Mark Dalby

Fighting Ignorance since 1986 (It’s taking longer than I thought).

Advertisement

Posts Tagged ‘ Linux ’

http://www.flickr.com/photos/pinelife/733214124/

On May 16, 2011, Fenghua Yu submitted a series of patches to the upstream Linux kernel implementing support for a new Intel CPU feature: Supervisor Mode Execution Protection (SMEP). This feature is enabled by toggling a bit in the cr4 register, and the result is the CPU will generate a fault whenever ring0 attempts to execute code from a page marked with the user bit.

First, some background on why this feature is useful. Like most mainstream operating systems, the vanilla Linux kernel does not leverage x86 segmentation, instead defining flat segment descriptors with limits encompassing the entire 4gb address space. Additionally, each process has the kernel’s page table entries replicated, resulting in the kernel address space being mapped in the upper 1gb of every user process. Both of these decisions are for performance reasons: reloading segment selectors at every trap and kernel-to-user (or vice versa) copy operation introduces a non-negligible (but not necessarily unacceptable) performance hit, and having completely separate user and kernel address spaces would necessitate a TLB flush on every trap, which is even more expensive.

The result of this is that the kernel is free to incorrectly access data residing in userspace, as well as execute code in the user region. In addition to enabling the exploitation of many bugs that rely on the kernel incorrectly using user data, this allows kernel exploits to simply map a suitable payload in userspace and divert kernel execution to that payload.

The PaX project solves this problem in a general way with a feature called PAX_UDEREF. When this feature is enabled, PaX leverages segmentation to isolate user and kernel addresses, such that a fault will be generated when the kernel incorrectly accesses user data or code. Unfortunately, due to the performance hit associated with reloading segment registers and the fact that this touches mission-critical code, it’s unlikely that this solution would be accepted into the upstream Linux kernel.

Tags: 

HITBSecNews – Keeping Knowledge Free for Over a Decade

The creator of Linux, Linus Torvalds is starting to think that the Linux 2.6 kernel is getting out of hand and he is thinking of killing it and releasing a new version.

In a message to the Linux Kernel Mailing List, Torvalds said that there have been too many updates to Linux 2.6 kernel releases and with traditional Linux humour he said that the numbers have got so long he could end up tagging this as the Linux 2.8.0 kernel.

The problem was pointed out in 2008 by Greg Kroah-Hartman who proposed abandoning the Linux 2.6 kernel numbering which he thought was getting confusing. He wanted something like”Linux 2009.0.0″ to reflect the age of the kernel rather than some number that holds little value to the great unwashed. Now that Linux 2.6 kernel series is on its way to its 40th release and is nearly seven years old, the numbers are getting confusing.
Hack In The Box

For those that follow my personal Twitter feed will know that for the past week I’ve been closely testing Ubuntu 11.04 and all Ubuntu releases going back to Ubuntu 8.04 on many mobile devices in the office. The overall system performance, power consumption, and boot performance have been the principal targets. However, late this week I discovered a glaring regression: Ubuntu 11.04 is viciously going through power. Compared to Ubuntu 10.10, the power consumption on Ubuntu 11.04 for mobile devices is up about 10% on average but under some workloads, I am seeing the power consumption up by nearly 30%. This is happening on many mobile systems spanning multiple generations of Intel CPUs and with Intel / ATI / NVIDIA graphics. This issue has been tracked down to a frightening kernel regression in the mainline tree that is still not addressed.

In the publishing queue for Monday morning is the main article for the full power consumption results with all of the tested mobile devices, more details, and of the Ubuntu releases going back to 8.04 Hardy. However, due to the severity of the regression, this afternoon I am putting out the key bits of information that illustrate the regression. During the Linux 2.6.38 kernel development, a regression was introduced causing systems to burn through significantly more power. The below graph shows the battery power consumption of one of the Lenovo ThinkPad notebooks under the Linux 2.6.35, 2.6.36, 2.6.37, 2.6.38, and 2.6.39 (Git code as of 19 April 2011) kernels. Unlike some of the other regressions to have been highlighted on Phoronix, this regression is still unfixed in Linux 2.6.39. On the particular system being talked about in the article today is the power consumption going up by 14%, which would lead to a noticeably shorter battery life.
Hack In The Box

According to our friends over at TheRegister;  Debian 6.0 (codenamed “Squeeze”) is going to be shipped with the option of a FreeBSD Kernel as opposed to the Linux one of distributions past.

This option will be named “KFreeBSD” (Short For KernelFreeBSD??) and will primarily be available on i386 and amd64 architectures (which will cater for most of us).

The use of a FreeBSD kernel will provide features such as jails, the OpenBSD Packet Filter and support for NDIS drivers and make Debian the only mainstream OS to concurrently support 2 different Kernels.

Over the past few years Debian has gained some serious traction, Its packaging system (aptitude) is by far the easiest to use and one of its derivatives (ubuntu) is the OS of choice for modern netbooks.

It makes me happy to know that there are still some forward thinking people in this world and I see this announcement as a massive plus for the *nix community in general.

Watch this space…

Reblog this post [with Zemanta]
Get Adobe Flash playerPlugin by wpburn.com wordpress themes