May 2026 - Crash-utility - Crash Utility List Archives

[PATCH] RISCV64: fix pmd address calculation in riscv64_vtop_4level_4k

by Rui Qi

Fix a bug in the PMD address calculation where the operator was incorrectly using '+' instead of '*'. This caused the PMD index to be added as an offset rather than multiplied by the entry size, resulting in incorrect page table traversal for 4-level 4KB paging. Signed-off-by: Rui Qi <qirui.001(a)bytedance.com> --- riscv64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/riscv64.c b/riscv64.c index ee9d4e321f6b..d1c7d4a36109 100644 --- a/riscv64.c +++ b/riscv64.c @@ -1241,7 +1241,7 @@ riscv64_vtop_4level_4k(ulong *pgd, ulong vaddr, physaddr_t *paddr, int verbose) /* PMD */ FILL_PMD(PAGEBASE(pmd_base), PHYSADDR, PAGESIZE()); - pmd_addr = pmd_base + sizeof(pmd_t) + pmd_index_l4_4k(vaddr); + pmd_addr = pmd_base + sizeof(pmd_t) * pmd_index_l4_4k(vaddr); pmd_val = ULONG(machdep->pmd + PAGEOFFSET(pmd_addr)); if (verbose) fprintf(fp, " PMD: %016lx => %016lx\n", pmd_addr, pmd_val); -- 2.20.1

4 months, 2 weeks

2
2
0 / 0

[PATCH] arm64: fix gdb register feeding for exception frames and stack switching

by Li Pengfei

From: lipengfei28 <lipengfei28(a)xiaomi.com> On ARM64, crash’s gdb bt relies on feeding a register snapshot (PC/SP/FP, etc.) into gdb and letting gdb unwind from there. Before this change, the register snapshot handling across exception frames / stack switching could be broken in several ways, leading to truncated backtraces, garbage substacks, or invalid addresses (e.g. -3 / 0xff...fd) showing up in gdb output. Fixes included in this patch: Fix out-of-bounds read when populating gdb registers from an exception frame In arm64_print_exception_frame(), the previous code copied sizeof(struct arm64_pt_regs) bytes from a smaller stackframe-derived buffer, which could read past valid data and poison the gdb registers. Replace this with explicit field/register assignment and initialize the bitmap accordingly. Improve unwinding across IRQ/overflow stack transitions on newer kernels When switching stacks (IRQ / overflow), gdb may stop at the trampoline (e.g. call_on_irq_stack) because the discontinuity prevents it from recovering the caller frame automatically. For UNW_4_14+, “peek” one frame ahead by reading the saved FP/PC from the current frame, and register that as the next gdb substack, so gdb can continue unwinding on the process stack. Avoid creating invalid/empty substacks Only add a gdb substack when the recovered PC is non-zero, preventing bogus threads from being created. This patch only changes ARM64 unwinding/register setup logic. It does not try to reformat or merge gdb output. Tested on: Android Linux 6.x, arm64 Signed-off-by: lipengfei28 <lipengfei28(a)xiaomi.com> --- arm64.c | 148 +++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 130 insertions(+), 18 deletions(-) diff --git a/arm64.c b/arm64.c index c125655..59fcda9 100644 --- a/arm64.c +++ b/arm64.c @@ -228,7 +228,7 @@ arm64_get_current_task_reg(int regno, const char *name, return FALSE; if (sid && sid <= extra_stacks_idx) { - ur_bitmap = extra_stacks_regs[extra_stacks_idx - 1]; + ur_bitmap = extra_stacks_regs[sid - 1]; goto get_sub; } @@ -3026,6 +3026,9 @@ static char *arm64_exception_functions[] = { "do_el0_irq_bp_hardening", "do_sp_pc_abort", "handle_bad_stack", + "el1h_64_sync", + "el1h_64_irq", + "el1h_64_error", NULL }; @@ -3123,6 +3126,11 @@ arm64_print_stackframe_entry(struct bt_info *bt, int level, struct arm64_stackfr fprintf(ofp, "\n"); + if (STREQ(name, "el1h_64_irq") || STREQ(name, "el1h_64_sync")) + if (arm64_is_kernel_exception_frame(bt, frame->sp)) { + arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } + if (bt->flags & BT_LINE_NUMBERS) { get_line_number(branch_pc, buf, FALSE); if (strlen(buf)) @@ -3775,11 +3783,13 @@ arm64_back_trace_cmd(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (bt->task != tt->panic_task) && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -3925,11 +3935,13 @@ arm64_back_trace_cmd_v2(struct bt_info *bt) REG_SEQ(arm64_pt_regs, pc)); SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, REG_SEQ(arm64_pt_regs, sp)); - if (!bt->machdep || + if (extra_stacks_regs[extra_stacks_idx]->ur.pc && + (bt->task != tt->panic_task) && + (!bt->machdep || (extra_stacks_regs[extra_stacks_idx]->ur.sp != ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { gdb_add_substack (extra_stacks_idx++); } } @@ -4232,6 +4244,46 @@ arm64_in_kdump_text_on_irq_stack(struct bt_info *bt) return FALSE; } +static void +arm64_gdb_add_next_frame_substack(struct bt_info *bt, const struct arm64_stackframe *frame) +{ + struct machine_specific *ms = machdep->machspec; + struct user_regs_bitmap_struct *ur_ptr; + ulong next_fp, next_pc, next_sp; + + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + next_fp = GET_STACK_ULONG(frame->fp); + next_pc = GET_STACK_ULONG(frame->fp + 8); + next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } +} + static int arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp) { @@ -4263,12 +4315,55 @@ arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + arm64_gdb_add_next_frame_substack(bt, frame); + } return KERNEL_MODE; } +static void +arm64_gdb_add_next_frame_substack(struct bt_info *bt, const struct arm64_stackframe *frame) +{ + struct machine_specific *ms = machdep->machspec; + struct user_regs_bitmap_struct *ur_ptr; + ulong next_fp, next_pc, next_sp; + + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + + memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); + ur_ptr = extra_stacks_regs[extra_stacks_idx]; + + next_fp = GET_STACK_ULONG(frame->fp); + next_pc = GET_STACK_ULONG(frame->fp + 8); + next_sp = frame->fp + 16; + + if (is_kernel_text(next_pc | ms->CONFIG_ARM64_KERNELPACMASK)) + next_pc |= ms->CONFIG_ARM64_KERNELPACMASK; + + ur_ptr->ur.pc = next_pc; + ur_ptr->ur.sp = next_sp; + ur_ptr->ur.regs[29] = next_fp; + + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, pc)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, sp)); + SET_BIT(ur_ptr->bitmap, REG_SEQ(arm64_pt_regs, regs[0]) + 29); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } +} + static int arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp) { @@ -4278,6 +4373,11 @@ arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *fr char buf[BUFSIZE]; struct machine_specific *ms = machdep->machspec; + if (!extra_stacks_regs[extra_stacks_idx]) { + extra_stacks_regs[extra_stacks_idx] = (struct user_regs_bitmap_struct *) + malloc(sizeof(struct user_regs_bitmap_struct)); + } + if (bt->flags & BT_FULL) { stacktop = ms->overflow_stacks[bt->tc->processor] + ms->overflow_stack_size; words = (stacktop - bt->bptr) / sizeof(ulong); @@ -4300,8 +4400,11 @@ arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *fr if (frame->fp == 0) return USER_MODE; - if (!(machdep->flags & UNW_4_14)) + if (!(machdep->flags & UNW_4_14)) { arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + } else { + arm64_gdb_add_next_frame_substack(bt, frame); + } return KERNEL_MODE; } @@ -4556,17 +4659,26 @@ arm64_print_exception_frame(struct bt_info *bt, ulong pt_regs, int mode, FILE *o } memset(extra_stacks_regs[extra_stacks_idx], 0, sizeof(struct user_regs_bitmap_struct)); - memcpy(&extra_stacks_regs[extra_stacks_idx]->ur, regs, - sizeof(struct arm64_pt_regs)); - for (int i = 0; i < sizeof(struct arm64_pt_regs)/sizeof(long); i++) - SET_BIT(extra_stacks_regs[extra_stacks_idx]->bitmap, i); - if (!bt->machdep || - (extra_stacks_regs[extra_stacks_idx]->ur.sp != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && - extra_stacks_regs[extra_stacks_idx]->ur.pc != - ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc)) { - gdb_add_substack (extra_stacks_idx++); - } + struct user_regs_bitmap_struct *ur_ptr = extra_stacks_regs[extra_stacks_idx]; + int i; + + ur_ptr->ur.pc = regs->pc; + ur_ptr->ur.sp = regs->sp; + ur_ptr->ur.pstate = regs->pstate; + for (i = 0; i < 31; i++) + ur_ptr->ur.regs[i] = regs->regs[i]; + + for (i = 0; i < 34; i++) + SET_BIT(ur_ptr->bitmap, i); + + if (ur_ptr->ur.pc && + (!bt->machdep || + (ur_ptr->ur.sp != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.sp && + ur_ptr->ur.pc != + ((struct user_regs_bitmap_struct *)(bt->machdep))->ur.pc))) { + gdb_add_substack(extra_stacks_idx++); + } } } -- 2.34.1

4 months, 2 weeks

3
7
0 / 0

[PATCH] Fix unwinding with 32k stacks in ppc64le

by Lucas Oakley

With commit 9c0b41e707a6 ("powerpc/64s: Increase default stack size to 32KB") in RHEL 9.4 ppc64le, the stack size was adjusted from 16k to 32k. As a result, ppc64_back_trace() can bail prematurely when checking if the stack pointer exists in the range of the range of the irq stacks, since SIZE(irq_ctx), used in ppc64_in_irqstack(), is set to 16k. This patch ensures that irq_ctx is updated to 32k if a 32k stack size is used. Tested against: el6 x86_64 el7 ppc64le s390x x86_64 el8 aarch64 ppc64le s390x x86_64 el9 aarch64 ppc64le s390x x86_64 el10 aarch64 ppc64le s390x x86_64 Without the commit: crash> bt -c 3 PID: 17524 TASK: c0000000b2c0e400 CPU: 3 COMMAND: "xyz" cannot find the stack info. With the commit: crash> bt -c 3 PID: 17524 TASK: c0000000b2c0e400 CPU: 3 COMMAND: "xyz" #0 [c000001dff7d7c10] smp_call_function_single_async at c00000000028dd38 #1 [c000001dff7d7d30] _raw_spin_lock_irqsave at c000000001023f1c #2 [c000001dff7d7d60] ibmvscsi_handle_crq at c0080000044635ec [ibmvscsi] #3 [c000001dff7d7de0] ibmvscsi_task at c008000004463804 [ibmvscsi] #4 [c000001dff7d7e30] tasklet_action_common.constprop.0 at c0000000001624cc #5 [c000001dff7d7e90] __do_softirq at c0000000010244cc #6 [c000001dff7d7f90] do_softirq_own_stack at c000000000016480 #7 [c000000140d67700] __irq_exit_rcu at c0000000001613b8 #8 [c000000140d67730] irq_exit at c000000000162170 #9 [c000000140d67750] do_IRQ at c000000000015fa4 #10 [c000000140d67780] hardware_interrupt_common_virt at c000000000009080 Hardware Interrupt [500] exception frame: R0: c000000001023de0 R1: c000000140d67a90 R2: c000000002c02500 R3: c00800000b30269c R4: 0000000000000001 R5: 0000000000000001 R6: ffffffffffffffff R7: 0000000000000000 R8: 0000000000000000 R9: fffffffffffe0000 R10: 0000000000000002 R11: 0000000048422824 R12: c000000001023d70 R13: c000001dffffd480 R14: 00007ffd6ef6d238 R15: 0000000000000028 R16: c000001dfc1e2280 R17: c000001dfc1e2280 R18: 00000000ab97fa48 R19: 0000000000000000 R20: 0000000000000001 R21: 0000001df9ff0000 R22: 0000000000000028 R23: c0000000021f2280 R24: 0000000000000000 R25: c0000000021f2280 R26: c0000000021f2380 R27: 0000000000000000 R28: c00800000b30269c R29: 0000000000000000 R30: c000000002c47190 R31: 000000000020000b NIP: c0000000000aea14 MSR: 800000000280b033 OR3: c0000000000ae944 CTR: c000000001023d70 LR: c000000001023de0 XER: 0000000020040001 CCR: 0000000088422824 MQ: 0000000000000000 DAR: 0000000000000001 DSISR: c0080000073b1e94 Syscall Result: 0000000000000000 [NIP : queued_spin_lock_slowpath+1204] [LR : _raw_spin_lock+112] #11 [c000000140d67a90] queued_spin_lock_slowpath at c0000000000aea14 #12 [c000000140d67bb0] _raw_spin_lock at c000000001023de0 (unreliable) #13 [c000000140d67bd0] dm_blk_close at c00800000b2c6850 [dm_mod] #14 [c000000140d67c00] blkdev_put_whole at c0000000007d2738 #15 [c000000140d67c30] bdev_release at c0000000007d3a38 #16 [c000000140d67c90] blkdev_release at c0000000007d4224 #17 [c000000140d67cb0] __fput at c0000000005d2e98 #18 [c000000140d67d00] task_work_run at c00000000018fb14 #19 [c000000140d67d50] do_notify_resume at c000000000020bd4 #20 [c000000140d67d80] interrupt_exit_user_prepare_main at c00000000002ed98 #21 [c000000140d67de0] syscall_exit_prepare at c00000000002f240 #22 [c000000140d67e10] system_call_vectored_common at c00000000000bff4 Signed-off-by: Lucas Oakley <soakley(a)redhat.com> --- task.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/task.c b/task.c index ec04b55..e8ed2b5 100644 --- a/task.c +++ b/task.c @@ -739,6 +739,18 @@ irqstacks_init(void) if (!(tt->softirq_tasks = (ulong *)calloc(NR_CPUS, sizeof(ulong)))) error(FATAL, "cannot malloc softirq_tasks space."); + /* + * RHEL 9.4.z adjusted the stack size from 16k to 32k for + * ppc64le only. We need to ensure that SIZE(irq_ctx) is + * correctly set so the unwinder doesn't prematurely bail + * when switching between the kernel stack and irq stacks. + * The stack size is updated in task_init(), which calls + * this routine, irqstacks_init() after checking for the + * existence of irq_ctx. + */ + if (STACKSIZE() > SIZE(irq_ctx)) + ASSIGN_SIZE(irq_ctx) = STACKSIZE(); + thread_info_buf = GETBUF(SIZE(irq_ctx)); if ((hard_sp = per_cpu_symbol_search("per_cpu__hardirq_ctx")) || -- 2.52.0

4 months, 2 weeks

2
2
0 / 0

[PATCH] Fix wrong detection of "[LIVEPATCH]" on old kernels

by HAGIO KAZUHITO(萩尾　一仁)

From: Kazuhito Hagio <k-hagio-ab(a)nec.com> The crash-utility wrongly prints "[LIVEPATCH]" occasionally on old kernels: KERNEL: vmlinux [LIVEPATCH] DUMPFILE: dump.d31 [PARTIAL DUMP] ... RELEASE: 2.6.24 In is_livepatch(), show_kernel_tains() does not set any value to buf on kernels that have the "tainted" symbol, so it's printed when the uninitialized buf has "K" by chance. On very old kernels, but this issue affects makedumpfile tests. Signed-off-by: Kazuhito Hagio <k-hagio-ab(a)nec.com> --- kernel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel.c b/kernel.c index 8781d6a22414..1e639ec6a007 100644 --- a/kernel.c +++ b/kernel.c @@ -5678,7 +5678,7 @@ is_livepatch(void) { int i; struct load_module *lm; - char buf[BUFSIZE]; + char buf[BUFSIZE] = {0}; show_kernel_taints(buf, !VERBOSE); if (strstr(buf, "K")) /* TAINT_LIVEPATCH */ -- 2.31.1

4 months, 2 weeks

2
2
0 / 0

[PATCH] Fix get_xtime() for kernel 6.17 and higher

by Aureau, Georges (Kernel Tools ERT)

On kernels 6.17 and higher, DATE is not displayed properly: crash> sys | grep -e DATE -e REL DATE: Wed Dec 31 18:00:00 CST 1969 RELEASE: 7.0.0-14-generic The function get_xtime() was enhanced to support: - kernel 6.17 ("shadow_timekeeper" moved to "tk_core") - kernel 7.0 ("tk_core" is now "timekeeper_data[0]). With this get_xtime() enhancement: crash> sys | grep DATE DATE: Mon Apr 27 09:19:50 CDT 2026 Signed-off-by: Georges Aureau <georges.aureau(a)hpe.com> -- defs.h | 1 + kernel.c | 19 ++++++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/defs.h b/defs.h index a6f4372..c07b9a2 100644 --- a/defs.h +++ b/defs.h @@ -2290,6 +2290,7 @@ struct offset_table { /* stash of commonly-used offsets */ long bpf_ringbuf_nr_pages; long hrtimer_clock_base_index; long klp_patch_list; + long tk_data_timekeeper; }; struct size_table { /* stash of commonly-used sizes */ diff --git a/kernel.c b/kernel.c index 8781d6a..d54e825 100644 --- a/kernel.c +++ b/kernel.c @@ -258,6 +258,7 @@ kernel_init() MEMBER_OFFSET_INIT(timekeeper_xtime, "timekeeper", "xtime"); MEMBER_OFFSET_INIT(timekeeper_xtime_sec, "timekeeper", "xtime_sec"); + MEMBER_OFFSET_INIT(tk_data_timekeeper, "tk_data", "timekeeper"); get_xtime(&kt->date); if (CRASHDEBUG(1)) fprintf(fp, "xtime timespec.tv_sec: %lx: %s\n", @@ -11134,7 +11135,23 @@ get_xtime(struct timespec *date) struct syment *sp; uint64_t xtime_sec; - if (VALID_MEMBER(timekeeper_xtime) && + if (VALID_MEMBER(tk_data_timekeeper) && + VALID_MEMBER(timekeeper_xtime_sec)) { + long offset = OFFSET(tk_data_timekeeper) + + OFFSET(timekeeper_xtime_sec); + if ((sp = kernel_symbol_search("timekeeper_data"))) { + readmem(sp->value + offset, KVADDR, + &xtime_sec, sizeof(uint64_t), + "timekeeper_data xtime_sec", RETURN_ON_ERROR); + date->tv_sec = (__time_t)xtime_sec; + } else if ((sp = kernel_symbol_search("tk_core"))) { + readmem(sp->value + offset, KVADDR, + &xtime_sec, sizeof(uint64_t), + "tk_core xtime_sec", RETURN_ON_ERROR); + date->tv_sec = (__time_t)xtime_sec; + } + } + else if (VALID_MEMBER(timekeeper_xtime) && (sp = kernel_symbol_search("timekeeper"))) { readmem(sp->value + OFFSET(timekeeper_xtime), KVADDR, date, sizeof(struct timespec),

4 months, 3 weeks

2
2
0 / 0

[PATCH v5 0/5] xarray: add large folio support

by Huang Shijie

The linux kernel supports the large folio for page cache by default. But the current CRASH does not support the large folio. So we may meet the errors when we detected the large folio sometimes, such as in the email: https://www.spinics.net/linux/fedora/redhat-crash-utility/msg11238.html ------------------------------ files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 0 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 10 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 20 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 30 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 40 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 50 files: page_to_nid: invalid page: 60 files: page_to_nid: invalid page: 60 ------------------------------ The patch 1 converts the ipcs.c to unix format. Please use following commands for patch 1: #git am 1.patch #git apply --reject 1.patch #git add -u #git am --continue The patches(2,3,4) are used to add large folio support for CRASH. The patch 5 is newly version of an old patch: it add "files -n" command. v4-->v5: Add a new patch to convert ipcs.c to unix format. Rebased the patch set again. v3-->v4: Fixes the BPF bug by: 1.) patch 1: Add a new type for do_xarray_info 2.) patch 3: Check XARRAY_TYPE_PAGE_CACHE for do_xarray_count()/do_xarray_dump()/do_xarray_dump_cb() v2-->v3: Rewrited the folio_order() in patch 2 to work with different kernel versions. v1-->v2: 1.) Rebase the kernel to later 7.0-rc1(merge window) 2.) Fixed a bug in the patch 3, the latest kernel supports folios whose page order is bigger then 5: "xarray: add large folio support" Huang Shijie (5): change to unix format for ipcs.c xarray: add a new parameter for do_xarray add folio_order function xarray: add large folio support add "files -n" command for an inode bpf.c | 8 +- defs.h | 14 +- dev.c | 4 +- diskdump.c | 10 +- filesys.c | 94 ++- help.c | 24 +- ipcs.c | 2325 ++++++++++++++++++++++++++-------------------------- kernel.c | 4 +- memory.c | 74 +- symbols.c | 6 + task.c | 4 +- tools.c | 16 +- 12 files changed, 1390 insertions(+), 1193 deletions(-) -- 2.43.0

4 months, 3 weeks

3
9
0 / 0

Re: [PATCH v5 3/5] add folio_order function

by Lianbo Jiang

On 3/18/26 8:24 PM, devel-request(a)lists.crash-utility.osci.io wrote: > Date: Wed, 18 Mar 2026 20:23:38 +0800 > From: Huang Shijie<huangsj(a)hygon.cn> > Subject: [Crash-utility] [PATCH v5 3/5] add folio_order function > To:<ltao(a)redhat.com>,<k-hagio-ab(a)nec.com>,<lijiang(a)redhat.com> > Cc:devel@lists.crash-utility.osci.io,zhongyuan@hygon.cn, > fangbaoshun@hygon.cn,yingzhiwei@hygon.cn,1537577747(a)qq.com, Huang > Shijie<huangsj(a)hygon.cn> > Message-ID:<20260318122340.53291-4-huangsj(a)hygon.cn> > Content-Type: text/plain > > The folio_order() was introduced to kernel at v5.16, but the first > large folio support patch is in v5.17: > 6795801366da "xfs: Support large folios" > > The folio_order() keeps the same logic as kernel code > in different versions: > 1.) In kernel v5.17, folio_order() uses page[1].compound_order to > get the folio order. > > 2.) In kernel v6.1, the following patch introduces _folio_order: > c3a15bff46cb5149 "mm: reimplement folio_order() and folio_nr_pages()" > > folio_order() uses _folio_order to get the folio order. > > 3.) In kernel v6.6, the following patch replaces the _folio_order with _flags_1: > ebc1baf5c9b46c22 "mm: free up a word in the first tail page" > > folio_order() uses _flags_1 to get the folio order. > > This patch will be used in later patches. > > Signed-off-by: Huang Shijie<huangsj(a)hygon.cn> > --- > defs.h | 8 +++++++ > memory.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ > symbols.c | 6 +++++ > 3 files changed, 84 insertions(+) > > diff --git a/defs.h b/defs.h > index 8f6784e..e832ea6 100644 > --- a/defs.h > +++ b/defs.h > @@ -2290,6 +2290,9 @@ struct offset_table { /* stash of commonly-used offsets */ > long bpf_ringbuf_nr_pages; > long hrtimer_clock_base_index; > long klp_patch_list; > + long page_compound_order; > + long folio__folio_order; > + long folio__flags_1; > }; > > struct size_table { /* stash of commonly-used sizes */ > @@ -2469,6 +2472,9 @@ struct size_table { /* stash of commonly-used sizes */ > long cpumask_t; > long task_struct_exit_state; > long bpf_ringbuf_map; > + long page_compound_order; > + long folio__folio_order; > + long folio__flags_1; > }; > > struct array_table { > @@ -6008,6 +6014,8 @@ ulong do_xarray(ulong, int, struct list_pair *, int); > #define XARRAY_TAG_MASK (3UL) > #define XARRAY_TAG_INTERNAL (2UL) > > +int folio_order(ulong folio); > + > int file_dump(ulong, ulong, ulong, int, int); > #define DUMP_FULL_NAME 0x1 > #define DUMP_INODE_ONLY 0x2 > diff --git a/memory.c b/memory.c > index 17423a5..3b272ad 100644 > --- a/memory.c > +++ b/memory.c > @@ -547,6 +547,13 @@ vm_init(void) > MEMBER_OFFSET_INIT(page_freelist, "page", "freelist"); > MEMBER_OFFSET_INIT(page_page_type, "page", "page_type"); > > + MEMBER_OFFSET_INIT(page_compound_order, "page", "compound_order"); > + MEMBER_SIZE_INIT(page_compound_order, "page", "compound_order"); > + MEMBER_OFFSET_INIT(folio__folio_order, "folio", "_folio_order"); > + MEMBER_SIZE_INIT(folio__folio_order, "folio", "_folio_order"); > + MEMBER_OFFSET_INIT(folio__flags_1, "folio", "_flags_1"); > + MEMBER_SIZE_INIT(folio__flags_1, "folio", "_flags_1"); > + > MEMBER_OFFSET_INIT(mm_struct_pgd, "mm_struct", "pgd"); > > MEMBER_OFFSET_INIT(swap_info_struct_swap_file, > @@ -20426,6 +20433,69 @@ static unsigned int oo_objects(ulong oo) > return (oo & ((1 << 16) - 1)); > } > > +/* > + * The folio_order() was introduced to kernel at v5.16, but the first > + * large folio support patch is in v5.17: > + * 6795801366da "xfs: Support large folios" > + * > + * 1.) In kernel v5.17, folio_order() uses page[1].compound_order to > + * get the folio order. > + * > + * 2.) In kernel v6.1, the following patch introduces _folio_order: > + * c3a15bff46cb5149 "mm: reimplement folio_order() and folio_nr_pages()" > + * > + * folio_order() uses _folio_order to get the folio order. > + * > + * 3.) In kernel v6.6, the following patch replaces the _folio_order with _flags_1: > + * ebc1baf5c9b46c22 "mm: free up a word in the first tail page" > + * > + * folio_order() uses _flags_1 to get the folio order. > + */ For this check condition, It's not very good to use kernel version. Let's investigate if there is a better way to handle this issue. Lianbo > +int > +folio_order(ulong folio) > +{ > + ulong v = 0; > + int PG_head = 16; > + > + if (THIS_KERNEL_VERSION < LINUX(5,17,0)) > + return 0; > + > + if (THIS_KERNEL_VERSION < LINUX(6,1,0)) { > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + SIZE(page) + OFFSET(page_compound_order), KVADDR, &v, > + SIZE(page_compound_order), "page[1].compound_order", FAULT_ON_ERROR); > + > + return v; > + } else if (THIS_KERNEL_VERSION < LINUX(6,6,0)) { > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + OFFSET(folio__folio_order), KVADDR, &v, > + SIZE(folio__folio_order), "folio->_folio_order", FAULT_ON_ERROR); > + > + return v; > + } else { > + /* The PG_head changes to bit 6 at kernel v6.6 */ > + PG_head = 6; > + > + readmem(folio + OFFSET(page_flags), KVADDR, &v, sizeof(ulong), > + "folio.page.flags", FAULT_ON_ERROR); > + if (!(v & (1 << PG_head))) > + return 0; > + > + readmem(folio + OFFSET(folio__flags_1), KVADDR, &v, > + SIZE(folio__flags_1), "folio->_flags_1", FAULT_ON_ERROR); > + > + return v & 0xff; > + } > +} > + > #ifdef NOT_USED > ulong > slab_to_kmem_cache_node(struct meminfo *si, ulong slab_page) > diff --git a/symbols.c b/symbols.c > index e6865ca..08c07e9 100644 > --- a/symbols.c > +++ b/symbols.c > @@ -10451,6 +10451,9 @@ dump_offset_table(char *spec, ulong makestruct) > fprintf(fp, " page_private: %ld\n", OFFSET(page_private)); > fprintf(fp, " page_page_type: %ld\n", > OFFSET(page_page_type)); > + fprintf(fp, " page_compound_order: %ld\n", OFFSET(page_compound_order)); > + fprintf(fp, " folio__folio_order: %ld\n", OFFSET(folio__folio_order)); > + fprintf(fp, " folio__flags_1: %ld\n", OFFSET(folio__flags_1)); > > fprintf(fp, " trace_print_flags_mask: %ld\n", > OFFSET(trace_print_flags_mask)); > @@ -11961,6 +11964,9 @@ dump_offset_table(char *spec, ulong makestruct) > fprintf(fp, "\n size_table:\n"); > fprintf(fp, " page: %ld\n", SIZE(page)); > fprintf(fp, " page_flags: %ld\n", SIZE(page_flags)); > + fprintf(fp, " page_compound_order: %ld\n", SIZE(page_compound_order)); > + fprintf(fp, " folio__folio_order: %ld\n", SIZE(folio__folio_order)); > + fprintf(fp, " folio__flags_1: %ld\n", SIZE(folio__flags_1)); > fprintf(fp, " trace_print_flags: %ld\n", SIZE(trace_print_flags)); > fprintf(fp, " free_area_struct: %ld\n", > SIZE(free_area_struct)); > -- 2.43.0

4 months, 3 weeks

3
7
0 / 0

[PATCH 0/1] struct: add -F source-file scoping for duplicate datatype names

by chahuan

When different source files define same-name struct/union tags, crash may resolve an unintended candidate because default type lookup depends on symbol lookup order/context. This series adds `struct/union -F <file_name>` to constrain datatype lookup to the compilation-unit scope matched by the requested source file. For example, this avoids ambiguity for duplicate tags such as `arm_smmu_device` defined in both `arm-smmu.c` and `arm-smmu-v3.c`. Implementation summary: - Parse `-F` in `struct`/`union` command path and propagate `source_file` in gdb requests. - In gdb-side patch code, map source file -> unique scope block (`objfile -> compunit -> filetabs -> blockvector`), prefer `STATIC_BLOCK` and fallback to `GLOBAL_BLOCK`. - Apply the scope temporarily for the request and restore previous scope automatically afterward. - If file match is missing or ambiguous, fail explicitly instead of choosing a random candidate. - Note: `-F` may add a small lookup-time overhead due to extra scope scanning and symbol-table expansion needed for deterministic file-scoped matching. Compatibility: - Existing behavior is unchanged when `-F` is not used. - Existing `STRUCT_SIZE/MEMBER_OFFSET/...` call paths remain compatible. - For external/plugin callers that need file-scoped lookup with minimal changes, expose two helper APIs: - `char *set_temporary_datatype_filename(const char *source_file);` - `void restore_datatype_filename(char *saved_source_file);` chahuan (1): struct: add -F source-file scoping for duplicate datatype names cmdline.c | 1 + defs.h | 4 ++ gdb-16.2.patch | 166 ++++++++++++++++++++++++++++++++++++++++++++++-- gdb_interface.c | 6 ++ help.c | 8 ++- symbols.c | 31 ++++++++- 6 files changed, 206 insertions(+), 10 deletions(-) -- 2.43.0

4 months, 3 weeks

2
8
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Crash-utility May 2026