Comments on: More Meltdown fixes

By: Sepherosa Ziehau

Sepherosa Ziehau — Thu, 11 Jan 2018 02:29:05 +0000

Anonymous, I think those sysctls work in the way you have described.

By: Anonymous

Anonymous — Wed, 10 Jan 2018 20:22:23 +0000

The sysctls are great.

Is it possible to turn isolated_user_pmap off, launch your trusted database and file server applications and then turn it back on? Will the trusted applications continue to enjoy fast system calls in this scenario?

Since a newly purchased Xeon scale server is unlikely to be replaced soon, having a per process way of enabling or disabling the privacy mitigation for untrusted or trusted code could help tremendously with performance.

By: Justin Sherrill

Justin Sherrill — Wed, 10 Jan 2018 15:28:33 +0000

Anonymous: These mitigations are controlled by sysctls, so they can be disabled in any situation where you don’t feel they are necessary.

Matthew Dillon posted another summary with specific sysctls mentioned; I’ll post on it later today when I have time to write it up.

By: Anonymous

Anonymous — Wed, 10 Jan 2018 03:01:37 +0000

I understand the issues with JavaScript on the desktop, why would anyone be running rogue JavaScript or any other untrusted code on a server?

Even so, would it be possible to allow trusted user-space processes to enjoy fast system calls and only enable meltdown mitigation for processes running untrusted code?

By: max

max — Tue, 09 Jan 2018 11:17:12 +0000

Yes. Because all it takes is a bit of rogue javascript via a browser to be compromised

By: Anonymous

Anonymous — Tue, 09 Jan 2018 04:25:01 +0000

Honest question: unless youre hosting your server on a shared VM environment (eg AWS, Azure, etc) – should we even care about apply the spectre / meltdown patch?

If I either host all my server on my own hardware or I host on baremetal, seems like I should really worry about apply these patches