From nobody Sat Feb 7 18:15:24 2026 Received: from sg-1-38.ptr.blmpb.com (sg-1-38.ptr.blmpb.com [118.26.132.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8516D2DE1E0 for ; Tue, 3 Feb 2026 08:04:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=118.26.132.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770105849; cv=none; b=HO2KuMcIgwORXtELR5uapxbxCOio4690BEr9zSlEiHxizVVWRUZ3b3Divge5WwJjteMEF25IzsYQQpTut55AUnyv7xR6CqazdVgvk4zPHChE5xmsEI6fDSxy+OR2gOcNgY1E3mV0lYIKL1RbhWrV3EltZHRUcCGvIFZ3YZq3bgs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770105849; c=relaxed/simple; bh=D3Dc5EBoI1T4TH1cIz06CA4R52wUK0GuvLhxUyMti8U=; h=Cc:From:Subject:To:Date:Content-Type:Message-Id:Mime-Version; b=oCHbd//LcA0q5VtlPC3uC/CCvvd9KQyYdGsc/qU8KDmi2/xPoOCPrKbQSLkfaVEo6xp3wKlm08OMYP1NUBvU425EXdH027lxx7mAvRRWJVHmEXLefrxorRqdcasr3z8l2t5GihgyPNTiV51DzyHdZ+W40fSvmxgXLFXpw8DBRWs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=riscv-computing.com; spf=pass smtp.mailfrom=riscv-computing.com; dkim=pass (2048-bit key) header.d=riscv-computing.com header.i=@riscv-computing.com header.b=pSVaNXib; arc=none smtp.client-ip=118.26.132.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=riscv-computing.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=riscv-computing.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=riscv-computing.com header.i=@riscv-computing.com header.b="pSVaNXib" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2506131828; d=riscv-computing.com; t=1770105833; h=from:subject:mime-version:from:date:message-id:subject:to:cc: reply-to:content-type:mime-version:in-reply-to:message-id; bh=ZCzD1kaB/x/fLNcQMQAZ9VMazaQg98QBjDoCyHeBoto=; b=pSVaNXibRg7swCjK+tgtC6eEGjw2W/wm7zTWOksIWvBhH1b1FqYZ7hJMsyBJ5+arGpBKXX 7kCc2g8K4++f+7QVMWvuGAZreCCKx4fyFZTle7PtxwmByK7jHevHR0zgO4qYuBajGAc4ve hLIYZy1YWms0YU/FFnt87ezcNuq7MjFdQj0Wuois6uo3DpSCcFmW7u3A/k8WAKxsiNno0C h6cVsuTh+fme5QyZ/Z5e5R6FqVo0hygubIgZsuFeuSyFZfzNVZc8qnJmSPEWThq7JBoJXT 8nIWb3fcL+H8CWlawPBOINJ6PGjORbL1ym1D++hqtnW4j9XD6FRSg7METVZ7SA== Cc: , , From: "Yingjun Ni" Subject: [PATCH] irqchip/riscv-imsic: Fix irq migration failure issue when cpu hotplug. To: , , , , , Date: Tue, 3 Feb 2026 16:02:57 +0800 X-Lms-Return-Path: X-Mailer: git-send-email 2.43.0 Message-Id: <20260203080256.9401-2-yingjun.ni@riscv-computing.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Original-From: Yingjun Ni Received: from LAPTOP-LH7SI6C4.localdomain ([14.127.203.227]) by smtp.feishu.cn with ESMTPS; Tue, 03 Feb 2026 16:03:50 +0800 Content-Type: text/plain; charset="utf-8" Add a null pointer check for irq_write_msi_msg to fix NULL pointer dereference issue when migrating irq. Modify the return value of imsic_irq_set_affinity to let the subdomain PCI-MSIX migrate the irq to a new cpu when cpu hotplug. Don't set vec->move_next in imsic_vector_move_update when the cpu is offline, because it will never be cleared. crash log: Unable to handle kernel NULL pointer dereference at virtual address 0 ... Stopper: multi_cpu_stop+0x0/0x24c <- stop_machine_cpuslocked+0x160/0x1b4 epc : 0x0 ra : imsic_irq_set_affinity+0x174/0x1ac Reproduce step: 1. start riscv kernel by qemu. $QEMU -M virt,aia=3Daplic-imsic,aia-guests=3D5 -m 512M -smp 4 \ -kernel $KERNEL -initrd $ROOTFS -bios $OPENSBI \ -device e1000e,netdev=3Dnet0,mac=3D52:54:00:12:34:56 \ -netdev user,id=3Dnet0,net=3D10.0.2.0/24,dhcpstart=3D10.0.2.11 \ -nographic 2. set cpu3 offline. cat /proc/interrupts CPU0 CPU1 CPU2 CPU3 23: 0 0 0 66 PCI-MSIX-0000:00:01.0 eth0-rx-0 echo 0 > /sys/bus/cpu/devices/cpu3/online Signed-off-by: Yingjun Ni --- drivers/irqchip/irq-riscv-imsic-platform.c | 8 ++++++-- drivers/irqchip/irq-riscv-imsic-state.c | 5 +++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-riscv-imsic-platform.c b/drivers/irqchip/i= rq-riscv-imsic-platform.c index 643c8e459611..131e4f2b5431 100644 --- a/drivers/irqchip/irq-riscv-imsic-platform.c +++ b/drivers/irqchip/irq-riscv-imsic-platform.c @@ -93,9 +93,13 @@ static void imsic_irq_compose_msg(struct irq_data *d, st= ruct msi_msg *msg) static void imsic_msi_update_msg(struct irq_data *d, struct imsic_vector *= vec) { struct msi_msg msg =3D { }; + struct irq_chip *irq_chip =3D irq_data_get_irq_chip(d); + + if (!irq_chip->irq_write_msi_msg) + return; =20 imsic_irq_compose_vector_msg(vec, &msg); - irq_data_get_irq_chip(d)->irq_write_msi_msg(d, &msg); + irq_chip->irq_write_msi_msg(d, &msg); } =20 static int imsic_irq_set_affinity(struct irq_data *d, const struct cpumask= *mask_val, @@ -173,7 +177,7 @@ static int imsic_irq_set_affinity(struct irq_data *d, c= onst struct cpumask *mask /* Move state of the old vector to the new vector */ imsic_vector_move(old_vec, new_vec); =20 - return IRQ_SET_MASK_OK_DONE; + return IRQ_SET_MASK_OK; } =20 static void imsic_irq_force_complete_move(struct irq_data *d) diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-= riscv-imsic-state.c index b6cebfee9461..cd1bf9516878 100644 --- a/drivers/irqchip/irq-riscv-imsic-state.c +++ b/drivers/irqchip/irq-riscv-imsic-state.c @@ -362,6 +362,10 @@ static bool imsic_vector_move_update(struct imsic_loca= l_priv *lpriv, /* Update enable and move details */ enabled =3D READ_ONCE(vec->enable); WRITE_ONCE(vec->enable, new_enable); + + if (!cpu_online(vec->cpu) && is_old_vec) + goto out; + if (is_old_vec) WRITE_ONCE(vec->move_next, move_vec); else @@ -371,6 +375,7 @@ static bool imsic_vector_move_update(struct imsic_local= _priv *lpriv, bitmap_set(lpriv->dirty_bitmap, vec->local_id, 1); __imsic_remote_sync(lpriv, vec->cpu); =20 +out: raw_spin_unlock_irqrestore(&lpriv->lock, flags); =20 return enabled; --=20 2.43.0