3 ms·

So can someone please explain to me if its better to use "mitigations=off" with Linux Kernel 5.10 or have the default from kernel with "AMD Phenom II X4 955 Pro

by tux 6y ago

So can someone please explain to me if its better to use "mitigations=off" with Linux Kernel 5.10 or have the default from kernel with "AMD Phenom II X4 955 Processor"? By running "lscpu" I see only two lines in default mode (not using "mitigations=off" right now), everything else "Not affected"; Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Full AMD retpoline, STIBP disabled, RSB filling By having those it will affect my CPU perferomance? Will applying "mitigations=off" help with perfermance? Also by having "mitigations=off" what are the real security implications? Thank you for your help!

grenoire 6y ago
It's really hard to define what a regular user is. You're your own commandeer and it's recommended that you try running benchmarks or using it under those two cases to determine if it's worth having mitigations or not. Considering all, the performance impact for your average Linux desktop user is likely not going to be unacceptable.
- flyinghamster 6y ago
  Exactly. I just tried shutting off mitigations on an old laptop running BOINC, triggering the benchmarks before and after shutting them off. It made no difference whatsoever - not surprising, since that's compute-bound and isn't likely to have lots of system calls. How much that translates to the running applications remains to be seen.
- alisonkisk 6y ago
  The performance part is either irrelevant or easy to measure. The security risk part is hard for most people to understand and make an informed decision. (Mitigation s ON is obviously safer, but even if I decide I want to go faster, I still don't understand the risk in taking.)
justaj 6y ago
Also, are MDS attacks mitigated or not? I seem to remember that on their website [0] it said that the mitigations were not possible or extremely hard, but now it says that Intel has released patches. I'm wondering if those patches actually mitigate MDS attacks. 0: https://mdsattacks.com/#ridl-ng https://mdsattacks.com/#ridl-ng
- tux 6y ago
  At least on my AMD processor by using default kernel 5.10 settings it says "Vulnerability Mds: Not affected". (EDIT) Honestly I did not notice any performance issues by NOT using "mitigation=off". Default kernel 5.10 settings seem to be working well enought. At least for my tasks :-) But than again, I'm not playing any games on it LOL
  - justaj 6y ago
    That's because AMD processors were never affected by MDS attacks in the first place.
dcolkitt 6y ago
One datapoint: We run our production HFT machines with migrations=off. Latency at the microsecond level is highly critical, and these machines don't have any public facing interface. This is obviously a niche case. But IMO, I can see similar calculus for other more mainstream use cases. I wouldn't turn migrations=off on a public facing web server. But if you have a cluster that does ETL data processing, it's probably CPU-bound and has very little externally exposed surface area. Arguably, even backend SQL servers can benefit, assuming the set of clients that directly access the dbase are tightly controlled and audited.
- ncmncm 6y ago
  Another: we do not. Our code runs with exactly zero system calls once it has finished starting up, so we never execute the code affected by mitigations. When every cycle counts, wasting them in the kernel is not a good idea anyhow. So, isolcpus and kernel bypass FTW.
- londons_explore 6y ago
  How many other "trade security for performance" options does Linux have? For example can you disable paging entirely and have all user code mix with kernel code as long as you trust all code not to segfault?

by tux 6y ago

grenoire 6y ago

It's really hard to define what a regular user is. You're your own commandeer and it's recommended that you try running benchmarks or using it under those two cases to determine if it's worth having mitigations or not. Considering all, the performance impact for your average Linux desktop user is likely not going to be unacceptable.

flyinghamster 6y ago
Exactly. I just tried shutting off mitigations on an old laptop running BOINC, triggering the benchmarks before and after shutting them off. It made no difference whatsoever - not surprising, since that's compute-bound and isn't likely to have lots of system calls. How much that translates to the running applications remains to be seen.
alisonkisk 6y ago
The performance part is either irrelevant or easy to measure. The security risk part is hard for most people to understand and make an informed decision. (Mitigation s ON is obviously safer, but even if I decide I want to go faster, I still don't understand the risk in taking.)

justaj 6y ago

Also, are MDS attacks mitigated or not? I seem to remember that on their website [0] it said that the mitigations were not possible or extremely hard, but now it says that Intel has released patches. I'm wondering if those patches actually mitigate MDS attacks. 0: https://mdsattacks.com/#ridl-ng https://mdsattacks.com/#ridl-ng

tux 6y ago
At least on my AMD processor by using default kernel 5.10 settings it says "Vulnerability Mds: Not affected". (EDIT) Honestly I did not notice any performance issues by NOT using "mitigation=off". Default kernel 5.10 settings seem to be working well enought. At least for my tasks :-) But than again, I'm not playing any games on it LOL
- justaj 6y ago
  That's because AMD processors were never affected by MDS attacks in the first place.

dcolkitt 6y ago

One datapoint: We run our production HFT machines with migrations=off. Latency at the microsecond level is highly critical, and these machines don't have any public facing interface. This is obviously a niche case. But IMO, I can see similar calculus for other more mainstream use cases. I wouldn't turn migrations=off on a public facing web server. But if you have a cluster that does ETL data processing, it's probably CPU-bound and has very little externally exposed surface area. Arguably, even backend SQL servers can benefit, assuming the set of clients that directly access the dbase are tightly controlled and audited.

ncmncm 6y ago
Another: we do not. Our code runs with exactly zero system calls once it has finished starting up, so we never execute the code affected by mitigations. When every cycle counts, wasting them in the kernel is not a good idea anyhow. So, isolcpus and kernel bypass FTW.
londons_explore 6y ago
How many other "trade security for performance" options does Linux have? For example can you disable paging entirely and have all user code mix with kernel code as long as you trust all code not to segfault?