Good news for Linux users , as changes underway in the Linux 4.20 kernel to mitigate STIBP (Single Thread Indirect Branch Predictors) appear to be restoring performance on Intel systems. Now, instead of needing up to 50% of the performance to run some programs when updating to the latest kernel version, Linux users can expect their systems to run as before, while also enjoying greater security.
STIBP is supposed to protect against Spectre v2 vulnerabilities, which rely on vulnerabilities in CPUs with simultaneous multithreading (SMT), such as Intel processors with Hyper-Threading enabled. This is a good thing in theory – no one wants their system to be affected by a vulnerability. However, the nature of the vulnerability, combined with the dramatic impact this version had on performance, has led many to question the benefits of using STIBP.
These concerns reached Linus Torvalds, who stated that “when performance is reduced by 50% in some cases, people should start to wonder if it was worth it” and that “I think we should use the same logic as L1TF: we default to something that doesn’t dramatically reduce performance.” He also noted that people who really care about security are more likely to disable SMT entirely than rely on STIBP mitigations.
Phoronix has been evaluating some of the preliminary changes made to STIBP in kernel 4.20 to see what kind of impact they might have on system performance. Many of the results are favorable: the updates bring the Linux 4.20 WIP Conditional STIBP version to the same level as Linux 4.19.0 in many benchmarks. This version has lower performance in some areas, but it is also much better than 4.20, so it should help most users affected by this issue.
All of this happens, however, because the Linux 4.20 WIP Conditional STIBP version changes the mitigation implementation so that it only runs when processes require it or for SECCOMP threads.
