6 ms·

He mentions Singularity as inspiration which is exactly what came to my mind. This isn’t an unproven space. Singularity proved you can use a single global addr

He mentions Singularity as inspiration which is exactly what came to my mind. This isn’t an unproven space. Singularity proved you can use a single global address space (given 64-bit) and software to isolate processes - something MS Research called Software Isolated Processes. This requires a verifiable bytecode/VM system so the kernel can verify the instruction stream at load time. In a way, WebAssembly is even easier to verify than C#. It’s obviously a research toy but that isn’t a bad thing.

kllrnohj 8y ago
That was before spectre happened. Software isolated processes are now basically impossible to do. All the CPU microcode updates & workarounds are purely about fixing isolation between processes & rings that the CPU is aware of.
- mickronome 8y ago
  Does that really follow? That purely software based solutions are doomed because hardware based solutions failed? Wasn't most fixes done at least partially in software?
  - kllrnohj 8y ago
    I think you misunderstood. The hardware-based solutions are being fixed with various approaches whereas the software-based solutions nobody has any clue how to fix. So much so that Chrome is giving up on software-isolation entirely and is rolling out even more process-based sandboxing https://www.chromium.org/Home/chromium-security/site-isolation https://www.chromium.org/Home/chromium-security/site-isolati...
    - andreiw 8y ago
      Depends on how you define hardware and software. There are global workarounds that amount to crippling CPU behavior, to provide guarantees for code not written to be spectre safe. I guess that’s what you mean by “hardware”. But “software” approaches are localized mitigations to code written to avoid spectre attacks - and these localized mitigations use arch specific sequences to do so.
      - microcolonel 8y ago
        Another major problem with the software level mitigations is that they cost considerably more. Speculation fences cut performance to a small integer fraction of prior performance.
        andreiw 8y ago
        Then tell your SiP to do better. On Arm the conditional speculation barrier couldn’t be more lightweight (CSDB).
    - pjmlp 8y ago
      Process-based sandboxing was too heavy in old hardware systems, but on modern ones is the best approach. Threads and plugins have proven not to be the best ideas regarding implementing safe systems.
      - microcolonel 8y ago
        > Process-based sandboxing was too heavy in old hardware systems, but on modern ones is the best approach. They actually started first with full process isolation, then realized that it had an outsize impact on performance, and now they're going back because the consequences for security are now known. There have been spectre-related patches going into chromium and v8 for the last few months, and they just keep coming, it's hard to overstate how much work must be done to have a decent probability of not being exposed to the known variants of these bugs in a software isolated system.
- kibwen 8y ago
  AFAIK, all the CPU microcode updates were for fixing Meltdown, not Spectre. Unless and until CPU manufacturers find a way to fix speculative execution for good, software-based mitigations would seem to be mandatory.
  - sp332 8y ago
    AMD also pushed firmware updates, and they weren't affected by Meltdown.
    - kibwen 8y ago
      Do you have a link to the firmware update announcement? Are there patch notes?
      - sp332 8y ago
        This is the latest I've heard about it: https://arstechnica.com/gadgets/2018/04/latest-windows-updates-bring-spectre-protection-to-amd-systems/ https://arstechnica.com/gadgets/2018/04/latest-windows-updat... I think the firmware generally comes from vendors, which for personal PCs means motherboard manufacturers. I did find this linked from an older Verge article: https://www.amd.com/en/corporate/security-updates https://www.amd.com/en/corporate/security-updates
        kibwen 8y ago
        Thanks for the links. But the Ars link seems to confirm that all these mitigations need to be done in software, and that the firmware updates merely give the OS the hooks necessary to implement their own mitigations (implying that application software didn't get or need any help from the CPU in applying mitigations). And if all this is being done in software anyway, then it would seem to suggest that should at least partially suffice for a scheme like the OP's (someone who knows more about what these hooks actually do should say more). I'm not sure whether that means it's as secure in practice as conventional OSes--naively we should expect that it's not until proven otherwise--but it also appears to be a far cry from the above claim that "software isolated processes are now basically impossible to do", which, even if true, seems true as well for the software we already have.
- DenisM 8y ago
  Imagine you have a BASIC interpreter with a million cooperative threads. Can you write a BASIC program using spectre to break from one thread to another?
  - andreiw 8y ago
    “break”? no, but spectre is a confidentiality attack, and not even the only confidentiality attack that can be done... yes you could, but the noise floor won’t be great
- deleted 8y ago
  [deleted]
- delinka 8y ago
  >Software isolated processes are now basically impossible to do. I don't think that's the case at all. To my understanding, software has always been capable of doing this just fine, but at a performance cost. So the mechanism was ported to hardware. Optimized implementations have proven to contain security issues. It's not that the security problems are unsolvable, it's that you can't just patch a broken CPU in the wild. So we fall back to software implementations again, resulting in an overall perform decrease, but with the more correct security.
  - microcolonel 8y ago
    Specifically regarding speculative sidechannel attacks, your rebuttal does not address the comment you're replying to. kllrnohj is specifically noting that the mitigations for speculative sidechannel attacks rely on seeing the patterns of a preemptive operating system using the facilities expected by the hardware for that task.
pjmlp 8y ago
Singularity was nice, but not the only one OS in this domain. Like Joe Duffy complained about Midori, the problem is getting management to be willing to push it no matter what. Eventually Microsoft took some of those ideas into Windows 8.x and 10, but they still are implemented in the context of a COM based world, thus only partially implemented.

