Re: [PATCH v8 3/3] riscv: store percpu offset into thread_info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing initialization of `pcpu_offset` in `arch_cpuhp_kick_ap_alive` causes secondary CPUs to use the boot CPU's per-cpu data during early boot, leading to memory corruption.
--

commit cfb659978a0a1c24330d1d94b1f3e36871d66657
Author: Yunhui Cui <cuiyunhui@bytedance.com>

riscv: store percpu offset into thread_info
    
RISC-V percpu addressing currently derives the base offset from the CPU
number and __per_cpu_offset[]. Cache the current CPU percpu offset in
thread_info so percpu accesses can load it directly. Keep the cached value
up to date for the boot CPU, context switches and secondary CPU bringup.

Link: https://lists.riscv.org/g/tech-privileged/topic/risc_v_tech_arch_review/113437553?page=2

> diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
> index f6ef57930b50a..7876854d16279 100644
> --- a/arch/riscv/kernel/smpboot.c
> +++ b/arch/riscv/kernel/smpboot.c

[ ... ]

> @@ -191,6 +191,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
>  {
>  	int ret;
>  	tidle->thread_info.cpu = cpu;
> +	tidle->thread_info.pcpu_offset = per_cpu_offset(cpu);
>  

[Severity: High]
Does this code also need to update arch_cpuhp_kick_ap_alive() for the
CONFIG_HOTPLUG_PARALLEL case?

If CONFIG_HOTPLUG_PARALLEL is enabled, secondary CPUs are booted via
arch_cpuhp_kick_ap_alive() instead of __cpu_up(). Because the idle thread
is forked from init_task, it inherits CPU 0's pcpu_offset.

Without initializing tidle->thread_info.pcpu_offset in
arch_cpuhp_kick_ap_alive(), the secondary CPU will start executing with
CPU 0's per-cpu offset.

Any per-cpu access before __my_cpu_offset is explicitly re-initialized
in smp_callin() will concurrently modify CPU 0's per-cpu state without
locking, which could lead to memory corruption.

>  	ret = start_secondary_cpu(cpu, tidle);
>  	if (!ret) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703122832.15984-1-cuiyunhui@bytedance.com?part=3