9 ms·
For those that can't watch the video GregKH says that OpenBSD was right to disable hyper-threading earlier than Linux in response to Spectre and Meltdown and no
by robmusial 7y ago
For those that can't watch the video GregKH says that OpenBSD was right to disable hyper-threading earlier than Linux in response to Spectre and Meltdown and now Linux disables it too.
He also caveats it by saying they were right for "a little bit of the wrong reasons" but at least in this clip doesn't expand on what he meant by that or what those wrong reasons were or why they were wrong.
- deleted 7y ago[deleted]
- dooglius 7y agoWhy should the kernel be making this decision at all, rather than leaving it up to the distro or a command-line boot argument? EDIT: can't see the video so if it is just a default rather than a forced disablement that's fine.
- Canada 7y agodefaults matter
- admax88q 7y agoBecause sane defaults are important.
- Crinus 7y agoIsn't this a "sane" default only in specific contexts though? (VMs). For a desktop PC that almost always runs a single heavy task (games, rendering, video encoding, etc) hyperthreading can be a day and night difference.
- phaer 7y agoYess, "sane" is context-specific, but it's useful to err on the side of more security and less performance, rather than the other way round.
- beatgammit 7y agoExactly. If you need more performance, there's always something you can tune. It would be especially awesome if this could be enabled at runtime so it could be turned on when thing specific tasks, like rendering or compiling something big. Even better, it would be nice to lock that to specific processes (i.e. enable it on a few cores and lock privileged processes to those cores).
- sharpneli 7y agoOne must consider the potential damages that can happen when the default is wrong, as it’s nigh certain that people are going to be careless and not change it. If the desktop PC has wrong default the performance is bad. Still functional though. If in case of VM the default is wrong we will read another headline about how N million customers of $company got their personal data leaked.
- Crinus 7y agoI think we'll read such headlines regardless of that setting :-P. I'm actually wondering if there should be some sort of premade "profiles" when it comes to default settings. Debian for example is used in a lot of contexts so perhaps it'd make sense to have a way to ask you what sort of usage you'll do when installing and provide different defaults based on that (not just at the initial installation time but also when installing some package, the default settings would be based on the profile you chose).
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- beatgammit 7y agoIt's pretty easy to change a default, so it's completely reasonable for a gaming distro (say, SteamOS) to have different defaults than a server distro (say, CentOS). Most Linux distributions don't ship the kernel in it's default configuration anyway, so this would really only affect those who use the kernel directly from the source.
- admax88q 7y agoI can't imagine a desktop PC that is unlikely to ever be used to browse the web. Spectre and simliar mitigations like disabling hyper threading are required to properly isolate javascript. Defaults should be set for the lowest common denominator. A lay computer user shouldn't have to understand and make decisions upon things like this.
- x0x0 7y agoYour desktop PC is regularly running largely unverified code, some of it potentially hostile: all the javascript in your browser.
- cosarara 7y agoBrowsers have mitigations in place, don't they? Aren't they enough, at least on paper?
- mikedelfino 7y agoI can't provide proper citations right now but there has been working exploits of some the latest CPU bugs using just Javascript in a browser as if we're browsing regular websites.
- cosarara 7y agoIf you could provide citations at some other time that would be great!
- SAI_Peregrinus 7y agoNot if hyperthreading is enabled. The point is that it's a hardware flaw, so any software mitigations can be bypassed.
- cosarara 7y agoIs there a PoC exploit for current firefox that would work if I set mitigations=off and enable HT on linux, for instance?
- diegoperini 7y agoLol, amount of untrusted dll injections to mod, by default, unmoddable games; 3rd party VR tools and drivers; video and audio multiplexer drivers; compatibility drivers for normally unsupported console cameras/controllers etc; ultra demanding last gen console emulators; macro tools that are essentialy keyloggers; anti-cheat daemons running as admin to read memory of other processes; Windows gaming is wild! I literally sell my soul to gain a few more fps or immersion. Browser js looks almost too innocent in this whole mess.
- AndrewUnmuted 7y agoHT doesn't actually make video encoding go any faster. It just allows the system to remain more stable while performing some other task at the same time. You really should not be running other tasks on your system while encoding video, your encoder will need all the resources it can get.
- Wowfunhappy 7y agoUh, are you sure of that? My experience has been that x264, for instance, benefits greatly from hyperthreading. Hyperthreading allows you to queue up additional instructions (in a different thread) that the executor can switch to when it would otherwise be just waiting for the next instruction in the primary thread.
- AndrewUnmuted 7y agoYou are correct that x264 does benefit from hyperthreading. According to the devs, the speed increase is about 20% until you are on the veryfast or ultrafast presets, which at this point is usually bottlenecked by decode speed, and not the speed of the encode. In making my previous claim, I was limiting the concept of 'encoding' to the more old-school definition: lossless compression of media bytestreams. This would include things like HuffYUV, ProRes, etc. But to be fair, these days it is quite likely that even a few of the newer intermediate/mezzanine codecs benefit from hyperthreading. I'd edit my post to clarify but the edit window has passed.
- melicerte 7y agoHe also said: if you are running a system and you don't trust your users, you should definitively disable Hyperthreading. Hence I believe hyperthreading is an option disabled for sane defaults.
- Skunkleton 7y agoAre scripts loaded in a web browser considered "users". If so, don't most people run systems which cant trust all of their users?
- beatgammit 7y agoNo, the person using the browser that loads the scripts is the user. The user has the option to disable JavaScript, so they are responsible for whatever they allow to be run on the machine. If you don't trust yourself to use the web safely, then put limits on what a naughty script can do. One option is to disable hyperthreading.
- Skunkleton 7y agoThat's like saying that its the users fault if their box was compromised by heartbleed. You never know what exploits are out there.