24 ms·

Spectre mitigations murder userspace performance

405 points by hasheddan 5y ago

neilsimp1 5y ago
`mitigations=off` in your GRUB_CMDLINE_LINUX_DEFAULT to disable Spectre/Meltdown mitigations, in case anyone is wondering. This page has a pretty decent write-up on it: https://leochavez.org/index.php/2020/11/16/disabling-intel-and-amd-cpu-vulnerability-mitigations/ https://leochavez.org/index.php/2020/11/16/disabling-intel-a....
- dijit 5y ago
  I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the largest example I can think of. Right now there's a kind of herd immunity for these things, nobody would really attack spectre because everyone is running mitigations, but if you make the target large enough there will be working exploits. For isolated machines running trusted workloads (thinking: databases or webservers serving static content) then it's a really nice flag to have on-hand.
  - tyingq 5y ago
    Nice 3rd party toggle for windows: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm Or a Powershell script from MS: https://support.microsoft.com/en-us/topic/understanding-get-speculationcontrolsettings-powershell-script-output-fd70a80a-a63f-e539-cda5-5be4c9e67c04 https://support.microsoft.com/en-us/topic/understanding-get-...
    - rkagerer 5y ago
      I'd like some more technical details on what exactly InSpectre does (specifically for the Meltdown patch). e.g. Does it just flip a registry key? Rewrite a microcode patch somewhere? Couldn't find an explanation in the software (even under Show Tech Details) or on their site; could you point me to it? Also, do all the major browsers now have their own mitigations built in?
      - rkagerer 5y ago
        Answering my own Question #1: Looks like it sets values for FeatureSettingsOverride and FeatureSettingsOverrideMask under the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" registry key. FeatureSettingsOverride is a bit field where bit 0 controls the mitigation for CVE-2017-5715 (Spectre) and bit 1 controls it for CVE-2017-5754 (Meltdown). If the bit value is 0 the corresponding mitigation is enabled, if 1 it's disabled. FeatureSettingsOverrideMask is simply a mask to control which bits of FeatureSettingsOverride to apply. So, for example, FeatureSettingsOverride = 2 and FeatureSettingsOverrideMask = 3 would enable the Spectre mitigation (if available) and disable the Meltdown one. More info here: https://support.microsoft.com/en-us/topic/windows-server-guidance-to-protect-against-speculative-execution-side-channel-vulnerabilities-2f965763-00e2-8f98-b632-0d96f30c8c8e https://support.microsoft.com/en-us/topic/windows-server-gui... https://gist.github.com/daBONDi/6f86210e54c68e84e85372fc4d1f0d82 https://gist.github.com/daBONDi/6f86210e54c68e84e85372fc4d1f... Haven't checked if the program emits different behavior for other CPU's or OS versions.
        Datagenerator 5y ago
        Propitiatory big brother OS has some cryptic setting, so? Linux and BSD give the user all sorts of freedom Microsoft never will. Freedom to research the source, ability to disable telemetry if that would exist and so on.
        asdfasgasdgasdg 5y ago
        For anyone considering whether to disable these for desktop performance, I tried to do some research on how much it helps, at least for my workload. From what I was able to read, for gaming, the performance differences are negligible. There also seems to be some indication that disabling mitigations is also harmful to performance on more recent CPUs, since more and more of the mitigations are being baked into the silicon. https://www.reddit.com/r/intel/comments/kp6b6i/how_bad_is_it_to_disable_specter_and_meltdown/ https://www.reddit.com/r/intel/comments/kp6b6i/how_bad_is_it...
    - ncann 5y ago
      That Powershell script seems to show the current status only, and not have any option to turn the protections on/off?
  - IshKebab 5y ago
    Kind of feels like apps should opt in to (or out of) mitigations individually. Obviously a web browser needs it, but does Clang? VSCode? Zoom? Probably not.
    - dijit 5y ago
      Three main things here: 1) we can’t trust people to categorise their own apps because the incentive for performance over security is a trade off we’ve all made time and time again. 2) efforts to address mandatory access controls have a coloured history here: selinux and apparmor both have very low adoption rates no matter your personal anecdotes. 3) These mitigation’s are so thorough that it would be more expensive on performance to even _check_ per application than it would be just to enable it everywhere.
      - staticassertion 5y ago
        I don't think that (3) is true.
        dijit 5y ago
        How would you implement such a change? Considering that you have: A) some list of allowed applications/programs B) a run of this check on every syscall C) to be faster than a TLB flush
        staticassertion 5y ago
        I don't know but I can't imagine a highly predictable branch being slower than a TLB flush.
        dijit 5y ago
        Well consider the fact that checking a table of “ok” programs is a branch and a lookup in of itself.
  - dustingetz 5y ago
    your desktop is already rooted by Zoom
    - bostonsre 5y ago
      Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.
      - matsemann 5y ago
        I just changed company. Wish I could go back to Zoom. Google Meet is horrible. I have to open Chrome for all meetings, as it (probably intentionally) runs worse in other browsers. But even in Chrome there are issues. Some workloads (like running tests) can take 5x as long on my system if I'm sharing my screen on Meet. Making working with others more hassle than it should be.
        jacquesm 5y ago
        This is fair, but at least you're sure that when you close the window that it's gone and that is as far as I'm concerned its biggest feature. Oh, and that it seems to work well on all platforms.
        cj 5y ago
        “Close browser tab” - immediately exits a Google Meet. Closing a Zoom/Webex meeting, who knows since it’s still running in the background. I also like meetings sandboxed in a browser so weird things like “automatically take control of your screen and maximize window” doesn’t happen when someone in a Zoom meeting starts sharing their screen. Even at the expense of more CPU.
        teddyh 5y ago
  - josefx 5y ago
    > not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.
    - swiley 5y ago
      I'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.
      - alisonkisk 5y ago
        Code is data. Data is code.
        bruce343434 5y ago
        Viral bacteria are matter. Matter is viral bacteria.
        swiley 5y ago
        It's more or less impossible to express recursion (in the same ways you can with js) with pure css/html. If you want to be overly reductionist then you can argue nothing matters because your just staring at a box with lights in it.
    - dijit 5y ago
      I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy. I tend to agree with what you're saying but the ship has sailed very much and running without javascript is a losing proposition these days. (my web browser starts up with javascript disabled except for some whitelisted sites and it usually only takes 15 minutes for me to find something completely broken on the internet and re-enable javascript entirely).
  - temac 5y ago
    > I love that this is a toggle like this, having control of my system is why I love Linux. You can disable mitigations on Windows too.
    - SteveNuts 5y ago
      Yeah but the next update will probably turn it back on silently...
      - a1369209993 5y ago
        Unlikely; Windows updates (mostly) only turn things you disabled back on if they're harmful to you.
        saurik 5y ago
        Yeah: and disabling mitigations for an attack certainly wouldn't be considered "harmful" by anyone.
        toomanyducks 5y ago
        idk about this, my anecdotal experience suggests otherwise - irrelevant things (i.e., monitor resolutions, mouse acceleration curves, and I think DNS settings at one point) can be thrown around by updates a bit too frequently in my experience.
        Causality1 5y ago
        I have a tablet that was unusable before I installed WuMgr and blocked auto-updates because every 24 hours Windows Update would force-install a broken touchscreen driver. Windows Update is the single most embarrassing, half-assed software project of the 21st century.
  - porphyra 5y ago
    Phoronix has comprehensive benchmarks on the impact of spectre mitigations if you want to find out how much of a difference it will actually make before exposing your system: https://www.phoronix.com/scan.php?page=search&q=Spectre https://www.phoronix.com/scan.php?page=search&q=Spectre
