back
20 comments
> AMD Inception Mitigations Can Lower Performance of CPUs by Up to 54% - in a specific MariaDB based benchmark.
`boot.kernelParams = [ "mitigations=off" ];`

Have there been actual JS-based attacks on users seen in the wild? I feel conflicted about this. I'm very stubborn about enabling 2FA everywhere possible, but I just can't convince myself I need to have these mitigations enabled on my laptop. I do leave the mitigations turned on for my "servers".

These attacks on CPU defects do work, and if they are being used to spy on people connected to internet, the attackers won't announce it.

If you really care about secrecy of your data, you would not be asking - you have to enable all mitigations, and do much more work to change patterns of computer use in a radical way to make your data somewhat secure against this level of craft.

If you care about sane practices that don't cost a lot but you don't consider yourself to be an interesting target, or you're not going to change your habits of computer use, chances are, someone on the internet slurping your data randomly is not the end of the world. If that is the case (most people), then on your personal laptop you can turn the costly mitigations off. After all, keeping them all on won't by itself give you solid security, most probably there are many more attacks on CPU/kernel out there for which there are no mitigations yet.

About the only scenario where keeping mitigations on is important and also "enough" is hosting/cloud vendors. "We follow the minimum industry security standard, but we don't guarantee someone else is not reading your data, that would be almost impossible."

Tomshardware link: https://www.tomshardware.com/news/amds-inception-fix-causes-...
Which links to the original Phoronix source. Conclusion from Phoronix:

"Overall it comes down to what workloads you are engaged in whether you may notice any performance difference when upgrading your Linux kernel (or otherwise being patched for Inception on your given OS) on an AMD Zen desktop or server. For the most part users are unlikely to notice anything drastic, aside from some sizable database performance hits in a few cases. ... For those wanting to avoid the new mitigation, there is always the "mitigations=off" route or the "spec_rstack_overflow=off" as used in this round of testing ..."

https://www.phoronix.com/review/amd-inception-benchmarks

At what point will all CPUs go back to zero speculation / in order ?
Probably never, it's likely that this performance drop is still less than you'd get from a completely naive in order implementation.

Speculative processing gives a huge performance boost in tight loops.

I'm not a big asm guy but it feels like user control of speculation is a good outcome. Use it for situations where it doesn't matter and leave it in order for situations that require security.
Aren't some of these speculation vulnerabilities exploitable from Javascript? This makes everyday web browsing "require security"
Some are, although they are relativily hard to exploit, as they require some JavaScript pattern that somehow will make the interpreter, or generated JIT code, have a sequence of machine code instructions that somehow trigger them.

So much more hard to exploit than a typical native code application, however it is still possible when all ingredients are available, including skillful hacking skills.

So now where are all the usual Intel bashers praising AMD?
AMD was impacted by a Meltdown-style attack[0], and the AMD Secure Encrypted Virtualization voltage attack[1] that, recently, was used to jailbreak Teslas. This culture of corporate fandom "console wars" mentality that has permeated almost every facet of technical discussion makes me nauseated. (not directed at parent -- just ranting.)

[0] https://www.amd.com/en/resources/product-security/bulletin/a... [1] https://arxiv.org/pdf/2108.04575.pdf

At its roots, is the usual "my team vs others" from school playgrounds.
You're likely being downvoted for baiting but it is true that it would only have been a matter of time before AMD faced a speculation issue
Indeed, even ARM has similar issues, unfortunely no vendor is free from hardware bugs.
benchmark link: https://www.phoronix.com/review/amd-inception-benchmarks
https://www.phoronix.com/review/amd-inception-benchmarks/7

This feels more significant to me than people here are willing to admit. This is with a Ryzen 9 7950x. What's the point of buying new generations if exploits are just going to slow down desktop performance by up to 30%?

> What's the point of buying new generations if exploits are just going to slow down desktop performance by up to 30%?

Probably in the fact that the older generations are susceptible to these exploits too, so mitigations will make your older CPU much slower than the new generation, even when the new generation is 30% slower than it can be.

When Moore's law is dead, and you have to keep producing better chips every generation, the easiest way is to dunk the old chips. My new favourite conspiracy theory: They design those chips with such vulnerabilities in mind, and when the time is right they "discover it" and offer a fix. New chips, of course, have no such vulnerability. Those will have a new one, discovered 2 years from now.
> New chips, of course, have no such vulnerability

I'm waiting for it...