• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

OpenBSD Turns Off Hyper-Threading to Combat Intel CPU Security Issues

W1zzard

Administrator
Staff member
Joined
May 14, 2004
Messages
27,964 (3.71/day)
Processor Ryzen 7 5700X
Memory 48 GB
Video Card(s) RTX 4080
Storage 2x HDD RAID 1, 3x M.2 NVMe
Display(s) 30" 2560x1600 + 19" 1280x1024
Software Windows 10 64-bit
Lead developer for OpenBSD Mark Kettenis has announced that OpenBSD will no longer enable Hyper-Threading on Intel processors by default. This move is intended to mitigate security exploits from the Spectre ecosystem as well as TLB and cache timing attacks, because important processor resources are no longer shared between threads. Their suspicion is that some of the unreleased (or yet unknown) attacks can be stopped using this approach.

This move is supported by the fact that most newer motherboards no longer provide an option to disable Hyper-Threading via BIOS. OpenBSD users who still want to use Hyper-Threading can manually enable support for it using the sysctl hw.smt. The developers are also looking into expanding this feature to other CPUs from other vendors, should they be affected, too.





The performance penalty from disabling Hyper-Threading is dependent on the software used. Highly optimized HPC software might even run faster without HT, other, more generic applications will see a performance hit. For example CineBench gains 30% with Hyper-Threading enabled.

Part of the reason why this change is happening now is due to criticism towards Intel, who keep failing at proper coordinated releases of exploits. Also Intel seems completely unresponsive to inquiries from the open source community. Only their buddies at big corporations like Apple, Google, Microsoft and Amazon get informed with enough lead time to prepare patches. That's why OpenBSD is taking the approach to immediately release a rough solution, while then waiting for Intel to come up with a fix that has a smaller performance impact.

View at TechPowerUp Main Site
 

qubit

Overclocked quantum bit
Joined
Dec 6, 2007
Messages
17,865 (2.87/day)
Location
Quantum Well UK
System Name Quantumville™
Processor Intel Core i7-2700K @ 4GHz
Motherboard Asus P8Z68-V PRO/GEN3
Cooling Noctua NH-D14
Memory 16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s) MSI RTX 2080 SUPER Gaming X Trio
Storage Samsung 850 Pro 256GB | WD Black 4TB | WD Blue 6TB
Display(s) ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) | Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case Cooler Master HAF 922
Audio Device(s) Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply Corsair AX1600i
Mouse Microsoft Intellimouse Pro - Black Shadow
Keyboard Yes
Software Windows 10 Pro 64-bit
I can't believe newer mobos don't allow HT to be turned off. :rolleyes: It's a basic configuration option. How dumb.
 
Joined
Sep 15, 2007
Messages
3,946 (0.63/day)
Location
Police/Nanny State of America
Processor OCed 5800X3D
Motherboard Asucks C6H
Cooling Air
Memory 32GB
Video Card(s) OCed 6800XT
Storage NVMees
Display(s) 32" Dull curved 1440
Case Freebie glass idk
Audio Device(s) Sennheiser
Power Supply Don't even remember
This is when you love LOLtel.
 
Joined
Dec 18, 2005
Messages
8,253 (1.19/day)
System Name money pit..
Processor Intel 9900K 4.8 at 1.152 core voltage minus 0.120 offset
Motherboard Asus rog Strix Z370-F Gaming
Cooling Dark Rock TF air cooler.. Stock vga air coolers with case side fans to help cooling..
Memory 32 gb corsair vengeance 3200
Video Card(s) Palit Gaming Pro OC 2080TI
Storage 150 nvme boot drive partition.. 1T Sandisk sata.. 1T Transend sata.. 1T 970 evo nvme m 2..
Display(s) 27" Asus PG279Q ROG Swift 165Hrz Nvidia G-Sync, IPS.. 2560x1440..
Case Gigabyte mid-tower.. cheap and nothing special..
Audio Device(s) onboard sounds with stereo amp..
Power Supply EVGA 850 watt..
Mouse Logitech G700s
Keyboard Logitech K270
Software Win 10 pro..
Benchmark Scores Firestike 29500.. timepsy 14000..
does this effectively turn an I7 into an I5.. :)

trog
 
Joined
Jan 8, 2017
Messages
9,504 (3.27/day)
System Name Good enough
Processor AMD Ryzen R9 7900 - Alphacool Eisblock XPX Aurora Edge
Motherboard ASRock B650 Pro RS
Cooling 2x 360mm NexXxoS ST30 X-Flow, 1x 360mm NexXxoS ST30, 1x 240mm NexXxoS ST30
Memory 32GB - FURY Beast RGB 5600 Mhz
Video Card(s) Sapphire RX 7900 XT - Alphacool Eisblock Aurora
Storage 1x Kingston KC3000 1TB 1x Kingston A2000 1TB, 1x Samsung 850 EVO 250GB , 1x Samsung 860 EVO 500GB
Display(s) LG UltraGear 32GN650-B + 4K Samsung TV
Case Phanteks NV7
Power Supply GPS-750C
Weren't some developers behind OpenBSD allegedly paid to leave backdoors in their OS ? Funny they are being so considerate.
 
