[PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[Colin King]

From: Colin Ian King <colin.king@canonical.com>

BugLink: https://bugs.launchpad.net/bugs/523112
BugLink: https://bugs.launchpad.net/bugs/322867

This patch addresses Intel errata AAE44 by totally disabling 4MB
pages and thus avoiding avoiding large pages being split into
smaller 4K pages and thus never tripping this CPU issue.

The bug can manifests itself as instruction fetch oopses on seemingly
legitimate executable pages.

Errata AAE44 (http://download.intel.com/design/processor/specupdt/319536.pdf
page 33) states:

"If software clears the PS (page size) bit in a present PDE (page directory
entry), that will cause linear addresses mapped through this PDE to use
4-KByte pages instead of using a large page after old TLB entries are
invalidated. Due to this erratum, if a code fetch uses this PDE before the
TLB entry for the large page is invalidated then it may fetch from a different
physical address than specified by either the old large page translation or
the new 4-KByte page translation. This erratum may also cause speculative code
fetches from incorrect addresses."

Where as commit 211b3d03c7400f48a781977a50104c9d12f4e229 seems to workaround
errata AAH41 (mixed 4K TLBs) it reduces the window of opportunity for the
bug to occur and does not totally remove it.  This patch disables mixed
4K/4MB page tables totally avoiding the page splitting and not tripping
this processor issue.

Without this workaround, one particular Z530 system with a lot of
filesystem activity and low memory pressure would panic randomly after
a few days soak testing. With this patch, the system ran flawlessly.

Also, this fixes random boot crashes on an Acer Asprire One.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 arch/x86/kernel/cpu/bugs.c |   15 +++++++++++++++
 1 files changed, 15 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 01a2652..32e49f3 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -151,6 +151,20 @@ static void __init check_config(void)
 #endif
 }
 
+static void __init check_atom(void)
+{
+
+	/*
+	 *  Disable 4MB page tables to work around Intel errata AAE44 for
+	 *  Atom. We cannot guarantee stopping undefined processor behaviour
+	 *  when two pageing structure translations differ with respect to
+	 *  page frame sizes.  Hence, for Atoms we disable the PSE.
+	 */
+	if (boot_cpu_data.x86_model == 0x1c) {
+		clear_bit(X86_FEATURE_PSE, boot_cpu_data.x86_capability);
+		printk(KERN_INFO "Disabling 4MB page tables to avoid TLB bug\n");
+	}
+}
 
 void __init check_bugs(void)
 {
@@ -163,6 +177,7 @@ void __init check_bugs(void)
 	check_fpu();
 	check_hlt();
 	check_popad();
+	check_atom();
 	init_utsname()->machine[1] =
 		'0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
 	alternative_instructions();
-- 
1.6.3.3

Re: [PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[Jeremy Fitzhardinge]

On 03/22/2010 08:20 AM, Colin King wrote:
> "If software clears the PS (page size) bit in a present PDE (page directory
> entry), that will cause linear addresses mapped through this PDE to use
> 4-KByte pages instead of using a large page after old TLB entries are
> invalidated. Due to this erratum, if a code fetch uses this PDE before the
> TLB entry for the large page is invalidated then it may fetch from a different
> physical address than specified by either the old large page translation or
> the new 4-KByte page translation. This erratum may also cause speculative code
> fetches from incorrect addresses."
>    

Does this only affect non-PAE 32-bit?  Or does it also affect 3 and 4 
level pagetables with 2MB large pages?

     J

Re: [PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[Andi Kleen]

Colin King <colin.king@canonical.com> writes:
>  
> +static void __init check_atom(void)
> +{
> +
> +	/*
> +	 *  Disable 4MB page tables to work around Intel errata AAE44 for
> +	 *  Atom. We cannot guarantee stopping undefined processor behaviour
> +	 *  when two pageing structure translations differ with respect to
> +	 *  page frame sizes.  Hence, for Atoms we disable the PSE.
> +	 */
> +	if (boot_cpu_data.x86_model == 0x1c) {

Perhaps someone else pointed that out already, but you obviously
need to check for x86_vendor == X86_VENDOR_INTEL and x86_family == 6 too,
otherwise you'll get false positives.

Besides such workarounds are normally in arch/x86/kernel/cpu/intel.c.
bugs.c is really obsolete.

-Andi

-- 
ak@linux.intel.com -- Speaking for myself only.

