[PATCH] boot_cpu_data corruption on SMP x86

The patch below eliminates a case of boot_cpu_data corruption
on SMP x86 machines. This was first observed on SMP Athlons,
but it also affects SMP Intel boxes in a less serious way.

When the secondary processors boot and execute head.S:checkCPUtype,
the code performs a 32-bit write of a small constant to the
byte-sized variable boot_cpu_data.x86 (X86 in head.S). Since the
write is 32-bit, it also writes zeros to the following 3 bytes,
which clobbers the x86_vendor, x86_model, and x86_mask fields
previously set up by check_bugs()'s call to identify_cpu().
Thus, after smp_init(), boot_cpu_data will _always_ identify
the CPU as an Intel (X86_VENDOR_INTEL == 0 in processor.h) with
model 0 and stepping 0.

The effect in standard kernels is not catastrophic, since:
(a) most SMP x86 boxes are Intel
(b) most uses of x86_vendor occur before smp_init() or reference
    the SMP cpu_data[] array
(c) most post-boot references to boot_cpu_data occur in the
    cpu_has_XXX macros which only read the x86_capability[] array
However, third-party extensions (like my x86 performance-monitoring
conters driver) can get seriously confused by this mis-identification.

diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 77d0323aa7e9e3dd439387b341afaf66218ce01f..6641f7ca76f775c6b66d3f61bc7cd360912937ea 100644 (file)
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -178,7 +178,7 @@ checkCPUtype:
  * we don't need to preserve eflags.
  */
 
-       movl $3,X86             # at least 386
+       movb $3,X86             # at least 386
        pushfl                  # push EFLAGS
        popl %eax               # get EFLAGS
        movl %eax,%ecx          # save original EFLAGS
@@ -191,7 +191,7 @@ checkCPUtype:
        andl $0x40000,%eax      # check if AC bit changed
        je is386
 
-       movl $4,X86             # at least 486
+       movb $4,X86             # at least 486
        movl %ecx,%eax
        xorl $0x200000,%eax     # check ID flag
        pushl %eax