  - kurikuri 5y ago
    >desktop executes untrusted and rather arbitrary code pretty often Aren’t the most affected group of users cloud users (and providers), not desktop users? I thought the biggest risk of specter attacks is the ability to glean information on other server residents who should be segmented off. There are many more concerns in user space which make attacking a desktop with specter pretty cumbersome for low reward wrt opportunity cost. The performance savings of speculative execution do seem to be worth the risk on a desktop IMO.
    - foobarbazetc 5y ago
      Yeah, this is mostly an issue in the cloud where you share SMT threads with other people.
      - chithanh 5y ago
        To be more precise, running different cloud customers on different SMT threads of the same core allows them to attack each other. This is also the case with Spectre-related vulnerabilities such as L1TF.
    - tcoff91 5y ago
      I was under the impression that spectre is is much more limited in scope than Meltdown. I think you have to be in a position to influence the execution of the program you are trying to extract information from. Like JavaScript engines running in browsers. One example is your JS can be used to get the browser to speculatively execute something that leaks data. I think that it’d be pretty hard for one VM to set up a spectre attack on another arbitrary VM. Meltdown however does expose everything.
    - tabokie 5y ago
      At least on AWS EC2, malicious neighbors won't be an issue. "This issue has been addressed for AWS hypervisors, and no instance can read the memory of another instance, nor can any instance read AWS hypervisor memory. We have not observed meaningful performance impact for the overwhelming majority of EC2 workloads."[1] [1] https://aws.amazon.com/speculative-execution-os-updates/ https://aws.amazon.com/speculative-execution-os-updates/
  - Abishek_Muthian 5y ago
    > I love that this is a toggle like this, having control of my system is why I love Linux. The need to keep telling this loud and clear for the manufacturers to hear is more needed now than ever since computers are becoming closed systems like smartphones and Manufacturers are claiming 'Customers not having to make hard decisions' to do so.
- nemetroid 5y ago
  In your kernel command line, to be more precise. If you use Grub as your boot loader, this can be achieved by adding it to GRUB_CMDLINE_LINUX_DEFAULT.
- amelius 5y ago
  What if your system is virtualized?
  - rbanffy 5y ago
    If you are pinned to a core, as non burstable instances should be, you are still pretty much vulnerable. Having noisy neighbours will pollute caches and make extracting data harder, but, eventually, everything will leak out. I’ve been thinking what would happen if cores would be pinned to separate security domains - all kernel processes run on one set of cores and user processes on others. I imagine microkernel OSs could go that way much easier. If kernel and user space communicate only by messages and shared data, there’s no reason they’d need to even share an ISA.
    - amelius 5y ago
      Isn't the entire memory hierarchy (caches) part of the problem?
      - rbanffy 5y ago
        Yes. You’d need to split caches by security context too.
        lanstin 5y ago
        Maybe each security context needs to be in its own cloud account and own network. Long ago it was an axiom that if you share a call stack in a process you trust each other. Perhaps the current truth is if you share hardware you trust each other.
        rbanffy 5y ago
        That should work with multiple services, but not in a user/kernel split as we have today.
- lumost 5y ago
  has there been any research on what hardware changes would be necessary to reclaim performance? I've noticed extreme stutter events on desktop OSX for the last 2 years. Would be curious if its related.
  - jodrellblank 5y ago
    Seems like there’s a lot of people with stuttering macOS https://apple.stackexchange.com/questions/245429/cursor-freezes-for-a-split-second-around-every-10-seconds https://apple.stackexchange.com/questions/245429/cursor-free... USB-C and USB 3.0 devices are one common cause, Bluetooth mouse interference by USB another, and external monitors after sleep/wake another.
    - desert_boi 5y ago
      https://apple.stackexchange.com/questions/407177/windowserver-high-cpu-using-external-monitor-big-sur/408444#408444 https://apple.stackexchange.com/questions/407177/windowserve... started happening in Big Sur to me.
    - davidwf 5y ago
      I know this is random but my Bluetooth mouse was driving me absolutely nuts, and this workaround (which involves a GUI instead of running some random script off the internet) was an absolute lifesaver: https://apple.stackexchange.com/questions/377853/macos-catalina-blueoothd-high-cpu-iobluetoothbroadcomschedulerworkaround-issue?rq=1 https://apple.stackexchange.com/questions/377853/macos-catal...
  - foobiekr 5y ago
    You can turn macOS into Windows 3.1 reading a floppy by mounting an SMB share with a ton of small files and running an rclone sync between it and an external drive that has previously completed a sync. The stat() operations make the kernel go crazy. It’s the most appalling thing I’ve seen and has been broken like this since Catalina where it arrived as a massive performance regression.
    - 5y ago
- BeeOnRope 5y ago
  It's worth noting that mitigations=off doesn't even restore all the performance, compared to kernel versions before Spectre mitigations were added at all. mitigations=off can only "patch out" some expensive instructions in the syscall path, or sometimes take a different path entirely, but it can't go back to the simple code before this was added in the first place. It also can't undo effects of compiler flags like -mindirect-branch which change the compiled code. I haven't tested it recently, but when I looked at this more than a year ago, the numbers for a simple syscall (which doesn't do much work beyond the syscall mechanics itself) were something like 130ns, 250ns, 700ns for a "pre mitigation kernel", "new kernel with mitigations=off" and "new kernel with mitigations=on". Some of the numbers have improved since then as better mitigations have been found, and/or improved CPU support for mitigations via microcode updates.
- blarg1 5y ago
  I wonder if I would be safe to use this if I removed all my sensitive passwords from the browser's password manager and/or harddrive? Does anyone know what is at risk from these exploits?
nickpeterson 5y ago
I’ve made similar comments in the past but I think we’re just trying to predict too much about what programs are trying to do in hardware. I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Most of the real slowdowns anyone has in day to day performance has more to do with inefficient code than hardware anyways. Look at old game consoles (like a regular old PlayStation) and what they were able to render on what today would be laughably slow hardware. They could do it because developers learned the stack inside and out. I’m hopeful that the emergence of arm as a desktop/server competitor will help in some ways by putting enough pressure on companies like intel to really rethink some of their core stuff, but who knows.
- mkr-hn 5y ago
  See: racing the beam https://www.youtube.com/watch?v=sJFnWZH5FXc https://www.youtube.com/watch?v=sJFnWZH5FXc The things they did with 128 bytes of RAM were amazing.
- UncleMeat 5y ago
  > I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Turning off speculative execution reduces performance enormously. Yes, code is often less efficient than it could be but "surprise, you need 5x as large of a datacenter because your hardware isn't doing fancy stuff" is not going to be an acceptable thing for any large organization.
  - icegreentea2 5y ago
    More specifically, we should point out that speculative execution is important for papering over IO/memory latency. We can incant all we want about 'inefficient code', but the compute vs memory latency imbalance is a whole different beast.
  - infogulch 5y ago
    I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.
FunnyLookinHat 5y ago
Should we have a debate as to whether or not Spectre mitigations matter for some (or all) desktop computers? I know that, theoretically, I could install a piece of software on my Linux box that is malware and could try to read my memory via those methods, but let's be honest - we're all mostly concerned with servers that run code for dozens or hundreds of different clients. I'm a foil hat as much as the next - security is of the utmost concern to me, but for once I actually just don't care and would take the performance back on my local dev machine.
- thanksforfish 5y ago
  Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-concept-shows-how-dangerous-these-attacks-can-be/ https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.
  - netr0ute 5y ago
    That's what JavaScript blockers like NoScript and uBlock Origin are for.
    - diegocg 5y ago
      Ad blockers can not know if a JavaScript algorithm is dangerous or not
      - netr0ute 5y ago
        People do, and the JS algorithms will get added to adblocker lists in no time.
      - a1369209993 5y ago
        It doesn't matter if it's dangerous or not if it doesn't get to run in the first place.
nerdponx 5y ago
Who is ultimately at risk because of Spectre and Meltdown? What additional risks am I taking on by disabling mitigations?
- dijit 5y ago
  The scope of the potential damage is rather huge and can't really be overstated. It's akin to handing over your entire working OS memory to a person, complete with all encryption keys, session tokens and whatever documents you're working on. Potentially, anyway. The working proof-of-concept attacks I've seen use a lot of CPU to read memory and they read slowly, but those are proof-of-concepts and it would not be terribly difficult for a motivated person to make them significantly faster and less obvious.
  - thrower123 5y ago
    Has there ever been a real-world attack of this type? All kinds of things are possible, but you don't cut your leg off because theoretically you might possibly one day get gangrene from an ingrown toenail.
    - mhh__ 5y ago
      I assume the triple letters have done it, but these attacks require a lot of careful planning so why bother when you can exploit something else. That kind of protects us, but these exploits are terrifying for purveyors of homogenous interfaces (i.e. the cloud) that can be attacked in ways you are already imagining. Also, anyone deploying this won't be stupid enough to chat.
    - dijit 5y ago
      Yes there are working proofs of concept using JavaScript for this kind of attack. https://leaky.page/ https://leaky.page/ Is a good example The proof of concept code has been further mitigated by removing high precision timers from JavaScript in most/all browsers; however it is not terribly difficult to create code which bypasses that restriction. The only thing that’s prevented more investment into this method of attack is that it has essentially no value due to everyone being immune.
TheGuyWhoCodes 5y ago
This was very well known when the mitigations came out but I do wonder if they were too broad. sure mitigation in place for a platform that run untrusted code like a browser make sense but should it affect every program running? I know trust is fickle but at least for power user there should be an option to disable mitigation on a per program basis.
- zozbot234 5y ago
  > sure mitigation in place for a platform that run untrusted code like a browser make sense but should it affect every program running? The issue is that mainstream OS's are simply not designed to protect against information disclosure vulns like Spectre in a principled way. https://en.wikipedia.org/wiki/Multilevel_security https://en.wikipedia.org/wiki/Multilevel_security is a very well known approach academically but practical implementation is lacking. So we have to go with one-size-fits-all mitigations that treat all code as untrusted, and all data as potentially sensitive.
cheschire 5y ago
For interested Windows users, you can disable spectre and meltdown mitigations using InSpectre: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
kd913 5y ago
Is this agnostic to hardware? I thought Intel/AMD had different strategies regarding variants of spectre with AMD having specific solutions of retpoline. Without knowing the hardware, what is the point of the performance comparison?
- apgwoz 5y ago
  > Skylake, Linux 5.12
- yyyk 5y ago
  >Is this agnostic to hardware? Not agnostic at all. Newer processors have less bugs to work around, and instructions to speed up the workarounds, so the performance impact is smaller: https://www.phoronix.com/scan.php?page=article&item=3-years-specmelt&num=9 https://www.phoronix.com/scan.php?page=article&item=3-years-... The author's hardware is uniquely susceptible - Skylake is old enough to suggest Meltdown mitigation (the new Intel processors and of course AMD don't require it) in addition to Spectre mitigation, yet it's new enough to use indirect branching more thoroughly than Broadwell. If the author had older or newer hardware the performance effect would have been smaller. * It might be noted that there were Intel models betwen Skylake and the current which were still susceptible to meltdown. Even those had a smaller performance impact: https://www.pcgamesn.com/intel-security-patch-performance https://www.pcgamesn.com/intel-security-patch-performance
emilfihlman 5y ago
Can we have syscall chaining finally? Please? There is literally no reason why we couldn't have it.
- Filligree 5y ago
  Do you mean io_uring?
  - hinkley 5y ago
    Doesn’t that address fanout, not chaining? Chaining RPC calls requires something more sophisticated.
    - emilfihlman 5y ago
      Io_uring doesn't even address fanout if you mean writing the same data to multiple fds. Io_uring is just a way to have "do this and tell me when it's done" io.
  - emilfihlman 5y ago
    No. Io_uring is a message passing system where you tell the kernel to do something and let you know when it's done. Syscall chaining refers to having the kernel execute consecutive systemcalls without switching the context back to userspace. An example of this might be closing a multitude of file descriptors or registering signals or writing the same data to multiple fds etc, which becomes prohibitely expensive if you need to do it multiple times quickly, and actually doing it even once is really expensive if your sets are large.
    - quotemstr 5y ago
      > Syscall chaining refers to having the kernel execute consecutive systemcalls without switching the context back to userspace. io_uring already gives you that. You can submit multiple operations in a batch and link the operations together so that if one operation in a chain of linked operations fails, io_uring won't try to execute the rest.
mwcampbell 5y ago
The title here on HN is missing a crucial qualifier: "In The Presence Of Frequent Syscalls".
Verdex 5y ago
I have to say that I'm liking the technical discussion here. Although I am surprised that nobody has mentioned the meta topic about the word usage of the title. Like did I miss something and is "murder" actually legit jargon? Or is the author just being dramatic? (Article looked like "kills" would have been perfectly adequate and appropriate.)
- c7DJTLrn 5y ago
  https://en.wiktionary.org/wiki/superlative https://en.wiktionary.org/wiki/superlative
- akersten 5y ago
  Well, the marketing of these vulnerabilities was also bombastic and hyperbolic, so it follows that the retorts should employ similar language so they are taken just as seriously.
ghoward 5y ago
I would love to see new chips that take all of the transistors used for speculation and use them for more cores. I asked electrical engineers once how many of the transistors on a chip serve speculation, and they said, "To a first approximation, 100%." That means we could add a lot more cores. Add enough, and the OS could easily pin basically all processes/threads to their own cores. And that, I believe, might win some performance back. I have more ideas at [1]. [1]: https://gavinhoward.com/2020/02/computing-is-broken-and-how-to-fix-it/#hardware https://gavinhoward.com/2020/02/computing-is-broken-and-how-...
- btown 5y ago
  > take all of the transistors used for speculation and use them for more cores We have these - they're called GPUs! https://www.nvidia.co.uk/content/PDF/fermi_white_papers/P.Glaskowsky_NVIDIA%27s_Fermi-The_First_Complete_GPU_Architecture.pdf https://www.nvidia.co.uk/content/PDF/fermi_white_papers/P.Gl... provides a good overview (search the word "speculative"): > Since most of the circuitry within each core is dedicated to computation, rather than speculative features meant to enhance single-threaded performance, most of the die area and power consumed by Fermi goes into the application’s actual algorithmic work. But GPUs are far from easy to code for, even in 2021, and there are a lot of workloads that benefit from speculative branching. Having a combination of GPU cores and speculative CPU cores in an architecture allows you to access the best of both worlds.
- MauranKilom 5y ago
