Re: [PATCH v6 00/16] x86/mtrr: fix handling with PAT but without MTRR

Juergen Gross
2023-05-10T15:53:24Z

[-- Attachment #1.1.1: Type: text/plain, Size: 2699 bytes --]

On 10.05.23 15:30, Borislav Petkov wrote:
> On Wed, May 10, 2023 at 01:36:41AM +0200, Borislav Petkov wrote:
>> More staring at this tomorrow, on a clear head.
>
> Yeah, I'm going to leave it as is. Tried doing a union with bitfields
> but doesn't get any prettier.
>
> Next crapola:
>
> The Intel box says now:
>
> [ 8.138683] sgx: EPC section 0x80200000-0x85ffffff
> [ 8.204838] pmd_set_huge: Cannot satisfy [mem 0x80200000-0x80400000] with a huge-page mapping due to MTRR override, uniform: 0
>
> (I've extended the debug output).
>
> and that happens because
>
> [ 8.174229] mtrr_type_lookup: mtrr_state_set: 1
> [ 8.178909] mtrr_type_lookup: start: 0x80200000, cache_map[3].start: 0x88800000
>
> that's
>
> if (start < cache_map[i].start) {
>
> in mtrr_type_lookup(). I fail to see how that check would work for the
> range 0x80200000-0x80400000 and the MTRR map is:
>
> [ 0.000587] MTRR map: 4 entries (3 fixed + 1 variable; max 23), built from 10 variable MTRRs
> [ 0.000588] 0: 0000000000000000-000000000009ffff write-back
> [ 0.000589] 1: 00000000000a0000-00000000000bffff uncachable
> [ 0.000590] 2: 00000000000c0000-00000000000fffff write-protect
> [ 0.000591] 3: 0000000088800000-00000000ffffffff uncachable
>
> so the UC range comes after this one we request.
>
> [ 8.186372] mtrr_type_lookup: type: 0x6, cache_map[3].type: 0x0
>
> now the next type merging happens and the 3rd region's type is UC, ofc.
>
> [ 8.192433] type_merge: type: 0x6, new_type: 0x0, effective_type: 0x0, clear uniform
>
> we clear uniform and we fail:
>
> [ 8.200331] mtrr_type_lookup: ret, uniform: 0
>
> So this map lookup thing is wrong in this case.
>

Urgh, yes, there is something missing:

diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index 031f7ea8e72b..9544e7d13bb3 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -521,8 +521,12 @@ u8 mtrr_type_lookup(u64 start, u64 end, u8 *uniform)
for (i = 0; i < cache_map_n && start < end; i++) {
if (start >= cache_map[i].end)
continue;
- if (start < cache_map[i].start)
+ if (start < cache_map[i].start) {
type = type_merge(type, mtrr_state.def_type, uniform);
+ start = cache_map[i].start;
+ if (end <= start)
+ break;
+ }
type = type_merge(type, cache_map[i].type, uniform);

start = cache_map[i].end;

Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3149 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]