linux-kernel - Re: [PATCH v6 00/16] x86/mtrr: fix handling with PAT but without MTRR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4c47a11c-0565-678d-3467-e01c5ec16600@suse.com>
Date:   Wed, 10 May 2023 17:53:15 +0200
From:   Juergen Gross <jgross@...e.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     linux-kernel@...r.kernel.org, x86@...nel.org,
        linux-hyperv@...r.kernel.org, linux-doc@...r.kernel.org,
        mikelley@...rosoft.com, Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "K. Y. Srinivasan" <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        xen-devel@...ts.xenproject.org, Jonathan Corbet <corbet@....net>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH v6 00/16] x86/mtrr: fix handling with PAT but without MTRR

On 10.05.23 15:30, Borislav Petkov wrote:
> On Wed, May 10, 2023 at 01:36:41AM +0200, Borislav Petkov wrote:
>> More staring at this tomorrow, on a clear head.
> 
> Yeah, I'm going to leave it as is. Tried doing a union with bitfields
> but doesn't get any prettier.
> 
> Next crapola:
> 
> The Intel box says now:
> 
> [    8.138683] sgx: EPC section 0x80200000-0x85ffffff
> [    8.204838] pmd_set_huge: Cannot satisfy [mem 0x80200000-0x80400000] with a huge-page mapping due to MTRR override, uniform: 0
> 
> (I've extended the debug output).
> 
> and that happens because
> 
> [    8.174229] mtrr_type_lookup: mtrr_state_set: 1
> [    8.178909] mtrr_type_lookup: start: 0x80200000, cache_map[3].start: 0x88800000
> 
> that's
> 
> 	 if (start < cache_map[i].start) {
> 
> in mtrr_type_lookup(). I fail to see how that check would work for the
> range 0x80200000-0x80400000 and the MTRR map is:
> 
> [    0.000587] MTRR map: 4 entries (3 fixed + 1 variable; max 23), built from 10 variable MTRRs
> [    0.000588]   0: 0000000000000000-000000000009ffff write-back
> [    0.000589]   1: 00000000000a0000-00000000000bffff uncachable
> [    0.000590]   2: 00000000000c0000-00000000000fffff write-protect
> [    0.000591]   3: 0000000088800000-00000000ffffffff uncachable
> 
> so the UC range comes after this one we request.
> 
> [    8.186372] mtrr_type_lookup: type: 0x6, cache_map[3].type: 0x0
> 
> now the next type merging happens and the 3rd region's type is UC, ofc.
> 
> [    8.192433] type_merge: type: 0x6, new_type: 0x0, effective_type: 0x0, clear uniform
> 
> we clear uniform and we fail:
> 
> [    8.200331] mtrr_type_lookup: ret, uniform: 0
> 
> So this map lookup thing is wrong in this case.
> 

Urgh, yes, there is something missing:

diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index 031f7ea8e72b..9544e7d13bb3 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -521,8 +521,12 @@ u8 mtrr_type_lookup(u64 start, u64 end, u8 *uniform)
         for (i = 0; i < cache_map_n && start < end; i++) {
                 if (start >= cache_map[i].end)
                         continue;
-               if (start < cache_map[i].start)
+               if (start < cache_map[i].start) {
                         type = type_merge(type, mtrr_state.def_type, uniform);
+                       start = cache_map[i].start;
+                       if (end <= start)
+                               break;
+               }
                 type = type_merge(type, cache_map[i].type, uniform);

                 start = cache_map[i].end;


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3099 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)