- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
by Yongjian Sun 16 Jul '25

16 Jul '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit af98b0157adf6504fade79b3e6cb260c4ff68e37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICLHG1 CVE: CVE-2025-38337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: ================================================================== BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... value changed: 0x00000000 -> 0x00000001 ================================================================== This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added. Reported-by: syzbot+de24c3fe3c4091051710(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=de24c3fe3c4091051710 Fixes: 6e06ae88edae ("jbd2: speedup jbd2_journal_dirty_metadata()") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20250514130855.99010-1-aha310510@gmail.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Conflicts: fs/jbd2/transaction.c [464170647b56 not applied and KCSAN not supported] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/jbd2/transaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 0797568c5899..ba7ec279c715 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1461,7 +1461,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) goto out; } - journal = transaction->t_journal; jbd_lock_bh_state(bh); if (is_handle_aborted(handle)) { @@ -1476,6 +1475,8 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) goto out_unlock_bh; } + journal = transaction->t_journal; + if (jh->b_modified == 0) { /* * This buffer's got modified and becoming part -- 2.39.2

2 1

[PATCH OLK-5.10] jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
by Yongjian Sun 16 Jul '25

16 Jul '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit af98b0157adf6504fade79b3e6cb260c4ff68e37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICLHG1 CVE: CVE-2025-38337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: ================================================================== BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... value changed: 0x00000000 -> 0x00000001 ================================================================== This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added. Reported-by: syzbot+de24c3fe3c4091051710(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=de24c3fe3c4091051710 Fixes: 6e06ae88edae ("jbd2: speedup jbd2_journal_dirty_metadata()") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20250514130855.99010-1-aha310510@gmail.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/jbd2/transaction.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 5f2f0b776d9d..48a64815f4e4 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1492,7 +1492,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) jh->b_next_transaction == transaction); spin_unlock(&jh->b_state_lock); } - if (jh->b_modified == 1) { + if (data_race(jh->b_modified == 1)) { /* If it's in our transaction it must be in BJ_Metadata list. */ if (data_race(jh->b_transaction == transaction && jh->b_jlist != BJ_Metadata)) { @@ -1511,7 +1511,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) goto out; } - journal = transaction->t_journal; spin_lock(&jh->b_state_lock); if (is_handle_aborted(handle)) { @@ -1526,6 +1525,8 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) goto out_unlock_bh; } + journal = transaction->t_journal; + if (jh->b_modified == 0) { /* * This buffer's got modified and becoming part -- 2.39.2

2 1

[openeuler:OLK-6.6 2519/2519] kernel/locking/mutex.c:623:6: warning: variable 'ifs_clock' is used uninitialized whenever 'if' condition is true
by kernel test robot 16 Jul '25

