my Latitude E7470 performance is below an acceptable threshold now. FWIW: I haven't done any benchmarks - This is purely anecdotal! I use VS 2017 / 2019 and the performance is definitely taken a noticeable hit since the last BIOS update. Opening projects is slow but once they're open the processor is pegged for longer and when using intellisense the process is pegged for longer now too. It's at the point where I looked to replace it even though it was fine up until Jan/Feb this year. I tried backing out the BIOS update but it failed so I am stuck with it now. I even bought a NVMe SSD which helped with IO a bit, and upped the RAM to 16GB but the processor is a huge bottleneck now. It is bad enough that I even had a Surface Book 2 15" for a week to test it and its performance is rotten as well so I returned it My desktop with an 8700K O/C to 5GHz hasn't had a BIOS update since early 2018 (I think) and is instantaneous for most things: needless to say, I have no intention of updating it. This is bad for Intel... really bad imo. Edit: Added the NVMe and RAM bit.
- acdha 7y ago
  This may be a vendor issue: I have a fully-patched Mac and while there are regressions in benchmarks it’s never noticeable in normal usage.
  - pdimitar 7y ago
    Can you please add details? Which Mac exactly? And which benchmarks have been observably slower? I am pondering an iMac Pro and since it's gonna be a huge investment, I am trying to gather some information and see if its Xeon-W 2195 (18 cores) CPU will be heavily hit by the mitigations.
    - washadjeffmad 7y ago
      For most processing tasks like render, the effect will be negligible. Syscall heavy workloads we saw dip up to 50% on all pre-NVMe models with under 4 cores in both the U and HQ series. The practical effect was up to 10 minute logins for new users and glacial access times on models prior to 2017. We have 6 mid spec'd iMac Pros ($8-11,000/pc), and unless it's being purchased for you, they're a hard product to justify. With the same budget, I usually recommend building a 1-2U half rack node for compute and getting an LG OLED or Flanders Scientific display if you're doing anything VFX related. For half the expense, you can get equivalent or better specs and invest more where you actually need it. We buy Macs mostly to remote into other machines built to do the work. It's more economical and much less frustrating.
jnordwick 7y ago
De we even have a Proof of concept for the MDS attacks (one that doesn't require other thread to be writing the same data over and over in a loop)? So much of this seems driven by Intel hate, and while hardware manufacturers should work on mitigation, it shouldn't be done at the expense of performance, especially for machines that don't run untrusted code (even then, I'm not sure it should be done unless the cost is extremely minimal). JavaScript/WASM is being used as a bogey man, when the overwhelming evidence is that it just isnt possible to exploit the browser with enough consistency to make it work when not assisted. The meltdown POC was more a "look at this neat thing I an do if I set everything up perfectly" - set up to such an artificial extent that it wasn't even applicable to any computer system. The the one MDS attack I saw required the target to repeatedly write the same byte of memory in loop while being attacked. This isn't going to happen. These MDS attacks at best seem to be able to pick fairly random bytes, and they can only do it while the data they are snooping on is in the load/store buffer, so they can't even run the number of times required to exfiltrate the data consistently. I haven't seen a single piece of code that will, for example, grap SSH keys from a running ssh program using one of these attacks. From Javascript in a browser? LOL. While these are very cool and interesting, they arent anything to be worried about, especially if you don't run a cloud service. Oh, but right, Intel hate.
- rayiner 7y ago
  The Intel hate is really misdirected. The entire industry had an incorrect mental model of what process isolation required. All that an x86 CPU promises is that you will get a page fault if you try to access privileged memory. That’s it, and it’s not sufficient for process isolation in the face of malicious code. JavaScript/WASM VMs assumed more or less the same thing. So long as you can catch any out-of-bound array reads or the like, you have a safe “sandbox.” Again, that assumption was insufficient. It wasn’t just Intel and JavaScript developers either. Entire bodies of research were dedicated to techniques that likely would be vulnerable to these sorts of attacks. For example, the idea that you could do away with CPU memory protection if you ran everything in a managed language that makes it impossible to access arbitrary memory. What you’re seeing as a paradigm shift in what kinds of process isolation are required for modern computing.
mycall 7y ago
Does the new Windows 10 sandbox feature help mitigate Meltdown/MDS?

