[PATCH v1 0/2] arm_mpam: A couple of fixes on v7.0-rc1

[PATCH v1 0/2] arm_mpam: A couple of fixes on v7.0-rc1

[Ben Horgan]

A couple of mpam fixes that avoid a null pointer dereference in cpuhp
and a warning when running the kunit tests with CONFIG_DEBUG_PREEMPT.

Ben Horgan (2):
  arm_mpam: Fix null pointer dereference when restoring bandwidth
    counters
  arm_mpam: Disable preemption when making accesses to fake MSC in kunit
    test

 drivers/resctrl/mpam_devices.c      |  2 ++
 drivers/resctrl/test_mpam_devices.c | 18 +++++++++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

-- 
2.43.0

[PATCH v1 1/2] arm_mpam: Fix null pointer dereference when restoring bandwidth counters

[Ben Horgan]

When an MSC supporting memory bandwidth monitoring is brought offline and
then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to
restore the configuration of the bandwidth counters. It doesn't care about
the value read, mbwu_arg.val, and doesn't set it leading to a null pointer
dereference when __ris_msmon_read() adds to it. This results in a kernel
oops with a call trace such as:

Call trace:
__ris_msmon_read+0x19c/0x64c (P)
mpam_restore_mbwu_state+0xa0/0xe8
smp_call_on_cpu_callback+0x1c/0x38
process_one_work+0x154/0x4b4
worker_thread+0x188/0x310
kthread+0x11c/0x130
ret_from_fork+0x10/0x20

Provide a local variable for val to avoid __ris_msmon_read() dereferencing
a null pointer when adding to val.

Fixes: 41e8a14950e1 ("arm_mpam: Track bandwidth counter state for power management")
Signed-off-by: Ben Horgan <ben.horgan@arm.com>
---
 drivers/resctrl/mpam_devices.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
index 1eebc2602187..0666be6b0e88 100644
--- a/drivers/resctrl/mpam_devices.c
+++ b/drivers/resctrl/mpam_devices.c
@@ -1428,6 +1428,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid,
 static int mpam_restore_mbwu_state(void *_ris)
 {
 	int i;
+	u64 val;
 	struct mon_read mwbu_arg;
 	struct mpam_msc_ris *ris = _ris;
 	struct mpam_class *class = ris->vmsc->comp->class;
@@ -1437,6 +1438,7 @@ static int mpam_restore_mbwu_state(void *_ris)
 			mwbu_arg.ris = ris;
 			mwbu_arg.ctx = &ris->mbwu_state[i].cfg;
 			mwbu_arg.type = mpam_msmon_choose_counter(class);
+			mwbu_arg.val = &val;
 
 			__ris_msmon_read(&mwbu_arg);
 		}
-- 
2.43.0

[PATCH v1 2/2] arm_mpam: Disable preemption when making accesses to fake MSC in kunit test

[Ben Horgan]

Accesses to MSC must be made from a cpu that is affine to that MSC and the
driver checks this in __mpam_write_reg() using smp_processor_id(). A fake
in-memory MSC is used for testing. When using that, it doesn't matter which
cpu we access it from but calling smp_processor_id() from a preemptible
context gives warnings when running with CONFIG_DEBUG_PREEMPT.

Add a test helper that wraps mpam_reset_msc_bitmap() with preemption
disabled to ensure all (fake) MSC accesses are made with preemption
disabled.

Signed-off-by: Ben Horgan <ben.horgan@arm.com>
---
 drivers/resctrl/test_mpam_devices.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/resctrl/test_mpam_devices.c b/drivers/resctrl/test_mpam_devices.c
index 3e8d564a0c64..75bd41bcc395 100644
--- a/drivers/resctrl/test_mpam_devices.c
+++ b/drivers/resctrl/test_mpam_devices.c
@@ -322,6 +322,14 @@ static void test_mpam_enable_merge_features(struct kunit *test)
 	mutex_unlock(&mpam_list_lock);
 }
 
+static void __test_mpam_reset_msc_bitmap(struct mpam_msc *msc, u16 reg, u16 wd)
+{
+	/* Avoid warnings when running with CONFIG_DEBUG_PREEMPT */
+	guard(preempt)();
+
+	mpam_reset_msc_bitmap(msc, reg, wd);
+}
+
 static void test_mpam_reset_msc_bitmap(struct kunit *test)
 {
 	char __iomem *buf = kunit_kzalloc(test, SZ_16K, GFP_KERNEL);
@@ -341,31 +349,31 @@ static void test_mpam_reset_msc_bitmap(struct kunit *test)
 
 	test_result = (u32 *)(buf + MPAMCFG_CPBM);
 
