4 ms·
Those attacks can be mitigated. They're not fatal to hyperthreading. HT is a great way to improve performance and is not going away.
by api 7y ago
Those attacks can be mitigated. They're not fatal to hyperthreading. HT is a great way to improve performance and is not going away.
- wahern 7y agoThey're fatal in the sense that you can't mitigate all the side-channels. It's intrinsic to HT/SMT that certain critical resources are shared without an ability to mask the side-channels. What you can do is make sure that only processes and threads with the same privilege (e.g. same UID) share a core. But AFAIK such mitigations haven't made their way into OS schedulers. You're almost certainly right that HT isn't going away, the performance benefits are too great. But to fully minimize the security impact operating systems in particular, but also some userspace applications (e.g. browsers), will need to be aware of the problems. This is already the case more generally for cryptographic algorithms and similar software--e.g. how memcmp can leak passwords.
- admax88q 7y agoUnfortunately same UID is not sufficient, if my program is running some other script or respnsing to input provided by an external user or attacker. JavaScript is the easiest example of this.