Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disable SMT/Hyperthreading in all Intel BIOSes

marc.info

Post reply on HN
Print view View original

101–110 of 159 posts

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#101

Post by reacharavindh »

We have disabled Hyper Threading(HT) on all public facing servers(running OpenBSD). However, our compute nodes running Linux kernel are benefiting about 80 to near 100% boost for specific scientific workloads. So, we run our INTERNAL NETWORK ONLY compute nodes with HT on. In places where security is not primary concern, why not make use of HT for extra efficiency?

Think and plan before you blanket disable HT on all servers running intel CPUs...

If an attacker is able to run any code on these private servers, I have bigger problems to deal with than HT as attack vector..

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#102

Post by walterbell »

mrb wrote: post #100
Roritharr wrote: post #20

Earlier quoted context omitted.

Where did you get that impression?

AMD claims their processors aren't affected at all by any of the 3 variants of Foreshadow ( https://www.amd.com/en/corporate/security-updates ) therefore SMT is safe to leave enabled. On the other hand, on Intel the only fully comprehensive workaround is to completely disable SMT, so given that disabling SMT almost halves the performance on some workloads,¹ AMD is bound to have a huge performance advantage over Intel…

Should truth-in-advertising laws require OEMs to stop advertising hyper-threading, e.g. 4C/8T on new hardware, if the advertised feature is not fit for purpose?

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#103

Post by walterbell »

jamroom wrote: post #90
jonny_eh wrote: post #86

Does anyone know the best way to disable hyperthreading in OSX? The only thing I found was this: https://www.whatroute.net/cpusetter.html

I'm not sure if you are running OSX on a multi user server, but is this something we need to worry about on our laptop? It's not clear to me what needs to be done in a single user situation.

The OpenBSD post references possible JavaScript (browser) attacks.

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#104

Post by knz42 »

stcredzero wrote: post #12

I've long felt that there's something less than half-baked about the multi CPU architecture we're currently using. The hacky contortions HFT coders have come up with to avoid things like False Sharing strike me as a big red flag. https://mechanical-sympathy.blogspot.com/2011/07/false-shari... How about an architecture more like Erlang's, where you have independent processes with their own CPU core, where each has the…

Something like this:

1) https://www.sciencedirect.com/science/article/pii/S014193311...

(PDF: https://science.raphael.poss.name/pub/poss.13.micpro.pdf )

"The Apple-CORE project has co-designed a general machine model and concurrency control interface with dedicated hardware support for concurrency management across multiple cores. Its SVP interface combines dataflow synchronisation with imperative programming, towards the efficient use of parallelism in general-purpose workloads. Its implementation in hardware provides logic able to coordinate single-issue, in-order multi-threaded RISC cores into computation clusters on chip, called Microgrids. In contrast with the traditional “accelerator” approach, Microgrids are components in distributed systems on chip that consider both clusters of small cores and optional, larger sequential cores as system services shared between applications.

2) https://ieeexplore.ieee.org/document/7300441/ (PDF: https://science.raphael.poss.name/pub/poss.15.tpds.pdf )

"This article advocates the use of new architectural features commonly found in many-cores to replace the machine model underlying Unix-like operating systems. "

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#106

Post by JBiserkov »

mehrdadn wrote: post #77

I would love to but how in the world do I do this when I'm using Windows and Lenovo doesn't give me an option in the BIOS?

One way to achieve something similar would be via a software tool which would set the process affinity to only run on real cores.

Or you could only run Chrome (untrusted JavaScript) on core 2 and 3, and run the app that has your secrets on core 0 and 1. (It is my understanding that 2k cores are real, and 2k+1 is their matching, "virtual" core) This way you get both hyperthreading and security. I'm not a security expert though.

https://bitsum.com/docs/pl/Using%20the%20GUI/using_the_gui.h...

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#107

Post by mehrdadn »

JBiserkov wrote: post #106
mehrdadn wrote: post #77

I would love to but how in the world do I do this when I'm using Windows and Lenovo doesn't give me an option in the BIOS?

One way to achieve something similar would be via a software tool which would set the process affinity to only run on real cores. Or you could only run Chrome (untrusted JavaScript) on core 2 and 3, and run the app that has your secrets on core 0 and 1. (It is my understanding that 2k cores are real, and 2k+1 is their matching, "virtual" core) This way you get both hyperthreading and security. I'm not a security expe…

I'm not sure it would be that easy since I believe e.g. I/O can go through the System process (or other processes even), which has full affinity. We'd likely have to set thread affinities for all processes/threads. But then it would clash with manually-set affinities, and I'm also not sure if it would have worse performance than actually disabling hyper-threading or not.

Right now I'm looking at what making a UEFI application to disable HT before boot might involve... not sure if that's too late in the boot process or not.

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#108

Post by Tuna-Fish »

lomnakkus wrote: post #26
Roritharr wrote: post #20

Earlier quoted context omitted.

Where did you get that impression?

I believe it may be because the email only mentioned Intel explicitly and had a "I won't be buying Intel in future" (paraphrased) comment. However, I personally wouldn't assume that AMDs HT implementation doesn't have similar issues.

> However, I personally wouldn't assume that AMDs HT implementation doesn't have similar issues.

It does not. The fundamental difference between AMD and Intel CPUs in all these faults is that AMD does all permissions checks eagerly before returning results from memory, while when speculating, Intel defers them until speculation is resolved.

This does not mean that AMD escaped all of it, because some of the attacks (eg, spectre variant 1) do not cross a protection boundary that permissions checks would catch.

Re: Disable SMT/Hyperthreading in all Intel BIOSes

#109

Post by CompuHacker »

ISL wrote: post #29
fermienrico wrote: post #17

Earlier quoted context omitted.

Indeed, the idea of "Security" is not negotiable when marketing. Imagine buying a car that says, "Save $5000 for a less safe version without airbags." Yes, I know Airbags are DOT requirement, just trying to make a point. Edit: I think people are missing my point. I am not saying they don't sell cheaper models that are less safe. My point is that they don't ACTIVELY market them as such. Point me to an advertisement th…

There are absolutely situations in which a substantially cheaper but less-secure/safe solution to a problem can make economic sense. Suppose you have $5k, you need a car in order to feed your family, and that only the following two options are available: You can buy the safe car for $10k or a less safe car for $5k. In that situation, less safety can be a reasonable choice. Indeed, there was a long period of time in w…

With two $5k cars, you can guarantee safety by having a leader car clear the road while you follow at very low speed.

Is there a hyperthreading joke here somewhere?

Post reply on HN