From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 41C131382C5 for ; Fri, 5 Jan 2018 02:12:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5FCB6E0B89; Fri, 5 Jan 2018 02:12:22 +0000 (UTC) Received: from pmta31.teksavvy.com (pmta31.teksavvy.com [76.10.157.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 10545E0B42 for ; Fri, 5 Jan 2018 02:12:21 +0000 (UTC) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2FpCQAY3k5a/02Ps2tdGwEBAQEDAQEBC?= =?us-ascii?q?QEBAYM+ZnQniSKGB44UAYIAMwGZCyiFFwQCAoQzQxUBAQEBAQEBAQEDaCiCa0t?= =?us-ascii?q?ZAQEBAQEBIwINXgEFMgEjMwsYCRMSDwUlN4ovELMuij0BAQgBAQEBHwWEDwSCZ?= =?us-ascii?q?oEChReDGBiCOoJ8gjQFikiIb5AhAoJBhUONKIIkiXQah2CKXoJTixw1JIFPfAi?= =?us-ascii?q?CZ4R1IzcBAQGIdwEBAQ?= X-IPAS-Result: =?us-ascii?q?A2FpCQAY3k5a/02Ps2tdGwEBAQEDAQEBCQEBAYM+ZnQniSK?= =?us-ascii?q?GB44UAYIAMwGZCyiFFwQCAoQzQxUBAQEBAQEBAQEDaCiCa0tZAQEBAQEBIwINX?= =?us-ascii?q?gEFMgEjMwsYCRMSDwUlN4ovELMuij0BAQgBAQEBHwWEDwSCZoEChReDGBiCOoJ?= =?us-ascii?q?8gjQFikiIb5AhAoJBhUONKIIkiXQah2CKXoJTixw1JIFPfAiCZ4R1IzcBAQGId?= =?us-ascii?q?wEBAQ?= X-IronPort-AV: E=Sophos;i="5.46,316,1511845200"; d="scan'208";a="16811625" Received: from 107-179-143-77.cpe.teksavvy.com (HELO waltdnes.org) ([107.179.143.77]) by smtp.teksavvy.com with SMTP; 04 Jan 2018 21:12:19 -0500 Received: by waltdnes.org (sSMTP sendmail emulation); Thu, 04 Jan 2018 21:12:18 -0500 From: "Walter Dnes" Date: Thu, 4 Jan 2018 21:12:18 -0500 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Re: old kernels are installed during the upgrade Message-ID: <20180105021217.GA19977@waltdnes.org> References: <2CA973AB-B583-4F4F-A0B3-0FE347A672BD@stellar.eclipse.co.uk> <5A4D3E92.5010908@youngman.org.uk> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.7.2 (2016-11-26) X-Archives-Salt: 144457ad-975e-4216-9d0a-0ac3b1215c78 X-Archives-Hash: 0dc56044fadad5f684ee012218e14b3e On Thu, Jan 04, 2018 at 11:10:01AM -0500, Rich Freeman wrote > On Thu, Jan 4, 2018 at 11:02 AM, Holger Hoffstätte > wrote: > > On Wed, 03 Jan 2018 15:53:07 -0500, Rich Freeman wrote: > > > >> On Wed, Jan 3, 2018 at 3:35 PM, Wols Lists wrote: > >>> > >>> And as I understand it the code can be disabled with either a compile > >>> time option or command line switch to the kernel. > >> > >> I suspect the compile-time option is PAGE_TABLE_ISOLATION (which was > >> newly added in 4.14.11). The command line option nopti will disable > >> it at runtime. > >> > >> Rumor has it that it will be disabled on AMD CPUs in 4.14.12, but I > > > > That's not a rumor and it can be easily verified either here: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-4.14/x86-cpu-x86-pti-do-not-enable-pti-on-amd-processors.patch > > > > or in mainline git, respectively. > > > > Not back when I made my post, as is evident from the timestamps. > > All the info around these vulnerabilities is rapidly evolving, so take > anything you hear with some skepticism until the dust settles... There are 2 vulnerabities at play here, both caused by speculative execution... 1) "Meltdown" is the reading, by userland processes, of kernel memory. This includes stuff like passwords, ssh and gpg keys, and other similar sensitive stuff. Intel is vulnerable; AMD is not, thanks to AMD's ring-level permission checking. 2) "Spectre" is the reading, by one userland process, of memory belonging to another userland process. Since this does not require jumping to kernel privilege level, AMD's ring-level permission checking is not invoked, and AMD cpus are vulnerable. Think "cross-site-scripting on steroids", or "cross-process memory access" on your PC. The most obvious attack vector would be web assembler or java plugin or javascript, executing a 3rd-party ad in your browser. By the way, Adobe Flash is scripted by "Ecmascript", a variant of javascript. This is a problem that's associated with "speculative execution". I wonder how much of a performance hit it would be to turn off speculative execution. That would probably require at least a microcode/firmware update, if not a new cpu. -- Walter Dnes I don't run "desktop environments"; I run useful applications