132 points by monort 7y ago

Would love to see similar in-depth analyses for Windows and MacOS. 25% perf loss in everyday work is a lot.

> Context switching on this Core i7 Broadwell CPU takes seven times longer since these mitigations. Wow. This is of course a laptop, but anything remotely IO intensive is going to seriously suffer. Does anyone know the context switch delta for desktop and server processors?

atemerev 7y ago

Spectre/Meltdown is a serious problem, but they matter only in shared environments (virtual hosting with multiple accounts per physical machine). Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/

als0 7y ago
It does exist in single user environments. What about a desktop/phone that runs untrusted code? e.g. every browser that supports JavaScript.
- atemerev 7y ago
  Yes, and this code is contained within the Javascript engine. Mitigations could be enabled only there.
  - danarmak 7y ago
    Disabling HT can't be done per-process. Since per-frame browser processes need to be protected from one another, you can't even run two browser processes on the same core in HT. And scheduling a browser process while leaving the second HT slot on the same core empty is even slower than turning HT off.
    - gmueckl 7y ago
      Somebody please explain to me why ripping out the JS JIT wouldn't work.
      - dfrage 7y ago
        In the most recent discussion of this it was reported that is no longer an easy option with Firefox: https://news.ycombinator.com/item?id=20012750 https://news.ycombinator.com/item?id=20012750 There's also a general impression that would be too slow for many web pages, and that comment noted it took minutes for logins using JavaScript cryptography to execute.
        gpderetta 7y ago
        It seems to me that most people will be willing to pay for slower js as opposed to an overall slower system.
        zzzcpan 7y ago
        Does it even need to be slower? Almost every single website out there is not a javascript app and so side channel attacks can be mitigated by simply having an rlimit-style CPU time limit after say a user action on a tab.
  - zzzcpan 7y ago
    Browsers rely on kernel/hardware mitigations. Google people even claimed it's impossible to fully mitigate those vulnerabilities in existing Javascript implementation in Chrome.
danieldk 7y ago
Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). Most desktops and laptops run a boatload of untrusted code in the form of JavaScript.
- atemerev 7y ago
  How about enabling mitigations in Javascript engines?
  - danarmak 7y ago
    There aren't such mitigations to enable. There aren't even purely software kernel-level mitiations.
    - atemerev 7y ago
      > There aren't even purely software kernel-level mitiations. Some are there, otherwise they couldn't be disabled in Linux kernel for faster performance. Which means that they could be enabled on demand.
      - danarmak 7y ago
        Some are there, yes, but they're insufficient to provide security. You need both them, and the microcode changes, and to disable HT. I'm not sure what if anything the software changes do alone, they may mitigate some of the attacks, but not all of them.
  - ggg2 7y ago
    why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have no control. You probably have apps in your phone runnig rigth now that ship with their own JS engine for advertising purposes. Do you expect them to have all the necessary safeguards?
  - 7y ago
geofft 7y ago
> P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ I like this website because, like its namesake, it promotes a simplistic solution to a symptom of an underlying problem, as if the symptom were itself the problem, in a manner that appeals to those who believe that a just world only has simple problems with simple solutions, and with no discussion of unintended consequences and serious security risks and no consideration of why those who have actually studied the problem in depth advocate different, more complicated solutions.
tasubotadas 7y ago
Is there a way to do the same for windows?

_Understated_ 7y ago

From a purely non-scientific standpoint my Latitude E7470 performance is below an acceptable threshold now. FWIW: I haven't done any benchmarks - This is purely anecdotal! I use VS 2017 / 2019 and the performance is definitely taken a noticeable hit since the last BIOS update. Opening projects is slow but once they're open the processor is pegged for longer and when using intellisense the process is pegged for longer now too. It's at the point where I looked to replace it even though it was fine up until Jan/Feb this year. I tried backing out the BIOS update but it failed so I am stuck with it now. I even bought a NVMe SSD which helped with IO a bit, and upped the RAM to 16GB but the processor is a huge bottleneck now. It is bad enough that I even had a Surface Book 2 15" for a week to test it and its performance is rotten as well so I returned it My desktop with an 8700K O/C to 5GHz hasn't had a BIOS update since early 2018 (I think) and is instantaneous for most things: needless to say, I have no intention of updating it. This is bad for Intel... really bad imo. Edit: Added the NVMe and RAM bit.

acdha 7y ago
This may be a vendor issue: I have a fully-patched Mac and while there are regressions in benchmarks it’s never noticeable in normal usage.
- pdimitar 7y ago
  Can you please add details? Which Mac exactly? And which benchmarks have been observably slower? I am pondering an iMac Pro and since it's gonna be a huge investment, I am trying to gather some information and see if its Xeon-W 2195 (18 cores) CPU will be heavily hit by the mitigations.
  - washadjeffmad 7y ago
    For most processing tasks like render, the effect will be negligible. Syscall heavy workloads we saw dip up to 50% on all pre-NVMe models with under 4 cores in both the U and HQ series. The practical effect was up to 10 minute logins for new users and glacial access times on models prior to 2017. We have 6 mid spec'd iMac Pros ($8-11,000/pc), and unless it's being purchased for you, they're a hard product to justify. With the same budget, I usually recommend building a 1-2U half rack node for compute and getting an LG OLED or Flanders Scientific display if you're doing anything VFX related. For half the expense, you can get equivalent or better specs and invest more where you actually need it. We buy Macs mostly to remote into other machines built to do the work. It's more economical and much less frustrating.

jnordwick 7y ago

De we even have a Proof of concept for the MDS attacks (one that doesn't require other thread to be writing the same data over and over in a loop)? So much of this seems driven by Intel hate, and while hardware manufacturers should work on mitigation, it shouldn't be done at the expense of performance, especially for machines that don't run untrusted code (even then, I'm not sure it should be done unless the cost is extremely minimal). JavaScript/WASM is being used as a bogey man, when the overwhelming evidence is that it just isnt possible to exploit the browser with enough consistency to make it work when not assisted. The meltdown POC was more a "look at this neat thing I an do if I set everything up perfectly" - set up to such an artificial extent that it wasn't even applicable to any computer system. The the one MDS attack I saw required the target to repeatedly write the same byte of memory in loop while being attacked. This isn't going to happen. These MDS attacks at best seem to be able to pick fairly random bytes, and they can only do it while the data they are snooping on is in the load/store buffer, so they can't even run the number of times required to exfiltrate the data consistently. I haven't seen a single piece of code that will, for example, grap SSH keys from a running ssh program using one of these attacks. From Javascript in a browser? LOL. While these are very cool and interesting, they arent anything to be worried about, especially if you don't run a cloud service. Oh, but right, Intel hate.

rayiner 7y ago
The Intel hate is really misdirected. The entire industry had an incorrect mental model of what process isolation required. All that an x86 CPU promises is that you will get a page fault if you try to access privileged memory. That’s it, and it’s not sufficient for process isolation in the face of malicious code. JavaScript/WASM VMs assumed more or less the same thing. So long as you can catch any out-of-bound array reads or the like, you have a safe “sandbox.” Again, that assumption was insufficient. It wasn’t just Intel and JavaScript developers either. Entire bodies of research were dedicated to techniques that likely would be vulnerable to these sorts of attacks. For example, the idea that you could do away with CPU memory protection if you ran everything in a managed language that makes it impossible to access arbitrary memory. What you’re seeing as a paradigm shift in what kinds of process isolation are required for modern computing.

mycall 7y ago

Does the new Windows 10 sandbox feature help mitigate Meltdown/MDS?