Re:Sushi Roll: A CPU research kernel with minimal noise for ...
by gamozolabs on Tuesday August 20, 2019 @03:02AM
(#20744456)
This kernel is just kind of a playground for projects I have. Specifically there were a few from this past year or so.
I used this kernel originally for my vectorized emulator, which is designed as a high-performance fuzzer/harness to find bugs (more info https://gamozolabs.github.io/fuzzing/2018/10/14/vectorized_e...). I used vectorized emulation on Windows DHCP to find multiple RCEs (which were disclosed earlier this year), as well as one of the Intel MDS vulnerabilities (such as RIDL and Fallout) disclosed earlier this year (specifically I found "MLPDS", https://nvd.nist.gov/vuln/detail/CVE-2018-12127).
I do most of my work in a personal kernel as it really gives me an edge with optimization. I'm able to use page tables directly (super fast fork()-like behavior), and write hypervisors that don't have to go through crazy call stacks to vmexit, use bleeding-edge CPU features, etc. Ultimately I just do it because it's fun, but I've found ways to justify it from time to time.
Re:Sushi Roll: A CPU research kernel with minimal noise for ...
by bogomipz on Tuesday August 20, 2019 @10:42AM
(#20747520)
Thanks for posting this. This is a fascinating project and I hope you post more about it. I had a question about something under the Microcode section which stated:
>"These are often complex operations, like switching operating modes, reading/writing internal CPU registers, etc."
Is a switch from ring 3 to ring 0 handled by microcode then? If so why is this?
Re:Sushi Roll: A CPU research kernel with minimal noise for ...
by dang on Tuesday August 20, 2019 @02:56AM
(#20744432)
No, matt_d's was earlier. The IDs tell all: 20736713 < 20743260.
The reason this was confusing is that we put the earlier post in the second-chance queue (described at https://news.ycombinator.com/item?id=11662380), which temporarily modifies the timestamps on re-up as explained here: https://news.ycombinator.com/item?id=19774614. This confusion comes up periodically but I don't know a globally better solution than how we currently do it.
Re:Sushi Roll: A CPU research kernel with minimal noise for ...
by saagarjha on Tuesday August 20, 2019 @01:39PM
(#20749667)
If you stick a title attribute on an image, it will show up when you long press on it in Mobile Safari. This doesn't work with links, though, because it'll show the destination instead. Might I suggest just putting the submission time in parentheses, like "1 day ago (resubmitted 3 hours ago)"?
[1] https://old.reddit.com/r/programming/comments/csfj53/sushi_r...
I used this kernel originally for my vectorized emulator, which is designed as a high-performance fuzzer/harness to find bugs (more info https://gamozolabs.github.io/fuzzing/2018/10/14/vectorized_e...). I used vectorized emulation on Windows DHCP to find multiple RCEs (which were disclosed earlier this year), as well as one of the Intel MDS vulnerabilities (such as RIDL and Fallout) disclosed earlier this year (specifically I found "MLPDS", https://nvd.nist.gov/vuln/detail/CVE-2018-12127).
I do most of my work in a personal kernel as it really gives me an edge with optimization. I'm able to use page tables directly (super fast fork()-like behavior), and write hypervisors that don't have to go through crazy call stacks to vmexit, use bleeding-edge CPU features, etc. Ultimately I just do it because it's fun, but I've found ways to justify it from time to time.
>"These are often complex operations, like switching operating modes, reading/writing internal CPU registers, etc."
Is a switch from ring 3 to ring 0 handled by microcode then? If so why is this?
I can only speculate as to the types of vulnerabilities not disclosed.
The reason this was confusing is that we put the earlier post in the second-chance queue (described at https://news.ycombinator.com/item?id=11662380), which temporarily modifies the timestamps on re-up as explained here: https://news.ycombinator.com/item?id=19774614. This confusion comes up periodically but I don't know a globally better solution than how we currently do it.
Also, out of curiosity, how does that work on mobile? I know it's a naive question but I've never figured that out.