  > Add enough, and the OS could easily pin basically all processes/threads to their own cores. But usually (when you care about performance) you don't have 20 processes requiring 5% CPU load each, but 1-2 processes requiring everything. Making those slower won't accomplish much. And if your problem is actually embarrassingly parallel [0], you are looking to run your code on a GPU (as another commenter notes). [0]: https://en.wikipedia.org/wiki/Embarrassingly_parallel https://en.wikipedia.org/wiki/Embarrassingly_parallel
  - ghoward 5y ago
    I think you need to read my full blog post. :)
jerieljan 5y ago
Speaking of Spectre/Meltdown, are these mitigations also in place with Apple M1 Macs? I'm quite curious how Apple has handled these.
delduca 5y ago
https://make-linux-fast-again.com/ https://make-linux-fast-again.com/
- albntomat0 5y ago
  Since others may be curious, here is the discussion on those specific config changes: https://news.ycombinator.com/item?id=22830330 https://news.ycombinator.com/item?id=22830330
jfrunyon 5y ago
Here's the lesson: we hit the ceiling on our current technology a while ago. Developers continue to behave as though computing resources will continue growing as they used to, even though they've been stagnant for years.
- PedroBatista 5y ago
  That's not really true. I think your views are founded on the "moar Mhz moar performance" myth ( which is prevalent ), and Intel's decades old monopoly didn't help either, but if you compare 2 equivalent CPU's 10-15 years apart, there is no stagnation in performance. Maybe the old trick of cranking up the Mhz and call it a day doesn't work the way it used to, but in terms of performance results we are getting improvements.
  - deleted 5y ago
    [deleted]
  - jfrunyon 5y ago
    > Maybe the old trick of cranking up the Mhz and call it a day doesn't work the way it used to, but in terms of performance results we are getting improvements. Except... we aren't. Intel's CPUs haven't gotten significantly better in 4+ generations. AMD's have, but that's only because they were still catching up to Intel.
umanwizard 5y ago
… in the presence of frequent syscalls. This crucial qualification in the original title is missing from the HN title.
gok 5y ago
If your code is bottlenecked by syscall overhead, your performance was already murdered. Spectre mitigations are just stabbing the corpse.
- saagarjha 5y ago
  In this case the “murdered” software perfectly describes most web servers.
hinkley 5y ago
What’s the current benchmark situation with pre-spectre and post-specter hardware now? Is there vintage hardware that is now faster than contemporary hardware?
- seanalexander 5y ago
  There are 2011 MacBook Pro laptops that run as fast or faster than the most recent gen of Intel MBPs.
yyyk 5y ago
On the one hand, I haven't seen any real exploitation of Spectre, at least by a non-TLA. On the other hand, the mitigations aren't so slow anymore on a modern CPU: https://www.phoronix.com/scan.php?page=article&item=3-years-specmelt&num=9 https://www.phoronix.com/scan.php?page=article&item=3-years-... IMHO, there's a good argument for turning off the mitigations on Skylake in some systems - but in modern CPUs the cost of leaving the mitigations on is bearable.
- staticassertion 5y ago
  Yeah, kinda similar to rowhammer. I was just saying the other day that these exploit techniques are totally viable, but there's not much point - privesc is trivial on any desktop environment (linux or Windows, maybe less on osx), and usually not too hard on servers either. Fancy exploits aren't worth it when operating systems are so vulnerable to local attackers. That said, the mitigations are assurances, and it also lets us point a finger at intel and say "fix your shit you just caused a global performance regression".
  - lima 5y ago
    > linux or Windows, maybe less on osx Trivial on macOS, too. Smartphone operating systems are better (and ChromeOS).
kyledrake 5y ago
Honestly, I think it's time to reconsider the wisdom of allowing arbitrary untrustable third party executable code to run instantly in the form of things like JavaScript on web pages, instead of just nerf everyone's computer into molasses to prop up an idea that's been bad for the web anyways. I've been of this opinion for a while now, not just because of performance slowdowns and security issues, but also just because of the way JS on web sites has been reducing usability in the form of popups, bitcoin miners, playing videos, sudden redirects to phishing sites and whatever crazy things are out there now. I'm not saying get rid of JS, but treat it like it is - running code you can't trust. Web sites should start as largely static HTML documents that you read, and then if they need to use JS then they should be required to ask permission to do so, the same way any other executable code is managed in any other computing environment. That seems wild, but I think it's far less crazy than taking away a decade of performance improvements to the entire computing ecosystem by default so a broken security model can continue unquestioned.
- nhumrich 5y ago
  [Deleted]
  - staticassertion 5y ago
    I think virtually every Spectrev1 POC is browser based Javascript.
- staticassertion 5y ago
  You're basically saying "let's consider reinventing the internet", which I think is not reasonable or a good idea. I think one problem with the comments about this post is that they doesn't emphasize enough that the hit is to system call heavy workloads. This is NOT a global slowdown of all compute. The hit is to system call performance, and it's big, no question, but I don't think we need to throw out the internet's structure in order to address that. One option is to make fewer system calls. For a program that is basically scanning a file system that might be harder to do today, but for tons of other programs it isn't, and with iouring we have a very reasonable escape hatch for optimizing syscall heavy workloads. This might sound silly, but this sort of thing is constantly happening - programs are optimized for thinking something is fast and something else is slow. For example, if you built a program in the 2000s you'd do everything you can to avoid the disk, aggressively caching. In 2020 disks are insanely fast, and the cost of caching will be worse than just optimizing your disk usage. I don't know about the average website, but from what I can tell most sites that aren't total shit are pretty 'clean'. With an adblocker, especially so. > running code you can't trust We do that already. There's literally dozens of mitigations taken based on this.
Barrin92 5y ago
is there an actual number one can attach to at how much risk this puts me in practice? Say I'm an average user, writing softare, using the web, is it one in a million on any given day, on in a thousand? It's hard make judgements about whether to make these performance/security trade-offs without any real sense of how dangerous it is.
FranchuFranchu 5y ago
This is the kind of problems backwards compatible legacy processors cause.
- dredmorbius 5y ago
  Language should have explicit text ordering or concept precedence.
michaelmrose 5y ago
Is this equally true for AMD CPUs? Does the kernel offer different mitigations per CPU or one unified set of strategies?
winrid 5y ago
I wonder if this is part of why the M1 chip pulls ahead?
deleted 5y ago
[deleted]
Popegaf 5y ago
So if I understand this right, CPUs try to predict what operations are going to be made in order to gain performance, but instead introduced a vuln that killed performance? Wouldn't the logical thing be then to get rid of the predictions on hardware in order to be able to turn off these mitigations? Are there CPUs out there / being made without these SoC predictions?
- dkarras 5y ago
  I'm not sure if I got you right: The performance boost with speculative execution is massive. It introduces a vuln. It is the fix for that vuln that kills the performance.
  - Popegaf 5y ago
    What I'm saying is if the fix for the vuln negates the performance boost from speculative execucution, then the net outcome is 0 performance boost and speculative execution might as well be removed entirely. It wouldn't surprise me if it just costs more energy to keep the vuln and mitigation active at the same time.
    - SAI_Peregrinus 5y ago
      The fix doesn't negate the performance boost. It decreases it. But it's still nonzero boost.
- p_l 5y ago
  The techniques used to make CPUs fast have possible vulnureable areas (not all of it is due to Out-Of-Order Execution, some was due to optimizations made on top). The mitigations introduced stalls into those mechanism, clearing some of the state, resulting in slowdowns. However, the mitigations are not as big slowdowns as not having the speculative execution mechanism at all.
pvillano 5y ago
what's the moore's law of general performance? How many months/years did we lose? anecdotally, my next amd cpu+gpu upgrade at the same price point is about +30% 3dmark