Re: [PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[H. Peter Anvin]

On 04/12/2010 01:02 AM, Andi Kleen wrote:
> Colin King <colin.king@canonical.com> writes:
>>  
>> +static void __init check_atom(void)
>> +{
>> +
>> +	/*
>> +	 *  Disable 4MB page tables to work around Intel errata AAE44 for
>> +	 *  Atom. We cannot guarantee stopping undefined processor behaviour
>> +	 *  when two pageing structure translations differ with respect to
>> +	 *  page frame sizes.  Hence, for Atoms we disable the PSE.
>> +	 */
>> +	if (boot_cpu_data.x86_model == 0x1c) {
> 
> Perhaps someone else pointed that out already, but you obviously
> need to check for x86_vendor == X86_VENDOR_INTEL and x86_family == 6 too,
> otherwise you'll get false positives.
> 
> Besides such workarounds are normally in arch/x86/kernel/cpu/intel.c.
> bugs.c is really obsolete.
> 

Much more than that, the constraint is clearly not strict enough.  I'm
currently trying to work out internally what the actual constraint
should be (it's a bit of a documentation hole at the moment.)

	-hpa

[tip:x86/urgent] x86: Disable large pages on CPUs with Atom erratum AAE44

[tip-bot for H. Peter Anvin]

Commit-ID:  7a0fc404ae663776e96db43879a0fa24fec1fa3a
Gitweb:     http://git.kernel.org/tip/7a0fc404ae663776e96db43879a0fa24fec1fa3a
Author:     H. Peter Anvin <hpa@linux.intel.com>
AuthorDate: Tue, 13 Apr 2010 14:40:54 -0700
Committer:  H. Peter Anvin <hpa@zytor.com>
CommitDate: Fri, 23 Apr 2010 16:49:51 -0700

x86: Disable large pages on CPUs with Atom erratum AAE44

Atom erratum AAE44/AAF40/AAG38/AAH41:

"If software clears the PS (page size) bit in a present PDE (page
directory entry), that will cause linear addresses mapped through this
PDE to use 4-KByte pages instead of using a large page after old TLB
entries are invalidated. Due to this erratum, if a code fetch uses
this PDE before the TLB entry for the large page is invalidated then
it may fetch from a different physical address than specified by
either the old large page translation or the new 4-KByte page
translation. This erratum may also cause speculative code fetches from
incorrect addresses."

[http://download.intel.com/design/processor/specupdt/319536.pdf]

Where as commit 211b3d03c7400f48a781977a50104c9d12f4e229 seems to
workaround errata AAH41 (mixed 4K TLBs) it reduces the window of
opportunity for the bug to occur and does not totally remove it.  This
patch disables mixed 4K/4MB page tables totally avoiding the page
splitting and not tripping this processor issue.

This is based on an original patch by Colin King.

Originally-by: Colin Ian King <colin.king@canonical.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
LKML-Reference: <1269271251-19775-1-git-send-email-colin.king@canonical.com>
Cc: <stable@kernel.org>
---
 arch/x86/kernel/cpu/intel.c |   21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 7e1cca1..1366c7c 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
 		(c->x86 == 0x6 && c->x86_model >= 0x0e))
 		set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
 
+	/*
+	 * Atom erratum AAE44/AAF40/AAG38/AAH41:
+	 *
+	 * A race condition between speculative fetches and invalidating
+	 * a large page.  This is worked around in microcode, but we
+	 * need the microcode to have already been loaded... so if it is
+	 * not, recommend a BIOS update and disable large pages.
+	 */
+	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) {
+		u32 ucode, junk;
+
+		wrmsr(MSR_IA32_UCODE_REV, 0, 0);
+		sync_core();
+		rdmsr(MSR_IA32_UCODE_REV, junk, ucode);
+
+		if (ucode < 0x20e) {
+			printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n");
+			clear_cpu_cap(c, X86_FEATURE_PSE);
+		}
+	}
+
 #ifdef CONFIG_X86_64
 	set_cpu_cap(c, X86_FEATURE_SYSENTER32);
 #else

RE: [PATCH] x86: Disable 4MB page tables for Atom, work around errata AAE44

[Yuhong Bao]

> Much more than that, the constraint is clearly not strict enough. I'm
> currently trying to work out internally what the actual constraint
> should be (it's a bit of a documentation hole at the moment.)
Yea, why does the spec updates say "It is possible for the BIOS to contain a workaround for this erratum." for issues fixed by a microcode update?
Yuhong Bao 		 	   		  
_________________________________________________________________
The New Busy is not the too busy. Combine all your e-mail accounts with Hotmail.
http://www.windowslive.com/campaign/thenewbusy?tile=multiaccount&ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_4