16 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0a2a4d6188250982405816f6ee5b085bfb522721 commit: a1ad9b2ed459a3e3a4a2de50e03f53036fc7ec96 [2519/2519] interference: Add mutex interference track support config: arm64-randconfig-004-20250716 (https://download.01.org/0day-ci/archive/20250716/202507161941.gk9sOp8j-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project 16534d19bf50bde879a83f0ae62875e2c5120e64) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250716/202507161941.gk9sOp8j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507161941.gk9sOp8j-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/locking/mutex.c:623:6: warning: variable 'ifs_clock' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~ kernel/locking/mutex.c:725:24: note: uninitialized use occurs here 725 | cgroup_ifs_leave_lock(ifs_clock, IFS_MUTEX); | ^~~~~~~~~ kernel/locking/mutex.c:623:2: note: remove the 'if' if its condition is always false 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ 624 | if (ww_ctx) | ~~~~~~~~~~~ 625 | __ww_mutex_check_waiters(lock, ww_ctx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 626 | 627 | goto skip_wait; | ~~~~~~~~~~~~~~~ 628 | } | ~ kernel/locking/mutex.c:576:15: note: initialize the variable 'ifs_clock' to silence this warning 576 | u64 ifs_clock; | ^ | = 0 1 warning generated. vim +623 kernel/locking/mutex.c 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 565 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 566 /* 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 567 * Lock a mutex (possibly interruptible), slowpath: 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 568 */ 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 569 static __always_inline int __sched 2f064a59a11ff9 kernel/locking/mutex.c Peter Zijlstra 2021-06-11 570 __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclass, 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 571 struct lockdep_map *nest_lock, unsigned long ip, b0267507dfd018 kernel/mutex.c Tetsuo Handa 2013-10-17 572 struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 573 { 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 574 struct mutex_waiter waiter; a40ca56577f628 kernel/locking/mutex.c Waiman Long 2016-08-26 575 struct ww_mutex *ww; a1ad9b2ed459a3 kernel/locking/mutex.c Pu Lehui 2025-07-16 576 u64 ifs_clock; 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 577 int ret; 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 578 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 579 if (!use_ww_ctx) 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 580 ww_ctx = NULL; 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 581 427b18207a87f6 kernel/locking/mutex.c Peter Zijlstra 2016-12-23 582 might_sleep(); ea9e0fb8fe1bdf kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 583 e6b4457b05f36b kernel/locking/mutex.c Peter Zijlstra 2021-06-30 584 MUTEX_WARN_ON(lock->magic != lock); 6c11c6e3d5e9e5 kernel/locking/mutex.c Sebastian Andrzej Siewior 2019-07-03 585 a40ca56577f628 kernel/locking/mutex.c Waiman Long 2016-08-26 586 ww = container_of(lock, struct ww_mutex, base); 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 587 if (ww_ctx) { 0422e83d84ae24 kernel/locking/mutex.c Chris Wilson 2016-05-26 588 if (unlikely(ww_ctx == READ_ONCE(ww->ctx))) 0422e83d84ae24 kernel/locking/mutex.c Chris Wilson 2016-05-26 589 return -EALREADY; 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 590 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 591 /* 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 592 * Reset the wounded flag after a kill. No other process can 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 593 * race and wound us here since they can't have a valid owner 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 594 * pointer if we don't have any locks held. 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 595 */ 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 596 if (ww_ctx->acquired == 0) 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 597 ww_ctx->wounded = 0; cf702eddcd03dc kernel/locking/mutex.c Peter Zijlstra 2021-08-15 598 cf702eddcd03dc kernel/locking/mutex.c Peter Zijlstra 2021-08-15 599 #ifdef CONFIG_DEBUG_LOCK_ALLOC cf702eddcd03dc kernel/locking/mutex.c Peter Zijlstra 2021-08-15 600 nest_lock = &ww_ctx->dep_map; cf702eddcd03dc kernel/locking/mutex.c Peter Zijlstra 2021-08-15 601 #endif 0422e83d84ae24 kernel/locking/mutex.c Chris Wilson 2016-05-26 602 } 0422e83d84ae24 kernel/locking/mutex.c Chris Wilson 2016-05-26 603 41719b03091911 kernel/mutex.c Peter Zijlstra 2009-01-14 604 preempt_disable(); e4c70a6629f9c7 kernel/mutex.c Peter Zijlstra 2011-05-24 605 mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip); c02260277e4720 kernel/mutex.c Frederic Weisbecker 2009-12-02 606 dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 607 trace_contention_begin(lock, LCB_F_MUTEX | LCB_F_SPIN); e274795ea7b7ca kernel/locking/mutex.c Peter Zijlstra 2017-01-11 608 if (__mutex_trylock(lock) || 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 609 mutex_optimistic_spin(lock, ww_ctx, NULL)) { 76916515d9d84e kernel/locking/mutex.c Davidlohr Bueso 2014-07-30 610 /* got the lock, yay! */ 3ca0ff571b092e kernel/locking/mutex.c Peter Zijlstra 2016-08-23 611 lock_acquired(&lock->dep_map, ip); 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 612 if (ww_ctx) 3ca0ff571b092e kernel/locking/mutex.c Peter Zijlstra 2016-08-23 613 ww_mutex_set_context_fastpath(ww, ww_ctx); dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 614 trace_contention_end(lock, 0); ac6e60ee405aa3 kernel/mutex.c Chris Mason 2009-01-14 615 preempt_enable(); ac6e60ee405aa3 kernel/mutex.c Chris Mason 2009-01-14 616 return 0; ac6e60ee405aa3 kernel/mutex.c Chris Mason 2009-01-14 617 } ac6e60ee405aa3 kernel/mutex.c Chris Mason 2009-01-14 618 ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 619 raw_spin_lock(&lock->wait_lock); 1e820c9608eace kernel/locking/mutex.c Jason Low 2014-06-11 620 /* 3ca0ff571b092e kernel/locking/mutex.c Peter Zijlstra 2016-08-23 621 * After waiting to acquire the wait_lock, try again. 1e820c9608eace kernel/locking/mutex.c Jason Low 2014-06-11 622 */ 659cf9f5824a12 kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 @623 if (__mutex_trylock(lock)) { 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 624 if (ww_ctx) 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 625 __ww_mutex_check_waiters(lock, ww_ctx); 659cf9f5824a12 kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 626 ec83f425dbca47 kernel/mutex.c Davidlohr Bueso 2013-06-28 627 goto skip_wait; 659cf9f5824a12 kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 628 } ec83f425dbca47 kernel/mutex.c Davidlohr Bueso 2013-06-28 629 9a11b49a805665 kernel/mutex.c Ingo Molnar 2006-07-03 630 debug_mutex_lock_common(lock, &waiter); c0afb0ffc06e6b kernel/locking/mutex.c Peter Zijlstra 2021-08-15 631 waiter.task = current; b857174e68e26f kernel/locking/mutex.c Sebastian Andrzej Siewior 2021-08-19 632 if (use_ww_ctx) c0afb0ffc06e6b kernel/locking/mutex.c Peter Zijlstra 2021-08-15 633 waiter.ww_ctx = ww_ctx; 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 634 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 635 lock_contended(&lock->dep_map, ip); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 636 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 637 if (!use_ww_ctx) { 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 638 /* add waiting tasks to the end of the waitqueue (FIFO): */ 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 639 __mutex_add_waiter(lock, &waiter, &lock->wait_list); 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 640 } else { 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 641 /* 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 642 * Add in stamp order, waking up waiters that must kill 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 643 * themselves. 