]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
authorPetr Oros <poros@redhat.com>
Tue, 28 Apr 2026 05:22:18 +0000 (22:22 -0700)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 30 Apr 2026 09:37:38 +0000 (11:37 +0200)
On certain E810 configurations where firmware supports Tx scheduler
topology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo()
may need to apply a new 5-layer or 9-layer topology from the DDP
package. If the AQ command to set the topology fails (e.g. due to
invalid DDP data or firmware limitations), the global configuration
lock must still be cleared via a CORER reset.

Commit 86aae43f21cf ("ice: don't leave device non-functional if Tx
scheduler config fails") correctly fixed this by refactoring
ice_cfg_tx_topo() to always trigger CORER after acquiring the global
lock and re-initialize hardware via ice_init_hw() afterwards.

However, commit 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end
of deinit paths") later moved ice_init_dev_hw() into ice_init_hw(),
breaking the reinit path introduced by 86aae43f21cf. This creates an
infinite recursive call chain:

  ice_init_hw()
    ice_init_dev_hw()
      ice_cfg_tx_topo()         # topology change needed
        ice_deinit_hw()
        ice_init_hw()           # reinit after CORER
          ice_init_dev_hw()     # recurse
            ice_cfg_tx_topo()
              ...               # stack overflow

Fix by moving ice_init_dev_hw() back out of ice_init_hw() and calling
it explicitly from ice_probe() and ice_devlink_reinit_up(). The third
caller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw()
during its reinit, it only needs the core HW reinitialization. This
breaks the recursion cleanly without adding flags or guards.

The deinit ordering changes from commit 8a37f9e2ff40 ("ice: move
ice_deinit_dev() to the end of deinit paths") which fixed slow rmmod
are preserved, only the init-side placement of ice_init_dev_hw() is
reverted.

Fixes: 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end of deinit paths")
Signed-off-by: Petr Oros <poros@redhat.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Tested-by: Alexander Nowlin <alexander.nowlin@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/intel/ice/devlink/devlink.c
drivers/net/ethernet/intel/ice/ice_common.c
drivers/net/ethernet/intel/ice/ice_main.c

index 6144cee8034d7731b8c60cc6dcd740509afd2bd1..641d6e289d5ce6e5670758751618ae5e4a9791f7 100644 (file)
@@ -1245,6 +1245,8 @@ static int ice_devlink_reinit_up(struct ice_pf *pf)
                return err;
        }
 
+       ice_init_dev_hw(pf);
+
        /* load MSI-X values */
        ice_set_min_max_msix(pf);
 
index ce11fea122d03eee07f95529e378fc7ca36b3f75..b617a6bff8913428a8c120fb93efed470d64e5f2 100644 (file)
@@ -1126,8 +1126,6 @@ int ice_init_hw(struct ice_hw *hw)
        if (status)
                goto err_unroll_fltr_mgmt_struct;
 
-       ice_init_dev_hw(hw->back);
-
        mutex_init(&hw->tnl_lock);
        ice_init_chk_recipe_reuse_support(hw);
 
index 5f92377d4dfc28c69cba0e3e0e9c85c0e0f92615..1d1947a7fe1191cd8a714408c001dd801199e834 100644 (file)
@@ -5245,6 +5245,8 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
                return err;
        }
 
+       ice_init_dev_hw(pf);
+
        adapter = ice_adapter_get(pdev);
        if (IS_ERR(adapter)) {
                err = PTR_ERR(adapter);