Hacker News Reader

Fantastic article. Disabling spectre mitigations on all my team's GCE instances is something I'm going to check out.

Regarding core pinning, the usual advice is to pin to the CPU socket physically closest to the NIC. Is there any point doing this on cloud instances? Your actual cores could be anywhere. So just isolate one and hope for the best?

View on HN

Pinning to the physically closest core is a bit misleading. Take a look at output from something like `lstopo` [https://www.open-mpi.org/projects/hwloc/], where you can filter pids across the NUMA topology and trace which components are routed into which nodes. Pin the network based workloads into the corresponding NUMA node and isolate processes from hitting the IRQ that drives the NIC.

wow, i had wondered about pinning in the cloud. this is a fantastic tip - thank you!

There are a bunch more mitigations that can be disabled than he disables in the article. I usually refer to https://make-linux-fast-again.com/

Make Linux Even More Insecure Again

In this list, mitigations=off implies all the others.

Reply on news.ycombinator.com