* [PATCH v6 1/4] arm64: vdso: Prepare for robust futex unlock support
2026-07-20 16:03 [PATCH v6 0/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
@ 2026-07-20 16:03 ` André Almeida
2026-07-20 16:03 ` [PATCH v6 2/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: André Almeida @ 2026-07-20 16:03 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Thomas Gleixner, Mark Rutland,
Mathieu Desnoyers, Sebastian Andrzej Siewior, Peter Zijlstra,
Florian Weimer, Darren Hart, Ingo Molnar, Davidlohr Bueso,
Arnd Bergmann, Uros Bizjak, Thomas Weißschuh
Cc: linux-arm-kernel, linux-kernel, linux-arch, kernel-dev, LKML,
André Almeida
To solve the robust futex's list_pending_op clearing race condition,
prepare for implement __vdso_futex_robust_try_unlock() for arm64 with the
following steps:
- Create a helper function that sets the struct futex_mm_data with the
VDSO's labels addresses. The robust futex fixup mechanism needs to
compare the current instruction pointer to the VDSO instructions range.
- Split vdso_mremap() in vdso_mremap() and aarch32_mremap(), this allows
the VDSO to be setup correctly regarding the instructions addresses for
both ABIs when a mremap happens.
- Implement arch_futex_robust_unlock_get_pop() for arm64, checking for r2
and r3 registers values for the fixup function. The role of this registers
is explained in the commit that implement the assembly portion of the VDSO.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
v6:
- Restructured this commit. Move the arch bits away, kept just the
generic/helper functions.
v4:
- Guard symbols from vdso.lds.S with ifdef
- drop update_ips() from sigpage remap function
v3:
- Fix adding vdso base addr twice
- Call vdso_futex_robust_unlock_update_ips() on remap as well
v2:
- Fixed linker not finding VDSO symbols
---
---
arch/arm64/include/asm/futex_robust.h | 19 +++++++++++++++++++
arch/arm64/kernel/vdso.c | 27 ++++++++++++++++++++++++++-
2 files changed, 45 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/futex_robust.h b/arch/arm64/include/asm/futex_robust.h
new file mode 100644
index 000000000000..4ff783bb2dc3
--- /dev/null
+++ b/arch/arm64/include/asm/futex_robust.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM64_FUTEX_ROBUST_H
+#define _ASM_ARM64_FUTEX_ROBUST_H
+
+#include <asm/ptrace.h>
+
+static __always_inline void __user *arm64_futex_robust_unlock_get_pop(struct pt_regs *regs)
+{
+ /*
+ * w3 stores the result of the stlxr instruction. If it's zero, the then
+ * the ll/sc cmpxchg succeeded and the pending op pointer needs to be cleared.
+ */
+ return (regs->user_regs.regs[3]) ? NULL : (void __user *) regs->user_regs.regs[2];
+}
+
+#define arch_futex_robust_unlock_get_pop(regs) \
+ arm64_futex_robust_unlock_get_pop(regs)
+
+#endif /* _ASM_ARM64_FUTEX_ROBUST_H */
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 592dd8668de4..3ef331b5b240 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -11,6 +11,7 @@
#include <linux/clocksource.h>
#include <linux/elf.h>
#include <linux/err.h>
+#include <linux/futex.h>
#include <linux/errno.h>
#include <linux/gfp.h>
#include <linux/kernel.h>
@@ -57,6 +58,22 @@ static struct vdso_abi_info vdso_info[] __ro_after_init = {
#endif /* CONFIG_COMPAT_VDSO */
};
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+static inline void __vdso_futex_update_ips(struct mm_struct *mm, bool is_32bit, void *startp,
+ void *endp)
+{
+ unsigned long start = (unsigned long) startp;
+ unsigned long end = (unsigned long) endp;
+ struct futex_mm_data *fd = &mm->futex;
+
+ futex_set_vdso_cs_range(fd, is_32bit ? 1 : 0, start, end, is_32bit);
+}
+
+#else
+static inline void __vdso_futex_update_ips(struct mm_struct *mm, bool is_32bit, void *startp,
