HVCI/memoryintegrity/ perf drop without 7TH gen processors.

[Adelin]

Hello,

I had memory integrity enabled in windows defender, and in benchmarks , i had lower performances.

Just to understand if i could improve performance somehow, i found interesting things like:


<<To have better performance and security require MBEC from intel and amd 7th generation.>>

Here are different articles, speaking about HVCI:

The potential performance Impact of Device Guard (HVCI)

http://borec.ch/the-potential-performance-impact-of-device-guard-hvci/

Borec/Borec's Legacy meets Modern Device Management Blog/ August 5 2018

<<the eureka moment came when turning of virtualization in the firmware. We now had a fast and responsive machine. In fact it was approximately 30-40% faster! (Based on a number of user scenario based tests, e.g file copy, application open, zip extraction, math calculations etc).
What could it be? Credential Guard just protects credentials and KMCI just checks that the drivers are signed?
Further investigation showed us that HVCI was to blame.
After an escalation to Microsoft we received a response to check if we had 7th gen CPUs together with a screen shot of the new features added by Intel and a comment along the lines of “Apparently you need this feature”. They were referring to MBEC.>>




What is Windows Defender Application Control?
https://www.petri.com/what-is-windows-defender-application-control

Petri ITknowledgeBase/ Russell Smith/ September 7, 2018


Why my 7-year old Windows 10 laptop became unbearably slow
https://www.ctrl.blog/entry/slow-windows-hvci.html

<<Turning off this feature immediately resolved all my performance and bluescreening problems. You can find the Off switch in the Windows Security app: Device Security: Core Isolation: Memory Integrity. Notably, if I try to turn Memory Integrity back on again I’m greeted with an error message that says:

“Memory integrity can’t be started. There may be an incompatibility on your device.”

It turns out that neither the Trusted Platform Module (TPM) or my processor meets the minimum feature requirements to run this feature. Then how, you may ask, was it enabled by default in the first place?>>

Daniel Aleksandersen/Ctrl.blog/2019-07-17


Microsoft Releases Standards for Highly Secure Windows 10 Devices
https://www.bleepingcomputer.com/news/security/microsoft-releases-standards-for-highly-secure-windows-10-devices/

BleepingComputers/Lawrence Abrams/ november 6 2017

<<For processor generation, Microsoft recommends that users use Intel & AMD 7th Generation processors. When questioning these requirements, Windows Offensive Security Team and Windows Device Security manager Dave Weston stated that the 7th generation CPUs contained Mode based execution control (MBEC), which provides further kernel security.>>

What microsoft forgot to tell us, is without MBEC from 7th gen processors,
Performance would decrease.

New windows 10 install if drivers are updated to allow HVCI to run, will have Memory Integrity on by default.

That is a good thing for a security purpose, but in my case, my 4670k already crippled by a very very small margin by spectre and meltdown patrch + bios i moded with ubu tools

If i enable memory integrity, it's hardware chaos, with dx12 games, taking long time to load ( bf5 and 1) requiring minutes and minutes waiting time.

Performance drop in benchmarks..

But i won't blame microsoft, as any security improvements are welcome.

Only angry position i have, is they don't tell us inside windows defender setting, you need 7Th gen cpu to have better performance, and potential security increase

That's a bit disgusting.

Thanks Microsoft for hidding this information under obscure docs, and scheme, users like me would never try to find or read.

[Adelin]

https://www.reddit.com/r/sysadmin/comments/9ll02b/windows_defender_credential_guard_performance/

Windows Defender Credential Guard performance

This user is saying in benchmarck 7th processors performance decrease by 8% +- and 5/6 th gen 30% +-

All gens processors if spectre and meltdown mitigations are disabled, get half performance decrease.

That's sad mitigations spectre meltdown, + hvci, impact performance that much, it would be cool if 7th gen would have only 4% perf decrease, with hvci.

I'm trolling:

troll on / Spectre and meltdown, was a conspiracy to make us buy better performances hardware + hvci enabled by default on new w10 install with non 7th gen processors. / troll off


Extremer

<<We had major performance issues. After quite a long case with Microsoft, we conclusively narrowed it down to HVCI. They claimed they had no documented case of it causing performance issues before but we ran a lot of different tests with a PFE onsite and had the same results on a clean Windows image.

Most of our machines had 5-6th gen Intel CPUs which suffered about a 30% decrease in performance benchmarks (strangely enough 2D graphics and memory performance were impacted, CPU/disk/3D not so much), running only CG is about a 5% decrease. Running HVCI on 8th gen has only a ~8% performance impact. Another interesting find - if you rollback the Spectre BIOS patch, the performance hit is halved on 5/6th gen.

I think it's ridiculous Microsoft still do not have any official post about this. We had our case opened in June and got it escalated quite high and even the top performance experts claimed HVCI should not have an impact on performance. Yet, the in the video from the Borec article they say without MBEC (added in 7th gen), it would have a big performance impact..>>

[Bad 💀 Motha]

It's also because no one in the industry cares how much an old cpu like 7th gen or older losses performance, as you as the user could just not patch it and then not loss performance. The industry is not going to keep patching older hardware, that is a given.

[Magma Dragoon]

Skylake server units have MBEC

[Adelin]

No skylake desktop processor with MBEC ?

Anyway i tryed just for the fun, a bios with speculative disabled, + reg file hex 3 value instead of 400,

CPuZ reached 470 max single core, and 1850 multicore after few trys.

I enabled the ubu tool bios with speculative patched ( disabled) + enabled with reg the os patch.

I have hard time to reach 1810 score multi and 461 is max single core score.
It's actually sitting @ 1760 most of the time and 456 one core

So on Haswell, there is a little decrease of performance.
It's not much, but if i enable this time memory integrity, i loose 50 points on multicore score, and single core score ( i dunno single score loss i forgot it )

I think i really wanna enable memory integrity, it worked fine with everry games, minus stalink that doesn't support hyperv isolation.

Maybe it's time to buy a new motherboard, cpu and ram.
The loss wityhout MBEC on, would be too much.

[Adelin]

Last update KB4517389 for windows 10 fixed cpu-z performance.
I get 470 single core perf and 1852 max score.

Also i had kone + military mouse having cursor freezing every two minutes, and the freeze is gone.

it's possible the patch is not the fixer, but installing old bios and putting moded bios back did fix something.

I would be not surprised, as one day i had negative temperature in bios and windows , of -38@ idle, that happend from nowhere on z87-plus, resetting to default, or cutting down power for 10 minutes, and even removing the cmos battery, or doing cmos reset, didn't fix the negative temp issue.

Flashing again the bios with the same version, unlocked positive temp instead of negative.

This is where i'm thinking bios / uefi, can corrupt by itself, as some bug may happen, when changing some value, i would not been surprised at all.