| Subject | Re: [RFC PATCH 00/16] PTI support for x86-32 | From | Nadav Amit <> | Date | Thu, 25 Jan 2018 14:09:40 -0800 |
| |
Krzysztof Mazur <krzysiek@podlesie.net> wrote:
> On Tue, Jan 16, 2018 at 05:36:43PM +0100, Joerg Roedel wrote: >> From: Joerg Roedel <jroedel@suse.de> >> >> Hi, >> >> here is my current WIP code to enable PTI on x86-32. It is >> still in a pretty early state, but it successfully boots my >> KVM guest with PAE and with legacy paging. The existing PTI >> code for x86-64 already prepares a lot of the stuff needed >> for 32 bit too, thanks for that to all the people involved >> in its development :) > > Hi, > > I've waited for this patches for a long time, until I've tried to > exploit meltdown on some old 32-bit CPUs and failed. Pentium M > seems to speculatively execute the second load with eax > always equal to 0: > > movzx (%[addr]), %%eax > shl $12, %%eax > movzx (%[target], %%eax), %%eax > > And on Pentium 4-based Xeon the second load seems to be never executed, > even without shift (shifts are slow on some or all Pentium 4's). Maybe > not all P6 and Netbursts CPUs are affected, but I'm not sure. Maybe the > kernel, at least on 32-bit, should try to exploit meltdown to test if > the CPU is really affected.
The PoC apparently does not work with 3GB of memory or more on 32-bit. Does you setup has more? Can you try the attack while setting max_addr=1G ?
Thanks, Nadav
|