gpd (gpderetta.delete@this.gmail.com) on September 24, 2021 3:59 am wrote:
> Linus Torvalds (torvalds.delete@this.linux-foundation.org) on September 23, 2021 12:01 pm wrote:
> > The fact is, the whole notion of passing magic pointers and trying to associate random state with
> > them between two random untrusted but somehow cooperative entities is pure BS. And I claim that
> > no amount of segmentation - whatever you call it - will make it anything else.
>
> They seem useful in a post-spectre world to run potentially hostile (but otherwise memory safe) code in process,
> for example a web browser that wants to isolate different JS VMs. Software boundary checking doesn't cut it anymore
> and separate processes (the current solution) has overhead. This assumes that segments handling does not have
> meltdown-like vulnerabilities (which is not a given, but it seems possible to implement correctly).
>
> The kernel could use it to isolate BPF programs for example.

It's one of those things that you can always make up examples for.

And then 99.9% of all code doesn't want it, because most memory accesses by far are perfectly normal loads and stores from regular local sources with absolutely no reason to worry about data leaks.

But if you make it about security and make your architecture all about capability pointers, then all memory accesses have to be checked. So you're taking a big cost for that very rare case.

Once you notice that, you then add the "regular memory accesses" back, and make it about special checking memory ops.

So then you say that untrusted code has to be compiled with a trusted compiler, and you add the checks only to the places that the compiler determines needs it. And then you end up with most software not using it at all, because they don't believe they need it and it is too costly in performance (and it probably only worked on special microarchitectures anyway, since the architecture that tried to force it on people failed), and you're back to square one.

Just don't go down a path that is guaranteed to fail. Again. Like it did last time.

Linus