Re: [tip:x86/platform] x86/intel/quark: Switch off CR4.PGE so TLB flush uses CR3 instead

From: H. Peter Anvin
Date: Wed Sep 24 2014 - 11:53:25 EST

On 09/24/2014 08:01 AM, tip-bot for Bryan O'Donoghue wrote:
Commit-ID: ee1b5b165c0a2f04d2107e634e51f05d0eb107de
Author: Bryan O'Donoghue <pure.logic@xxxxxxxxxxxxxxxxx>
AuthorDate: Wed, 24 Sep 2014 00:26:24 +0100
Committer: Ingo Molnar <mingo@xxxxxxxxxx>
CommitDate: Wed, 24 Sep 2014 15:06:15 +0200

x86/intel/quark: Switch off CR4.PGE so TLB flush uses CR3 instead

Quark x1000 advertises PGE via the standard CPUID method
PGE bits exist in Quark X1000's PTEs. In order to flush
an individual PTE it is necessary to reload CR3 irrespective
of the PTE.PGE bit.

See Quark Core_DevMan_001.pdf section 6.4.11

This bug was fixed in Galileo kernels, unfixed vanilla kernels are expected to
crash and burn on this platform.

Signed-off-by: Bryan O'Donoghue <pure.logic@xxxxxxxxxxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
arch/x86/kernel/cpu/intel.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)

diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 74e804d..50ce751 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -144,6 +144,21 @@ static void early_init_intel(struct cpuinfo_x86 *c)
+ /*
+ * Intel Quark Core DevMan_001.pdf section 6.4.11
+ * "The operating system also is required to invalidate (i.e., flush)
+ * the TLB when any changes are made to any of the page table entries.
+ * The operating system must reload CR3 to cause the TLB to be flushed"
+ *
+ * As a result cpu_has_pge() in arch/x86/include/asm/tlbflush.h should
+ * be false so that __flush_tlb_all() causes CR3 insted of CR4.PGE
+ * to be modified
+ */
+ if (c->x86 == 5 && c->x86_model == 9) {
+ pr_info("Disabling PGE capability bit\n");
+ setup_clear_cpu_cap(X86_FEATURE_PGE);
+ }

#ifdef CONFIG_X86_32

I believe there is one more change needed: there is a __flush_tlb_all() in the early code which gets executed before the above code runs; the easiest fix is to just add a __flush_tlb() immediately after it.

This should have been pushed upstream, and not stayed in the BSP kernel.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at