News for hackers. Stuff that matters.

A comment on Linux page table isolation is not needed on AMD processors. Parent comment

Re:Linux page table isolation is not needed on AMD processors by SolarNet on Tuesday January 02, 2018 @07:23PM (#16057238)
Yes. AMD didn't take shortcuts, and implemented the spec correctly. Intel took shortcuts, introduced bugs, and now to compensate for that the OS has to work around it in software, it's going to be slow. For years Intel has reaped the benefits of shortcuts for performance, while AMD has been implementing things correctly; now there is a correction.

That's how the market works.

[ Parent | on HN ]
Re:Linux page table isolation is not needed on AMD processors by amluto on Tuesday January 02, 2018 @10:07PM (#16057967)
AMD doesn't exactly do an amazing job of avoiding gotchas in their CPUs. They have a bizarre idea of what writing zero to a segment register should do (resulting in info leaks that were only recently fixed on Linux), their demented leaky IRET is even more demented than Intel's, and their SYSRET's handling of SS is downright nutty.

OTOH, Intel's SYSRET is actively dangerous and has resulted in severe security holes, and Intel doesn't appear to acknowledge that their design is a mistake or that it should be fixed.

[ Parent | on HN ]
Re:Linux page table isolation is not needed on AMD processors by tfcata on Tuesday January 02, 2018 @10:52PM (#16058210)
Can you post a few links maybe to the SYSRET issue mentioned? Just curious.
[ Parent | on HN ]
Re:Linux page table isolation is not needed on AMD processors by amluto on Wednesday January 03, 2018 @12:59AM (#16058846)
SYSRET on Intel will fault with #GP if the kernel tries to go to a noncanonical user RIP. The #GP comes from kernel mode but with the user RSP. Before SMAP, this was an easy root if it happened. With SMAP, it's still pretty bad. AMD CPUs instead allow SYSRET to succeed and send #PF afterwards, which is very safe.

AMD CPUs are differently dumb. If SYSRET is issued while SS=0, then the SS register ends up in a bogus state in which it appears to contain the correct value but 32-bit stack access fails. Search the Linux kernel for "SYSRET_SS_ATTRS" for the workaround.

[ Parent | on HN ]
Re:Linux page table isolation is not needed on AMD processors by cesarb on Wednesday January 03, 2018 @06:15AM (#16060076)
I believe it's this one: https://blog.xenproject.org/2012/06/13/the-intel-sysret-priv...
[ Parent | on HN ]