linux-kernel - Re: General protection fault in `switch_mm_irqs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9bca3e26-1dfc-6e86-cf28-90cadd983ff4@molgen.mpg.de>
Date:   Wed, 9 Jan 2019 17:34:11 +0100
From:   Paul Menzel <pmenzel@...gen.mpg.de>
To:     Thomas Lendacky <Thomas.Lendacky@....com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Jiri Kosina <jikos@...nel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Borislav Petkov <bp@...en8.de>
Subject: Re: General protection fault in `switch_mm_irqs_off()`

Dear Thomas,


On 01/09/19 17:15, Lendacky, Thomas wrote:
> On 1/9/19 8:34 AM, Paul Menzel wrote:

>> On 01/09/19 15:29, Lendacky, Thomas wrote:
>>> On 1/9/19 7:35 AM, Paul Menzel wrote:
>>
>>>> On 01/09/19 14:16, Thomas Gleixner wrote:
>>>>
>>>>> On Wed, 9 Jan 2019, Paul Menzel wrote:
>>>>>> I get the same with microcode updates applied.
>>>>>>
>>>>>>     $ dmesg | grep 'microcode: CPU0: patch_level'
>>>>>>     [    3.809210] microcode: CPU0: patch_level=0x0600063e
>>>>>>     $ sudo modprobe msr
>>>>>>     $ sudo ./wrmsr 0x49 0x1
>>>>>>     wrmsr: CPU 0 cannot set MSR 0x00000049 to 0x0000000000000001
>>>>>>
>>>>>>> Could you please post /proc/cpuinfo from such a boot as well?
>>>>>
>>>>> /proc/cpuinfo unfortunately does not contain the amd specific IBPB flag,
>>>>> but the dmesg of the original report says:
>>>>>
>>>>>   Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
>>>>>
>>>>> which means, that the CPUID bit is set.
>>>>>
>>>>> Can you please provide the output of:
>>>>>
>>>>>   cpuid -1 -l 0x80000008 -r
>>>>>
>>>>> On my AMD Opteron(TM) Processor 6276 with microcode 0x600063d loaded I get:
>>>>>
>>>>>    0x80000008 0x00: eax=0x00003030 ebx=0x00000000 ecx=0x0000500f edx=0x00000000
>>>>>
>>>>> EBX is 0, which means that X86_FEATURE_AMD_IBPB is not enabled. So the
>>>>> kernel does not try to use the speculation control MSR (0x49).
>>>>
>>>> With CPUID 20180519, I get the output below with both microcode update versions.
>>>>
>>>> 0x600063d:
>>>>
>>>>     $ sudo ./cpuid -1 -l 0x80000008 -r
>>>>     CPU:
>>>>        0x80000008 0x00: eax=0x00003030 ebx=0x00000000 ecx=0x0000500f edx=0x00000000
>>>>
>>>> 0x600063e:
>>>>
>>>>     $ sudo ./cpuid -1 -l 0x80000008 -r
>>>>     CPU:
>>>>        0x80000008 0x00: eax=0x00003030 ebx=0x00000000 ecx=0x0000500f edx=0x00000000
>>>
>>> Hmmm... so ebx is 0 for both versions, so I'm not sure how IBPB is being
>>> set. What's the CPUID output for 0x07 (cpuid -1 -l 0x07 -r)?
>>
>>     $ sudo ./cpuid -1 -l 0x07 -r
>>     CPU:
>>        0x00000007 0x00: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
> 
> I'm confused then...  the only way that I can see that the IBPB feature
> can be set is if 0x80000008[EBX] bit 12 is set or if 0x07[EDX] bit 26 is
> set - neither of which is the case. I must be missing something...

Is there a way to trace the value of `boot_cpu_data` from
`arch/x86/include/asm/cpufeature.h` with some Linux Kernel magic?

    #define boot_cpu_has(bit)       cpu_has(&boot_cpu_data, bit)

Or is rebuilding with print statements the only solution?


Kind regards,

Paul


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5174 bytes)