[Beowulf] Update on dealing with Spectre and Meltdown

[Peter Kjellström]

On Thu, 8 Mar 2018 13:10:15 -0500
Prentice Bisbal <pbisbal at pppl.gov> wrote:

> Beowulfers,
> 
> Have any of you updated the kernels on your clusters to fix the
> Spectre and Meltdown vulnerabilities? I was following this issue
> closely for the first couple of weeks. There seemed to be a lack of
> consensus on how much these fixed would impact HPC jobs, and if I
> recall correctly, some of the patches really hurt performance, or
> caused other problems. We took a wait-and-see approach here. So now
> that I've waited a while, what did you see?

We updated on day one as we would for any security related update.

We ran regression tests across serveral applications at scale and came
to the rough conclusion that PTI (meltdown) was essentially no impact
(<1%) but IBRS/IBPB (spectre) more costly (2-5%).

After this analysis two significant things happened, 1) new kernel with
possibly different behaviour 2) Intel reverted the microcode side of
IBRS/IBPB. This is not reflected in my numbers above.

Right now we're looking at adding new microcode for both our old
Sandybridge and Haswell systems to enable the spectre side again. This
will include another performance regression testing round.

OS for these systems, CentOS-6.

/Peter K