7 ms·

Intel-undervolt: CPU undervolting and throttling configuration tool for Linux

132 points by cl3misch 2y ago

voidbert 2y ago
Please consider the risks of the following vulnerability before deciding whether or not to undervolt: https://plundervolt.com/ https://plundervolt.com/
- rany_ 2y ago
  In all likelihood this tool does not work for most users, specifically in response to this vulnerability. If you're on the latest microcode, undervolting is no longer possible due to Intel's mitigation: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html https://www.intel.com/content/www/us/en/security-center/advi...
  - gravescale 2y ago
    Which is a pity because my i7 Lenovo laptop is acoustically and thermally some kind of jet turbine in a case, because I was foolish enough to believe a review, and I really wish I could undervolt it so it can make it to lunchtime on a charge.
    - rany_ 2y ago
      I was actually wrong about that, it turned out to be possible on my 11th gen Intel CPU but it was definitely not as easy as it should've been. I used https://github.com/datasone/setup_var.efi https://github.com/datasone/setup_var.efi to modify the UEFI variables. The README has all the info you'd need. It turns out that both a BIOS and microcode update is required to kill off this feature, and you could just configure the BIOS to not lock it.
- yjftsjthsd-h 2y ago
  > We were able to corrupt the integrity of Intel SGX on Intel Core processors by controling the voltage when executing enclave computations > If you are not using SGX, no actions are required. If you are using SGX, it suffices to apply the microcode update provided by Intel to mitigate Plundervolt. It's not nothing, but that seems minor to irrelevant to most people.
- aftbit 2y ago
  Wow, I never considered a power attack from software of an untrusted OS. Ring -1 and SGX and the like lead to some very harsh security environments for modern processors. IMO if you want cryptographic security, you should probably use an external component that you control, but that isn't always possible and is never the cheaper option.
- dannyw 2y ago
  Isn’t SGX mostly used for DRM, remote attestation, and other anti-consumer stuff in practice today? I haven’t came across a use case of SGX that benefits me.
  - mscrivo 2y ago
    Here's one: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
    - RussianCow 2y ago
      But that's something that Signal implements on their own backend, not something that runs on consumer devices, so it's not really relevant to a discussion about the risks of undervolting your CPU.
      - mscrivo 2y ago
        I was directly replying to the parent's question of whether there were any uses of SGX that were not anti-consumer. Signal's use of it, is very much in line with my thinking of what constitutes pro-consumer. I agree though, we're all getting slightly off topic
  - AshamedCaptain 2y ago
    Except when Apple does it (on their server hardware). Then it supposedly benefits you. See the thread for the "Private Cloud" analysis.
  - bobbiechen 2y ago
    SGX is actually deprecated on client devices like PCs, so it is rather difficult to use it in anti-consumer ways now (and as mentioned in a sibling thread, makes this rather irrelevant to the topic of undervolting your own PC). In my experience (working in the field at Anjuna), SGX and other Confidential Computing are quietly used on the server-side in enterprises a lot. It's a part of defense-in-depth, often to protect critical secrets and cryptographic keys, or the systems that manage them.
- tedunangst 2y ago
  If you're in a position to choose not to undervolt, you're not vulnerable.
- gruez 2y ago
  Aren't you vulnerable to this regardless of whether wether you're using this tool? The vulnerability in question relies on untrusted code being able to lower voltages to very low levels, causing the cpu to malfunction. Using this tool or having it installed isn't a relevant factor. If you have untrusted code running on your PC, it's already game over, and any malicious tool can use the same api this tool uses to control voltages.
  - Bognar 2y ago
    Not exactly. The promise of SGX and secure hardware enclaves is that the code that executes there should run with access to protected encrypted memory pages (enforced by the CPU VMM), and the state of the enclave can be remotely attested. Basically, it's designed to run a secure application in an untrusted computing environment as long as you trust the hardware to implement the features correctly. That last part being the rub.
    - damsalor 2y ago
      Yea about that „promise“ …
jauntywundrkind 2y ago
