linux-kernel - Re: [PATCH] Blacklist DMAR on Intel G31/G33 chipsets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080905183459.GC14258@elte.hu>
Date:	Fri, 5 Sep 2008 20:34:59 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	David Woodhouse <dwmw2@...radead.org>
Cc:	linux-kernel@...r.kernel.org, andi@...stfloor.org,
	arjan@...radead.org, torvalds@...ux-foundation.org,
	sfr@...b.auug.org.au, Jesse Barnes <jbarnes@...tuousgeek.org>
Subject: Re: [PATCH] Blacklist DMAR on Intel G31/G33 chipsets

* David Woodhouse <dwmw2@...radead.org> wrote:

> Some BIOSes (the Intel DG33BU, for example) wrongly claim to have DMAR
> when they don't. Avoid the resulting crashes when it doesn't work as
> expected.
> 
> Signed-off-by: David Woodhouse <David.Woodhouse@...el.com>
> ---
> 
> This time, I build-tested it with CONFIG_DMAR actually enabled. Sorry. 
> I'd still be grateful if someone could test it on a DG33BU with the 
> old BIOS though, since I've killed mine. I tested the DMI version, but 
> not this one.

ok - fixing this makes sense. I have two worries about this patch.

Firstly, the quirk is keyed off an ACPI capability which is quite bad if 
someone boots with ACPI off. (which is still quite possible) The DMAR is 
PCI enumerated so there's nothing inherently ACPI about this. A DMI 
quirk (which will work even if ACPI is disabled) looks more robust.

Secondly, keying off the PCI ID and assuming a BIOS bug based on the 
presence of an ACPI table can indeed get incoherent results as you 
suspect. It's better to single out the specific BIOS as long as the DMI 
info is specific enough. Even if that PCI ID is never supposed to be 
combined with VT-d (because, obviously, VT-d needs a different chipset), 
it's just a sloppy concept in general.

The fact that you've already tested the DMI version and cannot test the 
new version is one more reason to favor the first patch.

Could you please resend the initial DMI version of the 
drivers/pci/intel-iommu.c commit stand-alone, not embedded in a 'misc' 
pull request, and with Jesse Cc:-ed as well? Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/