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 0);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 0);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
 
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 1);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 1);
 	KUNIT_EXPECT_EQ(test, test_result[0], 1);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
 
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 16);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 16);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
 
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 32);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 32);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffffffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
 
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 33);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 33);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffffffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 1);
 	test_result[0] = 0;
-- 
2.43.0

Re: [PATCH v1 1/2] arm_mpam: Fix null pointer dereference when restoring bandwidth counters

[James Morse]

Hi Ben,

On 27/02/2026 11:03, Ben Horgan wrote:
> When an MSC supporting memory bandwidth monitoring is brought offline and
> then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to
> restore the configuration of the bandwidth counters. It doesn't care about
> the value read, mbwu_arg.val, and doesn't set it leading to a null pointer

If we're lucky! If its not NULL, it'll take it as a pointer and go corrupt
something else.


> dereference when __ris_msmon_read() adds to it. This results in a kernel
> oops with a call trace such as:
> 
> Call trace:
> __ris_msmon_read+0x19c/0x64c (P)
> mpam_restore_mbwu_state+0xa0/0xe8
> smp_call_on_cpu_callback+0x1c/0x38
> process_one_work+0x154/0x4b4
> worker_thread+0x188/0x310
> kthread+0x11c/0x130
> ret_from_fork+0x10/0x20
> 
> Provide a local variable for val to avoid __ris_msmon_read() dereferencing
> a null pointer when adding to val.

> diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
> index 1eebc2602187..0666be6b0e88 100644
> --- a/drivers/resctrl/mpam_devices.c
> +++ b/drivers/resctrl/mpam_devices.c
> @@ -1428,6 +1428,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid,
>  static int mpam_restore_mbwu_state(void *_ris)
>  {
>  	int i;
> +	u64 val;
>  	struct mon_read mwbu_arg;
>  	struct mpam_msc_ris *ris = _ris;
>  	struct mpam_class *class = ris->vmsc->comp->class;
> @@ -1437,6 +1438,7 @@ static int mpam_restore_mbwu_state(void *_ris)
>  			mwbu_arg.ris = ris;
>  			mwbu_arg.ctx = &ris->mbwu_state[i].cfg;
>  			mwbu_arg.type = mpam_msmon_choose_counter(class);
> +			mwbu_arg.val = &val;
>  
>  			__ris_msmon_read(&mwbu_arg);
>  		}


Reviewed-by: James Morse <james.morse@arm.com>


Thanks for catching this!

James

Re: [PATCH v1 2/2] arm_mpam: Disable preemption when making accesses to fake MSC in kunit test

[James Morse]

Hi Ben,

On 27/02/2026 11:03, Ben Horgan wrote:
> Accesses to MSC must be made from a cpu that is affine to that MSC and the
> driver checks this in __mpam_write_reg() using smp_processor_id(). A fake
> in-memory MSC is used for testing. When using that, it doesn't matter which
> cpu we access it from but calling smp_processor_id() from a preemptible
> context gives warnings when running with CONFIG_DEBUG_PREEMPT.

Bah!


> Add a test helper that wraps mpam_reset_msc_bitmap() with preemption
> disabled to ensure all (fake) MSC accesses are made with preemption
> disabled.

> diff --git a/drivers/resctrl/test_mpam_devices.c b/drivers/resctrl/test_mpam_devices.c
> index 3e8d564a0c64..75bd41bcc395 100644
> --- a/drivers/resctrl/test_mpam_devices.c
> +++ b/drivers/resctrl/test_mpam_devices.c
> @@ -322,6 +322,14 @@ static void test_mpam_enable_merge_features(struct kunit *test)
>  	mutex_unlock(&mpam_list_lock);
>  }
>  
> +static void __test_mpam_reset_msc_bitmap(struct mpam_msc *msc, u16 reg, u16 wd)
> +{
> +	/* Avoid warnings when running with CONFIG_DEBUG_PREEMPT */
> +	guard(preempt)();
> +
> +	mpam_reset_msc_bitmap(msc, reg, wd);
> +}
Reviewed-by: James Morse <james.morse@arm.com>


Thanks,

James

Re: [PATCH v1 0/2] arm_mpam: A couple of fixes on v7.0-rc1

[Tan, Shaopeng/譚 紹鵬]

Hello Ben,

It looks fine to me.
Tested-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>
Reviewed-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>

Best regards,
Shaopeng TAN