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 644 */ 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 645 ret = __ww_mutex_add_waiter(&waiter, lock, ww_ctx); 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 646 if (ret) 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 647 goto err_early_kill; 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 648 } 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 649 642fa448ae6b3a kernel/locking/mutex.c Davidlohr Bueso 2017-01-03 650 set_current_state(state); dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 651 trace_contention_begin(lock, LCB_F_MUTEX); a1ad9b2ed459a3 kernel/locking/mutex.c Pu Lehui 2025-07-16 652 cgroup_ifs_enter_lock(&ifs_clock); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 653 for (;;) { 048661a1f963e9 kernel/locking/mutex.c Peter Zijlstra 2021-06-30 654 bool first; 048661a1f963e9 kernel/locking/mutex.c Peter Zijlstra 2021-06-30 655 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 656 /* 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 657 * Once we hold wait_lock, we're serialized against 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 658 * mutex_unlock() handing the lock off to us, do a trylock 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 659 * before testing the error conditions to make sure we pick up 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 660 * the handoff. 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 661 */ e274795ea7b7ca kernel/locking/mutex.c Peter Zijlstra 2017-01-11 662 if (__mutex_trylock(lock)) 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 663 goto acquired; 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 664 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 665 /* 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 666 * Check for signals and kill conditions while holding 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 667 * wait_lock. This ensures the lock cancellation is ordered 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 668 * against mutex_unlock() and wake-ups do not go missing. 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 669 */ 3bb5f4ac55dd91 kernel/locking/mutex.c Davidlohr Bueso 2019-01-03 670 if (signal_pending_state(state, current)) { 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 671 ret = -EINTR; 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 672 goto err; 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 673 } 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 674 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 675 if (ww_ctx) { 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 676 ret = __ww_mutex_check_kill(lock, &waiter, ww_ctx); 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 677 if (ret) 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 678 goto err; 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 679 } 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 680 ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 681 raw_spin_unlock(&lock->wait_lock); bd2f55361f1834 kernel/mutex.c Thomas Gleixner 2011-03-21 682 schedule_preempt_disabled(); 9d659ae14b545c kernel/locking/mutex.c Peter Zijlstra 2016-08-23 683 6baa5c60a97d7f kernel/locking/mutex.c Nicolai Hähnle 2016-12-21 684 first = __mutex_waiter_is_first(lock, &waiter); 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 685 642fa448ae6b3a kernel/locking/mutex.c Davidlohr Bueso 2017-01-03 686 set_current_state(state); 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 687 /* 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 688 * Here we order against unlock; we must either see it change 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 689 * state back to RUNNING and fall through the next schedule(), 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 690 * or we must see its unlock and acquire. 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 691 */ dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 692 if (__mutex_trylock_or_handoff(lock, first)) dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 693 break; dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 694 dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 695 if (first) { dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 696 trace_contention_begin(lock, LCB_F_MUTEX | LCB_F_SPIN); dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 697 if (mutex_optimistic_spin(lock, ww_ctx, &waiter)) 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 698 break; dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 699 trace_contention_begin(lock, LCB_F_MUTEX); dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 700 } 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 701 ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 702 raw_spin_lock(&lock->wait_lock); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 703 } ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 704 raw_spin_lock(&lock->wait_lock); 5bbd7e64437833 kernel/locking/mutex.c Peter Zijlstra 2016-09-02 705 acquired: 642fa448ae6b3a kernel/locking/mutex.c Davidlohr Bueso 2017-01-03 706 __set_current_state(TASK_RUNNING); 51587bcf31d070 kernel/locking/mutex.c Davidlohr Bueso 2015-01-19 707 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 708 if (ww_ctx) { 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 709 /* 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 710 * Wound-Wait; we stole the lock (!first_waiter), check the 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 711 * waiters as anyone might want to wound us. 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 712 */ 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 713 if (!ww_ctx->is_wait_die && 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 714 !__mutex_waiter_is_first(lock, &waiter)) 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 715 __ww_mutex_check_waiters(lock, ww_ctx); 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 716 } 08295b3b5beec9 kernel/locking/mutex.c Thomas Hellstrom 2018-06-15 717 3a010c493271f0 kernel/locking/mutex.c Zqiang 2021-05-17 718 __mutex_remove_waiter(lock, &waiter); 3ca0ff571b092e kernel/locking/mutex.c Peter Zijlstra 2016-08-23 719 ec83f425dbca47 kernel/mutex.c Davidlohr Bueso 2013-06-28 720 debug_mutex_free_waiter(&waiter); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 721 ec83f425dbca47 kernel/mutex.c Davidlohr Bueso 2013-06-28 722 skip_wait: ec83f425dbca47 kernel/mutex.c Davidlohr Bueso 2013-06-28 723 /* got the lock - cleanup and rejoice! */ c7e78cff6b7518 kernel/mutex.c Peter Zijlstra 2008-10-16 724 lock_acquired(&lock->dep_map, ip); a1ad9b2ed459a3 kernel/locking/mutex.c Pu Lehui 2025-07-16 725 cgroup_ifs_leave_lock(ifs_clock, IFS_MUTEX); ee042be16cb455 kernel/locking/mutex.c Namhyung Kim 2022-03-22 726 trace_contention_end(lock, 0); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 727 5de2055d31ea88 kernel/locking/mutex.c Waiman Long 2021-03-16 728 if (ww_ctx) 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 729 ww_mutex_lock_acquired(ww, ww_ctx); 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 730 ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 731 raw_spin_unlock(&lock->wait_lock); 41719b03091911 kernel/mutex.c Peter Zijlstra 2009-01-14 732 preempt_enable(); 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 733 return 0; 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 734 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 735 err: 642fa448ae6b3a kernel/locking/mutex.c Davidlohr Bueso 2017-01-03 736 __set_current_state(TASK_RUNNING); 3a010c493271f0 kernel/locking/mutex.c Zqiang 2021-05-17 737 __mutex_remove_waiter(lock, &waiter); 55f036ca7e74b8 kernel/locking/mutex.c Peter Ziljstra 2018-06-15 738 err_early_kill: a1ad9b2ed459a3 kernel/locking/mutex.c Pu Lehui 2025-07-16 739 cgroup_ifs_leave_lock(ifs_clock, IFS_MUTEX); dc1f7893a70fe4 kernel/locking/mutex.c Peter Zijlstra 2022-03-30 740 trace_contention_end(lock, ret); ebf4c55c1ddbab kernel/locking/mutex.c Thomas Gleixner 2021-08-15 741 raw_spin_unlock(&lock->wait_lock); 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 742 debug_mutex_free_waiter(&waiter); 5facae4f3549b5 kernel/locking/mutex.c Qian Cai 2019-09-19 743 mutex_release(&lock->dep_map, ip); 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 744 preempt_enable(); 040a0a37100563 kernel/mutex.c Maarten Lankhorst 2013-06-24 745 return ret; 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 746 } 6053ee3b32e343 kernel/mutex.c Ingo Molnar 2006-01-09 747 :::::: The code at line 623 was first introduced by commit :::::: 659cf9f5824a12e6b50785e4e9cf1adf8a3adbd0 locking/ww_mutex: Optimize ww-mutexes by waking at most one waiter for backoff when acquiring the lock :::::: TO: Nicolai Hähnle <Nicolai.Haehnle(a)amd.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] downstream: KVM: arm64: Initialize HCRX_EL2 for FEAT_HAFT
by Qi Xi 16 Jul '25

16 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> FEAT_HAFT is enabled at boot by TCR2_EL1 which is controlled by HCRX_EL2. Back port the initialization part of HCRX_EL2 to support HAFT form [1][2]. Virtualization part (world switch) is not ported since it's said to have no such scenarios. [1] https://lore.kernel.org/all/20230509142235.3284028-2-kristina.martsenko@arm… [2] https://lore.kernel.org/all/20230606145859.697944-15-joey.gouly@arm.com/ Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> --- arch/arm64/include/asm/el2_setup.h | 10 ++++++++++ arch/arm64/include/asm/kvm_arm.h | 3 +++ arch/arm64/include/asm/sysreg.h | 3 +++ 3 files changed, 16 insertions(+) diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h index a9f16e2e4a4e..3f96c2ffd054 100644 --- a/arch/arm64/include/asm/el2_setup.h +++ b/arch/arm64/include/asm/el2_setup.h @@ -22,6 +22,15 @@ isb .endm +.macro __init_el2_hcrx + mrs x0, id_aa64mmfr1_el1 + ubfx x0, x0, #ID_AA64MMFR1_EL1_HCX_SHIFT, #4 + cbz x0, .Lskip_hcrx_\@ + mov_q x0, HCRX_HOST_FLAGS + msr_s SYS_HCRX_EL2, x0 +.Lskip_hcrx_\@: +.endm + /* * Allow Non-secure EL1 and EL0 to access physical timer and counter. * This is not necessary for VHE, since the host kernel runs in EL2, @@ -233,6 +242,7 @@ */ .macro init_el2_state __init_el2_sctlr + __init_el2_hcrx __init_el2_timers __init_el2_debug __init_el2_lor diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h index f67a561e0935..d6dbc8acd8bd 100644 --- a/arch/arm64/include/asm/kvm_arm.h +++ b/arch/arm64/include/asm/kvm_arm.h @@ -63,6 +63,8 @@ #define HCR_VM (UL(1) << 0) #define HCR_RES0 ((UL(1) << 48) | (UL(1) << 39)) +#define HCRX_EL2_TCR2En (UL(1) << 14) + /* * The bits we set in HCR: * TLOR: Trap LORegion register accesses @@ -89,6 +91,7 @@ #define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK | HCR_ATA) #define HCR_HOST_NVHE_PROTECTED_FLAGS (HCR_HOST_NVHE_FLAGS | HCR_TSC) #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H) +#define HCRX_HOST_FLAGS (HCRX_EL2_TCR2En) /* TCR_EL2 Registers bits */ #define TCR_EL2_RES1 ((1U << 31) | (1 << 23)) diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index b4e5392e9748..82129bbf89ac 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -1043,6 +1043,7 @@ #define SYS_HFGITR_EL2 sys_reg(3, 4, 1, 1, 6) #define SYS_ZCR_EL2 sys_reg(3, 4, 1, 2, 0) #define SYS_TRFCR_EL2 sys_reg(3, 4, 1, 2, 1) +#define SYS_HCRX_EL2 sys_reg(3, 4, 1, 2, 2) #define SYS_DACR32_EL2 sys_reg(3, 4, 3, 0, 0) #define SYS_HDFGRTR_EL2 sys_reg(3, 4, 3, 1, 4) #define SYS_HDFGWTR_EL2 sys_reg(3, 4, 3, 1, 5) @@ -1603,6 +1604,8 @@ #define ID_AA64MMFR1_EL1_HAFDBS_HAFT UL(0b0011) #define ID_AA64MMFR1_EL1_HAFDBS_HDBSS UL(0b0100) +#define ID_AA64MMFR1_EL1_HCX_SHIFT 40 + #if defined(CONFIG_ARM64_4K_PAGES) #define ID_AA64MMFR0_TGRAN_SHIFT ID_AA64MMFR0_TGRAN4_SHIFT #define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN -- 2.33.0

