PCI: dwc: ep: Refresh MSI Message Address cache on change

Endpoint drivers use dw_pcie_ep_raise_msi_irq() to raise MSI interrupts to
the host.  After 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU
mapping"), dw_pcie_ep_raise_msi_irq() caches the Message Address from the
MSI Capability in ep->msi_msg_addr.  But that Message Address is controlled
by the host, and it may change.  For example, if:

  - firmware on the host configures the Message Address and triggers an
    MSI,

  - a driver on the Endpoint raises the MSI via dw_pcie_ep_raise_msi_irq(),
    which caches the Message Address,

  - a kernel on the host reconfigures the Message Address and the host
    kernel driver triggers another MSI,

dw_pcie_ep_raise_msi_irq() notices that the Message Address no longer
matches the cached ep->msi_msg_addr, warns about it, and returns error
instead of raising the MSI.  The host kernel may hang because it never
receives the MSI.

This was seen with the nvmet_pci_epf_driver: the host UEFI performs NVMe
commands, e.g. Identify Controller to get the name of the controller,
nvmet-pci-epf posts the completion queue entry and raises an IRQ using
dw_pcie_ep_raise_msi_irq().  When the host boots Linux, we see a
WARN_ON_ONCE() from dw_pcie_ep_raise_msi_irq(), and the host kernel hangs
because the nvme driver never gets an IRQ.

Remove the warning when dw_pcie_ep_raise_msi_irq() notices that Message
Address has changed, remap using the new address, and update the
ep->msi_msg_addr cache.

Fixes: 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Tested-by: Koichiro Den <den@valinux.co.jp>
Acked-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260210181225.3926165-2-cassel@kernel.org

diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
index 295076cf70de9768e4b34bd85fde86282b6783bb..35d8fc5e1d201a41e73e4b3bc4a5f47bc4c96bda 100644 (file)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -905,6 +905,19 @@ int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
         * supported, so we avoid reprogramming the region on every MSI,
         * specifically unmapping immediately after writel().
         */
+       if (ep->msi_iatu_mapped && (ep->msi_msg_addr != msg_addr ||
+                                   ep->msi_map_size != map_size)) {
+               /*
+                * The host changed the MSI target address or the required
+                * mapping size changed. Reprogramming the iATU when there are
+                * operations in flight is unsafe on this controller. However,
+                * there is no unified way to check if we have operations in
+                * flight, thus we don't know if we should WARN() or not.
+                */
+               dw_pcie_ep_unmap_addr(epc, func_no, 0, ep->msi_mem_phys);
+               ep->msi_iatu_mapped = false;
+       }
+
        if (!ep->msi_iatu_mapped) {
                ret = dw_pcie_ep_map_addr(epc, func_no, 0,
                                          ep->msi_mem_phys, msg_addr,
@@ -915,15 +928,6 @@ int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
                ep->msi_iatu_mapped = true;
                ep->msi_msg_addr = msg_addr;
                ep->msi_map_size = map_size;
-       } else if (WARN_ON_ONCE(ep->msi_msg_addr != msg_addr ||
-                               ep->msi_map_size != map_size)) {
-               /*
-                * The host changed the MSI target address or the required
-                * mapping size changed. Reprogramming the iATU at runtime is
-                * unsafe on this controller, so bail out instead of trying to
-                * update the existing region.
-                */
-               return -EINVAL;
        }
 
        writel(msg_data | (interrupt_num - 1), ep->msi_mem + offset);