+ void *endp)
+#endif /* CONFIG_FUTEX_ROBUST_UNLOCK */
+
static int vdso_mremap(const struct vm_special_mapping *sm,
struct vm_area_struct *new_vma)
{
@@ -162,6 +179,14 @@ static int aarch32_sigpage_mremap(const struct vm_special_mapping *sm,
return 0;
}
+static int aarch32_mremap(const struct vm_special_mapping *sm,
+ struct vm_area_struct *new_vma)
+{
+ current->mm->context.vdso = (void *)new_vma->vm_start;
+
+ return 0;
+}
+
static struct vm_special_mapping aarch32_vdso_maps[] = {
[AA32_MAP_VECTORS] = {
.name = "[vectors]", /* ABI */
@@ -174,7 +199,7 @@ static struct vm_special_mapping aarch32_vdso_maps[] = {
},
[AA32_MAP_VDSO] = {
.name = "[vdso]",
- .mremap = vdso_mremap,
+ .mremap = aarch32_mremap,
},
};
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v6 2/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock()
2026-07-20 16:03 [PATCH v6 0/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
2026-07-20 16:03 ` [PATCH v6 1/4] arm64: vdso: Prepare for robust futex unlock support André Almeida
@ 2026-07-20 16:03 ` André Almeida
2026-07-20 16:03 ` [PATCH v6 3/4] arm64: vdso32: Bring vdso32-offsets.h back André Almeida
2026-07-20 16:03 ` [PATCH v6 4/4] arm64: vdso32: Implement __vdso_futex_robust_try_unlock() André Almeida
3 siblings, 0 replies; 6+ messages in thread
From: André Almeida @ 2026-07-20 16:03 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Thomas Gleixner, Mark Rutland,
Mathieu Desnoyers, Sebastian Andrzej Siewior, Peter Zijlstra,
Florian Weimer, Darren Hart, Ingo Molnar, Davidlohr Bueso,
Arnd Bergmann, Uros Bizjak, Thomas Weißschuh
Cc: linux-arm-kernel, linux-kernel, linux-arch, kernel-dev, LKML,
André Almeida
The futex's robust list uAPI has a struct robust_list_head::list_op_pending
pointer used by userspace as a temporary variable while the mutex unlock is
happening. User sets it to the futex address that's about to be released
and removed from the robust list, and list_op_pending is cleared after.
After a thread dies, the kernel checks it's list_op_pending and wakes the
mutex in that address, to prevent starvation, and flip a bit in the mutex
word (FUTEX_OWNER_DIED).
However, there's a critical section where the user thread dies after the
mutex is released but before list_op_pending is cleared. If that happens,
another thread can wake up, use the lock, release it, and free its
memory. Now, if the robust list cleanup happens after this, the
killed thread's list_op_pending becomes a dandling pointer. The
kernel wrongly treats this address as a mutex, calls a futex_wake()
on it and flips a bit, causing a memory corruption.
To avoid using the dangling pointer, implement
__vdso_futex_robust_try_unlock() for arm64. Make the VDSO release the mutex
and clear the list_op_pending fields, just as is done in userspace right
now. But having it in a VDSO means that, in the case of a killed user
thread, the kernel can know exactly in which part of the release process
the thread was interrupt, check the registers for the operation success and
clears the list_op_pending on behalf of the user thread to prevent the
use-after-free bug.
The need for checking the instructions addresses and the register makes
this mechanism arch-dependent. Implement it using LL/SC semantics. If the
user instruction pointer is between the labels
__futex_list64_try_unlock_cs_start and __futex_list64_try_unlock_cs_end,
the critical section was interrupted. The kernel checks for the result
register (always w3) of the stlxr instruction used for atomically releasing
the mutex. If it's 1, the release happened and the kernel should clear the
list_op_pending field (always stored at x2).
