x86: fix app crashes after SMP resume (61165d7a) · Commits · 戴 / test

After resume on a 2cpu laptop, kernel builds collapse with a sed hang, sh or make segfault (often on 20295564), real-time signal to cc1 etc. Several hurdles to jump, but a manually-assisted bisect led to -rc1's x86: do not zap_low_mappings in __smp_prepare_cpus. Though the low mappings were removed at bootup, they were left behind (with Global flags helping to keep them in TLB) after resume or cpu online, causing the crashes seen. Reinstate zap_low_mappings (with local __flush_tlb_all) for each cpu_up on x86_32. This used to be serialized by smp_commenced_mask: that's now gone, but a low_mappings flag will do. No need for native_smp_cpus_done to repeat the zap: let mem_init zap BSP's low mappings just like on UP. (In passing, fix error code from native_cpu_up: do_boot_cpu returns a variety of diagnostic values, Dprintk what it says but convert to -EIO. And save_pg_dir separately before zap_low_mappings: doesn't matter now, but zapping twice in succession wiped out resume's swsusp_pg_dir.) That worked well on the duo and one quad, but wouldn't boot 3rd or 4th cpu on P4 Xeon, oopsing just after unlock_ipi_call_lock. The TLB flush IPI now being sent reveals a long-standing bug: the booting cpu has its APIC readied in smp_callin at the top of start_secondary, but isn't put into the cpu_online_map until just before that unlock_ipi_call_lock. So native_smp_call_function_mask to online cpus would send_IPI_allbutself, including the cpu just coming up, though it has been excluded from the count to wait for: by the time it handles the IPI, the call data on native_smp_call_function_mask's stack may well have been overwritten. So fall back to send_IPI_mask while cpu_online_map does not match cpu_callout_map: perhaps there's a better APICological fix to be made at the start_secondary end, but I wouldn't know that. Signed-off-by:

Hugh Dickins <hugh@veritas.com> Signed-off-by:

Ingo Molnar <mingo@elte.hu>

arch/x86/kernel/smp.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -231,7 +231,8 @@ native_smp_call_function_mask(cpumask_t mask,
		wmb();

		/* Send a message to other CPUs */
		if (cpus_equal(mask, allbutself))
		if (cpus_equal(mask, allbutself) &&
		cpus_equal(cpu_online_map, cpu_callout_map))
		send_IPI_allbutself(CALL_FUNCTION_VECTOR);
		else
		send_IPI_mask(mask, CALL_FUNCTION_VECTOR);

arch/x86/kernel/smpboot.c

+17 −7

Original line number	Diff line number	Diff line
		@@ -86,6 +86,7 @@ void *x86_bios_cpu_apicid_early_ptr;

		#ifdef CONFIG_X86_32
		u8 apicid_2_node[MAX_APICID];
		static int low_mappings;
		#endif

		/* State of each CPU */
		@@ -326,6 +327,12 @@ static void __cpuinit start_secondary(void *unused)
		enable_8259A_irq(0);
		}

		#ifdef CONFIG_X86_32
		while (low_mappings)
		cpu_relax();
		__flush_tlb_all();
		#endif

		/* This must be done before setting cpu_online_map */
		set_cpu_sibling_map(raw_smp_processor_id());
		wmb();
		@@ -1042,12 +1049,18 @@ int __cpuinit native_cpu_up(unsigned int cpu)
		clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
		min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
		flush_tlb_all();
		#endif
		low_mappings = 1;

		err = do_boot_cpu(apicid, cpu);
		if (err < 0) {

		zap_low_mappings();
		low_mappings = 0;
		#else
		err = do_boot_cpu(apicid, cpu);
		#endif
		if (err) {
		Dprintk("do_boot_cpu failed %d\n", err);
		return err;
		return -EIO;
		}

		/*
		@@ -1259,9 +1272,6 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
		setup_ioapic_dest();
		#endif
		check_nmi_watchdog();
		#ifdef CONFIG_X86_32
		zap_low_mappings();
		#endif
		}

		#ifdef CONFIG_HOTPLUG_CPU

arch/x86/mm/init_32.c

+1 −11

Original line number	Diff line number	Diff line
		@@ -438,8 +438,6 @@ void zap_low_mappings(void)
		{
		int i;

		save_pg_dir();

		/*
		* Zap initial low-memory mappings.
		*
		@@ -663,16 +661,8 @@ void __init mem_init(void)
		test_wp_bit();

		cpa_init();

		/*
		* Subtle. SMP is doing it's boot stuff late (because it has to
		* fork idle threads) - but it also needs low mappings for the
		* protected-mode entry to work. We zap these entries only after
		* the WP-bit has been tested.
		*/
		#ifndef CONFIG_SMP
		save_pg_dir();
		zap_low_mappings();
		#endif
		}

		#ifdef CONFIG_MEMORY_HOTPLUG

Admin message