3 ms·
I do wish there was some sort of "1 process per physical core" rule you could apply at the scheduler level to get most of the benefit with fewer risks. Or mayb
by Symmetry 6y ago
I do wish there was some sort of "1 process per physical core" rule you could apply at the scheduler level to get most of the benefit with fewer risks. Or maybe isolate the handling of untrusted code like browser javascript, pdfs, etc.
- secondcoming 6y agoYou can tell the kernel to not make certain cores available to the scheduler (isolcpus)
- Symmetry 6y agoYes, but that doesn't help if I want a virtual core to only be available to threads belonging to the same process as the thread on the other virtual core. I suppose syscalls make the idea not work anyways.
- WJW 6y agoStep 1: Buy lots of raspberry pis. Step 2: Run 1 process per pi. Step 3: Enjoy freedom from spectre-related problems! Optional step 4: Move everything back to Intel/AMD when management realizes why they went for multiple processes per box in the first place. Money rules everything around us.
- Symmetry 6y agoIf I'm willing to give up long pipelines and out of order execution for security I'd at least go for a Project Denver chip or something. No need to give up all the single thread performance, or multiple cores sharing a memory pool. Or more likely a chip with a ton of ARM A5* cores on it due to availability. EDIT: Wait, it looks like I could actually get a Drive AGX for $700 on Newegg[1] and they seem to have about 40% the single thread performance of a Ryzen[2]. So actually not out of the question if I was willing to give up more for security than I actually am. [1]https://www.newegg.com/nvidia-jetson-agx-xavier-32gb-256-bit-lpddr4x-137gb-s/p/N82E16813190012 https://www.newegg.com/nvidia-jetson-agx-xavier-32gb-256-bit... [2]https://www.phoronix.com/scan.php?page=article&item=nvidia-jetson-xavier&num=4 https://www.phoronix.com/scan.php?page=article&item=nvidia-j...