Re: [PATCH] nvme-pci: Make sure to ring doorbell when last request is short-circuited

[Keith Busch <kbusch@kernel.org>]

On Sun, Sep 18, 2022 at 05:48:16AM +0000, Mohamed Khalfella wrote:
> When processing a batch of requests, it is possible that nvme_queue_rq()
> misses to ring nvme queue doorbell if the last request fails because the
> controller is not ready. As a result of that, previously queued requests
> will timeout because the device had not chance to know about the commands
> existence. This failure can cause nvme controller reset to timeout if
> there was another App using adminq while nvme reset was taking place.
> 
> Consider this case:
> - App is hammering adminq with NVME_ADMIN_IDENTIFY commands
> - Controller reset triggered by "echo 1 > /sys/.../nvme0/reset_controller"
> 
> nvme_reset_ctrl() will change controller state to NVME_CTRL_RESETTING.
> From that point on all requests from App will be forced to fail because
> the controller is no longer ready. More importantly these requests will
> not make it to adminq and will be short-circuited in nvme_queue_rq().
> Unlike App requests, requests issued by reset code path will be allowed
> to go through adminq in order to carry out the reset process. The problem
> happens when blk-mq decides to mix requests from reset code path and App
> in one batch, in particular when the last request in such batch happens
> to be from App.
> 
> In this case the last request will have bd->last set to true telling the
> driver to ring doorbell after queuing this request. However, since the
> controller is not ready, this App request will be completed without going
> through adminq, and nvme_queue_rq() will miss the opportunity to ring
> adminq doorbell leaving earlier queued requests unknown to the device.
> 
> Fixes: d4060d2be1132 ("nvme-pci: fix controller reset hang when racing with nvme_timeout")

I revisted that commit, and it doesn't sound correct. Specifically this part:

    5) reset_work() continues to setup_io_queues() as it observes no error
       in init_identify(). However, the admin queue has already been
       quiesced in dev_disable(). Thus, any following commands would be
       blocked forever in blk_execute_rq().

When a timeout occurs in the CONNECTING state, the timeout handler unquiesces
the queue specifically to flush out any blocked requests. Is that commit really
necessary? I'd rather just revert it to save the extra per-IO checks if not.