Joined
Oct 2, 2004
Messages
13,791 (1.87/day)
So, Intel literally lost all the benefits because of security issues. First predictive cache and now HyperThreading. HT is huge deal. Is AMD's implementation of HT so different that they aren't affected?
 

qubit

Overclocked quantum bit
Joined
Dec 6, 2007
Messages
17,865 (2.87/day)
Location
Quantum Well UK
System Name Quantumville™
Processor Intel Core i7-2700K @ 4GHz
Motherboard Asus P8Z68-V PRO/GEN3
Cooling Noctua NH-D14
Memory 16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s) MSI RTX 2080 SUPER Gaming X Trio
Storage Samsung 850 Pro 256GB | WD Black 4TB | WD Blue 6TB
Display(s) ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) | Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case Cooler Master HAF 922
Audio Device(s) Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply Corsair AX1600i
Mouse Microsoft Intellimouse Pro - Black Shadow
Keyboard Yes
Software Windows 10 Pro 64-bit
So, Intel literally lost all the benefits because of security issues. First predictive cache and now HyperThreading. HT is huge deal. Is AMD's implementation of HT so different that they aren't affected?
They are affected, but not to the same degree, apparently. There were various news reports about this if you want to know more details.
 
Joined
Aug 20, 2007
Messages
21,541 (3.40/day)
System Name Pioneer
Processor Ryzen R9 9950X
Motherboard GIGABYTE Aorus Elite X670 AX
Cooling Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s) XFX RX 7900 XTX Speedster Merc 310
Storage Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s) 55" LG 55" B9 OLED 4K Display
Case Thermaltake Core X31
Audio Device(s) TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply FSP Hydro Ti Pro 850W
Mouse Logitech G305 Lightspeed Wireless
Keyboard WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software Gentoo Linux x64 / Windows 11 Enterprise IoT 2024

qubit

Overclocked quantum bit
Joined
Dec 6, 2007
Messages
17,865 (2.87/day)
Location
Quantum Well UK
System Name Quantumville™
Processor Intel Core i7-2700K @ 4GHz
Motherboard Asus P8Z68-V PRO/GEN3
Cooling Noctua NH-D14
Memory 16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s) MSI RTX 2080 SUPER Gaming X Trio
Storage Samsung 850 Pro 256GB | WD Black 4TB | WD Blue 6TB
Display(s) ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) | Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case Cooler Master HAF 922
Audio Device(s) Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply Corsair AX1600i
Mouse Microsoft Intellimouse Pro - Black Shadow
Keyboard Yes
Software Windows 10 Pro 64-bit
More like they failed to vet government contractor provided code.

OpenBSD wasn't paid to insert them, they just failed to notice that paid "helpers" were slipping them in aparently useful commits.

Have a read:

https://www.theregister.co.uk/2010/12/15/openbsd_backdoor_claim/
So the government might have been sliding backdoors into Linux on the sly? I find this very, very hard to believe. I'm sorry, but it's simply not possible.

/s
 

Frick

Fishfaced Nincompoop
Joined
Feb 27, 2006
Messages
19,671 (2.86/day)
Location
w
System Name Black MC in Tokyo
Processor Ryzen 5 7600
Motherboard MSI X670E Gaming Plus Wifi
Cooling Be Quiet! Pure Rock 2
Memory 2 x 16GB Corsair Vengeance @ 6000Mhz
Video Card(s) XFX 6950XT Speedster MERC 319
Storage Kingston KC3000 1TB | WD Black SN750 2TB |WD Blue 1TB x 2 | Toshiba P300 2TB | Seagate Expansion 8TB
Display(s) Samsung U32J590U 4K + BenQ GL2450HT 1080p
Case Fractal Design Define R4
Audio Device(s) Plantronics 5220, Nektar SE61 keyboard
Power Supply Corsair RM850x v3
Mouse Logitech G602
Keyboard Dell SK3205
Software Windows 10 Pro
Benchmark Scores Rimworld 4K ready!
So the government might have been sliding backdoors into Linux on the sly? I find this very, very hard to believe. I'm sorry, but it's simply not possible.

