Re: Privilege Levels Below User

John Savard <quadibloc@servername.invalid> writes:

If no branches... then no need for retpolines and stuff.
>
If no access to memory... no worries about rowhammer.

The proper answer to hardware bugs is not adding software limitations,
nor software mitigations (what the hardware makers suggest), but to
fix the hardware.

Given that, a third mode - not reduced-privilege so much as
reduced-efficiency - suggests itself.

That would be one fix, but fixes that cost less performance are
possible.

Cause some code to be executed... without any speculative execution;
allow branches, but don't execute anything until where the branch goes
is fully resolved.
>
This deals with Spectre and friends.
>
So the idea is to give an unprivileged user application, like a web
browser, a capability, without going through the operating system, to
run code that is sandboxed in appropriate ways to prevent it from
causing trouble although it is untrusted.
>
That browsers have to be able to run untrusted JavaScript

In general JavaScript cannot be executed without branches nor without
memory accesses.  Therefore your modes will not be used for
JavaScript.

has been the
basic reason why computers today are insecure.

There is certainly something to that, even without hardware bugs.
JavaScript offers a huge attack surface, and lots of software-only
vulnerabilities have been found in JavaScript engines over the
decades.  One way to deal with that problem is to disable JavaScript.

But JavaScript and hardware bugs are not the only security problems on
computers today.

If the only code that
ran on computers was trusted code, then the virus situation would be
like it was back in the days of 8-bit computers; except for
supply-chain attacks, just don't run pirated software, and you're
pretty much safe.

That's naive.  All kinds of "trusted" software has vulnerabilities,
and hardware bugs make things worse.

- anton
--
'Anyone trying for "industrial quality" ISA should avoid undefined behavior.'
  Mitch Alsup, <c17fcd89-f024-40e7-a594-88a85ac10d20o@googlegroups.com>