linux-kernel - Re: [PATCH] x86/AMD: Apply erratum 688 on machines without a BIOS fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 19 Oct 2016 17:00:56 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     sonofagun@...nmailbox.org, Nikos Barkas <levelwol@...il.com>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/AMD: Apply erratum 688 on machines without a BIOS fix

On Wed, Oct 19, 2016 at 04:58:08PM +0300, sonofagun@...nmailbox.org wrote:
> 
> AMD F14h machines have an erratum which can cause unpredictable program
> behaviour under specific branch conditions. The workaround is to set
> MSRC001_1021[14] and MSRC001_1021[3]. Both bits are reserved for this MSR,
> so we trust AMD suggestions. Since there is no BIOS update containing that
> workaround for some machines, we do it ourselves unconditionally on this
> family too. Our Compaq CQ57 laptop which has broken firmware in various
> areas does not contain both workarounds(MSRc0011021: 0000000010208000)...

...

> +#define MSR_AMD64_IC_CFG	0xC0011021
> +
> +static void init_amd_on(struct cpuinfo_x86 *c)
> +{
> +	/*
> +	 * Apply erratum 688 fix unconditionally so machines without a BIOS
> +	 * fix work.
> +	 */
> +	msr_set_bit(MSR_AMD64_IC_CFG, 3);
> +	msr_set_bit(MSR_AMD64_IC_CFG, 14);
> +}

You can't force this unconditionally. Look at the suggested workaround:

"BIOS should set MSRC001_1021[14] = 1b and MSRC001_1021[3] = 1b. This
workaround is required only when bit 2 of Fixed Errata Status Register
(D18F4x164[2]) = 0b."

So you need to do something like this:

	if (c->x86_model == 2 && c->x86_mask == 0) {
		u32 val = pci_read_config(0, 0x18, 0x4, 0x164);

		if (!(val & BIT(2))) {
			msr_set_bit(MSR_AMD64_IC_CFG, 3);
			msr_set_bit(MSR_AMD64_IC_CFG, 14);
		}
	}

Also, please paste /proc/cpuinfo from that machine.

Then, keep that *whole* changelog above when sending v2 of the patch - I like
the level of detail of your explanation! ;-)

Thanks.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.