linux-kernel - Re: RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 24 Jul 2022 14:30:28 +0200
From:   Adam Borowski <kilobyte@...band.pl>
To:     Jan Engelhardt <jengelh@...i.de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        open list <linux-kernel@...r.kernel.org>,
        X86 ML <x86@...nel.org>, lkft-triage@...ts.linaro.org,
        Borislav Petkov <bp@...e.de>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...nel.org>
Subject: Re: RETBleed: WARNING: Spectre v2 mitigation leaves CPU vulnerable
 to RETBleed attacks, data leaks possible!

On Sun, Jul 24, 2022 at 11:25:04AM +0200, Jan Engelhardt wrote:
> On Saturday 2022-07-23 23:50, Adam Borowski wrote:
> >> > We are booting the i386 kernel on an x86 machine.
> >
> >[..] And for quite some tasks, halved word
> >size (thus ~2/3 memory usage) can overcome register starvation and win
> >benchmarks.
> 
> So how many benchmarks does a 32-bit userspace with a 32-bit kernel
> win over 32-bit userspace with a 64-bit kernel?

Likely none or almost none.
What we want is for people to run 64-bit kernel, there are no real issues
with userland.

Valid uses to run 32-bit kernel:
* ancient hardware (so much more prevalent than m68k we support!;
  non-hobbyists should upgrade to reduce power costs)
* hardware to run that 100$k-1M ISA industrial control/medical imaging card
  (which, having ISA, is necessarily ancient too)
* us devs testing the above

Only the last case will have a modern CPU, thus requiring an explicit
override won't hurt less educated users -- while telling the latter to grab
a 64-bit kernel if their hardware isn't ancient would have other benefits
for them beside just vulnerabilities.


Meow!
-- 
⢀⣴⠾⠻⢶⣦⠀ Aryans: split from other Indo-Europeans ~2900-2000BC → Ural →
⣾⠁⢠⠒⠀⣿⡁     Bactria → settled 2000-1000BC in northwest India.
⢿⡄⠘⠷⠚⠋⠀ Gypsies: came ~1000AD from northern India; aryan.
⠈⠳⣄⠀⠀⠀⠀ Germans: IE people who came ~2800BC to Scandinavia; not aryan.