union futex_key {
    struct {                    // PROCESS_SHARED（文件映射）
        u64 i_seq;              // inode 序列号
        unsigned long pgoff;    // 页索引
        unsigned int offset;    // 页内偏移
    } shared;
    struct {                    // PROCESS_PRIVATE
        struct mm_struct *mm;   // 地址空间
        unsigned long address;  // 虚拟地址（页对齐）
        unsigned int offset;    // 页内偏移
    } private;
    struct {                    // 哈希比较用
        u64 ptr;
        unsigned long word;
        unsigned int offset;
    } both;
};

struct futex_hash_bucket {
    atomic_t waiters;           // 等待者计数（SMP 优化用）
    spinlock_t lock;
    struct plist_head chain;    // 优先级排序的等待队列
} ____cacheline_aligned_in_smp;

struct futex_q {
    struct plist_node list;         // 按优先级排序
    struct task_struct *task;
    spinlock_t *lock_ptr;           // 所属 hash bucket 的锁
    union futex_key key;
    struct futex_pi_state *pi_state; // PI futex 专用
    struct rt_mutex_waiter *rt_waiter;
    u32 bitset;                     // bitset 唤醒过滤
    atomic_t requeue_state;         // requeue_pi 状态机
};

struct futex_pi_state {
    struct list_head list;          // 挂在 owner->pi_state_list
    struct rt_mutex_base pi_mutex;  // 底层 RT mutex
    struct task_struct *owner;
    refcount_t refcount;
    union futex_key key;
};

struct futex_hash_bucket *futex_hash(union futex_key *key)
{
    u32 hash = jhash2((u32 *)key, ..., key->both.offset);
    return &futex_queues[hash & (futex_hashsize - 1)];
}

static int __init futex_init(void)
{
    futex_hashsize = roundup_pow_of_two(256 * num_possible_cpus());
    futex_queues = alloc_large_system_hash(...);
    for (i = 0; i < futex_hashsize; i++) {
        atomic_set(&futex_queues[i].waiters, 0);
        plist_head_init(&futex_queues[i].chain);
        spin_lock_init(&futex_queues[i].lock);
    }
}
core_initcall(futex_init);

// futex_q 被认为已唤醒当且仅当：
plist_node_empty(&q->list) || q->lock_ptr == NULL

static inline void requeue_futex(struct futex_q *q,
    struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2,
    union futex_key *key2)
{
    if (&hb1->chain != &hb2->chain) {
        plist_del(&q->list, &hb1->chain);
        futex_hb_waiters_dec(hb1);
        futex_hb_waiters_inc(hb2);
        plist_add(&q->list, &hb2->chain);
        q->lock_ptr = &hb2->lock;
    }
    q->key = *key2;
}

struct robust_list_head {
    struct robust_list list;
    long futex_offset;
    struct robust_list *list_op_pending;
};

SYSCALL_DEFINE5(futex_waitv,
    struct futex_waitv __user *, waiters,   // 等待数组
    unsigned int, nr_futexes,              // 数组长度（≤128）
    unsigned int, flags,
    struct __kernel_timespec __user *, timeout,
    clockid_t, clockid)

struct futex_waitv {
    __u64 val;          // 期望值
    __u64 uaddr;        // futex 地址
    __u32 flags;        // FUTEX_32 | FUTEX_PRIVATE_FLAG
    __u32 __reserved;
};

long do_futex(uaddr, op, val, timeout, uaddr2, val2, val3)
{
    cmd = op & FUTEX_CMD_MASK;
    if (!(op & FUTEX_PRIVATE_FLAG)) flags |= FLAGS_SHARED;

    switch (cmd) {
    case FUTEX_WAIT:       return futex_wait(...);
    case FUTEX_WAKE:       return futex_wake(...);
    case FUTEX_REQUEUE:    return futex_requeue(...);
    case FUTEX_LOCK_PI:    return futex_lock_pi(...);
    case FUTEX_UNLOCK_PI:  return futex_unlock_pi(...);
    // ...
    }
}

// futex_atomic_cmpxchg_inatomic — CAS 实现
asm volatile(
    "1: ldxr   %w1, %2\n"       // Load-Exclusive
    "   sub    %w3, %w1, %w5\n"  // compare with oldval
    "   cbnz   %w3, 4f\n"        // mismatch → exit
    "2: stlxr  %w3, %w6, %2\n"   // Store-Exclusive
    "   cbz    %w3, 3f\n"        // success
    "   ... retry loop ...\n"
    "3: dmb    ish\n"            // Data Memory Barrier
    "4:\n"
    ...);

struct gcov_info {
    unsigned int version;           // GCC version magic
    struct gcov_info *next;         // 全局链表
    unsigned int stamp;             // 唯一时间戳
#if (__GNUC__ >= 12)
    unsigned int checksum;          // 编译单元 checksum
#endif
    const char *filename;           // 对应 .gcda 文件名
    void (*merge[GCOV_COUNTERS])(...);  // 各 counter 类型 merge 函数
    unsigned int n_functions;
    struct gcov_fn_info **functions;
};

struct gcov_fn_info {
    const struct gcov_info *key;    // comdat key
    unsigned int ident;
    unsigned int lineno_checksum;
    unsigned int cfg_checksum;
    struct gcov_ctr_info ctrs[];    // 柔性数组：各类型 counter
};

struct gcov_ctr_info {
    unsigned int num;               // counter 数量
    gcov_type *values;              // 运行时递增的计数值
};

struct gcov_node {
    struct list_head list;          // 父节点 children 链表
    struct list_head children;
    struct list_head all;           // 全局节点链表
    struct gcov_node *parent;
    struct gcov_info **loaded_info; // 已加载对象的 profiling 数据
    int num_loaded;
    struct gcov_info *unloaded_info; // 模块卸载后的持久化副本
    struct dentry *dentry;
    struct dentry **links;          // .gcno 符号链接
    char name[];
};

void __gcov_init(struct gcov_info *info)
{
    mutex_lock(&gcov_lock);
    if (gcov_version == 0)
        gcov_version = gcov_info_version(info);  // 记录 GCC magic

    gcov_info_link(info);                        // 加入全局链表
    if (gcov_events_enabled)
        gcov_event(GCOV_ADD, info);              // 创建 debugfs 节点
    mutex_unlock(&gcov_lock);
}

void llvm_gcov_init(writeout, flush)
{
    info = kzalloc(...);
    list_add_tail(&info->head, &clang_gcov_list);
    current_info = info;
    writeout();    // 回调编译器 writeout，依次调用：
                   //   llvm_gcda_start_file()
                   //   llvm_gcda_emit_function() + llvm_gcda_emit_arcs()
                   //   llvm_gcda_end_file()
    current_info = NULL;
    gcov_event(GCOV_ADD, info);
}

void gcov_enable_events(void)
{
    gcov_events_enabled = 1;
    // 重放已注册但未创建 debugfs 节点的 info
    while ((info = gcov_info_next(info)))
        gcov_event(GCOV_ADD, info);
}

DEFINE_MUTEX(gcov_lock);    // 保护 gcov_info 链表（注册/遍历）
// fs.c 中：
DEFINE_MUTEX(node_lock);    // 保护 debugfs 节点树

void gcov_event(enum gcov_action action, struct gcov_info *info)
{
    switch (action) {
    case GCOV_ADD:
        node = get_node_by_name(gcov_info_filename(info));
        if (node)
            add_info(node, info);      // 已有节点，追加 data set
        else
            add_node(info);            // 新建目录树 + .gcda 文件
        break;
    case GCOV_REMOVE:
        remove_info(node, info);       // 模块卸载
        break;
    }
}

// open /sys/kernel/debug/gcov/.../core.gcda
gcov_seq_open()
  → get_accumulated_info(node)   // dup + 合并多个 loaded_info
  → gcov_iter_new(info)
      → convert_to_gcda(buffer, info)  // 转为标准 .gcda 二进制
  → seq_read() 分页输出

const struct gcov_link gcov_link[] = {
    { OBJ_TREE, "gcno" },   // 链接到 $(objtree) 下的 .gcno
    { 0, NULL },
};

size_t convert_to_gcda(char *buffer, struct gcov_info *info)
{
    // File header
    store_gcov_u32(GCOV_DATA_MAGIC);    // "gcda"
    store_gcov_u32(info->version);
    store_gcov_u32(info->stamp);
#if GCC >= 12
    store_gcov_u32(0);                  // checksum placeholder
#endif

    for each function:
        store_gcov_u32(GCOV_TAG_FUNCTION);
        store_gcov_u32(length);
        store_gcov_u32(ident, lineno_checksum, cfg_checksum);

        for each active counter type:
            store_gcov_u32(GCOV_TAG_FOR_COUNTER(type));
            store_gcov_u32(num * 2);
            for each counter value:
                store_gcov_u64(value);  // 64-bit 分两个 u32 存储
}

const char *gcov_info_filename(struct gcov_info *info);
struct gcov_info *gcov_info_next(struct gcov_info *info);
size_t convert_to_gcda(char *buffer, struct gcov_info *info);
// ...

void __gcov_flush(void)           { /* Unused */ }
void __gcov_merge_add(...)        { /* Unused */ }
void __gcov_exit(void)            { /* Unused */ }

static int gcov_persist = 1;   // 默认开启

// 内核参数：gcov_persist=0 关闭
__setup("gcov_persist=", gcov_persist_setup);

struct irq_desc {
    struct irq_common_data  irq_common_data;  // affinity、msi_desc 等
    struct irq_data         irq_data;         // chip、hwirq、状态
    unsigned int __percpu  *kstat_irqs;       // 每 CPU 中断计数
    irq_flow_handler_t      handle_irq;       // flow handler 函数
    struct irqaction       *action;           // handler 链表头
    unsigned int            depth;            // disable 嵌套深度
    raw_spinlock_t          lock;
    struct cpumask         *affinity;         // SMP 亲和性
    struct mutex            request_mutex;    // request/free 序列化
    const char             *name;
    // ...
};

struct irq_data {
    u32                     mask;           // chip 内 bit mask
    unsigned int            irq;            // Linux virq 号
    unsigned long           hwirq;          // 硬件 IRQ 号
    struct irq_chip        *chip;           // 关联的 irq_chip
    struct irq_domain      *domain;         // 所属 domain
    void                   *chip_data;      // chip 私有数据
    // state: disabled/masked/inprogress/...
};

struct irq_chip {
    const char     *name;
    unsigned int    irq_ack;        // 是否需 ack
    void          (*irq_mask)(struct irq_data *);
    void          (*irq_unmask)(struct irq_data *);
    void          (*irq_eoi)(struct irq_data *);     // End Of Interrupt
    int           (*irq_set_type)(struct irq_data *, unsigned int);
    int           (*irq_set_affinity)(struct irq_data *, const struct cpumask *, bool);
    int           (*irq_startup)(struct irq_data *);
    void          (*irq_shutdown)(struct irq_data *);
    unsigned long   flags;          // IRQCHIP_* 标志
};

struct irqaction {
    irq_handler_t       handler;        // 硬中断 handler
    irq_handler_t       thread_fn;      // 线程化 handler（可选）
    struct irqaction   *next;           // 共享 IRQ 链表
    irq_handler_t      *secondary;      // 辅助 handler
    void               *dev_id;         // 设备标识（free_irq 用）
    void               *percpu_dev_id;
    const char         *name;
    struct task_struct *thread;         // IRQ 线程
    unsigned int        flags;          // IRQF_* 标志
    unsigned long       thread_flags;   // IRQTF_* 内部标志
    // ...
};

struct irq_domain {
    struct list_head    link;
    const char         *name;
    const struct irq_domain_ops *ops;
    irq_hw_number_t     hwirq_max;      // 最大 hwirq
    unsigned int        revmap_size;
    unsigned int       *revmap;         // hwirq → virq 反向映射
    struct irq_domain  *parent;         // 层级 domain
    // ...
};

irqreturn_t handle_irq_event(struct irq_desc *desc)
{
    desc->istate &= ~IRQS_PENDING;
    irqd_set(&desc->irq_data, IRQD_IRQ_INPROGRESS);
    raw_spin_unlock(&desc->lock);           // 释放锁调用 handler

    ret = handle_irq_event_percpu(desc);    // 遍历 action 链

    raw_spin_lock(&desc->lock);
    irqd_clear(&desc->irq_data, IRQD_IRQ_INPROGRESS);
    return ret;
}

void __irq_wake_thread(struct irq_desc *desc, struct irqaction *action)
{
    desc->threads_oneshot |= action->thread_mask;
    atomic_inc(&desc->threads_active);
    wake_up_process(action->thread);       // 唤醒 IRQ 内核线程
}

void handle_fasteoi_irq(struct irq_desc *desc)
{
    raw_spin_lock(&desc->lock);

    if (!desc->action || irqd_irq_disabled(&desc->irq_data)) {
        desc->istate |= IRQS_PENDING;
        mask_irq(desc);
        goto out;
    }

    kstat_incr_irqs_this_cpu(desc);
    if (desc->istate & IRQS_ONESHOT)
        mask_irq(desc);                     // ONESHOT: 线程完成前保持 masked

    handle_irq_event(desc);                 // 调用 driver handler

    cond_unmask_eoi_irq(desc, chip);        // chip->irq_eoi() + 条件 unmask
out:
    raw_spin_unlock(&desc->lock);
}

void handle_edge_irq(struct irq_desc *desc)
{
    raw_spin_lock(&desc->lock);
    desc->istate &= stale flags;
    desc->istate |= IRQS_PENDING;           // 边沿可能 pending
    mask_ack_irq(desc);                     // mask + ack

    if (desc->action && !irqd_irq_disabled())
        handle_irq_event(desc);

    // 若 pending 且 unmasked → 重新处理
    cond_unmask_irq(desc);
    raw_spin_unlock(&desc->lock);
}

int request_threaded_irq(unsigned int irq,
    irq_handler_t handler,          // 硬中断 handler（可为 NULL）
    irq_handler_t thread_fn,        // 线程 handler
    unsigned long flags,
    const char *name, void *dev_id)
{
    // 分配 irqaction
    // __setup_irq(irq, desc, action)
}

void disable_irq(unsigned int irq)    // depth++，depth==1 时 mask
void enable_irq(unsigned int irq)     // depth--，depth==0 时 unmask + resend
void synchronize_irq(unsigned int irq) // 等待 handler 完成

const void *free_irq(unsigned int irq, void *dev_id)
  → __free_irq(desc, dev_id)         // 从 action 链移除
  → 若无 action 剩余 → irq_shutdown()
  → kfree(action) + 停止 IRQ 线程

// 驱动 probe 中
domain = irq_domain_add_simple(node, max_irq, irq_base, &chip, chip_data);
virq = irq_create_of_mapping(irq_spec);   // 解析 interrupt-parent + interrupts
request_irq(virq, handler, flags, name, dev);

void mask_irq(struct irq_desc *desc)
{
    if (!irqd_irq_masked(&desc->irq_data)) {
        desc->irq_data.chip->irq_mask(&desc->irq_data);
        irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
    }
}

void unmask_irq(struct irq_desc *desc)
{
    if (irqd_irq_masked(&desc->irq_data)) {
        desc->irq_data.chip->irq_unmask(&desc->irq_data);
        irqd_clear(&desc->irq_data, IRQD_IRQ_MASKED);
    }
}

#ifdef CONFIG_SPARSE_IRQ
// 动态分配 irq_desc，radix tree 索引
struct irq_desc *irq_alloc_desc(irq, node, affinity, owner, ...)
// allocated_irqs bitmap 跟踪
#else
struct irq_desc irq_desc[NR_IRQS];   // 静态数组
#endif

struct msi_desc {
    struct device          *dev;
    unsigned int            msi_index;
    unsigned int            nvec_used;
    struct irq_affinity_desc *affinity;
    // PCI 特定字段
};

struct msi_device_data {
    struct xa_array          __store;    // msi_desc 存储
    struct mutex             mutex;
    struct irq_domain       *domain;
};

struct irq_chip_generic {
    raw_spinlock_t          lock;
    void __iomem           *reg_base;
    struct irq_chip_type    chip_types[];   // 多种 trigger 类型
    u32                    mask_cache;
    u32                    wake_enabled;
};

struct irq_chip_type {
    struct irq_chip         chip;
    struct irq_chip_regs    regs;           // mask/enable/ack/disable 寄存器偏移
    u32                     type;           // IRQ_TYPE_* 组合
    u32                     handler;        // handle_level/edge_irq
    u32                    *mask_cache;
};

int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
  → irq_do_set_affinity(data, mask, force)
      → chip->irq_set_affinity()         // 硬件设置
      → 或 pending 到 pending_mask       // 中断上下文中延迟迁移

void irq_move_masked_irq(struct irq_data *idata)
{
    if (!irqd_is_setaffinity_pending(data))
        return;
    irqd_clr_move_pending(data);
    chip->irq_set_affinity(data, desc->pending_mask, false);
}

struct irq_affinity_desc *
irq_create_affinity_masks(unsigned int nvecs, struct irq_affinity *affd)

int irq_reserve_ipi(struct irq_domain *domain, const struct cpumask *dest)
int ipi_send_single(unsigned int virq, unsigned int cpu)
int ipi_send_mask(unsigned int virq, const struct cpumask *dest)

devm_request_irq(dev, irq, handler, flags, name, dev_id)

// arch/arm64/kernel/irq.c
asmlinkage void __exception_irq_entry handle_arch_irq(struct pt_regs *regs)
{
    generic_handle_arch_irq(regs);
}

// init 阶段
set_handle_irq(handle_arch_irq);

// 每 CPU 跳过计数器：大部分访问直接返回
static DEFINE_PER_CPU(long, kcsan_skip);

static __always_inline bool should_watch(struct kcsan_ctx *ctx, ...)
{
    if (is_atomic(ctx, ptr, size, type))  // 原子区域不采样
        return false;

    if (this_cpu_dec_return(kcsan_skip) >= 0)  // 跳过 N 次访问
        return false;

    return true;  // 本次访问设置 watchpoint
}

static __always_inline void check_access(const volatile void *ptr,
                                         size_t size, int type, unsigned long ip)
{
    // 快速路径：检查是否命中已有 watchpoint
    watchpoint = find_watchpoint(addr, size, expect_write, &encoded);
    if (watchpoint != NULL)
        kcsan_found_watchpoint(...);      // 慢路径：消费 watchpoint，记录竞争方
    else if (should_watch(ctx, ptr, size, type))
        kcsan_setup_watchpoint(...);      // 慢路径：插入 watchpoint + 延迟
    else
        // 检查 reorder_access（弱内存）和 scoped_access
}

#define KCSAN_CHECK_ADJACENT 1
#define NUM_SLOTS (1 + 2*KCSAN_CHECK_ADJACENT)  // = 3

// 编码格式（64-bit）：
// [63]     = is_write
// [62:ADDR_BITS] = size
// [ADDR_BITS-1:0] = addr 低位（masked）

encode_watchpoint(addr, size, is_write)
watchpoint_slot(addr) = (addr / PAGE_SIZE) % CONFIG_KCSAN_NUM_WATCHPOINTS

bool kcsan_enabled;                                    // 全局开关
static atomic_long_t watchpoints[NUM_WATCHPOINTS + 2]; // watchpoint 数组
atomic_long_t kcsan_counters[KCSAN_COUNTER_COUNT];     // 统计计数器
static DEFINE_PER_CPU(struct kcsan_ctx, kcsan_cpu_ctx); // 中断上下文
// task 使用 task_struct.kcsan_ctx

void __init kcsan_init(void)
{
    for_each_possible_cpu(cpu)
        per_cpu(kcsan_rand_state, cpu) = get_cycles();

    if (kcsan_early_enable)
        WRITE_ONCE(kcsan_enabled, true);

    // 非 strict 模式警告
}

// 编译选项（内核构建）
CFLAGS_KCSAN := -fsanitize=thread -mllvm -tsan-distinguish-volatile=1  // Clang
// 或 GCC: --param tsan-distinguish-volatile=1

// 编译器在每个 load/store 插入：
__tsan_read1/2/4/8/16(void *ptr)
__tsan_write1/2/4/8/16(void *ptr)
__tsan_read_writeN(void *ptr)     // 复合操作 ++, += 等
__tsan_volatile_read/writeN()     // volatile 访问
__tsan_read/write_range()         // 范围访问

void __tsan_write4(void *ptr)
{
    check_access(ptr, 4, KCSAN_ACCESS_WRITE, _RET_IP_);
}

void __tsan_read4(void *ptr)
{
    check_access(ptr, 4, 0, _RET_IP_);  // 0 = read
}

struct kcsan_ctx {
    int disable_count;          // kcsan_disable_current() 嵌套计数
    int disable_scoped;
    int atomic_next;            // 后续 N 个操作视为 atomic
    int atomic_nest_count;      // nestable atomic 区域深度
    bool in_flat_atomic;        // flat atomic 区域（如 seqlock 读侧）
    unsigned long access_mask;  // 位级 ASSERT_EXCLUSIVE_BITS
    struct list_head scoped_accesses;
    struct kcsan_scoped_access reorder_access;  // 弱内存重排序
};

void __kcsan_mb(void)      { reorder_access->size = 0; }  // 全屏障
void __kcsan_wmb(void)     { 写屏障 }
void __kcsan_rmb(void)     { 读屏障 }
void __kcsan_release(void) { release 语义 }