linux-kernel - RE: [PATCH v3] x86: add NOPL and CMOV emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4b8e1393929b47d29a996f07cd332c65@AcuMS.aculab.com>
Date:   Sun, 27 Jun 2021 10:57:48 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Marcos Del Sol Vives' <marcos@...a.pet>,
        "x86@...nel.org" <x86@...nel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v3] x86: add NOPL and CMOV emulation

From: Marcos Del Sol Vives
> Sent: 26 June 2021 14:03
> 
> NOPL and CMOV are a set of instructions that were introduced to the
> x86 architecture with the i686 ISA in 1995, first implemented in the
> Intel Pentium Pro and Pentium II processors.
> 
> While virtually all desktop and server systems are modern enough to
> support these instructions, in the embedded market things are a little
> bit different: DM&P is still manufacturing their i586-only Vortex86
> SoCs, and many embedded devices still in use are stuck on legacy SoCs
> that either are i586-only (AMD Elan, AMD Geode GX1) or implement i686
> but lack the NOPL instructions (Transmeta devices, AMD Geode LX).
> 
> This is a problem because most modern Linux distributions, such as
> Debian and all its derivatives, have started compiling targeting i686,
> leaving old embedded devices using binary distributions without an
> easy upgrade path.
> 
> This ultimately results in most of these embedded devices running
> years old, insecure and obsolete installations, and this itself can be
> seen on the DM&P's own supported OS page where the newest supported
> desktop Linux distro is Ubuntu 18.04, already three years old.
> 
> The emulation of these instructions thus allow upgrading to newer
> distributions just by replacing the kernel, keeping all precompiled
> binaries intact.
...

Does this really help?
1) Trapping and emulating the instructions will be slow.
2) All 64bit cpus support these instructions - so these must be 32bit.
   I believe the main distributions are about to drip 32bit support.

It also has to be said that using Ubuntu in an embedded device
is about as sensible as running windows.
There is far too much 'crud' running that you don't need and
is only likely to result in security breaches.

Much better is something based on busybox+buildroot where you
have (almost) complete control of the system userspace and
can easily build a kernel that only has support for the required
hardware from one of the LTS kernel trees.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)