【OLK5.10】locking/qspinlock: Micro-optimize pending state waiting for unlock

> _**请尽量提供详细的信息，如缺乏必要的定位信息，则缺陷不会被定位**_

## 环境信息

【OS版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）
openEuler 22.03-LTS-SP1
【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）
 5.10.0-202.0.0.115
【硬件平台】（缺陷相关的硬件信息，如：处理器型号、内存、磁盘、网卡、BIOS 等信息）
 ![输入图片说明](https://foruda.gitee.com/images/1747894101866288381/f4f93180_563961.png "屏幕截图")
## 缺陷信息

【问题复现步骤】
1.启动3个kvm虚拟机,占用宿主机50%
2. stress-ng --all 128 --vm-bytes 200% --aggressive   --maximize --oomable --verify  --syslog --metrics  --times  --timeout 3000m

【实际结果】请描述出问题的结果和影响
在软锁关闭的情况下，运行一段时间时间会导致卡死。在软锁打开的情况下，压力测试一天会导致系统崩溃重启。
【期望结果】请描述出期望的结果和影响
压力测试系统稳定运行，在软锁关闭的情况下不会导致卡死，在软锁打开的情况下不会导致系统崩溃重启。
【其他相关附件信息】比如 syslog、dmesg、panic、lockup、kdump 信息、图片等

```
```
[41162.851023] watchdog: BUG: soft lockup - CPU#18 stuck for 22s! [CPU 27/KVM:788491]
[41162.851028] watchdog: BUG: soft lockup - CPU#19 stuck for 22s! [CPU 7/KVM:788471]
[41162.851036] Modules linked in:
[41162.851113] watchdog: BUG: soft lockup - CPU#23 stuck for 22s! [CPU 30/KVM:788494]
[41162.851121] Modules linked in: sm4_ce(-) sm4_ce_cipher(-) xt_mac xt_state xt_REDIRECT xt_connmark xt_CT vhost_net vhost vhost_iotlb tap xts salsa20_generic chacha_generic chacha_neon libchacha xxhash_generic wp512 tgr192 sha512_generic sha512_arm64 sha3_generic rmd320 rmd256 rmd160 rmd128 poly1305_generic poly1305_neon nhpoly1305_neon nhpoly1305 libpoly1305 michael_mic md4 crc32_generic blake2b_generic twofish_generic twofish_common tea sm4_generic sm4_neon sm4 serpent_generic seed khazad fcrypt des_generic libdes cast6_generic cast5_generic cast_common camellia_generic blowfish_generic blowfish_common anubis tun ip6table_raw ip6table_mangle ip6table_filter xt_set ipt_rpfilter xt_multiport iptable_raw ip_set_hash_ip ip_set_hash_net ip_set veth ip6table_nat ip6_tables xt_statistic xt_nat xt_recent xt_addrtype ipt_REJECT nf_reject_ipv4 iptable_mangle xt_physdev xt_conntrack xt_comment xt_mark iptable_filter nf_conntrack_netlink iptable_nat xt_MASQUERADE ip_tables rbd ceph
[41162.851327]  libceph dns_resolver overlay sch_ingress vxlan ip6_udp_tunnel udp_tunnel nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c 8021q garp mrp bonding vfat fat dm_service_time dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser ib_umad rdma_cm iw_cm libiscsi ib_ipoib scsi_transport_iscsi ib_cm mlx5_ib ib_uverbs ib_core lpfc dm_mod nvmet_fc ses nvmet aes_ce_blk enclosure scsi_transport_sas aes_ce_cipher nvme_fc sg mlx5_core ghash_ce nvme_fabrics hibmc_drm sha1_ce drm_vram_helper nvme_core host_edma_drv drm_ttm_helper mlxfw scsi_transport_fc ttm sch_fq_codel br_netfilter bridge stp llc fuse ext4 mbcache jbd2 sd_mod t10_pi sha2_ce igb sha256_arm64 ixgbe megaraid_sas(OE) mdio aes_neon_bs aes_neon_blk crypto_simd cryptd
[41162.851533] CPU: 23 PID: 788494 Comm: CPU 30/KVM Kdump: loaded Tainted: G           OE     5.10.0-202.0.0.115.ile2312sp1.aarch64 #1
[41162.851537] Hardware name: BaoDeWangAn BD-21083F3/BC82AMDRA, BIOS 1.31 08/20/2024 17:10:12
[41162.851543] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
[41162.851561] pc : native_queued_spin_lock_slowpath+0x20c/0x390
[41162.851571] lr : user_mem_abort+0x808/0x8dc
[41162.851574] sp : ffff80002edf3980
[41162.851577] x29: ffff80002edf39d0 x28: ffff2680033a4cf0 
[41162.851584] x27: 0000000000000004 x26: 000000083f927000 
[41162.851590] x25: 0000000000000004 x24: 000000000000000c 
[41162.851597] x23: ffff24a354070010 x22: 0000ffff47727000 
[41162.851603] x21: ffff2680106b0000 x20: 0000000012b780cd 
[41162.851610] x19: ffff2680033a28e0 x18: 0000000000000000 
[41162.851617] x17: 0000000000000000 x16: ffffb50c8639df44 
[41162.851623] x15: 0000000000000000 x14: 0000000000000000 
[41162.851630] x13: 00000722abdb0fa2 x12: ffff26b024f951e0 
[41162.851636] x11: 000000000000001e x10: ffffdc8000000000 
[41162.851643] x9 : ffff6f9f7912d000 x8 : 0000000000000000 
[41162.851649] x7 : ffff24abfffeb5c0 x6 : ffffb50c86e9a5c0 
