Lazy Reading for 2018/01/21

Almost all of this was done within 24 hours of the last Lazy Reading.  No idea why there were so many good candidates for reading, but I’m happy about it.

In Other BSDs for 2018/01/20

Done well ahead of time.

 

Lazy Reading for 2018/01/14

This is almost all link overflow from last week – and next week’s edition is almost complete.  There’s a lot to read lately!

In Other BSDs for 2018/01/13

A full slate of BSDs this week.

Even more Meltdown

Are you tired of hearing about Meltdown/Spectre yet?  Doesn’t matter!  The two sysctls for controlling mitigation in DragonFly have been renamed:

machdep.meltdown_mitigation
machdep.spectre_mitigation

They go to hopefully sensible defaults, but Matthew Dillon has done some testing to show the effects of each in various combinations.   (Update: more changes and tests.)  Note that this is not the final mitigation work; compilers (i.e. gcc) are being updated to include workarounds for this, so new gcc -> new compiler in DragonFly -> new defenses.  No silver bullet there, though.

Microcode updates on DragonFly

One side effect of Meltdown/Spectre are CPU microcode (firmware) updates.  For future needs: sysutils/devcpu-data is the port that has the updates for Intel, and cpucontrol(8) is the program you run on DragonFly to add them.

I haven’t used this myself, yet, so I can’t tell you how necessary an immediate update could be – but you will probably want to use it soon.

Update: Newer CPUs might require this sizing change.

Update update: a better explanation of applying microcode updates.  There’s new ones out, too.  (via)

More Meltdown fixes

If you’re on the bleeding edge of DragonFly and already updated for Meltdown fixes, there’s a few more commits you’ll want to get.

Matthew Dillon wrote a summary of the current status, noting there’s not much you can do for Spectre beyond new hardware.   There is an update to the “defensive browser setup” plan for DragonFly (using –site-per-process) that can help at least with Javascript versions of Spectre.

Update: step-by-step microcode fixes from Intel if you really want to trash your performance.

Lazy Reading for 2018/01/07

I had to trim this down; there’s been a post-Christmas surge in material.

In Other BSDs for 2018/01/06

Note the non-profit link; that may be useful to you.

Meltdown and Spectre and DragonFly

By now you’ve probably heard of the Meltdown/Spectre attacks.  (background rumors, technical note)  Matthew Dillon’s put together a Meltdown mitigation in DragonFly, done in four commits.

It’s turned off and on by the sysctl machdep.isolated_user_pmap – and defaults to on for Intel CPUs.  Buildworld tests show about a 4-5% performance hit, but that’s only one form of activity, measured, so there will surely be other effects.

Note that Spectre is not mitigated by this commit series, and as I understand it, cannot be realistically fixed in software.

Update: Matthew Dillon posted a summary to users@.

Update 2: He told us so.