On Sat, Sep 05, 2026 at 05:20:59PM +0200, Karl Mehltretter wrote:
> virtio_reset_device() now calls synchronize_cbs to wait for running
> callbacks. Its synchronize_rcu() fallback does not cover workqueue or
> sleepable callbacks.
>
> Add the missing hooks. UML waits for its shared IRQ; TmFIFO takes the
> existing per-direction locks held around vring_interrupt(). Virtio-vdpa
> uses a per-device rwlock around its callbacks, which must already be
> hard-IRQ safe.
>
> Remoteproc callbacks can run in hard-IRQ or process context, and rpmsg
> callbacks can sleep, so use one SRCU domain per rproc. Enter it before
> looking up the queue. Initialize it in rproc_alloc(), returning NULL if
> that fails, and clean it up at final release. cleanup_srcu_struct() can
> sleep, so document that rproc_put() and rproc_free() may sleep when
> dropping the last reference.
>
> These hooks wait for callbacks already running. UML, TmFIFO and
> remoteproc still allow new callbacks after reset.
>
> Suggested-by: Michael S. Tsirkin <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <[email protected]>
sounds like sashiko sees some issues here.
they seem legit.
I would also maybe split, 1 patch per transport.
> ---
> arch/um/drivers/virtio_uml.c | 10 ++++++++++
> drivers/platform/mellanox/mlxbf-tmfifo.c | 14 ++++++++++++++
> drivers/remoteproc/remoteproc_core.c | 10 ++++++++++
> drivers/remoteproc/remoteproc_virtio.c | 20 +++++++++++++++++---
> drivers/virtio/virtio_vdpa.c | 21 ++++++++++++++++++++-
> include/linux/remoteproc.h | 3 +++
> 6 files changed, 74 insertions(+), 4 deletions(-)
>
> diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c
> index 7425a8548141..baca6b09e9ac 100644
> --- a/arch/um/drivers/virtio_uml.c
> +++ b/arch/um/drivers/virtio_uml.c
> @@ -20,6 +20,7 @@
> *
> * Based on Virtio MMIO driver by Pawel Moll, copyright 2011-2014, ARM Ltd.
> */
> +#include <linux/interrupt.h>
> #include <linux/module.h>
> #include <linux/of.h>
> #include <linux/platform_device.h>
> @@ -869,6 +870,14 @@ static void vu_reset(struct virtio_device *vdev)
> vu_dev->status = 0;
> }
>
> +static void vu_synchronize_cbs(struct virtio_device *vdev)
> +{
> + struct virtio_uml_device *vu_dev = to_virtio_uml_device(vdev);
> +
> + if (vu_dev->irq >= 0)
> + synchronize_irq(vu_dev->irq);
> +}
> +
> static void vu_del_vq(struct virtqueue *vq)
> {
> struct virtio_uml_vq_info *info = vq->priv;
> @@ -1121,6 +1130,7 @@ static const struct virtio_config_ops
> virtio_uml_config_ops = {
> .reset = vu_reset,
> .find_vqs = vu_find_vqs,
> .del_vqs = vu_del_vqs,
> + .synchronize_cbs = vu_synchronize_cbs,
> .get_features = vu_get_features,
> .finalize_features = vu_finalize_features,
> .bus_name = vu_bus_name,
> diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c
> b/drivers/platform/mellanox/mlxbf-tmfifo.c
> index 3c6408581373..c260e3a1544e 100644
> --- a/drivers/platform/mellanox/mlxbf-tmfifo.c
> +++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
> @@ -1135,6 +1135,19 @@ static void mlxbf_tmfifo_virtio_reset(struct
> virtio_device *vdev)
> tm_vdev->status = 0;
> }
>
> +static void mlxbf_tmfifo_virtio_synchronize_cbs(struct virtio_device *vdev)
> +{
> + struct mlxbf_tmfifo_vdev *tm_vdev = mlxbf_vdev_to_tmfifo(vdev);
> + struct mlxbf_tmfifo *fifo = tm_vdev->vrings[0].fifo;
> + unsigned long flags;
> + int i;
> +
> + for (i = 0; i < ARRAY_SIZE(fifo->spin_lock); i++) {