/s
nitpicking, but bsd =! Linux. ;)

Anyway, why is it not applied to amd?
 
Joined
Aug 19, 2008
Messages
107 (0.02/day)
Location
Jozi
This move is supported by the fact that most newer motherboards no longer provide an option to disable Hyper-Threading via BIOS
Pretty much have access to all the latest or at least high end boards starting at B360, H370, B350, X470, Z370 and X299 from at least 3 different board vendors.
I'd be interested to know which boards are these that don't allow disabling HT, which is actually in spec from INTEL.

On a sidenote, INTEL needs to get its act together, falling over themselves at every turn, with unforced errors. They are just fortunate their chief competitor is profoundly incompetent to some degree and unable to capitalize on these numerous short comings and failures from those in charge at INTEL (ThreadRipper sales are abysmal, when they should be killing INTEL's HEDT at every turn)
 

Frick

Fishfaced Nincompoop
Joined
Feb 27, 2006
Messages
19,671 (2.86/day)
Location
w
System Name Black MC in Tokyo
Processor Ryzen 5 7600
Motherboard MSI X670E Gaming Plus Wifi
Cooling Be Quiet! Pure Rock 2
Memory 2 x 16GB Corsair Vengeance @ 6000Mhz
Video Card(s) XFX 6950XT Speedster MERC 319
Storage Kingston KC3000 1TB | WD Black SN750 2TB |WD Blue 1TB x 2 | Toshiba P300 2TB | Seagate Expansion 8TB
Display(s) Samsung U32J590U 4K + BenQ GL2450HT 1080p
Case Fractal Design Define R4
Audio Device(s) Plantronics 5220, Nektar SE61 keyboard
Power Supply Corsair RM850x v3
Mouse Logitech G602
Keyboard Dell SK3205
Software Windows 10 Pro
Benchmark Scores Rimworld 4K ready!
AMD's smt implementation is different than Intel & more secure, for now.
yes, but i was after a more technical explanation.

Pretty much have access to all the latest or at least high end boards starting at B360, H370, B350, X470, Z370 and X299 from at least 3 different board vendors.
I'd be interested to know which boards are these that don't allow disabling HT, which is actually in spec from INTEL.

On a sidenote, INTEL needs to get its act together, falling over themselves at every turn, with unforced errors. They are just fortunate their chief competitor is profoundly incompetent to some degree and unable to capitalize on these numerous short comings and failures from those in charge at INTEL (ThreadRipper sales are abysmal, when they should be killing INTEL's HEDT at every turn)
Are they abysmal though? I haven't seen any numbers, but for what it's worth tr ranks higher than intel hedt on a popular price comparision site where i live. Would be nice to see concrete numbers though.
 
Joined
Dec 28, 2012
Messages
3,954 (0.90/day)
System Name Skunkworks 3.0
Processor 5800x3d
Motherboard x570 unify
Cooling Noctua NH-U12A
Memory 32GB 3600 mhz
Video Card(s) asrock 6800xt challenger D
Storage Sabarent rocket 4.0 2TB, MX 500 2TB
Display(s) Asus 1440p144 27"
Case Old arse cooler master 932
Power Supply Corsair 1200w platinum
Mouse *squeak*
Keyboard Some old office thing
Software Manjaro
Are they abysmal though? I haven't seen any numbers, but for what it's worth tr ranks higher than intel hedt on a popular price comparision site where i live. Would be nice to see concrete numbers though.
AMD hasnt released hard numbers. Their quarterly financial statements show that, while sales and revenue are up, they haven't exploded onto the market like some predicted. The HDET market is quite small compared to the server market, where EPYC is still in the process of rolling out.
 
Joined
Jun 10, 2014
Messages
2,995 (0.78/day)
Processor AMD Ryzen 9 5900X ||| Intel Core i7-3930K
Motherboard ASUS ProArt B550-CREATOR ||| Asus P9X79 WS
Cooling Noctua NH-U14S ||| Be Quiet Pure Rock
Memory Crucial 2 x 16 GB 3200 MHz ||| Corsair 8 x 8 GB 1333 MHz
Video Card(s) MSI GTX 1060 3GB ||| MSI GTX 680 4GB
Storage Samsung 970 PRO 512 GB + 1 TB ||| Intel 545s 512 GB + 256 GB
Display(s) Asus ROG Swift PG278QR 27" ||| Eizo EV2416W 24"
Case Fractal Design Define 7 XL x 2
Audio Device(s) Cambridge Audio DacMagic Plus
Power Supply Seasonic Focus PX-850 x 2
Mouse Razer Abyssus
Keyboard CM Storm QuickFire XT
Software Ubuntu
This action by the OpenBSD team seems hardly justified, the known security implications of SMT are maintainable when implemented properly.

