Visualizing Meltdown on AWS

#1

Post by mike_heffner » Fri, Jan 12, 2018, 11:53 PM UTC

Visualizing Meltdown on AWS
blog.appoptics.com

Re: Visualizing Meltdown on AWS

#2

Post by patrickxb » Sat, Jan 13, 2018, 3:27 AM UTC

It would be nice if AWS could write something official about what they are doing.

I've been noticing major performance changes in our instances and have no idea if it is related to Meltdown or something else.

Google released a blog post specifically on performance: https://blog.google/topics/google-cloud/protecting-our-googl...

It would be nice to have similar transparency from AWS.

Re: Visualizing Meltdown on AWS

#3

Post by jdangu » Sat, Jan 13, 2018, 3:30 AM UTC

Anyone has more info on the performance recovery today? We experienced similar performance issues over the last few days with a seemingly complete recovery today (on a cluster of ~2500 HVM T-1s).

Re: Visualizing Meltdown on AWS

#4

Post by alacombe » Sat, Jan 13, 2018, 3:32 AM UTC

Trying to foresee the future...

Could we expect Intel to fix the design flaw^Wfeature so that future server appliance (but also desktop) can run without KPTI while still not being affected by Meltdown ? If so, what timeline could we expect ? Say a year for new CPU designs, plus a year to roll-out new machines in datacenter ?

Re: Visualizing Meltdown on AWS

#5

Post by mrep » Sat, Jan 13, 2018, 3:38 AM UTC

My team saw a 40% CPU usage increase on all of our EC2 instances and even our RDS instances. We were shocked since the media was downplaying the performance impact.

I tried to start a poll but it seems as though my team was just the unlucky one: https://news.ycombinator.com/item?id=16109036

Re: Visualizing Meltdown on AWS

#6

Post by hanklazard » Sat, Jan 13, 2018, 3:51 AM UTC

Pardon this likely naive question, but I haven’t seen it addressed yet in all the coverage: what’s the cost in electricity of patching this vulnerability? Does a company like amazon running a massive cloud infrastructure see a non-negligible increase in their cost of doing business?

Re: Visualizing Meltdown on AWS

#7

Post by MBCook » Sat, Jan 13, 2018, 4:01 AM UTC

alacombe wrote: post #4

Trying to foresee the future... Could we expect Intel to fix the design flaw^Wfeature so that future server appliance (but also desktop) can run without KPTI while still not being affected by Meltdown ? If so, what timeline could we expect ? Say a year for new CPU designs, plus a year to roll-out new machines in datacenter ?

What I’ve seen is it takes five years to design a CPU from scratch.

I imagine they’ll try and rush this to get it out there as fast as possible (obviously a lot of people would like to buy CPUs they don’t have this issue for security/performance reasons) but it’s going to take a while. I think years is definitely the minimum.

Meltdown is easy enough (relatively) but Spectre is kind of a disaster. What do you do? Does the branch predictor have to start tagging every branch guess with some sort of process ID to prevent one process from messing with another’s predictions? Tag the cache lines instead so even though the data is in cache you can’t see it because YOUR process didn’t pull it in yet? What a mess.

Re: Visualizing Meltdown on AWS

#8

Post by dboreham » Sat, Jan 13, 2018, 4:08 AM UTC

MBCook wrote: post #7

alacombe wrote: post #4

Trying to foresee the future... Could we expect Intel to fix the design flaw^Wfeature so that future server appliance (but also desktop) can run without KPTI while still not being affected by Meltdown ? If so, what timeline could we expect ? Say a year for new CPU designs, plus a year to roll-out new machines in datacenter ?

What I’ve seen is it takes five years to design a CPU from scratch. I imagine they’ll try and rush this to get it out there as fast as possible (obviously a lot of people would like to buy CPUs they don’t have this issue for security/performance reasons) but it’s going to take a while. I think years is definitely the minimum. Meltdown is easy enough (relatively) but Spectre is kind of a disaster. What do you do? Does…

Just isolate code on different cores.

Re: Visualizing Meltdown on AWS

#9

Post by bamboozled » Sat, Jan 13, 2018, 4:09 AM UTC

patrickxb wrote: post #2

It would be nice if AWS could write something official about what they are doing. I've been noticing major performance changes in our instances and have no idea if it is related to Meltdown or something else. Google released a blog post specifically on performance: https://blog.google/topics/google-cloud/protecting-our-googl... It would be nice to have similar transparency from AWS.

Same, I feel it's irresponsible not to provide more details about this issue.

Re: Visualizing Meltdown on AWS

#10

Post by voidlogic » Sat, Jan 13, 2018, 4:31 AM UTC

MBCook wrote: post #7

alacombe wrote: post #4

Trying to foresee the future... Could we expect Intel to fix the design flaw^Wfeature so that future server appliance (but also desktop) can run without KPTI while still not being affected by Meltdown ? If so, what timeline could we expect ? Say a year for new CPU designs, plus a year to roll-out new machines in datacenter ?

What I’ve seen is it takes five years to design a CPU from scratch. I imagine they’ll try and rush this to get it out there as fast as possible (obviously a lot of people would like to buy CPUs they don’t have this issue for security/performance reasons) but it’s going to take a while. I think years is definitely the minimum. Meltdown is easy enough (relatively) but Spectre is kind of a disaster. What do you do? Does…

>Does the branch predictor have to start tagging every branch guess with some sort of process ID to prevent one process from messing with another’s predictions?

Its worth pointing out that for their newest designs AMD (and Samsung Exynos) uses the full memory address for branch predictions; no doubt Intel's next design will be doing this.