It's not clear that he's using "SMT" to refer to AMD specifically as he goes on to talk about "Intel CPUs" and disabling it in "Intel BIOS". Does the Zen architecture have the same issue?
It does not.
Disable SMT/Hyperthreading in all Intel BIOSes
111–120 of 159 posts
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#112Earlier quoted context omitted.
AMD claims their processors aren't affected at all by any of the 3 variants of Foreshadow ( https://www.amd.com/en/corporate/security-updates ) therefore SMT is safe to leave enabled. On the other hand, on Intel the only fully comprehensive workaround is to completely disable SMT, so given that disabling SMT almost halves the performance on some workloads,¹ AMD is bound to have a huge performance advantage over Intel…
Should truth-in-advertising laws require OEMs to stop advertising hyper-threading, e.g. 4C/8T on new hardware, if the advertised feature is not fit for purpose?
My personal opinion is "not yet".
Give intel some time to cope with this newest set of vulns, see if they can find a way to re-enable hyper threading safely, and if they can't and are still advertising hyper threading, then start going after them.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#113Does that mean hyperthreading is effectively unpatchably insecure? Cloud Providers are gonna have a bad time if this is true.
Probably in most cases. Vmware have disclaimers in the mitigation options that preclude turning off HT, meaning, use at your own risk. [1] I am still waiting on a comment from Linode [2] Openstack have some knobs you can adjust, but it really depends on your workloads and what risk you are willing to accept. [3] AWS have their own custom hypervisor and are said to have worked around the issue. [4] Amazon had info on…
Microsoft has stated that you can leave HT enabled when using Hyper-V on Windows 2016. The same mitigations have allowed them to keep HT enabled in Azure.
https://blogs.technet.microsoft.com/virtualization/2018/08/1...
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#114Maybe this is what finally gets me to upgrade from my ~2012 i7-3770. Not because of performance improvements, but to avoid performance degradation from all these security patches...
I'm in this exact scenario. I am thinking I might just go with AMD this time around, even if it is mostly an illusory short-term strength over Intel. In the long run I will undoubtedly have to refresh my hardware as new exploits come out, but at least I can take solace in the fact that I'm only worried about a single machine and not a datacenter.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#115> SMT is fundamentally broken because it shares resources between the two cpu instances and those shared resources lack security differentiators. I thought the root of one of the Foreshadow problems was that caches are shared across cores , and therefore even with hyperthreading disabled, you still gain information about a process on another core. Am I misinterpreting it? It does seem like the paranoid thing to do is…
There are cache partitioning implementations to isolate cores from each other, but mainly to prevent noisy neighbors from bumping you out of the higher level caches. https://danluu.com/intel-cat/ Cache timimg attacks are the old hat in the Timing side channel business, the newer attacks are cooler because the memory maps are not checked and you can determine the caching status of memory not mapped into your processes…
It looks like CAT only does allocation of the last level cache (ie, L3). Despite the literature claiming this could prevent timing attacks, but I don't see how it could. Isn't there enough difference in speed between L3 and L1 that one should be able to extract timing information?
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#116Does this mean AMD hyperthreading has a performance + security advantage over currently shipping Intel processors? Edit: https://www.amd.com/en/corporate/security-updates > 8/14/18 – Updated: As in the case with Meltdown, we believe our processors are not susceptible to these new speculative execution attack variants: L1 Terminal Fault – SGX (also known as Foreshadow) CVE 2018-3615, L1 Terminal Fault – OS/SMM (also k…
For hypervisors it's automatic. For operating systems, there's no performance penalty. Browsers need not do anything.
Unless the browser is using hypervisor https://arstechnica.com/information-technology/2016/09/windo...
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#117We have disabled Hyper Threading(HT) on all public facing servers(running OpenBSD). However, our compute nodes running Linux kernel are benefiting about 80 to near 100% boost for specific scientific workloads. So, we run our INTERNAL NETWORK ONLY compute nodes with HT on. In places where security is not primary concern, why not make use of HT for extra efficiency? Think and plan before you blanket disable HT on all s…
If you fully trust the software you're running, I see no reason to disable HT. At this point, I don't think I'd have it running on anything publicly facing, though. That said, I still have it enabled on my work PC & home PC.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#118We have disabled Hyper Threading(HT) on all public facing servers(running OpenBSD). However, our compute nodes running Linux kernel are benefiting about 80 to near 100% boost for specific scientific workloads. So, we run our INTERNAL NETWORK ONLY compute nodes with HT on. In places where security is not primary concern, why not make use of HT for extra efficiency? Think and plan before you blanket disable HT on all s…
Yes I think it is a more significant problem for Multitenant cloud providers..
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#119Scary looking headline on a discussion forum with instructions to perform a task that the average user would not really understand, with no explanation of attack vector or even consequences for any user who doesn't want to take the time (and energy, frankly at this point) to follow security news.
I'm pretty close to not caring anymore. I hope somebody figures out how to at least fix the security news infrastructure, if fixing security is still a ways off.
EDIT: Scratch that, I assume attack vector is a browser since they mentioned JavaScript.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#120We have disabled Hyper Threading(HT) on all public facing servers(running OpenBSD). However, our compute nodes running Linux kernel are benefiting about 80 to near 100% boost for specific scientific workloads. So, we run our INTERNAL NETWORK ONLY compute nodes with HT on. In places where security is not primary concern, why not make use of HT for extra efficiency? Think and plan before you blanket disable HT on all s…
If you fully trust the software you're running, I see no reason to disable HT. At this point, I don't think I'd have it running on anything publicly facing, though. That said, I still have it enabled on my work PC & home PC.
Do you fully trust all the JavaScript you run?