April 2026 - Crash-utility - Crash Utility List Archives

[PATCH] arm64: Fix broken/incomplete gdb backtrace and unify output format

by lipengfei28＠xiaomi.com

From 4d832a33ebd80bd109cc5a47f98c6b35fdcbd956 Mon Sep 17 00:00:00 2001 From: lipengfei28 <lipengfei28(a)xiaomi.com> Date: Fri, 23 Jan 2026 16:24:07 +0800 Subject: [PATCH] arm64: Fix broken/incomplete gdb backtrace and unify output format This patch fixes multiple issues with 'gdb bt' on ARM64, where the backtrace would be interrupted, contain garbage threads, or display fragmented output. 1. Fix Out-of-Bounds Read in Exception Frame Handling: In `arm64_print_exception_frame`, the code previously used `memcpy` to copy `sizeof(struct arm64_pt_regs)` bytes from a `struct arm64_stackframe *` source. Since `stackframe` is significantly smaller than `pt_regs`, this caused an out-of-bounds read, populating the GDB thread registers with stack garbage (often resulting in invalid addresses like -3/0xff...fd). This is fixed by manually copying only the valid registers (PC, SP, FP, etc.) and properly initializing the bitmap. 2. Bridge the Gap Between IRQ and Process Stacks: Previously, GDB unwinding would stop at `call_on_irq_stack` because it could not automatically unwind through the assembly trampoline back to the process stack. Modified `arm64_switch_stack` (and the overflow variant) to "peek" one frame ahead (reading the saved FP/PC of the caller) before registering the new GDB substack. This effectively bridges the discontinuity, allowing GDB to show frames like `do_interrupt_handler` that were previously missing. 3. Unify and Format GDB Output: Modified `gdb_interface.c` to: - Strip "Thread <id>" headers to present a continuous backtrace similar to the native `crash bt`. - Renumber stack frames sequentially (e.g., #0 to #30) instead of resetting at each stack switch. - Add indentation/alignment for frames where GDB omits the address (e.g., inline functions) to improve readability. 4. Prevent Invalid Thread Creation: Added checks to ensure a GDB substack is only created if the Program Counter (PC) is non-zero, preventing the display of "corrupt" or empty threads. Tested on: Android 6.x ARM64 Signed-off-by: lipengfei28 <lipengfei28(a)xiaomi.com> --- arm64.c | 117 +++++++++++++++++++++++++++++++++++++------ gdb_interface.c | 130 +++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 229 insertions(+), 18 deletions(-) diff --git a/arm64.c b/arm64.c index c125655..f842739 100644 --- a/arm64.c +++ b/arm64.c @@ -3026,6 +3026,9 @@ static char *arm64_exception_functions[] = { "do_el0_irq_bp_hardening", "do_sp_pc_abort", "handle_bad_stack", + "el1h_64_sync", + "el1h_64_irq", + "el1h_64_error", NULL }; @@ -3123,6 +3126,11 @@ arm64_print_stackframe_entry(struct bt_info *bt, int level, struct arm64_stackfr fprintf(ofp, "\n"); + if (STREQ(name, "el1h_64_irq") || STREQ(name, "el1h_64_sync")) + if (arm64_is_kernel_exception_frame(bt, frame->sp)) { + arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } + if (bt->flags & BT_LINE_NUMBERS) { get_line_number(branch_pc, buf, FALSE); if (strlen(buf)) @@ -3775,11 +3783,12 @@ arm64_back_trace_cmd(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -3925,11 +3934,12 @@ arm64_back_trace_cmd_v2(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -4263,8 +4273,40 @@ arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + struct user_regs_bitmap_struct *ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + ulong next_fp = GET_STACK_ULONG(frame->fp); + ulong next_pc = GET_STACK_ULONG(frame->fp + 8); + ulong next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack (extra_stacks_idx++); + } + } return KERNEL_MODE; } @@ -4300,8 +4342,40 @@ arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *fr if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + struct user_regs_bitmap_struct *ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + ulong next_fp = GET_STACK_ULONG(frame->fp); + ulong next_pc = GET_STACK_ULONG(frame->fp + 8); + ulong next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack (extra_stacks_idx++); + } + } return KERNEL_MODE; } @@ -4556,16 +4630,27 @@ arm64_print_exception_frame(struct bt_info *bt, ulong pt_regs, int mode, FILE *o } memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); - memcpy(&extra_stacks_regs[extra_stacks_idx]->ur, regs, - sizeof(struct arm64_pt_regs)); - for (int i = 0; i < sizeof(struct arm64_pt_regs)/sizeof(long); i++) - SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, i); - if (!bt->machdep || - (extra_stacks_regs[extra_stacks_idx]->ur.sp != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && - extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { - gdb_add_substack (extra_stacks_idx++); + { + struct user_regs_bitmap_struct *ur_ptr = extra_stacks_regs[extra_stacks_idx]; + int i; + + ur_ptr->ur.pc = regs->pc; + ur_ptr->ur.sp = regs->sp; + ur_ptr->ur.pstate = regs->pstate; + for (i = 0; i < 31; i++) + ur_ptr->ur.regs[i] = regs->regs[i]; + + for (i = 0; i < 34; i++) + SET_BIT(ur_ptr->bitmap, i); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack (extra_stacks_idx++); + } } } } diff --git a/gdb_interface.c b/gdb_interface.c index 9f76f85..d14144e 100644 --- a/gdb_interface.c +++ b/gdb_interface.c @@ -16,6 +16,7 @@ */ #include "defs.h" +#include <ctype.h> #if !defined(GDB_10_2) && !defined(GDB_16_2) static void exit_after_gdb_info(void); @@ -779,22 +780,53 @@ strip_redirection(char *buf) /* * Command for passing strings directly to gdb. */ +static void format_and_print_gdb_bt(FILE *input_fp); + void cmd_gdb(void) { char buf[BUFSIZE]; char **argv; + int i; argv = STREQ(args[0], "gdb") ? &args[1] : &args[0]; if (*argv == NULL) cmd_usage(pc->curcmd, SYNOPSIS); + if (STREQ(*argv, "bt")) { + FILE *tmp_fp; + + if ((tmp_fp = tmpfile()) == NULL) { + error(FATAL, "cannot create temporary file for GDB output\n"); + } + + strcpy(buf, "thread apply all bt"); + /* Append any arguments that were passed to 'bt' */ + /* args[0] is "gdb", args[1] is "bt", so options start at index 2 */ + for (i = 2; i < argcnt; i++) { + strcat(buf, " "); + strcat(buf, args[i]); + } + + if (!gdb_pass_through(buf, tmp_fp, GNU_RETURN_ON_ERROR)) { + fclose(tmp_fp); + error(INFO, "gdb request failed: %s\n", buf); + return; + } + + rewind(tmp_fp); + format_and_print_gdb_bt(tmp_fp); + + fclose(tmp_fp); + return; + } + if (STREQ(*argv, "set") && argv[1]) { /* * Intercept set commands in case something has to be done - * here or elsewhere. - */ + * here or elsewhere. + */ if (STREQ(argv[1], "gdb")) { cmd_set(); return; @@ -821,6 +853,100 @@ cmd_gdb(void) } } +#define MAX_BT_LINES 1024 +#define MAX_THREAD_BLOCKS 64 + +/* + * Helper function to parse 'thread apply all bt' output, reverse the + * thread blocks, and print the result. + */ +static void format_and_print_gdb_bt(FILE *input_fp) +{ + char *lines[MAX_BT_LINES]; + int line_count = 0; + int thread_starts[MAX_THREAD_BLOCKS]; + int thread_count = 0; + char line_buffer[BUFSIZE]; + int i, j; + int global_frame_cnt = 0; + + // Read all lines into memory + while (fgets(line_buffer, BUFSIZE, input_fp) && line_count < MAX_BT_LINES) { + if (strstr(line_buffer, "Thread ") == line_buffer) { + if (thread_count < MAX_THREAD_BLOCKS) { + thread_starts[thread_count++] = line_count; + } + } + lines[line_count] = strdup(line_buffer); + if (!lines[line_count]) { + error(FATAL, "strdup failed while reading gdb output\n"); + } + line_count++; + } + + if (thread_count == 0) { // If no threads, just print everything as is. + for (i = 0; i < line_count; i++) { + fputs(lines[i], fp); + } + } else { + // Iterate threads in reverse order to fix the display order + for (i = thread_count - 1; i >= 0; i--) { + int start_line = thread_starts[i]; + int end_line = (i == thread_count - 1) ? line_count : thread_starts[i+1]; + + // Print thread frames, stripping header and renumbering + for (j = start_line; j < end_line; j++) { + char *line = lines[j]; + // Skip "Thread " line + if (strncmp(line, "Thread ", 7) == 0) continue; + // Skip "Backtrace stopped" or similar noise if desired, + // but usually GDB prints "Backtrace stopped" at the very end. + // We'll keep it for info unless it's in the middle of our merge. + // Actually, duplicate frames or stops might appear. + // For now, simple renumbering. + + char *ptr = line; + while (*ptr == ' ' || *ptr == '\t') ptr++; + + if (*ptr == '#') { + // Frame line: #0 0x... + char *rest = ptr + 1; + while (isdigit(*rest)) rest++; // Skip old number + + // Parse content to check for address + char *p = rest; + while (*p == ' ' || *p == '\t') p++; + + int has_addr = (strncmp(p, "0x", 2) == 0); + + // Print number + fprintf(fp, "#%-3d", global_frame_cnt++); + + // Align if address is missing + if (!has_addr) { + // Align function name with frames that have addresses + // 64-bit: 0x... (18 chars) + " in " (4 chars) = 22 chars + // 32-bit: 0x... (10 chars) + " in " (4 chars) = 14 chars + int width = (machdep->bits == 64) ? 22 : 14; + for (int k = 0; k < width; k++) fputc(' ', fp); + } + + fputs(rest, fp); + } else { + // Other lines (e.g. variable info, code) + fputs(line, fp); + } + } + } + } + + // Cleanup + for (i = 0; i < line_count; i++) { + free(lines[i]); + } +} + + /* * The gdb target_xfer_memory() has a hook installed to re-route * all memory accesses back here; reads of 1 or 4 bytes come primarily -- 2.34.1

1 week, 1 day

2
1
0 / 0

[PATCH] Support module memory layout change on linux 6.18

by yangshiguang1011＠163.com

From: yangshiguang <yangshiguang(a)xiaomi.com> Support module memory layout change on linux 6.18 by kernel commit b4760ff ("module: deprecate usage of *_gpl sections in module loader")[1]. Without the patch, crash cannot start a session with an error message like this: crash: invalid structure member offset: module_num_gpl_syms FILE: kernel.c LINE: 3834 FUNCTION: module_init() [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?... Signed-off-by: yangshiguang <yangshiguang(a)xiaomi.com> --- kernel.c | 5 +++-- symbols.c | 18 ++++++++++++++---- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/kernel.c b/kernel.c index 8781d6a..786eb73 100644 --- a/kernel.c +++ b/kernel.c @@ -3830,8 +3830,9 @@ module_init(void) nsyms = UINT(modbuf + OFFSET(module_nsyms)); break; case KMOD_V2: - nsyms = UINT(modbuf + OFFSET(module_num_syms)) + - UINT(modbuf + OFFSET(module_num_gpl_syms)); + nsyms = UINT(modbuf + OFFSET(module_num_syms)); + if (VALID_MEMBER(module_num_gpl_syms)) + nsyms += UINT(modbuf + OFFSET(module_num_gpl_syms)); break; } diff --git a/symbols.c b/symbols.c index e6865ca..189fe3e 100644 --- a/symbols.c +++ b/symbols.c @@ -1976,9 +1976,14 @@ store_module_symbols_6_4(ulong total, int mods_installed) "module buffer", FAULT_ON_ERROR); syms = ULONG(modbuf + OFFSET(module_syms)); - gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); nsyms = UINT(modbuf + OFFSET(module_num_syms)); - ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + if (VALID_MEMBER(module_gpl_syms) && VALID_MEMBER(module_num_gpl_syms)) { + gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); + ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + } else { + gpl_syms = 0; + ngplsyms = 0; + } nksyms = UINT(modbuf + OFFSET(module_num_symtab)); @@ -2336,9 +2341,14 @@ store_module_symbols_v2(ulong total, int mods_installed) "module buffer", FAULT_ON_ERROR); syms = ULONG(modbuf + OFFSET(module_syms)); - gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); nsyms = UINT(modbuf + OFFSET(module_num_syms)); - ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + if (VALID_MEMBER(module_gpl_syms) && VALID_MEMBER(module_num_gpl_syms)) { + gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); + ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + } else { + gpl_syms = 0; + ngplsyms = 0; + } if (THIS_KERNEL_VERSION >= LINUX(2,6,27)) { nksyms = UINT(modbuf + OFFSET(module_num_symtab)); -- 2.43.0

2 weeks, 1 day

2
1
0 / 0

[PATCH] RISCV64: introduce riscv64_VTOP() and riscv64_PTOV()

by Austin Kim

The VTOP and PTOV macros are typically implemented using architecture-specific functions to improve maintainability and debugging capabilities. This patch moves the RISCV64-specific VTOP/PTOV logic from inline macros in defs.h to dedicated functions in riscv64.c. This refactoring makes the code easier to understand and provides a better location for adding future debugging or validation checks. No functional changes are introduced by this patch. Signed-off-by: Austin Kim <austindh.kim(a)gmail.com> --- defs.h | 14 ++++---------- riscv64.c | 24 ++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 10 deletions(-) diff --git a/defs.h b/defs.h index a6f4372..54f1725 100644 --- a/defs.h +++ b/defs.h @@ -3803,16 +3803,8 @@ typedef signed int s32; /* * Direct memory mapping */ -#define PTOV(X) \ - (((unsigned long)(X)+(machdep->kvbase)) - machdep->machspec->phys_base) -#define VTOP(X) ({ \ - ulong _X = X; \ - (THIS_KERNEL_VERSION >= LINUX(5,13,0) && \ - (_X) >= machdep->machspec->kernel_link_addr) ? \ - ((unsigned long)(_X)-(machdep->machspec->va_kernel_pa_offset)): \ - (((unsigned long)(_X)-(machdep->kvbase)) + \ - machdep->machspec->phys_base); \ - }) +#define PTOV(X) riscv64_PTOV((ulong)(X)) +#define VTOP(X) riscv64_VTOP((ulong)(X)) #define PAGEBASE(X) (((ulong)(X)) & (ulong)machdep->pagemask) /* @@ -7211,6 +7203,8 @@ void riscv64_display_regs_from_elf_notes(int, FILE *); void riscv64_init(int); void riscv64_dump_machdep_table(ulong); int riscv64_IS_VMALLOC_ADDR(ulong); +ulong riscv64_PTOV(ulong); +ulong riscv64_VTOP(ulong); #define display_idt_table() \ error(FATAL, "-d option is not applicable to RISCV64 architecture\n") diff --git a/riscv64.c b/riscv64.c index eceae70..3aee827 100644 --- a/riscv64.c +++ b/riscv64.c @@ -1606,6 +1606,30 @@ riscv64_uvtop(struct task_context *tc, ulong uvaddr, physaddr_t *paddr, int verb } } +ulong riscv64_PTOV(ulong paddr) +{ + ulong vaddr; + ulong offset = paddr - machdep->machspec->phys_base; + + vaddr = offset + machdep->kvbase; + + return vaddr; +} + +ulong +riscv64_VTOP(ulong addr) +{ + ulong paddr; + + if ( (THIS_KERNEL_VERSION >= LINUX(5,13,0)) && + (addr >= machdep->machspec->kernel_link_addr)) + paddr = (addr - (machdep->machspec->va_kernel_pa_offset)); + else + paddr = (addr - (ulong)machdep->kvbase + machdep->machspec->phys_base); + + return paddr; +} + static int riscv64_kvtop(struct task_context *tc, ulong kvaddr, physaddr_t *paddr, int verbose) { -- 2.34.1

2 weeks, 5 days

2
5
0 / 0

[RESEND PATCH v1 1/1] symbols: Add support for mod symtab with combined GPL and non-GPL symbols

by Alexander Egorenkov

The commit b4760ff2a5e4 ("module: deprecate usage of *_gpl sections in module loader") eliminated separate GPL symbol sections representing GPL only symbols. Therefore, depending on whether the member gpl_syms is present in struct module, decide whether GPL module symbols are separated or not. https://lore.kernel.org/all/20260326-kflagstab-v5-4-fa0796fe88d9@google.com Signed-off-by: Alexander Egorenkov <egorenar(a)linux.ibm.com> --- kernel.c | 13 ++++++++----- symbols.c | 9 +++++++-- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/kernel.c b/kernel.c index 8781d6a22414..35e6fd61f077 100644 --- a/kernel.c +++ b/kernel.c @@ -3634,9 +3634,11 @@ module_init(void) case KMOD_V2: MEMBER_OFFSET_INIT(module_num_syms, "module", "num_syms"); MEMBER_OFFSET_INIT(module_list, "module", "list"); - MEMBER_OFFSET_INIT(module_gpl_syms, "module", "gpl_syms"); - MEMBER_OFFSET_INIT(module_num_gpl_syms, "module", - "num_gpl_syms"); + if (MEMBER_EXISTS("module", "gpl_syms")) { + MEMBER_OFFSET_INIT(module_gpl_syms, "module", "gpl_syms"); + MEMBER_OFFSET_INIT(module_num_gpl_syms, "module", + "num_gpl_syms"); + } if (MEMBER_EXISTS("module", "mem")) { /* 6.4 and later */ kt->flags2 |= KMOD_MEMORY; /* MODULE_MEMORY() can be used. */ @@ -3830,8 +3832,9 @@ module_init(void) nsyms = UINT(modbuf + OFFSET(module_nsyms)); break; case KMOD_V2: - nsyms = UINT(modbuf + OFFSET(module_num_syms)) + - UINT(modbuf + OFFSET(module_num_gpl_syms)); + nsyms = UINT(modbuf + OFFSET(module_num_syms)); + if (VALID_MEMBER(module_num_gpl_syms)) + nsyms += UINT(modbuf + OFFSET(module_num_gpl_syms)); break; } diff --git a/symbols.c b/symbols.c index e6865cabef74..7b00e26ab0cf 100644 --- a/symbols.c +++ b/symbols.c @@ -1976,9 +1976,14 @@ store_module_symbols_6_4(ulong total, int mods_installed) "module buffer", FAULT_ON_ERROR); syms = ULONG(modbuf + OFFSET(module_syms)); - gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); nsyms = UINT(modbuf + OFFSET(module_num_syms)); - ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + if (VALID_MEMBER(module_gpl_syms)) { + gpl_syms = ULONG(modbuf + OFFSET(module_gpl_syms)); + ngplsyms = UINT(modbuf + OFFSET(module_num_gpl_syms)); + } else { + gpl_syms = 0; + ngplsyms = 0; + } nksyms = UINT(modbuf + OFFSET(module_num_symtab)); -- 2.51.0

3 weeks

2
3
0 / 0

[PATCH] arm64: fix gdb register feeding for exception frames and stack switching

by Li Pengfei

From: lipengfei28 <lipengfei28(a)xiaomi.com> On ARM64, crash’s gdb bt relies on feeding a register snapshot (PC/SP/FP, etc.) into gdb and letting gdb unwind from there. Before this change, the register snapshot handling across exception frames / stack switching could be broken in several ways, leading to truncated backtraces, garbage substacks, or invalid addresses (e.g. -3 / 0xff...fd) showing up in gdb output. Fixes included in this patch: Fix out-of-bounds read when populating gdb registers from an exception frame In arm64_print_exception_frame(), the previous code copied sizeof(struct arm64_pt_regs) bytes from a smaller stackframe-derived buffer, which could read past valid data and poison the gdb registers. Replace this with explicit field/register assignment and initialize the bitmap accordingly. Improve unwinding across IRQ/overflow stack transitions on newer kernels When switching stacks (IRQ / overflow), gdb may stop at the trampoline (e.g. call_on_irq_stack) because the discontinuity prevents it from recovering the caller frame automatically. For UNW_4_14+, “peek” one frame ahead by reading the saved FP/PC from the current frame, and register that as the next gdb substack, so gdb can continue unwinding on the process stack. Avoid creating invalid/empty substacks Only add a gdb substack when the recovered PC is non-zero, preventing bogus threads from being created. This patch only changes ARM64 unwinding/register setup logic. It does not try to reformat or merge gdb output. Tested on: Android Linux 6.x, arm64 Signed-off-by: lipengfei28 <lipengfei28(a)xiaomi.com> --- arm64.c | 148 +++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 130 insertions(+), 18 deletions(-) diff --git a/arm64.c b/arm64.c index c125655..59fcda9 100644 --- a/arm64.c +++ b/arm64.c @@ -228,7 +228,7 @@ arm64_get_current_task_reg(int regno, const char *name, return FALSE; if (sid && sid <= extra_stacks_idx) { - ur_bitmap = extra_stacks_regs[extra_stacks_idx - 1]; + ur_bitmap = extra_stacks_regs[sid - 1]; goto get_sub; } @@ -3026,6 +3026,9 @@ static char *arm64_exception_functions[] = { "do_el0_irq_bp_hardening", "do_sp_pc_abort", "handle_bad_stack", + "el1h_64_sync", + "el1h_64_irq", + "el1h_64_error", NULL }; @@ -3123,6 +3126,11 @@ arm64_print_stackframe_entry(struct bt_info *bt, int level, struct arm64_stackfr fprintf(ofp, "\n"); + if (STREQ(name, "el1h_64_irq") || STREQ(name, "el1h_64_sync")) + if (arm64_is_kernel_exception_frame(bt, frame->sp)) { + arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } + if (bt->flags & BT_LINE_NUMBERS) { get_line_number(branch_pc, buf, FALSE); if (strlen(buf)) @@ -3775,11 +3783,13 @@ arm64_back_trace_cmd(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (bt->task != tt->panic_task) && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -3925,11 +3935,13 @@ arm64_back_trace_cmd_v2(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (bt->task != tt->panic_task) && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -4232,6 +4244,46 @@ arm64_in_kdump_text_on_irq_stack(struct bt_info *bt) return FALSE; } +static void +arm64_gdb_add_next_frame_substack(struct bt_info *bt, const struct arm64_stackframe *frame) +{ + struct machine_specific *ms = machdep->machspec; + struct user_regs_bitmap_struct *ur_ptr; + ulong next_fp, next_pc, next_sp; + + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + next_fp = GET_STACK_ULONG(frame->fp); + next_pc = GET_STACK_ULONG(frame->fp + 8); + next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } +} + static int arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp) { @@ -4263,12 +4315,55 @@ arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + arm64_gdb_add_next_frame_substack(bt, frame); + } return KERNEL_MODE; } +static void +arm64_gdb_add_next_frame_substack(struct bt_info *bt, const struct arm64_stackframe *frame) +{ + struct machine_specific *ms = machdep->machspec; + struct user_regs_bitmap_struct *ur_ptr; + ulong next_fp, next_pc, next_sp; + + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + next_fp = GET_STACK_ULONG(frame->fp); + next_pc = GET_STACK_ULONG(frame->fp + 8); + next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } +} + static int arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp) { @@ -4278,6 +4373,11 @@ arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *fr char buf[BUFSIZE]; struct machine_specific *ms = machdep->machspec; + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + if (bt->flags & BT_FULL) { stacktop = ms->overflow_stacks[bt->tc->processor] + ms->overflow_stack_size; words = (stacktop - bt->bptr) / sizeof(ulong); @@ -4300,8 +4400,11 @@ arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *fr if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + arm64_gdb_add_next_frame_substack(bt, frame); + } return KERNEL_MODE; } @@ -4556,17 +4659,26 @@ arm64_print_exception_frame(struct bt_info *bt, ulong pt_regs, int mode, FILE *o } memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); - memcpy(&extra_stacks_regs[extra_stacks_idx]->ur, regs, - sizeof(struct arm64_pt_regs)); - for (int i = 0; i < sizeof(struct arm64_pt_regs)/sizeof(long); i++) - SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, i); - if (!bt->machdep || - (extra_stacks_regs[extra_stacks_idx]->ur.sp != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && - extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { - gdb_add_substack (extra_stacks_idx++); - } + struct user_regs_bitmap_struct *ur_ptr = extra_stacks_regs[extra_stacks_idx]; + int i; + + ur_ptr->ur.pc = regs->pc; + ur_ptr->ur.sp = regs->sp; + ur_ptr->ur.pstate = regs->pstate; + for (i = 0; i < 31; i++) + ur_ptr->ur.regs[i] = regs->regs[i]; + + for (i = 0; i < 34; i++) + SET_BIT(ur_ptr->bitmap, i); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } } } -- 2.34.1

