[PATH v2] NVMe: init nvme queue before enabling irq

[PATH v2] NVMe: init nvme queue before enabling irq

[Wenbo Wang]

From: Wenbo Wang <wenbo.wang@memblaze.com>

During reset process, the nvme_dev->bar (ioremapped) may change,
so nvmeq->q_db shall be also updated by nvme_init_queue().

Currently nvmeq irq is enabled before queue init, so a spurious
interrupt triggered nvme_process_cq may access nvmeq->q_db just
before it is updated, this could cause kernel panic.

Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>
---
 drivers/nvme/host/pci.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index f5c0e26..3371c18 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1529,9 +1529,6 @@ static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
 	snprintf(nvmeq->irqname, sizeof(nvmeq->irqname), "nvme%dq%d",
 			dev->instance, qid);
 	spin_lock_init(&nvmeq->q_lock);
-	nvmeq->cq_head = 0;
-	nvmeq->cq_phase = 1;
-	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
 	nvmeq->q_depth = depth;
 	nvmeq->qid = qid;
 	nvmeq->cq_vector = -1;
@@ -1590,11 +1587,17 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
 	if (result < 0)
 		goto release_cq;
 
+	/*
+	 * Init queue door bell ioremap address before enabling irq, if not,
+	 * a spurious interrupt triggered nvme_process_cq may access invalid
+	 * address
+	 */
+	nvme_init_queue(nvmeq, qid);
+
 	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
 	if (result < 0)
 		goto release_sq;
 
-	nvme_init_queue(nvmeq, qid);
 	return result;
 
  release_sq:
@@ -1789,6 +1792,8 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
 	if (result)
 		goto free_nvmeq;
 
+	nvme_init_queue(nvmeq, 0);
+
 	nvmeq->cq_vector = 0;
 	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
 	if (result) {
@@ -3164,7 +3169,6 @@ static void nvme_probe_work(struct work_struct *work)
 		goto disable;
 	}
 
-	nvme_init_queue(dev->queues[0], 0);
 	result = nvme_alloc_admin_tags(dev);
 	if (result)
 		goto disable;
-- 
1.8.3.1

[PATH v2] NVMe: init nvme queue before enabling irq

[Sagi Grimberg]

> From: Wenbo Wang <wenbo.wang at memblaze.com>
>
> During reset process, the nvme_dev->bar (ioremapped) may change,
> so nvmeq->q_db shall be also updated by nvme_init_queue().
>
> Currently nvmeq irq is enabled before queue init, so a spurious
> interrupt triggered nvme_process_cq may access nvmeq->q_db just
> before it is updated, this could cause kernel panic.
>
> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>

You should add Cc: stable at vger.kernel.org here,
git-send-email will take care of the CC for you.

[PATH v2] NVMe: init nvme queue before enabling irq

[Keith Busch]

On Wed, Jan 20, 2016@05:48:35AM -0500, Wenbo Wang wrote:
> From: Wenbo Wang <wenbo.wang at memblaze.com>
> 
> During reset process, the nvme_dev->bar (ioremapped) may change,
> so nvmeq->q_db shall be also updated by nvme_init_queue().
> 
> Currently nvmeq irq is enabled before queue init, so a spurious
> interrupt triggered nvme_process_cq may access nvmeq->q_db just
> before it is updated, this could cause kernel panic.
> 
> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>

Looks good, thanks for the fix.

Acked-by: Keith Busch <keith.busch at intel.com>

[PATH v2] NVMe: init nvme queue before enabling irq

[Johannes Thumshirn]

On Wed, Jan 20, 2016@05:48:35AM -0500, Wenbo Wang wrote:
> From: Wenbo Wang <wenbo.wang at memblaze.com>
> 
> During reset process, the nvme_dev->bar (ioremapped) may change,
> so nvmeq->q_db shall be also updated by nvme_init_queue().
> 
> Currently nvmeq irq is enabled before queue init, so a spurious
> interrupt triggered nvme_process_cq may access nvmeq->q_db just
> before it is updated, this could cause kernel panic.
> 
> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>
> ---
>  drivers/nvme/host/pci.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
> index f5c0e26..3371c18 100644
> --- a/drivers/nvme/host/pci.c
> +++ b/drivers/nvme/host/pci.c
> @@ -1529,9 +1529,6 @@ static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid,
>  	snprintf(nvmeq->irqname, sizeof(nvmeq->irqname), "nvme%dq%d",
>  			dev->instance, qid);
>  	spin_lock_init(&nvmeq->q_lock);
> -	nvmeq->cq_head = 0;
> -	nvmeq->cq_phase = 1;
> -	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
>  	nvmeq->q_depth = depth;
>  	nvmeq->qid = qid;
>  	nvmeq->cq_vector = -1;
> @@ -1590,11 +1587,17 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
>  	if (result < 0)
>  		goto release_cq;
>  
> +	/*
> +	 * Init queue door bell ioremap address before enabling irq, if not,
> +	 * a spurious interrupt triggered nvme_process_cq may access invalid
> +	 * address
> +	 */
> +	nvme_init_queue(nvmeq, qid);
> +
>  	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
>  	if (result < 0)
>  		goto release_sq;
>  
> -	nvme_init_queue(nvmeq, qid);
>  	return result;
>  
>   release_sq:
> @@ -1789,6 +1792,8 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
>  	if (result)
>  		goto free_nvmeq;
>  
> +	nvme_init_queue(nvmeq, 0);
> +
>  	nvmeq->cq_vector = 0;
>  	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
>  	if (result) {
> @@ -3164,7 +3169,6 @@ static void nvme_probe_work(struct work_struct *work)
>  		goto disable;
>  	}
>  
> -	nvme_init_queue(dev->queues[0], 0);
>  	result = nvme_alloc_admin_tags(dev);
>  	if (result)
>  		goto disable;
> -- 
> 1.8.3.1
> 
> 
> 
> _______________________________________________
> Linux-nvme mailing list
> Linux-nvme at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-nvme



