4 ms·

Can you disable these on a per-process basis? I'm not concerned that my compiler or Blender render is going to side-channel attack whatever other part of the sy

Can you disable these on a per-process basis? I'm not concerned that my compiler or Blender render is going to side-channel attack whatever other part of the system. Generally there's little overlap between completely untrusted code and code that requires high performance.

dspillett 5y ago
> Can you disable these on a per-process basis? No. If it wasn't impossible, it would add a massive delay to context switches between processes as the required microcode changes are applied.
- silon42 5y ago
  It would be interesting if they could be done per core... So one could reserve 1 core for JS and also down-clock it to a minimum.
- Wowfunhappy 5y ago
  Hm... I'm on a host OS with Meltdown mitigations disabled, but I can seemingly run a VM with the mitigations enabled, verified via InSpectre[1]. I guess that's different somehow? 1: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
  - monocasa 5y ago
    There's a lot of mitigations. Some are microcode, some are kernel/vmm code, some are user space if that process is running untrusted code. Your host probably just isn't running with the normal ISA mitigations, but the microcode installed.
  - eklitzke 5y ago
    This is because the Spectre/Meltdown can't be patched with microcode updates, the mitigations instead use different kernel mechanisms (KPTI for Meltdown, retpolines for Spectre). If the guest kernel for your VM is using these mitigations it will be protected even if the host has mitigations disabled.
    - Wowfunhappy 5y ago
      And I guess those kernel mechanisms can’t be applied per process? If a hypervisor is required, could, say, JVM do it?
  - touisteur 5y ago
    Ha interesting! It was something I wanted to check/try. I'm wondering if it makes the mitigations less effective. Maybe it would drop for some time the even minimal risk of netspectre or such and make cybertight architects lay off my vm hosts...
deleted 5y ago
[deleted]

dspillett 5y ago

> Can you disable these on a per-process basis? No. If it wasn't impossible, it would add a massive delay to context switches between processes as the required microcode changes are applied.

silon42 5y ago
It would be interesting if they could be done per core... So one could reserve 1 core for JS and also down-clock it to a minimum.
Wowfunhappy 5y ago
Hm... I'm on a host OS with Meltdown mitigations disabled, but I can seemingly run a VM with the mitigations enabled, verified via InSpectre[1]. I guess that's different somehow? 1: https://www.grc.com/inspectre.htm https://www.grc.com/inspectre.htm
- monocasa 5y ago
  There's a lot of mitigations. Some are microcode, some are kernel/vmm code, some are user space if that process is running untrusted code. Your host probably just isn't running with the normal ISA mitigations, but the microcode installed.
- eklitzke 5y ago
  This is because the Spectre/Meltdown can't be patched with microcode updates, the mitigations instead use different kernel mechanisms (KPTI for Meltdown, retpolines for Spectre). If the guest kernel for your VM is using these mitigations it will be protected even if the host has mitigations disabled.
  - Wowfunhappy 5y ago
    And I guess those kernel mechanisms can’t be applied per process? If a hypervisor is required, could, say, JVM do it?
- touisteur 5y ago
  Ha interesting! It was something I wanted to check/try. I'm wondering if it makes the mitigations less effective. Maybe it would drop for some time the even minimal risk of netspectre or such and make cybertight architects lay off my vm hosts...

deleted 5y ago

[deleted]