Path: ...!feed.opticnetworks.net!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: anton@mips.complang.tuwien.ac.at (Anton Ertl)
Newsgroups: comp.arch
Subject: Re: Privilege Levels Below User
Date: Sun, 09 Jun 2024 16:52:45 GMT
Organization: Institut fuer Computersprachen, Technische Universitaet Wien
Lines: 56
Message-ID: <2024Jun9.185245@mips.complang.tuwien.ac.at>
References: <jai66jd4ih4ejmek0abnl4gvg5td4obsqg@4ax.com> <h0ib6j576v8o37qu1ojrsmeb5o88f29upe@4ax.com>
Injection-Date: Sun, 09 Jun 2024 19:03:23 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="7b4ba09b667304af8ef2f7c37e960318";
	logging-data="3833137"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/WJiNIbWFXF/M0aXFu6244"
Cancel-Lock: sha1:vhm7RNpOOjjt2a464OFA2B10aL4=
X-newsreader: xrn 10.11
Bytes: 3064

John Savard <quadibloc@servername.invalid> writes:
>If no branches... then no need for retpolines and stuff.
>
>If no access to memory... no worries about rowhammer.

The proper answer to hardware bugs is not adding software limitations,
nor software mitigations (what the hardware makers suggest), but to
fix the hardware.

>Given that, a third mode - not reduced-privilege so much as
>reduced-efficiency - suggests itself.

That would be one fix, but fixes that cost less performance are
possible.

>Cause some code to be executed... without any speculative execution;
>allow branches, but don't execute anything until where the branch goes
>is fully resolved.
>
>This deals with Spectre and friends.
>
>So the idea is to give an unprivileged user application, like a web
>browser, a capability, without going through the operating system, to
>run code that is sandboxed in appropriate ways to prevent it from
>causing trouble although it is untrusted.
>
>That browsers have to be able to run untrusted JavaScript

In general JavaScript cannot be executed without branches nor without
memory accesses.  Therefore your modes will not be used for
JavaScript.

> has been the
>basic reason why computers today are insecure.

There is certainly something to that, even without hardware bugs.
JavaScript offers a huge attack surface, and lots of software-only
vulnerabilities have been found in JavaScript engines over the
decades.  One way to deal with that problem is to disable JavaScript.

But JavaScript and hardware bugs are not the only security problems on
computers today.

>If the only code that
>ran on computers was trusted code, then the virus situation would be
>like it was back in the days of 8-bit computers; except for
>supply-chain attacks, just don't run pirated software, and you're
>pretty much safe.

That's naive.  All kinds of "trusted" software has vulnerabilities,
and hardware bugs make things worse.

- anton
-- 
'Anyone trying for "industrial quality" ISA should avoid undefined behavior.'
  Mitch Alsup, <c17fcd89-f024-40e7-a594-88a85ac10d20o@googlegroups.com>