[PATCH net-next v4] net: mana: Add handler for sriov configure

[PATCH net-next v4] net: mana: Add handler for sriov configure

[Haiyang Zhang]

From: Haiyang Zhang <haiyangz@microsoft.com>

Add callback function for the pci_driver / sriov_configure.

It asks the NIC to provide certain number of VFs, or disable
VFs if the request is zero.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
---
v4:
  Removed unnecessary pci_disable_sriov() from mana_gd_shutdown() as
  suggested by AI review.

v3:
  Updated sriov disabling paths suggested by Paolo Abeni

v2:
  No longer change VF autoprobe as discussed with Leon Romanovsky and Bjorn Helgaas.

---
 .../net/ethernet/microsoft/mana/gdma_main.c   | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
index aef3b77229c1..a38d4bb74621 100644
--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
@@ -2456,6 +2456,8 @@ static void mana_gd_remove(struct pci_dev *pdev)
 {
 	struct gdma_context *gc = pci_get_drvdata(pdev);
 
+	pci_disable_sriov(pdev);
+
 	mana_rdma_remove(&gc->mana_ib);
 	mana_remove(&gc->mana, false);
 
@@ -2525,6 +2527,27 @@ static void mana_gd_shutdown(struct pci_dev *pdev)
 	pci_disable_device(pdev);
 }
 
+static int mana_sriov_configure(struct pci_dev *pdev, int numvfs)
+{
+	int err = 0;
+
+	dev_info(&pdev->dev, "Requested num VFs: %d\n", numvfs);
+
+	if (numvfs > 0) {
+		err = pci_enable_sriov(pdev, numvfs);
+	} else {
+		if (pci_vfs_assigned(pdev)) {
+			dev_warn(&pdev->dev,
+				 "Cannot disable SR-IOV while VFs are assigned\n");
+			return -EPERM;
+		}
+
+		pci_disable_sriov(pdev);
+	}
+
+	return err ? err : numvfs;
+}
+
 static const struct pci_device_id mana_id_table[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_MICROSOFT, MANA_PF_DEVICE_ID) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_MICROSOFT, MANA_PF2_DEVICE_ID) },
@@ -2540,6 +2563,7 @@ static struct pci_driver mana_driver = {
 	.suspend	= mana_gd_suspend,
 	.resume		= mana_gd_resume,
 	.shutdown	= mana_gd_shutdown,
+	.sriov_configure = mana_sriov_configure,
 };
 
 static int __init mana_driver_init(void)
-- 
2.34.1

Re: [PATCH net-next v4] net: mana: Add handler for sriov configure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uncancelled background works (`mana_serv_work` and `mana_dev_recovery_work`) lead to Use-After-Free of `gdma_context` during device removal.
--

--- Patch [1]: [PATCH net-next v4] net: mana: Add handler for sriov configure ---
commit d651d90ceb3e1716b100c2eb4035662f066b67fa
Author: Haiyang Zhang <haiyangz@microsoft.com>

net: mana: Add handler for sriov configure

This commit adds a callback function for the pci_driver / sriov_configure
interface. It requests the NIC to provide a specific number of VFs, or
disables VFs if the requested number is zero.

> diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
> index aef3b77229c13..a38d4bb74621f 100644
> --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
> +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
> @@ -2456,6 +2456,8 @@ static void mana_gd_remove(struct pci_dev *pdev)
>  {
>  	struct gdma_context *gc = pci_get_drvdata(pdev);
>  
> +	pci_disable_sriov(pdev);
> +
>  	mana_rdma_remove(&gc->mana_ib);
>  	mana_remove(&gc->mana, false);

[Severity: High]
This is a pre-existing issue, but can this lead to a Use-After-Free of
gdma_context if there are uncancelled background works?

When mana_gd_remove() executes, it eventually frees the gdma_context via
vfree(gc) without flushing works like mana_serv_work or
mana_dev_recovery_work that might be pending on the system_wq.

If a hardware event triggers mana_gd_process_eqe() and schedules
serv_work before a hot-unplug, could the scheduled work run after
mana_gd_remove() has freed the context?

The worker thread mana_serv_func() calls mana_serv_reset(), which does:

    struct gdma_context *gc = pci_get_drvdata(pdev);
    ...
    hwc = gc->hwc.driver_data;

Since the PCI core only clears drvdata after remove() returns, this could
dereference the freed gc memory. Should these background works be
cancelled before freeing the context?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710192735.2921300-1-haiyangz@linux.microsoft.com?part=1