linux-kernel - Re: [PATCH v2] x86/mce: Include the PPIN in machine check records when it is available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 23 Nov 2016 14:37:23 +0100
From:   Borislav Petkov <bp@...e.de>
To:     Henrique de Moraes Holschuh <hmh@....eng.br>
Cc:     "Luck, Tony" <tony.luck@...el.com>,
        Andi Kleen <andi@...stfloor.org>,
        Ashok Raj <ashok.raj@...el.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] x86/mce: Include the PPIN in machine check records
 when it is available

On Wed, Nov 23, 2016 at 11:29:51AM -0200, Henrique de Moraes Holschuh wrote:
> 1. Assuming we can do it, always lock it when it is found to be unlocked
>    at kernel boot.

Because...?

> 2. Not attempt to change its state from disabled to enabled *unless*
>    given a command line parameter authorizing it.  A kconfig-based
>    solution for default+command line override would also work well IMHO,
>    if it makes more sense.

You can't reenable it:

"LockOut (R/WO)
Set 1 to prevent further writes to MSR_PPIN_CTL. Writing 1 to
MSR_PPINCTL[bit 0] is permitted only if MSR_PPIN_CTL[bit 1] is
clear, Default is 0."

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--