1 0

[PATCH 1/8] arm64/sysreg: Update ID_AA64MMFR1_EL1 register
by Qi Xi 16 Jul '25

16 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> commit aa47dcda2708e571695dae2e3f9537d9a8eb804c upstream. Update ID_AA64MMFR1_EL1 register fields definition per DDI0601 (ID092424) 2024-09. ID_AA64MMFR1_EL1.ETS adds definition for FEAT_ETS2 and FEAT_ETS3. ID_AA64MMFR1_EL1.HAFDBS adds definition for FEAT_HAFT and FEAT_HDBSS. Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Link: https://lore.kernel.org/r/20241102104235.62560-2-yangyicong@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/include/asm/sysreg.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index b898395f5e77..cb43cfe3caa7 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -1579,6 +1579,12 @@ #define ID_PFR1_SECURITY_SHIFT 4 #define ID_PFR1_PROGMOD_SHIFT 0 +#define ID_AA64MMFR1_EL1_ETS_ETS2 UL(0b0010) +#define ID_AA64MMFR1_EL1_ETS_ETS3 UL(0b0011) + +#define ID_AA64MMFR1_EL1_HAFDBS_HAFT UL(0b0011) +#define ID_AA64MMFR1_EL1_HAFDBS_HDBSS UL(0b0100) + #if defined(CONFIG_ARM64_4K_PAGES) #define ID_AA64MMFR0_TGRAN_SHIFT ID_AA64MMFR0_TGRAN4_SHIFT #define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN -- 2.33.0

1 7

openEuler Kernel SIG双周例会
by openEuler conference 16 Jul '25

16 Jul '25

您好！ Kernel 邀请您参加 2025-07-18 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可直接回复本邮件申请，也可填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986249346 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-07-18 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可直接回复本邮件申请，也可填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986249346 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] drm: phytium: fix NULL dereference issue in drm_gem_object_free
by Li Chen 16 Jul '25

16 Jul '25

From: Li Chen <chenl311(a)chinatelecom.cn> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGG2A ---------------------------------------------------------------------- Syzkaller crashed kernel in drm path. The root cause is that phytium_drm_gem_object_funcs is not assigned before phytium_gem_create_object enters the failed_dma_alloc label. Let's fix this issue by assigning the function earlier. Below is the crash log: ``` [ 9042.703078] [drm:phytium_gem_create_object [phytium_dc_drm]] *ERROR* fail to allocate vram buffer with size 3de4000 [ 9042.717862] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 9042.727173] fuse: Unknown parameter '0xffffffffffffffff<r00000000000000000000' [ 9042.730383] Mem abort info: [ 9042.745443] ESR = 0x0000000096000006 [ 9042.745446] EC = 0x25: DABT (current EL), IL = 32 bits [ 9042.745448] SET = 0, FnV = 0 [ 9042.745450] EA = 0, S1PTW = 0 [ 9042.745451] FSC = 0x06: level 2 translation fault [ 9042.745453] Data abort info: [ 9042.745455] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 9042.745457] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 9042.745459] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 9042.745462] user pgtable: 4k pages, 48-bit VAs, pgdp=00003000894ca000 [ 9042.745464] [0000000000000000] pgd=08003000894cb403, p4d=08003000894cb403, pud=0800300085320403, pmd=0000000000000000 [ 9042.830042] Internal error: Oops: 0000000096000006 [#1] SMP [ 9042.838310] Modules linked in: cramfs camellia_generic serpent_generic blowfish_generic blowfish_common cast5_generic cast_common des_generic libdes rmd160 tcp_bic unix_diag ansi_cprng tcp_dctcp ppp_synctty ip_set_hash_ip n_hdlc cmac pps_ldisc n_gsm nfnetlink_log slcan tcp_diag nfnetlink_cthelper atm nfsd auth_rpcgss nfs_acl twofish_generic twofish_common ccm md4 ppp_async msdos nfs lockd grace fscache crc32_generic netfs smc_diag tcp_westwood smc nfnetlink_osf vfio_iommu_type1 vfio vhost_vsock iommufd squashfs ib_core gfs2 snd_timer snd soundcore uhid nfnetlink_cttimeout pppoe ip_vs cuse can_bcm loop can_raw can vsock_loopback inet_diag vmw_vsock_virtio_transport_common vhost_net vhost ieee802154_socket vsock cfg80211 uinput ieee802154 vhost_iotlb pptp crypto_user l2tp_ppp pppox sctp ppp_generic slhc af_key ip6_vti ip_vti ipip sit geneve macvtap tap ipvlan macvlan hsr xfrm_interface xfrm6_tunnel tunnel4 wireguard libchacha20poly1305 chacha_neon poly1305_neon libcurve25519_generic libchacha nlmon team vcan can_dev tun [ 9042.838608] xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat nf_tables overlay nfnetlink_queue authenc echainiv cls_matchall esp6 l2tp_ip6 l2tp_eth l2tp_ip l2tp_netlink l2tp_core br_netfilter sch_etf sch_fq dccp_ipv6 dccp_ipv4 dccp sch_ingress act_mirred cls_basic veth bonding tls esp4_offload esp4 psample macsec vxlan ip6_udp_tunnel udp_tunnel vrf 8021q garp mrp ip6_gre ip6_tunnel tunnel6 ip_gre ip_tunnel gre cls_u32 sch_htb dummy binfmt_misc bridge stp llc rfkill ip_set libcrc32c sunrpc vfat fat ipmi_si ipmi_devintf phytium_dc_drm ses enclosure ipmi_msghandler drm_display_helper scsi_transport_sas cec drm_kms_helper cppc_cpufreq sg drm fuse nfnetlink ext4 mbcache jbd2 sd_mod t10_pi crc64_rocksoft_generic crc64_rocksoft crc64 crct10dif_ce ghash_ce sm4_ce_gcm sm4_ce_ccm sm4_ce sm4_ce_cipher sm4 sm3_ce sha3_ce sha512_ce ahci sha512_arm64 sha2_ce libahci sha256_arm64 ice sha1_ce igb sbsa_gwdt libata megaraid_sas i2c_algo_bit i2c_core [ 9042.958095] dm_mirror dm_region_hash dm_log dm_multipath dm_mod aes_neon_bs aes_neon_blk aes_ce_blk aes_ce_cipher [last unloaded: nf_tables] [ 9043.094331] CPU: 39 PID: 127275 Comm: syz-executor.3 Kdump: loaded Not tainted 6.6.0-0001.rc3.ctl4.aarch64 #1 [ 9043.108430] Hardware name: vclusters VSFT5000 B/VSFT5000 B, BIOS KL4.2A.RC.D.170.240314.D.DX 03/14/2024 18:01:48 [ 9043.122832] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 9043.132983] pc : drm_gem_object_free+0xc/0x40 [drm] [ 9043.140480] lr : phytium_gem_create_object+0x2ac/0x338 [phytium_dc_drm] [ 9043.150238] sp : ffff80009cd83bd0 [ 9043.155639] x29: ffff80009cd83bd0 x28: 00000000000000b2 x27: ffff80009cd83ce8 [ 9043.166023] x26: 0000000000000020 x25: 0000000000000020 x24: ffff80007b4b2d78 [ 9043.176292] x23: ffff00ff8de5b000 x22: 0000000003de4000 x21: 0000000000000000 [ 9043.186548] x20: ffff00ff8df94c80 x19: fffffffffffffff4 x18: ffffffffffffffff [ 9043.196768] x17: 6f74206c69616620 x16: 2a524f5252452a20 x15: 5d5d6d72645f6364 [ 9043.207193] x14: 5f6d756974796870 x13: 205d353732373231 x12: 545b5d3837303330 [ 9043.217647] x11: 00000000ffff7fff x10: ffff80008223b900 x9 : ffff80007b5cdcb4 [ 9043.228070] x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 00000000002bffa8 [ 9043.238522] x5 : ffff80008345bd08 x4 : 0000000000000000 x3 : 0000000000000000 [ 9043.248718] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff200014f5b800 [ 9043.258874] Call trace: [ 9043.263132] drm_gem_object_free+0xc/0x40 [drm] [ 9043.270239] phytium_gem_dumb_create+0x60/0x160 [phytium_dc_drm] [ 9043.279194] drm_mode_create_dumb_ioctl+0x98/0xc0 [drm] [ 9043.287188] drm_ioctl_kernel+0xdc/0x188 [drm] [ 9043.294188] drm_ioctl+0x274/0x540 [drm] [ 9043.300456] __arm64_sys_ioctl+0xb4/0x100 [ 9043.306777] invoke_syscall+0x50/0x128 [ 9043.312774] el0_svc_common.constprop.0+0xc8/0xf0 [ 9043.319953] do_el0_svc+0x24/0x38 [ 9043.325324] el0_svc+0x44/0x1b8 [ 9043.330517] el0t_64_sync_handler+0x100/0x130 [ 9043.337369] el0t_64_sync+0x188/0x190 [ 9043.343315] Code: ffff00ff aa1e03e9 952fe875 f940a001 (f9400021) [ 9043.352351] SMP: stopping secondary CPUs [ 9043.412513] Starting crashdump kernel... [ 9044.001381] Bye! ``` Disassembler drm_gem_object_free: ``` 0xffff80007b437398 <drm_gem_object_free>: mov x9, x30 0xffff80007b43739c <drm_gem_object_free+4>: bl 0xffff800080031570 <ftrace_caller> 0xffff80007b4373a0 <drm_gem_object_free+8>: ldr x1, [x0, #320] 0xffff80007b4373a4 <drm_gem_object_free+12>: ldr x1, [x1] 0xffff80007b4373a8 <drm_gem_object_free+16>: cbz x1, 0xffff80007b4373c8 <drm_gem_object_free+48> 0xffff80007b4373ac <drm_gem_object_free+20>: paciasp 0xffff80007b4373b0 <drm_gem_object_free+24>: stp x29, x30, [sp, #-16]! 0xffff80007b4373b4 <drm_gem_object_free+28>: mov x29, sp 0xffff80007b4373b8 <drm_gem_object_free+32>: blr x1 0xffff80007b4373bc <drm_gem_object_free+36>: ldp x29, x30, [sp], #16 0xffff80007b4373c0 <drm_gem_object_free+40>: autiasp 0xffff80007b4373c4 <drm_gem_object_free+44>: ret 0xffff80007b4373c8 <drm_gem_object_free+48>: brk #0x800 0xffff80007b4373cc <drm_gem_object_free+52>: ret 0xffff80007b4373d0 <drm_gem_object_free+56>: .inst 0x865baea8 ; undefined 0xffff80007b4373d4 <drm_gem_object_free+60>: .inst 0xffff00ff ; undefined ``` ldr x1, [x1] <-- trapping instruction Signed-off-by: Li Chen <chenl311(a)chinatelecom.cn> Reviewed-by: Bin Lai <laib2(a)chinatelecom.cn> Reviewed-by: Shuo Li <lishuo(a)phytium.com.cn> --- drivers/gpu/drm/phytium/phytium_gem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/phytium/phytium_gem.c b/drivers/gpu/drm/phytium/phytium_gem.c index 2cbbcd9fbd112..95b6b0360c065 100644 --- a/drivers/gpu/drm/phytium/phytium_gem.c +++ b/drivers/gpu/drm/phytium/phytium_gem.c @@ -432,6 +432,8 @@ struct phytium_gem_object *phytium_gem_create_object(struct drm_device *dev, uns goto failed_object_init; } + phytium_gem_obj->base.funcs = &phytium_drm_gem_object_funcs; + if (priv->support_memory_type & (MEMORY_TYPE_VRAM_WC | MEMORY_TYPE_VRAM_DEVICE)) { ret = phytium_memory_pool_alloc(priv, &phytium_gem_obj->vaddr, &phytium_gem_obj->phys_addr, size); @@ -475,8 +477,6 @@ struct phytium_gem_object *phytium_gem_create_object(struct drm_device *dev, uns goto failed_dma_alloc; } - phytium_gem_obj->base.funcs = &phytium_drm_gem_object_funcs; - phytium_gem_obj->size = size; list_add_tail(&phytium_gem_obj->list, &priv->gem_list_head); DRM_DEBUG_KMS("phytium_gem_obj iova:0x%pa size:0x%lx\n", -- 2.49.0

