Linux page table isolation is not needed on AMD processors
At the meta level this is just a special case of &quot;complexity is evil&quot; in security. CPUs have been getting more and more complex, and the relationship between complexity and bugs (of all types) is exponential. Each new CPU feature exponentially increases the likelihood of errata.<p>A major underlying cause is that we&#x27;re doing things in hardware that ought to be done in software. We really need to stop shipping software as native blobs and start shipping it as pseudocode, allowing the OS to manage native execution. This would allow the kernel and OS to do <i>tons and tons</i> of stuff the CPU currently does: process isolation, virtualization, much or perhaps even all address remapping, handling virtual memory, etc. CPUs could just present a flat 64-bit address space and run code in it.<p>These chips would be faster, simpler, cheaper, and more power efficient. It would also make CPU architectures easier to change. Going from x64 to ARM or RISC-V would be a matter of porting the kernel and core OS only.<p>Unfortunately nobody&#x27;s ever really gone there. The major problem with Java and .NET is that they try to do way too much at once and solve too many problems in one layer. They&#x27;re also too far abstracted from the hardware, imposing an &quot;impedance mismatch&quot; performance penalty. (Though this penalty is minimal for most apps.)<p>What we need is a binary format with a thin (not overly abstracted) pseudocode that closely models the processor. OSes could lazily compile these binaries and cache them, eliminating JIT program launch overhead except on first launch or code change. If the pseudocode contained rich vectorization instructions, etc., then there would not be much if any performance cost. In fact performance might be better since the lazy AOT compiler could apply CPU model specific optimizations and always use the latest CPU features for all programs.<p>Instead we&#x27;ve bloated the processor to keep supporting 1970s operating systems and program delivery paradigms.<p>It&#x27;s such an obvious thing I&#x27;m really surprised nobody&#x27;s done it. Maybe there&#x27;s a perverse hardware platform lock-in incentive at work.