New Spectre variant 4: Our patches cause up to 8% performance hit, warns Intel

Intel's Spectre variant 4 patches will be off by default, but users who turn it on are likely to see slower performance.

Intel's upcoming microcode updates to address the just-revealed Spectre variant 4 attack are likely to put a significant drain on CPU performance.

"If enabled, we've observed a performance impact of approximately two to eight percent based on overall scores for benchmarks like SYSmark® 2014 SE and SPEC integer rate on client and server test systems," wrote Intel executive vice president Leslie Culbertson.

Spectre variant 4 is a new subclass of speculative execution attacks discovered by Jann Horn of Google Project Zero and Microsoft's Ken Johnson.

Intel calls the Spectre attack a Speculative Store Bypass and calls its mitigation Speculative Store Bypass Disable (SSBD), which is delivered as a microcode update to operating system vendors, equipment manufacturers, and other ecosystem partners.

Intel in January was less forthcoming in its communications about the performance impact caused by its mitigations for Spectre variant 2, only saying it would vary depending on the workload. However, Google found the impact to be significant and developed its own Retpoline software alternative.

Intel's current benchmarking to test the impact of SSBD was run on unspecified Intel reference hardware and an 8th Generation Intel Core desktop microprocessor.

The performance impact is four percent in the SYSmark 2014 SE overall score, two percent under the SPECint_rate_base2006 (n copy) total score, and eight percent in the SPECint_rate_base2006 (1 copy) total score.

The impact on a Skylake architecture Xeon processor is similar under these benchmarks.

But unlike Intel's updates for variant 2, the updates for Spectre variant 4, which is rated as a 'moderate'-severity issue and closely related to Spectre variant 1, will be optional and will by-default set to off. In this state, there is no impact on performance.

"We've already delivered the microcode update for variant 4 in beta form to OEM system manufacturers and system software vendors, and we expect it will be released into production BIOS and software updates over the coming weeks," wrote Culbertson.

"This mitigation will be set to off by default, providing customers the choice of whether to enable it. We expect most industry software partners will likewise use the default-off option. In this configuration, we have observed no performance impact."

As Intel notes in its advisory, "SSBD provides additional protection by providing a means for system software to completely inhibit a Speculative Store Bypass from occurring if desired."

In other words, if consumers and OEMs want their hardware to be extra secure they can choose that option at the expense of performance.

Intel also notes that already-released browser mitigations against Spectre variant 1 do help mitigate variant 4. AMD similarly recommends leaving SSBD disabled.

SOURCE BY