[PATCH 0/2] powerpc/xive: rework xive_find_target_in_mask()

[PATCH 0/2] powerpc/xive: rework xive_find_target_in_mask()

[Yury Norov]

Simplify the function by switching to using a modern cpumask API.

Yury Norov (2):
  Revert "powerpc/xive: Fix the size of the cpumask used in
    xive_find_target_in_mask()"
  powerpc/xive: rework xive_find_target_in_mask()

 arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
 1 file changed, 6 insertions(+), 25 deletions(-)

-- 
2.43.0

[PATCH 1/2] Revert "powerpc/xive: Fix the size of the cpumask used in xive_find_target_in_mask()"

[Yury Norov]

This reverts commit a9dadc1c512807f955f0799e85830b420da47932.

The commit message states: 

    When called from xive_irq_startup(), the size of the cpumask can be
    larger than nr_cpu_ids. This can result in a WARN_ON.
    [...]
    This happens because we're being called with our affinity mask set to
    irq_default_affinity. That in turn was populated using
    cpumask_setall(), which sets NR_CPUs worth of bits, not nr_cpu_ids
    worth. Finally cpumask_weight() will return > nr_cpu_ids when passed a
    mask which has > nr_cpu_ids bits set.

In modern kernel, cpumask_weight() can't return > nr_cpu_ids.

In inline case, cpumask_setall() explicitly clears all bits above
nr_cpu_ids, see commit 63355b9884b3 ("cpumask: be more careful with
'cpumask_setall()'"). So, despite that cpumask_weight() is passed
with small_cpumask_bits, which is NR_CPUS in this case, it can't
count over the nr_cpu_ids.

In outline case, cpumask_setall() may set bits beyond the limit up to
the next byte alignment, but in this case small_cpumask_bits is wired
to nr_cpu_ids, thus making overcounting impossible.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---

I've added some explicit tests for cpumask_weight() to make sure:
https://lore.kernel.org/all/20260319004349.849281-1-ynorov@nvidia.com/

 arch/powerpc/sysdev/xive/common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index e1a4f8a97393..e91ec9036ad8 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -551,7 +551,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
 	int cpu, first, num, i;
 
 	/* Pick up a starting point CPU in the mask based on  fuzz */
-	num = min_t(int, cpumask_weight(mask), nr_cpu_ids);
+	num = cpumask_weight(mask);
 	first = fuzz % num;
 
 	/* Locate it */
-- 
2.43.0

[PATCH 2/2] powerpc/xive: rework xive_find_target_in_mask()

[Yury Norov]

Switch the function to using modern cpumask API and drop most of the
housekeeping code.

Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just
like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered,
no special handling is needed.

Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
 arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
 1 file changed, 6 insertions(+), 25 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index e91ec9036ad8..4e05f678e171 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -548,40 +548,21 @@ static void xive_dec_target_count(int cpu)
 static int xive_find_target_in_mask(const struct cpumask *mask,
 				    unsigned int fuzz)
 {
-	int cpu, first, num, i;
+	int cpu, first;
 
 	/* Pick up a starting point CPU in the mask based on  fuzz */
-	num = cpumask_weight(mask);
-	first = fuzz % num;
-
-	/* Locate it */
-	cpu = cpumask_first(mask);
-	for (i = 0; i < first && cpu < nr_cpu_ids; i++)
-		cpu = cpumask_next(cpu, mask);
-
-	/* Sanity check */
-	if (WARN_ON(cpu >= nr_cpu_ids))
-		cpu = cpumask_first(cpu_online_mask);
-
-	/* Remember first one to handle wrap-around */
-	first = cpu;
+	fuzz %= cpumask_weight(mask);
+	first = cpumask_nth(fuzz, mask);
+	WARN_ON(first >= nr_cpu_ids);
 
 	/*
 	 * Now go through the entire mask until we find a valid
 	 * target.
 	 */
-	do {
-		/*
-		 * We re-check online as the fallback case passes us
-		 * an untested affinity mask
-		 */
+	for_each_cpu_wrap(cpu, mask, first) {
 		if (cpu_online(cpu) && xive_try_pick_target(cpu))
 			return cpu;
-		cpu = cpumask_next(cpu, mask);
-		/* Wrap around */
-		if (cpu >= nr_cpu_ids)
-			cpu = cpumask_first(mask);
-	} while (cpu != first);
+	}
 
 	return -1;
 }
-- 
2.43.0

Re: [PATCH 1/2] Revert "powerpc/xive: Fix the size of the cpumask used in xive_find_target_in_mask()"