It was sad seeing AMDGPU limit undervolting semi-recently. A couple complaints or bits of damage ruined a practice that a lot of people were using just fine to save significsnt wattage, https://www.phoronix.com/news/AMDGPU-Lower-Power-Limit https://www.phoronix.com/news/AMDGPU-Lower-Power-Limit
- fbdab103 2y ago
  Super frustrating. From the mailing thread: However, this is not good as it remove under-powering range too far. I was getting only about 7% less performance but 90W(!) less consumption when set to my 115W before. Also I wonder if we as a OS of options and freedom have to stick to such very high reference for min values without ability to override them through some sys ctrls. Commit was done by amd guy and I wonder if because of maybe this post that I made few months ago(business strategy?) I have certainly crossed a threshold where hardware seems good enough. I do not need the 99th percentile performance if it comes with a non-linear increase in power consumption.
  - Rinzler89 2y ago
    >I have certainly crossed a threshold where hardware seems good enough. I do not need the 99th percentile performance if it comes with a non-linear increase in power consumption. But this is how AMD, Intel and Nvidia have been pushing performance improvements to consumers every generation. To quote Darth Sidious: "UNLIMITED POWER!"
- nottorp 2y ago
  Not just AMD. I recently bought a nvidia 4060 card and i can't set the power limit lower than something like 75-90 W, at least in Linux. Of course, it's possible that the lower limit has always been there for nvidia, but I just didn't know because I went without a dedicated video card for like 4 years. For AMD aren't the drivers (partially) open source? Can't the change be reverted?
  - forbiddenlake 2y ago
    Yes, for example, the alternative kernel, Zen, did so. https://github.com/zen-kernel/zen-kernel/issues/344 https://github.com/zen-kernel/zen-kernel/issues/344
chx 2y ago
> my i7-8650U those can but 10nm CPUs after Plundervolt can't undervolt , it's disabled from UEFI and not only there's no option to reenable it in the UI, the very EFI variable itself is write locked. I have an X1 Gen 4 (Intel 11th gen) and you just can't do it.
- lm411 2y ago
  Damn, you mean we can't just swap resistors to under/over volt anymore? I am getting old. (tongue in cheek, and yes, I am getting old) Shit, I remember just using a pencil to lower resistance values.
  - ngneer 2y ago
    You can. The main thing is that software-based attacks are easier to perform.
    - chx 2y ago
      That'd be reason to take away the reenable from UEFI but write protecting the EFI variable where changing it already requires to boot into an EFI editor is just being dicks, pardon my French. Just let me enable it , I am aware of the risks.
      - ngneer 2y ago
        I think the trouble is that it is not possible to distinguish (through reliable technical means) a responsible overclocker such as yourself versus an unscrupulous actor editing EFI variables in flash. So, because some bad guys/gals found a way to damage the system, all the good guys/gals suffer as a result, because the system cannot tell them apart. Reminds me of airport security...
  - Scoundreller 2y ago
    I remember some boards, you would have to paint a cpu pin with nail polish to stop it from conducting, or carefully jump one of the several hundred pins on the socket…
nubinetwork 2y ago
Why would I want this? With a properly configured kernel, Intel chips can downclock to somewhere in the 400-800mhz range when idle.
- inhumantsar 2y ago
  iirc a lot of Intel chips (12th gen+ esp) can be slightly undervolted to achieve better power efficiency and lower temperatures with negligible impact to clock speeds. particularly useful on laptops, mini PCs, and desktops that spend a lot of time at idle.
  - declan_roberts 2y ago
    Where can I find out more about this? Just picked up an i5 13500 and my primary concern is low power usage.
    - damsalor 2y ago
      Basically the same as overclocking; set, test, reset, retest …. Be careful with the verification runs as they can easily eat up the energy savings that you are trying to archive
    - BSDobelix 2y ago
      Check here: https://www.reddit.com/r/buildapc/comments/14kll95/intel_i5_13500_undervolting_question/ https://www.reddit.com/r/buildapc/comments/14kll95/intel_i5_... it seams -100mv - -150mv is the maximum (maybe not stable) undervolting.
- dijit 2y ago
  Undervolting can make your CPU use less power and produce less heat. It’s popular for people attempting to overclock because of the thermal headroom it gives- essentially its the same concept as overclocking in that the silicon lottery can mean CPUs can be better than their factory tuning because Intel is hitting the lowest common denominator in the stock config. I have used this to moderate success on a 8th generation mobile Xeon to drop the temps ~7C under load, and get the system idle from 6w to 4w (going lower would have been really hard as at that point the CPU was responsible for very little of what remained). Undervolting is not the same as downclocking, it is supplying less voltage which has a strangely profound impact with no performance loss. However your system can be much less stable.
