Root Cause Analysis

Involved Functions, Structs, and Files

• Files:
  • drivers/net/netdevsim/dev.c
  • net/devlink/core.c
  • net/devlink/rate.c
• Functions:
  • nsim_esw_switchdev_enable() (drivers/net/netdevsim/dev.c)
  • nsim_rate_node_new() (drivers/net/netdevsim/dev.c)
  • nsim_dev_reload_destroy() (drivers/net/netdevsim/dev.c)
  • nsim_esw_legacy_enable() (drivers/net/netdevsim/dev.c)
  • devl_rate_nodes_destroy() (net/devlink/rate.c)
  • devlink_free() / devlink_rates_check() (net/devlink/core.c, net/devlink/rate.c)
• Structs and Fields:
  • struct nsim_dev (esw_mode)
  • struct devlink (rate_list)
  • struct devlink_rate (type == DEVLINK_RATE_TYPE_NODE, list, priv, name)

Bug Mechanism and Lifecycle Invariant Violation

1. Switchdev Mode Allowed With Zero VFs: When userspace configures the netdevsim eswitch mode via Netlink (DEVLINK_CMD_ESWITCH_MODE_SET with DEVLINK_ESWITCH_MODE_SWITCHDEV), nsim_devlink_eswitch_mode_set() invokes nsim_esw_switchdev_enable(). In this function:

   for (i = 0; i < nsim_dev_get_vfs(nsim_dev); i++) {
       ...
   }
   nsim_dev->esw_mode = DEVLINK_ESWITCH_MODE_SWITCHDEV;
   

   If no VFs have been instantiated (nsim_dev_get_vfs(nsim_dev) == 0), the loop does not run, but nsim_dev->esw_mode is successfully set to DEVLINK_ESWITCH_MODE_SWITCHDEV.

2. Creation of Rate Nodes: Once in switchdev mode, userspace creates one or more devlink rate nodes using DEVLINK_CMD_RATE_NEW (devlink_nl_rate_new_doit()). The driver callback nsim_rate_node_new() checks:

   if (!nsim_esw_mode_is_switchdev(nsim_dev)) {
       NL_SET_ERR_MSG_MOD(extack, "Node creation allowed only in switchdev mode.");
       return -EOPNOTSUPP;
   }
   

   Because nsim_dev->esw_mode is DEVLINK_ESWITCH_MODE_SWITCHDEV, node creation succeeds regardless of the number of VFs. An allocated struct devlink_rate object of type DEVLINK_RATE_TYPE_NODE is added to devlink->rate_list.

3. Incomplete Teardown in nsim_dev_reload_destroy(): When the netdevsim device is removed (nsim_drv_remove()) or reloaded (nsim_dev_reload_down()), nsim_dev_reload_destroy() is called to tear down sub-components. The destruction of rate nodes is handled within nsim_esw_legacy_enable(), which calls devl_rate_nodes_destroy(devlink). However, nsim_dev_reload_destroy() guards the eswitch transition with a VF existence check:

   if (nsim_dev_get_vfs(nsim_dev)) {
       nsim_bus_dev_set_vfs(nsim_dev->nsim_bus_dev, 0);
       if (nsim_esw_mode_is_switchdev(nsim_dev))
           nsim_esw_legacy_enable(nsim_dev, NULL);
   }
   

   Because nsim_dev_get_vfs(nsim_dev) is 0, the entire block is bypassed. nsim_esw_legacy_enable() is not executed, and devl_rate_nodes_destroy() is never called.

4. Failure Trigger: Execution proceeds to devlink_free(devlink) in nsim_drv_remove(). Line 544 of net/devlink/core.c checks whether any rate elements remain registered on the devlink instance:

   WARN_ON(devlink_rates_check(devlink, NULL, NULL));
   

   Because the user-created devlink_rate node(s) were never destroyed and remain linked in devlink->rate_list, devlink_rates_check() returns -EBUSY, tripping the WARN_ON.