[41162.851654] x5 : ffff24abfffeb5c0 x4 : 0000000000000000 
[41162.851661] x3 : ffff2680106b0000 x2 : 0000000000000000 
[41162.851666] x1 : 0000000000600000 x0 : ffff24abfffeb5c8 
[41162.851673] Call trace:
[41162.851685]  native_queued_spin_lock_slowpath+0x20c/0x390
[41162.851692]  kvm_handle_guest_abort+0x268/0x350
[41162.851700]  handle_trap_exceptions+0x4c/0x1f0
[41162.851704]  handle_exit+0x148/0x1e4
[41162.851708]  kvm_arch_vcpu_ioctl_run+0x238/0x600
[41162.851715]  kvm_vcpu_ioctl+0x380/0x9e0
[41162.851724]  __arm64_sys_ioctl+0xb0/0x110
[41162.851731]  invoke_syscall+0x50/0x130
[41162.851735]  el0_svc_common.constprop.0+0x158/0x180
[41162.851739]  do_el0_svc+0x34/0xe0
[41162.851748]  el0_svc+0x20/0x30
[41162.851752]  el0_sync_handler+0xb8/0xc0
[41162.851757]  el0_sync+0x160/0x180
[41162.851763] Kernel panic - not syncing: softlockup: hung tasks
[41162.851769] CPU: 23 PID: 788494 Comm: CPU 30/KVM Kdump: loaded Tainted: G           OEL    5.10.0-202.0.0.115.ile2312sp1.aarch64 #1
[41162.851772] Hardware name: BaoDeWangAn BD-21083F3/BC82AMDRA, BIOS 1.31 08/20/2024 17:10:12
[41162.851774] Call trace:
[41162.851780]  dump_backtrace+0x0/0x214
[41162.851784]  show_stack+0x20/0x2c
[41162.851791]  dump_stack+0xf0/0x138
[41162.851795]  panic+0x194/0x3b0
[41162.851802]  watchdog_timer_fn+0x230/0x2c0
[41162.851812]  __run_hrtimer+0x98/0x2cc
[41162.851816]  __hrtimer_run_queues+0xc0/0x150
[41162.851819]  hrtimer_interrupt+0x150/0x400
[41162.851828]  arch_timer_handler_phys+0x3c/0x60
[41162.851835]  handle_percpu_devid_irq+0x90/0x210
[41162.851842]  __handle_domain_irq+0x84/0xfc
[41162.851846]  gic_handle_irq+0x90/0x2b4
[41162.851849]  el1_irq+0xb8/0x140
[41162.851853]  native_queued_spin_lock_slowpath+0x20c/0x390
[41162.851859]  kvm_handle_guest_abort+0x268/0x350
[41162.851865]  handle_trap_exceptions+0x4c/0x1f0
[41162.851868]  handle_exit+0x148/0x1e4
[41162.851874]  kvm_arch_vcpu_ioctl_run+0x238/0x600
[41162.851880]  kvm_vcpu_ioctl+0x380/0x9e0
[41162.851885]  __arm64_sys_ioctl+0xb0/0x110
[41162.851890]  invoke_syscall+0x50/0x130
[41162.851893]  el0_svc_common.constprop.0+0x158/0x180
[41162.851896]  do_el0_svc+0x34/0xe0
[41162.851902]  el0_svc+0x20/0x30
[41162.851906]  el0_sync_handler+0xb8/0xc0
[41162.851910]  el0_sync+0x160/0x180
[41162.852029] SMP: stopping secondary CPUs
[41162.863790] Modules linked in: sm4_ce(-) sm4_ce_cipher(-) xt_mac xt_state xt_REDIRECT xt_connmark xt_CT vhost_net vhost vhost_iotlb tap xts salsa20_generic chacha_generic chacha_neon libchacha xxhash_generic wp512 tgr192 sha512_generic sha512_arm64 sha3_generic rmd320 rmd256 rmd160 rmd128 poly1305_generic poly1305_neon nhpoly1305_neon nhpoly1305 libpoly1305 michael_mic md4 crc32_generic blake2b_generic twofish_generic twofish_common tea sm4_generic sm4_neon sm4 serpent_generic seed khazad fcrypt des_generic libdes cast6_generic cast5_generic cast_common camellia_generic blowfish_generic blowfish_common anubis tun ip6table_raw ip6table_mangle ip6table_filter xt_set ipt_rpfilter xt_multiport iptable_raw ip_set_hash_ip ip_set_hash_net ip_set veth ip6table_nat ip6_tables xt_statistic xt_nat xt_recent xt_addrtype ipt_REJECT nf_reject_ipv4 iptable_mangle xt_physdev xt_conntrack xt_comment xt_mark iptable_filter nf_conntrack_netlink iptable_nat xt_MASQUERADE ip_tables rbd ceph
[41162.863900]  libceph dns_resolver overlay sch_ingress vxlan ip6_udp_tunnel udp_tunnel nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c 8021q garp mrp bonding vfat fat dm_service_time dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser ib_umad rdma_cm iw_cm libiscsi ib_ipoib scsi_transport_iscsi ib_cm mlx5_ib ib_uverbs ib_core lpfc dm_mod nvmet_fc ses nvmet aes_ce_blk enclosure scsi_transport_sas aes_ce_cipher nvme_fc sg mlx5_core ghash_ce nvme_fabrics hibmc_drm sha1_ce drm_vram_helper nvme_core host_edma_drv drm_ttm_helper mlxfw scsi_transport_fc ttm sch_fq_codel br_netfilter bridge stp llc fuse ext4 mbcache jbd2 sd_mod t10_pi sha2_ce igb sha256_arm64 ixgbe megaraid_sas(OE) mdio aes_neon_bs aes_neon_blk crypto_simd cryptd
