[PATCH net 0/3] There are some bugfix for hibmcge ethernet driver

[PATCH net 0/3] There are some bugfix for hibmcge ethernet driver

[Jijie Shao]

This patch set is intended to fix several issues for hibmcge driver:
1. Holding the rtnl_lock in pci_error_handlers->reset_prepare()
   may lead to a deadlock issue.
2. A division by zero issue caused by debugfs when the port is down.
3. A probabilistic false positive issue with np_link_fail. 

Jijie Shao (3):
  net: hibmcge: fix rtnl deadlock issue
  net: hibmcge: fix the division by zero issue
  net: hibmcge: fix the np_link_fai error reporting issue

 drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c  | 13 ++++---------
 drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c   | 15 +++++++++++++--
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h |  3 +++
 3 files changed, 20 insertions(+), 11 deletions(-)

-- 
2.33.0

[PATCH net 1/3] net: hibmcge: fix rtnl deadlock issue

[Jijie Shao]

Currently, the hibmcge netdev acquires the rtnl_lock in
pci_error_handlers.reset_prepare() and releases it in
pci_error_handlers.reset_done().

However, in the PCI framework:
pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -
 pci_dev_save_and_disable - err_handler->reset_prepare(dev);

In pci_slot_save_and_disable_locked():
	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
		if (!dev->slot || dev->slot!= slot)
			continue;
		pci_dev_save_and_disable(dev);
		if (dev->subordinate)
			pci_bus_save_and_disable_locked(dev->subordinate);
	}

This will iterate through all devices under the current bus and execute
err_handler->reset_prepare(), causing two devices of the hibmcge driver
to sequentially request the rtnl_lock, leading to a deadlock.

Since the driver now executes netif_device_detach()
before the reset process, it will not concurrently with
other netdev APIs, so there is no need to hold the rtnl_lock now.

Therefore, this patch removes the rtnl_lock during the reset process and
adjusts the position of HBG_NIC_STATE_RESETTING to ensure
that multiple resets are not executed concurrently.

Fixes: 3f5a61f6d504f ("net: hibmcge: Add reset supported in this module")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
index 503cfbfb4a8a..94bc6f0da912 100644
--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
+++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
@@ -53,9 +53,11 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
 {
 	int ret;
 
-	ASSERT_RTNL();
+	if (test_and_set_bit(HBG_NIC_STATE_RESETTING, &priv->state))
+		return -EBUSY;
 
 	if (netif_running(priv->netdev)) {
+		clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
 		dev_warn(&priv->pdev->dev,
 			 "failed to reset because port is up\n");
 		return -EBUSY;
@@ -64,7 +66,6 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
 	netif_device_detach(priv->netdev);
 
 	priv->reset_type = type;
-	set_bit(HBG_NIC_STATE_RESETTING, &priv->state);
 	clear_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
 	ret = hbg_hw_event_notify(priv, HBG_HW_EVENT_RESET);
 	if (ret) {
@@ -84,10 +85,8 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
 	    type != priv->reset_type)
 		return 0;
 
-	ASSERT_RTNL();
-
-	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
 	ret = hbg_rebuild(priv);
+	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
 	if (ret) {
 		priv->stats.reset_fail_cnt++;
 		set_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
@@ -101,12 +100,10 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
 	return ret;
 }
 
-/* must be protected by rtnl lock */
 int hbg_reset(struct hbg_priv *priv)
 {
 	int ret;
 
-	ASSERT_RTNL();
 	ret = hbg_reset_prepare(priv, HBG_RESET_TYPE_FUNCTION);
 	if (ret)
 		return ret;
@@ -171,7 +168,6 @@ static void hbg_pci_err_reset_prepare(struct pci_dev *pdev)
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct hbg_priv *priv = netdev_priv(netdev);
 
-	rtnl_lock();
 	hbg_reset_prepare(priv, HBG_RESET_TYPE_FLR);
 }
 
@@ -181,7 +177,6 @@ static void hbg_pci_err_reset_done(struct pci_dev *pdev)
 	struct hbg_priv *priv = netdev_priv(netdev);
 
 	hbg_reset_done(priv, HBG_RESET_TYPE_FLR);
-	rtnl_unlock();
 }
 
 static const struct pci_error_handlers hbg_pci_err_handler = {
-- 
2.33.0

[PATCH net 2/3] net: hibmcge: fix the division by zero issue

[Jijie Shao]

When the network port is down, the queue is released, and ring->len is 0.
In debugfs, hbg_get_queue_used_num() will be called,
which may lead to a division by zero issue.