M95D 2y ago
So, why is this not in kernel?
- zamadatix 2y ago
  The ability to do this is exposed via the kernel (writing MSRs). The userspace app here just makes that friendly.
  - M95D 2y ago
    I don't know how it works, but I thought MSR write was forbidden since... v5.10... ? Anyway, I was expecting to see it in the "Voltage and Current Regulator Support" in kernel menuconfig.
ycui1986 2y ago
In 2006, I had my first laptop right before the release of Windows Vista. Unfortunately, running Windows Vista makes my laptop hot and the fan kicked in to make a lot noise. I cannot remember the software's name which can reduce the core voltage of my single core Centrino processor. I was successful to undervolt the CPU to the lowest possible voltage. That cools down the CPU by a large margin, the laptop became quiet again (also stable). I was happy. The functionality disappears with the newer generation intel CPU releases, I had not been able to do similar thing ever since. Back then, Intel had the best semiconductor process, and they had a wide margin on undervolting the CPU.
- LoganDark 2y ago
  > The functionality disappears with the newer generation intel CPU releases, I had not been able to do similar thing ever since. I don't know about undervolting, but ThrottleStop allowed me to run my 230W laptop off a 65W power adapter by downclocking the CPU to 800MHz!
  - juujian 2y ago
    Did I get that right? A laptop that needs a 230W power brick and wasn't really intended to run on 65W, though it does? 800MHz, that was what we had in the 90s, I assume that's the era? Meanwhile, my laptop is idlying at ~9W playing YouTube. Crazy. How long did the battery last? Less than 30m I assume.
    - triblemaster 2y ago
      Most 230W laptops were not meant to be run without power brick. They were more portable desktops than laptops. Even sold as such.
      - LoganDark 2y ago
        Oh no, portable workstations are a whole nother thing. This was 100% marketed and sold as a laptop. But gaming laptops have never been good with battery life. They even tried to make it thin and light, which makes me cringe every time. Gamers don't need thin and light, wtf.
hu3 2y ago
I slightly undervolted an i7 11800H by -100mV. That resulted in a -10C average CPU temperature. Massive! I don't remember last time I heard the fans. Not even with Docker + Jetbrains IDEs. I wonder why doesn't it come like this by default. It runs faster too because it's no longer frequently thermal throttled.
- atVelocet 2y ago
  Cause the CPU can get unstable under certain loads. So Intel plays it safe and ramps up the voltage. And no.. there is no easy way to measure this. Also every CPU is slightly different.
  - StrangeDoctor 2y ago
    I ultimately gave up playing this game, spent hours testing and tuning. Each core is slightly different (on amd, I’m sure intel has something similar) and stress test for 1-24h each tweak invoking a reboot. Then some new workload comes and kernel panic/bsod. Stock settings just work, maybe I lost the silicon lottery but too tired to check anymore.
  - rcthompson 2y ago
    It's not just unstable, it's a security issue because control over CPU voltage allows someone to use that instability to compromise computations that are supposed to be performed securely (e.g. look up "Plundervolt").
    - epcoa 2y ago
      If plundervolt is a viable attack you’ve got much bigger problems (the attacker must already have gained full privileges). Not sure how this is relevant to just using throttled or similar to conditionally undervolt the CPU with fixed levels that can be proven reasonably stable.
- Out_of_Characte 2y ago
  Because not all chips will be stable at -100mV Intel is providing the chip with warranty/guarantee that the chip performs 'up to' spec. Is your chip completely stable in all workloads? Would it be stable at 90c? when all Dram slots are occupied? When driving all pcie lanes at max? I bet that you could make any chip unstable with the right tools and knowledge.
sharpshadow 2y ago
Dell stopped the option to undervolt the XPS series with some BIOS update. Would need to downgrade the BIOS first.
rldjbpin 2y ago
throttlestop (https://www.techpowerup.com/download/techpowerup-throttlestop/ https://www.techpowerup.com/download/techpowerup-throttlesto...) is my one of top 2 reasons for using windows. been aware of the code this is based on but i hope this also provides a set-and-forget experience like on windows.

132 points by cl3misch 2y ago

Please consider the risks of the following vulnerability before deciding whether or not to undervolt: https://plundervolt.com/ https://plundervolt.com/

rany_ 2y ago
In all likelihood this tool does not work for most users, specifically in response to this vulnerability. If you're on the latest microcode, undervolting is no longer possible due to Intel's mitigation: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html https://www.intel.com/content/www/us/en/security-center/advi...
- gravescale 2y ago
  Which is a pity because my i7 Lenovo laptop is acoustically and thermally some kind of jet turbine in a case, because I was foolish enough to believe a review, and I really wish I could undervolt it so it can make it to lunchtime on a charge.
  - rany_ 2y ago
    I was actually wrong about that, it turned out to be possible on my 11th gen Intel CPU but it was definitely not as easy as it should've been. I used https://github.com/datasone/setup_var.efi https://github.com/datasone/setup_var.efi to modify the UEFI variables. The README has all the info you'd need. It turns out that both a BIOS and microcode update is required to kill off this feature, and you could just configure the BIOS to not lock it.
yjftsjthsd-h 2y ago
> We were able to corrupt the integrity of Intel SGX on Intel Core processors by controling the voltage when executing enclave computations > If you are not using SGX, no actions are required. If you are using SGX, it suffices to apply the microcode update provided by Intel to mitigate Plundervolt. It's not nothing, but that seems minor to irrelevant to most people.
aftbit 2y ago
Wow, I never considered a power attack from software of an untrusted OS. Ring -1 and SGX and the like lead to some very harsh security environments for modern processors. IMO if you want cryptographic security, you should probably use an external component that you control, but that isn't always possible and is never the cheaper option.
dannyw 2y ago
Isn’t SGX mostly used for DRM, remote attestation, and other anti-consumer stuff in practice today? I haven’t came across a use case of SGX that benefits me.
- mscrivo 2y ago
  Here's one: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
  - RussianCow 2y ago
    But that's something that Signal implements on their own backend, not something that runs on consumer devices, so it's not really relevant to a discussion about the risks of undervolting your CPU.
    - mscrivo 2y ago
      I was directly replying to the parent's question of whether there were any uses of SGX that were not anti-consumer. Signal's use of it, is very much in line with my thinking of what constitutes pro-consumer. I agree though, we're all getting slightly off topic
- AshamedCaptain 2y ago
  Except when Apple does it (on their server hardware). Then it supposedly benefits you. See the thread for the "Private Cloud" analysis.
- bobbiechen 2y ago
  SGX is actually deprecated on client devices like PCs, so it is rather difficult to use it in anti-consumer ways now (and as mentioned in a sibling thread, makes this rather irrelevant to the topic of undervolting your own PC). In my experience (working in the field at Anjuna), SGX and other Confidential Computing are quietly used on the server-side in enterprises a lot. It's a part of defense-in-depth, often to protect critical secrets and cryptographic keys, or the systems that manage them.
tedunangst 2y ago
If you're in a position to choose not to undervolt, you're not vulnerable.
gruez 2y ago
Aren't you vulnerable to this regardless of whether wether you're using this tool? The vulnerability in question relies on untrusted code being able to lower voltages to very low levels, causing the cpu to malfunction. Using this tool or having it installed isn't a relevant factor. If you have untrusted code running on your PC, it's already game over, and any malicious tool can use the same api this tool uses to control voltages.
- Bognar 2y ago
  Not exactly. The promise of SGX and secure hardware enclaves is that the code that executes there should run with access to protected encrypted memory pages (enforced by the CPU VMM), and the state of the enclave can be remotely attested. Basically, it's designed to run a secure application in an untrusted computing environment as long as you trust the hardware to implement the features correctly. That last part being the rub.
  - damsalor 2y ago
    Yea about that „promise“ …

jauntywundrkind 2y ago

It was sad seeing AMDGPU limit undervolting semi-recently. A couple complaints or bits of damage ruined a practice that a lot of people were using just fine to save significsnt wattage, https://www.phoronix.com/news/AMDGPU-Lower-Power-Limit https://www.phoronix.com/news/AMDGPU-Lower-Power-Limit

