Return-path: Received: from mga09.intel.com ([134.134.136.24]) by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1fDfFW-0008Nu-7m for speck@linutronix.de; Wed, 02 May 2018 02:03:58 +0200 Message-Id: Resent-Message-ID: <20180502000354.GD44477@tassilo.jf.intel.com> Resent-To: speck@linutronix.de From: Andi Kleen Date: Fri, 9 Feb 2018 10:36:15 -0800 Subject: [MODERATED] [PATCH 5/6] Patch 5 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 To: speck@linutronix.de List-ID: If the system has more than MAX_PA/2 physical memory the invert page workarounds don't protect the system against the L1TF attack anymore, because an inverted physical address will point to valid memory. We cannot do much here, after all users want to use the memory, but at least print a warning and report the system as vulnerable in sysfs Note this is all extremely unlikely to happen on a real machine because they typically have far more MAX_PA than DIMM slots Typical MAX_PA sizes on Intel and respective threshold: Nehalem Client 39 >=0.25TB Nehalem Server 44 >=8TB SandyBridge/IvyBridge/Haswell/Broadwell/Skylake 46 >=32TB Some VMs also report fairly small PAs to guest, e.g. only 36bits. In this case the threshold will be lower, but applies only to the maximum guest size. Signed-off-by: Andi Kleen --- arch/x86/kernel/setup.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index fadbd41094d2..62dbfc533b99 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -779,7 +779,27 @@ static void __init trim_low_memory_range(void) { memblock_reserve(0, ALIGN(reserve_low, PAGE_SIZE)); } - + +static __init void check_maxpa_memory(void) +{ + u64 len; + + if (!boot_cpu_has(X86_BUG_L1TF)) + return; + + len = (1ULL << (boot_cpu_data.x86_phys_bits - 1)) - 1; + + /* + * This is extremely unlikely to happen because systems near always have far + * more MAX_PA than DIMM slots. + */ + if (e820__mapped_any(len, ULLONG_MAX - len, + E820_TYPE_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. Disabled L1TF workaround\n"); + setup_force_cpu_cap(X86_FEATURE_NO_L1TF_FIX); + } +} + /* * Dump out kernel offset information on panic. */ @@ -1016,6 +1036,8 @@ void __init setup_arch(char **cmdline_p) insert_resource(&iomem_resource, &data_resource); insert_resource(&iomem_resource, &bss_resource); + check_maxpa_memory(); + e820_add_kernel_range(); trim_bios_range(); #ifdef CONFIG_X86_32 -- 2.15.0