Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: [PATCH v2] x86/mce: Include the PPIN in machine check records when it is available
From: Tony Luck <tony.luck@gmail.com>
In-Reply-To: <20161123140521.gkjl7vnvaneef7hv@pd.tnic>
Date: Wed, 23 Nov 2016 08:42:40 -0800
Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
        "Luck, Tony" <tony.luck@intel.com>, Andi Kleen <andi@firstfloor.org>,
        Ashok Raj <ashok.raj@intel.com>, linux-kernel@vger.kernel.org
Message-Id: <6A4C8FFC-0A4E-4374-B276-DE5A751BDB72@gmail.com>
References: <878tsg67r3.fsf@tassilo.jf.intel.com> <1479491316-11716-1-git-send-email-tony.luck@intel.com> <20161123114855.njguoaygp3qnbkia@pd.tnic> <20161123132951.GA9373@khazad-dum.debian.net> <20161123133723.vyi7bv46h3pulldc@pd.tnic> <20161123140521.gkjl7vnvaneef7hv@pd.tnic>
To: Borislav Petkov <bp@suse.de>
Sender: linux-kernel-owner@vger.kernel.org
Content-Transfer-Encoding: 8bit
Content-Length: 1840
Lines: 52

If the BIOS writes 10b, then PPIN is disabled and will remain so until the processor is reset. Bit 1 is a one way trip, it can be set by s/w, but not cleared again.

All this is because of the huge stink last time Intel tried to add a serial number to CPUs a decade and a half ago. The lockout bit is so that this can be turned off in a way that you can be sure that it can't be turned on again.

-Tony

Sent from my iPhone

> On Nov 23, 2016, at 06:05, Borislav Petkov <bp@suse.de> wrote:
> 
>> On Wed, Nov 23, 2016 at 02:37:23PM +0100, Borislav Petkov wrote:
>> You can't reenable it:
>> 
>> "LockOut (R/WO)
>> Set 1 to prevent further writes to MSR_PPIN_CTL. Writing 1 to
>> MSR_PPINCTL[bit 0] is permitted only if MSR_PPIN_CTL[bit 1] is
>> clear, Default is 0."
> 
> Well, almost.
> 
> "Enable_PPIN (R/W)
> If 1, enables MSR_PPIN to be accessible using RDMSR. Once set,
> attempt to write 1 to MSR_PPIN_CTL[bit 0] will cause #GP.
> If 0, an attempt to read MSR_PPIN will cause #GP. Default is 0."
> 
> Frankly, I don't get what the deal behind that locking out is. And it
> says that BIOS should provide an opt-in so that agent can read the PPIN
> and then that agent should *disable* it again by writing 01b to the CTL
> MSR.
> 
> But then the first paragraph above says that the write
> MSR_PPIN_CTL[0]=1b will #GP because MSR_PPIN_CTL[1] will be 1 for the
> agent to read out MSR_PPIN first.
> 
> I guess we need to write a 00b first to disable PPIN and then write 01b
> to lock it out.
> 
> So AFAIU, the steps will be:
> 
> * BIOS writes 10b
> * agent reads MSR_PPIN
> * agent writes 00b to disable MSR_PPIN
> * agent writes 01b because bit 1 is clear now and it won't #GP.
> 
> Meh...
> 
> -- 
> Regards/Gruss,
>    Boris.
> 
> SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
> --