Linux Kernel developers might be a little mad at Intel over Meltdown

L

Lunar

Limp Gawd
Joined
Jul 26, 2007
Messages
444
Here's an excerpt from the Linux Kernel Mailing List about what they were going to rename the KAISER patches for Meltdown. They settled on Kernel Page Table Isolation, but I think I prefer the others personally.
Several people including Linus requested to change the KAISER name.

We came up with a list of technically correct acronyms:

User Address Space Separation, prefix uass_

Forcefully Unmap Complete Kernel With Interrupt Trampolines, prefix fuckwit_

but we are politically correct people so we settled for

Kernel Page Table Isolation, prefix kpti_

Linus, your call :)
Click to expand...
https://lkml.org/lkml/2017/12/4/709

Funniest thing I've seen all day.
 
Isn't it great when you can view the code! If it wasnt for Linux we would probably all still be in the dark over the whole exploit right now.
 
octane said:
Isn't it great when you can view the code! If it wasnt for Linux we would probably all still be in the dark over the whole exploit right now.
Click to expand...
I don't know about that. The details were going to be made public regardless. The researchers were just giving vendors time to create the fixes so that the problem was nullified prior to the details of the vulnerability being made public. Standard practice in the security space. Has nothing to do with open source I'm afraid.

EDIT: This is also why details about the Spectre vulnerability are still scarce. The fixes aren't in place, so it would be irresponsible to disclose details about the vulnerability at this time.
 
Lunar said:
I don't know about that. The details were going to be made public regardless. The researchers were just giving vendors time to create the fixes so that the problem was nullified prior to the details of the vulnerability being made public. Standard practice in the security space. Has nothing to do with open source I'm afraid.

EDIT: This is also why details about the Spectre vulnerability are still scarce. The fixes aren't in place, so it would be irresponsible to disclose details about the vulnerability at this time.
Click to expand...
That is true as there was an embargo in-place while vendors tested... HOWEVER once the linux patches were released 10 days ago people started pulling it apart to figure what could be the issue based upon what was occurring. The embargo was to be lifted next tuesday when MS releases its patches but they had to accelerate.

Yes the embargo was being lift, yes a level of full disclosure would have occurred BUT imagine if linux didn't exist so everyone can see what was being patched, the Intel BS PR spin probably would have been accepted by the masses instead of torn to bits. Its the corporate side of any suppression that was alleviated by open-source
 
naib said:
That is true as there was an embargo in-place while vendors tested... HOWEVER once the linux patches were released 10 days ago people started pulling it apart to figure what could be the issue based upon what was occurring. The embargo was to be lifted next tuesday when MS releases its patches but they had to accelerate.

Yes the embargo was being lift, yes a level of full disclosure would have occurred BUT imagine if linux didn't exist so everyone can see what was being patched, the Intel BS PR spin probably would have been accepted by the masses instead of torn to bits. Its the corporate side of any suppression that was alleviated by open-source
Click to expand...

My point exactly. :)
 
Lunar said:
Also, this commit to the linux kernel by AMD has got to be the best jab at another company ever committed to code.


https://lkml.org/lkml/2017/12/27/2
Click to expand...


AMD is no better than intel according to Richard Stallman and may actually be worse according to this:


Why is the latest AMD hardware unsupported in libreboot?
It is extremely unlikely that any post-2013 AMD hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern AMD hardware. If you have an AMD based system affected by the problems described below, then you should get rid of it as soon as possible. The main issues are as follows:

We call on AMD to release source code and specs for the new AMD Ryzen platforms! We call on the community to put pressure on AMD. Click here to read more

AMD Platform Security Processor (PSP)
This is basically AMD’s own version of the Intel Management Engine. It has all of the same basic security and freedom issues, although the implementation is wildly different.

The Platform Security Processor (PSP) is built in on all Family 16h + systems (basically anything post-2013), and controls the main x86 core startup. PSP firmware is cryptographically signed with a strong key similar to the Intel ME. If the PSP firmware is not present, or if the AMD signing key is not present, the x86 cores will not be released from reset, rendering the system inoperable.

The PSP is an ARM core with TrustZone technology, built onto the main CPU die. As such, it has the ability to hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, login data, browsing history, keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM “features” to work as intended), which means that it has at minimum MMIO-based access to the network controllers and any other PCI/PCIe peripherals installed on the system.

In theory any malicious entity with access to the AMD signing key would be able to install persistent malware that could not be eradicated without an external flasher and a known good PSP image. Furthermore, multiple security vulnerabilities have been demonstrated in AMD firmware in the past, and there is every reason to assume one or more zero day vulnerabilities are lurking in the PSP firmware. Given the extreme privilege level (ring -2 or ring -3) of the PSP, said vulnerabilities would have the ability to remotely monitor and control any PSP enabled machine completely outside of the user’s knowledge.

Much like with the Intel Boot Guard (an application of the Intel Management Engine), AMD’s PSP can also act as a tyrant by checking signatures on any boot firmware that you flash, making replacement boot firmware (e.g. libreboot, coreboot) impossible on some boards. Early anecdotal reports indicate that AMD’s boot guard counterpart will be used on most OEM hardware, disabled only on so-called “enthusiast” CPUs.

AMD IMC firmware
Read https://www.coreboot.org/AMD_IMC.

AMD SMU firmware
Handles some power management for PCIe devices (without this, your laptop will not work properly) and several other power management related features.

The firmware is signed, although on older AMD hardware it is a symmetric key, which means that with access to the key (if leaked) you could sign your own modified version and run it. Rudolf Marek (coreboot hacker) found out how to extract this key in this video demonstration, and based on this work, Damien Zammit (another coreboot hacker) partially replaced it with free firmware, but on the relevant system (ASUS F2A85-M) there were still other blobs present (Video BIOS, and others) preventing the hardware from being supported in libreboot.

AMD AGESA firmware
This is responsible for virtually all core hardware initialization on modern AMD systems. In 2011, AMD started cooperating with the coreboot project, releasing this as source code under a free license. In 2014, they stopped releasing source code and started releasing AGESA as binary blobs instead. This makes AGESA now equivalent to Intel FSP.

AMD CPU microcode updates
Read the Intel section practically the same, though it was found with much later hardware in AMD that you could run without microcode updates. It’s unknown whether the updates are needed on all AMD boards (depends on CPU).

AMD is incompetent (and uncooperative)
AMD seemed like it was on the right track in 2011 when it started cooperating with and releasing source code for several critical components to the coreboot project. It was not to be. For so-called economic reasons, they decided that it was not worth the time to invest in the coreboot project anymore.

For a company to go from being so good, to so bad, in just 3 years, shows that something is seriously wrong with AMD. Like Intel, they do not deserve your money.

Given the current state of Intel hardware with the Management Engine, it is our opinion that all performant x86 hardware newer than the AMD Family 15h CPUs (on AMD’s side) or anything post-2009 on Intel’s side is defective by design and cannot safely be used to store, transmit, or process sensitive data. Sensitive data is any data in which a data breach would cause significant economic harm to the entity which created or was responsible for storing said data, so this would include banks, credit card companies, or retailers (customer account records), in addition to the “usual” engineering and software development firms. This also affects whistleblowers, or anyone who needs actual privacy and security.

What can I use, then?
Libreboot has support for fam15h AMD hardware (~2012 gen) and some older Intel platforms like Napa, Montevina, Eagle Lake, Lakeport (2004-2006). We also have support for some ARM chipsets (rk3288). On the Intel side, we’re also interested in some of the chipsets that use Atom CPUs (rebranded from older chipsets, mostly using ich7-based southbridges).

Here's the link:

https://libreboot.org/faq.html#intel
 
scharfshutze009 said:
AMD is no better than intel according to Richard Stallman and may actually be worse according to this
Click to expand...
I agree and disagree here. First, Richard as great as he can be is also a bit excessive in this regard. The call to release protected IP by him is not and should ever be honored by AMD or Intel. I love open source, but I don't have the frankly asinine belief that all things should be open source. If he wants to recommend people not use AMD or Intel hardware because of freedom issues, then that's his right. However, AMD is in no way worse than Intel in this regard, especially considering they are going to be allowing the PSP to be disabled with a firmware update.

