From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 852C51DB356 for ; Tue, 9 Jun 2026 21:16:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781039785; cv=none; b=ECi7lL3lrM0RRecoZyxl+dkzzcE/lp2NBSEgW8J45MkCszokbHp86Em7WZyThza1xbLWvORIUCfuX3T4U/cV2w1wc8hwI2vMd2BSWWrqbMu3XWmwEKgiv8DrX2KBBERBEFQTTbt99mgNVoDU9g8FRQuxbEc4XF4UzZaKhRjmUMc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781039785; c=relaxed/simple; bh=PbVYV9tNQS/fN0275JKbht5E9YPBF3utMtsJHaVDheQ=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=loUQSJN7atX6wLvCtzmoCAf4jmNdtFGPuyhEqAB81m0BVno0H6mpTfHHZIMLzY7JiS5C9BLUZ00MAT6smhtBWrVH2IUDdJy6SCtbQc89CTlLJlcuB0uXWEDY0wiD6soEHqqslYvLw1nDWXMz2XmlyT5zd1lOh16wC92nl5+tXWk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--jmattson.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=hIdO5qK3; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jmattson.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="hIdO5qK3" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2c0c272e532so61466645ad.1 for ; Tue, 09 Jun 2026 14:16:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781039784; x=1781644584; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=Ni+RjYHvu40WZo8rGbDKIk14/Uq95fdiNqSQnV6vmbM=; b=hIdO5qK3/w31iSp8P+yX/kiqB+R71yvkS3gkybKxdrYt43urTptHEae9F8ru6rT3ud cHbiv0mBbwzrl6pbz837TM4ZXeAFw2BJXfNdzex4YjhFvQFGrvDUBoRfnLp8k5fqoBEX FggJ+L8svbsGOQ2G+xmg5vBNEbVhX2CNaeCaosB+BCmCe0/vQ8hURBr6M4bUKFbcJXeq fyNw/6S/Az+UyLtIhXE9/ZJJx9me3xvhEFmqBe1usTbRDZTaGFoP5dcNG3D/LwogwSQo PJYOCVby261FhyBrMDvCUJv8NCMZoiFahd+TIO/qTsurgN5D0+4UN7+0fAu9VGu+WCxH h1Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781039784; x=1781644584; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=Ni+RjYHvu40WZo8rGbDKIk14/Uq95fdiNqSQnV6vmbM=; b=Mgpvqc+SHCmoF/4Z6eMnTpQRz0lu12yBW9m1D5odvGnmyBF5/T4y4YKro5OEsEVvul 5uqF0Ko3YMxTYv9+XQGTpKKnqPNTy4URBjCgBofZGBQogyBFBcPl0CznRq1Po5QYll3y cHu1giuKORw+oBJiOT9U8I4pnq1ec3oyylAi31UfijouIuyLfTMOBFWFs/DisnP3rCsi DIYN/LDU3T6C1tIBW7GTrP++lxJajFj+ipKbDZZ9yPvZLYUt7v1UatEqVJr1uMLrIFQn AG21pJeXzbW6NQ15Q00UCuBMW+3vE9St99W6CU6DwW1+3emgj+vGlw/9LtSJv3ysTIct tVog== X-Forwarded-Encrypted: i=1; AFNElJ+8nVXbAoasgLKigsezGFMDCe56z9n7pqZBI4MG7Ez81ZBBlOlB9+WSjw8PK6qER/pUI3pagtX69okbKFg=@vger.kernel.org X-Gm-Message-State: AOJu0Yx2jXQDuQJXdQIky3cAhtiRSpUjLJdGa7tQCDEB27Xz6zQwXgUd rpf2dLmiEfe7uEg7LhO6Fw0oYMwBtaxOIo9qz4/ya6aZ5Cqs5/cCJ6gcFUmxPB1E1yzGpYk+mAe Ut6UvELZtmiLNFA== X-Received: from plbkv13.prod.google.com ([2002:a17:903:28cd:b0:2b2:41fc:ea6e]) (user=jmattson job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:4b46:b0:2b2:5314:e96a with SMTP id d9443c01a7336-2c1e80fc534mr251693485ad.34.1781039783427; Tue, 09 Jun 2026 14:16:23 -0700 (PDT) Date: Tue, 9 Jun 2026 14:15:46 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.54.0.1099.g489fc7bff1-goog Message-ID: <20260609211611.466231-1-jmattson@google.com> Subject: [PATCH 0/1] Fix an HWCR RMW race From: Jim Mattson To: Borislav Petkov , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org, yosry@kernel.org Cc: Jim Mattson Content-Type: text/plain; charset="UTF-8" I was backporting commit 65f55a301766 ("x86/CPU/AMD: Add CPUID faulting support") to a local branch based on Linux v6.12, when our internal Sashiko asked: > Can this corrupt MSR_K7_HWCR? disable_cpuid()->set_cpuid_faulting() is > called with preemption disabled, but interrupts are still enabled. Since > msr_set_bit() performs a read-modify-write without disabling interrupts, > if an IPI arrives between the read and write and modifies MSR_K7_HWCR > (e.g. acpi-cpufreq toggling Core Performance Boost), the IPI's update > will be lost. To confirm that this wasn't just AI slop, I set up an empirical test on a Turin system. First, I replaced the amd-pstate cpufreq driver with acpi-cpufreq. Then I ran a test program, where one thread repeatedly reads CPU0's HWCR, toggles /sys/devices/system/cpu/cpufreq/boost, reads CPU0's HWCR again, and then verifies that the CPB_DIS bit has flipped. A second thread, pinned to CPU0, repeatedly calls arch_prctl(ARCH_SET_CPUID, ), where alternates between 0 and 1. With the second thread running, the first thread soon fails the verification step, indicating that the CPB_DIS bit change is, in fact, lost. Jim Mattson (1): x86/CPU/AMD: Avoid racy updates to MSR_K7_HWCR in set_cpuid_faulting() arch/x86/kernel/process.c | 4 ++++ 1 file changed, 4 insertions(+) base-commit: 2d3090a8aeb596a26935db0955d46c9a5db5c6ce -- 2.54.0.1099.g489fc7bff1-goog