a53b59ece8
enic_dev_wait() has a BUG_ON(in_interrupt()).
Chasing the callers of enic_dev_wait() revealed the gems of enic_reset()
and enic_tx_hang_reset() which are both invoked through work queues in
order to be able to call rtnl_lock(). So far so good.
After locking rtnl both functions acquire enic::enic_api_lock which
serializes against the (ab)use from infiniband. This is where the
trainwreck starts.
enic::enic_api_lock is a spin_lock() which implicitly disables preemption,
but both functions invoke a ton of functions under that lock which can
sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it
can't detect the preempt disabled condition.
This clearly has never been tested with any of the mandatory debug options
for 7+ years, which would have caught that for sure.
Cure it by adding a enic_api_busy member to struct enic, which is modified
and evaluated with enic::enic_api_lock held.
If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true,
it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to
become false.
It would be smarter to wait for a completion of that busy period, but
enic_api_devcmd_proxy_by_index() is called with other spin locks held which
obviously can't sleep.
Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and
with proper debugging enabled the problem would have been caught from the
debug checks in schedule_timeout().
Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
55 lines
1.6 KiB
C
55 lines
1.6 KiB
C
/*
|
|
* Copyright 2013 Cisco Systems, Inc. All rights reserved.
|
|
*
|
|
* This program is free software; you may redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; version 2 of the License.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*
|
|
*/
|
|
|
|
#include <linux/netdevice.h>
|
|
#include <linux/spinlock.h>
|
|
|
|
#include "vnic_dev.h"
|
|
#include "vnic_devcmd.h"
|
|
|
|
#include "enic_res.h"
|
|
#include "enic.h"
|
|
#include "enic_api.h"
|
|
|
|
int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf,
|
|
enum vnic_devcmd_cmd cmd, u64 *a0, u64 *a1, int wait)
|
|
{
|
|
int err;
|
|
struct enic *enic = netdev_priv(netdev);
|
|
struct vnic_dev *vdev = enic->vdev;
|
|
|
|
spin_lock(&enic->enic_api_lock);
|
|
while (enic->enic_api_busy) {
|
|
spin_unlock(&enic->enic_api_lock);
|
|
cpu_relax();
|
|
spin_lock(&enic->enic_api_lock);
|
|
}
|
|
|
|
spin_lock_bh(&enic->devcmd_lock);
|
|
|
|
vnic_dev_cmd_proxy_by_index_start(vdev, vf);
|
|
err = vnic_dev_cmd(vdev, cmd, a0, a1, wait);
|
|
vnic_dev_cmd_proxy_end(vdev);
|
|
|
|
spin_unlock_bh(&enic->devcmd_lock);
|
|
spin_unlock(&enic->enic_api_lock);
|
|
|
|
return err;
|
|
}
|
|
EXPORT_SYMBOL(enic_api_devcmd_proxy_by_index);
|