[PATCH 0/2] NTB: epf: Fix ntb_hw_epf ISR issues

[PATCH 0/2] NTB: epf: Fix ntb_hw_epf ISR issues

[Koichiro Den]

ntb_hw_epf handles doorbell interrupts using multiple MSI/MSI-X vectors.
This small patch series is to address two issues in the interrupt
setup/handler path:

 1) ntb_epf_init_isr() does not unwind already requested IRQs when
    request_irq() fails part-way through the vector loop.

 2) ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to
    derive the vector number. pci_irq_vector() performs an MSI domain
    lookup (msi_get_virq()) that takes a mutex, which can trigger
    "scheduling while atomic" splats.

Patch 1 fixes the request_irq() unwind path.
Patch 2 caches the Linux IRQ number for vector 0 and uses it as a base in
the ISR, avoiding pci_irq_vector() from hardirq context.

Both patches are Cc'd to stable (v5.12+).

Best regards,
Koichiro

Koichiro Den (2):
  NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
  NTB: epf: Avoid pci_irq_vector() from hardirq context

 drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

-- 
2.51.0

[PATCH 1/2] NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

[Koichiro Den]

ntb_epf_init_isr() requests multiple MSI/MSI-X vectors in a loop. If
request_irq() fails part-way through, it jumps straight to
pci_free_irq_vectors() without freeing already requested IRQs.

Fix the error path by freeing any successfully requested IRQs before
releasing the vectors.

Cc: stable@vger.kernel.org # v5.12+
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/ntb/hw/epf/ntb_hw_epf.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index d3ecf25a5162..5a35f341f821 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -355,7 +355,7 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
 				  0, "ntb_epf", ndev);
 		if (ret) {
 			dev_err(dev, "Failed to request irq\n");
-			goto err_request_irq;
+			goto err_free_irq;
 		}
 	}
 
@@ -365,16 +365,14 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
 				   argument | irq);
 	if (ret) {
 		dev_err(dev, "Failed to configure doorbell\n");
-		goto err_configure_db;
+		goto err_free_irq;
 	}
 
 	return 0;
 
-err_configure_db:
-	for (i = 0; i < ndev->db_count + 1; i++)
+err_free_irq:
+	while (i--)
 		free_irq(pci_irq_vector(pdev, i), ndev);
-
-err_request_irq:
 	pci_free_irq_vectors(pdev);
 
 	return ret;
-- 
2.51.0

[PATCH 2/2] NTB: epf: Avoid pci_irq_vector() from hardirq context

[Koichiro Den]

ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive
the vector number. pci_irq_vector() calls msi_get_virq() that takes a
mutex and can therefore trigger "scheduling while atomic" splats.

  BUG: scheduling while atomic: kworker/u33:0/55/0x00010001
  ...
  Call trace:
   ...
   schedule+0x38/0x110
   schedule_preempt_disabled+0x28/0x50
   __mutex_lock.constprop.0+0x848/0x908
   __mutex_lock_slowpath+0x18/0x30
   mutex_lock+0x4c/0x60
   msi_domain_get_virq+0xe8/0x138
   pci_irq_vector+0x2c/0x60
   ntb_epf_vec_isr+0x28/0x120 [ntb_hw_epf]
   __handle_irq_event_percpu+0x70/0x3a8
   handle_irq_event+0x48/0x100
   handle_edge_irq+0x100/0x1c8
   ...

Cache the Linux IRQ number for vector 0 when vectors are allocated and
use it as a base in the ISR. Running the ISR in a threaded IRQ handler
would also avoid the problem, but that would be unnecessary here.

