From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227hxUCpxSdUt+UfWQCCrLBXRgfvNGss+LTC6/IdBQaojn7RzooDeZG/SOo+e5jvC/c7wbg4 ARC-Seal: i=1; a=rsa-sha256; t=1516958917; cv=none; d=google.com; s=arc-20160816; b=TAjhur07LoDDJBmELX3EhqGNsXJMfYHmpL1FE3yQfNbNMw5saAnNlucowIR4Oq4y66 DIcLLxiQuRucoSRoEAUXuUrdZJIArc9DphcB1dJh9pX7+QV3QD8xa/U7uXrzwoCRihZq D6/z9FZP787vGt9a+GV+AHbq6ECrgcohX2SaFDdLGHJr+wAOpnPLYkda9230KQ0c3chS aSCCWZwmtZpRhr+7/lZEcQTOdmprTTB4jGYsuwScT0lupjSvYRZ7hu3cQjtbMGMoPxwJ wzhP2sqST/mfhdhwn0END2iIeXcDlmXRLuQ+PB/3DeJ8rGmQYlQmTwBerFi+k/agXVKD Zasg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:arc-authentication-results; bh=PGRe1ItFIPoita3qqhxWK0ULR7f/1b/Nf4ZhQe5yNsM=; b=mUnpe5yFiYYnr4ZKvOXq/cKsU/utBqEe1M0ZjPtkOxGPWDgEG1owyEHCHSTPkwfeYX IJZoumnadnFxsCxVH5FDvk9vHBO4Nbe8mZB4uFoyKR8pWmhLsHJVl1QQnXJjNZL7D0lA mGXmLZDPt1Xng4ANI9ykHgk5nb+4WYSS2NnPE+Cjw4wEXbE0ynqHzPCfalAfCXFIxzZA TAyZieJFQtWo5LrERrIfs7C51dRt7eXWTFy0bl6rgmGDrTJbIumBIij7njRfJDffPHxY bcVKokucVdEMC8yJw0Up4462As1tB9YI1PDpIwLrVHI28H/V6p+pkbtRwc1k/Jt/lpTf Q8jw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of krzysiek@podlesie.net designates 2a00:13a0:3010::1 as permitted sender) smtp.mailfrom=krzysiek@podlesie.net; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=podlesie.net Authentication-Results: mx.google.com; spf=pass (google.com: domain of krzysiek@podlesie.net designates 2a00:13a0:3010::1 as permitted sender) smtp.mailfrom=krzysiek@podlesie.net; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=podlesie.net Date: Fri, 26 Jan 2018 10:28:36 +0100 From: Krzysztof Mazur To: Nadav Amit Cc: Joerg Roedel , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , the arch/x86 maintainers , LKML , "open list:MEMORY MANAGEMENT" , Linus Torvalds , Andy Lutomirski , Dave Hansen , Josh Poimboeuf , Juergen Gross , Peter Zijlstra , Borislav Petkov , Jiri Kosina , Boris Ostrovsky , Brian Gerst , David Laight , Denys Vlasenko , Eduardo Valentin , Greg KH , Will Deacon , aliguori@amazon.com, daniel.gruss@iaik.tugraz.at, hughd@google.com, keescook@google.com, Andrea Arcangeli Subject: Re: [RFC PATCH 00/16] PTI support for x86-32 Message-ID: <20180126092836.GA11003@shrek.podlesie.net> References: <1516120619-1159-1-git-send-email-joro@8bytes.org> <20180124185800.GA11515@shrek.podlesie.net> <67E8EB67-EB60-441E-BDFB-521F3D431400@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <67E8EB67-EB60-441E-BDFB-521F3D431400@gmail.com> User-Agent: Mutt/1.6.2 (2016-07-01) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589767841591470697?= X-GMAIL-MSGID: =?utf-8?q?1590646714464941939?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Thu, Jan 25, 2018 at 02:09:40PM -0800, Nadav Amit wrote: > The PoC apparently does not work with 3GB of memory or more on 32-bit. Does > you setup has more? Can you try the attack while setting max_addr=1G ? No, I tested on: Pentium M (Dothan): 1.5 GB RAM, PAE for NX, 2GB/2GB split CONFIG_NOHIGHMEM=y CONFIG_VMSPLIT_2G=y CONFIG_PAGE_OFFSET=0x80000000 CONFIG_X86_PAE=y and Xeon (Pentium 4): 2 GB RAM, no PAE, 1.75GB/2.25GB split CONFIG_NOHIGHMEM=y CONFIG_VMSPLIT_2G_OPT=y CONFIG_PAGE_OFFSET=0x78000000 Now I'm testing with standard settings on Pentium M: 1.5 GB RAM, no PAE, 3GB/1GB split, ~890 MB RAM available CONFIG_NOHIGHMEM=y CONFIG_PAGE_OFFSET=0xc0000000 CONFIG_X86_PAE=n and it still does not work. reliability from https://github.com/IAIK/meltdown reports 0.38% (1/256 = 0.39%, "true" random), and other libkdump tools does not work. https://github.com/paboldin/meltdown-exploit (on linux_proc_banner symbol) reports: cached = 46, uncached = 515, threshold 153 read c0897020 = ff (score=0/1000) read c0897021 = ff (score=0/1000) read c0897022 = ff (score=0/1000) read c0897023 = ff (score=0/1000) read c0897024 = ff (score=0/1000) NOT VULNERABLE and my exploit with: for (i = 0; i < 256; i++) { unsigned char *px = p + (i << 12); t = rdtsc(); readb(px); t = rdtsc() - t; if (t < 100) printf("%02x %lld\n", i, t); } loop returns only "00 45". When I change the exploit code (now based on paboldin code to be sure) to: movzx (%[addr]), %%eax movl $0xaa, %%eax shl $12, %%eax movzx (%[target], %%eax), %%eax I always get "0xaa 51", so the CPU is speculatively executing the second load with (0xaa << 12) in eax, and without the movl instruction, eax seems to be always 0. I even tried to remove the shift: movzx (%[addr]), %%eax movzx (%[target], %%eax), %%eax and I've been reading known value (from /dev/mem, for instance 0x20), I've modified target array offset, and the CPU is still touching "wrong" cacheline, eax == 0 instead of 0x20. I've also tested movl instead of movzx (with and 0xff). On Core 2 Quad in 64-bit mode everything works as expected, vulnerable to Meltdown (I did not test it in 32-bit mode). I don't have any Core "1" to test. On that Pentium M syscall slowdown caused by PTI is huge, 7.5 times slower (7 times compared to patched kernel with disabled PTI), on Skylake with PCID the same trivial benchmark is "only" 3.5 times slower (and 5.2 times slower without PCID). Krzysiek