[MODERATED] Re: [PATCH 2/8] L1TFv3 7

[Vlastimil Babka <vbabka@suse.cz>]

[-- Attachment #1: Type: text/plain, Size: 2154 bytes --]

On 05/04/2018 05:23 AM, speck for Andi Kleen wrote:
> From: Linus Torvalds <torvalds@linux-foundation.org>
> Subject:  x86, l1tf: Protect swap entries against L1TF
> 
> With L1 terminal fault the CPU speculates into unmapped PTEs, and
> resulting side effects allow to read the memory the PTE is pointing
> too, if its values are still in the L1 cache.
> 
> For swapped out pages Linux uses unmapped PTEs and stores a swap entry
> into them.
> 
> We need to make sure the swap entry is not pointing to valid memory,
> which requires setting higher bits (between bit 36 and bit 45) that
> are inside the CPUs physical address space, but outside any real
> memory.
> 
> To do this we invert the offset to make sure the higher bits are always
> set, as long as the swap file is not too big.
> 
> Here's a patch that switches the order of "type" and
> "offset" in the x86-64 encoding, in addition to doing the binary 'not' on
> the offset.
> 
> That means that now the offset is bits 9-58 in the page table, and that
> the offset is in the bits that hardware generally doesn't care about.

      ^ type

> That, in turn, means that if you have a desktop chip with only 40 bits of
> physical addressing, now that the offset starts at bit 9, you still have
> to have 30 bits of offset actually *in use* until bit 39 ends up being
> clear.
> 
> So that's 4 terabyte of swap space (because the offset is counted in
> pages, so 30 bits of offset is 42 bits of actual coverage). With bigger
> physical addressing, that obviously grows further, until you hit the limit
> of the offset (at 50 bits of offset - 62 bits of actual swap file
> coverage).
> 
> Note there is no workaround for 32bit !PAE, or on systems which
> have more than MAX_PA/2 memory. The later case is very unlikely
> to happen on real systems.
> 
> [updated description and minor tweaks by AK]
> 
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Andi Kleen <ak@linux.intel.com>
> Tested-by: Andi Kleen <ak@linux.intel.com>
> Acked-by: Michal Hocko <mhocko@suse.com>

Acked-by: Vlastimil Babka <vbabka@suse.cz>