[41162.864004] CPU: 18 PID: 788491 Comm: CPU 27/KVM Kdump: loaded Tainted: G           OEL    5.10.0-202.0.0.115.ile2312sp1.aarch64 #1
[41162.864007] Hardware name: BaoDeWangAn BD-21083F3/BC82AMDRA, BIOS 1.31 08/20/2024 17:10:12
[41162.864011] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
[41162.864030] pc : native_queued_spin_lock_slowpath+0x21c/0x390
[41162.864040] lr : kvm_mmu_notifier_invalidate_range_start+0x2e8/0x3d0
[41162.864042] sp : ffff80002ed9b410
[41162.864043] x29: ffff80002ed9b460 x28: ffff24a354070010 
[41162.864046] x27: 0000fffaefc62000 x26: ffff2680106b0000 
[41162.864050] x25: ffff24a354070000 x24: 0000fffaefc61000 
[41162.864052] x23: 0000000000000000 x22: 0000000000000fff 
[41162.864055] x21: 0000000000000001 x20: 0000000000000028 
[41162.864058] x19: ffff24a354070010 x18: 0000000000000000 
[41162.864061] x17: 0000000000000000 x16: 0000000000000000 
[41162.864064] x15: 0000000000000000 x14: 0000000000000000 
[41162.864067] x13: 0000000000000000 x12: 0000000000000040 
[41162.864070] x11: ffff2480005d9ff0 x10: ffffdc8000000000 
[41162.864072] x9 : ffff6f9f79151000 x8 : 0000000000000000 
[41162.864075] x7 : ffff24abfff375c0 x6 : ffffb50c86e9a5c0 
[41162.864077] x5 : ffff24abfff375c0 x4 : 0000000000000000 
[41162.864080] x3 : ffff2680106b0000 x2 : 0000000000000000 
[41162.864083] x1 : 00000000004c0000 x0 : ffff24abfff375c8 
[41162.864087] Call trace:
[41162.864091]  native_queued_spin_lock_slowpath+0x21c/0x390
[41162.864096]  mn_hlist_invalidate_range_start+0x80/0x170
[41162.864101]  __mmu_notifier_invalidate_range_start+0x40/0x84
[41162.864106]  wp_page_copy+0xa44/0xca0
[41162.864108]  do_wp_page+0x250/0x654
[41162.864111]  handle_pte_fault+0x20c/0x240
[41162.864115]  __handle_mm_fault+0x1b0/0x39c
[41162.864117]  handle_mm_fault+0xf4/0x260
[41162.864121]  __get_user_pages+0x218/0x42c
[41162.864124]  get_user_pages_unlocked+0xbc/0x344
[41162.864127]  hva_to_pfn_slow+0x6c/0x1b0
[41162.864130]  hva_to_pfn+0x88/0x260
[41162.864133]  gfn_to_pfn_prot+0xac/0x110
[41162.864138]  user_mem_abort+0x20c/0x8dc
[41162.864141]  kvm_handle_guest_abort+0x268/0x350
[41162.864147]  handle_trap_exceptions+0x4c/0x1f0
[41162.864149]  handle_exit+0x148/0x1e4
[41162.864152]  kvm_arch_vcpu_ioctl_run+0x238/0x600
[41162.864155]  kvm_vcpu_ioctl+0x380/0x9e0
[41162.864162]  __arm64_sys_ioctl+0xb0/0x110
[41162.864167]  invoke_syscall+0x50/0x130
[41162.864170]  el0_svc_common.constprop.0+0x158/0x180
[41162.864172]  do_el0_svc+0x34/0xe0
[41162.864180]  el0_svc+0x20/0x30
[41162.864183]  el0_sync_handler+0xb8/0xc0
[41162.864186]  el0_sync+0x160/0x180
[41162.872996]  sm4_ce(-) sm4_ce_cipher(-) xt_mac xt_state xt_REDIRECT xt_connmark xt_CT vhost_net vhost vhost_iotlb tap xts salsa20_generic chacha_generic chacha_neon libchacha xxhash_generic wp512 tgr192 sha512_generic sha512_arm64 sha3_generic rmd320 rmd256 rmd160 rmd128 poly1305_generic poly1305_neon nhpoly1305_neon nhpoly1305 libpoly1305 michael_mic md4 crc32_generic blake2b_generic twofish_generic twofish_common tea sm4_generic sm4_neon sm4 serpent_generic seed khazad fcrypt des_generic libdes cast6_generic cast5_generic cast_common camellia_generic blowfish_generic blowfish_common anubis tun ip6table_raw ip6table_mangle ip6table_filter xt_set ipt_rpfilter xt_multiport iptable_raw ip_set_hash_ip ip_set_hash_net ip_set veth ip6table_nat ip6_tables xt_statistic xt_nat xt_recent xt_addrtype ipt_REJECT nf_reject_ipv4 iptable_mangle xt_physdev xt_conntrack xt_comment xt_mark iptable_filter nf_conntrack_netlink iptable_nat xt_MASQUERADE ip_tables rbd ceph libceph dns_resolver
[41163.716966]  overlay sch_ingress vxlan ip6_udp_tunnel udp_tunnel nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c 8021q garp mrp bonding vfat fat dm_service_time dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser ib_umad rdma_cm iw_cm
[41163.898264] SMP: failed to stop secondary CPUs 0-22,24-127
[41163.906527] Starting crashdump kernel...