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
v6:
- Complete reword of commit message to make it clear
- Better commit split, only the specific aarch64 things here
- Use explicity labels instead of macros
v4:
- Guard makefile for vfutex.o with ifdef
- Moved _start label one instruction above
- Use results register (w3) to check for store success instead of using zero
flag
v3:
- Managed to get pop to always be stored at x2
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/vdso.c | 13 +++++++++++++
arch/arm64/kernel/vdso/Makefile | 10 ++++++++++
arch/arm64/kernel/vdso/vdso.lds.S | 9 +++++++++
arch/arm64/kernel/vdso/vfutex.c | 35 +++++++++++++++++++++++++++++++++++
5 files changed, 68 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b3afe0688919..0582172811d9 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -221,6 +221,7 @@ config ARM64
select HAVE_RELIABLE_STACKTRACE
select HAVE_POSIX_CPU_TIMERS_TASK_WORK
select HAVE_FUNCTION_ARG_ACCESS_API
+ select HAVE_FUTEX_ROBUST_UNLOCK
select MMU_GATHER_RCU_TABLE_FREE
select HAVE_RSEQ
select HAVE_RUST if RUSTC_SUPPORTS_ARM64
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 3ef331b5b240..1d1633e8339b 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -74,11 +74,22 @@ static inline void __vdso_futex_update_ips(struct mm_struct *mm, bool is_32bit,
void *endp)
#endif /* CONFIG_FUTEX_ROBUST_UNLOCK */
+static inline void vdso_futex_update_ips(struct mm_struct *mm)
+{
+ unsigned long vdso = (unsigned long) mm->context.vdso;
+
+ __vdso_futex_update_ips(mm, false,
+ VDSO_SYMBOL(vdso, futex_list64_try_unlock_cs_start),
+ VDSO_SYMBOL(vdso, futex_list64_try_unlock_cs_end));
+}
+
static int vdso_mremap(const struct vm_special_mapping *sm,
struct vm_area_struct *new_vma)
{
current->mm->context.vdso = (void *)new_vma->vm_start;
+ vdso_futex_update_ips(current->mm);
+
return 0;
}
@@ -366,5 +377,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
ret = __setup_additional_pages(VDSO_ABI_AA64, mm, bprm, uses_interp);
mmap_write_unlock(mm);
+ vdso_futex_update_ips(mm);
+
return ret;
}
diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
index 7dec05dd33b7..985346c7a0bb 100644
--- a/arch/arm64/kernel/vdso/Makefile
+++ b/arch/arm64/kernel/vdso/Makefile
@@ -11,6 +11,10 @@ include $(srctree)/lib/vdso/Makefile.include
obj-vdso := vgettimeofday.o note.o sigreturn.o vgetrandom.o vgetrandom-chacha.o
+ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+ obj-vdso += vfutex.o
+endif
+
# Build rules
targets := $(obj-vdso) vdso.so vdso.so.dbg
obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
@@ -45,9 +49,11 @@ CC_FLAGS_ADD_VDSO := -O2 -mcmodel=tiny -fasynchronous-unwind-tables
CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_REMOVE_VDSO)
CFLAGS_REMOVE_vgetrandom.o = $(CC_FLAGS_REMOVE_VDSO)
+CFLAGS_REMOVE_vfutex.o = $(CC_FLAGS_REMOVE_VDSO)
CFLAGS_vgettimeofday.o = $(CC_FLAGS_ADD_VDSO)
CFLAGS_vgetrandom.o = $(CC_FLAGS_ADD_VDSO)
+CFLAGS_vfutex.o = $(CC_FLAGS_ADD_VDSO)
ifneq ($(c-gettimeofday-y),)
CFLAGS_vgettimeofday.o += -include $(c-gettimeofday-y)
@@ -57,6 +63,10 @@ ifneq ($(c-getrandom-y),)
CFLAGS_vgetrandom.o += -include $(c-getrandom-y)
endif
+ifneq ($(c-futex-y),)
+ CFLAGS_vfutex.o += -include $(c-futex-y)
+endif
+
targets += vdso.lds
CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
diff --git a/arch/arm64/kernel/vdso/vdso.lds.S b/arch/arm64/kernel/vdso/vdso.lds.S
index 52314be29191..225f59bb81d1 100644
--- a/arch/arm64/kernel/vdso/vdso.lds.S
+++ b/arch/arm64/kernel/vdso/vdso.lds.S
@@ -104,6 +104,9 @@ VERSION
__kernel_clock_gettime;
__kernel_clock_getres;
__kernel_getrandom;
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+ __vdso_futex_robust_list64_try_unlock;
+#endif
local: *;
};
}
@@ -112,3 +115,9 @@ VERSION
* Make the sigreturn code visible to the kernel.
