Re: [PATCH] PCI: dwc: ep: Fix regression in dw_pcie_ep_raise_msi_irq()

[Bjorn Helgaas <helgaas@kernel.org>]

On Tue, Feb 10, 2026 at 07:12:25PM +0100, Niklas Cassel wrote:
> When using the nvmet-pci-epf EPF driver, and starting the EP before
> starting a host with UEFI, the UEFI performs NVMe commands e.g.
> Identify Controller, to get the name of the controller.
> 
> nvmet-pci-epf will post the CQE (completion queue entry) to the Admin
> Completion Queue, and then raise an IRQ (using
> dw_pcie_ep_raise_msi_irq()).
> 
> Once the host boots Linux, we will see a WARN_ON_ONCE() from
> dw_pcie_ep_raise_msi_irq(), and then the booting of the host hangs,
> because it never gets an IRQ when loading the nvme driver.
> 
> The reason is that the MSI target address used by UEFI and Linux might
> be different, which will cause dw_pcie_ep_raise_msi_irq() to simply
> return -EINVAL.
> 
> This was working before commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI
> outbound iATU mapping"), so this is a regression.
> 
> Also, remove the warning, as we cannot know if there are operations in
> flight or not, so it seems wrong to print this warning unconditionally
> at every boot when e.g. nvmet-pci-epf is used with a host with UEFI.

I put this on pci/for-linus for v7.0, thanks!

I'd like to make the commit log a little more general, since the issue
affects any endpoint driver.  Here's my proposal; I'll update it based
on your feedback:

  PCI: dwc: ep: Fix dw_pcie_ep_raise_msi_irq() Message Address cache

  Endpoint drivers use dw_pcie_ep_raise_msi_irq() to raise MSI interrupts to
  the host.  After 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU
  mapping"), dw_pcie_ep_raise_msi_irq() caches the Message Address from the
  MSI Capability in ep->msi_msg_addr.  But that Message Address is controlled
  by the host, and it may change.  For example, if:

    - firmware on the host configures the Message Address and triggers an
      MSI,

    - a driver on the Endpoint raises the MSI via dw_pcie_ep_raise_msi_irq(),
      which caches the Message Address,

    - a kernel on the host reconfigures the Message Address and the host
      kernel driver triggers another MSI,

  dw_pcie_ep_raise_msi_irq() notices that the Message Address no longer
  matches the cached ep->msi_msg_addr, warns about it, and returns error
  instead of raising the MSI.  The host kernel may hang because it never
  receives the MSI.

  This was seen with the nvmet_pci_epf_driver: the host UEFI performs NVMe
  commands, e.g. Identify Controller to get the name of the controller,
  nvmet-pci-epf posts the completion queue entry and raises an IRQ using
  dw_pcie_ep_raise_msi_irq().  When the host boots Linux, we see a
  WARN_ON_ONCE() from dw_pcie_ep_raise_msi_irq(), and the host kernel hangs
  because the nvme driver never gets an IRQ.

  Remove the warning when dw_pcie_ep_raise_msi_irq() notices that Message
  Address has changed, remap using the new address, and update the
  ep->msi_msg_addr cache.