fbdab103 2y ago
Super frustrating. From the mailing thread: However, this is not good as it remove under-powering range too far. I was getting only about 7% less performance but 90W(!) less consumption when set to my 115W before. Also I wonder if we as a OS of options and freedom have to stick to such very high reference for min values without ability to override them through some sys ctrls. Commit was done by amd guy and I wonder if because of maybe this post that I made few months ago(business strategy?) I have certainly crossed a threshold where hardware seems good enough. I do not need the 99th percentile performance if it comes with a non-linear increase in power consumption.
- Rinzler89 2y ago
  >I have certainly crossed a threshold where hardware seems good enough. I do not need the 99th percentile performance if it comes with a non-linear increase in power consumption. But this is how AMD, Intel and Nvidia have been pushing performance improvements to consumers every generation. To quote Darth Sidious: "UNLIMITED POWER!"
nottorp 2y ago
Not just AMD. I recently bought a nvidia 4060 card and i can't set the power limit lower than something like 75-90 W, at least in Linux. Of course, it's possible that the lower limit has always been there for nvidia, but I just didn't know because I went without a dedicated video card for like 4 years. For AMD aren't the drivers (partially) open source? Can't the change be reverted?
- forbiddenlake 2y ago
  Yes, for example, the alternative kernel, Zen, did so. https://github.com/zen-kernel/zen-kernel/issues/344 https://github.com/zen-kernel/zen-kernel/issues/344

chx 2y ago

> my i7-8650U those can but 10nm CPUs after Plundervolt can't undervolt , it's disabled from UEFI and not only there's no option to reenable it in the UI, the very EFI variable itself is write locked. I have an X1 Gen 4 (Intel 11th gen) and you just can't do it.

lm411 2y ago
Damn, you mean we can't just swap resistors to under/over volt anymore? I am getting old. (tongue in cheek, and yes, I am getting old) Shit, I remember just using a pencil to lower resistance values.
- ngneer 2y ago
  You can. The main thing is that software-based attacks are easier to perform.
  - chx 2y ago
    That'd be reason to take away the reenable from UEFI but write protecting the EFI variable where changing it already requires to boot into an EFI editor is just being dicks, pardon my French. Just let me enable it , I am aware of the risks.
    - ngneer 2y ago
      I think the trouble is that it is not possible to distinguish (through reliable technical means) a responsible overclocker such as yourself versus an unscrupulous actor editing EFI variables in flash. So, because some bad guys/gals found a way to damage the system, all the good guys/gals suffer as a result, because the system cannot tell them apart. Reminds me of airport security...
- Scoundreller 2y ago
  I remember some boards, you would have to paint a cpu pin with nail polish to stop it from conducting, or carefully jump one of the several hundred pins on the socket…

nubinetwork 2y ago

Why would I want this? With a properly configured kernel, Intel chips can downclock to somewhere in the 400-800mhz range when idle.

inhumantsar 2y ago
iirc a lot of Intel chips (12th gen+ esp) can be slightly undervolted to achieve better power efficiency and lower temperatures with negligible impact to clock speeds. particularly useful on laptops, mini PCs, and desktops that spend a lot of time at idle.
- declan_roberts 2y ago
  Where can I find out more about this? Just picked up an i5 13500 and my primary concern is low power usage.
  - damsalor 2y ago
    Basically the same as overclocking; set, test, reset, retest …. Be careful with the verification runs as they can easily eat up the energy savings that you are trying to archive
  - BSDobelix 2y ago
    Check here: https://www.reddit.com/r/buildapc/comments/14kll95/intel_i5_13500_undervolting_question/ https://www.reddit.com/r/buildapc/comments/14kll95/intel_i5_... it seams -100mv - -150mv is the maximum (maybe not stable) undervolting.
dijit 2y ago
Undervolting can make your CPU use less power and produce less heat. It’s popular for people attempting to overclock because of the thermal headroom it gives- essentially its the same concept as overclocking in that the silicon lottery can mean CPUs can be better than their factory tuning because Intel is hitting the lowest common denominator in the stock config. I have used this to moderate success on a 8th generation mobile Xeon to drop the temps ~7C under load, and get the system idle from 6w to 4w (going lower would have been really hard as at that point the CPU was responsible for very little of what remained). Undervolting is not the same as downclocking, it is supplying less voltage which has a strangely profound impact with no performance loss. However your system can be much less stable.

