3 ms·
It's more than that even - given that a high portion of the code being run now is using virtual machines, a lot of that protection is redundant. If all code is
by jordanthoms 9y ago
It's more than that even - given that a high portion of the code being run now is using virtual machines, a lot of that protection is redundant. If all code is run inside VMs and zero 'native' code is allowed, then you could run without needing protection rings, system call overhead, memory mapping, etc - which in theory could more than make up for the virtual machine overhead.
This was being explored with Microsoft's Singularity and Midori projects but seems to be a dormant idea.
A fun talk on this idea with JavaScript: https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
- yjftsjthsd-h 9y agoIsn't that a unikernel?
- SolarNet 9y agoNo. Each copy of the VM is still it's own process. The kernel just trusts the VM to be safe.
- bestham 9y agoI don’t think it works like that. You still need protection between the rings inside the VM and the CPU is providing that protection. The VM is not only a user process for the host, it is executing its kernel code in the virtualized ring 0 on the CPU (where its still the CPU that provides protection).
- jordanthoms 9y agoAs i understand it, with this approach you wouldn't have a separation between kernel code and the virtual machine - everything runs in a single address space and you rely on the virtual machine verifying the code as it JITs it.
- tedunangst 9y agoAnd that, of course, is how you get Spectre.
- jordanthoms 9y agoIt should be possible to apply retpoline in the JIT to mitigate that.
- contrarian_ 9y agoEmphasis on "mitigate".