[Mukesh Kumar Chaurasiya]

On Wed, Mar 18, 2026 at 11:36:45PM -0400, Yury Norov wrote:
> This reverts commit a9dadc1c512807f955f0799e85830b420da47932.
> 
> The commit message states: 
> 
>     When called from xive_irq_startup(), the size of the cpumask can be
>     larger than nr_cpu_ids. This can result in a WARN_ON.
>     [...]
>     This happens because we're being called with our affinity mask set to
>     irq_default_affinity. That in turn was populated using
>     cpumask_setall(), which sets NR_CPUs worth of bits, not nr_cpu_ids
>     worth. Finally cpumask_weight() will return > nr_cpu_ids when passed a
>     mask which has > nr_cpu_ids bits set.
> 
> In modern kernel, cpumask_weight() can't return > nr_cpu_ids.
> 
> In inline case, cpumask_setall() explicitly clears all bits above
> nr_cpu_ids, see commit 63355b9884b3 ("cpumask: be more careful with
> 'cpumask_setall()'"). So, despite that cpumask_weight() is passed
> with small_cpumask_bits, which is NR_CPUS in this case, it can't
> count over the nr_cpu_ids.
> 
> In outline case, cpumask_setall() may set bits beyond the limit up to
> the next byte alignment, but in this case small_cpumask_bits is wired
> to nr_cpu_ids, thus making overcounting impossible.
> 
> Signed-off-by: Yury Norov <ynorov@nvidia.com>
> ---
> 
> I've added some explicit tests for cpumask_weight() to make sure:
> https://lore.kernel.org/all/20260319004349.849281-1-ynorov@nvidia.com/
> 
>  arch/powerpc/sysdev/xive/common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index e1a4f8a97393..e91ec9036ad8 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -551,7 +551,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
>  	int cpu, first, num, i;
>  
>  	/* Pick up a starting point CPU in the mask based on  fuzz */
> -	num = min_t(int, cpumask_weight(mask), nr_cpu_ids);
> +	num = cpumask_weight(mask);
>  	first = fuzz % num;
>  
>  	/* Locate it */
> -- 
> 2.43.0
> 
LGTM

Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>

Re: [PATCH 0/2] powerpc/xive: rework xive_find_target_in_mask()

[Mukesh Kumar Chaurasiya]

On Wed, Mar 18, 2026 at 11:36:44PM -0400, Yury Norov wrote:
> Simplify the function by switching to using a modern cpumask API.
> 
> Yury Norov (2):
>   Revert "powerpc/xive: Fix the size of the cpumask used in
>     xive_find_target_in_mask()"
>   powerpc/xive: rework xive_find_target_in_mask()
> 
>  arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
>  1 file changed, 6 insertions(+), 25 deletions(-)
> 
> -- 
> 2.43.0
> 
Tested the whole series with 
https://lore.kernel.org/all/20260320054202.3245144-2-mkchauras@gmail.com/

Tested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>

Re: [PATCH 2/2] powerpc/xive: rework xive_find_target_in_mask()

[Shrikanth Hegde]

Hi Yury.