Cc: stable@vger.kernel.org # v5.12+
Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/ntb/hw/epf/ntb_hw_epf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index 5a35f341f821..8925c688930c 100644
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -92,6 +92,7 @@ struct ntb_epf_dev {
 
 	int db_val;
 	u64 db_valid_mask;
+	int irq_base;
 };
 
 #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
@@ -318,7 +319,7 @@ static irqreturn_t ntb_epf_vec_isr(int irq, void *dev)
 	struct ntb_epf_dev *ndev = dev;
 	int irq_no;
 
-	irq_no = irq - pci_irq_vector(ndev->ntb.pdev, 0);
+	irq_no = irq - ndev->irq_base;
 	ndev->db_val = irq_no + 1;
 
 	if (irq_no == 0)
@@ -350,6 +351,7 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
 		argument &= ~MSIX_ENABLE;
 	}
 
+	ndev->irq_base = pci_irq_vector(pdev, 0);
 	for (i = 0; i < irq; i++) {
 		ret = request_irq(pci_irq_vector(pdev, i), ntb_epf_vec_isr,
 				  0, "ntb_epf", ndev);
-- 
2.51.0

Re: [PATCH 0/2] NTB: epf: Fix ntb_hw_epf ISR issues

[Koichiro Den]

On Wed, Mar 04, 2026 at 05:30:26PM +0900, Koichiro Den wrote:
> ntb_hw_epf handles doorbell interrupts using multiple MSI/MSI-X vectors.
> This small patch series is to address two issues in the interrupt
> setup/handler path:
> 
>  1) ntb_epf_init_isr() does not unwind already requested IRQs when
>     request_irq() fails part-way through the vector loop.
> 
>  2) ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to
>     derive the vector number. pci_irq_vector() performs an MSI domain
>     lookup (msi_get_virq()) that takes a mutex, which can trigger
>     "scheduling while atomic" splats.
> 
> Patch 1 fixes the request_irq() unwind path.
> Patch 2 caches the Linux IRQ number for vector 0 and uses it as a base in
> the ISR, avoiding pci_irq_vector() from hardirq context.
> 
> Both patches are Cc'd to stable (v5.12+).
> 
> Best regards,
> Koichiro
> 
> Koichiro Den (2):
>   NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
>   NTB: epf: Avoid pci_irq_vector() from hardirq context

Jon or Dave,

Gentle ping on this series.
I would appreciate it if you could take a look when you have a chance.

Best regards,
Koichiro

> 
>  drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> -- 
> 2.51.0
> 
> 

Re: [PATCH 0/2] NTB: epf: Fix ntb_hw_epf ISR issues

[Dave Jiang]

On 3/16/26 8:01 PM, Koichiro Den wrote:
> On Wed, Mar 04, 2026 at 05:30:26PM +0900, Koichiro Den wrote:
>> ntb_hw_epf handles doorbell interrupts using multiple MSI/MSI-X vectors.
>> This small patch series is to address two issues in the interrupt
>> setup/handler path:
>>
>>  1) ntb_epf_init_isr() does not unwind already requested IRQs when
>>     request_irq() fails part-way through the vector loop.
>>
>>  2) ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to
>>     derive the vector number. pci_irq_vector() performs an MSI domain
>>     lookup (msi_get_virq()) that takes a mutex, which can trigger
>>     "scheduling while atomic" splats.
>>
>> Patch 1 fixes the request_irq() unwind path.
>> Patch 2 caches the Linux IRQ number for vector 0 and uses it as a base in
>> the ISR, avoiding pci_irq_vector() from hardirq context.
>>
>> Both patches are Cc'd to stable (v5.12+).
>>
>> Best regards,
>> Koichiro
>>
>> Koichiro Den (2):
>>   NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
>>   NTB: epf: Avoid pci_irq_vector() from hardirq context
> 
> Jon or Dave,
> 
> Gentle ping on this series.
> I would appreciate it if you could take a look when you have a chance.

For the series, LGTM
Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> 
> Best regards,
> Koichiro
> 
>>
>>  drivers/ntb/hw/epf/ntb_hw_epf.c | 14 +++++++-------
>>  1 file changed, 7 insertions(+), 7 deletions(-)
>>
>> -- 
>> 2.51.0
>>
>>