3 ms·
Single Address Space OSs have been around forever. Turns out that memory protection is useful even if you are running memory safe code. Also spectre.
by gpderetta 3y ago
Single Address Space OSs have been around forever. Turns out that memory protection is useful even if you are running memory safe code.
Also spectre.
- crest 3y agoIf the hardware is designed to support single address space OSs it doesn't have be a security problem. It can help avoid spectre like problems because it can lower the expected overhead of permission checks so far that there is no advantage of speculating on them instead of performing them.
- gpderetta 3y agoI think you are confusing meltdown (a speculation attack on hardware permission checks which was patched in later revisions of intel silicon and never affected other vendors) with Spectre, a general family of attacks on speculative execution, which are generally unsolved. You could of course add dedicated hardware to lower the overhead specifically of memory access permission checks. In fact most CPUs already do, it is called an MMU.
- Aerbil313 3y agoSafe-language OSes like Theseus don't have this class of problems, by their very design. I think it's a superior architecture to current conventional OSes which rely on hardware for protection.
- gpderetta 3y agoHow does Theseus prevents speculation attacks? This page [1] mentions them, but has nothing on how the software prevents them. [1] https://www.theseus-os.com/Theseus/book/design/idea.html https://www.theseus-os.com/Theseus/book/design/idea.html
- Aerbil313 3y agoMy understanding is that conventional OSes rely on hardware to provide kernel and userspace data isolation, while Theseus relies on Rust compiler, as in safe Rust you can't access arbitrary memory locations. Maybe watch the project founder's talk? https://youtu.be/n7r8zO7SodE?si=nswWcFrkTj7K1GpZ https://youtu.be/n7r8zO7SodE?si=nswWcFrkTj7K1GpZ
- gpderetta 3y agoBy "this class of problems" I assumed you were talking about speculation attacks. How does the rust compiler help? Sorry, I'm not going to watch a talk.
- Aerbil313 3y agoI'm sorry, I did not mean that, misunderstanding twice on my part. I meant that you can have a SAS SPL OS and have it safe too. Theseus Book simply states that relying on hardware for data isolation have proven a deficient approach, given the existence of such attacks.
- HALtheWise 3y agoDoes anyone know of attempts to add CPU instructions that allow JITs and compilers to mitigate Spectre by using speculation-safe instructions for safety critical checks? I could imagine a "load if less than" or similar instruction, which the compiler could use to incorporate the safety check into the load instruction and avoid a separate branch that could be mispredicted. Such an instruction would be documented to have no side effects (even timing side effects) if the condition were not met.
- gpderetta 3y agoMany CPUs have already specualtion barriers. But of course they are slow.