M95D 2y ago

So, why is this not in kernel?

zamadatix 2y ago
The ability to do this is exposed via the kernel (writing MSRs). The userspace app here just makes that friendly.
- M95D 2y ago
  I don't know how it works, but I thought MSR write was forbidden since... v5.10... ? Anyway, I was expecting to see it in the "Voltage and Current Regulator Support" in kernel menuconfig.

ycui1986 2y ago

In 2006, I had my first laptop right before the release of Windows Vista. Unfortunately, running Windows Vista makes my laptop hot and the fan kicked in to make a lot noise. I cannot remember the software's name which can reduce the core voltage of my single core Centrino processor. I was successful to undervolt the CPU to the lowest possible voltage. That cools down the CPU by a large margin, the laptop became quiet again (also stable). I was happy. The functionality disappears with the newer generation intel CPU releases, I had not been able to do similar thing ever since. Back then, Intel had the best semiconductor process, and they had a wide margin on undervolting the CPU.

LoganDark 2y ago
> The functionality disappears with the newer generation intel CPU releases, I had not been able to do similar thing ever since. I don't know about undervolting, but ThrottleStop allowed me to run my 230W laptop off a 65W power adapter by downclocking the CPU to 800MHz!
- juujian 2y ago
  Did I get that right? A laptop that needs a 230W power brick and wasn't really intended to run on 65W, though it does? 800MHz, that was what we had in the 90s, I assume that's the era? Meanwhile, my laptop is idlying at ~9W playing YouTube. Crazy. How long did the battery last? Less than 30m I assume.
  - triblemaster 2y ago
    Most 230W laptops were not meant to be run without power brick. They were more portable desktops than laptops. Even sold as such.
    - LoganDark 2y ago
      Oh no, portable workstations are a whole nother thing. This was 100% marketed and sold as a laptop. But gaming laptops have never been good with battery life. They even tried to make it thin and light, which makes me cringe every time. Gamers don't need thin and light, wtf.

hu3 2y ago

I slightly undervolted an i7 11800H by -100mV. That resulted in a -10C average CPU temperature. Massive! I don't remember last time I heard the fans. Not even with Docker + Jetbrains IDEs. I wonder why doesn't it come like this by default. It runs faster too because it's no longer frequently thermal throttled.

atVelocet 2y ago
Cause the CPU can get unstable under certain loads. So Intel plays it safe and ramps up the voltage. And no.. there is no easy way to measure this. Also every CPU is slightly different.
- StrangeDoctor 2y ago
  I ultimately gave up playing this game, spent hours testing and tuning. Each core is slightly different (on amd, I’m sure intel has something similar) and stress test for 1-24h each tweak invoking a reboot. Then some new workload comes and kernel panic/bsod. Stock settings just work, maybe I lost the silicon lottery but too tired to check anymore.
- rcthompson 2y ago
  It's not just unstable, it's a security issue because control over CPU voltage allows someone to use that instability to compromise computations that are supposed to be performed securely (e.g. look up "Plundervolt").
  - epcoa 2y ago
    If plundervolt is a viable attack you’ve got much bigger problems (the attacker must already have gained full privileges). Not sure how this is relevant to just using throttled or similar to conditionally undervolt the CPU with fixed levels that can be proven reasonably stable.
Out_of_Characte 2y ago
Because not all chips will be stable at -100mV Intel is providing the chip with warranty/guarantee that the chip performs 'up to' spec. Is your chip completely stable in all workloads? Would it be stable at 90c? when all Dram slots are occupied? When driving all pcie lanes at max? I bet that you could make any chip unstable with the right tools and knowledge.

sharpshadow 2y ago

Dell stopped the option to undervolt the XPS series with some BIOS update. Would need to downgrade the BIOS first.

rldjbpin 2y ago

throttlestop (https://www.techpowerup.com/download/techpowerup-throttlestop/ https://www.techpowerup.com/download/techpowerup-throttlesto...) is my one of top 2 reasons for using windows. been aware of the code this is based on but i hope this also provides a set-and-forget experience like on windows.