*/
VDSO_sigtramp = __kernel_rt_sigreturn;
+
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+VDSO_futex_list64_try_unlock_cs_start = __futex_list64_try_unlock_cs_start;
+VDSO_futex_list64_try_unlock_cs_success = __futex_list64_try_unlock_cs_success;
+VDSO_futex_list64_try_unlock_cs_end = __futex_list64_try_unlock_cs_end;
+#endif
diff --git a/arch/arm64/kernel/vdso/vfutex.c b/arch/arm64/kernel/vdso/vfutex.c
new file mode 100644
index 000000000000..83efd5e5896f
--- /dev/null
+++ b/arch/arm64/kernel/vdso/vfutex.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#include <linux/stringify.h>
+#include <vdso/futex.h>
+
+__u32 __vdso_futex_robust_list64_try_unlock(__u32 *lock, __u32 tid, __u64 *pop)
+{
+ register __u64 *pop_reg asm("x2") = pop;
+ register __u32 result_reg asm("w3") = 0;
+ __u32 val;
+
+ asm volatile (
+ ".globl "
+ "__futex_list64_try_unlock_cs_start, "
+ "__futex_list64_try_unlock_cs_success, "
+ "__futex_list64_try_unlock_cs_end \n"
+
+ " prfm pstl1strm, %[lock] \n"
+ "retry: \n"
+ " ldxr %w[val], %[lock] \n"
+ " cmp %w[tid], %w[val] \n"
+ " bne __futex_list64_try_unlock_cs_end \n"
+ " stlxr %w[result], wzr, %[lock] \n"
+ "__futex_list64_try_unlock_cs_start: \n"
+ " cbnz %w[result], retry \n"
+ "__futex_list64_try_unlock_cs_success: \n"
+ " str xzr, %[pop_reg] \n"
+ "__futex_list64_try_unlock_cs_end: \n"
+
+ : [val] "=&r" (val), [result] "=&r" (result_reg)
+ : [tid] "r" (tid), [lock] "Q" (*lock), [pop_reg] "Q" (*pop_reg)
+ : "cc", "memory"
+ );
+
+ return val;
+}
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v6 3/4] arm64: vdso32: Bring vdso32-offsets.h back
2026-07-20 16:03 [PATCH v6 0/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
2026-07-20 16:03 ` [PATCH v6 1/4] arm64: vdso: Prepare for robust futex unlock support André Almeida
2026-07-20 16:03 ` [PATCH v6 2/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
@ 2026-07-20 16:03 ` André Almeida
2026-07-20 16:03 ` [PATCH v6 4/4] arm64: vdso32: Implement __vdso_futex_robust_try_unlock() André Almeida
3 siblings, 0 replies; 6+ messages in thread
From: André Almeida @ 2026-07-20 16:03 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Thomas Gleixner, Mark Rutland,
Mathieu Desnoyers, Sebastian Andrzej Siewior, Peter Zijlstra,
Florian Weimer, Darren Hart, Ingo Molnar, Davidlohr Bueso,
Arnd Bergmann, Uros Bizjak, Thomas Weißschuh
Cc: linux-arm-kernel, linux-kernel, linux-arch, kernel-dev, LKML,
André Almeida
Commit c7767f5c43df ("arm64: vdso32: Remove unused vdso32-offsets.h")
removed vdso32-offsets.h because it was empty and therefore useless.