kllrnohj 8y ago

That was before spectre happened. Software isolated processes are now basically impossible to do. All the CPU microcode updates & workarounds are purely about fixing isolation between processes & rings that the CPU is aware of.

mickronome 8y ago
Does that really follow? That purely software based solutions are doomed because hardware based solutions failed? Wasn't most fixes done at least partially in software?
- kllrnohj 8y ago
  I think you misunderstood. The hardware-based solutions are being fixed with various approaches whereas the software-based solutions nobody has any clue how to fix. So much so that Chrome is giving up on software-isolation entirely and is rolling out even more process-based sandboxing https://www.chromium.org/Home/chromium-security/site-isolation https://www.chromium.org/Home/chromium-security/site-isolati...
  - andreiw 8y ago
    Depends on how you define hardware and software. There are global workarounds that amount to crippling CPU behavior, to provide guarantees for code not written to be spectre safe. I guess that’s what you mean by “hardware”. But “software” approaches are localized mitigations to code written to avoid spectre attacks - and these localized mitigations use arch specific sequences to do so.
    - microcolonel 8y ago
      Another major problem with the software level mitigations is that they cost considerably more. Speculation fences cut performance to a small integer fraction of prior performance.
      - andreiw 8y ago
        Then tell your SiP to do better. On Arm the conditional speculation barrier couldn’t be more lightweight (CSDB).
  - pjmlp 8y ago
    Process-based sandboxing was too heavy in old hardware systems, but on modern ones is the best approach. Threads and plugins have proven not to be the best ideas regarding implementing safe systems.
    - microcolonel 8y ago
      > Process-based sandboxing was too heavy in old hardware systems, but on modern ones is the best approach. They actually started first with full process isolation, then realized that it had an outsize impact on performance, and now they're going back because the consequences for security are now known. There have been spectre-related patches going into chromium and v8 for the last few months, and they just keep coming, it's hard to overstate how much work must be done to have a decent probability of not being exposed to the known variants of these bugs in a software isolated system.
kibwen 8y ago
AFAIK, all the CPU microcode updates were for fixing Meltdown, not Spectre. Unless and until CPU manufacturers find a way to fix speculative execution for good, software-based mitigations would seem to be mandatory.
- sp332 8y ago
  AMD also pushed firmware updates, and they weren't affected by Meltdown.
  - kibwen 8y ago
    Do you have a link to the firmware update announcement? Are there patch notes?
    - sp332 8y ago
      This is the latest I've heard about it: https://arstechnica.com/gadgets/2018/04/latest-windows-updates-bring-spectre-protection-to-amd-systems/ https://arstechnica.com/gadgets/2018/04/latest-windows-updat... I think the firmware generally comes from vendors, which for personal PCs means motherboard manufacturers. I did find this linked from an older Verge article: https://www.amd.com/en/corporate/security-updates https://www.amd.com/en/corporate/security-updates
      - kibwen 8y ago
        Thanks for the links. But the Ars link seems to confirm that all these mitigations need to be done in software, and that the firmware updates merely give the OS the hooks necessary to implement their own mitigations (implying that application software didn't get or need any help from the CPU in applying mitigations). And if all this is being done in software anyway, then it would seem to suggest that should at least partially suffice for a scheme like the OP's (someone who knows more about what these hooks actually do should say more). I'm not sure whether that means it's as secure in practice as conventional OSes--naively we should expect that it's not until proven otherwise--but it also appears to be a far cry from the above claim that "software isolated processes are now basically impossible to do", which, even if true, seems true as well for the software we already have.
DenisM 8y ago
Imagine you have a BASIC interpreter with a million cooperative threads. Can you write a BASIC program using spectre to break from one thread to another?
- andreiw 8y ago
  “break”? no, but spectre is a confidentiality attack, and not even the only confidentiality attack that can be done... yes you could, but the noise floor won’t be great
deleted 8y ago
[deleted]
delinka 8y ago
>Software isolated processes are now basically impossible to do. I don't think that's the case at all. To my understanding, software has always been capable of doing this just fine, but at a performance cost. So the mechanism was ported to hardware. Optimized implementations have proven to contain security issues. It's not that the security problems are unsolvable, it's that you can't just patch a broken CPU in the wild. So we fall back to software implementations again, resulting in an overall perform decrease, but with the more correct security.
- microcolonel 8y ago
  Specifically regarding speculative sidechannel attacks, your rebuttal does not address the comment you're replying to. kllrnohj is specifically noting that the mitigations for speculative sidechannel attacks rely on seeing the patterns of a preemptive operating system using the facilities expected by the hardware for that task.

pjmlp 8y ago

Singularity was nice, but not the only one OS in this domain. Like Joe Duffy complained about Midori, the problem is getting management to be willing to push it no matter what. Eventually Microsoft took some of those ideas into Windows 8.x and 10, but they still are implemented in the context of a COM based world, thus only partially implemented.