linux-kernel - Re: [PATCH] x86/cpu: Avoid writing MSR_IA32_TSX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Sep 2022 23:00:08 +0000
From:   Andrew Cooper <Andrew.Cooper3@...rix.com>
To:     Peter Zijlstra <peterz@...radead.org>,
        Hans de Goede <hdegoede@...hat.com>
CC:     "Rafael J . Wysocki" <rafael@...nel.org>,
        Pavel Machek <pavel@....cz>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H . Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Andrew Cooper <Andrew.Cooper3@...rix.com>
Subject: Re: [PATCH] x86/cpu: Avoid writing MSR_IA32_TSX_CTRL when writing it
 is not supported

On 06/09/2022 22:00, Peter Zijlstra wrote:
> On Tue, Sep 06, 2022 at 10:56:47PM +0200, Hans de Goede wrote:
>> Hi,
>>
>> On 9/6/22 22:43, Peter Zijlstra wrote:
>>> On Tue, Sep 06, 2022 at 10:17:43PM +0200, Hans de Goede wrote:
>>>> On an Intel Atom N2600 (and presumable other Cedar Trail models)
>>>> MSR_IA32_TSX_CTRL can be read, causing saved_msr.valid to be set for it
>>>> by msr_build_context().
>>>>
>>>> This causes restore_processor_state() to try and restore it, but writing
>>>> this MSR is not allowed on the Intel Atom N2600 leading to:
>>> FWIW, virt tends to do this same thing a lot. They'll allow reading
>>> random MSRs and only fail on write.
>> Right. So I guess I should send a v2 with an updated commit
>> message mentioning this ?
> Nah, just saying this is a somewhat common pattern with MSRs.
>
> The best ones are the one where writing the value read is invalid :/ or
> those who also silently eat a 0 write just for giggles. Luckily that
> doesn't happen often.

Several comments.  First of all, MSR_TSX_CTRL is a fully read/write
MSR.  If virt is doing this wrong, fix the hypervisor.  But this doesn't
look virt related?

More importantly, MSR_TSX_CTRL does not plausibly exist on an Atom
N2600, as it is more than a decade old.

MSR_TSX_CTRL was retrofitted in microcode to the MDS_NO, TAA-vulnerable
CPUs which is a very narrow range from about 1 quarter of 2019 which
includes Cascade Lake, and then included architecturally on subsequent
parts which support TSX.

pm_save_spec_msr() is totally broken.  It's poking MSRs blindly without
checking the enumeration of the capability first.

In this case, I bet the N2600 has a model specific MSR living at index
0x122 which has absolutely nothing at all to do with TSX.

~Andrew