This patch adds a check, if ring->len is 0,
hbg_get_queue_used_num() directly returns 0.

Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h
index 2883a5899ae2..2aecc73f3d49 100644
--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h
+++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.h
@@ -29,6 +29,9 @@ static inline bool hbg_fifo_is_full(struct hbg_priv *priv, enum hbg_dir dir)
 
 static inline u32 hbg_get_queue_used_num(struct hbg_ring *ring)
 {
+	if (!ring->len)
+		return 0;
+
 	return (ring->ntu + ring->len - ring->ntc) % ring->len;
 }
 
-- 
2.33.0

[PATCH net 3/3] net: hibmcge: fix the np_link_fai error reporting issue

[Jijie Shao]

Currently, after modifying device port mode, the np_link_ok state
is immediately checked. At this point, the device may not yet ready,
leading to the querying of an intermediate state.

This patch will poll to check if np_link is ok after
modifying device port mode, and only report np_link_fail upon timeout.

Fixes: e0306637e85d ("net: hibmcge: Add support for mac link exception handling feature")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c
index 8cca8316ba40..d0aa0661ecd4 100644
--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c
+++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_hw.c
@@ -12,6 +12,8 @@
 
 #define HBG_HW_EVENT_WAIT_TIMEOUT_US	(2 * 1000 * 1000)
 #define HBG_HW_EVENT_WAIT_INTERVAL_US	(10 * 1000)
+#define HBG_MAC_LINK_WAIT_TIMEOUT_US	(500 * 1000)
+#define HBG_MAC_LINK_WAIT_INTERVAL_US	(5 * 1000)
 /* little endian or big endian.
  * ctrl means packet description, data means skb packet data
  */
@@ -228,6 +230,9 @@ void hbg_hw_fill_buffer(struct hbg_priv *priv, u32 buffer_dma_addr)
 
 void hbg_hw_adjust_link(struct hbg_priv *priv, u32 speed, u32 duplex)
 {
+	u32 link_status;
+	int ret;
+
 	hbg_hw_mac_enable(priv, HBG_STATUS_DISABLE);
 
 	hbg_reg_write_field(priv, HBG_REG_PORT_MODE_ADDR,
@@ -239,8 +244,14 @@ void hbg_hw_adjust_link(struct hbg_priv *priv, u32 speed, u32 duplex)
 
 	hbg_hw_mac_enable(priv, HBG_STATUS_ENABLE);
 
-	if (!hbg_reg_read_field(priv, HBG_REG_AN_NEG_STATE_ADDR,
-				HBG_REG_AN_NEG_STATE_NP_LINK_OK_B))
+	/* wait MAC link up */
+	ret = readl_poll_timeout(priv->io_base + HBG_REG_AN_NEG_STATE_ADDR,
+				 link_status,
+				 FIELD_GET(HBG_REG_AN_NEG_STATE_NP_LINK_OK_B,
+					   link_status),
+				 HBG_MAC_LINK_WAIT_INTERVAL_US,
+				 HBG_MAC_LINK_WAIT_TIMEOUT_US);
+	if (ret)
 		hbg_np_link_fail_task_schedule(priv);
 }
 
-- 
2.33.0

Re: [PATCH net 1/3] net: hibmcge: fix rtnl deadlock issue

[Simon Horman]

On Thu, Jul 31, 2025 at 09:47:47PM +0800, Jijie Shao wrote:
> Currently, the hibmcge netdev acquires the rtnl_lock in
> pci_error_handlers.reset_prepare() and releases it in
> pci_error_handlers.reset_done().
> 
> However, in the PCI framework:
> pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -
>  pci_dev_save_and_disable - err_handler->reset_prepare(dev);
> 
> In pci_slot_save_and_disable_locked():
> 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
> 		if (!dev->slot || dev->slot!= slot)
> 			continue;
> 		pci_dev_save_and_disable(dev);
> 		if (dev->subordinate)
> 			pci_bus_save_and_disable_locked(dev->subordinate);
> 	}
> 
> This will iterate through all devices under the current bus and execute
> err_handler->reset_prepare(), causing two devices of the hibmcge driver
> to sequentially request the rtnl_lock, leading to a deadlock.
> 
> Since the driver now executes netif_device_detach()
> before the reset process, it will not concurrently with
> other netdev APIs, so there is no need to hold the rtnl_lock now.
> 
> Therefore, this patch removes the rtnl_lock during the reset process and
> adjusts the position of HBG_NIC_STATE_RESETTING to ensure
> that multiple resets are not executed concurrently.
> 
> Fixes: 3f5a61f6d504f ("net: hibmcge: Add reset supported in this module")
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
> ---
>  drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> index 503cfbfb4a8a..94bc6f0da912 100644
> --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> @@ -53,9 +53,11 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
>  {
>  	int ret;
>  
> -	ASSERT_RTNL();
> +	if (test_and_set_bit(HBG_NIC_STATE_RESETTING, &priv->state))
> +		return -EBUSY;
>  
>  	if (netif_running(priv->netdev)) {
> +		clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>  		dev_warn(&priv->pdev->dev,
>  			 "failed to reset because port is up\n");
>  		return -EBUSY;
> @@ -64,7 +66,6 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
>  	netif_device_detach(priv->netdev);
>  
>  	priv->reset_type = type;
> -	set_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>  	clear_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
>  	ret = hbg_hw_event_notify(priv, HBG_HW_EVENT_RESET);
>  	if (ret) {
> @@ -84,10 +85,8 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
>  	    type != priv->reset_type)
>  		return 0;
>  
> -	ASSERT_RTNL();
> -
> -	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>  	ret = hbg_rebuild(priv);
> +	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);

Hi Jijie,

If I understand things correctly, then with this patch the
HBG_NIC_STATE_RESETTING bit is used to prevent concurrent execution.

Noting that a reset may be triggered via eththool, where hbg_reset() is
used as a callback, I am concerned about concurrency implications for lines
below this one.

>  	if (ret) {
>  		priv->stats.reset_fail_cnt++;
>  		set_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
> @@ -101,12 +100,10 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
>  	return ret;
>  }
>  
> -/* must be protected by rtnl lock */
>  int hbg_reset(struct hbg_priv *priv)
>  {
>  	int ret;
>  
> -	ASSERT_RTNL();
>  	ret = hbg_reset_prepare(priv, HBG_RESET_TYPE_FUNCTION);
>  	if (ret)
>  		return ret;
> @@ -171,7 +168,6 @@ static void hbg_pci_err_reset_prepare(struct pci_dev *pdev)
>  	struct net_device *netdev = pci_get_drvdata(pdev);
>  	struct hbg_priv *priv = netdev_priv(netdev);
>  
> -	rtnl_lock();
>  	hbg_reset_prepare(priv, HBG_RESET_TYPE_FLR);
>  }
>  
> @@ -181,7 +177,6 @@ static void hbg_pci_err_reset_done(struct pci_dev *pdev)
>  	struct hbg_priv *priv = netdev_priv(netdev);
>  
>  	hbg_reset_done(priv, HBG_RESET_TYPE_FLR);
> -	rtnl_unlock();
>  }
>  
>  static const struct pci_error_handlers hbg_pci_err_handler = {
> -- 
> 2.33.0
> 

Re: [PATCH net 2/3] net: hibmcge: fix the division by zero issue

[Simon Horman]

On Thu, Jul 31, 2025 at 09:47:48PM +0800, Jijie Shao wrote:
> When the network port is down, the queue is released, and ring->len is 0.
> In debugfs, hbg_get_queue_used_num() will be called,
> which may lead to a division by zero issue.
> 
> This patch adds a check, if ring->len is 0,
> hbg_get_queue_used_num() directly returns 0.
> 
> Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function")
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>

Thanks,

Thinking aloud:

I see that hbg_get_queue_used_num() can be called for both RX and TX
rings via the debugfs code hbg_dbg_ring(). And that hbg_net_stop()
clears the RX and TX ring configuration using hbg_txrx_uninit().

So I agree that when the port is down ring-len will be 0.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net 3/3] net: hibmcge: fix the np_link_fai error reporting issue

[Simon Horman]

On Thu, Jul 31, 2025 at 09:47:49PM +0800, Jijie Shao wrote:
> Currently, after modifying device port mode, the np_link_ok state
> is immediately checked. At this point, the device may not yet ready,
> leading to the querying of an intermediate state.
> 
> This patch will poll to check if np_link is ok after
> modifying device port mode, and only report np_link_fail upon timeout.
> 
> Fixes: e0306637e85d ("net: hibmcge: Add support for mac link exception handling feature")
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net 1/3] net: hibmcge: fix rtnl deadlock issue

[Jijie Shao]

on 2025/8/1 18:05, Simon Horman wrote:
> On Thu, Jul 31, 2025 at 09:47:47PM +0800, Jijie Shao wrote:
>> Currently, the hibmcge netdev acquires the rtnl_lock in
>> pci_error_handlers.reset_prepare() and releases it in
>> pci_error_handlers.reset_done().
>>
>> However, in the PCI framework:
>> pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -
>>   pci_dev_save_and_disable - err_handler->reset_prepare(dev);
>>
>> In pci_slot_save_and_disable_locked():
>> 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
>> 		if (!dev->slot || dev->slot!= slot)
>> 			continue;
>> 		pci_dev_save_and_disable(dev);
>> 		if (dev->subordinate)
>> 			pci_bus_save_and_disable_locked(dev->subordinate);
>> 	}
>>
>> This will iterate through all devices under the current bus and execute
>> err_handler->reset_prepare(), causing two devices of the hibmcge driver
>> to sequentially request the rtnl_lock, leading to a deadlock.
>>
>> Since the driver now executes netif_device_detach()
>> before the reset process, it will not concurrently with
>> other netdev APIs, so there is no need to hold the rtnl_lock now.
>>
>> Therefore, this patch removes the rtnl_lock during the reset process and
>> adjusts the position of HBG_NIC_STATE_RESETTING to ensure
>> that multiple resets are not executed concurrently.
>>
>> Fixes: 3f5a61f6d504f ("net: hibmcge: Add reset supported in this module")
>> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
>> ---
>>   drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 13 ++++---------
>>   1 file changed, 4 insertions(+), 9 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
>> index 503cfbfb4a8a..94bc6f0da912 100644
>> --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
>> +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
>> @@ -53,9 +53,11 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
>>   {
>>   	int ret;
>>   
>> -	ASSERT_RTNL();
>> +	if (test_and_set_bit(HBG_NIC_STATE_RESETTING, &priv->state))
>> +		return -EBUSY;
>>   
>>   	if (netif_running(priv->netdev)) {
>> +		clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>>   		dev_warn(&priv->pdev->dev,
>>   			 "failed to reset because port is up\n");
>>   		return -EBUSY;
>> @@ -64,7 +66,6 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
>>   	netif_device_detach(priv->netdev);
>>   
>>   	priv->reset_type = type;
>> -	set_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>>   	clear_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
>>   	ret = hbg_hw_event_notify(priv, HBG_HW_EVENT_RESET);
>>   	if (ret) {
>> @@ -84,10 +85,8 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
>>   	    type != priv->reset_type)
>>   		return 0;
>>   
>> -	ASSERT_RTNL();
>> -
>> -	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
>>   	ret = hbg_rebuild(priv);
>> +	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
> Hi Jijie,
>
> If I understand things correctly, then with this patch the
> HBG_NIC_STATE_RESETTING bit is used to prevent concurrent execution.
>
> Noting that a reset may be triggered via eththool, where hbg_reset() is
> used as a callback, I am concerned about concurrency implications for lines
> below this one.

Yes, just like the following, it can lead to reset and net open concurrency.
===========

      reset1                                              reset2                               open

set_bit HBG_NIC_STATE_RESETTING

      netif_device_detach()
      
      resetting...

clear_bit HBG_NIC_STATE_RESETTING
                                               set_bit HBG_NIC_STATE_RESETTING
                                                    netif_device_detach()

       netif_device_attach()
                                                          resetting...                     hbg_net_open()
                                                                                           hbg_txrx_init()

                                               clear_bit HBG_NIC_STATE_RESETTING
                                                       netif_device_attach()

============
Thank you for your reminder.
I will fix it in V2

Jijie Shao

>>   	if (ret) {
>>   		priv->stats.reset_fail_cnt++;
>>   		set_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
>> @@ -101,12 +100,10 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
>>   	return ret;
>>   }
>>   
>> -/* must be protected by rtnl lock */
>>   int hbg_reset(struct hbg_priv *priv)
>>   {
>>   	int ret;
>>   
>> -	ASSERT_RTNL();
>>   	ret = hbg_reset_prepare(priv, HBG_RESET_TYPE_FUNCTION);
>>   	if (ret)
>>   		return ret;
>> @@ -171,7 +168,6 @@ static void hbg_pci_err_reset_prepare(struct pci_dev *pdev)
>>   	struct net_device *netdev = pci_get_drvdata(pdev);
>>   	struct hbg_priv *priv = netdev_priv(netdev);
>>   
>> -	rtnl_lock();
>>   	hbg_reset_prepare(priv, HBG_RESET_TYPE_FLR);
>>   }
>>   
>> @@ -181,7 +177,6 @@ static void hbg_pci_err_reset_done(struct pci_dev *pdev)
>>   	struct hbg_priv *priv = netdev_priv(netdev);
>>   
>>   	hbg_reset_done(priv, HBG_RESET_TYPE_FLR);
>> -	rtnl_unlock();
>>   }
>>   
>>   static const struct pci_error_handlers hbg_pci_err_handler = {
>> -- 
>> 2.33.0
>>

Re: [PATCH net 2/3] net: hibmcge: fix the division by zero issue

[Jijie Shao]

on 2025/8/1 18:11, Simon Horman wrote:
> On Thu, Jul 31, 2025 at 09:47:48PM +0800, Jijie Shao wrote:
>> When the network port is down, the queue is released, and ring->len is 0.
>> In debugfs, hbg_get_queue_used_num() will be called,
>> which may lead to a division by zero issue.
>>
>> This patch adds a check, if ring->len is 0,
>> hbg_get_queue_used_num() directly returns 0.
>>
>> Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function")
>> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
> Thanks,
>
> Thinking aloud:
>
> I see that hbg_get_queue_used_num() can be called for both RX and TX
> rings via the debugfs code hbg_dbg_ring(). And that hbg_net_stop()
> clears the RX and TX ring configuration using hbg_txrx_uninit().

Yes, yes.

> So I agree that when the port is down ring-len will be 0.
>
> Reviewed-by: Simon Horman <horms@kernel.org>
>
>

Re: [PATCH net 1/3] net: hibmcge: fix rtnl deadlock issue

[Simon Horman]