The bigger discussion we should have is rather if SMT still makes sense for future CPUs. The purpose of SMT is to utilize the idle resources in the CPU to other threads while the execution is stalled due to branch mispreditions, data dependencies or cache misses. SMT may gain total throughput across multiple threads at the price of decreased throughput for a single thread, and "marginal" cost of implementation compared to a whole new CPU core.

Intel implemented HT at a time their Pentium 4 ("Netburst") architecture was struggling due to an inefficient design. At this time CPUs were single core, but multi-CPU setups existed for the enterprise market. The cost of implementation was relatively marginal, both for the front-end/prefetcher and the execution units. Making a single core have some powers of a "dual core" made sense at the time, and not only for marketing purposes, at the time it made scheduling easier and systems potentially less "hanging". It's worth mentioning that IBM's Power CPUs support 4-/8-way SMT, mainly used for executing massive amounts of threads of enterprise Java code, which normally have huge amounts of stalls due to cache misses.

But does SMT still make sense today, at least if we narrow our scope to desktops and laptops?
Performance:
The average gains is in the range of ~5%. The cases where we see 30% gains are edge-cases, there are also many cases where we see performance loss of >10%. Any synchronized workload risk losing performance with SMT, including gaming, audio processing, etc. SMT also introduces performance variability and higher latency.
Die cost:
While the cost of implementation of SMT in Pentium 4 was relatively low, modern CPU architectures relies more and more on their front-end; the prefetcher. This doesn't only add security implications, but also a strain on the prefetcher's resources, and of course the cache. Intel usually adds more L3 cache, but it's not enough to compensate for the performance loss. We are already at a point where the design cost of SMT is much greater than when it was introduced, and since we can easily add more cores to a design today, it makes more sense to prioritize more faster cores rather than cores with SMT. As we go forward, future CPU architectures is only going to be more advanced, and SMT adds more and more restrictions on the design choices.
Software - OS:
The kernel obviously have to be aware of SMT, and treats the CPU as x "strong" cores and x "weak" cores. This might have been simple when most computers had 1 core, but today with even HEDT soon getting >20 cores, this complexity becomes completely unnecessary.
Software - programs:
It's harder for a single program with many threads to scale well if SMT than for multiple programs. E.g. on an 8-core, some workloads will scale better with 8 threads, while others scale better with 16 threads. This comes down to how efficient the code is, and more efficient code will cause fewer stalls in the CPU, so there are fewer idle cycles to use for other threads. If the program assumes all threads are equal, splitting a workload into 16 threads vs. 8 threads may reduce performance (on the same 8-core CPU). SMT only really works well when you have a mix of "heavy" threads and "light" threads, and no need to synchronize them.

My assessment is that the costs of SMT are increasing while the gains are decreasing, and we're approaching a point where it will soon be "pointless". I would much rather trade an 8-core/16-thread CPU design for one that's either a faster 8-core or a 10-core instead.
 
Joined
Aug 30, 2015
Messages
166 (0.05/day)
Location
Copenhagen, Denmark
System Name Royal Fortune (Main)/Adventure Galley (NAS)/Little Ranger (HTPC)
Processor Intel i5 4460/AMD C-70/Intel Pentium G3258 Anniversary Ed.
Motherboard Gigabyte ga-z97x-gaming 5/Asrock C-70M1/Asrock Z97 Anniversary
Cooling Phanteks PH-TC12DX/Stock/Raijintek Triton Core
Memory 8GB Team Group Dark 1600 CL9/8GB Team Group Elite 1600 CL9/8GB Avexir Core 1600
Video Card(s) VTX3D R9 280X 3GB/APU/Palit GTX 750 TI StormX Duo
Storage 120GB Team Group Ultra L5 SSD + 1TB WD Black/4 X 2TB WD Blue/120 GB Kingston V300
Display(s) Dell 2310/AOC e2070Swn 19.5"/TV
Case In Win 707/Bitfenix Prodigy M/Dimastech Easy V3
Audio Device(s) N/A
Power Supply EVGA Supernova GS 650W/be quiet! System Power 7 350W/Xigmatek Maverick 400W
Mouse Logitech G303 Daedalus Apex/Razer Abyssus/-
Keyboard Corsair K70 Red/Steelseries Apex Raw/Logitech K400
Software Win10/FreeNAS 9.3/KodiBuntu
Thank you! This is why I still come to the forums...great info, short and to the point.
 