405 points by hasheddan 5y ago

`mitigations=off` in your GRUB_CMDLINE_LINUX_DEFAULT to disable Spectre/Meltdown mitigations, in case anyone is wondering. This page has a pretty decent write-up on it: https://leochavez.org/index.php/2020/11/16/disabling-intel-and-amd-cpu-vulnerability-mitigations/ https://leochavez.org/index.php/2020/11/16/disabling-intel-a....

dijit 5y ago
I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the largest example I can think of. Right now there's a kind of herd immunity for these things, nobody would really attack spectre because everyone is running mitigations, but if you make the target large enough there will be working exploits. For isolated machines running trusted workloads (thinking: databases or webservers serving static content) then it's a really nice flag to have on-hand.
- tyingq 5y ago
  Nice 3rd party toggle for windows: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm Or a Powershell script from MS: https://support.microsoft.com/en-us/topic/understanding-get-speculationcontrolsettings-powershell-script-output-fd70a80a-a63f-e539-cda5-5be4c9e67c04 https://support.microsoft.com/en-us/topic/understanding-get-...
  - rkagerer 5y ago
    I'd like some more technical details on what exactly InSpectre does (specifically for the Meltdown patch). e.g. Does it just flip a registry key? Rewrite a microcode patch somewhere? Couldn't find an explanation in the software (even under Show Tech Details) or on their site; could you point me to it? Also, do all the major browsers now have their own mitigations built in?
    - rkagerer 5y ago
      Answering my own Question #1: Looks like it sets values for FeatureSettingsOverride and FeatureSettingsOverrideMask under the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" registry key. FeatureSettingsOverride is a bit field where bit 0 controls the mitigation for CVE-2017-5715 (Spectre) and bit 1 controls it for CVE-2017-5754 (Meltdown). If the bit value is 0 the corresponding mitigation is enabled, if 1 it's disabled. FeatureSettingsOverrideMask is simply a mask to control which bits of FeatureSettingsOverride to apply. So, for example, FeatureSettingsOverride = 2 and FeatureSettingsOverrideMask = 3 would enable the Spectre mitigation (if available) and disable the Meltdown one. More info here: https://support.microsoft.com/en-us/topic/windows-server-guidance-to-protect-against-speculative-execution-side-channel-vulnerabilities-2f965763-00e2-8f98-b632-0d96f30c8c8e https://support.microsoft.com/en-us/topic/windows-server-gui... https://gist.github.com/daBONDi/6f86210e54c68e84e85372fc4d1f0d82 https://gist.github.com/daBONDi/6f86210e54c68e84e85372fc4d1f... Haven't checked if the program emits different behavior for other CPU's or OS versions.
      - Datagenerator 5y ago
        Propitiatory big brother OS has some cryptic setting, so? Linux and BSD give the user all sorts of freedom Microsoft never will. Freedom to research the source, ability to disable telemetry if that would exist and so on.
      - asdfasgasdgasdg 5y ago
        For anyone considering whether to disable these for desktop performance, I tried to do some research on how much it helps, at least for my workload. From what I was able to read, for gaming, the performance differences are negligible. There also seems to be some indication that disabling mitigations is also harmful to performance on more recent CPUs, since more and more of the mitigations are being baked into the silicon. https://www.reddit.com/r/intel/comments/kp6b6i/how_bad_is_it_to_disable_specter_and_meltdown/ https://www.reddit.com/r/intel/comments/kp6b6i/how_bad_is_it...
  - ncann 5y ago
    That Powershell script seems to show the current status only, and not have any option to turn the protections on/off?
- IshKebab 5y ago
  Kind of feels like apps should opt in to (or out of) mitigations individually. Obviously a web browser needs it, but does Clang? VSCode? Zoom? Probably not.
  - dijit 5y ago
    Three main things here: 1) we can’t trust people to categorise their own apps because the incentive for performance over security is a trade off we’ve all made time and time again. 2) efforts to address mandatory access controls have a coloured history here: selinux and apparmor both have very low adoption rates no matter your personal anecdotes. 3) These mitigation’s are so thorough that it would be more expensive on performance to even _check_ per application than it would be just to enable it everywhere.
    - staticassertion 5y ago
      I don't think that (3) is true.
      - dijit 5y ago
        How would you implement such a change? Considering that you have: A) some list of allowed applications/programs B) a run of this check on every syscall C) to be faster than a TLB flush
        staticassertion 5y ago
        I don't know but I can't imagine a highly predictable branch being slower than a TLB flush.
        dijit 5y ago
        Well consider the fact that checking a table of “ok” programs is a branch and a lookup in of itself.
- dustingetz 5y ago
  your desktop is already rooted by Zoom
  - bostonsre 5y ago
    Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.
    - matsemann 5y ago
      I just changed company. Wish I could go back to Zoom. Google Meet is horrible. I have to open Chrome for all meetings, as it (probably intentionally) runs worse in other browsers. But even in Chrome there are issues. Some workloads (like running tests) can take 5x as long on my system if I'm sharing my screen on Meet. Making working with others more hassle than it should be.
      - jacquesm 5y ago
        This is fair, but at least you're sure that when you close the window that it's gone and that is as far as I'm concerned its biggest feature. Oh, and that it seems to work well on all platforms.
        cj 5y ago
        “Close browser tab” - immediately exits a Google Meet. Closing a Zoom/Webex meeting, who knows since it’s still running in the background. I also like meetings sandboxed in a browser so weird things like “automatically take control of your screen and maximize window” doesn’t happen when someone in a Zoom meeting starts sharing their screen. Even at the expense of more CPU.
        teddyh 5y ago
- josefx 5y ago
  > not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.
  - swiley 5y ago
    I'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.
    - alisonkisk 5y ago
      Code is data. Data is code.
      - bruce343434 5y ago
        Viral bacteria are matter. Matter is viral bacteria.
      - swiley 5y ago
        It's more or less impossible to express recursion (in the same ways you can with js) with pure css/html. If you want to be overly reductionist then you can argue nothing matters because your just staring at a box with lights in it.
  - dijit 5y ago
    I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy. I tend to agree with what you're saying but the ship has sailed very much and running without javascript is a losing proposition these days. (my web browser starts up with javascript disabled except for some whitelisted sites and it usually only takes 15 minutes for me to find something completely broken on the internet and re-enable javascript entirely).
- temac 5y ago
  > I love that this is a toggle like this, having control of my system is why I love Linux. You can disable mitigations on Windows too.
  - SteveNuts 5y ago
    Yeah but the next update will probably turn it back on silently...
    - a1369209993 5y ago
