linux-kernel - [tip:x86/urgent] x86: SMI workaround for pit_expect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 31 Jul 2009 17:39:43 GMT
From:	"tip-bot for Tan, Wei Chong" <wei.chong.tan@...el.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, wei.chong.tan@...el.com,
	hpa@...or.com, mingo@...hat.com, tglx@...utronix.de
Subject: [tip:x86/urgent] x86: SMI workaround for pit_expect_msb

Commit-ID:  fb34a8ee86cb52ee688627f820ed6c80ee033219
Gitweb:     http://git.kernel.org/tip/fb34a8ee86cb52ee688627f820ed6c80ee033219
Author:     Tan, Wei Chong <wei.chong.tan@...el.com>
AuthorDate: Wed, 15 Jul 2009 14:47:18 +0800
Committer:  H. Peter Anvin <hpa@...or.com>
CommitDate: Fri, 31 Jul 2009 09:26:55 -0700

x86: SMI workaround for pit_expect_msb

pit_expect_msb() seems to be vulnerable to SMI disturbance corner case
in some platforms which causes /proc/cpuinfo to show wrong CPU MHz
value when quick_pit_calibrate() jump to success section.  This patch
try to minimize such cases by rejecting them so that other calibration
method is utilized.  Initial trial shows that out of 300 reboot
cycles, 18 uses quick_pit_calibrate() successfully and /proc/cpuinfo
shows reasonable CPU MHz.  Without the patch, 1 out of roughly 20
reboot cycles may show wrong MHz value.

Signed-off-by: Wei Chong Tan <wei.chong.tan@...el.com>
LKML-Reference: <B28277FD4E0F9247A3D55704C440A140D3278C16@...msx504.gar.corp.intel.com>
Acked-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: H. Peter Anvin <hpa@...or.com>


---
 arch/x86/kernel/tsc.c |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 6e1a368..68e93c1 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -285,10 +285,29 @@ static inline int pit_expect_msb(unsigned char val, u64 *tscp, unsigned long *de
 		inb(0x42);
 		if (inb(0x42) != val)
 			break;
+		/* What if an SMI kicks in here when
+		 * count is just slightly over 5 and SMI run long enough
+		 * so that PIT MSB value is way bigger then val?
+		 * Then tscp will have an unreasonably large value,
+		 * since the code has no notion of
+		 * how much inb(0x42) MSB is bigger then val when it return from SMI.
+		 * In addition, since the 2 get_cycles() are near,
+		 * deltap may get a sane value.
+		 * If this happen on the final few readings
+		 * just before (d1+d2 < delta >> 11),
+		 * this may skew the average delta variable of quick_pit_calibrate().
+		 */
 		tsc = get_cycles();
 	}
 	*deltap = get_cycles() - tsc;
 	*tscp = tsc;
+	/* inb(0x42) will need to be separately repeated here as
+	 * the SMI may take so long that the old reading
+	 * is no longer reliable. inb(0x42) after all get_cycles is the safest.
+	 */
+	inb(0x42);
+	if (inb(0x42) < (val - 1))
+		return 0;
 
 	/*
 	 * We require _some_ success, but the quality control
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/