Joined
Sep 25, 2012
Messages
2,074 (0.46/day)
Location
Jacksonhole Florida
System Name DEVIL'S ABYSS
Processor i7-4790K@4.6 GHz
Motherboard Asus Z97-Deluxe
Cooling Corsair H110 (2 x 140mm)(3 x 140mm case fans)
Memory 16GB Adata XPG V2 2400MHz
Video Card(s) EVGA 780 Ti Classified
Storage Intel 750 Series 400GB (AIC), Plextor M6e 256GB (M.2), 13 TB storage
Display(s) Crossover 27QW (27"@ 2560x1440)
Case Corsair Obsidian 750D Airflow
Audio Device(s) Realtek ALC1150
Power Supply Cooler Master V1000
Mouse Ttsports Talon Blu
Keyboard Logitech G510
Software Windows 10 Pro x64 version 1803
Benchmark Scores Passmark CPU score = 13080
does this effectively turn an I7 into an I5.. :)

trog
No, this makes you go out and buy the new 8-core Intel, so you can still have 8 threads with HT turned off. At least it will overclock a little higher without HT enabled.
 
Joined
Jul 5, 2013
Messages
28,260 (6.75/day)
This is when you love LOLtel.
That firmware option is not Intel's purview. It is up to system/mobo builder to enable it in their product. Blame the manufacturers for this one, not AMD/Intel.

Weren't some developers behind OpenBSD allegedly paid to leave backdoors in their OS ? Funny they are being so considerate.
Citation please?

I'm sorry, but it's simply not possible.
Well, let's be fair, it is possible, but very unlikely and if did happen it'd be found swiftly, so..

AMD's smt implementation is different than Intel & more secure, for now.
Key point.
 

qubit

Overclocked quantum bit
Joined
Dec 6, 2007
Messages
17,865 (2.87/day)
Location
Quantum Well UK
System Name Quantumville™
Processor Intel Core i7-2700K @ 4GHz
Motherboard Asus P8Z68-V PRO/GEN3
Cooling Noctua NH-D14
Memory 16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s) MSI RTX 2080 SUPER Gaming X Trio
Storage Samsung 850 Pro 256GB | WD Black 4TB | WD Blue 6TB
Display(s) ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) | Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case Cooler Master HAF 922
Audio Device(s) Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply Corsair AX1600i
Mouse Microsoft Intellimouse Pro - Black Shadow
Keyboard Yes
Software Windows 10 Pro 64-bit
nitpicking, but bsd =! Linux. ;)

Anyway, why is it not applied to amd?
Ya, I was thinking open source and then wrote Linux. Brain fart, lol.

Well, let's be fair, it is possible, but very unlikely and if did happen it'd be found swiftly, so..
I was being sarcastic. :) Note the /s underneath my post. Of course they'd be only too willing to stick in backdoors. Remember the mini scandal with that dead terrorist's iPhone that they couldn't crack? They were trying to force Apple into putting backdoors into iOS.
 
Joined
Jul 5, 2013
Messages
28,260 (6.75/day)
I was being sarcastic. :) Note the /s underneath my post. Of course they'd be only too willing to stick in backdoors. Remember the mini scandal with that dead terrorist's iPhone that they couldn't crack? They were trying to force Apple into putting backdoors into iOS.
I understood you. No worries.
 

newtekie1

Semi-Retired Folder
Joined
Nov 22, 2005
Messages
28,473 (4.08/day)
Location
Indiana, USA
Processor Intel Core i7 10850K@5.2GHz
Motherboard AsRock Z470 Taichi
Cooling Corsair H115i Pro w/ Noctua NF-A14 Fans
Memory 32GB DDR4-3600
Video Card(s) RTX 2070 Super
Storage 500GB SX8200 Pro + 8TB with 1TB SSD Cache
Display(s) Acer Nitro VG280K 4K 28"
Case Fractal Design Define S
Audio Device(s) Onboard is good enough for me
Power Supply eVGA SuperNOVA 1000w G3
Software Windows 10 Pro x64
Spare a thought for the regular i3 buyer, they're getting locked Pentiums with extra l2/l3 cache :shadedshu:

Unless they have the latest gen i3, in which case they aren't losing anything.

Plus, its not like people can't just re-enable it. It is just an option that is now off by default instead of on by default.
 
Top