6 ms·
I wonder if eventually we'll have to have a "secure mode" operational setting where all speculation is disabled along with other extreme security measures any t
by causi 4y ago
I wonder if eventually we'll have to have a "secure mode" operational setting where all speculation is disabled along with other extreme security measures any time a computer needs to handle credentials.
- yababa_y 4y agodedicating a single core to the task and interfacing with existing secure enclave / smart card like protocols would get you pretty far.
- inetknght 4y agoCores can share cache. Cache leaks from speculation are a thing. So dedicating a single core might not be strong enough countermeasure. There's of course little other recourse without a secure processor. I will be very saddened when a secure processor becomes required standard hardware because it will, no doubt, contain only phantom blobs that hinder ownership and promote corporate bullshit.
- itvision 4y agoYeah, in this mode the CPU will just work 10 times slower.
- rasz 4y agoYou can speculate all you want, just dont Fking share the state between cores/threads/processes.
- marshray 4y agoMy understanding is that flushing all cache and other state on every thread/process context switch has a big performance impact.
- zozbot234 4y agoYou don't need to flush predictor state on every task switch, only when entering a less private context from a more private one. Systems with a feature known as multiple-level security (or "multiple levels of security") can be designed to track these privacy/information requirements automatically.
- marshray 4y agoI'm not familiar with this concept of a "less private context" in computing. Could you please link me to something I can read about it?
- rasz 4y agoNo need to flush cache if we could have all the caches tagged per process.
- 1over137 4y ago>"secure mode" operational setting where all speculation is disabled We have that, it's called OpenBSD. :)
- systems_glitch 4y agoOn SPARC64 or POWER.
- yjftsjthsd-h 4y agoIIRC, SPARC actually is affected by speculative vulnerabilities.
- msbarnett 4y agoI think you’re confusing hyperthreading (disabled on amd64 in OpenBSD) with speculation (neither disabled nor afaik disableable on amd64).