Commit 6e06780a authored Sep 28, 2015 by Ashok Raj Committed by Ingo Molnar Sep 28, 2015

x86/mce: Don't clear shared banks on Intel when offlining CPUs



It is not safe to clear global MCi_CTL banks during CPU offline
or suspend/resume operations. These MSRs are either
thread-scoped (meaning private to a thread), or core-scoped
(private to threads in that core only), or with a socket scope:
visible and controllable from all threads in the socket.

When we offline a single CPU, clearing those MCi_CTL bits will
stop signaling for all the shared, i.e., socket-wide resources,
such as LLC, iMC, etc.

In addition, it might be possible to compromise the integrity of
an Intel Secure Guard eXtentions (SGX) system if the attacker
has control of the host system and is able to inject errors
which would be otherwise ignored when MCi_CTL bits are cleared.

Hence on SGX enabled systems, if MCi_CTL is cleared, SGX gets
disabled.

Tested-by: Serge Ayoun <serge.ayoun@intel.com>
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
[ Cleanup text. ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1441391390-16985-1-git-send-email-ashok.raj@intel.com


Signed-off-by: Ingo Molnar <mingo@kernel.org>

parent 097f70b3

arch/x86/kernel/cpu/mcheck/mce.c

+20 −10

Original line number	Diff line number	Diff line
		@@ -2042,7 +2042,7 @@ int __init mcheck_init(void)
		* Disable machine checks on suspend and shutdown. We can't really handle
		* them later.
		*/
		static int mce_disable_error_reporting(void)
		static void mce_disable_error_reporting(void)
		{
		int i;

		@@ -2052,17 +2052,32 @@ static int mce_disable_error_reporting(void)
		if (b->init)
		wrmsrl(MSR_IA32_MCx_CTL(i), 0);
		}
		return 0;
		return;
		}

		static void vendor_disable_error_reporting(void)
		{
		/*
		* Don't clear on Intel CPUs. Some of these MSRs are socket-wide.
		* Disabling them for just a single offlined CPU is bad, since it will
		* inhibit reporting for all shared resources on the socket like the
		* last level cache (LLC), the integrated memory controller (iMC), etc.
		*/
		if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
		return;

		mce_disable_error_reporting();
		}

		static int mce_syscore_suspend(void)
		{
		return mce_disable_error_reporting();
		vendor_disable_error_reporting();
		return 0;
		}

		static void mce_syscore_shutdown(void)
		{
		mce_disable_error_reporting();
		vendor_disable_error_reporting();
		}

		/*
		@@ -2342,19 +2357,14 @@ static void mce_device_remove(unsigned int cpu)
		static void mce_disable_cpu(void *h)
		{
		unsigned long action = (unsigned long )h;
		int i;

		if (!mce_available(raw_cpu_ptr(&cpu_info)))
		return;

		if (!(action & CPU_TASKS_FROZEN))
		cmci_clear();
		for (i = 0; i < mca_cfg.banks; i++) {
		struct mce_bank *b = &mce_banks[i];

		if (b->init)
		wrmsrl(MSR_IA32_MCx_CTL(i), 0);
		}
		vendor_disable_error_reporting();
		}

		static void mce_reenable_cpu(void *h)

Admin message