Re: VIA C3 backdoor

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 10/08/2018 à 16:15, coypu%sdf.org@localhost a écrit :
> Anyone watching this?
> https://github.com/xoreaxeaxeax/rosenbridge
> Looks like we'll want to disable ALTINST on VIA CPUs if it happens to be
> on already.
> [...]
> Index: x86/identcpu.c
> ===================================================================
> RCS file: /cvsroot/src/sys/arch/x86/x86/identcpu.c,v
> retrieving revision 1.79
> diff -u -r1.79 identcpu.c
> --- x86/identcpu.c	4 Jul 2018 07:55:57 -0000	1.79
> +++ x86/identcpu.c	10 Aug 2018 14:08:05 -0000
> @@ -601,10 +601,13 @@
>   			msr = rdmsr(MSR_VIA_ACE);
>   			wrmsr(MSR_VIA_ACE, msr | MSR_VIA_ACE_ENABLE);
>   		    }
> -
>   		}
>   	}
>
> +	/* Disable unsafe ALTINST mode if it's accidentally on */
> +	msr = rdmsr(MSR_VIA_ACE);
> +	wrmsr(MSR_VIA_ACE, msr & ~MSR_VIA_ACE_ALTINST);
> +
>   	/*
>   	 * Determine L1 cache/TLB info.
>   	 */

I would put a check around it, like this:

+	if (ci->ci_feat_val[4] & CPUID_VIA_DO_ACE) {
+		/* Disable unsafe ALTINST mode. */
+		msr = rdmsr(MSR_VIA_ACE);
+		wrmsr(MSR_VIA_ACE, msr & ~VIA_ACE_ALTINST);
+	}

To be sure the rdmsr won't fault. Will probably commit soon, likely without
testing either.