From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1516918183; cv=none; d=google.com; s=arc-20160816; b=k3jrc/OZTvVb0IvZHfxFnudwNRQE6lDLIrHPL8i3kU3W81NEWU/Xmtxyb/G2yG0vkX E6ahez0ocSrcLnwpsw20voCSzxKOBjoLpDfyGg7Ls1WNTuEz+WMoSNw7yDJgpZQP7Fdo dsAOWaYsYqyA4spmtAZU1uYI9ft06gzMDo/BKdrDA7udX4Mtj5xlwJdL5tfPwnBuDksH 81wJVYMiU86BL/qL4gZnNOgVDco63AU4FtzBgLuceQykdB06Er2tqyC5L/yVgbv+eTUx BMc/IWx4X36W6VZJvBV0Ou0rt5ePrHBRTyU1BIyq919nNX7nSNZc99M8vzKxx8IFMODo fc5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:dkim-signature :arc-authentication-results; bh=/i8lsAbNpAWWST7L9oJnqcPNw7uGPAdhZtw1oWpgppo=; b=THqc2SA4n2D4iKeH5s6GOK2+qHr3t/eUivJSt0C/kHAKX2cVx0bPiA/lW2T7MlMo4f HbNVpN/O5hQE7IhKQQR7vUfsuf8KSkQ1+7+83jKkVbYwSaOIbz2kttm0L8JD71ljatGx 9KXObFQuUN+pQLLxTzdeXm3yM6prb620wwVyfNGOtivsjVI3JyobcApu7+vyrBtrNcYs Tm77+DZ2D7WIYEs/9FuCY7t7HZANqCw30Ob83EXZVLEC2vDh/GXJSJXloZXO9G9/ZU5R /MTsBb2/EFfDu9mWU2EAFpmTPjKYWwASLaMWCr02oJamvZ+o02Y0+nmknpmJyYE6gbXF TRjA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=rLIVz4Xd; spf=pass (google.com: domain of nadav.amit@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=nadav.amit@gmail.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=rLIVz4Xd; spf=pass (google.com: domain of nadav.amit@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=nadav.amit@gmail.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gmail.com X-Google-Smtp-Source: AH8x225+CiChG5FNLneOFGbfR/scVr6w8pndvcG0bKErByiZm69VstUVDneyiDS4XClAgW29ZXFqDg== Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: [RFC PATCH 00/16] PTI support for x86-32 From: Nadav Amit In-Reply-To: <20180124185800.GA11515@shrek.podlesie.net> Date: Thu, 25 Jan 2018 14:09:40 -0800 Cc: Joerg Roedel , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , the arch/x86 maintainers , LKML , "open list:MEMORY MANAGEMENT" , Linus Torvalds , Andy Lutomirski , Dave Hansen , Josh Poimboeuf , Juergen Gross , Peter Zijlstra , Borislav Petkov , Jiri Kosina , Boris Ostrovsky , Brian Gerst , David Laight , Denys Vlasenko , Eduardo Valentin , Greg KH , Will Deacon , aliguori@amazon.com, daniel.gruss@iaik.tugraz.at, hughd@google.com, keescook@google.com, Andrea Arcangeli Content-Transfer-Encoding: 7bit Message-Id: <67E8EB67-EB60-441E-BDFB-521F3D431400@gmail.com> References: <1516120619-1159-1-git-send-email-joro@8bytes.org> <20180124185800.GA11515@shrek.podlesie.net> To: Krzysztof Mazur X-Mailer: Apple Mail (2.3273) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589767841591470697?= X-GMAIL-MSGID: =?utf-8?q?1590604001663192131?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: Krzysztof Mazur wrote: > On Tue, Jan 16, 2018 at 05:36:43PM +0100, Joerg Roedel wrote: >> From: Joerg Roedel >> >> Hi, >> >> here is my current WIP code to enable PTI on x86-32. It is >> still in a pretty early state, but it successfully boots my >> KVM guest with PAE and with legacy paging. The existing PTI >> code for x86-64 already prepares a lot of the stuff needed >> for 32 bit too, thanks for that to all the people involved >> in its development :) > > Hi, > > I've waited for this patches for a long time, until I've tried to > exploit meltdown on some old 32-bit CPUs and failed. Pentium M > seems to speculatively execute the second load with eax > always equal to 0: > > movzx (%[addr]), %%eax > shl $12, %%eax > movzx (%[target], %%eax), %%eax > > And on Pentium 4-based Xeon the second load seems to be never executed, > even without shift (shifts are slow on some or all Pentium 4's). Maybe > not all P6 and Netbursts CPUs are affected, but I'm not sure. Maybe the > kernel, at least on 32-bit, should try to exploit meltdown to test if > the CPU is really affected. The PoC apparently does not work with 3GB of memory or more on 32-bit. Does you setup has more? Can you try the attack while setting max_addr=1G ? Thanks, Nadav From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f197.google.com (mail-pf0-f197.google.com [209.85.192.197]) by kanga.kvack.org (Postfix) with ESMTP id 06FC96B0005 for ; Thu, 25 Jan 2018 17:09:46 -0500 (EST) Received: by mail-pf0-f197.google.com with SMTP id e26so6931348pfi.15 for ; Thu, 25 Jan 2018 14:09:45 -0800 (PST) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id 1-v6sor1224284plv.17.2018.01.25.14.09.43 for (Google Transport Security); Thu, 25 Jan 2018 14:09:44 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: [RFC PATCH 00/16] PTI support for x86-32 From: Nadav Amit In-Reply-To: <20180124185800.GA11515@shrek.podlesie.net> Date: Thu, 25 Jan 2018 14:09:40 -0800 Content-Transfer-Encoding: 7bit Message-Id: <67E8EB67-EB60-441E-BDFB-521F3D431400@gmail.com> References: <1516120619-1159-1-git-send-email-joro@8bytes.org> <20180124185800.GA11515@shrek.podlesie.net> Sender: owner-linux-mm@kvack.org List-ID: To: Krzysztof Mazur Cc: Joerg Roedel , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , the arch/x86 maintainers , LKML , "open list:MEMORY MANAGEMENT" , Linus Torvalds , Andy Lutomirski , Dave Hansen , Josh Poimboeuf , Juergen Gross , Peter Zijlstra , Borislav Petkov , Jiri Kosina , Boris Ostrovsky , Brian Gerst , David Laight , Denys Vlasenko , Eduardo Valentin , Greg KH , Will Deacon , aliguori@amazon.com, daniel.gruss@iaik.tugraz.at, hughd@google.com, keescook@google.com, Andrea Arcangeli Krzysztof Mazur wrote: > On Tue, Jan 16, 2018 at 05:36:43PM +0100, Joerg Roedel wrote: >> From: Joerg Roedel >> >> Hi, >> >> here is my current WIP code to enable PTI on x86-32. It is >> still in a pretty early state, but it successfully boots my >> KVM guest with PAE and with legacy paging. The existing PTI >> code for x86-64 already prepares a lot of the stuff needed >> for 32 bit too, thanks for that to all the people involved >> in its development :) > > Hi, > > I've waited for this patches for a long time, until I've tried to > exploit meltdown on some old 32-bit CPUs and failed. Pentium M > seems to speculatively execute the second load with eax > always equal to 0: > > movzx (%[addr]), %%eax > shl $12, %%eax > movzx (%[target], %%eax), %%eax > > And on Pentium 4-based Xeon the second load seems to be never executed, > even without shift (shifts are slow on some or all Pentium 4's). Maybe > not all P6 and Netbursts CPUs are affected, but I'm not sure. Maybe the > kernel, at least on 32-bit, should try to exploit meltdown to test if > the CPU is really affected. The PoC apparently does not work with 3GB of memory or more on 32-bit. Does you setup has more? Can you try the attack while setting max_addr=1G ? Thanks, Nadav -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org