With the introduction of __vdso_futex_robust_try_unlock(), there is the
need to expose offsets again.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
arch/arm64/Makefile | 2 +-
arch/arm64/include/asm/vdso.h | 3 +++
arch/arm64/kernel/vdso32/Makefile | 8 ++++++++
3 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 6b005c8fef70..265716644193 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -211,7 +211,7 @@ vdso_prepare: prepare0
include/generated/vdso-offsets.h arch/arm64/kernel/vdso/vdso.so
ifdef CONFIG_COMPAT_VDSO
$(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 \
- arch/arm64/kernel/vdso32/vdso.so
+ include/generated/vdso32-offsets.h arch/arm64/kernel/vdso32/vdso.so
endif
endif
diff --git a/arch/arm64/include/asm/vdso.h b/arch/arm64/include/asm/vdso.h
index 232b46969088..43a214b93524 100644
--- a/arch/arm64/include/asm/vdso.h
+++ b/arch/arm64/include/asm/vdso.h
@@ -10,6 +10,9 @@
#ifndef __ASSEMBLER__
#include <generated/vdso-offsets.h>
+#ifdef CONFIG_COMPAT_VDSO
+#include <generated/vdso32-offsets.h>
+#endif
#define VDSO_SYMBOL(base, name) \
({ \
diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile
index bea3675fa668..4bd60f059f4a 100644
--- a/arch/arm64/kernel/vdso32/Makefile
+++ b/arch/arm64/kernel/vdso32/Makefile
@@ -135,6 +135,14 @@ $(c-obj-vdso-gettimeofday): %.o: %.c FORCE
$(asm-obj-vdso): %.o: %.S FORCE
$(call if_changed_dep,vdsoas)
+# Generate VDSO offsets using helper script
+gen-vdsosym := $(src)/../vdso/gen_vdso_offsets.sh
+quiet_cmd_vdsosym = VDSOSYM $@
+ cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
+
+include/generated/vdso32-offsets.h: $(obj)/vdso32.so.dbg FORCE
+ $(call if_changed,vdsosym)
+
# Actual build commands
quiet_cmd_vdsold_and_vdso_check = LD32 $@
cmd_vdsold_and_vdso_check = $(cmd_vdsold); $(cmd_vdso_check)
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v6 4/4] arm64: vdso32: Implement __vdso_futex_robust_try_unlock()
2026-07-20 16:03 [PATCH v6 0/4] arm64: vdso: Implement __vdso_futex_robust_try_unlock() André Almeida
` (2 preceding siblings ...)
2026-07-20 16:03 ` [PATCH v6 3/4] arm64: vdso32: Bring vdso32-offsets.h back André Almeida
@ 2026-07-20 16:03 ` André Almeida
2026-07-23 15:57 ` André Almeida
3 siblings, 1 reply; 6+ messages in thread
From: André Almeida @ 2026-07-20 16:03 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Thomas Gleixner, Mark Rutland,
Mathieu Desnoyers, Sebastian Andrzej Siewior, Peter Zijlstra,
Florian Weimer, Darren Hart, Ingo Molnar, Davidlohr Bueso,
Arnd Bergmann, Uros Bizjak, Thomas Weißschuh
Cc: linux-arm-kernel, linux-kernel, linux-arch, kernel-dev, LKML,
André Almeida
Based on aarch64 implementation, provide a 32 bit entry point for
this vDSO.
In order to keep compatibility with arm64_futex_robust_unlock_get_pop(),
make sure to store the pop address at r2 and the compare result value
at r3.