3 weeks

3
7
0 / 0

[PATCH] Fix wrong detection of "[LIVEPATCH]" on old kernels

by HAGIO KAZUHITO(萩尾　一仁)

From: Kazuhito Hagio <k-hagio-ab(a)nec.com> The crash-utility wrongly prints "[LIVEPATCH]" occasionally on old kernels: KERNEL: vmlinux [LIVEPATCH] DUMPFILE: dump.d31 [PARTIAL DUMP] ... RELEASE: 2.6.24 In is_livepatch(), show_kernel_tains() does not set any value to buf on kernels that have the "tainted" symbol, so it's printed when the uninitialized buf has "K" by chance. On very old kernels, but this issue affects makedumpfile tests. Signed-off-by: Kazuhito Hagio <k-hagio-ab(a)nec.com> --- kernel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel.c b/kernel.c index 8781d6a22414..1e639ec6a007 100644 --- a/kernel.c +++ b/kernel.c @@ -5678,7 +5678,7 @@ is_livepatch(void) { int i; struct load_module *lm; - char buf[BUFSIZE]; + char buf[BUFSIZE] = {0}; show_kernel_taints(buf, !VERBOSE); if (strstr(buf, "K")) /* TAINT_LIVEPATCH */ -- 2.31.1

3 weeks

2
2
0 / 0

[PATCH] Fix get_xtime() for kernel 6.17 and higher

by Aureau, Georges (Kernel Tools ERT)

On kernels 6.17 and higher, DATE is not displayed properly: crash> sys | grep -e DATE -e REL DATE: Wed Dec 31 18:00:00 CST 1969 RELEASE: 7.0.0-14-generic The function get_xtime() was enhanced to support: - kernel 6.17 ("shadow_timekeeper" moved to "tk_core") - kernel 7.0 ("tk_core" is now "timekeeper_data[0]). With this get_xtime() enhancement: crash> sys | grep DATE DATE: Mon Apr 27 09:19:50 CDT 2026 Signed-off-by: Georges Aureau <georges.aureau(a)hpe.com> -- defs.h | 1 + kernel.c | 19 ++++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/defs.h b/defs.h index a6f4372..c07b9a2 100644 --- a/defs.h +++ b/defs.h @@ -2290,6 +2290,7 @@ struct offset_table { /* stash of commonly-used offsets */ long bpf_ringbuf_nr_pages; long hrtimer_clock_base_index; long klp_patch_list; + long tk_data_timekeeper; }; struct size_table { /* stash of commonly-used sizes */ diff --git a/kernel.c b/kernel.c index 8781d6a..d54e825 100644 --- a/kernel.c +++ b/kernel.c @@ -258,6 +258,7 @@ kernel_init() MEMBER_OFFSET_INIT(timekeeper_xtime, "timekeeper", "xtime"); MEMBER_OFFSET_INIT(timekeeper_xtime_sec, "timekeeper", "xtime_sec"); + MEMBER_OFFSET_INIT(tk_data_timekeeper, "tk_data", "timekeeper"); get_xtime(&kt->date); if (CRASHDEBUG(1)) fprintf(fp, "xtime timespec.tv_sec: %lx: %s\n", @@ -11134,7 +11135,23 @@ get_xtime(struct timespec *date) struct syment *sp; uint64_t xtime_sec; - if (VALID_MEMBER(timekeeper_xtime) && + if (VALID_MEMBER(tk_data_timekeeper) && + VALID_MEMBER(timekeeper_xtime_sec)) { + long offset = OFFSET(tk_data_timekeeper) + + OFFSET(timekeeper_xtime_sec); + if ((sp = kernel_symbol_search("timekeeper_data"))) { + readmem(sp->value + offset, KVADDR, + &xtime_sec, sizeof(uint64_t), + "timekeeper_data xtime_sec", RETURN_ON_ERROR); + date->tv_sec = (__time_t)xtime_sec; + } else if ((sp = kernel_symbol_search("tk_core"))) { + readmem(sp->value + offset, KVADDR, + &xtime_sec, sizeof(uint64_t), + "tk_core xtime_sec", RETURN_ON_ERROR); + date->tv_sec = (__time_t)xtime_sec; + } + } + else if (VALID_MEMBER(timekeeper_xtime) && (sp = kernel_symbol_search("timekeeper"))) { readmem(sp->value + OFFSET(timekeeper_xtime), KVADDR, date, sizeof(struct timespec),

3 weeks, 5 days

2
2
0 / 0

[PATCH v2] Fix unwinding with 32k stacks in ppc64le RHEL 9.4

by Lucas Oakley

In RHEL 9.4 ppc64le, the stack size was adjusted from 16k to 32k. As a result, ppc64_back_trace() can bail prematurely when checking if the stack pointer exists in the range of the range of the irq stacks, since SIZE(irq_ctx), used in ppc64_in_irqstack(), is set to 16k. This patch ensures that irq_ctx is updated to 32k if a 32k stack size is used. Tested against: el6 x86_64 el7 ppc64le s390x x86_64 el8 aarch64 ppc64le s390x x86_64 el9 aarch64 ppc64le s390x x86_64 el10 aarch64 ppc64le s390x x86_64 Without the commit: crash> bt -c 3 PID: 17524 TASK: c0000000b2c0e400 CPU: 3 COMMAND: "xyz" cannot find the stack info. With the commit: crash> bt -c 3 PID: 17524 TASK: c0000000b2c0e400 CPU: 3 COMMAND: "xyz" #0 [c000001dff7d7c10] smp_call_function_single_async at c00000000028dd38 #1 [c000001dff7d7d30] _raw_spin_lock_irqsave at c000000001023f1c #2 [c000001dff7d7d60] ibmvscsi_handle_crq at c0080000044635ec [ibmvscsi] #3 [c000001dff7d7de0] ibmvscsi_task at c008000004463804 [ibmvscsi] #4 [c000001dff7d7e30] tasklet_action_common.constprop.0 at c0000000001624cc #5 [c000001dff7d7e90] __do_softirq at c0000000010244cc #6 [c000001dff7d7f90] do_softirq_own_stack at c000000000016480 #7 [c000000140d67700] __irq_exit_rcu at c0000000001613b8 #8 [c000000140d67730] irq_exit at c000000000162170 #9 [c000000140d67750] do_IRQ at c000000000015fa4 #10 [c000000140d67780] hardware_interrupt_common_virt at c000000000009080 Hardware Interrupt [500] exception frame: R0: c000000001023de0 R1: c000000140d67a90 R2: c000000002c02500 R3: c00800000b30269c R4: 0000000000000001 R5: 0000000000000001 R6: ffffffffffffffff R7: 0000000000000000 R8: 0000000000000000 R9: fffffffffffe0000 R10: 0000000000000002 R11: 0000000048422824 R12: c000000001023d70 R13: c000001dffffd480 R14: 00007ffd6ef6d238 R15: 0000000000000028 R16: c000001dfc1e2280 R17: c000001dfc1e2280 R18: 00000000ab97fa48 R19: 0000000000000000 R20: 0000000000000001 R21: 0000001df9ff0000 R22: 0000000000000028 R23: c0000000021f2280 R24: 0000000000000000 R25: c0000000021f2280 R26: c0000000021f2380 R27: 0000000000000000 R28: c00800000b30269c R29: 0000000000000000 R30: c000000002c47190 R31: 000000000020000b NIP: c0000000000aea14 MSR: 800000000280b033 OR3: c0000000000ae944 CTR: c000000001023d70 LR: c000000001023de0 XER: 0000000020040001 CCR: 0000000088422824 MQ: 0000000000000000 DAR: 0000000000000001 DSISR: c0080000073b1e94 Syscall Result: 0000000000000000 [NIP : queued_spin_lock_slowpath+1204] [LR : _raw_spin_lock+112] #11 [c000000140d67a90] queued_spin_lock_slowpath at c0000000000aea14 #12 [c000000140d67bb0] _raw_spin_lock at c000000001023de0 (unreliable) #13 [c000000140d67bd0] dm_blk_close at c00800000b2c6850 [dm_mod] #14 [c000000140d67c00] blkdev_put_whole at c0000000007d2738 #15 [c000000140d67c30] bdev_release at c0000000007d3a38 #16 [c000000140d67c90] blkdev_release at c0000000007d4224 #17 [c000000140d67cb0] __fput at c0000000005d2e98 #18 [c000000140d67d00] task_work_run at c00000000018fb14 #19 [c000000140d67d50] do_notify_resume at c000000000020bd4 #20 [c000000140d67d80] interrupt_exit_user_prepare_main at c00000000002ed98 #21 [c000000140d67de0] syscall_exit_prepare at c00000000002f240 #22 [c000000140d67e10] system_call_vectored_common at c00000000000bff4 Signed-off-by: Lucas Oakley <soakley(a)redhat.com> --- task.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/task.c b/task.c index ec04b55..a398a8d 100644 --- a/task.c +++ b/task.c @@ -739,6 +739,18 @@ irqstacks_init(void) if (!(tt->softirq_tasks = (ulong *)calloc(NR_CPUS, sizeof(ulong)))) error(FATAL, "cannot malloc softirq_tasks space."); + /* + * RHEL 9.4.z adjusted the stack size from 16k to 32k for + * ppc64le only. We need to ensure that SIZE(irq_ctx) is + * correctly set so the unwinder doesn't prematurely bail + * when switching between the kernel stack and irq stacks. + * The stack size is updated in task_init(), which calls + * this routine, irqstacks_init() after checking for the + * existence of irq_ctx. + */ + if ((SIZE(irq_ctx) != -1) && (STACKSIZE() > SIZE(irq_ctx))) + ASSIGN_SIZE(irq_ctx) = STACKSIZE(); + thread_info_buf = GETBUF(SIZE(irq_ctx)); if ((hard_sp = per_cpu_symbol_search("per_cpu__hardirq_ctx")) || -- 2.52.0

3 weeks, 6 days

2
2
0 / 0

[PATCH v5 0/5] xarray: add large folio support

by Huang Shijie

The linux kernel supports the large folio for page cache by default. But the current CRASH does not support the large folio. So we may meet the errors when we detected the large folio sometimes, such as in the email: https://www.spinics.net/linux/fedora/redhat-crash-utility/msg11238.html ------------------------------ files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 60 files: page_to_nid: invalid page: 60 ------------------------------ The patch 1 converts the ipcs.c to unix format. Please use following commands for patch 1: #git am 1.patch #git apply --reject 1.patch #git add -u #git am --continue The patches(2,3,4) are used to add large folio support for CRASH. The patch 5 is newly version of an old patch: it add "files -n" command. v4-->v5: Add a new patch to convert ipcs.c to unix format. Rebased the patch set again. v3-->v4: Fixes the BPF bug by: 1.) patch 1: Add a new type for do_xarray_info 2.) patch 3: Check XARRAY_TYPE_PAGE_CACHE for do_xarray_count()/do_xarray_dump()/do_xarray_dump_cb() v2-->v3: Rewrited the folio_order() in patch 2 to work with different kernel versions. v1-->v2: 1.) Rebase the kernel to later 7.0-rc1(merge window) 2.) Fixed a bug in the patch 3, the latest kernel supports folios whose page order is bigger then 5: "xarray: add large folio support" Huang Shijie (5): change to unix format for ipcs.c xarray: add a new parameter for do_xarray add folio_order function xarray: add large folio support add "files -n" command for an inode bpf.c | 8 +- defs.h | 14 +- dev.c | 4 +- diskdump.c | 10 +- filesys.c | 94 ++- help.c | 24 +- ipcs.c | 2325 ++++++++++++++++++++++++++-------------------------- kernel.c | 4 +- memory.c | 74 +- symbols.c | 6 + task.c | 4 +- tools.c | 16 +- 12 files changed, 1390 insertions(+), 1193 deletions(-) -- 2.43.0

3 weeks, 6 days

3
9
0 / 0

Re: [PATCH v5 3/5] add folio_order function

by Lianbo Jiang

On 3/18/26 8:24 PM, devel-request(a)lists.crash-utility.osci.io wrote: > Date: Wed, 18 Mar 2026 20:23:38 +0800 > From: Huang Shijie<huangsj(a)hygon.cn> > Subject: [Crash-utility] [PATCH v5 3/5] add folio_order function > To:<ltao(a)redhat.com>,<k-hagio-ab(a)nec.com>,<lijiang(a)redhat.com> > Cc:devel@lists.crash-utility.osci.io,zhongyuan@hygon.cn, > fangbaoshun@hygon.cn,yingzhiwei@hygon.cn,1537577747(a)qq.com, Huang > Shijie<huangsj(a)hygon.cn> > Message-ID:<20260318122340.53291-4-huangsj(a)hygon.cn> > Content-Type: text/plain > > The folio_order() was introduced to kernel at v5.16, but the first > large folio support patch is in v5.17: > 6795801366da "xfs: Support large folios" > > The folio_order() keeps the same logic as kernel code > in different versions: > 1.) In kernel v5.17, folio_order() uses page[1].compound_order to > get the folio order. > > 2.) In kernel v6.1, the following patch introduces _folio_order: > c3a15bff46cb5149 "mm: reimplement folio_order() and folio_nr_pages()" > > folio_order() uses _folio_order to get the folio order. > > 3.) In kernel v6.6, the following patch replaces the _folio_order with _flags_1: > ebc1baf5c9b46c22 "mm: free up a word in the first tail page" > > folio_order() uses _flags_1 to get the folio order. > > This patch will be used in later patches. > > Signed-off-by: Huang Shijie<huangsj(a)hygon.cn> > --- > defs.h | 8 +++++++ > memory.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ > symbols.c | 6 +++++ > 3 files changed, 84 insertions(+) > > diff --git a/defs.h b/defs.h > index 8f6784e..e832ea6 100644 > --- a/defs.h > +++ b/defs.h > @@ -2290,6 +2290,9 @@ struct offset_table { /* stash of commonly-used offsets */ > long bpf_ringbuf_nr_pages; > long hrtimer_clock_base_index; > long klp_patch_list; > + long page_compound_order; > + long folio__folio_order; > + long folio__flags_1; > }; > > struct size_table { /* stash of commonly-used sizes */ > @@ -2469,6 +2472,9 @@ struct size_table { /* stash of commonly-used sizes */ > long cpumask_t; > long task_struct_exit_state; > long bpf_ringbuf_map; > + long page_compound_order; > + long folio__folio_order; > + long folio__flags_1; > }; > > struct array_table { > @@ -6008,6 +6014,8 @@ ulong do_xarray(ulong, int, struct list_pair *, int); > #define XARRAY_TAG_MASK (3UL) > #define XARRAY_TAG_INTERNAL (2UL) > > +int folio_order(ulong folio); > + > int file_dump(ulong, ulong, ulong, int, int); > #define DUMP_FULL_NAME 0x1 > #define DUMP_INODE_ONLY 0x2 > diff --git a/memory.c b/memory.c > index 17423a5..3b272ad 100644 > --- a/memory.c > +++ b/memory.c > @@ -547,6 +547,13 @@ vm_init(void) > MEMBER_OFFSET_INIT(page_freelist, "page", "freelist"); > MEMBER_OFFSET_INIT(page_page_type, "page", "page_type"); > > + MEMBER_OFFSET_INIT(page_compound_order, "page", "compound_order"); > + MEMBER_SIZE_INIT(page_compound_order, "page", "compound_order"); > + MEMBER_OFFSET_INIT(folio__folio_order, "folio", "_folio_order"); > + MEMBER_SIZE_INIT(folio__folio_order, "folio", "_folio_order"); > + MEMBER_OFFSET_INIT(folio__flags_1, "folio", "_flags_1"); > + MEMBER_SIZE_INIT(folio__flags_1, "folio", "_flags_1"); > + > MEMBER_OFFSET_INIT(mm_struct_pgd, "mm_struct", "pgd"); > > MEMBER_OFFSET_INIT(swap_info_struct_swap_file, > @@ -20426,6 +20433,69 @@ static unsigned int oo_objects(ulong oo) > return (oo & ((1 << 16) - 1)); > } > > +/* > + * The folio_order() was introduced to kernel at v5.16, but the first > + * large folio support patch is in v5.17: > + * 6795801366da "xfs: Support large folios" > + * > + * 1.) In kernel v5.17, folio_order() uses page[1].compound_order to > + * get the folio order. > + * > + * 2.) In kernel v6.1, the following patch introduces _folio_order: > + * c3a15bff46cb5149 "mm: reimplement folio_order() and folio_nr_pages()" > + * > + * folio_order() uses _folio_order to get the folio order. > + * > + * 3.) In kernel v6.6, the following patch replaces the _folio_order with _flags_1: > + * ebc1baf5c9b46c22 "mm: free up a word in the first tail page" > + * > + * folio_order() uses _flags_1 to get the folio order. > + */ For this check condition, It's not very good to use kernel version. Let's investigate if there is a better way to handle this issue. Lianbo > +int > +folio_order(ulong folio) > +{ > + ulong v = 0; > + int PG_head = 16; > + > + if (THIS_KERNEL_VERSION < LINUX(5,17,0)) > + return 0; > + > + if (THIS_KERNEL_VERSION < LINUX(6,1,0)) { > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + SIZE(page) + OFFSET(page_compound_order), KVADDR, &v, > + SIZE(page_compound_order), "page[1].compound_order", FAULT_ON_ERROR); > + > + return v; > + } else if (THIS_KERNEL_VERSION < LINUX(6,6,0)) { > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + OFFSET(folio__folio_order), KVADDR, &v, > + SIZE(folio__folio_order), "folio->_folio_order", FAULT_ON_ERROR); > + > + return v; > + } else { > + /* The PG_head changes to bit 6 at kernel v6.6 */ > + PG_head = 6; > + > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + OFFSET(folio__flags_1), KVADDR, &v, > + SIZE(folio__flags_1), "folio->_flags_1", FAULT_ON_ERROR); > + > + return v & 0xff; > + } > +} > + > #ifdef NOT_USED > ulong > slab_to_kmem_cache_node(struct meminfo *si, ulong slab_page) > diff --git a/symbols.c b/symbols.c > index e6865ca..08c07e9 100644 > --- a/symbols.c > +++ b/symbols.c > @@ -10451,6 +10451,9 @@ dump_offset_table(char *spec, ulong makestruct) > fprintf(fp, " page_private: %ld\n", OFFSET(page_private)); > fprintf(fp, " page_page_type: %ld\n", > OFFSET(page_page_type)); > + fprintf(fp, " page_compound_order: %ld\n", OFFSET(page_compound_order)); > + fprintf(fp, " folio__folio_order: %ld\n", OFFSET(folio__folio_order)); > + fprintf(fp, " folio__flags_1: %ld\n", OFFSET(folio__flags_1)); > > fprintf(fp, " trace_print_flags_mask: %ld\n", > OFFSET(trace_print_flags_mask)); > @@ -11961,6 +11964,9 @@ dump_offset_table(char *spec, ulong makestruct) > fprintf(fp, "\n size_table:\n"); > fprintf(fp, " page: %ld\n", SIZE(page)); > fprintf(fp, " page_flags: %ld\n", SIZE(page_flags)); > + fprintf(fp, " page_compound_order: %ld\n", SIZE(page_compound_order)); > + fprintf(fp, " folio__folio_order: %ld\n", SIZE(folio__folio_order)); > + fprintf(fp, " folio__flags_1: %ld\n", SIZE(folio__flags_1)); > fprintf(fp, " trace_print_flags: %ld\n", SIZE(trace_print_flags)); > fprintf(fp, " free_area_struct: %ld\n", > SIZE(free_area_struct)); > -- 2.43.0

3 weeks, 6 days

3
7
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Crash-utility April 2026