Skip to content

[PW_SID:1155392] iommu/riscv: Fix command queue publishing races - #2566

Open
linux-riscv-bot wants to merge 6 commits into
workflow__riscv__fixesfrom
pw1155392
Open

[PW_SID:1155392] iommu/riscv: Fix command queue publishing races#2566
linux-riscv-bot wants to merge 6 commits into
workflow__riscv__fixesfrom
pw1155392

Conversation

@linux-riscv-bot

Copy link
Copy Markdown

PR for series 1155392 applied to workflow__riscv__fixes

Name: iommu/riscv: Fix command queue publishing races
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1155392
Version: 2

Xixin Liu and others added 6 commits August 31, 2026 19:12
Overflow status and restart masks are u64, but bits were built with
BIT(). On RV32 that is an unsigned long shift, so indices >= 32 truncate
or wrap and corrupt the mask.

Use BIT_ULL() for those u64 bitops.

Fixes: a862521 ("drivers/perf: riscv: Implement SBI PMU snapshot function")
Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Link: https://patch.msgid.link/prpmask01bitul.v2.1786434000.git.liuxixin@kylinos.cn
[pjw@kernel.org: updated to apply]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
The available-counter mask was a single unsigned long, but iteration
uses RISCV_MAX_COUNTERS, which is 64. On RV32 that reads past the object.
Filling with an unsigned-long bit at index 32 and above is also wrong.

Use DECLARE_BITMAP and set_bit/bitmap helpers. Walk each bitmap word
into CFG_MATCH when checking events, when allocating an index, and when
stopping all counters. Set the counter base to i times BITS_PER_LONG.
Share the CFG_MATCH ecall through a small helper so the 32-bit argument
split is not duplicated. On qemu-system-riscv32 the probe bitmap has bits
above XLEN set, so the first word alone is not enough.

Fixes: e999143 ("RISC-V: Add perf platform driver based on SBI PMU extension")
Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Link: https://patch.msgid.link/prpmask02cmap.v2.1786434000.git.liuxixin@kylinos.cn
[pjw@kernel.org: updated to apply]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Add a raw spinlock to the RISC-V IOMMU queue state so command queue
publishing can be serialized by a later change.

Fixes: 856c0cf ("iommu/riscv: Command and fault queue support")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Serialize command queue publishing so software producer state advances only
after a command is written and the hardware tail is updated. Wait for
hardware consumption outside the queue lock when the command queue is full
so other CPUs are not blocked behind a long poll.

Fixes: 856c0cf ("iommu/riscv: Command and fault queue support")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Do not wait for IOFENCE.C completion when the command failed to enter the
queue. The command was not published to hardware, so waiting for its
producer index can only report a misleading execution timeout.

Fixes: 856c0cf ("iommu/riscv: Command and fault queue support")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot
linux-riscv-bot force-pushed the workflow__riscv__fixes branch 3 times, most recently from 495bff0 to c27f74f Compare September 2, 2026 00:49
@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 143.46 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1488.02 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1801.63 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 26.51 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 28.05 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.98 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 91.90 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
kdoc
Desc: Detects for kdoc errors
Duration: 0.83 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
module-param
Desc: Detect module_param changes
Duration: 0.29 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.31 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v2,1/3] iommu/riscv: Add command queue lock"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.33 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 143.62 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1529.91 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1802.65 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 26.58 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 27.78 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 2.15 seconds
Result: WARNING
Output:

CHECK: Alignment should match open parenthesis
#33: FILE: drivers/iommu/riscv/iommu.c:386:
+static int riscv_iommu_queue_wait_for_space(struct riscv_iommu_queue *queue,
+						   unsigned int last)

CHECK: Alignment should match open parenthesis
#42: FILE: drivers/iommu/riscv/iommu.c:395:
+	ret = riscv_iommu_readl_timeout(queue->iommu, Q_HEAD(queue), hw_head,
+					      !(hw_head & ~queue->mask) && hw_head != last,

total: 0 errors, 0 warnings, 2 checks, 135 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit 033dec28b038 ("iommu/riscv: Serialize command queue publishing") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 0 warnings, 2 checks, 135 lines checked
CHECK: Alignment should match open parenthesis


@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 92.89 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
kdoc
Desc: Detects for kdoc errors
Duration: 0.78 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.28 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[v2,2/3] iommu/riscv: Serialize command queue publishing"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.29 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 142.76 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1470.69 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1801.30 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 26.48 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 27.91 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 1.93 seconds
Result: WARNING
Output:

CHECK: Alignment should match open parenthesis
#28: FILE: drivers/iommu/riscv/iommu.c:423:
+static int riscv_iommu_queue_send(struct riscv_iommu_queue *queue,
+					  void *entry, size_t entry_size,

total: 0 errors, 0 warnings, 1 checks, 51 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit f39becc868ee ("iommu/riscv: Avoid waiting on failed command enqueue") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 0 warnings, 1 checks, 51 lines checked
CHECK: Alignment should match open parenthesis


@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 89.92 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
kdoc
Desc: Detects for kdoc errors
Duration: 0.83 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
module-param
Desc: Detect module_param changes
Duration: 0.25 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.28 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 3: "[v2,3/3] iommu/riscv: Avoid waiting on failed command enqueue"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.30 seconds
Result: PASS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants