linux-kernel - Re: 2f47e7e19f ("x86/mm/kaiser: Use PCID feature to make user and .."): WARNING: CPU: 0 PID: 1 at mm/early_ioremap.c:114 __early

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9f73a515-ce07-c833-4e6b-2062fe03f354@linux.intel.com>
Date:   Mon, 27 Nov 2017 17:22:02 -0800
From:   Dave Hansen <dave.hansen@...ux.intel.com>
To:     "Rafael J. Wysocki" <rafael@...nel.org>
Cc:     Ingo Molnar <mingo@...nel.org>,
        kernel test robot <fengguang.wu@...el.com>, LKP <lkp@...org>,
        kvm@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>, wfg@...ux.intel.com,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
        "Brown, Len" <len.brown@...el.com>,
        Jesse Barnes <jbarnes@...tuousgeek.org>,
        Bjorn Helgaas <bhelgaas@...gle.com>
Subject: Re: 2f47e7e19f ("x86/mm/kaiser: Use PCID feature to make user and
 .."): WARNING: CPU: 0 PID: 1 at mm/early_ioremap.c:114 __early_ioremap

I think I narrowed this down.

__native_flush_tlb_single() depends on cpu_tlbstate.loaded_mm_asid
matching what is in CR3.  But, while we are still "early" in boot, CR3
has hardware ASID=0, but cpu_tlbstate.loaded_mm_asid=0 which is actually
hardware ASID=1.

So, we have ASID=0 in CR3 and we try to *flush* ASID=1 with INVPCID,
which does nothing for us, effectively missing the TLB flush.

I think we need to steer __native_flush_tlb_single() into the
"!this_cpu_has(X86_FEATURE_INVPCID_SINGLE)" path if we get called before
initialize_tlbstate_and_flush() gives us a "real" ASID in CR3, but I
haven't found a nice way to do it, yet.

We probably also need a debugging warning in there to read CR3 and check
it against cpu_tlbstate.loaded_mm_asid.  I'll look at this in some more
detail tomorrow if nobody beats me to it.