On Fri, Aug 01, 2025 at 06:44:36PM +0800, Jijie Shao wrote:
> 
> on 2025/8/1 18:05, Simon Horman wrote:
> > On Thu, Jul 31, 2025 at 09:47:47PM +0800, Jijie Shao wrote:
> > > Currently, the hibmcge netdev acquires the rtnl_lock in
> > > pci_error_handlers.reset_prepare() and releases it in
> > > pci_error_handlers.reset_done().
> > > 
> > > However, in the PCI framework:
> > > pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked -
> > >   pci_dev_save_and_disable - err_handler->reset_prepare(dev);
> > > 
> > > In pci_slot_save_and_disable_locked():
> > > 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
> > > 		if (!dev->slot || dev->slot!= slot)
> > > 			continue;
> > > 		pci_dev_save_and_disable(dev);
> > > 		if (dev->subordinate)
> > > 			pci_bus_save_and_disable_locked(dev->subordinate);
> > > 	}
> > > 
> > > This will iterate through all devices under the current bus and execute
> > > err_handler->reset_prepare(), causing two devices of the hibmcge driver
> > > to sequentially request the rtnl_lock, leading to a deadlock.
> > > 
> > > Since the driver now executes netif_device_detach()
> > > before the reset process, it will not concurrently with
> > > other netdev APIs, so there is no need to hold the rtnl_lock now.
> > > 
> > > Therefore, this patch removes the rtnl_lock during the reset process and
> > > adjusts the position of HBG_NIC_STATE_RESETTING to ensure
> > > that multiple resets are not executed concurrently.
> > > 
> > > Fixes: 3f5a61f6d504f ("net: hibmcge: Add reset supported in this module")
> > > Signed-off-by: Jijie Shao <shaojijie@huawei.com>
> > > ---
> > >   drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c | 13 ++++---------
> > >   1 file changed, 4 insertions(+), 9 deletions(-)
> > > 
> > > diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> > > index 503cfbfb4a8a..94bc6f0da912 100644
> > > --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> > > +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_err.c
> > > @@ -53,9 +53,11 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
> > >   {
> > >   	int ret;
> > > -	ASSERT_RTNL();
> > > +	if (test_and_set_bit(HBG_NIC_STATE_RESETTING, &priv->state))
> > > +		return -EBUSY;
> > >   	if (netif_running(priv->netdev)) {
> > > +		clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
> > >   		dev_warn(&priv->pdev->dev,
> > >   			 "failed to reset because port is up\n");
> > >   		return -EBUSY;
> > > @@ -64,7 +66,6 @@ static int hbg_reset_prepare(struct hbg_priv *priv, enum hbg_reset_type type)
> > >   	netif_device_detach(priv->netdev);
> > >   	priv->reset_type = type;
> > > -	set_bit(HBG_NIC_STATE_RESETTING, &priv->state);
> > >   	clear_bit(HBG_NIC_STATE_RESET_FAIL, &priv->state);
> > >   	ret = hbg_hw_event_notify(priv, HBG_HW_EVENT_RESET);
> > >   	if (ret) {
> > > @@ -84,10 +85,8 @@ static int hbg_reset_done(struct hbg_priv *priv, enum hbg_reset_type type)
> > >   	    type != priv->reset_type)
> > >   		return 0;
> > > -	ASSERT_RTNL();
> > > -
> > > -	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
> > >   	ret = hbg_rebuild(priv);
> > > +	clear_bit(HBG_NIC_STATE_RESETTING, &priv->state);
> > Hi Jijie,
> > 
> > If I understand things correctly, then with this patch the
> > HBG_NIC_STATE_RESETTING bit is used to prevent concurrent execution.
> > 
> > Noting that a reset may be triggered via eththool, where hbg_reset() is
> > used as a callback, I am concerned about concurrency implications for lines
> > below this one.
> 
> Yes, just like the following, it can lead to reset and net open concurrency.
> ===========
> 
>      reset1                                              reset2                               open
> 
> set_bit HBG_NIC_STATE_RESETTING
> 
>      netif_device_detach()
>      resetting...
> 
> clear_bit HBG_NIC_STATE_RESETTING
>                                               set_bit HBG_NIC_STATE_RESETTING
>                                                    netif_device_detach()
> 
>       netif_device_attach()
>                                                          resetting...                     hbg_net_open()
>                                                                                           hbg_txrx_init()
> 
>                                               clear_bit HBG_NIC_STATE_RESETTING
>                                                       netif_device_attach()
> 
> ============
> Thank you for your reminder.
> I will fix it in V2

Likewise, thanks.

-- 
pw-bot: cr