Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Probably you're on Win as you mentioned gaming. In Linux you can pass `mitigations=off` as a kernel boot time switch [1]. I did it on my old PC at home and it felt a bit snappier after that. However, I don't have any numbers to quantify it.

[1] https://www.phoronix.com/scan.php?page=news_item&px=Spectre-....



On Windows you'll have to delete C:\Windows\System32\mcupdate_GenuineIntel.dll to prevent Windows applying Intel microcode updates. Whatever microcode is in the bios, it will use that. There are also ways to modify the BIOS to update or downgrade its microcode.

My gaming PC, a Sandy Bridge i7-2600k, has had 20 microcode updates between 2010 to 2019. The majority were in 2013 until the spectre mitigations came in 2018. The last bios update for my mobo contains microcode 2 versions behind the spectre updates.

Feed a BIOS image in to this tool to view microcode information. https://github.com/platomav/MCExtractor


mitigations=off doesn't disable this effect.


A citation or some kind of further explanation would be more valuable than an effective "no it doesn't" response.


Sorry, I explained it more detail elsewhere in this comments section.

mitigations=off works at the OS kernel level to patch out some expensive aspects of what the kernel can do (possibly in concert with the CPU but driven by the kernel). This issue a microcode change that affects the CPU behavior without any intervention by the kernel, so mitigations=off doesn't help.


Do the microcode changed alone, without kernel mitigations, negatively impact performance?


Yes. There is no kernel mitigation associated with this issue and it is not in the Spectre class of vulnerabilities.

It is purely a microcode fix for an "old-school" data dependent timing issue.


It disables kernel mitigation, not microcode mitigations.


Thanks! I wasn't aware of that!


Yes, I actually dual-boot.

I know this way of disabling mitigations on Linux (nevertheless thank you, I well might be unaware of this feature, I only learnt it some years ago).

However, I doubt you can disable microcode-level mitigations this way. I believe it only affects the kernel level.


On some linux distributions [0] microcode is loaded early during kernel boot. So it's a matter of pinning the package to a previous version. No idea what happens with BIOS/UEFI updates though, although you can roll these back too. Obviously the "proper" way here is to have open source microcode but I can't see that happening anytime soon.

[0] https://wiki.archlinux.org/title/Microcode#Early_loading


I also have no idea how to do on Windows but disabling those mitigations along with other unnecessary Windows 10 stuff can be done through Chris Titus' debloat program: https://christitus.com/debloat-windows-10/


Can you disable these on a per-process basis? I'm not concerned that my compiler or Blender render is going to side-channel attack whatever other part of the system. Generally there's little overlap between completely untrusted code and code that requires high performance.


> Can you disable these on a per-process basis?

No. If it wasn't impossible, it would add a massive delay to context switches between processes as the required microcode changes are applied.


Hm... I'm on a host OS with Meltdown mitigations disabled, but I can seemingly run a VM with the mitigations enabled, verified via InSpectre[1]. I guess that's different somehow?

1: https://www.grc.com/inspectre.htm


This is because the Spectre/Meltdown can't be patched with microcode updates, the mitigations instead use different kernel mechanisms (KPTI for Meltdown, retpolines for Spectre). If the guest kernel for your VM is using these mitigations it will be protected even if the host has mitigations disabled.


And I guess those kernel mechanisms can’t be applied per process? If a hypervisor is required, could, say, JVM do it?


There's a lot of mitigations. Some are microcode, some are kernel/vmm code, some are user space if that process is running untrusted code. Your host probably just isn't running with the normal ISA mitigations, but the microcode installed.


Ha interesting! It was something I wanted to check/try. I'm wondering if it makes the mitigations less effective. Maybe it would drop for some time the even minimal risk of netspectre or such and make cybertight architects lay off my vm hosts...


It would be interesting if they could be done per core... So one could reserve 1 core for JS and also down-clock it to a minimum.


Me too. Last time I checked, it halved my boot time, which I know is not a perfect benchmark but it's something.


Last I checked, my performance almost doubled in multicore benchmarks when I disabled mitigations.


> Probably you're on Win as you mentioned gaming.

This is not as sure a deduction as it once was.

The main reason for games not to be playable on Linux is the anticheat software used in modern online games. Pretty much everything else will now run perfectly (see protondb.com). Since the commentor you were replying to specified that they played old single player games they would probably be fine with just Linux. Indeed many sufficiently old Windows games are now easier to play on Linux than they are on modern Windows.


Agreed! That's why I said probably. I am also gaming a bit on Linux, but I know the vast majority of people still stick with Winddows for that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: