Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux page table isolation is not needed on AMD processors

lkml.org

Post reply on HN
Print view View original

211–220 of 298 posts

Re: Linux page table isolation is not needed on AMD processors

#211

Post by yeukhon »

amckenna wrote: post #150
calt wrote: post #145

Earlier quoted context omitted.

What's the connection?

Here is some more context - http://pythonsweetness.tumblr.com/post/169166980422/the-myst... The connection between the linked article in this comment and the linked page for this post is that there is a potentially huge bug that will be made public soon and it just affects Intel processors, not AMD - hence the large sale of stock by the Intel CEO.

Not sure if it makes any sense and even logical to compare the market before and after Intel's floating point bug was uncovered a decade ago. My bet is this current bug won't shake Intel's stock price much.

Re: Linux page table isolation is not needed on AMD processors

#212

Post by yeukhon »

electic wrote: post #170

This is going to have dramatic effect on the cloud computing market. It might make sense to make sure any VMs you run are on AMD processors or it can really hurt your performance and basically cost you more to do the same workload. It also seems, from early benchmarks, this can slaughter performance with databases.

Why are people insisting this affects cloud computing market? I am not sure if this bug is absolutely limited to cloud instances.

Re: Linux page table isolation is not needed on AMD processors

#213

Post by artellectual »

bhouston wrote: post #205
artellectual wrote: post #196

Essentially looks like Intel compromised (whether intentional or not is a different point) the design to get the speed boost that gave them the lead over AMD for the past decade. Will be interesting to see how all this plays out.

What chip exactly introduced this feature? Core 2 architecture? Nehalem?

> It is understood the bug is present in modern Intel processors produced in the past decade.

Source: https://www.theregister.co.uk/2018/01/02/intel_cpu_design_fl...

Re: Linux page table isolation is not needed on AMD processors

#214

Post by dingo_bat »

kbart wrote: post #210
vasili111 wrote: post #207

Earlier quoted context omitted.

Don't worry. I don't think that there will be two separate kernels for Intel and AMD. I think performance drop will be on both CPUs no matter has it the bug or not.

No. The check is being made what CPU is underlying before applying the fix.

Not yet. That patch hasn't been merged as of now.

Re: Linux page table isolation is not needed on AMD processors

#215

Post by myrandomcomment »

freeone3000 wrote: post #76
dboreham wrote: post #53

Earlier quoted context omitted.

I think it will because it shows the downside of a monoculture. Hence big purchasers of CPUs will want to diversify. Also good for ARM vendors I suppose. Disclosure : bought AMD this morning before headlines saying "Buy AMD, short INTC" appeared.

Why would this cause you to diversify? Long-term negative effects of a monoculture are not evenly distributed to purchasers. In fact, if you ran both AMD and Intel CPUs, you'd see application performance differences solely based on processor architecture. This makes application deployment planning way harder. At any given time, there's one CPU that should be purchased, and artificially introducing two "so they don't…

It depends. There was a reason back in the day that if you were a telco you have phone switches from from 2 providers,ie a DMSxxx and ESSxxx. Another example would be how the big providers got screwed by the in ability of Cisco to get their GSR working right without a few forklift upgrades (really they were moved with a forklift). This opened the path for Juniper. For a long time the telcos moved to have one router from each so a nasty bug in one would not take them down. In a properly tooled setup you should be able to account for the load characteristics between AMD and Intel. Having 2 is safer then one.

Google is pushing both PowerCPU development as well as ARM. They seem to be able to sort for this just fine. You can write tools to sort the differences. You cannot write tools to fix major HW issue.

Anyway my 2 cents based on experience and history for whatever the comments of a random person on the intertubes is worth.

Re: Linux page table isolation is not needed on AMD processors

#216

Post by myrandomcomment »

technion wrote: post #192
IgorPartola wrote: post #79

Earlier quoted context omitted.

No. That's exactly what I'm saying. Most people don't care. Enterprise users do care because ME is useful for them. It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. They'll see this as a small problem that should be fixed and will ask Intel to do so. Intel will fix it, most everyone will move on. I don't think ME will take down Intel stock, and neither will this pa…

That's the narrative, but consulted to a lot of enterprises, and I've never once seen ME in use. Servers have hardware like HPE iLO, and desktops will use OS based agents. And failing that they'll use PXE boot and get rebuilt. The only discussion I've ever seen an Enterprise have about ME was the debate about how you deal with HPE's latest laptop security update.

And the sad part is the current LOM stuff is not better (even somewhat worse) then the stuff on Sun gear from the late 90s. Oh well.

Re: Linux page table isolation is not needed on AMD processors

#217

Post by dingo_bat »

bitwind wrote: post #17
userbinator wrote: post #13

All that I've read about this so far seems to indicate that it's only a way to bypass KASLR... which is itself not really a problem, but there must be something more to it. Given that it doesn't affect AMD, perhaps it's related to Intel ME?

The growing consensus is that someone managed to make this work: https://cyber.wtf/2017/07/28/negative-result-reading-kernel-... Reading kernel memory from user mode = reading cached disk blocks, cached credentials and anything else, by simply running javascript on a web browser. KASLR bypass is just a small bonus.

Just curious: how did you decide what the consensus is? I'd like to read more about this but I'm unable to find much.

Re: Linux page table isolation is not needed on AMD processors

#218

Post by czeidler »

Would it be possible to slow down segfault notifications to mitigate the attack? For example, if the segfault was not on kernel space, halt the application for the time offset of a kernel read. In this way all segfaults would be reported at more or less the same time and the attack could be avoided.

Are there any sane apps that depends on timely segfault handling and thus might be affected by such a workaround?

Re: Linux page table isolation is not needed on AMD processors

#219

Post by kev009 »

amluto wrote: post #62
rurban wrote: post #43

Earlier quoted context omitted.

Nope, read the paper, read the patches. Only Intel is affected. Arm has two such registers, TTB0 and TTB1. http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....

I think you're still misunderstanding. The CPU picks TTBR0 or TTBR1 based on the top significant bit of the VA, irrespective of whether the access was initiated by user or kernel code. This is in contrast to s390, which has separate page tables for user mode and kernel mode. I personally much prefer s390's model. And yes, I've read quite a few papers, and I wrote a good fraction of the patches.

I vaguely remember some threads from last decade where Linus trashed PowerPC and s390 TLBs. I wish I could find them and reread with this in mind.
Post reply on HN