From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753511AbbCQSBZ (ORCPT ); Tue, 17 Mar 2015 14:01:25 -0400 Received: from 251.110.2.81.in-addr.arpa ([81.2.110.251]:57095 "EHLO lxorguk.ukuu.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752044AbbCQSBY (ORCPT ); Tue, 17 Mar 2015 14:01:24 -0400 Date: Tue, 17 Mar 2015 17:58:59 +0000 From: One Thousand Gnomes To: Pavel Machek Cc: Andy Lutomirski , Mark Seaborn , "Kirill A. Shutemov" , "linux-mm@kvack.org" , kernel list , Andrew Morton , Linus Torvalds , "Kirill A. Shutemov" , Pavel Emelyanov , Konstantin Khlebnikov Subject: Re: rowhammer and pagemap (was Re: [RFC, PATCH] pagemap: do not leak physical addresses to non-privileged userspace) Message-ID: <20150317175859.1d9555fc@lxorguk.ukuu.org.uk> In-Reply-To: <20150317111653.GA23711@amd> References: <1425935472-17949-1-git-send-email-kirill@shutemov.name> <20150316211122.GD11441@amd> <20150317111653.GA23711@amd> Organization: Intel Corporation X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.25; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > > Can we just try getting rid of it except with global CAP_SYS_ADMIN. > > > > (Hmm. Rowhammer attacks targeting SMRAM could be interesting.) > CAP_SYS_RAWIO is the protection for "can achieve anything". If you have CAP_SYS_RAWIO you can attain any other capability, the reverse _should_ not be true. > > The Intel people I asked last week weren't confident. For one thing, > > I fully expect that rowhammer can be exploited using only reads and > > writes with some clever tricks involving cache associativity. I don't > > think there are any fully-associative caches, although the cache > > replacement algorithm could make the attacks interesting. > > We should definitely get Intel/AMD to disable CLFLUSH, then. I doubt that would work, because you'd have to fix up all the faults from userspace in things like graphics and video. Whether it is possible to make the microcode do other accesses and delays I have no idea - but that might also be quite horrible. A serious system should be using ECC memory anyway. and on things like shared boxes it is probably not a root compromise that is the worst case scenario but subtle undetected corruption of someone elses data sets. That's what ECC already exists to protect against whether its from flawed memory and rowhammer or just a vindictive passing cosmic ray. Alan