From nobody Thu Oct 29 23:37:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jG0y801qvz6xr6q for ; Thu, 29 Oct 2026 23:37:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jG0y74T5Yz4t0h for ; Thu, 29 Oct 2026 23:37:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qoO5H1kM3X4klDXwyvnvaKMNNNHRDMbforsqpLbnWYI=; b=neeZWBIdAxTtpbGIv0uHxhBcqBP8SRktXTiaNxMVAhLKPydd36aijVd7WNmVrW+DzgCm7Y JGKUgq7GXKEG4c/7Q+h5cK5/bgeLYPo9Vfqtjcft6BjfU+7n/lEOHrJekDPBgsNSAvyI5v 7GgQbdkIpMXc7ORbUJtB6i7b6IgwRY/aeI26mM1qTiFEnpt/6fHP5ceJTbBCzX6TxZSMKv FB4+MpIVY0yu4IfgmLTZhOoM9LjGPvBS/5aArRht9E/Cke/iDrFInSFdODb7nEIHARy3Bd HP3CS7OBT++9o2kR9nrVRyf0GVsyELQFjrETvnWbq0lDno5yb4ZOI0uL/OaCxQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793317039; b=CFOYpglM7bgtOX45l+/Pm5y0tiQSi9UUz11Y0gKxoE4Xeor1hJSko5NAUFNUENDrk/slmC WVKWO1waLK8l/Bju6dTtVsES91rkftNupK0lu6iAOF5t/vzJa17KtUGAFBqOHE8F1xqabh kqTsLt2eDz0rpDbtmvceHjkQfHCbUzdKj9i3poRa6Gc1+0xibWznNwJaefldsKAFFWdW+2 SzWYo/Z2kH0Th4dK+qn3YD38D7cRPsAQk09Iu0KiFfrG8cwdsz8L6gaqFeu1o+e5b9zGWq OscNGXbFVrkwuuUI/ariOWlL4XxmrVcCvPO/63Tnh2EyniyI8KumAnekUCn5NQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qoO5H1kM3X4klDXwyvnvaKMNNNHRDMbforsqpLbnWYI=; b=FN/ajR5oaM4KiompeKyMrgjkvMYYi/ZNRJsgt9LXcJetgQOGfGdRS8JBK+6J1LJ4XlCWZY RIIWmZ+TCTIpiuOHl1Cxp1q1zXDknWILT6DON1PfdlAWtE5GVnkfM5J54iojpROlfJu7rO /1ko9boU+YAEViGbKxu3J0LHpXXiGurCbCe9doEdcykTvFfbAB/3eNl3xcj7r2Ln/Uk5DN w8RSL1Ng+c7JfpbdrJZ4qNw82Dv/VXSrT2y6Gvnf1kaVQMhDteMT1N2AB5Udf9h5Lf6qvH rrJPzv0cAvgL/JBOfX9/Bda7Vr6P/5E9CYU7EaV5rh92UbtWil1tX8m12wQX4A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jG0y73pxNz11kK for ; Thu, 29 Oct 2026 23:37:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c32b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 23:37:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Sumit Saxena From: Kevin Bowling Subject: git: d5f3f5f2f259 - stable/15 - if_bnxt: dcb: serialize HWRM sends and avoid freeing DMA bufs on timeout List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: d5f3f5f2f259648661517f4b3bc8c039f4c2ddf7 Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 23:37:19 +0000 Message-Id: <6ae3d8af.3c32b.1cfe146@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=d5f3f5f2f259648661517f4b3bc8c039f4c2ddf7 commit d5f3f5f2f259648661517f4b3bc8c039f4c2ddf7 Author: Sumit Saxena AuthorDate: 2026-09-29 12:15:06 +0000 Commit: Kevin Bowling CommitDate: 2026-10-29 23:15:20 +0000 if_bnxt: dcb: serialize HWRM sends and avoid freeing DMA bufs on timeout Every _hwrm_send_message() call in bnxt_dcb.c ran without BNXT_HWRM_LOCK, unlike the rest of the driver, letting concurrent HWRM commands race on the shared MMIO doorbell and response buffer. Route single-shot sends through the already-locked hwrm_send_message() wrapper, and wrap the remaining send+response-read sequences in explicit BNXT_HWRM_LOCK/UNLOCK. Also stop freeing the transient DMA buffers used for structured-data get/set on ETIMEDOUT: a host-side timeout doesn't guarantee firmware actually gave up, so a late completion could still DMA into memory that's since been freed and reused. Leak the buffer instead in that case. Reviewed by: gallatin Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D60179 (cherry picked from commit 4f20e02ed0582bd8a3e2b59853690c1d46e08fa8) --- sys/dev/bnxt/bnxt_en/bnxt_dcb.c | 52 ++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 8 deletions(-) diff --git a/sys/dev/bnxt/bnxt_en/bnxt_dcb.c b/sys/dev/bnxt/bnxt_en/bnxt_dcb.c index 403bb4183985..9efd3ba8653d 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_dcb.