linux-kernel - Re: [RFC][PATCH] perf, intel: Don't touch MSR_IA32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1347471714.15764.71.camel@twins>
Date:	Wed, 12 Sep 2012 19:41:54 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Stephane Eranian <eranian@...gle.com>,
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
	linux-kernel <linux-kernel@...r.kernel.org>, mingo@...nel.org
Subject: Re: [RFC][PATCH] perf, intel: Don't touch MSR_IA32_DEBUGCTLMSR from
 NMI context

On Wed, 2012-09-12 at 19:36 +0200, Oleg Nesterov wrote:
> On 09/12, Peter Zijlstra wrote:
> >
> > Oleg and Sebastian found that touching MSR_IA32_DEBUGCTLMSR from NMI
> > context is problematic since the only way to change the various
> > unrelated bits in there is:
> >
> >   debugctl = get_debugctlmsr()
> >   /* frob flags in debugctl */
> >   update_debugctlmsr(debugctl);
> >
> > Which is entirely unsafe if we prod at the MSR from NMI context.
> >
> > In particular the path that is responsible is:
> >
> >   x86_pmu_handle_irq() (NMI handler)
> >     x86_pmu_stop()
> >       x86_pmu.disable -> intel_pmu_disable_event()
> >         intel_pmu_lbr_disable()
> >           __intel_pmu_lbr_disable()
> >             wrmsrl(MSR_IA32_DEBUGCTLMSR,... );
> 
> Not only.
> 
> x86_pmu_handle_irq() does intel_pmu_disable_all() and intel_pmu_enable_all(),
> this leads to intel_pmu_enable_bts() and intel_pmu_disable_bts().
> 
> And those intel_pmu_*_bts() are also called by intel_pmu_disable_event()
> and intel_pmu_enable_event(), the latter is probably fine.

As written in the email to Stephane just now, the {dis,en}able_all()
things are symmetric and don't change the visible MSR state. But you're
right, I missed that BTS frobbed that MSR as well. 

I'll have to see if there's a DS programming that effectively disables
the BTS nonsense.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/