[PATCH] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d

[PATCH] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d

[Sasha Levin]

The KIOXIA XG10d reads past the end of a PRP List that fills a whole
256 byte small descriptor.  If that descriptor is the last block of its
dmapool page, the read crosses into the following page.  Behind an IOMMU
that is usually an unmapped IOVA, and the controller does not survive
the fault:

  arm-smmu-v3 arm-smmu-v3.0.auto: event: F_TRANSLATION client: 0001:09:00.0 sid: 0x20900 ssid: 0x0 iova: 0xff7fe000 ipa: 0x0
  nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0xffff
  nvme 0001:09:00.0: Unable to change power state from D3cold to D0, device inaccessible
  nvme nvme0: Disabling device after reset failure: -19

When this fired, sixteen 132 KiB writes were in flight, each with a
32-entry PRP List in a small descriptor from the same dmapool page; the
one at offset 0xF00 ends exactly at the faulting IOVA.

Only full lists trigger it.  The 31-entry lists of aligned 128 KiB
transfers land in that last block too, and never faulted in our testing.
A full list needs a transfer spanning exactly 33 pages, such as an
aligned 132 KiB transfer or a 128 KiB transfer from a buffer that is not
page aligned.  Larger transfers get a 4 KiB descriptor, which a 256 KiB
MDTS never fills.  Transfers above 128 KiB became routine once commit
2e8e30b3cf9f ("Revert "nvme-pci: clamp max_hw_sectors based on DMA
optimized limitation"") lifted the 128 KiB cap behind an IOMMU.  Kernels
before v6.4 are not affected either way: their dmapool never handed out
the last block of a page (see commit da9619a30e73 ("dmapool: link blocks
across pages")).

Align the small descriptor pool to 512 bytes, as is already done for
the O2 Micro and Micron 4100AT controllers.  The last block then starts
at offset 0xE00, and the read stays inside the page.

Cc: stable@vger.kernel.org # 6.4.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 019a1e3cc0a2..2be6d1a9ad4d 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -4430,6 +4430,8 @@ static const struct pci_device_id nvme_id_table[] = {
 		 .driver_data = NVME_QUIRK_BOGUS_NID, },
 	{ PCI_DEVICE(0x1344, 0x6004),	/* Micron 4100AT */
 		.driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, },
+	{ PCI_DEVICE(0x1e0f, 0x0032),	/* KIOXIA XG10d */
+		.driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, },
 	{ PCI_DEVICE(0x1c5c, 0x1504),   /* SK Hynix PC400 */
 		.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
 	{ PCI_DEVICE(0x1c5c, 0x174a),   /* SK Hynix P31 SSD */
-- 
2.43.0

Re: [PATCH] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d

[Christoph Hellwig]

Meh, more broken devices.

Can you please provide a smaller, to the point humand written commit
log?

[PATCH v2] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d

[Sasha Levin]

The KIOXIA XG10d reads past the end of a PRP list that completely fills
a 256 byte small pool block. When that block is the last one in its
dmapool page, the read lands on the next page, which usually isn't
mapped. The IOMMU faults it and the controller craps itself:

  arm-smmu-v3 arm-smmu-v3.0.auto: event: F_TRANSLATION client: 0001:09:00.0 sid: 0x20900 ssid: 0x0 iova: 0xff7fe000 ipa: 0x0
  nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0xffff

Filling the block requires a slightly larger write, and those became common
with commit 2e8e30b3cf9f ("Revert "nvme-pci: clamp max_hw_sectors based on
DMA optimized limitation"").

Do what we do for other disks and use 512 byte aligned small pool blocks
for this controller.

Cc: stable@vger.kernel.org # 6.4.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 019a1e3cc0a2..2be6d1a9ad4d 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -4430,6 +4430,8 @@ static const struct pci_device_id nvme_id_table[] = {
 		 .driver_data = NVME_QUIRK_BOGUS_NID, },
 	{ PCI_DEVICE(0x1344, 0x6004),	/* Micron 4100AT */
 		.driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, },
+	{ PCI_DEVICE(0x1e0f, 0x0032),	/* KIOXIA XG10d */
+		.driver_data = NVME_QUIRK_DMAPOOL_ALIGN_512, },
 	{ PCI_DEVICE(0x1c5c, 0x1504),   /* SK Hynix PC400 */
 		.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
 	{ PCI_DEVICE(0x1c5c, 0x174a),   /* SK Hynix P31 SSD */
-- 
2.43.0

Re: [PATCH v2] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d

[Keith Busch]

On Wed, 04 Nov 2026 07:18:16 -0500, Sasha Levin wrote:
> The KIOXIA XG10d reads past the end of a PRP list that completely fills
> a 256 byte small pool block. When that block is the last one in its
> dmapool page, the read lands on the next page, which usually isn't
> mapped. The IOMMU faults it and the controller craps itself:
> 
>   arm-smmu-v3 arm-smmu-v3.0.auto: event: F_TRANSLATION client: 0001:09:00.0 sid: 0x20900 ssid: 0x0 iova: 0xff7fe000 ipa: 0x0
>   nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0xffff
> 
> [...]

Applied, thanks!

[1/1] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
      commit: d99ba2df0ea5273752787eed10f4c7d1db2f5dfb

Best regards,
-- 
Keith Busch <kbusch@kernel.org>