[PATCH iwl-net v5 0/3] idpf: destroy the vports on shutdown

[Tian Xun Ng <luckilystar08@gmail.com>]

From: Tian Xun Ng <tianxun.ng@bytedance.com>

On shutdown idpf shuts its virtchnl transaction manager down before the
vports are torn down, so the device is never told that they are gone.
Patch 3 keeps the mailbox up for that teardown, as remove already does,
with a short timeout so that an unresponsive control plane cannot hold
up a reboot for long. Patches 1 and 2 first close two existing races in
which the mailbox task uses state that the teardown has released: the
async PTP Tx timestamp reply, which patch 3 would otherwise make
reachable on shutdown, and link change events, which can already arrive
in that window on both remove and shutdown.

An LLM coding assistant helped analyse the problem and draft the changes
and their messages. Each patch carries an Assisted-by tag.

Changes in v5:
- New patch 2: idpf_handle_event_link() returns once IDPF_REMOVE_IN_PROG
  is set, so that a link event cannot use a vport, or its netdev, that
  idpf_deinit_task() has released (Sashiko on v4). The window predates
  this series: mbx_task keeps running until idpf_vc_core_deinit()
  cancels it after the vports are gone, with or without the requeue in
  patch 1, whose drain makes the check race-free. The same window on a
  hard reset is not changed.
- Patch 1 is retitled to the mailbox reply it guards. The Tx timestamp
  state cached for the transmit and Tx completion paths is freed by
  idpf_ptp_release() before NAPI is disabled; that older lifetime issue
  is not touched here.
- Patch 3: a missing Tx queue marker no longer stops the mailbox
  messages that follow. The remaining queues of that vport skip their
  marker wait, and UNMAP_QUEUE_VECTOR, DESTROY_VPORT and DEALLOC_VECTORS
  are still sent with the 500 ms cap. This departs from the helper
  suggested on v3, which also failed the later messages: the device has
  just answered DISABLE_QUEUES, so its mailbox works. With the first
  marker treated as missing, all six transactions completed and 3 of 3
  warm reboots were clean.
- Patch 3: the kdoc and the message now say that only a synchronous
  transaction that times out fails the later ones at once, and that a
  reset already running in the event task keeps its own timeouts.
  IDPF_REMOVE_IN_PROG is documented as covering shutdown.

Testing of v5, besides what patch 3 describes: W=1 builds of idpf and
libie with allmodconfig and allyesconfig showed no new warnings after
each patch. On one server, modprobe -r idpf and a reload completed
without warnings or IOMMU faults. No link event arrived during a
teardown in these tests, so the path patch 2 changes was not exercised;
these devices do not support PTP, so neither was the one patch 1
changes.

Changes in v4 (patch numbers as in v4):
- New patch 1, closing the Tx timestamp callback race that Sashiko
  pointed out on v3. It already affects remove; with patch 2 it would
  also reach shutdown.
- Patch 2: the Tx queue SW marker wait follows the same bail-out as the
  mailbox transactions, so a control plane that acks DISABLE_QUEUES but
  posts no markers costs one marker timeout instead of one per queue
  (Emil).
- Patch 2: the statistics task stops sending once IDPF_REMOVE_IN_PROG is
  set (Emil).
- Patch 2: the shutdown comment now says that a transaction already in
  flight keeps its own timeout; bounding that would need support in
  libie.
- Not changed: if one teardown reply or Tx queue marker takes longer
  than 500 ms, the rest of the teardown is skipped. On the tested PFs
  the queue-related messages took at most 240 ms, and the slowest,
  DEALLOC_VECTORS (about 300 ms), is sent last, after DESTROY_VPORT.
  With the driver made to treat the first Tx queue marker as missing, so
  that UNMAP_QUEUE_VECTOR, DESTROY_VPORT and DEALLOC_VECTORS were
  skipped, 3 of 3 warm reboots were still clean on these devices. A
  function reset as a fallback was patch 2 of v1; in our tests a
  function reset on shutdown did not stop the faults, so it was dropped.
  I can add one for when the timeout fires if that is preferred.

Changes in v3:
- No new flags: adapter->vc_xn_timeout_ms (60 s from probe) is lowered
  to 500 ms on shutdown, and idpf_send_mb_msg() fails the rest at once
  after a shortened transaction times out (Emil).
- IDPF_REMOVE_IN_PROG is set before the service and event tasks are
  cancelled (Emil); the comment and message no longer state that a reset
  does not clear the vports (Emil).

v4: https://lore.kernel.org/all/20261012063027.27750-1-luckilystar08@gmail.com/
v3: https://lore.kernel.org/all/20261009032706.94324-1-luckilystar08@gmail.com/
v2: https://lore.kernel.org/all/20261007055741.30629-1-luckilystar08@gmail.com/
v1: https://lore.kernel.org/all/20260917105205.37561-1-luckilystar08@gmail.com/

Tian Xun Ng (3):
  idpf: ignore Tx timestamp replies once removal has started
  idpf: ignore link events once removal has started
  idpf: keep the mailbox up while tearing down vports on shutdown

 drivers/net/ethernet/intel/idpf/idpf.h        |  5 +-
 drivers/net/ethernet/intel/idpf/idpf_lib.c    |  3 ++
 drivers/net/ethernet/intel/idpf/idpf_main.c   | 11 +++++
 .../net/ethernet/intel/idpf/idpf_virtchnl.c   | 49 ++++++++++++++++---
 .../net/ethernet/intel/idpf/idpf_virtchnl.h   |  1 +
 .../ethernet/intel/idpf/idpf_virtchnl_ptp.c   |  3 +-
 6 files changed, 64 insertions(+), 8 deletions(-)

-- 
2.50.1 (Apple Git-155)