From: Dave Hansen <haveblue@us.ibm.com>
Hmmm. This is looking like fallout from the massive wli-bomb. Here's
the loop that controls the cpu booting, before and after cpumask_t:
- for (bit = 0; kicked < NR_CPUS && bit < BITS_PER_LONG; bit++)
+ for (bit = 0; kicked < NR_CPUS && bit < MAX_APICS; bit++)
apicid = cpu_present_to_apicid(bit);
"kicked" only gets incremented for CPUs that were successfully booted,
so it doesn't help terminate the loop much. MAX_APICS is 256 on summit,
which is *MUCH* bigger than BITS_PER_LONG.
cpu_2_logical_apicid[NR_CPUS] which is referenced from
cpu_present_to_apicid() is getting referenced up to MAX_APICs, which is
bigger than NR_CPUS. Overflow. Bang. garbage != BAD_APICID :)
/* Mapping from cpu number to logical apicid */
static inline int cpu_to_logical_apicid(int cpu)
{
+ if (cpu >= NR_CPUS)
+ return BAD_APICID;
return (int)cpu_2_logical_apicid[cpu];
}
/* Mapping from cpu number to logical apicid */
static inline int cpu_to_logical_apicid(int cpu)
{
+ if (cpu >= NR_CPUS)
+ return BAD_APICID;
return (int)cpu_2_logical_apicid[cpu];
}
extern u8 cpu_2_logical_apicid[];
static inline int cpu_to_logical_apicid(int cpu)
{
+ if (cpu >= NR_CPUS)
+ return BAD_APICID;
return (int)cpu_2_logical_apicid[cpu];
}
extern u8 cpu_2_logical_apicid[];
static inline int cpu_to_logical_apicid(int cpu)
{
+ if (cpu >= NR_CPUS)
+ return BAD_APICID;
return (int)cpu_2_logical_apicid[cpu];
}