Stallman's recommendations of usable platforms are also just unrealistic for most of us, because if you think for a second that I'm going to use an Intel chip from 2006 or an AMD chip from 2012 then you have another thing coming. He can stick to his old Thinkpad with libreboot and Trisquel Linux all he wants, but I wont be doing that. Yes that means I'm accepting some risk, and I'm personally fine with that. This idea that there should be no such thing as protected IP by companies is just absurd. I'm more than happy to support a company that decides to go open source, but I'll never demand it. It's their right to protect their IP, and I will defend that right just as I'll defend those who choose to go open source.

lastly, the PSP/IME vulnerabilities and the vulnerabilities that are the topic of discussion for this thread are very different. The opening statement of this thread still stands as accurate and is still just as funny to me as it was when I posted it.

EDIT: I'd also like to add that throwing shade in AMD's direction isn't the right path forward. AMD has shown ever increasing support for open source, and has been contributing for years to open source. They even made their custom rendering paths for hair (Tomb Raider) open source as opposed to NVIDIA's gameworks black box. I'm fine with providing constructive criticism where necessary, but to claim AMD is as bad or worse than Intel is disingenuous and not constructive.

For so-called economic reasons, they decided that it was not worth the time to invest in the coreboot project anymore
Click to expand...
Considering their financial state at the time I can understand where they were coming from. Frankly, coreboot is a waste of time and resources for them. It's a great idea, but completely unrealistic and an unachievable goal until we get the upcoming open source RISC-V CPU's. I wish all involved good luck, but I highly doubt those projects will ever go anywhere or gain traction. It's statements like these that irritate me the most about Stallman. He's so fanatical in his beliefs that he wont listen to reason or anyone's position on these things if their position differs from his own. He abides by a strict ideology as if it's the one true way, and while I do agree with him on some things, I honestly don't on most.
 
Last edited:
Lunar said:
I agree and disagree here. First, Richard as great as he can be is also a bit excessive in this regard. The call to release protected IP by him is not and should ever be honored by AMD or Intel. I love open source, but I don't have the frankly asinine belief that all things should be open source. If he wants to recommend people not use AMD or Intel hardware because of freedom issues, then that's his right. However, AMD is in no way worse than Intel in this regard, especially considering they are going to be allowing the PSP to be disabled with a firmware update.

Stallman's recommendations of usable platforms are also just unrealistic for most of us, because if you think for a second that I'm going to use an Intel chip from 2006 or an AMD chip from 2012 then you have another thing coming. He can stick to his old Thinkpad with libreboot and Trisquel Linux all he wants, but I wont be doing that. Yes that means I'm accepting some risk, and I'm personally fine with that. This idea that there should be no such thing as protected IP by companies is just absurd. I'm more than happy to support a company that decides to go open source, but I'll never demand it. It's their right to protect their IP, and I will defend that right just as I'll defend those who choose to go open source.

lastly, the PSP/IME vulnerabilities and the vulnerabilities that are the topic of discussion for this thread are very different. The opening statement of this thread still stands as accurate and is still just as funny to me as it was when I posted it.

EDIT: I'd also like to add that throwing shade in AMD's direction isn't the right path forward. AMD has shown ever increasing support for open source, and has been contributing for years to open source. They even made their custom rendering paths for hair (Tomb Raider) open source as opposed to NVIDIA's gameworks black box. I'm fine with providing constructive criticism where necessary, but to claim AMD is as bad or worse than Intel is disingenuous and not constructive.
Click to expand...

Agreed. Stallman's belief system in fully open source systems is an unattainable pipedream unless you control everything from start to finish including all the silicon and that just isn't going to happen.
 
Lunar said:
I agree and disagree here. First, Richard as great as he can be is also a bit excessive in this regard. The call to release protected IP by him is not and should ever be honored by AMD or Intel. I love open source, but I don't have the frankly asinine belief that all things should be open source. If he wants to recommend people not use AMD or Intel hardware because of freedom issues, then that's his right. However, AMD is in no way worse than Intel in this regard, especially considering they are going to be allowing the PSP to be disabled with a firmware update.

