From: Pavel Machek <pavel@ucw.cz>
To: Jiri Kosina <jikos@kernel.org>
Cc: Tim Chen <tim.c.chen@linux.intel.com>,
Jonathan Corbet <corbet@lwn.net>,
Thomas Gleixner <tglx@linutronix.de>,
Linus Torvalds <torvalds@linux-foundation.org>,
Tom Lendacky <thomas.lendacky@amd.com>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
David Woodhouse <dwmw@amazon.co.uk>,
Andi Kleen <ak@linux.intel.com>,
Dave Hansen <dave.hansen@intel.com>,
Asit Mallick <asit.k.mallick@intel.com>,
Arjan van de Ven <arjan@linux.intel.com>,
Jon Masters <jcm@redhat.com>, Waiman Long <longman9394@gmail.com>,
Greg KH <gregkh@linuxfoundation.org>,
Borislav Petkov <bp@alien8.de>,
linux-kernel@vger.kernel.org, x86@kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] x86/speculation: Add document to describe Spectre and its mitigations
Date: Mon, 14 Jan 2019 13:01:57 +0100 [thread overview]
Message-ID: <20190114120157.GB21544@amd> (raw)
In-Reply-To: <nycvar.YFH.7.76.1901140012110.6626@cbobk.fhfr.pm>
[-- Attachment #1: Type: text/plain, Size: 3150 bytes --]
On Mon 2019-01-14 00:12:59, Jiri Kosina wrote:
> On Mon, 14 Jan 2019, Pavel Machek wrote:
>
> > That one really is Intel-specific (not even all x86s are affectd). Same
> > for Meltdown.
>
> At least for Meltdown, your claim is simply not correct.
You are right, there may be few ARM chips affected by meltdown.
I don't know about any non-Intel affected by l1tf.
...and its documentation is just plain wrong, explaining I'm protected
when I'm not...
commit f372cd79be31382ae6030a1f15638cc7fe9eeb9f
Author: Pavel <pavel@ucw.cz>
Date: Thu Jan 3 00:48:40 2019 +0100
Ok, I guess L1TF was a lot of fun, and there was not time for a good
documentation.
There's admin guide that is written as an advertisment, and
unfortunately is slightly "inaccurate" at places (to the point of
lying).
Plus, I believe it should go to x86/ directory, as this is really
Intel issue, and not anything ARM (or RISC-V) people need to know.
Signed-off-by: Pavel Machek <pavel@ucw.cz>
diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
index 9af9773..05c5422 100644
--- a/Documentation/admin-guide/l1tf.rst
+++ b/Documentation/admin-guide/l1tf.rst
@@ -1,10 +1,11 @@
L1TF - L1 Terminal Fault
========================
-L1 Terminal Fault is a hardware vulnerability which allows unprivileged
-speculative access to data which is available in the Level 1 Data Cache
-when the page table entry controlling the virtual address, which is used
-for the access, has the Present bit cleared or other reserved bits set.
+L1 Terminal Fault is a hardware vulnerability on most recent Intel x86
+CPUs which allows unprivileged speculative access to data which is
+available in the Level 1 Data Cache when the page table entry
+controlling the virtual address, which is used for the access, has the
+Present bit cleared or other reserved bits set.
Affected processors
-------------------
@@ -76,12 +77,14 @@ Attack scenarios
deterministic and more practical.
The Linux kernel contains a mitigation for this attack vector, PTE
- inversion, which is permanently enabled and has no performance
- impact. The kernel ensures that the address bits of PTEs, which are not
- marked present, never point to cacheable physical memory space.
-
- A system with an up to date kernel is protected against attacks from
- malicious user space applications.
+ inversion, which is permanently enabled and has no measurable
+ performance impact in most configurations. The kernel ensures that
+ the address bits of PTEs, which are not marked present, never point
+ to cacheable physical memory space. On x86-32, this physical memory
+ needs to be limited to 2GiB to make mitigation effective.
+
+ Mitigation is present in kernels v4.19 and newer, and in
+ recent -stable kernels.
2. Malicious guest in a virtual machine
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply other threads:[~2019-01-14 12:02 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-21 17:44 [PATCH] x86/speculation: Add document to describe Spectre and its mitigations Tim Chen
2018-12-21 21:59 ` Ben Greear
2018-12-22 1:17 ` Tim Chen
2018-12-31 16:22 ` Ben Greear
2018-12-31 17:10 ` Arjan van de Ven
2019-01-07 17:57 ` Tim Chen
2019-01-09 0:58 ` Ben Greear
2019-01-09 1:35 ` Tim Chen
2018-12-23 23:11 ` Alexei Starovoitov
2019-01-08 21:12 ` Tim Chen
2019-01-09 1:11 ` Alexei Starovoitov
2019-01-09 1:41 ` Tim Chen
2019-01-09 2:42 ` Alexei Starovoitov
2018-12-28 17:34 ` Jonathan Corbet
2019-01-08 21:18 ` Tim Chen
2019-01-13 23:10 ` Pavel Machek
2019-01-13 23:12 ` Jiri Kosina
2019-01-14 12:01 ` Pavel Machek [this message]
2019-01-14 12:06 ` Jiri Kosina
2019-01-14 13:01 ` Pavel Machek
2019-01-14 13:06 ` Jiri Kosina
2019-01-14 14:39 ` Arjan van de Ven
2019-01-30 0:12 ` Thomas Gleixner
2019-02-12 12:00 ` Thomas Gleixner
2019-02-12 17:36 ` Tim Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190114120157.GB21544@amd \
--to=pavel@ucw.cz \
--cc=aarcange@redhat.com \
--cc=ak@linux.intel.com \
--cc=arjan@linux.intel.com \
--cc=asit.k.mallick@intel.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=dave.hansen@intel.com \
--cc=dwmw@amazon.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=jcm@redhat.com \
--cc=jikos@kernel.org \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=longman9394@gmail.com \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tim.c.chen@linux.intel.com \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).