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_dcb.c @@ -78,7 +78,7 @@ bnxt_hwrm_queue_pri2cos_cfg(struct bnxt_softc *softc, qidx = softc->tc_to_qidx[ets->prio_tc[i]]; pri2cos[i] = q_info[qidx].queue_id; } - return _hwrm_send_message(softc, &req, sizeof(req)); + return hwrm_send_message(softc, &req, sizeof(req)); } static int @@ -92,6 +92,7 @@ bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt_softc *softc, struct bnxt_ieee_ets *ets bnxt_hwrm_cmd_hdr_init(softc, &req, HWRM_QUEUE_PRI2COS_QCFG); req.flags = htole32(HWRM_QUEUE_PRI2COS_QCFG_INPUT_FLAGS_IVLAN); + BNXT_HWRM_LOCK(softc); rc = _hwrm_send_message(softc, &req, sizeof(req)); if (!rc) { uint8_t *pri2cos = &resp->pri0_cos_queue_id; @@ -106,6 +107,7 @@ bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt_softc *softc, struct bnxt_ieee_ets *ets ets->prio_tc[i] = tc; } } + BNXT_HWRM_UNLOCK(softc); return rc; } @@ -152,7 +154,7 @@ bnxt_hwrm_queue_cos2bw_cfg(struct bnxt_softc *softc, struct bnxt_ieee_ets *ets, req.unused_0 = 0; } } - return _hwrm_send_message(softc, &req, sizeof(req)); + return hwrm_send_message(softc, &req, sizeof(req)); } static int @@ -167,8 +169,10 @@ bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt_softc *softc, struct bnxt_ieee_ets *ets) bnxt_hwrm_cmd_hdr_init(softc, &req, HWRM_QUEUE_COS2BW_QCFG); + BNXT_HWRM_LOCK(softc); rc = _hwrm_send_message(softc, &req, sizeof(req)); if (rc) { + BNXT_HWRM_UNLOCK(softc); return rc; } @@ -191,6 +195,7 @@ bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt_softc *softc, struct bnxt_ieee_ets *ets) ets->tc_tx_bw[tc] = cos2bw.bw_weight; } } + BNXT_HWRM_UNLOCK(softc); return 0; } @@ -288,7 +293,7 @@ bnxt_hwrm_queue_pfc_cfg(struct bnxt_softc *softc, struct bnxt_ieee_pfc *pfc) bnxt_hwrm_cmd_hdr_init(softc, &req, HWRM_QUEUE_PFCENABLE_CFG); req.flags = htole32(pri_mask); - return _hwrm_send_message(softc, &req, sizeof(req)); + return hwrm_send_message(softc, &req, sizeof(req)); } static int @@ -302,13 +307,16 @@ bnxt_hwrm_queue_pfc_qcfg(struct bnxt_softc *softc, struct bnxt_ieee_pfc *pfc) bnxt_hwrm_cmd_hdr_init(softc, &req, HWRM_QUEUE_PFCENABLE_QCFG); + BNXT_HWRM_LOCK(softc); rc = _hwrm_send_message(softc, &req, sizeof(req)); if (rc) { + BNXT_HWRM_UNLOCK(softc); return rc; } pri_mask = le32toh(resp->flags); pfc->pfc_en = pri_mask; + BNXT_HWRM_UNLOCK(softc); return 0; } @@ -341,7 +349,7 @@ bnxt_hwrm_get_dcbx_app(struct bnxt_softc *softc, struct bnxt_dcb_app *app, get.structure_id = htole16(HWRM_STRUCT_HDR_STRUCT_ID_DCBX_APP); get.subtype = htole16(HWRM_STRUCT_DATA_SUBTYPE_HOST_OPERATIONAL); get.count = 0; - rc = _hwrm_send_message(softc, &get, sizeof(get)); + rc = hwrm_send_message(softc, &get, sizeof(get)); if (rc) goto set_app_exit; @@ -362,6 +370,11 @@ bnxt_hwrm_get_dcbx_app(struct bnxt_softc *softc, struct bnxt_dcb_app *app, } set_app_exit: + if (rc == ETIMEDOUT) { + device_printf(softc->dev, + "dcbx app get timed out, leaking DMA buffer\n"); + return rc; + } iflib_dma_free(&dma_data); return rc; } @@ -377,6 +390,7 @@ bnxt_hwrm_set_dcbx_app(struct bnxt_softc *softc, struct bnxt_dcb_app *app, struct iflib_dma_info dma_data; size_t data_len; int rc, n, i; + bool did_set = false; if (softc->hwrm_spec_code < 0x10601) return 0; @@ -393,7 +407,7 @@ bnxt_hwrm_set_dcbx_app(struct bnxt_softc *softc, struct bnxt_dcb_app *app, get.structure_id = htole16(HWRM_STRUCT_HDR_STRUCT_ID_DCBX_APP); get.subtype = htole16(HWRM_STRUCT_DATA_SUBTYPE_HOST_OPERATIONAL); get.count = 0; - rc = _hwrm_send_message(softc, &get, sizeof(get)); + rc = hwrm_send_message(softc, &get, sizeof(get)); if (rc) goto set_app_exit; @@ -445,9 +459,16 @@ bnxt_hwrm_set_dcbx_app(struct bnxt_softc *softc, struct bnxt_dcb_app *app, set.src_data_addr = htole64(dma_data.idi_paddr); set.data_len = htole16(sizeof(*data) + sizeof(*fw_app) * n); set.hdr_cnt = 1; - rc = _hwrm_send_message(softc, &set, sizeof(set)); + did_set = true; + rc = hwrm_send_message(softc, &set, sizeof(set)); set_app_exit: + if (rc == ETIMEDOUT) { + device_printf(softc->dev, + "dcbx app %s timed out, leaking DMA buffer\n", + did_set ? "set" : "get"); + return rc; + } iflib_dma_free(&dma_data); return rc; } @@ -466,12 +487,14 @@ bnxt_hwrm_queue_dscp_qcaps(struct bnxt_softc *softc) bnxt_hwrm_cmd_hdr_init(softc, &req, HWRM_QUEUE_DSCP_QCAPS); + BNXT_HWRM_LOCK(softc); rc = _hwrm_send_message(softc, &req, sizeof(req)); if (!rc) { softc->max_dscp_value = (1 << resp->num_dscp_bits) - 1; if (softc->max_dscp_value < 0x3f) softc->max_dscp_value = 0; } + BNXT_HWRM_UNLOCK(softc); return rc; } @@ -502,12 +525,15 @@ bnxt_hwrm_queue_dscp2pri_qcfg(struct bnxt_softc *softc, struct bnxt_dcb_app *app req.dest_data_addr = htole64(dma_data.idi_paddr); req.dest_data_buffer_size = htole16(sizeof(*dscp2pri) * 64); req.port_id = htole16(softc->pf.port_id); + BNXT_HWRM_LOCK(softc); rc = _hwrm_send_message(softc, &req, sizeof(req)); + if (!rc) + entry_cnt = le16toh(resp->entry_cnt); + BNXT_HWRM_UNLOCK(softc); if (rc) goto end; - entry_cnt = le16toh(resp->entry_cnt); for (i = 0; i < entry_cnt && *num_inputs < nitems; i++) { app[*num_inputs].priority = dscp2pri[i].pri; app[*num_inputs].protocol = dscp2pri[i].dscp; @@ -516,6 +542,11 @@ bnxt_hwrm_queue_dscp2pri_qcfg(struct bnxt_softc *softc, struct bnxt_dcb_app *app } end: + if (rc == ETIMEDOUT) { + device_printf(softc->dev, + "dscp2pri qcfg timed out, leaking DMA buffer\n"); + return rc; + } iflib_dma_free(&dma_data); return rc; } @@ -549,8 +580,13 @@ bnxt_hwrm_queue_dscp2pri_cfg(struct bnxt_softc *softc, struct bnxt_dcb_app *app, dscp2pri->pri = app->priority; req.entry_cnt = htole16(1); req.port_id = htole16(softc->pf.port_id); - rc = _hwrm_send_message(softc, &req, sizeof(req)); + rc = hwrm_send_message(softc, &req, sizeof(req)); + if (rc == ETIMEDOUT) { + device_printf(softc->dev, + "dscp2pri cfg timed out, leaking DMA buffer\n"); + return rc; + } iflib_dma_free(&dma_data); return rc; }