      Unlikely; Windows updates (mostly) only turn things you disabled back on if they're harmful to you.
      - saurik 5y ago
        Yeah: and disabling mitigations for an attack certainly wouldn't be considered "harmful" by anyone.
      - toomanyducks 5y ago
        idk about this, my anecdotal experience suggests otherwise - irrelevant things (i.e., monitor resolutions, mouse acceleration curves, and I think DNS settings at one point) can be thrown around by updates a bit too frequently in my experience.
      - Causality1 5y ago
        I have a tablet that was unusable before I installed WuMgr and blocked auto-updates because every 24 hours Windows Update would force-install a broken touchscreen driver. Windows Update is the single most embarrassing, half-assed software project of the 21st century.
- porphyra 5y ago
  Phoronix has comprehensive benchmarks on the impact of spectre mitigations if you want to find out how much of a difference it will actually make before exposing your system: https://www.phoronix.com/scan.php?page=search&q=Spectre https://www.phoronix.com/scan.php?page=search&q=Spectre
- kurikuri 5y ago
  >desktop executes untrusted and rather arbitrary code pretty often Aren’t the most affected group of users cloud users (and providers), not desktop users? I thought the biggest risk of specter attacks is the ability to glean information on other server residents who should be segmented off. There are many more concerns in user space which make attacking a desktop with specter pretty cumbersome for low reward wrt opportunity cost. The performance savings of speculative execution do seem to be worth the risk on a desktop IMO.
  - foobarbazetc 5y ago
    Yeah, this is mostly an issue in the cloud where you share SMT threads with other people.
    - chithanh 5y ago
      To be more precise, running different cloud customers on different SMT threads of the same core allows them to attack each other. This is also the case with Spectre-related vulnerabilities such as L1TF.
  - tcoff91 5y ago
    I was under the impression that spectre is is much more limited in scope than Meltdown. I think you have to be in a position to influence the execution of the program you are trying to extract information from. Like JavaScript engines running in browsers. One example is your JS can be used to get the browser to speculatively execute something that leaks data. I think that it’d be pretty hard for one VM to set up a spectre attack on another arbitrary VM. Meltdown however does expose everything.
  - tabokie 5y ago
    At least on AWS EC2, malicious neighbors won't be an issue. "This issue has been addressed for AWS hypervisors, and no instance can read the memory of another instance, nor can any instance read AWS hypervisor memory. We have not observed meaningful performance impact for the overwhelming majority of EC2 workloads."[1] [1] https://aws.amazon.com/speculative-execution-os-updates/ https://aws.amazon.com/speculative-execution-os-updates/
- Abishek_Muthian 5y ago
  > I love that this is a toggle like this, having control of my system is why I love Linux. The need to keep telling this loud and clear for the manufacturers to hear is more needed now than ever since computers are becoming closed systems like smartphones and Manufacturers are claiming 'Customers not having to make hard decisions' to do so.
nemetroid 5y ago
In your kernel command line, to be more precise. If you use Grub as your boot loader, this can be achieved by adding it to GRUB_CMDLINE_LINUX_DEFAULT.
amelius 5y ago
What if your system is virtualized?
- rbanffy 5y ago
  If you are pinned to a core, as non burstable instances should be, you are still pretty much vulnerable. Having noisy neighbours will pollute caches and make extracting data harder, but, eventually, everything will leak out. I’ve been thinking what would happen if cores would be pinned to separate security domains - all kernel processes run on one set of cores and user processes on others. I imagine microkernel OSs could go that way much easier. If kernel and user space communicate only by messages and shared data, there’s no reason they’d need to even share an ISA.
  - amelius 5y ago
    Isn't the entire memory hierarchy (caches) part of the problem?
    - rbanffy 5y ago
      Yes. You’d need to split caches by security context too.
      - lanstin 5y ago
        Maybe each security context needs to be in its own cloud account and own network. Long ago it was an axiom that if you share a call stack in a process you trust each other. Perhaps the current truth is if you share hardware you trust each other.
        rbanffy 5y ago
        That should work with multiple services, but not in a user/kernel split as we have today.
lumost 5y ago
has there been any research on what hardware changes would be necessary to reclaim performance? I've noticed extreme stutter events on desktop OSX for the last 2 years. Would be curious if its related.
- jodrellblank 5y ago
  Seems like there’s a lot of people with stuttering macOS https://apple.stackexchange.com/questions/245429/cursor-freezes-for-a-split-second-around-every-10-seconds https://apple.stackexchange.com/questions/245429/cursor-free... USB-C and USB 3.0 devices are one common cause, Bluetooth mouse interference by USB another, and external monitors after sleep/wake another.
  - desert_boi 5y ago
    https://apple.stackexchange.com/questions/407177/windowserver-high-cpu-using-external-monitor-big-sur/408444#408444 https://apple.stackexchange.com/questions/407177/windowserve... started happening in Big Sur to me.
  - davidwf 5y ago
    I know this is random but my Bluetooth mouse was driving me absolutely nuts, and this workaround (which involves a GUI instead of running some random script off the internet) was an absolute lifesaver: https://apple.stackexchange.com/questions/377853/macos-catalina-blueoothd-high-cpu-iobluetoothbroadcomschedulerworkaround-issue?rq=1 https://apple.stackexchange.com/questions/377853/macos-catal...
- foobiekr 5y ago
  You can turn macOS into Windows 3.1 reading a floppy by mounting an SMB share with a ton of small files and running an rclone sync between it and an external drive that has previously completed a sync. The stat() operations make the kernel go crazy. It’s the most appalling thing I’ve seen and has been broken like this since Catalina where it arrived as a massive performance regression.
  - 5y ago
BeeOnRope 5y ago
It's worth noting that mitigations=off doesn't even restore all the performance, compared to kernel versions before Spectre mitigations were added at all. mitigations=off can only "patch out" some expensive instructions in the syscall path, or sometimes take a different path entirely, but it can't go back to the simple code before this was added in the first place. It also can't undo effects of compiler flags like -mindirect-branch which change the compiled code. I haven't tested it recently, but when I looked at this more than a year ago, the numbers for a simple syscall (which doesn't do much work beyond the syscall mechanics itself) were something like 130ns, 250ns, 700ns for a "pre mitigation kernel", "new kernel with mitigations=off" and "new kernel with mitigations=on". Some of the numbers have improved since then as better mitigations have been found, and/or improved CPU support for mitigations via microcode updates.
blarg1 5y ago
I wonder if I would be safe to use this if I removed all my sensitive passwords from the browser's password manager and/or harddrive? Does anyone know what is at risk from these exploits?

