The controller memory buffer is remapped into a kernel address on each
reset, but the driver was setting the submission queue base address
only on the very first queue creation. The remapped address is likely to
change after a reset, so accessing the old address will hit a kernel bug.
This patch fixes that by setting the queue's CMB base address each time
the queue is created.
Cherry-pick from upstream commit 815c6704bf9f ("nvme-pci: Remap CMB SQ
entries on every controller reset")
Fixes: f63572dff1421 ("nvme: unmap CMB and remove sysfs file in reset path")
Reported-by: Christian Black <christian.d.black@xxxxxxxxx>
Cc: Jon Derrick <jonathan.derrick@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # 4.9+
Signed-off-by: Keith Busch <keith.busch@xxxxxxxxx>
Reviewed-by: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Gavin Shan <shan.gavin@xxxxxxxxxxxxxxxxx>
---
drivers/nvme/host/pci.c | 29 +++++++++++++++++------------
1 file changed, 17 insertions(+), 12 deletions(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 52d540f089e0..84fb47c4ad5c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1174,18 +1174,16 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
int sq_idx, int depth)
{
int qid = nvmeq->sq[sq_idx].id;
- if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
- unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
- dev->ctrl.page_size);
- nvmeq->sq[sq_idx].sq_dma_addr = dev->cmb_bus_addr + offset;
- nvmeq->sq[sq_idx].sq_cmds_io = dev->cmb + offset;
- } else {
- nvmeq->sq[sq_idx].sq_cmds = dma_alloc_coherent(dev->dev,
- SQ_SIZE(depth),
- &nvmeq->sq[sq_idx].sq_dma_addr, GFP_KERNEL);
- if (!nvmeq->sq[sq_idx].sq_cmds)
- return -ENOMEM;
- }
+
+ /* CMB SQEs will be mapped before creation */
+ if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS))
+ return 0;
+
+ nvmeq->sq[sq_idx].sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+ &nvmeq->sq[sq_idx].sq_dma_addr,
+ GFP_KERNEL);
+ if (!nvmeq->sq[sq_idx].sq_cmds)
+ return -ENOMEM;
return 0;
}
@@ -1280,6 +1278,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
struct nvme_dev *dev = nvmeq->dev;
int result, i;
+ if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
+ unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+ dev->ctrl.page_size);
+ nvmeq->sq[0].sq_dma_addr = dev->cmb_bus_addr + offset;
+ nvmeq->sq[0].sq_cmds_io = dev->cmb + offset;
+ }
+
nvmeq->cq_vector = qid - 1;
result = adapter_alloc_cq(dev, nvmeq->cq_id, nvmeq);
if (result < 0)
--
2.11.0
