public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
	kernel-team@lists.ubuntu.com
Cc: Helge Deller <deller@gmx.de>,
	John David Anglin <dave.anglin@bell.net>,
	Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 3.8 65/91] parisc: Do not crash 64bit SMP kernels on machines with >= 4GB RAM
Date: Thu,  7 Nov 2013 18:15:20 -0800	[thread overview]
Message-ID: <1383876946-2396-66-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1383876946-2396-1-git-send-email-kamal@canonical.com>

3.8.13.13 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit 54e181e073fc1415e41917d725ebdbd7de956455 upstream.

Since the beginning of the parisc-linux port, sometimes 64bit SMP kernels were
not able to bring up other CPUs than the monarch CPU and instead crashed the
kernel.  The reason was unclear, esp. since it involved various machines (e.g.
J5600, J6750 and SuperDome). Testing showed, that those crashes didn't happened
when less than 4GB were installed, or if a 32bit Linux kernel was booted.

In the end, the fix for those SMP problems is trivial:
During the early phase of the initialization of the CPUs, including the monarch
CPU, the PDC_PSW firmware function to enable WIDE (=64bit) mode is called.
It's documented that this firmware function may clobber various registers, and
one one of those possibly clobbered registers is %cr30 which holds the task
thread info pointer.

Now, if %cr30 would always have been clobbered, then this bug would have been
detected much earlier. But lots of testing finally showed, that - at least for
%cr30 - on some machines only the upper 32bits of the 64bit register suddenly
turned zero after the firmware call.

So, after finding the root cause, the explanation for the various crashes
became clear:
- On 32bit SMP Linux kernels all upper 32bit were zero, so we didn't faced this
  problem.
- Monarch CPUs in 64bit mode always booted sucessfully, because the inital task
  thread info pointer was below 4GB.
- Secondary CPUs booted sucessfully on machines with less than 4GB RAM because
  the upper 32bit were zero anyay.
- Secondary CPus failed to boot if we had more than 4GB RAM and the task thread
  info pointer was located above the 4GB boundary.

Finally, the patch to fix this problem is trivial by saving the %cr30 register
before the firmware call and restoring it afterwards.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/parisc/kernel/head.S | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 37aabd7..d2d5825 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
 	ldw             MEM_PDC_HI(%r0),%r6
 	depd            %r6, 31, 32, %r3        /* move to upper word */
 
+	mfctl		%cr30,%r6		/* PCX-W2 firmware bug */
+
 	ldo             PDC_PSW(%r0),%arg0              /* 21 */
 	ldo             PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
 	ldo             PDC_PSW_WIDE_BIT(%r0),%arg2     /* 2 */
@@ -203,6 +205,8 @@ common_stext:
 	copy            %r0,%arg3
 
 stext_pdc_ret:
+	mtctl		%r6,%cr30		/* restore task thread info */
+
 	/* restore rfi target address*/
 	ldd             TI_TASK-THREAD_SZ_ALGN(%sp), %r10
 	tophys_r1       %r10
-- 
1.8.1.2


  parent reply	other threads:[~2013-11-08  2:15 UTC|newest]

Thread overview: 94+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-11-08  2:14 [3.8.y.z extended stable] Linux 3.8.13.13 stable review Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 01/91] ACPICA: Interpreter: Fix Store() when implicit conversion is not possible Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 02/91] ACPICA: DeRefOf operator: Update to fully resolve FieldUnit and BufferField refs Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 03/91] ACPICA: Return error if DerefOf resolves to a null package element Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 04/91] ACPICA: Fix for a Store->ArgX when ArgX contains a reference to a field Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 05/91] vxlan: fix ip_select_ident skb parameter Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 06/91] tcp: TSO packets automatic sizing Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 07/91] tcp: TSQ can use a dynamic limit Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 08/91] net: Add skb_unclone() helper function Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 09/91] ipv6: fix warning in xfrm6_mode_tunnel_input Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 10/91] ip: fix warning in xfrm4_mode_tunnel_input Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 11/91] tcp: must unclone packets before mangling them Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 12/91] tcp: do not forget FIN in tcp_shifted_skb() Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 13/91] net: do not call sock_put() on TIMEWAIT sockets Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 14/91] l2tp: fix kernel panic when using IPv4-mapped IPv6 addresses Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 15/91] l2tp: Fix build warning with ipv6 disabled Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 16/91] net: mv643xx_eth: update statistics timer from timer context only Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 17/91] net: mv643xx_eth: fix orphaned statistics timer crash Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 18/91] net: heap overflow in __audit_sockaddr() Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 19/91] proc connector: fix info leaks Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 20/91] ipv4: fix ineffective source address selection Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 21/91] can: dev: fix nlmsg size calculation in can_get_size() Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 22/91] net: secure_seq: Fix warning when CONFIG_IPV6 and CONFIG_INET are not selected Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 23/91] xen-netback: Don't destroy the netdev until the vif is shut down Kamal Mostafa
2013-11-08  9:53   ` Ian Campbell
2013-11-08 17:54     ` Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 24/91] net: vlan: fix nlmsg size calculation in vlan_get_size() Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 25/91] vti: get rid of nf mark rule in prerouting Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 26/91] l2tp: must disable bh before calling l2tp_xmit_skb() Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 27/91] farsync: fix info leak in ioctl Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 28/91] unix_diag: fix info leak Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 29/91] connector: use nlmsg_len() to check message length Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 30/91] virtio-net: don't respond to cpu hotplug notifier if we're not ready Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 31/91] bridge: Correctly clamp MAX forward_delay when enabling STP Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 32/91] net: dst: provide accessor function to dst->xfrm Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 33/91] sctp: Use software crc32 checksum when xfrm transform will happen Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 34/91] sctp: Perform software checksum if packet has to be fragmented Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 35/91] wanxl: fix info leak in ioctl Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 36/91] net: unix: inherit SOCK_PASS{CRED, SEC} flags from socket to fix race Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 37/91] net: fix cipso packet validation when !NETLABEL Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 38/91] inet: fix possible memory corruption with UDP_CORK and UFO Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 39/91] davinci_emac.c: Fix IFF_ALLMULTI setup Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 40/91] jfs: fix error path in ialloc Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 41/91] cfg80211: fix warning when using WEXT for IBSS Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 42/91] mac80211: drop spoofed packets in ad-hoc mode Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 43/91] mac80211: use sta_info_get_bss() for nl80211 tx and client probing Kamal Mostafa
2013-11-08  2:14 ` [PATCH 3.8 44/91] mac80211: update sta->last_rx on acked tx frames Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 45/91] mwifiex: fix SDIO interrupt lost issue Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 46/91] ath9k: fix tx queue scheduling after channel changes Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 47/91] libata: make ata_eh_qc_retry() bump scmd->allowed on bogus failures Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 48/91] mac80211: correctly close cancelled scans Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 49/91] can: flexcan: fix mx28 detection by rearanging OF match table Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 50/91] rtlwifi: rtl8192cu: Fix error in pointer arithmetic Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 51/91] wireless: radiotap: fix parsing buffer overrun Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 52/91] mac80211: fix crash if bitrate calculation goes wrong Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 53/91] drm/vmwgfx: Don't put resources with invalid id's on lru list Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 54/91] drm/vmwgfx: Don't kill clients on VT switch Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 55/91] ecryptfs: Fix memory leakage in keystore.c Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 56/91] drm: Prevent overwriting from userspace underallocating core ioctl structs Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 57/91] drm: Pad drm_mode_get_connector to 64-bit boundary Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 58/91] drm/radeon/atom: workaround vbios bug in transmitter table on rs780 Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 59/91] md: Fix skipping recovery for read-only arrays Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 60/91] md: avoid deadlock when md_set_badblocks Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 61/91] raid5: set bio bi_vcnt 0 for discard request Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 62/91] raid5: avoid finding "discard" stripe Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 63/91] target/pscsi: fix return value check Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 64/91] vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter Kamal Mostafa
2013-11-08  2:15 ` Kamal Mostafa [this message]
2013-11-08  2:15 ` [PATCH 3.8 66/91] dmi: add support for exact DMI matches in addition to substring matching Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 67/91] clk: fixup argument order when setting VCO parameters Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 68/91] xtensa: don't use alternate signal stack on threads Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 69/91] ALSA: hda - Fix unbalanced runtime PM refcount after S3/S4 Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 70/91] ASoC: dapm: Fix source list debugfs outputs Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 71/91] drm/i915: quirk away phantom LVDS on Intel's D510MO mainboard Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 72/91] drm/i915: quirk away phantom LVDS on Intel's D525MW mainboard Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 73/91] drm/i915: No LVDS hardware on Intel D410PT and D425KT Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 74/91] mm: Wait for THP migrations to complete during NUMA hinting faults Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 75/91] mm: numa: cleanup flow of transhuge page migration Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 76/91] mm: Prevent parallel splits during THP migration Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 77/91] mm: numa: Sanitize task_numa_fault() callsites Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 78/91] mm: Close races between THP migration and PMD numa clearing Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 79/91] mm: Account for a THP NUMA hinting update as one PTE update Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 80/91] Fix a few incorrectly checked [io_]remap_pfn_range() calls Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 81/91] ALSA: hda - Add a fixup for ASUS N76VZ Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 82/91] ASoC: wm_hubs: Add missing break in hp_supply_event() Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 83/91] uml: check length in exitcode_proc_write() Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 84/91] staging: ozwpan: prevent overflow in oz_cdev_write() Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 85/91] aacraid: missing capable() check in compat ioctl Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 86/91] staging: wlags49_h2: buffer overflow setting station name Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 87/91] Staging: bcm: info leak in ioctl Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 88/91] Staging: sb105x: info leak in mp_get_count() Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 89/91] ALSA: fix oops in snd_pcm_info() caused by ASoC DPCM Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 90/91] lib/scatterlist.c: don't flush_kernel_dcache_page on slab page Kamal Mostafa
2013-11-08  2:15 ` [PATCH 3.8 91/91] scripts/kallsyms: filter symbols not in kernel address space Kamal Mostafa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1383876946-2396-66-git-send-email-kamal@canonical.com \
    --to=kamal@canonical.com \
    --cc=dave.anglin@bell.net \
    --cc=deller@gmx.de \
    --cc=kernel-team@lists.ubuntu.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox