On Wed, 2018-02-21 at 21:12 +0100, Fabian Grünbichler wrote:
[...]
> > Meltdown
> > --------
> >
> > We currently say that only amd64 is mitigated for Meltdown in the wiki -
> > is there work being done in the kernel to try and fix this in other
> > architectures? Or is the intersection of "vulnerable design + exotic
> > architecture" too small to bother?
>
> there are threads discussing porting it to i386 IIRC, arm64 has a patch
> set as well (with various degrees of being applied upstream and in
> distro kernels).
Some PowerPC, MIPS and System z cores may also need fixes (thankfully
not in LTS). I replicated the status table for each group of
architectures that is likely to be addressed separately.
> also, for Meltdown (v3) mitigation you absolutely want to pass through
> the PCID flag to your VMs in case your physical CPUs (i.e., Intel since
> Westmere) and guest OS support it. it makes a whole world of difference
> for syscall-heavy workloads. passing this through also requires support
> from your hypervisor stack.
>
> it's also worth noting that KPTI in 3.16 (Jessie), 4.4 (Ubuntu 16.04),
> 4.9 (Stretch) is vastly different from KPTI in 4.13+ (Ubuntu 17.10,
> Ubuntu 16.04 HWE, current latest upstream LTS, current latest upstream
> stable). the former uses an adapted version of the original KAISER patch
> set, the latter use a much more heavily adapted mainline version.
> upstream stable (Greg K-H)'s recommendation is thus to use 4.14 or later
> if at all possible - it's likely that not all subsequent
> fixes/improvements are easily backportable to the KAISER-based kernels
> (IMHO this applies to performance, regression and security fixes).
The KAISER backports we are using in all our stable branches (wheezy,
jessie and stretch) map all kernel stack pages in the user-space page
tables. This is a significant weakness that ought to be fixed. In
4.14+, only small per-CPU entry stacks (and other essential data) are
included in the user-space page tables.
Ben.
> this got kinda long, sorry ;)
>
--
Ben Hutchings
Life is what happens to you while you're busy making other plans.
- John
Lennon
Attachment:
signature.asc
Description: This is a digitally signed message part