Hacker News Reader

Comment by dzdt | Hacker News Reader

I wonder if it would be possible to peg the kernel to one processor core (or a subset of the cores) and userspace to the remainder of the cores. As I understand it, all of the memory caches that are being exploited to leak information are per-core, so that would give a blanket guard against kernel->userspace leaks via cache timing.

View on HN

Yes this is easy to do with cpu shields. But it means a system call might need to go onto another board... this would work only for the apps that ran mainly in user space and wouldn’t be very impacted anyway...

As memory serves that was exactly how the hypervisor on the PS3 Cell setup worked.

Syscall performance would suffer but otherwise this could work.

This is the first time I've seen this suggestion; it is something that could be done relatively easily for systems that otherwise have no updates/mitigations.

If performance is better some variant of this (auto-scaling dedicated cores) may even become the default solution rather than all the other workarounds! Bare metal hypervisors should get their own core(s) too.

Is anyone already doing this? (Qubes, etc.)

I remember seeing this suggestion earlier. If I'm not mistaken a commentor stated that a) this would come with a huge performance penalty b) there would be synchronization problems in multithreaded scenarios.

Don't take my word for it though, I might have understood it wrong. I imagine concurrent/parallel execution involving system calls could maybe suffer from synchronization issues if processes/threads run on different physical cores with separate caches?

Reply on news.ycombinator.com