Reviewed-by: Johannes Thumshirn <jthumshirn at suse.de>

-- 
Johannes Thumshirn                                          Storage
jthumshirn at suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N?rnberg
GF: Felix Imend?rffer, Jane Smithard, Graham Norton
HRB 21284 (AG N?rnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

[PATH v2] NVMe: init nvme queue before enabling irq

[Greg KH]

On Wed, Jan 20, 2016@05:48:35AM -0500, Wenbo Wang wrote:
> From: Wenbo Wang <wenbo.wang at memblaze.com>
> 
> During reset process, the nvme_dev->bar (ioremapped) may change,
> so nvmeq->q_db shall be also updated by nvme_init_queue().
> 
> Currently nvmeq irq is enabled before queue init, so a spurious
> interrupt triggered nvme_process_cq may access nvmeq->q_db just
> before it is updated, this could cause kernel panic.
> 
> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>
> ---
>  drivers/nvme/host/pci.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read Documentation/stable_kernel_rules.txt
for how to do this properly.

</formletter>

[PATH v2] NVMe: init nvme queue before enabling irq

[Jens Axboe]

On 01/20/2016 10:12 AM, Greg KH wrote:
> On Wed, Jan 20, 2016@05:48:35AM -0500, Wenbo Wang wrote:
>> From: Wenbo Wang <wenbo.wang at memblaze.com>
>>
>> During reset process, the nvme_dev->bar (ioremapped) may change,
>> so nvmeq->q_db shall be also updated by nvme_init_queue().
>>
>> Currently nvmeq irq is enabled before queue init, so a spurious
>> interrupt triggered nvme_process_cq may access nvmeq->q_db just
>> before it is updated, this could cause kernel panic.
>>
>> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
>> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>
>> ---
>>   drivers/nvme/host/pci.c | 14 +++++++++-----
>>   1 file changed, 9 insertions(+), 5 deletions(-)
>
> <formletter>
>
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree.  Please read Documentation/stable_kernel_rules.txt
> for how to do this properly.

I'll mark it stable when adding, just ignore it for now.

-- 
Jens Axboe

[PATH v2] NVMe: init nvme queue before enabling irq

[Johannes Thumshirn]

On 2016-01-20 11:48, Wenbo Wang wrote:
> From: Wenbo Wang <wenbo.wang at memblaze.com>
> 
> During reset process, the nvme_dev->bar (ioremapped) may change,
> so nvmeq->q_db shall be also updated by nvme_init_queue().
> 
> Currently nvmeq irq is enabled before queue init, so a spurious
> interrupt triggered nvme_process_cq may access nvmeq->q_db just
> before it is updated, this could cause kernel panic.
> 
> Signed-off-by: Wenbo Wang <wenbo.wang at memblaze.com>
> Reviewed-by: Wenwei Tao <wenwei.tao at memblaze.com>
> ---
>  drivers/nvme/host/pci.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
> index f5c0e26..3371c18 100644
> --- a/drivers/nvme/host/pci.c
> +++ b/drivers/nvme/host/pci.c
> @@ -1529,9 +1529,6 @@ static struct nvme_queue
> *nvme_alloc_queue(struct nvme_dev *dev, int qid,
>  	snprintf(nvmeq->irqname, sizeof(nvmeq->irqname), "nvme%dq%d",
>  			dev->instance, qid);
>  	spin_lock_init(&nvmeq->q_lock);
> -	nvmeq->cq_head = 0;
> -	nvmeq->cq_phase = 1;
> -	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
>  	nvmeq->q_depth = depth;
>  	nvmeq->qid = qid;
>  	nvmeq->cq_vector = -1;
> @@ -1590,11 +1587,17 @@ static int nvme_create_queue(struct nvme_queue
> *nvmeq, int qid)
>  	if (result < 0)
>  		goto release_cq;
> 
> +	/*
> +	 * Init queue door bell ioremap address before enabling irq, if not,
> +	 * a spurious interrupt triggered nvme_process_cq may access invalid
> +	 * address
> +	 */
> +	nvme_init_queue(nvmeq, qid);
> +
>  	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
>  	if (result < 0)
>  		goto release_sq;
> 
> -	nvme_init_queue(nvmeq, qid);
>  	return result;
> 
>   release_sq:
> @@ -1789,6 +1792,8 @@ static int nvme_configure_admin_queue(struct
> nvme_dev *dev)
>  	if (result)
>  		goto free_nvmeq;
> 
> +	nvme_init_queue(nvmeq, 0);
> +
>  	nvmeq->cq_vector = 0;
>  	result = queue_request_irq(dev, nvmeq, nvmeq->irqname);
>  	if (result) {
> @@ -3164,7 +3169,6 @@ static void nvme_probe_work(struct work_struct 
> *work)
>  		goto disable;
>  	}
> 
> -	nvme_init_queue(dev->queues[0], 0);
>  	result = nvme_alloc_admin_tags(dev);
>  	if (result)
>  		goto disable;

What ever happened to this patch?
I can easily reproduce the bug using
while [ true ]; do rmmod nvme nvme_core; modprobe nvme; done

[PATH v2] NVMe: init nvme queue before enabling irq

[Keith Busch]

On Wed, May 11, 2016@11:25:16AM +0200, Johannes Thumshirn wrote:
> What ever happened to this patch?
> I can easily reproduce the bug using
> while [ true ]; do rmmod nvme nvme_core; modprobe nvme; done

This patch was supposed to fix using a doorbell between resets when the
driver had BAR0 unmapped. We don't ever unmap the bar anymore, so this
patch shouldn't be necessary: the doorbell is already set during queue
allocation before requset_irq.

The test doesn't seem like this patch would help either. It sounds
more like you're hitting somethine else if you don't have this fix:

  https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit/?h=for-linus&id=9bf2b972afeaffd173fe2ce211ebc555ea7e8a87

If you do have that fix already, I'd like to see the panic stack trace
(assuming that's what happened).

[PATH v2] NVMe: init nvme queue before enabling irq

[Johannes Thumshirn]

On Wed, May 11, 2016@03:16:33PM -0400, Keith Busch wrote:
> On Wed, May 11, 2016@11:25:16AM +0200, Johannes Thumshirn wrote:
> > What ever happened to this patch?
> > I can easily reproduce the bug using
> > while [ true ]; do rmmod nvme nvme_core; modprobe nvme; done
> 
> This patch was supposed to fix using a doorbell between resets when the
> driver had BAR0 unmapped. We don't ever unmap the bar anymore, so this
> patch shouldn't be necessary: the doorbell is already set during queue
> allocation before requset_irq.
> 
> The test doesn't seem like this patch would help either. It sounds
> more like you're hitting somethine else if you don't have this fix:
> 
>   https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit/?h=for-linus&id=9bf2b972afeaffd173fe2ce211ebc555ea7e8a87
> 
> If you do have that fix already, I'd like to see the panic stack trace
> (assuming that's what happened).

Yup, having that commit.

I'm going to reproduce (with current Linus' master) w/o the patch applied
later today.

-- 
Johannes Thumshirn                                          Storage
jthumshirn at suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N?rnberg
GF: Felix Imend?rffer, Jane Smithard, Graham Norton
HRB 21284 (AG N?rnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

[PATH v2] NVMe: init nvme queue before enabling irq

[Johannes Thumshirn]

On Wed, May 11, 2016@03:16:33PM -0400, Keith Busch wrote:
> On Wed, May 11, 2016@11:25:16AM +0200, Johannes Thumshirn wrote:
> > What ever happened to this patch?
> > I can easily reproduce the bug using
> > while [ true ]; do rmmod nvme nvme_core; modprobe nvme; done
> 
> This patch was supposed to fix using a doorbell between resets when the
> driver had BAR0 unmapped. We don't ever unmap the bar anymore, so this
> patch shouldn't be necessary: the doorbell is already set during queue
> allocation before requset_irq.
> 
> The test doesn't seem like this patch would help either. It sounds
> more like you're hitting somethine else if you don't have this fix:
> 
>   https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit/?h=for-linus&id=9bf2b972afeaffd173fe2ce211ebc555ea7e8a87
> 
> If you do have that fix already, I'd like to see the panic stack trace
> (assuming that's what happened).

So for whatever reason I cannot reproduce it anymore with mainline, though I'm
sure I _did_ test mainline and it failed as well.

Sorry,
	Johannes
-- 
Johannes Thumshirn                                          Storage
jthumshirn at suse.de                                +49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N?rnberg
GF: Felix Imend?rffer, Jane Smithard, Graham Norton
HRB 21284 (AG N?rnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850