From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753130AbbGOLHc (ORCPT ); Wed, 15 Jul 2015 07:07:32 -0400 Received: from mail-wi0-f182.google.com ([209.85.212.182]:34507 "EHLO mail-wi0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751598AbbGOLHb (ORCPT ); Wed, 15 Jul 2015 07:07:31 -0400 Date: Wed, 15 Jul 2015 13:07:26 +0200 From: Ingo Molnar To: Dave Hansen Cc: linux-kernel@vger.kernel.org, Andy Lutomirski , Borislav Petkov , Fenghua Yu , "H. Peter Anvin" , Linus Torvalds , Oleg Nesterov , Thomas Gleixner , Ross Zwisler Subject: Re: 4.2-rc2: early boot memory corruption from FPU rework Message-ID: <20150715110726.GA26611@gmail.com> References: <1430848300-27877-1-git-send-email-mingo@kernel.org> <1430848300-27877-19-git-send-email-mingo@kernel.org> <55A56709.6020201@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55A56709.6020201@linux.intel.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Dave Hansen wrote: > On 05/05/2015 10:49 AM, Ingo Molnar wrote: > > @@ -574,12 +573,10 @@ static void setup_init_fpu_buf(void) > > on_boot_cpu = 0; > > > > /* > > - * Setup init_xstate_buf to represent the init state of > > + * Setup init_xstate_ctx to represent the init state of > > * all the features managed by the xsave > > */ > > - init_xstate_buf = alloc_bootmem_align(xstate_size, > > - __alignof__(struct xsave_struct)); > > - fx_finit(&init_xstate_buf->i387); > > + fx_finit(&init_xstate_ctx.i387); > > This is causing memory corruption in 4.2-rc2. > > We do not know the size of the 'init_xstate_buf' before we boot. It's > completely enumerated in CPUID leaves but it is not static by any means. > This commit when applied (3e5e126774) tries to replace the dynamic > allocation with a static one. When we do the first 'xrstor' (in > copy_xregs_to_kernel_booting()) it overruns init_fpstate and corrupts > the next chunk of memory (which is xfeatures_mask in my case). > > I'm seeing this on a system with states not represented in > XSTATE_RESERVE (XSTATE_ZMM_Hi256 / XSTATE_OPMASK / XSTATE_Hi16_ZMM). > The systems affected are not widely available, but this is something > that we absolutely do not want to see regress. > > This bug could also occur if a future CPU decided to change the amount > of storage allocated for a given xstate feature (which would be > architecturally OK). > > According to the commit: > > > This removes the last bootmem allocation from the FPU init path, allowing > > it to be called earlier in the boot sequence. > > so we can't easily just revert this, although I'm not 100% that this is > before bootmem is availalble. > > This patch works around the problem, btw: > > https://www.sr71.net/~dave/intel/bloat-xsave-gunk-2.patch Yeah, so I got this prototype hardware boot crash reported in private mail and decoded it and after some debugging I suggested the +PAGE_SIZE hack - possibly you got that hack from the same person? My suggestion was to solve this properly: if we list xstate features as supported then we should size their max size correctly. The AVX bits are currently not properly enumerated and sized - and I refuse to add feature support to the kernel where per task CPU state fields that the kernel saves/restores are opaque... So please add proper AVX512 support structures to fpu/types.h and size XSTATE_RESERVE correctly - or alternatively we can remove the current incomplete AVX512 bits. Thanks, Ingo