1 0

[PATCH 01/15] cpu/SMT: Provide a default topology_is_primary_thread()
by Qi Xi 16 Jul '25

16 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> commit 4b455f59945aab5610828a1320b045c82cbe8852 upstream. Currently if architectures want to support HOTPLUG_SMT they need to provide a topology_is_primary_thread() telling the framework which thread in the SMT cannot offline. However arm64 doesn't have a restriction on which thread in the SMT cannot offline, a simplest choice is that just make 1st thread as the "primary" thread. So just make this as the default implementation in the framework and let architectures like x86 that have special primary thread to override this function (which they've already done). There's no need to provide a stub function if !CONFIG_SMP or !CONFIG_HOTPLUG_SMT. In such case the testing CPU is already the 1st CPU in the SMT so it's always the primary thread. Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Reviewed-by: Pierre Gondois <pierre.gondois(a)arm.com> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Reviewed-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/topology.h | 1 - arch/x86/kernel/smpboot.c | 1 + include/linux/topology.h | 24 ++++++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 5b4f87329031..8bf8d5546e97 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -152,7 +152,6 @@ static inline int topology_phys_to_logical_die(unsigned int die, unsigned int cpu) { return 0; } static inline int topology_max_die_per_package(void) { return 1; } static inline int topology_max_smt_threads(void) { return 1; } -static inline bool topology_is_primary_thread(unsigned int cpu) { return true; } static inline bool topology_smt_supported(void) { return false; } #endif diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 5726a3c9623e..2c897ad8b014 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -284,6 +284,7 @@ bool topology_is_primary_thread(unsigned int cpu) { return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); } +#define topology_is_primary_thread topology_is_primary_thread /** * topology_smt_supported - Check whether SMT is supported by the CPUs diff --git a/include/linux/topology.h b/include/linux/topology.h index 80d27d717631..3aa7a3ef6771 100644 --- a/include/linux/topology.h +++ b/include/linux/topology.h @@ -212,6 +212,30 @@ static inline const struct cpumask *cpu_smt_mask(int cpu) } #endif +#ifndef topology_is_primary_thread + +#define topology_is_primary_thread topology_is_primary_thread + +static inline bool topology_is_primary_thread(unsigned int cpu) +{ + /* + * When disabling SMT the primary thread of the SMT will remain + * enabled/active. Architectures do have a special primary thread + * (e.g. x86) needs to override this function. Otherwise can make + * the first thread in the SMT as the primary thread. + * + * The sibling cpumask of an offline CPU contains always the CPU + * itself for architectures using the implementation of + * CONFIG_GENERIC_ARCH_TOPOLOGY for building their topology. + * Other architectures not using CONFIG_GENERIC_ARCH_TOPOLOGY for + * building their topology have to check whether to use this default + * implementation or to override it. + */ + return cpu == cpumask_first(topology_sibling_cpumask(cpu)); +} + +#endif + static inline const struct cpumask *cpu_cpu_mask(int cpu) { return cpumask_of_node(cpu_to_node(cpu)); -- 2.33.0

1 14

[PATCH 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 16 Jul '25

16 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> commit 218a06a79d9a98a96ef46bb003d4d8adb0962056 upstream. The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

1 11

[PATCH 01/15] cpu/SMT: Provide a default topology_is_primary_thread()
by Qi Xi 16 Jul '25

16 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> commit 4b455f59945aab5610828a1320b045c82cbe8852 upstream. Currently if architectures want to support HOTPLUG_SMT they need to provide a topology_is_primary_thread() telling the framework which thread in the SMT cannot offline. However arm64 doesn't have a restriction on which thread in the SMT cannot offline, a simplest choice is that just make 1st thread as the "primary" thread. So just make this as the default implementation in the framework and let architectures like x86 that have special primary thread to override this function (which they've already done). There's no need to provide a stub function if !CONFIG_SMP or !CONFIG_HOTPLUG_SMT. In such case the testing CPU is already the 1st CPU in the SMT so it's always the primary thread. Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Reviewed-by: Pierre Gondois <pierre.gondois(a)arm.com> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Reviewed-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/topology.h | 1 - arch/x86/kernel/smpboot.c | 1 + include/linux/topology.h | 24 ++++++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 5b4f87329031..8bf8d5546e97 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -152,7 +152,6 @@ static inline int topology_phys_to_logical_die(unsigned int die, unsigned int cpu) { return 0; } static inline int topology_max_die_per_package(void) { return 1; } static inline int topology_max_smt_threads(void) { return 1; } -static inline bool topology_is_primary_thread(unsigned int cpu) { return true; } static inline bool topology_smt_supported(void) { return false; } #endif diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 5726a3c9623e..2c897ad8b014 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -284,6 +284,7 @@ bool topology_is_primary_thread(unsigned int cpu) { return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); } +#define topology_is_primary_thread topology_is_primary_thread /** * topology_smt_supported - Check whether SMT is supported by the CPUs diff --git a/include/linux/topology.h b/include/linux/topology.h index 80d27d717631..3aa7a3ef6771 100644 --- a/include/linux/topology.h +++ b/include/linux/topology.h @@ -212,6 +212,30 @@ static inline const struct cpumask *cpu_smt_mask(int cpu) } #endif +#ifndef topology_is_primary_thread + +#define topology_is_primary_thread topology_is_primary_thread + +static inline bool topology_is_primary_thread(unsigned int cpu) +{ + /* + * When disabling SMT the primary thread of the SMT will remain + * enabled/active. Architectures do have a special primary thread + * (e.g. x86) needs to override this function. Otherwise can make + * the first thread in the SMT as the primary thread. + * + * The sibling cpumask of an offline CPU contains always the CPU + * itself for architectures using the implementation of + * CONFIG_GENERIC_ARCH_TOPOLOGY for building their topology. + * Other architectures not using CONFIG_GENERIC_ARCH_TOPOLOGY for + * building their topology have to check whether to use this default + * implementation or to override it. + */ + return cpu == cpumask_first(topology_sibling_cpumask(cpu)); +} + +#endif + static inline const struct cpumask *cpu_cpu_mask(int cpu) { return cpumask_of_node(cpu_to_node(cpu)); -- 2.33.0

1 14