From: Herbert Xu <herbert@gondor.apana.org.au>
To: Borislav Petkov <bp@alien8.de>
Cc: Jain@formenos.rohan.me.apana.org.au, Ayush <Ayush.Jain3@amd.com>,
Stephen Rothwell <sfr@canb.auug.org.au>, x86-ml <x86@kernel.org>,
lkml <linux-kernel@vger.kernel.org>,
linux-crypto@vger.kernel.org, Eric Biggers <ebiggers@google.com>
Subject: Re: cryptodev linux-next splat
Date: Fri, 16 May 2025 19:34:06 +0800 [thread overview]
Message-ID: <aCcirrsFFrrRqf5A@gondor.apana.org.au> (raw)
In-Reply-To: <20250516112217.GBaCcf6Yoc6LkIIryP@fat_crate.local>
On Fri, May 16, 2025 at 01:22:17PM +0200, Borislav Petkov wrote:
> Hi Herbert,
>
> one of our linux-next tests which hotplugs a CPU fails with the below splat.
>
> Reproducing is very easy:
>
> # echo 0 > /sys/devices/system/cpu/cpu1/online
> # echo 1 > /sys/devices/system/cpu/cpu1/online
>
> Opcode bytes point to:
>
> 02:06:54 [ 3199.416779] Code: 65 c6 05 9a c8 ad 02 01 f7 47 2c 00 40 20 00 74 4f 65 48 c7 05 95 c8 ad 02 00 00 00 00 f6 c3 02 74 0d c7 44 24 04 80 1f 00 00 <0f> ae 54 24 04 83 e3 01 75 47 48 8b 44 24 08 65 48 2b 05 49 97 ad
> All code
> ========
> 0: 65 c6 05 9a c8 ad 02 movb $0x1,%gs:0x2adc89a(%rip) # 0x2adc8a2
> 7: 01
> 8: f7 47 2c 00 40 20 00 testl $0x204000,0x2c(%rdi)
> f: 74 4f je 0x60
> 11: 65 48 c7 05 95 c8 ad movq $0x0,%gs:0x2adc895(%rip) # 0x2adc8b2
> 18: 02 00 00 00 00
> 1d: f6 c3 02 test $0x2,%bl
> 20: 74 0d je 0x2f
> 22: c7 44 24 04 80 1f 00 movl $0x1f80,0x4(%rsp)
> 29: 00
> 2a:* 0f ae 54 24 04 ldmxcsr 0x4(%rsp) <-- trapping instruction
> 2f: 83 e3 01 and $0x1,%ebx
> 32: 75 47 jne 0x7b
> 34: 48 8b 44 24 08 mov 0x8(%rsp),%rax
> 39: 65 gs
> 3a: 48 rex.W
> 3b: 2b .byte 0x2b
> 3c: 05 .byte 0x5
> 3d: 49 97 xchg %rax,%r15
> 3f: ad lods %ds:(%rsi),%eax
>
> Code starting with the faulting instruction
> ===========================================
> 0: 0f ae 54 24 04 ldmxcsr 0x4(%rsp)
> 5: 83 e3 01 and $0x1,%ebx
> 8: 75 47 jne 0x51
> a: 48 8b 44 24 08 mov 0x8(%rsp),%rax
> f: 65 gs
> 10: 48 rex.W
> 11: 2b .byte 0x2b
> 12: 05 .byte 0x5
> 13: 49 97 xchg %rax,%r15
> 15: ad lods %ds:(%rsi),%eax
>
> And LDMXCSR would #UD for a bunch of conditions.
>
> Reverting cryptodev from linux-next next-20250515 this way:
>
> $ git revert -m 1 ed18a632e45785e3392cf96b9683ca033a74b1f8
>
> fixes the issue so I'm thinking it must be one of the patches you guys have
> there.
>
> Ideas?
Yes probably.
So what's happened is that previously if you call sha256_update
from lib/crypto it would only use the generic C code to perform
the operation.
This has now been changed to automatically use SIMD instructions
which obviously blew up in your case.
Eric, can you please take a look at this crash? It looks like
crypto_simd_usable returned true, but kernel_fpu_begin still
crashed for some reason. One of them must be wrong :)
Thanks,
> 02:05:36 [ 3129.220448] systemd[1]: systemd-timedated.service: Deactivated successfully.
> 02:05:36 [ 3129.252398] systemd[1]: systemd-hostnamed.service: Deactivated successfully.