Signed-off-by: André Almeida <andrealmeid@igalia.com>
---
arch/arm64/kernel/vdso.c | 14 ++++++++++++++
arch/arm64/kernel/vdso32/Makefile | 4 ++++
arch/arm64/kernel/vdso32/vdso.lds.S | 9 +++++++++
arch/arm64/kernel/vdso32/vfutex.c | 34 ++++++++++++++++++++++++++++++++++
4 files changed, 61 insertions(+)
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 1d1633e8339b..d9b86f9a0db6 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -182,6 +182,15 @@ enum aarch32_map {
static struct page *aarch32_vectors_page __ro_after_init;
static struct page *aarch32_sig_page __ro_after_init;
+static inline void aarch32_vdso_futex_update_ips(struct mm_struct *mm)
+{
+ unsigned long vdso = (unsigned long) mm->context.vdso;
+
+ __vdso_futex_update_ips(mm, true,
+ VDSO_SYMBOL(vdso, futex_list32_try_unlock_cs_start),
+ VDSO_SYMBOL(vdso, futex_list32_try_unlock_cs_end));
+}
+
static int aarch32_sigpage_mremap(const struct vm_special_mapping *sm,
struct vm_area_struct *new_vma)
{
@@ -195,6 +204,8 @@ static int aarch32_mremap(const struct vm_special_mapping *sm,
{
current->mm->context.vdso = (void *)new_vma->vm_start;
+ aarch32_vdso_futex_update_ips(current->mm);
+
return 0;
}
@@ -327,6 +338,7 @@ static int aarch32_sigreturn_setup(struct mm_struct *mm)
return PTR_ERR_OR_ZERO(ret);
}
+
int aarch32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
{
struct mm_struct *mm = current->mm;
@@ -347,6 +359,8 @@ int aarch32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
}
ret = aarch32_sigreturn_setup(mm);
+
+ aarch32_vdso_futex_update_ips(mm);
out:
mmap_write_unlock(mm);
return ret;
diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile
index 4bd60f059f4a..f3190125c68b 100644
--- a/arch/arm64/kernel/vdso32/Makefile
+++ b/arch/arm64/kernel/vdso32/Makefile
@@ -97,6 +97,10 @@ munge := ../../../arm/vdso/vdsomunge
hostprogs := $(munge)
c-obj-vdso := note.o
+ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+ c-obj-vdso += vfutex.o
+endif
+
c-obj-vdso-gettimeofday := vgettimeofday.o
ifneq ($(c-gettimeofday-y),)
diff --git a/arch/arm64/kernel/vdso32/vdso.lds.S b/arch/arm64/kernel/vdso32/vdso.lds.S
index c374fb0146f3..46c0123b2684 100644
--- a/arch/arm64/kernel/vdso32/vdso.lds.S
+++ b/arch/arm64/kernel/vdso32/vdso.lds.S
@@ -87,6 +87,15 @@ VERSION
__vdso_clock_getres;
__vdso_clock_gettime64;
__vdso_clock_getres_time64;
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+ __vdso_futex_robust_list32_try_unlock;
+#endif
local: *;
};
}
+
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+VDSO_futex_list32_try_unlock_cs_success = __futex_list32_try_unlock_cs_success;
+VDSO_futex_list32_try_unlock_cs_start = __futex_list32_try_unlock_cs_start;
+VDSO_futex_list32_try_unlock_cs_end = __futex_list32_try_unlock_cs_end;
+#endif
diff --git a/arch/arm64/kernel/vdso32/vfutex.c b/arch/arm64/kernel/vdso32/vfutex.c
new file mode 100644
index 000000000000..030eb767b8d6
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/vfutex.c
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#include <linux/stringify.h>
+#include <vdso/futex.h>
+
+__u32 __vdso_futex_robust_list32_try_unlock(__u32 *lock, __u32 tid, __u32 *pop)
+{
+ register __u32 *pop_reg asm("r2") = pop, result_reg asm("r3") = 0;
+ __u32 val, zero = 0;
+
+ asm volatile (
+ ".globl "
+ "__futex_list32_try_unlock_cs_start, "
+ "__futex_list32_try_unlock_cs_success, "
+ "__futex_list32_try_unlock_cs_end \n"
+
+ "retry: \n"
+ " ldrex %[val], %[lock] \n"
+ " cmp %[tid], %[val] \n"
+ " bne __futex_list32_try_unlock_cs_end \n"
+ " strex %[result], %[zero], %[lock] \n"
+ "__futex_list32_try_unlock_cs_start: \n"
+ " cmp %[result], #0 \n"
+ " bne retry \n"
+ "__futex_list32_try_unlock_cs_success: \n"
+ " str %[zero], %[pop_reg] \n"
+ "__futex_list32_try_unlock_cs_end: \n"
+
+ : [val] "=&r" (val), [result] "=r" (result_reg)
+ : [tid] "r" (tid), [lock] "Q" (*lock), [pop_reg] "Q" (*pop_reg), [zero] "r" (zero)
+ : "cc", "memory"
+ );
+
+ return val;
+}
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v6 4/4] arm64: vdso32: Implement __vdso_futex_robust_try_unlock()
2026-07-20 16:03 ` [PATCH v6 4/4] arm64: vdso32: Implement __vdso_futex_robust_try_unlock() André Almeida
@ 2026-07-23 15:57 ` André Almeida
0 siblings, 0 replies; 6+ messages in thread
From: André Almeida @ 2026-07-23 15:57 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Thomas Gleixner, Mark Rutland,
Mathieu Desnoyers, Sebastian Andrzej Siewior, Peter Zijlstra,
Florian Weimer, Darren Hart, Ingo Molnar, Davidlohr Bueso,
Arnd Bergmann, Uros Bizjak, Thomas Weißschuh
Cc: linux-arm-kernel, linux-kernel, linux-arch, kernel-dev
Em 20/07/2026 13:03, André Almeida escreveu:
> Based on aarch64 implementation, provide a 32 bit entry point for
> this vDSO.
>
> In order to keep compatibility with arm64_futex_robust_unlock_get_pop(),
> make sure to store the pop address at r2 and the compare result value
> at r3.
>
> Signed-off-by: André Almeida <andrealmeid@igalia.com>
[...]
> +__u32 __vdso_futex_robust_list32_try_unlock(__u32 *lock, __u32 tid, __u32 *pop)
> +{
> + register __u32 *pop_reg asm("r2") = pop, result_reg asm("r3") = 0;
> + __u32 val, zero = 0;
> +
> + asm volatile (
> + ".globl "
> + "__futex_list32_try_unlock_cs_start, "
> + "__futex_list32_try_unlock_cs_success, "
> + "__futex_list32_try_unlock_cs_end \n"
> +
> + "retry: \n"
> + " ldrex %[val], %[lock] \n"
> + " cmp %[tid], %[val] \n"
> + " bne __futex_list32_try_unlock_cs_end \n"
> + " strex %[result], %[zero], %[lock] \n"
Actually, this should be `stlex` instead for the store release semantics.
> + "__futex_list32_try_unlock_cs_start: \n"
> + " cmp %[result], #0 \n"
> + " bne retry \n"
> + "__futex_list32_try_unlock_cs_success: \n"
> + " str %[zero], %[pop_reg] \n"
> + "__futex_list32_try_unlock_cs_end: \n"
> +
> + : [val] "=&r" (val), [result] "=r" (result_reg)
> + : [tid] "r" (tid), [lock] "Q" (*lock), [pop_reg] "Q" (*pop_reg), [zero] "r" (zero)
> + : "cc", "memory"
> + );
> +
> + return val;
> +}
>
^ permalink raw reply [flat|nested] 6+ messages in thread