nickpeterson 5y ago

I’ve made similar comments in the past but I think we’re just trying to predict too much about what programs are trying to do in hardware. I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Most of the real slowdowns anyone has in day to day performance has more to do with inefficient code than hardware anyways. Look at old game consoles (like a regular old PlayStation) and what they were able to render on what today would be laughably slow hardware. They could do it because developers learned the stack inside and out. I’m hopeful that the emergence of arm as a desktop/server competitor will help in some ways by putting enough pressure on companies like intel to really rethink some of their core stuff, but who knows.

mkr-hn 5y ago
See: racing the beam https://www.youtube.com/watch?v=sJFnWZH5FXc https://www.youtube.com/watch?v=sJFnWZH5FXc The things they did with 128 bytes of RAM were amazing.
UncleMeat 5y ago
> I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Turning off speculative execution reduces performance enormously. Yes, code is often less efficient than it could be but "surprise, you need 5x as large of a datacenter because your hardware isn't doing fancy stuff" is not going to be an acceptable thing for any large organization.
- icegreentea2 5y ago
  More specifically, we should point out that speculative execution is important for papering over IO/memory latency. We can incant all we want about 'inefficient code', but the compute vs memory latency imbalance is a whole different beast.
- infogulch 5y ago
  I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.

FunnyLookinHat 5y ago

Should we have a debate as to whether or not Spectre mitigations matter for some (or all) desktop computers? I know that, theoretically, I could install a piece of software on my Linux box that is malware and could try to read my memory via those methods, but let's be honest - we're all mostly concerned with servers that run code for dozens or hundreds of different clients. I'm a foil hat as much as the next - security is of the utmost concern to me, but for once I actually just don't care and would take the performance back on my local dev machine.

thanksforfish 5y ago
Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-concept-shows-how-dangerous-these-attacks-can-be/ https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.
- netr0ute 5y ago
  That's what JavaScript blockers like NoScript and uBlock Origin are for.
  - diegocg 5y ago
    Ad blockers can not know if a JavaScript algorithm is dangerous or not
    - netr0ute 5y ago
      People do, and the JS algorithms will get added to adblocker lists in no time.
    - a1369209993 5y ago
      It doesn't matter if it's dangerous or not if it doesn't get to run in the first place.

nerdponx 5y ago

Who is ultimately at risk because of Spectre and Meltdown? What additional risks am I taking on by disabling mitigations?

dijit 5y ago
The scope of the potential damage is rather huge and can't really be overstated. It's akin to handing over your entire working OS memory to a person, complete with all encryption keys, session tokens and whatever documents you're working on. Potentially, anyway. The working proof-of-concept attacks I've seen use a lot of CPU to read memory and they read slowly, but those are proof-of-concepts and it would not be terribly difficult for a motivated person to make them significantly faster and less obvious.
- thrower123 5y ago
  Has there ever been a real-world attack of this type? All kinds of things are possible, but you don't cut your leg off because theoretically you might possibly one day get gangrene from an ingrown toenail.
  - mhh__ 5y ago
    I assume the triple letters have done it, but these attacks require a lot of careful planning so why bother when you can exploit something else. That kind of protects us, but these exploits are terrifying for purveyors of homogenous interfaces (i.e. the cloud) that can be attacked in ways you are already imagining. Also, anyone deploying this won't be stupid enough to chat.
  - dijit 5y ago
    Yes there are working proofs of concept using JavaScript for this kind of attack. https://leaky.page/ https://leaky.page/ Is a good example The proof of concept code has been further mitigated by removing high precision timers from JavaScript in most/all browsers; however it is not terribly difficult to create code which bypasses that restriction. The only thing that’s prevented more investment into this method of attack is that it has essentially no value due to everyone being immune.

TheGuyWhoCodes 5y ago

This was very well known when the mitigations came out but I do wonder if they were too broad. sure mitigation in place for a platform that run untrusted code like a browser make sense but should it affect every program running? I know trust is fickle but at least for power user there should be an option to disable mitigation on a per program basis.

zozbot234 5y ago
> sure mitigation in place for a platform that run untrusted code like a browser make sense but should it affect every program running? The issue is that mainstream OS's are simply not designed to protect against information disclosure vulns like Spectre in a principled way. https://en.wikipedia.org/wiki/Multilevel_security https://en.wikipedia.org/wiki/Multilevel_security is a very well known approach academically but practical implementation is lacking. So we have to go with one-size-fits-all mitigations that treat all code as untrusted, and all data as potentially sensitive.

cheschire 5y ago

For interested Windows users, you can disable spectre and meltdown mitigations using InSpectre: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm

kd913 5y ago

Is this agnostic to hardware? I thought Intel/AMD had different strategies regarding variants of spectre with AMD having specific solutions of retpoline. Without knowing the hardware, what is the point of the performance comparison?

apgwoz 5y ago
> Skylake, Linux 5.12
yyyk 5y ago
>Is this agnostic to hardware? Not agnostic at all. Newer processors have less bugs to work around, and instructions to speed up the workarounds, so the performance impact is smaller: https://www.phoronix.com/scan.php?page=article&item=3-years-specmelt&num=9 https://www.phoronix.com/scan.php?page=article&item=3-years-... The author's hardware is uniquely susceptible - Skylake is old enough to suggest Meltdown mitigation (the new Intel processors and of course AMD don't require it) in addition to Spectre mitigation, yet it's new enough to use indirect branching more thoroughly than Broadwell. If the author had older or newer hardware the performance effect would have been smaller. * It might be noted that there were Intel models betwen Skylake and the current which were still susceptible to meltdown. Even those had a smaller performance impact: https://www.pcgamesn.com/intel-security-patch-performance https://www.pcgamesn.com/intel-security-patch-performance

emilfihlman 5y ago

Can we have syscall chaining finally? Please? There is literally no reason why we couldn't have it.

Filligree 5y ago
Do you mean io_uring?
- hinkley 5y ago
  Doesn’t that address fanout, not chaining? Chaining RPC calls requires something more sophisticated.
  - emilfihlman 5y ago
    Io_uring doesn't even address fanout if you mean writing the same data to multiple fds. Io_uring is just a way to have "do this and tell me when it's done" io.
- emilfihlman 5y ago
  No. Io_uring is a message passing system where you tell the kernel to do something and let you know when it's done. Syscall chaining refers to having the kernel execute consecutive systemcalls without switching the context back to userspace. An example of this might be closing a multitude of file descriptors or registering signals or writing the same data to multiple fds etc, which becomes prohibitely expensive if you need to do it multiple times quickly, and actually doing it even once is really expensive if your sets are large.
  - quotemstr 5y ago
    > Syscall chaining refers to having the kernel execute consecutive systemcalls without switching the context back to userspace. io_uring already gives you that. You can submit multiple operations in a batch and link the operations together so that if one operation in a chain of linked operations fails, io_uring won't try to execute the rest.

mwcampbell 5y ago

The title here on HN is missing a crucial qualifier: "In The Presence Of Frequent Syscalls".

Verdex 5y ago

I have to say that I'm liking the technical discussion here. Although I am surprised that nobody has mentioned the meta topic about the word usage of the title. Like did I miss something and is "murder" actually legit jargon? Or is the author just being dramatic? (Article looked like "kills" would have been perfectly adequate and appropriate.)

c7DJTLrn 5y ago
https://en.wiktionary.org/wiki/superlative https://en.wiktionary.org/wiki/superlative
akersten 5y ago
Well, the marketing of these vulnerabilities was also bombastic and hyperbolic, so it follows that the retorts should employ similar language so they are taken just as seriously.

ghoward 5y ago

I would love to see new chips that take all of the transistors used for speculation and use them for more cores. I asked electrical engineers once how many of the transistors on a chip serve speculation, and they said, "To a first approximation, 100%." That means we could add a lot more cores. Add enough, and the OS could easily pin basically all processes/threads to their own cores. And that, I believe, might win some performance back. I have more ideas at [1]. [1]: https://gavinhoward.com/2020/02/computing-is-broken-and-how-to-fix-it/#hardware https://gavinhoward.com/2020/02/computing-is-broken-and-how-...

btown 5y ago
> take all of the transistors used for speculation and use them for more cores We have these - they're called GPUs! https://www.nvidia.co.uk/content/PDF/fermi_white_papers/P.Glaskowsky_NVIDIA%27s_Fermi-The_First_Complete_GPU_Architecture.pdf https://www.nvidia.co.uk/content/PDF/fermi_white_papers/P.Gl... provides a good overview (search the word "speculative"): > Since most of the circuitry within each core is dedicated to computation, rather than speculative features meant to enhance single-threaded performance, most of the die area and power consumed by Fermi goes into the application’s actual algorithmic work. But GPUs are far from easy to code for, even in 2021, and there are a lot of workloads that benefit from speculative branching. Having a combination of GPU cores and speculative CPU cores in an architecture allows you to access the best of both worlds.
MauranKilom 5y ago
> Add enough, and the OS could easily pin basically all processes/threads to their own cores. But usually (when you care about performance) you don't have 20 processes requiring 5% CPU load each, but 1-2 processes requiring everything. Making those slower won't accomplish much. And if your problem is actually embarrassingly parallel [0], you are looking to run your code on a GPU (as another commenter notes). [0]: https://en.wikipedia.org/wiki/Embarrassingly_parallel https://en.wikipedia.org/wiki/Embarrassingly_parallel
- ghoward 5y ago
  I think you need to read my full blog post. :)

jerieljan 5y ago

Speaking of Spectre/Meltdown, are these mitigations also in place with Apple M1 Macs? I'm quite curious how Apple has handled these.

delduca 5y ago

https://make-linux-fast-again.com/ https://make-linux-fast-again.com/

albntomat0 5y ago
Since others may be curious, here is the discussion on those specific config changes: https://news.ycombinator.com/item?id=22830330 https://news.ycombinator.com/item?id=22830330

jfrunyon 5y ago

Here's the lesson: we hit the ceiling on our current technology a while ago. Developers continue to behave as though computing resources will continue growing as they used to, even though they've been stagnant for years.