> + spin_lock_irqsave(&fifo->spin_lock[i], flags);
> + spin_unlock_irqrestore(&fifo->spin_lock[i], flags);
> + }
> +}
> +
> /* Read the value of a configuration field. */
> static void mlxbf_tmfifo_virtio_get(struct virtio_device *vdev,
> unsigned int offset,
> @@ -1179,6 +1192,7 @@ static const struct virtio_config_ops
> mlxbf_tmfifo_virtio_config_ops = {
> .find_vqs = mlxbf_tmfifo_virtio_find_vqs,
> .del_vqs = mlxbf_tmfifo_virtio_del_vqs,
> .reset = mlxbf_tmfifo_virtio_reset,
> + .synchronize_cbs = mlxbf_tmfifo_virtio_synchronize_cbs,
> .set_status = mlxbf_tmfifo_virtio_set_status,
> .get_status = mlxbf_tmfifo_virtio_get_status,
> .get = mlxbf_tmfifo_virtio_get,
> diff --git a/drivers/remoteproc/remoteproc_core.c
> b/drivers/remoteproc/remoteproc_core.c
> index 1ed406714849..1b139d25ab2b 100644
> --- a/drivers/remoteproc/remoteproc_core.c
> +++ b/drivers/remoteproc/remoteproc_core.c
> @@ -2410,6 +2410,7 @@ static void rproc_type_release(struct device *dev)
>
> dev_info(&rproc->dev, "releasing %s\n", rproc->name);
>
> + cleanup_srcu_struct(&rproc->vq_srcu);
> idr_destroy(&rproc->notifyids);
>
> if (rproc->index >= 0)
> @@ -2507,6 +2508,11 @@ struct rproc *rproc_alloc(struct device *dev, const
> char *name,
> if (!rproc)
> return NULL;
>
> + if (init_srcu_struct(&rproc->vq_srcu)) {
> + kfree(rproc);
> + return NULL;
> + }
> +
> rproc->priv = &rproc[1];
> rproc->auto_boot = true;
> rproc->elf_class = ELFCLASSNONE;
> @@ -2571,6 +2577,8 @@ EXPORT_SYMBOL(rproc_alloc);
> *
> * If no one holds any reference to rproc anymore, then its refcount would
> * now drop to zero, and it would be freed.
> + *
> + * Context: May sleep if this drops the last reference.
> */
> void rproc_free(struct rproc *rproc)
> {
> @@ -2586,6 +2594,8 @@ EXPORT_SYMBOL(rproc_free);
> *
> * If no one holds any reference to rproc anymore, then its refcount would
> * now drop to zero, and it would be freed.
> + *
> + * Context: May sleep if this drops the last reference.
> */
> void rproc_put(struct rproc *rproc)
> {
> diff --git a/drivers/remoteproc/remoteproc_virtio.c
> b/drivers/remoteproc/remoteproc_virtio.c
> index d5e9ff045a28..ecc022e354db 100644
> --- a/drivers/remoteproc/remoteproc_virtio.c
> +++ b/drivers/remoteproc/remoteproc_virtio.c
> @@ -23,6 +23,7 @@
> #include <linux/err.h>
> #include <linux/kref.h>
> #include <linux/slab.h>
> +#include <linux/srcu.h>
>
> #include "remoteproc_internal.h"
>
> @@ -89,14 +90,19 @@ static bool rproc_virtio_notify(struct virtqueue *vq)
> irqreturn_t rproc_vq_interrupt(struct rproc *rproc, int notifyid)
> {
> struct rproc_vring *rvring;
> + int srcu_idx;
> + irqreturn_t ret;
> +
> + srcu_idx = srcu_read_lock(&rproc->vq_srcu);
>
> dev_dbg(&rproc->dev, "vq index %d is interrupted\n", notifyid);
>
> rvring = idr_find(&rproc->notifyids, notifyid);
> - if (!rvring || !rvring->vq)
> - return IRQ_NONE;
> + ret = rvring && rvring->vq ? vring_interrupt(0, rvring->vq) : IRQ_NONE;
> +
> + srcu_read_unlock(&rproc->vq_srcu, srcu_idx);
>
> - return vring_interrupt(0, rvring->vq);
> + return ret;
> }
> EXPORT_SYMBOL(rproc_vq_interrupt);
>
> @@ -242,6 +248,13 @@ static void rproc_virtio_reset(struct virtio_device
> *vdev)
> dev_dbg(&vdev->dev, "reset !\n");
> }
>
> +static void rproc_virtio_synchronize_cbs(struct virtio_device *vdev)
> +{
> + struct rproc *rproc = vdev_to_rproc(vdev);
> +
> + synchronize_srcu(&rproc->vq_srcu);
> +}
> +
> /* provide the vdev features as retrieved from the firmware */
> static u64 rproc_virtio_get_features(struct virtio_device *vdev)
> {
> @@ -330,6 +343,7 @@ static const struct virtio_config_ops
> rproc_virtio_config_ops = {
> .find_vqs = rproc_virtio_find_vqs,
> .del_vqs = rproc_virtio_del_vqs,
> .reset = rproc_virtio_reset,
> + .synchronize_cbs = rproc_virtio_synchronize_cbs,
> .set_status = rproc_virtio_set_status,
> .get_status = rproc_virtio_get_status,
> .get = rproc_virtio_get,
> diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c
> index de2af696de6c..4f9e70c1332e 100644
> --- a/drivers/virtio/virtio_vdpa.c
> +++ b/drivers/virtio/virtio_vdpa.c
> @@ -27,6 +27,7 @@
> struct virtio_vdpa_device {
> struct virtio_device vdev;
> struct vdpa_device *vdpa;
> + rwlock_t callback_lock;
> u64 features;
> };
>
> @@ -123,8 +124,24 @@ static irqreturn_t virtio_vdpa_config_cb(void *private)
> static irqreturn_t virtio_vdpa_virtqueue_cb(void *private)
> {
> struct virtqueue *vq = private;
> + struct virtio_vdpa_device *vd_dev;
> + unsigned long flags;
> + irqreturn_t ret;
>
> - return vring_interrupt(0, vq);
> + vd_dev = to_virtio_vdpa_device(vq->vdev);
> + read_lock_irqsave(&vd_dev->callback_lock, flags);
> + ret = vring_interrupt(0, vq);
> + read_unlock_irqrestore(&vd_dev->callback_lock, flags);
> +
> + return ret;
> +}
> +
> +static void virtio_vdpa_synchronize_cbs(struct virtio_device *vdev)
> +{
> + struct virtio_vdpa_device *vd_dev = to_virtio_vdpa_device(vdev);
> +
> + write_lock_irq(&vd_dev->callback_lock);
> + write_unlock_irq(&vd_dev->callback_lock);
> }
>
> static struct virtqueue *
> @@ -439,6 +456,7 @@ static const struct virtio_config_ops
> virtio_vdpa_config_ops = {
> .reset = virtio_vdpa_reset,
> .find_vqs = virtio_vdpa_find_vqs,
> .del_vqs = virtio_vdpa_del_vqs,
> + .synchronize_cbs = virtio_vdpa_synchronize_cbs,
> .get_features = virtio_vdpa_get_features,
> .finalize_features = virtio_vdpa_finalize_features,
> .bus_name = virtio_vdpa_bus_name,
> @@ -472,6 +490,7 @@ static int virtio_vdpa_probe(struct vdpa_device *vdpa)
> vd_dev->vdev.config = &virtio_vdpa_config_ops;
> vd_dev->vdev.map = vdpa->map;
> vd_dev->vdpa = vdpa;
> + rwlock_init(&vd_dev->callback_lock);
>
> vd_dev->vdev.id.device = ops->get_device_id(vdpa);
> if (vd_dev->vdev.id.device == 0)
> diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
> index a44368737b39..ad6bccbdfabc 100644
> --- a/include/linux/remoteproc.h
> +++ b/include/linux/remoteproc.h
> @@ -11,6 +11,7 @@
> #include <linux/types.h>
> #include <linux/mutex.h>
> #include <linux/spinlock.h>
> +#include <linux/srcu.h>
> #include <linux/virtio.h>
> #include <linux/cdev.h>
> #include <linux/completion.h>
> @@ -230,6 +231,7 @@ enum rproc_features {
> * @rvdevs: list of remote virtio devices
> * @subdevs: list of subdevices, to following the running state
> * @notifyids: idr for dynamically assigning rproc-wide unique notify ids
> + * @vq_srcu: SRCU domain for virtqueue callbacks
> * @index: index of this rproc device
> * @attach_work: workqueue for attaching rproc
> * @crash_handler: workqueue for handling a crash
> @@ -276,6 +278,7 @@ struct rproc {
> struct list_head rvdevs;
> struct list_head subdevs;
> struct idr notifyids;
> + struct srcu_struct vq_srcu;
> int index;
> struct work_struct attach_work;
> struct work_struct crash_handler;
> --
> 2.39.5 (Apple Git-154)
