Does that mean hyperthreading is effectively unpatchably insecure? Cloud Providers are gonna have a bad time if this is true.
Is it a feasible solution to enable hyperthreading only for threads or forks of the same process? Then they can use this ability, but other processes cannot do timing attacks on this process in this core... I think
Disable SMT/Hyperthreading in all Intel BIOSes
141–150 of 159 posts
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#142Eh hyperthreading seems to be questionable anyway. On all the application benchmarks I've run except for a few, it slows things down.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#143FTA >>> We are having to do research by reading other operating systems. Si Intel cooperates with business partners like apple/windows and not with open source. Does it mean that Apple and Windows can claim to be more secure because they have access to the information needed to fix Intel's issues ?
Intel cooperates with organizations that obey embargoes and don't badmouth their partners in public, like Red Hat, Canonical, and probably the Linux Foundation. Intel does not cooperate with OpenBSD.
a.k.a. truth
Linus has "badmouthed" Intel in much harsher and more explicit terms. Linux is just too big for them to get away with trying to smear and slander so they ignore him and move on.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#144Earlier quoted context omitted.
With the newer AMD processors having as many real cores as they do, does the cost-benefit analysis of HT/SMT change? I read in a comment here a few weeks ago that turning it off on the newer AMD CPUs can yield better performance because of improved cache-coherency on some workloads (My memory of what I read might be totally wrong).
I'll defer to whatever the benchmarks say of course, but I don't see why HT would affect cache coherency for normal workloads. If you disable HT you'd still have the same number of threads/processes running on the system, so you still have to schedule the same amount of work and do the same number of context switches.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#145Earlier quoted context omitted.
Possibly, but it's not uncommon to refer to x86 and x64 machines as intel architecture machines or as intel machines.
Due to architectural differences, AMD CPUs are immune or nearly immune to some of the speculative execution attacks (though not all of them). For example, AMDs branch predictor uses the full address and so is not vulnerable to branch predictor poisoning in the same way as Intel. The major win (whether AMD intended it or not) is that AMD cpus don't speculate loads until page permissions have been verified. Intel fires…
Microarchitectural differences. They are, after all the same architecture, i.e. x86-64.
/pedantic
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#146Earlier quoted context omitted.
With the newer AMD processors having as many real cores as they do, does the cost-benefit analysis of HT/SMT change? I read in a comment here a few weeks ago that turning it off on the newer AMD CPUs can yield better performance because of improved cache-coherency on some workloads (My memory of what I read might be totally wrong).
I'll defer to whatever the benchmarks say of course, but I don't see why HT would affect cache coherency for normal workloads. If you disable HT you'd still have the same number of threads/processes running on the system, so you still have to schedule the same amount of work and do the same number of context switches.
With 4 execution units, 4 processes run at a time, and they all get swapped out every scheduling tick (losing all their cached lines). OTOH each process gets a full measure of cache to use during its slice.
With 8 execution units, 8 processes "run" at a time, they interleave based on stalls and CPU resources, and the OS doesn't need to reschedule anything every tick (so they hopefully keep their cache lines hot). But each process gets a half measure of cache to use.
In reality, code tuned to use a full measure of cache will be better off matching the number of processes to the number of execution units available, so you'd run half the number of processes with HT disabled. And cache-tuned code tends to fall off a performance cliff when it exceeds cache available, so it may easily run more than twice as fast, depending on the work.
The win from HT depends on most code not being tuned to full measures of cache, and having a lot of memory stalls or other heterogeneous work that other work can fit into. And most code is like that. Cache tends to have a declining marginal return - you have to add exponentially more cache to avoid cache misses - https://en.wikipedia.org/wiki/Power_law_of_cache_misses .
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#147Re: Disable SMT/Hyperthreading in all Intel BIOSes
#148Earlier quoted context omitted.
I think what you're insinuating is a side effect of the OpenBSD group being open, honest, and congruent to their ethics.
What he's insinuating is that they agreed to embargos and then repeatedly broke them, claiming it was "better for users". Regardless of whether it is, you should expect the result of that to be that nobody trusts them with embargoes. Which is in fact, what has happened.
Google broke an embargo early. https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
EFail embargo was broken. See https://twitter.com/seecurity/status/995964977461776385 and http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.h...
I don't think picking on OpenBSD is the right thing here.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#149Earlier quoted context omitted.
Agree. A personal computer could probably even risk it as long as they don't run untrusted javascript (which they shouldn't do anyways, or only under sandboxed/careful conditions).
Very few people don't run untrusted Javascript these days.
Re: Disable SMT/Hyperthreading in all Intel BIOSes
#150Maybe this is what finally gets me to upgrade from my ~2012 i7-3770. Not because of performance improvements, but to avoid performance degradation from all these security patches...