6 ms·

Seems like the ultimate end-game here is to have mini-vms for every process using CPU-level ring protection. If you can't speculate across privilege levels, onl

by tcoppi 9y ago

Seems like the ultimate end-game here is to have mini-vms for every process using CPU-level ring protection. If you can't speculate across privilege levels, only inside them, it isn't a security problem anymore.

sandworm101 9y ago
Or time to have Kernel live on dedicated cache not ever accessed/shared with anything else. Let the CPU speculate all it wants, just not when playing in the kernel's cache. It may even be time for dedicated kernel cpus/cores.
- FractalNerve 9y ago
  > It may even be time for dedicated kernel cpus/cores. Oh yes, I agree! One needs to be able to phycically (un)lock the "kernel fpga" like a door without remote capabilities, except for server cpu's. Or whatever chip designers believe is a good "physical kernel embodiment" other than fpga. EDIT: I know it's not really clever, but I would really enjoy hearing any solutions that doesn't try to fix it at the hardware level.
- ufo 9y ago
  Reading Kernel memory (Meltdown attack) is extra bad but regular user processes being able to read each other's memory (Spectre attack) is also very bad and not solvable by isolating the kernel.
  - sandworm101 9y ago
    Im less worried about my steam client reading my chat cache than something inside my web browser reading the keys that encrypt my home directory. Short of abandoning all sharing, the least we can do is isolate kernel cache.
    - bluGill 9y ago
      That depends on what you are chatting with. My chatlog would be very interesting to our competitors. The key that encrypts my home directory isn't useful because the firewall blocks your access to my home directory (that a different layer of security).
  - jacksmith21006 9y ago
    Why one solution is put secrets in kernel and use meltdown mitigation to protect.
frik 9y ago
> mini VMs for every process using CPU ring protection Yes. We should really start to learn from history, MULTICS operating system had already 16 CPU ring support back in the early 1970s. MULTICS is the mother of UNIX, its smaller child. MULTICS had so many advanced features that barely got implemented (often reinvented) in newer OS. It's time to read old docs and ask the old devs who are still alive. (Another such often overlooked gem is Plan9, but it's better known thanks to Go lang devs). Older Intel CPUs only supported 2 rings. Modern Intel CPU supports only 4 rings. Windows and Linux use ring 0 for kernel mode and ring 3 for user mode. And Intel introduced a ring -1 for VT. "To assist virtualization, VT and Pacifica insert a new privilege level beneath Ring 0. Both add nine new machine code instructions that only work at "Ring -1," intended to be used by the hypervisor It's time for modern operating systems to use more rings, and modern CPUs to correctly protect between different rings. https://en.wikipedia.org/wiki/Multics https://en.wikipedia.org/wiki/Multics https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring
manol74 9y ago
Qubes OS [1] does something like that [1]: https://www.qubes-os.org/ https://www.qubes-os.org/
- strongholdmedia 9y ago
  Yet Meltdown nuked exactly that.

by tcoppi 9y ago

sandworm101 9y ago

Or time to have Kernel live on dedicated cache not ever accessed/shared with anything else. Let the CPU speculate all it wants, just not when playing in the kernel's cache. It may even be time for dedicated kernel cpus/cores.

FractalNerve 9y ago
> It may even be time for dedicated kernel cpus/cores. Oh yes, I agree! One needs to be able to phycically (un)lock the "kernel fpga" like a door without remote capabilities, except for server cpu's. Or whatever chip designers believe is a good "physical kernel embodiment" other than fpga. EDIT: I know it's not really clever, but I would really enjoy hearing any solutions that doesn't try to fix it at the hardware level.
ufo 9y ago
Reading Kernel memory (Meltdown attack) is extra bad but regular user processes being able to read each other's memory (Spectre attack) is also very bad and not solvable by isolating the kernel.
- sandworm101 9y ago
  Im less worried about my steam client reading my chat cache than something inside my web browser reading the keys that encrypt my home directory. Short of abandoning all sharing, the least we can do is isolate kernel cache.
  - bluGill 9y ago
    That depends on what you are chatting with. My chatlog would be very interesting to our competitors. The key that encrypts my home directory isn't useful because the firewall blocks your access to my home directory (that a different layer of security).
- jacksmith21006 9y ago
  Why one solution is put secrets in kernel and use meltdown mitigation to protect.

frik 9y ago

> mini VMs for every process using CPU ring protection Yes. We should really start to learn from history, MULTICS operating system had already 16 CPU ring support back in the early 1970s. MULTICS is the mother of UNIX, its smaller child. MULTICS had so many advanced features that barely got implemented (often reinvented) in newer OS. It's time to read old docs and ask the old devs who are still alive. (Another such often overlooked gem is Plan9, but it's better known thanks to Go lang devs). Older Intel CPUs only supported 2 rings. Modern Intel CPU supports only 4 rings. Windows and Linux use ring 0 for kernel mode and ring 3 for user mode. And Intel introduced a ring -1 for VT. "To assist virtualization, VT and Pacifica insert a new privilege level beneath Ring 0. Both add nine new machine code instructions that only work at "Ring -1," intended to be used by the hypervisor It's time for modern operating systems to use more rings, and modern CPUs to correctly protect between different rings. https://en.wikipedia.org/wiki/Multics https://en.wikipedia.org/wiki/Multics https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring

manol74 9y ago

Qubes OS [1] does something like that [1]: https://www.qubes-os.org/ https://www.qubes-os.org/

strongholdmedia 9y ago
Yet Meltdown nuked exactly that.