Re: Privilege Levels Below User

John Savard wrote:

On Fri, 07 Jun 2024 12:03:03 -0600, John Savard
<quadibloc@servername.invalid> wrote:

The first reduced-privilege state would not allow any branch
instructions, particularly conditional branches.
>
The second, in addition, would not allow any access to memory, only
allowing access to registers.

Maybe I haven't made clear what this is _for_ as I thought it would be
obvious.

If no branches... then no need for retpolines and stuff.

My 66000 needs no retpolnes for external calls/returns or for
SVCs and SVRs.

If no access to memory... no worries about rowhammer.

Rowhammer can be eliminated without restricting access to memory.

Given that, a third mode - not reduced-privilege so much as
reduced-efficiency - suggests itself.

Cause some code to be executed... without any speculative execution;
allow branches, but don't execute anything until where the branch goes
is fully resolved.

This deals with Spectre and friends.

Spectré exploits the inability to keep microarchitectural state hidden
from architectural state. Design the pipeline correctly and you won't
Spectré, Meltdown, or friends...

So the idea is to give an unprivileged user application, like a web
browser, a capability, without going through the operating system, to
run code that is sandboxed in appropriate ways to prevent it from
causing trouble although it is untrusted.

That browsers have to be able to run untrusted JavaScript (and,
formerly, even Java and Flash, which have now been discarded) to
support the flexibility desired for modern web sites... has been the
basic reason why computers today are insecure. If the only code that
ran on computers was trusted code, then the virus situation would be
like it was back in the days of 8-bit computers; except for
supply-chain attacks, just don't run pirated software, and you're
pretty much safe.

John Savard