linux-kernel - Re: [kernel-hardening] Re: [RFC, PATCH] x86_64: KAISER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 09 May 2017 11:30:57 -0400
From:   Rik van Riel <riel@...hat.com>
To:     Richard Weinberger <richard@....at>,
        "Fogh, Anders" <anders.fogh@...ta-adan.de>,
        Daniel Gruss <daniel.gruss@...k.tugraz.at>
Cc:     Christoph Hellwig <hch@...radead.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        "clementine.maurice@...k.tugraz.at" 
        <clementine.maurice@...k.tugraz.at>,
        "moritz.lipp@...k.tugraz.at" <moritz.lipp@...k.tugraz.at>,
        Michael Schwarz <michael.schwarz@...k.tugraz.at>,
        Richard Fellner <richard.fellner@...dent.tugraz.at>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: [kernel-hardening] Re: [RFC, PATCH] x86_64: KAISER - do not
 mapkernel in user mode

On Tue, 2017-05-09 at 16:57 +0200, Richard Weinberger wrote:
> Am 09.05.2017 um 16:44 schrieb Fogh, Anders:
> > > > i.e. how does it perform on recent AMD systems?
> > 
> > Sorry for the latency. Recent AMD is reported by Enrique Nissem to
> > not
> > be vulnerable to the prefetch attack. TSX attack doesn't apply to
> > AMD.
> > Hund, Willems & Holz wrote in 2013 that AMD was vulnerable to that
> > attack. The BTB is almost surely working in a different manner of
> > fashion if at all. So AMD may or may not be vulnerable to the DPF
> > attack, but none of the modern attacks should work - at least out
> > of the
> > box.
> 
> But the promoted patch will also run on AMD systems, that's why I
> asked
> for the overhead.

Well, if it is a compile time switch, and the
overhead is unacceptable on everything but the
very latest Intel chips, chances are the code
will not be enabled in any distribution kernel.

-- 
All rights reversed
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)