Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753902AbeAMUpw (ORCPT + 1 other); Sat, 13 Jan 2018 15:45:52 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:36970 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751372AbeAMUpv (ORCPT ); Sat, 13 Jan 2018 15:45:51 -0500 Date: Sat, 13 Jan 2018 21:45:25 +0100 (CET) From: Thomas Gleixner To: Andy Lutomirski cc: Willy Tarreau , Peter Zijlstra , Borislav Petkov , Laura Abbott , X86 ML , Linux Kernel Mailing List , stable Subject: Re: Yet another KPTI regression with 4.14.x series in a VM In-Reply-To: Message-ID: References: <9eb15489-da09-7a4c-0700-7b6eb99e6f7b@redhat.com> <20180113063320.GC16821@1wt.eu> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Sat, 13 Jan 2018, Andy Lutomirski wrote: > Trying to inventory this stuff scattered all over the place: > > #define PTI_PGTABLE_SWITCH_BIT PAGE_SHIFT > #define PTI_SWITCH_PGTABLES_MASK (1< # define X86_CR3_PTI_SWITCH_BIT 11 > #define PTI_SWITCH_MASK > (PTI_SWITCH_PGTABLES_MASK|(1< > Blech. I wouldn't be terribly surprised if I missed a few as well. How about: > > PTI_USER_PGTABLE_BIT = PAGE_SHIFT > PTI_USER_PGTABLE_MASK = 1 << PTI_USER_PGTABLE_BIT > PTI_USER_PCID_BIT = 11 > PTI_USER_PCID_MASK = 1 << PTI_USER_PCID_BIT > PTI_USER_PGTABLE_AND_PCID_MASK = PTI_USER_PCID_MASK | PTI_USER_PGTABLE_MASK > > This naming would make the apparently buggy code look fishy, as it > should. I will give this a shot some time soon if no one beats me to > it. Well, the thing we tripped over is that we trusted the SDM that bit 11 is ignored. Seems its not and the AMD APM says that reserved bit should be cleared. Next time I surely stare into both.... So something like the below should make it clear. I've not done the alternatives thing yet... Thanks, tglx 8<------------------- --- a/arch/x86/entry/calling.h +++ b/arch/x86/entry/calling.h @@ -198,8 +198,11 @@ For 32-bit we have the following convent * PAGE_TABLE_ISOLATION PGDs are 8k. Flip bit 12 to switch between the two * halves: */ -#define PTI_SWITCH_PGTABLES_MASK (1<= (1 << X86_CR3_PTI_SWITCH_BIT)); + BUILD_BUG_ON(TLB_NR_DYN_ASIDS >= (1 << X86_CR3_PTI_PCID_USER_BIT)); /* * The ASID being passed in here should have respected the * MAX_ASID_AVAILABLE and thus never have the switch bit set. */ - VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_SWITCH_BIT)); + VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_PCID_USER_BIT)); #endif /* * The dynamically-assigned ASIDs that get passed in are small @@ -112,7 +112,7 @@ static inline u16 user_pcid(u16 asid) { u16 ret = kern_pcid(asid); #ifdef CONFIG_PAGE_TABLE_ISOLATION - ret |= 1 << X86_CR3_PTI_SWITCH_BIT; + ret |= 1 << X86_CR3_PTI_PCID_USER_BIT; #endif return ret; }