4 ms·
I wonder if it would be possible to peg the kernel to one processor core (or a subset of the cores) and userspace to the remainder of the cores. As I understan
by dzdt 9y ago
I wonder if it would be possible to peg the kernel to one processor core (or a subset of the cores) and userspace to the remainder of the cores. As I understand it, all of the memory caches that are being exploited to leak information are per-core, so that would give a blanket guard against kernel->userspace leaks via cache timing.
- kindfellow92 9y agoSyscall performance would suffer but otherwise this could work.
- gaius 9y agoYes this is easy to do with cpu shields. But it means a system call might need to go onto another board... this would work only for the apps that ran mainly in user space and wouldn’t be very impacted anyway...
- j_s 9y agoThis is the first time I've seen this suggestion; it is something that could be done relatively easily for systems that otherwise have no updates/mitigations. If performance is better some variant of this (auto-scaling dedicated cores) may even become the default solution rather than all the other workarounds! Bare metal hypervisors should get their own core(s) too. Is anyone already doing this? (Qubes, etc.)
- terminalcommand 9y agoI remember seeing this suggestion earlier. If I'm not mistaken a commentor stated that a) this would come with a huge performance penalty b) there would be synchronization problems in multithreaded scenarios. Don't take my word for it though, I might have understood it wrong. I imagine concurrent/parallel execution involving system calls could maybe suffer from synchronization issues if processes/threads run on different physical cores with separate caches?
- angersock 9y agoAs memory serves that was exactly how the hypervisor on the PS3 Cell setup worked.