Phoronix’s Michael Larabel has shared some benchmarks showing how the mitigations for a new Spectre v2 variant dubbed Spectre-BHI/BHB will affect Intel processors as new as the 12th Gen Core Alder Lake series, and they ain’t pretty. The tests show that chips such as the Core i9-12900K and Core i7-1185G7 can suffer performance degradations as high as 26.7% and 35.6% in areas such as networking and storage based on sockperf, OSBench, and other tests. Disclosed by the VUSec security research group and Intel this week, Spectre-BHI/BHB affects both Intel and Arm CPUs. AMD chips aren’t believed to be affected.
In Light Of Spectre BHI, The Performance Impact For Retpolines On Modern Intel CPUs (Phoronix)
- The VUSec security researchers that discovered BHI are recommending Retpolines be enabled for newer processors even those with hardware mitigations against Spectre V2, but that’s that performance cost?
- Indeed in workloads exposed to return trampolines overhead, there can be quite a noticeable performance hit. This includes various network and I/O benchmarks and does translate to performance penalties in such databases (e.g. KeyDB, RocksDB, SQLite, LevelDB) in particular.
- AMD for their part isn’t believed to be affected by BHI and has still been making use of Retpolines on newer Zen processors. They did discover though their LFENCE/JMP-focused AMD Retpolines implementation to be racy and thus are now moving to use generic Retpolines instead.
Discussion (12 replies)
Join Discussion →I thought Intel said all bugs are AMDs.... Should keep their mouths shut.
The more things change, the more they stay the same.
AMD right now....
Really a big reason behind that is more peoe target Intel for these vulnerabilities. Onoy because the Intel install base is bigger in enterprise environments.
Perhaps, but that isn't a good excuse for them to exist, just a valid rationale for expedient discovery.
This hits AMD too - just not as much 'up to' performance hit, which itself is a significant reach.
From what I've gathered, this vulnerability is fairly arcane, and would take a software developer going out of their way to expose their system to risk. That's actually true for most of the recent vulnerability discoveries. Yes, we do want to know about them, but if they take purposefully running an insecure system, how big of a deal is it?
I've mentioned this in the past - and while AMD is catching up in terms of being a viable alternative in your average server, they simply have neither the install base nor really the production volume potential to be the more attractive research target. Intel is and will likely remain the target of first choice simply due to their ability to pump out enterprise-grade CPUs.
Not that I disagree - but these discoveries are good reminders that there is no such thing as a secure system. Hopefully the press on these vulnerabilities and the potential impact of their mitigations is cause for Intel (and AMD and...) to focus on reducing the attack surfaces of their respective product lines.
And Intel's string of snafus that resulted in the Skylake architecture having a five-year production lifetime as opposed to the typical ~1 year lifetime in Intel's 'tick-tock' release cadence certainly didn't help!
AMD isn't catching up in the server CPU world, they surpassed Intel a while ago., as far as performance, efficiency and density is concerned. What's held them back is that you can't integrate an AMD host in to a VMWare host cluster that's running Intel CPU's. High Availability doesn't work and VM's cannot migrate from one CPU platform to the other. Integration of AMD hosts has been slow because of that. For those replacing hardware, yes, a lot of providers have gone to or are going to AMD for the, cost, efficiency and density.
As far as this threat is concerned AMD platforms are already running the code necessary to mitigate it. No update needed. So any realized performance losses were in place from day one. It's impossible to say what those losses are since there is no control to compare to.
I'm still of the mind that these kinds vulnerabilities are of no concern to home users, as such the mitigations should be at the least opt out, but preferably opt in for anyone but enterprise users.
That's the thing: it doesn't matter if AMD is supply constrained, and Alder Lake-based Xeons are not likely to give up any real performance. AMDs window for leveraging Intel's recent missteps is rapidly closing.
It's got to be addressed at the OS level, so rolling out through Windows Update is really the only way to hit most end users. And from what I understand this latest vulnerability isn't even accessible from Windows.
As for opt in / opt out... that's a much bigger question. Preventing botnets from expanding is a pretty high priority.
Spectre has nothing to do with botnets. It's like proofing your car against volcanic acid when you live nowhere near an active volcano.
It was more of a general comment - i.e., why Microsoft may just roll mitigations out to end users, as they have invested themselves in shoring up endpoint security baselines.
Sheesh.
Might have to starting thinking about upgrading the server again. It's still running on my dual Ivy Bridge Xeon E5-2650 v2's.
I've considered picking up an EPYC single core system, but damn those things are extremely pricy, in addition to having to re-buy all of my RAM, since I am currently on DDR3.