Intel CPUs Suffer Performance Hit From New Spectre-v2 Mitigations

[harlan4096]

Guess who's back?

Branch History Injection (BHI), a new flavor of the Spectre-v2 vulnerability that affects both new and old Intel processors and specific Arm models, recently came to light. Linux publication Phoronix conducted testing that shows the new BHI mitigations could produce severe performance penalties up to 35%.

Intel will release a software update for its processors to mitigate BHI, but it may take a while since processors starting from Haswell going forward are vulnerable to the exploit. However, the Linux community was quick to act, and mitigations for BHI already formed a part of the Linux kernel in a matter of minutes after BHI's announcement.

VUSec, the Systems and Network Security Group at Vrije Universiteit Amsterdam who discovered BHI, recommended enabling Repotlines (return and trampoline) to mitigate BHI. The recommendation still stands for modern processors that already carry the necessary hardware mitigations for Spectre V2. In Intel's case, that would be eIBRS, but as the VUSec researchers highlighted, it isn't enough to fight off BHI, which is the reason to have eIBRS and Retpolines working in tandem.

According to Phoronix's Core i9-12900K (Alder Lake) results, networking and storage performance went down the toilet after enabling Retpolines. The publication recorded a 26.7% performance loss on the former and 14.5% on the latter. That's the hallmark of these mitigations: Any external I/O from the chip takes a hard hit. Workloads like web browsing or image manipulation in GIMP didn't show a huge impact.

The Core i7-1185G7 (Tiger Lake) took an even more detrimental hit to storage performance. The results showed 35.6% and 34.1% lower performance in OSBench and Flexible IO Tester, respectively. But again, workloads that don't rely on I/O or networking didn't show significant performance loss. These include gaming, web browsing, and other daily tasks.

Phoronix noted that AMD processors aren't safe from BHI even though modern Zen chips already leverage Retpolines. The problem is that AMD's LFENCE/JMP-based implementation of Retpolines isn't good enough to fend off BHI, so the chipmaker is shifting to general Retpolines. The impact of the transition for AMD processors is unknown, but Phoronix is already conducting new tests to find out.

It's possible Intel and other software developers will be able to reduce the impact of the BHI mitigations with additional time and effort, but for the time being, enabling the patches could prove very painful on servers and other systems that do a lot of I/O intensive work.
...

Continue Reading

[harlan4096]

Ryzen came out almost unscathed.

Spectre-v2 isn't going anywhere soon. VUSec, a group of researchers from Vrije Universiteit Amsterdam, recently discovered Branch History Injection (BHI), a byproduct of Spectre-v2 that affects Intel and Arm processors. According to Phoronix's latest report, while Intel has taken a performance hit up to 35%, AMD's processors got off easy.

AMD utilizes a Retpoline (return and trampoline) protection with its Zen-based processors to mitigate the Spectre-v2 vulnerability. Instead of the standard Retpoline implementation, AMD took the LFENCE/JMP approach, which is more forgiving on Ryzen processors. Unfortunately, Intel (yes, Intel) discovered flaws in AMD's mitigation, prompting the chipmaker to shift to a generic Retpoline model, the same one that Intel chips have adopted.

The transition from LFENCE to generic Retpoline will bring performance repercussions for all of AMD's modern chips. Phoronix highlighted that Linux distributions would allow users to defect back to LFENCE if they wish, but doing so will be a liability on security.

The Ryzen 9 5950X (Vermeer) suffered a 54% performance reduction with the Stress-NG (Context Switching) benchmark. Stress-NG is similar to Prime95 for Windows users, so it isn't the most relevant metric for measuring performance from a consumer workload standpoint. However, the Ryzen 9 5950X held up pretty well besides that specific benchmark. There was only a 5.3% and 5% drop in networking and storage performance, respectively. In comparison, the Core i9-12900K (Alder Lake) experienced performance hits of 26.7% and 14.5% in the networking and storage department.

Compared to the Ryzen 9 5950X, the Ryzen 9 5900HX (Cezanne) wasn't affected as much with Stress-NG. The mobile Zen 3 chip only saw 22% lower performance. However, the results revealed a higher toll on networking and storage performance. With the generic Retpoline, the Ryzen 9 5900X took a 9.2% and 9.1% hit in the former and latter, respectively.

It indeed came as a surprise that generic Retpoline didn't significantly impact AMD's EPYC server processors that handle more intensive I/O workloads. For example, with the EPYC 72F3, Phoronix only logged 8.9% lower networking performance and 7.2% lower storage performance. In addition, some workloads even benefitted from enabling generic Retpoline, showing improvements ranging from 2.2% to 3.8%.

Phoronix conducted its tests in Linux 5.17 kernel, so it remains to be seen if Windows users will experience similar margins regarding performance penalties. As per the publication, Microsoft reportedly will or has patched Windows, so it won't take long for us to find out.
...

Continue Reading