WingNews logo WingNews GitHub [2]
top | item 16094349

PCID is now a critical performance/security feature on x86

164 points| pedro84 | 8 years ago |archive.is | reply

56 comments

order
[+] brendangregg|8 years ago|reply
+1 yes, pcid makes a big improvement (I've been testing the KPTI patches with and without pcid).
[+] snaky|8 years ago|reply
> I did manage to pull out an old Lenovo ThinkPad W510 with an Intel Core i7 720QM Clarksfield that is from 2009 and lacks PCID but is affected by this cpu_insecure issue.

> On that old Clarksfield-era ThinkPad I wasn't going to be surprised if the performance was disastrous, but it wound up being better than I had anticipated given all the ongoing drama... In general purpose workloads there was no reportable performance difference in our frequent benchmark test cases. Under I/O, the PTI-using kernel did yield some slower results but not by the margins seen on the newer systems with faster storage. The laptop consumer-grade HDD in this laptop appeared to be the main bottleneck and kernel inefficiencies weren't causing as dramatic slowdowns.

> To some surprise, when carrying out network benchmarks with netperf/iperf3, in at least those contexts PTI didn't have a noticeable impact on the network throughput performance.

https://www.phoronix.com/scan.php?page=article&item=linux-mo...

[+] hannob|8 years ago|reply
Can anyone confirm that the way to identify if a linux system has pcid support is to check /proc/cpuinfo? Or is that merely to identify if the hw supports it, independent of the kernel support?

I checked two ubuntu servers, one 14.04, the other 16.04, both have it. Which seems odd given the claim that it's only been added recently to the kernel.

Also I see nothing showing up in dmesg, no config option and no proc interface on any system.

[+] ajross|8 years ago|reply
Indeed /proc/cpuinfo is telling you only the capabilities of the hardware, that's what it's for.
[+] pkaye|8 years ago|reply
Linux kernels did not make use of PCID until version 4.14 but your hardware was capable on processors from 2010 onwards.
[+] MBCook|8 years ago|reply
I saw a post in the last few days that said that most Macintoshes have this feature and Apple has been using it. Can anyone confirm that?
[+] the8472|8 years ago|reply
It seems to be a double win for bare metal machines. They always have PCID and they're less at risk in the first place since they don't share the hardware.

Virtualbox seems to lack PCID too.

[+] MBCook|8 years ago|reply
The machine may have PCID but that doesn’t mean the OS was using it.
[+] tveita|8 years ago|reply
This will be good to keep in mind when looking at performance reports.

The main performance numbers I've seen so far are from two kinds of sources:

1. Local benchmarks like the Phoronix benchmarks, which I think are all on physical hardware with PCID.

2. Reports from cloud customers like https://forums.aws.amazon.com/thread.jspa?threadID=269858 and https://twitter.com/chanian/status/949457156071288833. These are with a patched host, but with an unpatched guest OS. The best case scenario here seems to be that it doesn't degrade much further when the guest OS is patched.

I don't think I've seen any numbers yet for AWS with a patched guest OS - this would be interesting to see on instances with and without PCID support.

[+] bogomipz|8 years ago|reply
I had a question, the author states:

>"The PCID (Processor-Context ID) feature on x86-64 works much like the more generic ASID (Address Space IDs)"

Is ASID the RISC instruction that accomplishes the same thing that PCID does on x86 then?

[+] puzzle|8 years ago|reply
ASID is not an instruction. It's basically an attribute in how MMU tables are set up. Processes usually get different ASIDs from each other and all their MMU pages are tagged with it.
[+] dannyw|8 years ago|reply
Can PCID (like HyperThreading, full L3 cache, or extra PCI-e slots in the latest i7s and i9s) be enabled with an update that blows those (e)fuses.
[+] monocasa|8 years ago|reply
I don't think it's a feature that's binned off. Intel used to bin off virtualization support (which PCID is technically part off), but they added PCID after they stopped binning on virtualization support.
[+] loeg|8 years ago|reply
PCID is supported by low end consumer CPUs since 2010 or so. I don't believe it exists in a disabled form on any hardware. (Maybe I'm mistaken.)
[+] pgeorgi|8 years ago|reply
efuses typically have a final efuse to be blown in manufacturing to prevent any further modification of the entire block. Otherwise there's way too high a risk of some broken code accidentally changing the configuration.
[+] KerrickStaley|8 years ago|reply
One thing I still don't understand about all this:

Why is there still a (smaller) performance hit from the KPTI patch when PCID is used?

[+] ploxiln|8 years ago|reply
You still have to switch the page tables via the CR3 register. It costs.

And the code around there is more complicated now and has more conditionals ... as they say, it'll be opimized over time, this was the fastest reasonable solution they could put in there (and it still took some time).

Also keep in mind that the reason PCID wasn't used by Linux until 4.14 is that the most obvious way of using it incurred more overhead managing the IDs than it saved by not flushing the TLB between different userland processes. This is the land of fiddly details where theory and practice collide and theory often loses in practice.

[+] dmitrygr|8 years ago|reply
with PCID, you only flush the kernel mappings out of the TLB (as user mappings are the same). Without PCID you can only flush TLB or not, so you do, and thus user mappings are gone too and need to be repopulated.
[+] yuhong|8 years ago|reply
One problem is cross-vendor migration, because AMD don't support PCID.
[+] jimktrains2|8 years ago|reply
I hate that you can't even view Google groups without an account. It also requires us to do nothing but show text. To me groups and blogger has always represented what a terrible web application is.
[+] dingo_bat|8 years ago|reply
Blogger doesn't even load if you have js disabled.
[+] igravious|8 years ago|reply
God I hate Google Groups. I actually need some info from some of those groups and because of account b0rkage and shenanigans it is just too much of a hassle. Weren't they originally Usenet groups or something? Initially they were being decent Web stewards of them (_that_ was a long time ago) but then they got subsumed into the corp. as all things must. It's as inevitable as night follows day. Utter shame.
[+] dmm|8 years ago|reply
Google only asks you to login if it knows you have an account.
[+] aceoflzlz|8 years ago|reply
I don't have an account and I could read that just fine.
[+] unitboolean|8 years ago|reply
Many people said that if your processor support PCID, the performance will not be reduced a lot by the new patches. However, after installing new updates for windows and for my very new CPU 7600U everything becomes extremely slow. My laptop is now literally unusable. Even the simplest tasks are very slow. Before this update I was able to watch youtube videos in 4K, now I'm struggling even to watch 480p... I will never buy Intel processors again. In the last few months I only hear lies from Intel regarding Meltdown, Management Engine and other "holes" in their products. Now I can throw my super expensive laptop in garbage. Thank you Intel.