On 3/19/26 9:06 AM, Yury Norov wrote:
> Switch the function to using modern cpumask API and drop most of the
> housekeeping code.
> 
> Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just
> like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered,
> no special handling is needed.
> 
> Signed-off-by: Yury Norov <ynorov@nvidia.com>
> ---
>   arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
>   1 file changed, 6 insertions(+), 25 deletions(-)
> 
> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index e91ec9036ad8..4e05f678e171 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -548,40 +548,21 @@ static void xive_dec_target_count(int cpu)
>   static int xive_find_target_in_mask(const struct cpumask *mask,
>   				    unsigned int fuzz)
>   {
> -	int cpu, first, num, i;
> +	int cpu, first;
>   
>   	/* Pick up a starting point CPU in the mask based on  fuzz */
> -	num = cpumask_weight(mask);
> -	first = fuzz % num;
> -
> -	/* Locate it */
> -	cpu = cpumask_first(mask);
> -	for (i = 0; i < first && cpu < nr_cpu_ids; i++)
> -		cpu = cpumask_next(cpu, mask);
> -
> -	/* Sanity check */
> -	if (WARN_ON(cpu >= nr_cpu_ids))
> -		cpu = cpumask_first(cpu_online_mask);
> -
> -	/* Remember first one to handle wrap-around */
> -	first = cpu;
> +	fuzz %= cpumask_weight(mask);
> +	first = cpumask_nth(fuzz, mask);
> +	WARN_ON(first >= nr_cpu_ids);
>   
>   	/*
>   	 * Now go through the entire mask until we find a valid
>   	 * target.
>   	 */
> -	do {
> -		/*
> -		 * We re-check online as the fallback case passes us
> -		 * an untested affinity mask
> -		 */
> +	for_each_cpu_wrap(cpu, mask, first) {
>   		if (cpu_online(cpu) && xive_try_pick_target(cpu))
>   			return cpu;
> -		cpu = cpumask_next(cpu, mask);
> -		/* Wrap around */
> -		if (cpu >= nr_cpu_ids)
> -			cpu = cpumask_first(mask);
> -	} while (cpu != first);
> +	}
>   
>   	return -1;
>   }

Only concern i have, (which could potentially leads to while(1) loop
today if it), is if mask is empty. atleast for_each_cpu_wrap will not
be a while(1) loop.

So, IMO this is better than what we have today.

nit: maybe a good to add a WARN_ON(cpu >= nr_cpu_ids) in the end.

Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>

Re: [PATCH 2/2] powerpc/xive: rework xive_find_target_in_mask()

[Yury Norov]

On Sun, Mar 29, 2026 at 02:43:27PM +0530, Shrikanth Hegde wrote:
> Hi Yury.
> 
> On 3/19/26 9:06 AM, Yury Norov wrote:
> > Switch the function to using modern cpumask API and drop most of the
> > housekeeping code.
> > 
> > Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just
> > like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered,
> > no special handling is needed.
> > 
> > Signed-off-by: Yury Norov <ynorov@nvidia.com>
> > ---
> >   arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
> >   1 file changed, 6 insertions(+), 25 deletions(-)
> > 
> > diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> > index e91ec9036ad8..4e05f678e171 100644
> > --- a/arch/powerpc/sysdev/xive/common.c
> > +++ b/arch/powerpc/sysdev/xive/common.c
> > @@ -548,40 +548,21 @@ static void xive_dec_target_count(int cpu)
> >   static int xive_find_target_in_mask(const struct cpumask *mask,
> >   				    unsigned int fuzz)
> >   {
> > -	int cpu, first, num, i;
> > +	int cpu, first;
> >   	/* Pick up a starting point CPU in the mask based on  fuzz */
> > -	num = cpumask_weight(mask);
> > -	first = fuzz % num;
> > -
> > -	/* Locate it */
> > -	cpu = cpumask_first(mask);
> > -	for (i = 0; i < first && cpu < nr_cpu_ids; i++)
> > -		cpu = cpumask_next(cpu, mask);
> > -
> > -	/* Sanity check */
> > -	if (WARN_ON(cpu >= nr_cpu_ids))
> > -		cpu = cpumask_first(cpu_online_mask);
> > -
> > -	/* Remember first one to handle wrap-around */
> > -	first = cpu;
> > +	fuzz %= cpumask_weight(mask);
> > +	first = cpumask_nth(fuzz, mask);
> > +	WARN_ON(first >= nr_cpu_ids);
> >   	/*
> >   	 * Now go through the entire mask until we find a valid
> >   	 * target.
> >   	 */
> > -	do {
> > -		/*
> > -		 * We re-check online as the fallback case passes us
> > -		 * an untested affinity mask
> > -		 */
> > +	for_each_cpu_wrap(cpu, mask, first) {
> >   		if (cpu_online(cpu) && xive_try_pick_target(cpu))
> >   			return cpu;
> > -		cpu = cpumask_next(cpu, mask);
> > -		/* Wrap around */
> > -		if (cpu >= nr_cpu_ids)
> > -			cpu = cpumask_first(mask);
> > -	} while (cpu != first);
> > +	}
> >   	return -1;
> >   }
> 
> Only concern i have, (which could potentially leads to while(1) loop
> today if it), is if mask is empty. atleast for_each_cpu_wrap will not
> be a while(1) loop.
> 
> So, IMO this is better than what we have today.
> 
> nit: maybe a good to add a WARN_ON(cpu >= nr_cpu_ids) in the end.
> 
> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
 
The iterator of for_each_cpu() is always >= nr_cpu_ids when it exits the
loop because it's the exit condition. If you want to warn user before
returning -1, just do __WARN().

Re: [PATCH 2/2] powerpc/xive: rework xive_find_target_in_mask()

[Shrikanth Hegde]

Hi Yury,

On 3/30/26 10:34 PM, Yury Norov wrote:
> On Sun, Mar 29, 2026 at 02:43:27PM +0530, Shrikanth Hegde wrote:
>> Hi Yury.
>>
>> On 3/19/26 9:06 AM, Yury Norov wrote:
>>> Switch the function to using modern cpumask API and drop most of the
>>> housekeeping code.
>>>
>>> Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just
>>> like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered,
>>> no special handling is needed.
>>>
>>> Signed-off-by: Yury Norov <ynorov@nvidia.com>
>>> ---
>>>    arch/powerpc/sysdev/xive/common.c | 31 ++++++-------------------------
>>>    1 file changed, 6 insertions(+), 25 deletions(-)
>>>
>>> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
>>> index e91ec9036ad8..4e05f678e171 100644
>>> --- a/arch/powerpc/sysdev/xive/common.c
>>> +++ b/arch/powerpc/sysdev/xive/common.c
>>> @@ -548,40 +548,21 @@ static void xive_dec_target_count(int cpu)
>>>    static int xive_find_target_in_mask(const struct cpumask *mask,
>>>    				    unsigned int fuzz)
>>>    {
>>> -	int cpu, first, num, i;
>>> +	int cpu, first;
>>>    	/* Pick up a starting point CPU in the mask based on  fuzz */
>>> -	num = cpumask_weight(mask);
>>> -	first = fuzz % num;
>>> -
>>> -	/* Locate it */
>>> -	cpu = cpumask_first(mask);
>>> -	for (i = 0; i < first && cpu < nr_cpu_ids; i++)
>>> -		cpu = cpumask_next(cpu, mask);
>>> -
>>> -	/* Sanity check */
>>> -	if (WARN_ON(cpu >= nr_cpu_ids))
>>> -		cpu = cpumask_first(cpu_online_mask);
>>> -
>>> -	/* Remember first one to handle wrap-around */
>>> -	first = cpu;
>>> +	fuzz %= cpumask_weight(mask);
>>> +	first = cpumask_nth(fuzz, mask);
>>> +	WARN_ON(first >= nr_cpu_ids);
>>>    	/*
>>>    	 * Now go through the entire mask until we find a valid
>>>    	 * target.
>>>    	 */
>>> -	do {
>>> -		/*
>>> -		 * We re-check online as the fallback case passes us
>>> -		 * an untested affinity mask
>>> -		 */
>>> +	for_each_cpu_wrap(cpu, mask, first) {
>>>    		if (cpu_online(cpu) && xive_try_pick_target(cpu))
>>>    			return cpu;
>>> -		cpu = cpumask_next(cpu, mask);
>>> -		/* Wrap around */
>>> -		if (cpu >= nr_cpu_ids)
>>> -			cpu = cpumask_first(mask);
>>> -	} while (cpu != first);
>>> +	}
>>>    	return -1;
>>>    }
>>
>> Only concern i have, (which could potentially leads to while(1) loop
>> today if it), is if mask is empty. atleast for_each_cpu_wrap will not
>> be a while(1) loop.
>>
>> So, IMO this is better than what we have today.
>>
>> nit: maybe a good to add a WARN_ON(cpu >= nr_cpu_ids) in the end.
>>
>> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
>   
> The iterator of for_each_cpu() is always >= nr_cpu_ids when it exits the
> loop because it's the exit condition. If you want to warn user before
> returning -1, just do __WARN().

Ok.

It might take a while a while to send the next version out since i am
working on getting the next version of that paravirt series out soon.

Re: [PATCH 2/2] powerpc/xive: rework xive_find_target_in_mask()

[Madhavan Srinivasan]

On 3/31/26 8:29 AM, Shrikanth Hegde wrote:
> Hi Yury,
>
> On 3/30/26 10:34 PM, Yury Norov wrote:
>> On Sun, Mar 29, 2026 at 02:43:27PM +0530, Shrikanth Hegde wrote:
>>> Hi Yury.
>>>
>>> On 3/19/26 9:06 AM, Yury Norov wrote:
>>>> Switch the function to using modern cpumask API and drop most of the
>>>> housekeeping code.
>>>>
>>>> Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator 
>>>> behaves just
>>>> like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is 
>>>> triggered,
>>>> no special handling is needed.
>>>>
>>>> Signed-off-by: Yury Norov <ynorov@nvidia.com>
>>>> ---
>>>>    arch/powerpc/sysdev/xive/common.c | 31 
>>>> ++++++-------------------------
>>>>    1 file changed, 6 insertions(+), 25 deletions(-)
>>>>
>>>> diff --git a/arch/powerpc/sysdev/xive/common.c 
>>>> b/arch/powerpc/sysdev/xive/common.c
>>>> index e91ec9036ad8..4e05f678e171 100644
>>>> --- a/arch/powerpc/sysdev/xive/common.c
>>>> +++ b/arch/powerpc/sysdev/xive/common.c
>>>> @@ -548,40 +548,21 @@ static void xive_dec_target_count(int cpu)
>>>>    static int xive_find_target_in_mask(const struct cpumask *mask,
>>>>                        unsigned int fuzz)
>>>>    {
>>>> -    int cpu, first, num, i;
>>>> +    int cpu, first;
>>>>        /* Pick up a starting point CPU in the mask based on fuzz */
>>>> -    num = cpumask_weight(mask);
>>>> -    first = fuzz % num;
>>>> -
>>>> -    /* Locate it */
>>>> -    cpu = cpumask_first(mask);
>>>> -    for (i = 0; i < first && cpu < nr_cpu_ids; i++)
>>>> -        cpu = cpumask_next(cpu, mask);
>>>> -
>>>> -    /* Sanity check */
>>>> -    if (WARN_ON(cpu >= nr_cpu_ids))
>>>> -        cpu = cpumask_first(cpu_online_mask);
>>>> -
>>>> -    /* Remember first one to handle wrap-around */
>>>> -    first = cpu;
>>>> +    fuzz %= cpumask_weight(mask);
>>>> +    first = cpumask_nth(fuzz, mask);
>>>> +    WARN_ON(first >= nr_cpu_ids);
>>>>        /*
>>>>         * Now go through the entire mask until we find a valid
>>>>         * target.
>>>>         */
>>>> -    do {
>>>> -        /*
>>>> -         * We re-check online as the fallback case passes us
>>>> -         * an untested affinity mask
>>>> -         */
>>>> +    for_each_cpu_wrap(cpu, mask, first) {
>>>>            if (cpu_online(cpu) && xive_try_pick_target(cpu))
>>>>                return cpu;
>>>> -        cpu = cpumask_next(cpu, mask);
>>>> -        /* Wrap around */
>>>> -        if (cpu >= nr_cpu_ids)
>>>> -            cpu = cpumask_first(mask);
>>>> -    } while (cpu != first);
>>>> +    }
>>>>        return -1;
>>>>    }
>>>
>>> Only concern i have, (which could potentially leads to while(1) loop
>>> today if it), is if mask is empty. atleast for_each_cpu_wrap will not
>>> be a while(1) loop.
>>>
>>> So, IMO this is better than what we have today.
>>>
>>> nit: maybe a good to add a WARN_ON(cpu >= nr_cpu_ids) in the end.
>>>
>>> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
>>   The iterator of for_each_cpu() is always >= nr_cpu_ids when it 
>> exits the
>> loop because it's the exit condition. If you want to warn user before
>> returning -1, just do __WARN().
>
> Ok.
>
> It might take a while a while to send the next version out since i am
> working on getting the next version of that paravirt series out soon.
OK, I am pulling this patchset as-is for next merge. I will expect
a followup patch  to add a __WARN().

Maddy