linux-kernel - Re: Linux 4.15-rc7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a3xs2-4VXKWum7cXrwUqK7Ysz3HOcikb53qQde2R6Ui4w@mail.gmail.com>
Date:   Fri, 12 Jan 2018 14:23:20 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Pavel Machek <pavel@....cz>
Cc:     Olivier Galibert <galibert@...ox.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        jikos@...e.cz
Subject: Re: Linux 4.15-rc7

On Fri, Jan 12, 2018 at 12:06 PM, Pavel Machek <pavel@....cz> wrote:
> Hi!
>
>> Wasn't/Isn't the 4G/4G  memory layout for 32 bits essentially KPTI?
>
> Good point. Is that still supported? Was it ever?
>
> Umm. I seem to recall that 4G/4G layout was out of tree but never
> merged.

I think that's correct: it was in RHEL3 and RHEL4 but never merged
upstream.

However, there is an important difference between KPTI and X86_4G:
The former unmaps the kernel pages from the user space page tables,
but keeps both the linear mapping and the user pages visible in
kernel mode, while the latter must have also unmapped user space
pages from kernel mode, requiring a more expensive get_user/put_user
implementation.

Kees mentioned an idea to also unmap user pages from kernel
mode as an additional safeguard on top of KPTI, which would get
it even closer to the X86_4G implementation:
https://outflux.net/blog/archives/2018/01/04/smep-emulation-in-pti/

Could you be more specific which 32-bit x86 chips you have that are
affected by Meltdown? Do you mean pre-2004 Pentiums or Core-Duo
laptops? I would guess that Cyrix/Natsemi/AMD 6x86/MediaGX/Geode
and AMD NexGen K6/K7 also affected by Spectre but probably not
Meltdown, and most other 32-bit microarchitectures seem to be purely
in-order.

        Arnd