https://www.phoronix.com/scan.php?page=article&item=3-years-specmelt&num=1 Phoronix * Articles & Reviews * News Archive * Forums * Premium * Categories * Computers * Display Drivers * GPUs / Graphics Cards * Linux Gaming * Memory * Motherboards * CPUs / Processors * Software * Storage * Operating Systems * Peripherals * Close * * Articles & Reviews * News Archive * Forums * Premium * Categories Computers GPUs / Graphics Cards Linux Gaming Memory Motherboards CPUs / Processors Software Storage Operating Systems Peripherals * [ ] [Search] A Look At The CPU Security Mitigation Costs Three Years After Spectre /Meltdown Written by Michael Larabel in Software on 6 January 2021. Page 1 of 9 . 23 Comments With this week marking three years since Spectre and Meltdown were made public in ushering in a wave of CPU security disclosures that followed and mitigations that often resulted in measurable performance hits, here is a look at how the performance costs stand today with various new and older Intel CPUs as well as AMD processors too. This article is looking at the current performance costs under Linux with the default mitigations and then the run-time disabling of the relevant mitigations for each of the processors under test while using an up-to-date Ubuntu 20.10 paired with the new Linux 5.10 LTS kernel. [image] For seeing how the performance is looking three years after Meltdown and Spectre were initially disclosed, I spent the holidays re-testing a range of Intel and AMD desktop processors for seeing the current default mitigation costs. A mix of desktop processors were tested while using an up-to-date Linux software stack with Ubuntu 20.10 with all available stable release updates and also opting to use the brand new Linux 5.10 kernel that is significant in its also a Long-Term Support (LTS) kernel series to be maintained for at least the next five years. Over the past three years we have continued to see new vulnerabilities disclosed resulting in new mitigations. We also continue to see ongoing work around trying to minimize the performance penalties incurred by the likes of return trampolines (Retpolines), finding new kernel code susceptible to Spectre V1 issues, and more. [image] A range of desktop systems were tested for this three-year look at the mitigations. On each system the same software stack was used while booting the Linux 5.10 kernel in its default configuration and then on the second run after booting it with the "mitigations=off" kernel command line flag for the run-time disabling of all applicable CPU security mitigations that have come in the past three years. Below is a look at the mix of processors tested for this article as well as the relevant (default) mitigations for the each of them. This article is looking at just the default versus off configuration and isn't toggling SMT/HT or any other overrides / extra precautions. Core i7 4770K - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Mitigation of PTE Inversion; VMX: conditional cache flushes SMT vulnerable + mds: Mitigation of Clear buffers; SMT vulnerable + meltdown: Mitigation of PTI + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/ swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full generic retpoline IBPB: conditional IBRS_FW STIBP: conditional RSB filling + srbds: Mitigation of Microcode + tsx_async_abort: Not affected Core i7 5775C - tlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Mitigation of PTE Inversion; VMX: conditional cache flushes SMT vulnerable + mds: Mitigation of Clear buffers; SMT vulnerable + meltdown: Mitigation of PTI + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/ swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full generic retpoline IBPB: conditional IBRS_FW STIBP: conditional RSB filling + srbds: Mitigation of Microcode + tsx_async_abort: Mitigation of Clear buffers; SMT vulnerable Core i7 7700K - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Mitigation of PTE Inversion; VMX: conditional cache flushes SMT vulnerable + mds: Mitigation of Clear buffers; SMT vulnerable + meltdown: Mitigation of PTI + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/ swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full generic retpoline IBPB: conditional IBRS_FW STIBP: conditional RSB filling + srbds: Mitigation of Microcode + tsx_async_abort: Mitigation of Clear buffers; SMT vulnerable Core i7 8700K - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Mitigation of PTE Inversion; VMX: conditional cache flushes SMT vulnerable + mds: Mitigation of Clear buffers; SMT vulnerable + meltdown: Mitigation of PTI + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/ swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full generic retpoline IBPB: conditional IBRS_FW STIBP: conditional RSB filling + srbds: Mitigation of Microcode + tsx_async_abort: Mitigation of Clear buffers; SMT vulnerable Core i9 9900K - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Not affected + mds: Mitigation of Clear buffers; SMT vulnerable + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/ swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full generic retpoline IBPB: conditional IBRS_FW STIBP: conditional RSB filling + srbds: Mitigation of Microcode + tsx_async_abort: Mitigation of Clear buffers; SMT vulnerable Core i9 10900K - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Enhanced IBRS IBPB: conditional RSB filling + srbds: Not affected + tsx_async_abort: Not affected Core i9 10980XE - itlb_multihit: KVM: Mitigation of VMX disabled + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Enhanced IBRS IBPB: conditional RSB filling + srbds: Not affected + tsx_async_abort: Mitigation of TSX disabled Ryzen 7 1800X - itlb_multihit: Not affected + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full AMD retpoline IBPB: conditional STIBP: disabled RSB filling + srbds: Not affected + tsx_async_abort: Not affected Ryzen 9 3950X - itlb_multihit: Not affected + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full AMD retpoline IBPB: conditional STIBP: conditional RSB filling + srbds: Not affected + tsx_async_abort: Not affected Ryzen Threadripper 3970X - itlb_multihit: Not affected + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full AMD retpoline IBPB: conditional STIBP: conditional RSB filling + srbds: Not affected + tsx_async_abort: Not affected Ryzen 9 5950X - itlb_multihit: Not affected + l1tf: Not affected + mds: Not affected + meltdown: Not affected + spec_store_bypass: Mitigation of SSB disabled via prctl and seccomp + spectre_v1: Mitigation of usercopy/swapgs barriers and __user pointer sanitization + spectre_v2: Mitigation of Full AMD retpoline IBPB: conditional IBRS_FW STIBP: always-on RSB filling + srbds: Not affected + tsx_async_abort: Not affected The same solid-state storage was used on each of the systems tested and each system was running with RAM at its optimal number of memory channels and frequency for each platform. Via the Phoronix Test Suite a wide range of workloads relevant to these CPU security mitigations were carried out with the default kernel protections as of Linux 5.10 and then in the mitigations=off mode. 23 Comments - Next Page Tweet [Page 1 - Introduction ] Page: 123456789Next Page Related Articles A Look At The CPU Security Mitigation Costs Three Years After Spectre /Meltdown Phoronix Test Suite 10.2 Released For Open-Source, Cross-Platform Automated Benchmarking AMD Performance On Linux 5.11 Remains Mixed Due To Schedutil With Frequency Invariance Testing The Intel "Workload Hints" Capability Of Linux 5.11 Linux 5.11 Is Heavy On New Features, Improvements For 2021 Linux 5.11 Is Regressing Hard For AMD Performance With Schedutil Trending Linux News HDMI Forum Closing Public Specification Access Is Hurting Open-Source GPU Drivers The Qt Company Is Tomorrow Moving Qt 5.15 To Its Commercial-Only LTS Phase Linux NVMe Simple-Copy Support Inches Closer To The Kernel Linux 5.11-rc2 Released - It's Tiny Due To Developers Offline With "Holiday Things" Fedora 34 To Ship With Standalone XWayland, LLVM 12 + Other Changes Approved Radeon Linux Drivers Now Only Officially Support Smart Access Memory On Zen 3 + RDNA2 Radeon FreeSync Video Mode Optimization Updated For The AMDGPU Linux Driver RHEL9 Raises Base Target For x86_64 CPUs Plus Possible Optimized Libraries With glibc-hwcaps Latest Linux News Proton Experimental Update Brings Performance Work, MS Flight Simulator VR Mode Intel Haswell GT1 Graphics Have Been Busted The Past Half-Year On Linux Intel Releases High Performance Computing Reference Stack 2.0 Early Work Is Underway On Reverse-Engineering The Apple M1 GPU Progress On The GNOME 40 Shell Continues At Full Speed NVIDIA 460.32.03 Linux Driver Released With Official Vulkan Ray-Tracing Intel's IWD 1.11 Released For Faster WiFi Scanning NVIDIA Prepares XWayland OpenGL/Vulkan Acceleration Support Fedora 34 Approved To Enable Systemd-OOMD By Default For All Spins Linux 5.10.5 Released - It Disables FBCON Accelerated Scrolling AMD's "AMDVLK" Vulkan Driver Making It Easier To Switch To RADV Driver OpenZFS 2.0.1 Released With Linux 5.10 Support, Many Fixes Show Your Support, Go Premium Phoronix Premium allows ad-free access to the site, multi-page articles on a single page, and other features while supporting this site's continued operations. Latest Featured Articles AMD Ryzen 9 5950X + GCC 11 Compiler Benchmarks At Varying Optimization Levels A Look At The CPU Security Mitigation Costs Three Years After Spectre /Meltdown Benchmarking OpenMandriva Lx 4.2 With Its AMD Zen Optimized Build Phoronix Test Suite 10.2 Released For Open-Source, Cross-Platform Automated Benchmarking AMD Performance On Linux 5.11 Remains Mixed Due To Schedutil With Frequency Invariance Support Phoronix The mission at Phoronix since 2004 has centered around enriching the Linux hardware experience. In addition to supporting our site through advertisements, you can help by subscribing to Phoronix Premium. You can also contribute to Phoronix through a PayPal tip. Phoronix Media --------------------------------------------------------------------- * Phoronix Test Suite * OpenBenchmarking.org * Phoromatic * LinuxBenchmarking.com Phoronix Premium --------------------------------------------------------------------- * Support Phoronix * While Having Ad-Free Browsing, * Single-Page Article Viewing Share --------------------------------------------------------------------- * Facebook * Twitter * Legal Disclaimer, Privacy Policy | Contact * Copyright (c) 2004 - 2021 by Phoronix Media. * All trademarks used are properties of their respective owners. All rights reserved.