> 02:06:54 [ 3199.347946] smpboot: CPU 1 is now offline
> 02:06:54 [ 3199.375693] smpboot: Booting Node 0 Processor 1 APIC 0x2
> 02:06:54 [ 3199.381723] Oops: invalid opcode: 0000 [#1] SMP NOPTI
> 02:06:54 [ 3199.387364] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted 6.15.0-rc6-next-20250515-484803582c77-1747374910702 #1 PREEMPT(voluntary)
> 02:06:54 [ 3199.402308] Hardware name: AMD Corporation Cinnabar/Cinnabar, BIOS RCB100DB 08/09/2024
> 02:06:54 [ 3199.411140] RIP: 0010:kernel_fpu_begin_mask+0x58/0xc0
> 02:06:54 [ 3199.416779] Code: 65 c6 05 9a c8 ad 02 01 f7 47 2c 00 40 20 00 74 4f 65 48 c7 05 95 c8 ad 02 00 00 00 00 f6 c3 02 74 0d c7 44 24 04 80 1f 00 00 <0f> ae 54 24 04 83 e3 01 75 47 48 8b 44 24 08 65 48 2b 05 49 97 ad
> 02:06:54 [ 3199.437736] RSP: 0000:ff3a2270c019fd98 EFLAGS: 00010002
> 02:06:54 [ 3199.443568] RAX: 0000000000000046 RBX: 0000000000000002 RCX: 0000000000000000
> 02:06:54 [ 3199.451528] RDX: 0000000000000057 RSI: ff380c5800eba000 RDI: ff380c5800eec280
> 02:06:54 [ 3199.459487] RBP: ff3a2270c019fe30 R08: 0000000000000000 R09: ff380c8684245078
> 02:06:54 [ 3199.467446] R10: 0000000000000000 R11: 0000000000000000 R12: ff380c5800eba000
> 02:06:54 [ 3199.475405] R13: 0000000000000057 R14: 00000000000015c0 R15: 00000000000015c0
> 02:06:54 [ 3199.483364] FS: 0000000000000000(0000) GS:ff380c86d4935000(0000) knlGS:0000000000000000
> 02:06:54 [ 3199.492391] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> 02:06:54 [ 3199.498801] CR2: 0000000000000000 CR3: 000000304b82a000 CR4: 00000000003318b0
> 02:06:54 [ 3199.506761] Call Trace:
> 02:06:54 [ 3199.509487] <TASK>
> 02:06:54 [ 3199.511825] sha256_blocks_simd+0x23/0x50
> 02:06:54 [ 3199.516303] sha256_update+0x73/0x100
> 02:06:54 [ 3199.520381] sha256+0x70/0xa0
> 02:06:54 [ 3199.523690] ? __smp_call_single_queue+0xb0/0x120
> 02:06:54 [ 3199.528939] ? srso_alias_return_thunk+0x5/0xfbef5
> 02:06:54 [ 3199.534285] ? bsearch+0x57/0x90
> 02:06:54 [ 3199.537884] ? __pfx_cmp_id+0x10/0x10
> 02:06:54 [ 3199.541968] __apply_microcode_amd+0xf1/0x1c0
> 02:06:54 [ 3199.546827] ? srso_alias_return_thunk+0x5/0xfbef5
> 02:06:54 [ 3199.552169] ? srso_alias_return_thunk+0x5/0xfbef5
> 02:06:54 [ 3199.557511] ? cpu_init_exception_handling+0x1fe/0x2c0
> 02:06:54 [ 3199.563241] ? srso_alias_return_thunk+0x5/0xfbef5
> 02:06:54 [ 3199.568584] apply_microcode_amd+0xca/0x110
> 02:06:54 [ 3199.573251] start_secondary+0x24/0x140
> 02:06:54 [ 3199.577531] ? srso_alias_return_thunk+0x5/0xfbef5
> 02:06:54 [ 3199.582872] common_startup_64+0x13e/0x141
> 02:06:54 [ 3199.587446] </TASK>
> 02:06:54 [ 3199.589877] Modules linked in: iscsi_target_mod target_core_mod binfmt_misc xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nft_compat nf_nat_tftp nf_conntrack_tftp overlay snd_seq_dummy snd_hrtimer snd_seq snd_seq_device snd_timer snd soundcore nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables nfnetlink sunrpc vfat fat amd_atl intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd kvm_amd ipmi_ssif kvm mlx5_ib irqbypass cdc_ether ib_uverbs usbnet rapl mii wmi_bmof pcspkr dax_hmem acpi_cpufreq ib_core acpi_ipmi i2c_piix4 k10temp i2c_smbus ipmi_si ipmi_devintf ipmi_msghandler i2c_designware_platform i2c_designware_core sch_fq_codel xfs ast drm_client_lib i2c_algo_bit drm_shmem_helper mlx5_core ahci drm_kms_helper libahci mlxfw tls nvme ghash_clmulni_intel sha512_ssse3 drm tg3 psample pci_hyperv_intf libata ccp nvme_core sp5100_tco wmi dm_mirror dm_region_hash dm_log
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
next prev parent reply other threads:[~2025-05-16 11:34 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-16 11:22 cryptodev linux-next splat Borislav Petkov
2025-05-16 11:34 ` Herbert Xu [this message]
2025-05-16 11:48 ` [PATCH] crypto: lib/sha256 - Disable SIMD Herbert Xu
2025-05-16 12:27 ` Borislav Petkov
2025-05-16 17:03 ` Eric Biggers
2025-05-16 18:13 ` Borislav Petkov
2025-05-16 19:06 ` Eric Biggers
2025-05-16 20:34 ` Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aCcirrsFFrrRqf5A@gondor.apana.org.au \
--to=herbert@gondor.apana.org.au \
--cc=Ayush.Jain3@amd.com \
--cc=Jain@formenos.rohan.me.apana.org.au \
--cc=bp@alien8.de \
--cc=ebiggers@google.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sfr@canb.auug.org.au \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox