[PATCH] sparc/iommu: Use raw_cpu_read() for iommu_hash_common in iommu_tbl_range_alloc()

[PATCH] sparc/iommu: Use raw_cpu_read() for iommu_hash_common in iommu_tbl_range_alloc()

[Karl Mehltretter]

iommu_tbl_range_alloc() reads the per-CPU starting pool cookie with
__this_cpu_read() before acquiring pool->lock. When called from
preemptible DMA allocation paths with PREEMPT and DEBUG_PREEMPT enabled,
check_preemption_disabled() reports a bug.

The per-CPU cookie only distributes allocations across pools, and each
pool is synchronized by pool->lock. Replace __this_cpu_read() with
raw_cpu_read().

Fixes: ff7d37a50202 ("Break up monolithic iommu table/lock into finer graularity pools and lock")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Assisted by an LLM.

Tested on v7.4-rc1 (d48723711bae) under QEMU sparc64 (sun4u, -smp 2)
with PREEMPT and DEBUG_PREEMPT. Without this patch, two consecutive
boots emit three "BUG: using __this_cpu_read() in preemptible
[00000000] code: swapper/0/1" diagnostics in iommu_tbl_range_alloc().
With this patch, two consecutive boots complete without the
__this_cpu_read() preemption diagnostic.

 arch/sparc/kernel/iommu-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/kernel/iommu-common.c b/arch/sparc/kernel/iommu-common.c
index 23ca75f092770..014d4e9283d55 100644
--- a/arch/sparc/kernel/iommu-common.c
+++ b/arch/sparc/kernel/iommu-common.c
@@ -101,7 +101,7 @@ unsigned long iommu_tbl_range_alloc(struct device *dev,
 				unsigned long mask,
 				unsigned int align_order)
 {
-	unsigned int pool_hash = __this_cpu_read(iommu_hash_common);
+	unsigned int pool_hash = raw_cpu_read(iommu_hash_common);
 	unsigned long n, end, start, limit, boundary_size;
 	struct iommu_pool *pool;
 	int pass = 0;
base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee

-- 
2.39.5 (Apple Git-154)

Re: [PATCH] sparc/iommu: Use raw_cpu_read() for iommu_hash_common in iommu_tbl_range_alloc()

[John Paul Adrian Glaubitz]

Hi Karl,

On Sat, 2026-11-07 at 20:51 +0100, Karl Mehltretter wrote:
> Fixes: ff7d37a50202 ("Break up monolithic iommu table/lock into finer graularity pools and lock")
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Assisted by an LLM.
> 
> Tested on v7.4-rc1 (d48723711bae) under QEMU sparc64 (sun4u, -smp 2)
> with PREEMPT and DEBUG_PREEMPT. Without this patch, two consecutive
> boots emit three "BUG: using __this_cpu_read() in preemptible
> [00000000] code: swapper/0/1" diagnostics in iommu_tbl_range_alloc().
> With this patch, two consecutive boots complete without the
> __this_cpu_read() preemption diagnostic.

According to your Fixes tag, this bug was introduced in 2015. However,
I have to admit I have never seen this message, neither on sun4u nor
on sun4v machines.

Is there a reliable way to reproduce this bug?

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH] sparc/iommu: Use raw_cpu_read() for iommu_hash_common in iommu_tbl_range_alloc()

[Karl Mehltretter]

On Sat, Nov 07, 2026 at 10:13:51PM +0100, John Paul Adrian Glaubitz wrote:
> On Sat, 2026-11-07 at 20:51 +0100, Karl Mehltretter wrote:
> > Fixes: ff7d37a50202 ("Break up monolithic iommu table/lock into finer graularity pools and lock")
> > Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> > ---
> > Assisted by an LLM.
> > 
> > Tested on v7.4-rc1 (d48723711bae) under QEMU sparc64 (sun4u, -smp 2)
> > with PREEMPT and DEBUG_PREEMPT. Without this patch, two consecutive
> > boots emit three "BUG: using __this_cpu_read() in preemptible
> > [00000000] code: swapper/0/1" diagnostics in iommu_tbl_range_alloc().
> > With this patch, two consecutive boots complete without the
> > __this_cpu_read() preemption diagnostic.
> 
> According to your Fixes tag, this bug was introduced in 2015. However,
> I have to admit I have never seen this message, neither on sun4u nor
> on sun4v machines.
> 
> Is there a reliable way to reproduce this bug?
> 

Hi Adrian,

Yes. It needs PREEMPT=y and DEBUG_PREEMPT=y. Debian's sparc64 kernel
uses PREEMPT_VOLUNTARY, so a kernel built from that config cannot
print it.

sparc64_defconfig with PREEMPT, DEBUG_PREEMPT and lockdep, booted with

  qemu-system-sparc64 -M sun4u -m 512 -nographic -no-reboot \
      -kernel arch/sparc/boot/image \
      -append "console=ttyS0 loglevel=7 panic=-1"

prints three reports on every boot, from the pata_cmd64x and sunhme
probes.

Danish Khateeb saw the same reports:
https://lore.kernel.org/r/20260923144909.414968-1-danishkhateeb03@gmail.com/

It is only a warning. The per-CPU value only picks the first pool to
try, and each pool has its own lock.

Thanks,
Karl