[41163.906530] ------------[ cut here ]------------
[41163.906532] Some CPUs may be stale, kdump will be unreliable.
[41163.906551] WARNING: CPU: 23 PID: 788494 at arch/arm64/kernel/machine_kexec.c:156 machine_kexec+0x48/0x2c0
[41163.906552] Modules linked in: sm4_ce(-) sm4_ce_cipher(-) xt_mac xt_state xt_REDIRECT xt_connmark xt_CT vhost_net vhost vhost_iotlb tap xts salsa20_generic chacha_generic chacha_neon libchacha xxhash_generic wp512 tgr192 sha512_generic sha512_arm64 sha3_generic rmd320 rmd256 rmd160 rmd128 poly1305_generic poly1305_neon nhpoly1305_neon nhpoly1305 libpoly1305 michael_mic md4 crc32_generic blake2b_generic twofish_generic twofish_common tea sm4_generic sm4_neon sm4 serpent_generic seed khazad fcrypt des_generic libdes cast6_generic cast5_generic cast_common camellia_generic blowfish_generic blowfish_common anubis tun ip6table_raw ip6table_mangle ip6table_filter xt_set ipt_rpfilter xt_multiport iptable_raw ip_set_hash_ip ip_set_hash_net ip_set veth ip6table_nat ip6_tables xt_statistic xt_nat xt_recent xt_addrtype ipt_REJECT nf_reject_ipv4 iptable_mangle xt_physdev xt_conntrack xt_comment xt_mark iptable_filter nf_conntrack_netlink iptable_nat xt_MASQUERADE ip_tables rbd ceph
[41163.906633]  libceph dns_resolver overlay sch_ingress vxlan ip6_udp_tunnel udp_tunnel nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c 8021q garp mrp bonding vfat fat dm_service_time dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser ib_umad rdma_cm iw_cm libiscsi ib_ipoib scsi_transport_iscsi ib_cm mlx5_ib ib_uverbs ib_core lpfc dm_mod nvmet_fc ses nvmet aes_ce_blk enclosure scsi_transport_sas aes_ce_cipher nvme_fc sg mlx5_core ghash_ce nvme_fabrics hibmc_drm sha1_ce drm_vram_helper nvme_core host_edma_drv drm_ttm_helper mlxfw scsi_transport_fc ttm sch_fq_codel br_netfilter bridge stp llc fuse ext4 mbcache jbd2 sd_mod t10_pi sha2_ce igb sha256_arm64 ixgbe megaraid_sas(OE) mdio aes_neon_bs aes_neon_blk crypto_simd cryptd
[41163.906712] CPU: 23 PID: 788494 Comm: CPU 30/KVM Kdump: loaded Tainted: G           OEL    5.10.0-202.0.0.115.ile2312sp1.aarch64 #1
[41163.906714] Hardware name: BaoDeWangAn BD-21083F3/BC82AMDRA, BIOS 1.31 08/20/2024 17:10:12
[41163.906718] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)
[41163.906720] pc : machine_kexec+0x48/0x2c0
[41163.906723] lr : machine_kexec+0x48/0x2c0
[41163.906724] sp : ffff8000100bbb20
[41163.906725] x29: ffff8000100bbb20 x28: ffff24abfffdc1b8 
[41163.906728] x27: ffff24abfffdc238 x26: ffff24abfffdc0c0 
[41163.906730] x25: ffffb50c871d2c80 x24: ffff80002edf3830 
[41163.906733] x23: ffffb50c877a4b40 x22: ffffb50c878de000 
[41163.906736] x21: ffff8000100bbb78 x20: ffff248052c5dc00 
[41163.906739] x19: ffff248052c5dc00 x18: 0000000000000020 
[41163.906741] x17: 0000000000000000 x16: ffffb50c8639df44 
[41163.906744] x15: ffffffffffffffff x14: 0000000060000085 
[41163.906747] x13: ffffb50c857828f8 x12: 0000000000000040 
[41163.906749] x11: ffffb50c874ed930 x10: ffffb50c87287eb0 
[41163.906752] x9 : ffffb50c857103f0 x8 : 656c6261696c6572 
[41163.906754] x7 : 6e75206562206c6c x6 : 0000000000000001 
[41163.906756] x5 : ffff24abfffd58d0 x4 : 0000000000000000 
[41163.906759] x3 : 0000000000000027 x2 : 0000000000000000 
[41163.906761] x1 : 0000000000000000 x0 : ffff268b428fe040 
[41163.906763] Call trace:
[41163.906767]  machine_kexec+0x48/0x2c0
[41163.906774]  __crash_kexec+0x94/0x190
[41163.906778]  panic+0x1ac/0x3b0
[41163.906782]  watchdog_timer_fn+0x230/0x2c0
[41163.906787]  __run_hrtimer+0x98/0x2cc
[41163.906789]  __hrtimer_run_queues+0xc0/0x150
[41163.906791]  hrtimer_interrupt+0x150/0x400
[41163.906796]  arch_timer_handler_phys+0x3c/0x60
[41163.906800]  handle_percpu_devid_irq+0x90/0x210
[41163.906806]  __handle_domain_irq+0x84/0xfc
[41163.906808]  gic_handle_irq+0x90/0x2b4
[41163.906810]  el1_irq+0xb8/0x140
[41163.906814]  native_queued_spin_lock_slowpath+0x20c/0x390
[41163.906819]  kvm_handle_guest_abort+0x268/0x350
[41163.906824]  handle_trap_exceptions+0x4c/0x1f0
[41163.906826]  handle_exit+0x148/0x1e4
[41163.906829]  kvm_arch_vcpu_ioctl_run+0x238/0x600
[41163.906834]  kvm_vcpu_ioctl+0x380/0x9e0
[41163.906840]  __arm64_sys_ioctl+0xb0/0x110
[41163.906844]  invoke_syscall+0x50/0x130
[41163.906847]  el0_svc_common.constprop.0+0x158/0x180
[41163.906849]  do_el0_svc+0x34/0xe0
[41163.906853]  el0_svc+0x20/0x30
[41163.906856]  el0_sync_handler+0xb8/0xc0
[41163.906858]  el0_sync+0x160/0x180
[41163.906860] ---[ end trace b079ca3aa66ec196 ]---
[41163.906869] Bye!
[41163.977742]  libiscsi ib_ipoib scsi_transport_iscsi ib_cm mlx5_ib ib_uverbs ib_core lpfc dm_mod nvmet_fc ses nvmet aes_ce_blk enclosure scsi_transport_sas aes_ce_cipher nvme_fc sg mlx5_core ghash_ce nvme_fabrics hibmc_drm sha1_ce drm_vram_helper nvme_core host_edma_drv drm_ttm_helper mlxfw scsi_transport_fc ttm sch_fq_codel br_netfilter bridge stp llc fuse ext4 mbcache jbd2 sd_mod t10_pi sha2_ce igb sha256_arm64 ixgbe megaraid_sas(OE) mdio aes_neon_bs aes_neon_blk crypto_simd cryptd
[41164.468635] CPU: 19 PID: 788471 Comm: CPU 7/KVM Kdump: loaded Tainted: G        W  OEL    5.10.0-202.0.0.115.ile2312sp1.aarch64 #1
[41164.472580] Hardware name: BaoDeWangAn BD-21083F3/BC82AMDRA, BIOS 1.31 08/20/2024 17:10:12
[41164.477300] pstate: 00000005 (nzcv daif -PAN -UAO -TCO BTYPE=--)
[41164.481507] pc : native_queued_spin_lock_slowpath+0x15c/0x390
[41164.487008] lr : kvm_mmu_notifier_invalidate_range_start+0x2e8/0x3d0
[41164.489740] sp : ffff80002e953410
[41164.534736] x29: ffff80002e953460 x28: ffff24a354070010 
[41164.564259] x27: 0000fffaefc62000 x26: ffff2680106b0000 
[41164.582695] x25: ffff24a354070000 x24: 0000fffaefc61000 
[41164.601659] x23: 0000000000000000 x22: 0000000000000fff 
[41164.607986] x21: 0000000000000001 x20: 0000000000000028 
[41164.614313] x19: ffff24a354070010 x18: 0000000000000000 
[41164.620636] x17: 0000000000000000 x16: 0000000000000000 
[41164.626965] x15: 0000000000000000 x14: 0000000000000000 
[41164.633292] x13: 0000000000000000 x12: 0000000000000040 
[41164.639612] x11: ffff2480005d9ff0 x10: ffffdc8000000000 
[41164.645933] x9 : ffffb50c8560c2cc x8 : 0000000000000000 
[41164.652260] x7 : 0007ffffffffffff x6 : 0000000000000000 
[41164.658584] x5 : 0000000000646b42 x4 : 0000000000000000 
[41164.664902] x3 : ffff2680106b0000 x2 : 0000000000000000 
[41164.671222] x1 : 0000000000000000 x0 : 00000000004c0101 
[41164.677537] Call trace:
[41164.680990]  native_queued_spin_lock_slowpath+0x15c/0x390
[41164.687390]  mn_hlist_invalidate_range_start+0x80/0x170
[41164.693598]  __mmu_notifier_invalidate_range_start+0x40/0x84
[41164.700238]  wp_page_copy+0xa44/0xca0
[41164.704876]  do_wp_page+0x250/0x654
[41164.709333]  handle_pte_fault+0x20c/0x240
[41164.714296]  __handle_mm_fault+0x1b0/0x39c
[41164.719334]  handle_mm_fault+0xf4/0x260
[41164.724108]  __get_user_pages+0x218/0x42c
[41164.729042]  get_user_pages_unlocked+0xbc/0x344
[41164.734484]  hva_to_pfn_slow+0x6c/0x1b0
[41164.739236]  hva_to_pfn+0x88/0x260
[41164.743545]  gfn_to_pfn_prot+0xac/0x110
[41164.748286]  user_mem_abort+0x20c/0x8dc
[41164.753023]  kvm_handle_guest_abort+0x268/0x350
[41164.758453]  handle_trap_exceptions+0x4c/0x1f0
[41164.763801]  handle_exit+0x148/0x1e4
[41164.768280]  kvm_arch_vcpu_ioctl_run+0x238/0x600
[41164.773800]  kvm_vcpu_ioctl+0x380/0x9e0
[41164.778542]  __arm64_sys_ioctl+0xb0/0x110
[41164.783460]  invoke_syscall+0x50/0x130
[41164.788119]  el0_svc_common.constprop.0+0x158/0x180
[41164.793908]  do_el0_svc+0x34/0xe0
[41164.798142]  el0_svc+0x20/0x30
[41164.802114]  el0_sync_handler+0xb8/0xc0
[41164.806866]  el0_sync+0x160/0x180
```
```
【已分析信息】如已经做过分析和定位，请尽量附上详细的分析结果
分析vmcore文件，可以分析得出native_queued_spin_lock_slowpath导致系统软锁panic。
```
      KERNEL: /usr/lib/debug/lib/modules/5.10.0-202.0.0.115.ile2312sp1.aarch64/vmlinux  [TAINTED]
    DUMPFILE: vmcore  [PARTIAL DUMP]
        CPUS: 128 [OFFLINE: 2]
        DATE: Tue May 20 09:30:25 CST 2025
      UPTIME: 11:25:55
LOAD AVERAGE: 3124.29, 993.61, 658.00
       TASKS: 17559
    NODENAME: inlinux-arm-compute-024
     RELEASE: 5.10.0-202.0.0.115.ile2312sp1.aarch64
     VERSION: #1 SMP Mon Jun 17 01:51:52 UTC 2024
     MACHINE: aarch64  (unknown Mhz)
      MEMORY: 255.8 GB
       PANIC: "Kernel panic - not syncing: softlockup: hung tasks"
         PID: 788494
     COMMAND: "CPU 30/KVM"
        TASK: ffff268b428fe040  [THREAD_INFO: ffff268b428fe040]
         CPU: 23
       STATE: TASK_RUNNING (PANIC)

crash> bt
PID: 788494   TASK: ffff268b428fe040  CPU: 23   COMMAND: "CPU 30/KVM"
bt: invalid kernel virtual address: 0  type: "IRQ stack contents"
bt: read of IRQ stack at 0 failed
 #0 [ffff8000100bbcd0] __crash_kexec at ffffb50c857828f4
 #1 [ffff8000100bbd50] panic at ffffb50c8637f450
 #2 [ffff8000100bbde0] watchdog_timer_fn at ffffb50c857cf924
 #3 [ffff8000100bbe30] __run_hrtimer at ffffb50c8574ffcc
 #4 [ffff8000100bbe90] __hrtimer_run_queues at ffffb50c857502c0
 #5 [ffff8000100bbee0] hrtimer_interrupt at ffffb50c857509e0
 #6 [ffff8000100bbf50] arch_timer_handler_phys at ffffb50c860da22c
 #7 [ffff8000100bbf60] handle_percpu_devid_irq at ffffb50c8571e8c0
 #8 [ffff8000100bbf90] __handle_domain_irq at ffffb50c85714a98
 #9 [ffff8000100bbfd0] gic_handle_irq at ffffb50c855b0440
--- <IRQ stack> ---
#10 [ffff80002edf3960] el1_irq at ffffb50c855b2374
#11 [ffff80002edf39d0] native_queued_spin_lock_slowpath at ffffb50c856fb98c
#12 [ffff80002edf3a40] kvm_handle_guest_abort at ffffb50c8561dac8
#13 [ffff80002edf3a90] handle_trap_exceptions at ffffb50c85623d1c
#14 [ffff80002edf3ad0] handle_exit at ffffb50c85624278
#15 [ffff80002edf3b10] kvm_arch_vcpu_ioctl_run at ffffb50c8561a288
#16 [ffff80002edf3d90] kvm_vcpu_ioctl at ffffb50c8560b870
#17 [ffff80002edf3dd0] __arm64_sys_ioctl at ffffb50c85a0e570
#18 [ffff80002edf3e10] invoke_syscall at ffffb50c855d02c0
#19 [ffff80002edf3e40] el0_svc_common.constprop.0 at ffffb50c855d04f8
#20 [ffff80002edf3e70] do_el0_svc at ffffb50c855d0554
#21 [ffff80002edf3e80] el0_svc at ffffb50c8639725c
#22 [ffff80002edf3ea0] el0_sync_handler at ffffb50c86397bd4
#23 [ffff80002edf3fe0] el0_sync at ffffb50c855b255c
     PC: 0000ffffa929693c   LR: 0000aaaadd4500f8   SP: 0000fff6be7fafa0
    X29: 0000fff6be7fafa0  X28: 0000fff6be7fc188  X27: 0000ffffa9635000
    X26: 0000fff6be7fba40  X25: 0000aaaaddc8b720  X24: 0000fff6be7fc140
    X23: 0000aaab0abdfce7  X22: 0000000000000000  X21: 000000000000ae80
    X20: 0000aaab0abe7c30  X19: 0000aaaaddb17000  X18: 0000000000000001
    X17: 0000ffffa9296930  X16: 0000aaaaddb0b8a0  X15: 0000000000000000
    X14: 0000000000000000  X13: 0000000000000000  X12: 000000007fffffff
    X11: 0000000000000010  X10: 0000000000000000   X9: 0000000000000000
     X8: 000000000000001d   X7: 0000000000000000   X6: 0000ffffaa00f6b0
     X5: 0000fff6be7fb020   X4: 00000000fffffff8   X3: 0000000000000000
     X2: 0000000000000000   X1: 000000000000ae80   X0: 0000000000000079
    ORIG_X0: 0000000000000079  SYSCALLNO: 1d  PSTATE: 40001000
crash> dis -s  native_queued_spin_lock_slowpath+0x15c
FILE: kernel/locking/qspinlock.c
LINE: 413

408            * sequentiality; this is because not all
  409            * clear_pending_set_locked() implementations imply full
  410            * barriers.
  411            */
  412           if (val & _Q_LOCKED_MASK)
* 413                   atomic_cond_read_acquire(&lock->val, !(VAL & _Q_LOCKED_MASK));
  414
  415           /*
  416            * take ownership and clear the pending bit.
  417            *
  418            * 0,1,0 -> 0,0,1
  419            */
  420           clear_pending_set_locked(lock);
  421           lockevent_inc(lock_pending);
  422           return;
  423
  424           /*
  425            * End of pending bit optimistic spinning and beginning of MCS
  426            * queuing.
  427            */
  428   queue:
  429           lockevent_inc(lock_slowpath);
  430   pv_queue:
  431           node = this_cpu_ptr(&qnodes[0].mcs);
  432           idx = node->count++;
  433           tail = encode_tail(smp_processor_id(), idx);
  434
  435           /*
  436            * 4 nodes are allocated based on the assumption that there will
  437            * not be nested NMIs taking spinlocks. That may not be true in
  438            * some architectures even though the chance of needing more than
  439            * 4 nodes will still be extremely unlikely. When that happens,
  440            * we fall back to spinning on the lock directly without using
  441            * any MCS node. This is not the most elegant solution, but is
  442            * simple enough.
  443            */
  444           if (unlikely(idx >= MAX_NODES)) {
  445                   lockevent_inc(lock_no_node);
  446                   while (!queued_spin_trylock(lock))
  447                           cpu_relax();
  448                   goto release;
  449           }
  450
  451           node = grab_mcs_node(node, idx);
  452
  453           /*
  454            * Keep counts of non-zero index values:
  455            */
  456           lockevent_cond_inc(lock_use_node2 + idx - 1, idx);
  457
  458           /*
  459            * Ensure that we increment the head node->count before initialising
  460            * the actual node. If the compiler is kind enough to reorder these
  461            * stores, then an IRQ could overwrite our assignments.
  462            */
  463           barrier();
  464
  465           node->locked = 0;
  466           node->next = NULL;
  467           pv_init_node(node);
  468

crash> dis -s native_queued_spin_lock_slowpath+0x20c
FILE: ./arch/arm64/include/asm/cmpxchg.h
LINE: 252

247           : [val] "r" (val));                                             \
  248   }
  249
  250   __CMPWAIT_CASE(w, b, 8);
  251   __CMPWAIT_CASE(w, h, 16);
* 252   __CMPWAIT_CASE(w,  , 32);
  253   __CMPWAIT_CASE( ,  , 64);
  254
  255   #undef __CMPWAIT_CASE
  256
  257   #define __CMPWAIT_GEN(sfx)                                              \
  258   static __always_inline void __cmpwait##sfx(volatile void *ptr,          \
  259                                     unsigned long val,                    \
  260                                     int size)                             \
  261   {                                                                       \
  262           switch (size) {                                                 \
  263           case 1:                                                         \
  264                   return __cmpwait_case##sfx##_8(ptr, (u8)val);           \
  265           case 2:                                                         \
  266                   return __cmpwait_case##sfx##_16(ptr, (u16)val);         \
  267           case 4:                                                         \
  268                   return __cmpwait_case##sfx##_32(ptr, val);              \
  269           case 8:                                                         \
  270                   return __cmpwait_case##sfx##_64(ptr, val);              \
  271           default:                                                        \
  272                   BUILD_BUG();                                            \
  273           }                                                               \
  274                                                                           \
  275           unreachable();                                                  \
  276   }

crash> dis -s native_queued_spin_lock_slowpath+0x21c
FILE: kernel/locking/qspinlock.c
LINE: 505

500
  501                   /* Link @node into the waitqueue. */
  502                   WRITE_ONCE(prev->next, node);
  503
  504                   pv_wait_node(node, prev);
* 505                   arch_mcs_spin_wait(&node->locked);
  506
  507                   /*
  508                    * While waiting for the MCS lock, the next pointer may have
  509                    * been set by another lock waiter. We optimistically load
  510                    * the next pointer & prefetch the cacheline for writing
  511                    * to reduce latency in the upcoming MCS unlock operation.
  512                    */
  513                   next = READ_ONCE(node->next);
  514                   if (next)
  515                           prefetchw(next);
  516           }
  517
  518           /*
  519            * we're at the head of the waitqueue, wait for the owner & pending to
  520            * go away.
  521            *
  522            * *,x,y -> *,0,0
  523            *
  524            * this wait loop must use a load-acquire such that we match the
  525            * store-release that clears the locked bit and create lock
  526            * sequentiality; this is because the set_locked() function below
  527            * does not imply a full barrier.
  528            *
  529            * The PV pv_wait_head_or_lock function, if active, will acquire
  530            * the lock and return a non-zero value. So we have to skip the
  531            * atomic_cond_read_acquire() call. As the next PV queue head hasn't
  532            * been designated yet, there is no way for the locked value to become
  533            * _Q_SLOW_VAL. So both the set_locked() and the
  534            * atomic_cmpxchg_relaxed() calls will be safe.
  535            *
  536            * If PV isn't active, 0 will be returned instead.
  537            *
  538            */
  539           if ((val = pv_wait_head_or_lock(lock, node)))
  540                   goto locked;
  541
  542           val = atomic_cond_read_acquire(&lock->val, !(VAL & _Q_LOCKED_PENDING_MASK));
  543
  544   locked:
  545           /*
  546            * claim the lock:
  547            *
  548            * n,0,0 -> 0,0,1 : lock, uncontended
  549            * *,*,0 -> *,*,1 : lock, contended
  550            *
  551            * If the queue head is the only one in the queue (lock value == tail)
  552            * and nobody is pending, clear the tail code and grab the lock.
  553            * Otherwise, we only need to grab the lock.
  554            */
  555
  556           /*
  557            * In the PV case we might already have _Q_LOCKED_VAL set, because
  558            * of lock stealing; therefore we must also allow:
  559            *
  560            * n,0,1 -> 0,0,1
  561            *
  562            * Note: at this point: (val & _Q_PENDING_MASK) == 0, because of the
  563            *       above wait condition, therefore any concurrent setting of
  564            *       PENDING will make the uncontended transition fail.
  565            */
  566           if ((val & _Q_TAIL_MASK) == tail) {
  567                   if (try_clear_tail(lock, val, node))
  568                           goto release; /* No contention */
  569           }
  570
  571           /*
  572            * Either somebody is queued behind us or _Q_PENDING_VAL got set
  573            * which will then detect the remaining tail and queue behind us
  574            * ensuring we'll see a @next.
  575            */
  576           set_locked(lock);
  577
  578           /*
  579            * contended path; wait for next if not observed yet, release.
  580            */
  581           if (!next)
  582                   next = smp_cond_load_relaxed(&node->next, (VAL));
  583
  584           mcs_lock_handoff(node, next);
  585           pv_kick_node(lock, next);
  586
  587   release:
  588           /*
  589            * release the node
  590            */
  591           __this_cpu_dec(qnodes[0].mcs.count);
  592   }
```
**二、缺陷分析结构反馈**
影响性分析说明：
  改缺陷影响openEuler 22.03SP4 以下所有版本，服务器运行负载高时会导致操作系统内核卡死。

缺陷严重等级:(Critical/High/Moderate/Low)
  Critical

缺陷根因说明:
  某个核心在获取自旋锁时触发了 queued-spinlock 的竞态 / 位破坏，导致后续所有等待这把锁的 CPU 永久自旋；watchdog 检测到 22 s 无调度而报警，最终整机“假死”。

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4  受影响
openEuler-22.03-LTS-SP3 受影响
openEuler-22.03-LTS-SP4 受影响
openEuler-24.03-LTS  不受影响
openEuler-24.03-LTS-SP1 不受影响

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4 否
openEuler-22.03-LTS-SP3 否
openEuler-22.03-LTS-SP4 否
openEuler-24.03-LTS 否
openEuler-24.03-LTS-SP1 否

GVP openEuler/kernel

Content Risk Flag

Comments (4)

GVPopenEuler/kernel

Content Risk Flag