Stallman's recommendations of usable platforms are also just unrealistic for most of us, because if you think for a second that I'm going to use an Intel chip from 2006 or an AMD chip from 2012 then you have another thing coming. He can stick to his old Thinkpad with libreboot and Trisquel Linux all he wants, but I wont be doing that. Yes that means I'm accepting some risk, and I'm personally fine with that. This idea that there should be no such thing as protected IP by companies is just absurd. I'm more than happy to support a company that decides to go open source, but I'll never demand it. It's their right to protect their IP, and I will defend that right just as I'll defend those who choose to go open source.

lastly, the PSP/IME vulnerabilities and the vulnerabilities that are the topic of discussion for this thread are very different. The opening statement of this thread still stands as accurate and is still just as funny to me as it was when I posted it.

EDIT: I'd also like to add that throwing shade in AMD's direction isn't the right path forward. AMD has shown ever increasing support for open source, and has been contributing for years to open source. They even made their custom rendering paths for hair (Tomb Raider) open source as opposed to NVIDIA's gameworks black box. I'm fine with providing constructive criticism where necessary, but to claim AMD is as bad or worse than Intel is disingenuous and not constructive.


Considering their financial state at the time I can understand where they were coming from. Frankly, coreboot is a waste of time and resources for them. It's a great idea, but completely unrealistic and an unachievable goal until we get the upcoming open source RISC-V CPU's. I wish all involved good luck, but I highly doubt those projects will ever go anywhere or gain traction. It's statements like these that irritate me the most about Stallman. He's so fanatical in his beliefs that he wont listen to reason or anyone's position on these things if their position differs from his own. He abides by a strict ideology as if it's the one true way, and while I do agree with him on some things, I honestly don't on most.
Click to expand...

I don't agree with Stallman on everything either yet if I ever will, but what I stated was what he believes or whatever. Personally, I feel as though he thinks that no security features are his true aim, which I don't agree with because you can't just let anyone do anything they want with your system or everyone else's and I know that to much security can almost make a system unusable too. He believes that everything should be like it was back in the 60's or 70's of computing and that everyone should respect each other's files and freedom's, but that's where I don't agree because everybody doesn't do that especially in this present day.

I do believe that AMD is probably no better than Intel though if Intel and it's products are flawed. He said ARM had issues too. I won't be going back to computers from 2009 or 2012 either just for the sake of listening to Stallman, but I still have two Intel Core 2 Duo systems and older. However, I didn't keep those older systems for that reason instead I kept the Core 2 Duo, so I could work on Computer Networking College Assignments from home easier considering Microsoft Windows Vista, 7, Server 2003, and 2008 didn't like hardware changes that I would have to keep reentering the product key to validate Windows for if their was even the slightest significant hardware difference while switching from the schools computers and my homes computers. Even CentOS Linux didn't like some hardware changes and would sometimes kernel panic if something wasn't the same or close and it's a portable operating system. I kept my other systems if they weren't that old or to see how far back I could go and still do something meaningful or if they might be valuable, which I doubt I have any valuable system considering their all custom made by me and the only thing valuable might be the parts.

I'm not trying to throw shade in AMD's direction, but according to Stallman they might be worse than Intel if not about the same or not as bad. Either way though AMD has similar technology to Intel's Managment systems and if whoever is using that back door isn't miss-using it then hackers might be.

Stallman isn't in favor of open source, like Torvalds is and favors freedom respecting or free software, but not free as in price and I don't completely agree with. I believe in more of open source or name your price, but I do see Stallman's point to some degree and believe that somethings are not freedom respecting. Open source has been extremely helpful to me in my current tight financial citation and freedom respecting has been helpful in keeping me productive because freedom respecting doesn't update my system at inconvenient times or without my permission. Finally the only problem I have with true freedom respecting is that I seem to be unable to download it because true free software or freedom respecting software in the following link won't let me download it:

https://www.gnu.org/distros/free-distros.html
 
Last edited:
I write firmware update automation code for commercial systems, and the variety of firmware and OS fixes I've seen from everyone has just been a mess. Companies submitting fixes frantically, only to find it partially works, or breaks something. It feels like this stuff is going to drag on for months.
 
You must log in or register to reply here.
Back
Top