Messages in this thread | | | Date | Mon, 16 May 2005 15:41:14 +0200 | From | Andrea Arcangeli <> | Subject | Re: Hyper-Threading Vulnerability |
| |
On Fri, May 13, 2005 at 05:39:25PM -0700, dean gaudet wrote: > same cache index -- and get an 8-fold reduction in exposure. the trick > here is the L2 is physically indexed, and userland code can perform only > virtual allocations. but it's not too hard to discover physical conflicts > if you really want to (using rdtsc) -- it would be done early in the > initialization of the program because it involves asking for enough memory > until the kernel gives you enough colliding pages. (a system call could > help with this if we really wanted it.)
A 8-way set associative 1M cache is guaranteed to go at l2 speed only up to 128K (no matter what the kernel does), but even if the secret payload is larger than 128K as long as the load is still distributed evenly at each pass for each page, there's not going to be any covert channel, simply the process will run slower than it could if it had a better page coloring.
So I don't see the need of kernel support, all it needs to do is to know the page size, and that's provided to userland already. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |