linux-kernel - Re: Windows side agrees that lowmem corruption is a problem too

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 10 Jun 2010 19:15:24 -0600
From:	Robert Hancock <hancockrwd@...il.com>
To:	"H. Peter Anvin" <hpa@...or.com>
CC:	Ondrej Zary <linux@...nbow-software.org>,
	Ingo Molnar <mingo@...e.hu>,
	Yuhong Bao <yuhongbao_386@...mail.com>,
	linux-kernel@...r.kernel.org, gregkh@...e.de
Subject: Re: Windows side agrees that lowmem corruption is a problem too

On 06/08/2010 02:31 PM, H. Peter Anvin wrote:
> On 06/08/2010 12:22 PM, Ondrej Zary wrote:
>>>
>>> Yep, patterns of some silly OSD bitmap showed up in one of the corruption -
>>> firmware displaying a 'you inserted a cable' kind of icon somewhere and
>>> messing up the SMM code or so ...
>>>
>>> I agree that dis-using<1M by default is probably the sanest option.
>>
>> But please limit it to newer systems only (DMI present&&  year>  200?). There
>> are many old machines running fine. Losing 1MB from 16MB is a bad thing.
>>
>
> Disusing 64K is something we can do unconditionally (especially since
> we're only talking about 60K -- 15 pages -- of actually usable memory
> anyway.)
>
> Dropping all the low 0.6 MB (which is what it really is) is probably
> unacceptable by default, but perhaps it makes sense to use it only for
> ZONE_DMA or something.

According to the document, "Neither Windows Vista nor Windows 7 stores 
operating system code and data in the lowest 1 MB of physical memory, 
regardless of whether Windows is running on real or virtualized 
hardware", so doing the same in general might not be a bad thing (unless 
we have less than a certain amount of RAM).

They're also checksumming the low 1MB and writing an event log entry if 
corruption is detected after sleep events, so if WHQL tests start 
checking for that, maybe these bugs will start going away on new 
machines. Of course, on some machines the corruption apparently happens 
other times as well, so who knows..
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/