PedroBatista 5y ago
That's not really true. I think your views are founded on the "moar Mhz moar performance" myth ( which is prevalent ), and Intel's decades old monopoly didn't help either, but if you compare 2 equivalent CPU's 10-15 years apart, there is no stagnation in performance. Maybe the old trick of cranking up the Mhz and call it a day doesn't work the way it used to, but in terms of performance results we are getting improvements.
- deleted 5y ago
  [deleted]
- jfrunyon 5y ago
  > Maybe the old trick of cranking up the Mhz and call it a day doesn't work the way it used to, but in terms of performance results we are getting improvements. Except... we aren't. Intel's CPUs haven't gotten significantly better in 4+ generations. AMD's have, but that's only because they were still catching up to Intel.

umanwizard 5y ago

… in the presence of frequent syscalls. This crucial qualification in the original title is missing from the HN title.

gok 5y ago

If your code is bottlenecked by syscall overhead, your performance was already murdered. Spectre mitigations are just stabbing the corpse.

saagarjha 5y ago
In this case the “murdered” software perfectly describes most web servers.

hinkley 5y ago

What’s the current benchmark situation with pre-spectre and post-specter hardware now? Is there vintage hardware that is now faster than contemporary hardware?

seanalexander 5y ago
There are 2011 MacBook Pro laptops that run as fast or faster than the most recent gen of Intel MBPs.

yyyk 5y ago

On the one hand, I haven't seen any real exploitation of Spectre, at least by a non-TLA. On the other hand, the mitigations aren't so slow anymore on a modern CPU: https://www.phoronix.com/scan.php?page=article&item=3-years-specmelt&num=9 https://www.phoronix.com/scan.php?page=article&item=3-years-... IMHO, there's a good argument for turning off the mitigations on Skylake in some systems - but in modern CPUs the cost of leaving the mitigations on is bearable.

staticassertion 5y ago
Yeah, kinda similar to rowhammer. I was just saying the other day that these exploit techniques are totally viable, but there's not much point - privesc is trivial on any desktop environment (linux or Windows, maybe less on osx), and usually not too hard on servers either. Fancy exploits aren't worth it when operating systems are so vulnerable to local attackers. That said, the mitigations are assurances, and it also lets us point a finger at intel and say "fix your shit you just caused a global performance regression".
- lima 5y ago
  > linux or Windows, maybe less on osx Trivial on macOS, too. Smartphone operating systems are better (and ChromeOS).

kyledrake 5y ago

Honestly, I think it's time to reconsider the wisdom of allowing arbitrary untrustable third party executable code to run instantly in the form of things like JavaScript on web pages, instead of just nerf everyone's computer into molasses to prop up an idea that's been bad for the web anyways. I've been of this opinion for a while now, not just because of performance slowdowns and security issues, but also just because of the way JS on web sites has been reducing usability in the form of popups, bitcoin miners, playing videos, sudden redirects to phishing sites and whatever crazy things are out there now. I'm not saying get rid of JS, but treat it like it is - running code you can't trust. Web sites should start as largely static HTML documents that you read, and then if they need to use JS then they should be required to ask permission to do so, the same way any other executable code is managed in any other computing environment. That seems wild, but I think it's far less crazy than taking away a decade of performance improvements to the entire computing ecosystem by default so a broken security model can continue unquestioned.

nhumrich 5y ago
[Deleted]
- staticassertion 5y ago
  I think virtually every Spectrev1 POC is browser based Javascript.
staticassertion 5y ago
You're basically saying "let's consider reinventing the internet", which I think is not reasonable or a good idea. I think one problem with the comments about this post is that they doesn't emphasize enough that the hit is to system call heavy workloads. This is NOT a global slowdown of all compute. The hit is to system call performance, and it's big, no question, but I don't think we need to throw out the internet's structure in order to address that. One option is to make fewer system calls. For a program that is basically scanning a file system that might be harder to do today, but for tons of other programs it isn't, and with iouring we have a very reasonable escape hatch for optimizing syscall heavy workloads. This might sound silly, but this sort of thing is constantly happening - programs are optimized for thinking something is fast and something else is slow. For example, if you built a program in the 2000s you'd do everything you can to avoid the disk, aggressively caching. In 2020 disks are insanely fast, and the cost of caching will be worse than just optimizing your disk usage. I don't know about the average website, but from what I can tell most sites that aren't total shit are pretty 'clean'. With an adblocker, especially so. > running code you can't trust We do that already. There's literally dozens of mitigations taken based on this.

Barrin92 5y ago

is there an actual number one can attach to at how much risk this puts me in practice? Say I'm an average user, writing softare, using the web, is it one in a million on any given day, on in a thousand? It's hard make judgements about whether to make these performance/security trade-offs without any real sense of how dangerous it is.

FranchuFranchu 5y ago

This is the kind of problems backwards compatible legacy processors cause.

dredmorbius 5y ago
Language should have explicit text ordering or concept precedence.

michaelmrose 5y ago

Is this equally true for AMD CPUs? Does the kernel offer different mitigations per CPU or one unified set of strategies?

winrid 5y ago

I wonder if this is part of why the M1 chip pulls ahead?

deleted 5y ago

[deleted]

Popegaf 5y ago

So if I understand this right, CPUs try to predict what operations are going to be made in order to gain performance, but instead introduced a vuln that killed performance? Wouldn't the logical thing be then to get rid of the predictions on hardware in order to be able to turn off these mitigations? Are there CPUs out there / being made without these SoC predictions?

dkarras 5y ago
I'm not sure if I got you right: The performance boost with speculative execution is massive. It introduces a vuln. It is the fix for that vuln that kills the performance.
- Popegaf 5y ago
  What I'm saying is if the fix for the vuln negates the performance boost from speculative execucution, then the net outcome is 0 performance boost and speculative execution might as well be removed entirely. It wouldn't surprise me if it just costs more energy to keep the vuln and mitigation active at the same time.
  - SAI_Peregrinus 5y ago
    The fix doesn't negate the performance boost. It decreases it. But it's still nonzero boost.
p_l 5y ago
The techniques used to make CPUs fast have possible vulnureable areas (not all of it is due to Out-Of-Order Execution, some was due to optimizations made on top). The mitigations introduced stalls into those mechanism, clearing some of the state, resulting in slowdowns. However, the mitigations are not as big slowdowns as not having the speculative execution mechanism at all.

pvillano 5y ago

what's the moore's law of general performance? How many months/years did we lose? anecdotally, my next amd cpu+gpu upgrade at the same price point is about +30% 3dmark