PCID is now a critical performance/security feature on x86

26

PCID is now a critical performance/security feature on x86 hardware performance security virtualization groups.google.com
via akpoff 7 months ago | cached | 7 comments

7

5

Freaky 7 months ago | link

I gather INVPCID is the important one. PCID was added in Westmere (2010), but INVPCID, which allows for selectively invalidating TLB entries, arrived a few generations later in Haswell (2013). Without it the Linux workaround at least just defaults to the no-PCID path.

Rather annoying, all my main local servers are Westmeres.
1. 1
  
  szbalint 7 months ago | link
  
  I’ve seen conflicting information on this, some people claim that Linux demands INVPCID for the performance problem mitigation but some people are saying that PCID without INVPCID still takes a faster path on Linux than a processor without both features would.
1

wyager 7 months ago | link

How do you check if a CPU has this feature?
1. 1
  
  apg 7 months ago | link
  
  From the OP in that thread: “The quickest way to check whether or not you have PCID is to grep for “pcid” in /proc/cpuinfo” – Obviously, this is Linux only.
1

kristof 7 months ago | link

Ok. So far, you’d think this whole thing boils down to “once I update my Linux distro with the latest fixes, I just want to make sure I’m not running on ancient hardware”. And since virtually all x86 hardware made this decade has PCID support, everything is fine. Right? That was my first thought too. Then I went and check a bunch of systems. Most of the Linux instances I looked in had no pcid feature, and all of them were running on modern hardware. Oh Shit.
1
feld 7 months ago | link
ugghhhhhhh this is painful.

I have a ton of VMs at work on Intel(R) Xeon(R) CPU E5-2699 v3 CPUs. None of the guests show PCID support.

VMWare doesn’t have a good way to show CPU flags so you have to ssh in and run this:
```
$ vim-cmd hostsvc/hosthardware

...

cpuFeature = (vim.host.CpuIdInfo) [
(vim.host.CpuIdInfo) {
level = 0, 
vendor = <unset>, 
eax = "0000:0000:0000:0000:0000:0000:0000:1111", 
ebx = "0111:0101:0110:1110:0110:0101:0100:0111", 
ecx = "0110:1100:0110:0101:0111:0100:0110:1110", 
edx = "0100:1001:0110:0101:0110:1110:0110:1001"
}, 
```
This site (http://www.felixcloutier.com/x86/CPUID.html) says PCID is the 17th register of ecx

It’s a zero. So no support? Greaaaaaaaaaaaaat.
1

amro 7 months ago | link

Desktop link