git: 7e546cdb6305 - stable/15 - bnxt_re: Fix witness reported calltrace while unloading driver

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=7e546cdb63053a59ef83bad593aea792a1880846

commit 7e546cdb63053a59ef83bad593aea792a1880846
Author:     Sumit Saxena <sumit.saxena@broadcom.com>
AuthorDate: 2026-07-31 15:51:01 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-29 23:15:19 +0000

    bnxt_re: Fix witness reported calltrace while unloading driver
    
    bnxt_unregister_dev() called synchronize_rcu() while holding
    bp->en_ops_lock, which witness flags as a sleeping-while-locked
    violation on driver unload. Drop the lock around the RCU grace period
    and reacquire it afterward.
    
    Also gate the RoCE extended-stats hex dump in
    bnxt_qplib_qext_stat() behind bootverbose instead of printing it
    unconditionally.
    
    Reviewed by:    gallatin
    Sponsored by:   Broadcom Inc.
    Differential Revision:  https://reviews.freebsd.org/D58611
    
    (cherry picked from commit 0aa3e15900d31a08680e2307cbc550715d727191)
---
 sys/dev/bnxt/bnxt_en/bnxt_ulp.c | 7 ++++++-
 sys/dev/bnxt/bnxt_re/qplib_sp.c | 4 +++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/sys/dev/bnxt/bnxt_en/bnxt_ulp.c b/sys/dev/bnxt/bnxt_en/bnxt_ulp.c
index c38521abd17f..e2eb307814fd 100644
--- a/sys/dev/bnxt/bnxt_en/bnxt_ulp.c
+++ b/sys/dev/bnxt/bnxt_en/bnxt_ulp.c
@@ -104,14 +104,19 @@ static int bnxt_unregister_dev(struct bnxt_en_dev *edev, int ulp_id)
 
 	mtx_lock(&bp->en_ops_lock);
 	RCU_INIT_POINTER(ulp->ulp_ops, NULL);
+	mtx_unlock(&bp->en_ops_lock);
 	synchronize_rcu();
+	mtx_lock(&bp->en_ops_lock);
 	ulp->max_async_event_id = 0;
 	ulp->async_events_bmap = NULL;
+	mtx_unlock(&bp->en_ops_lock);
 	while (atomic_read(&ulp->ref_count) != 0 && i < 10) {
 		msleep(100);
 		i++;
 	}
-	mtx_unlock(&bp->en_ops_lock);
+	/* Tell the caller a ULP consumer may still hold a reference into torn-down state. */
+	if (atomic_read(&ulp->ref_count) != 0)
+		return ETIMEDOUT;
 	return 0;
 }
 
diff --git a/sys/dev/bnxt/bnxt_re/qplib_sp.c b/sys/dev/bnxt/bnxt_re/qplib_sp.c
index f876573ce69f..71780211a2c1 100644
--- a/sys/dev/bnxt/bnxt_re/qplib_sp.c
+++ b/sys/dev/bnxt/bnxt_re/qplib_sp.c
@@ -1200,7 +1200,9 @@ int bnxt_qplib_qext_stat(struct bnxt_qplib_rcfw *rcfw, u32 fid,
 		goto bail;
 
 	/* dump when dyndbg is enabled */
-	print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, sb, sizeof(*sb));
+	if (bootverbose)
+		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, sb, sizeof(*sb));
+
 	estat->tx_atomic_req = le64_to_cpu(sb->tx_atomic_req_pkts);
 	estat->tx_read_req = le64_to_cpu(sb->tx_read_req_pkts);
 	estat->tx_read_res = le64_to_cpu(sb->tx_read_res_pkts);