From nobody Thu Oct 29 23:37:30 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jG0yM1sszz6xr0Z for ; Thu, 29 Oct 2026 23:37:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jG0yL4XVQz4tN9 for ; Thu, 29 Oct 2026 23:37:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XOK0m5E151MIrtBSzMT+s4ZD+IQAQioheqFZ8NieBlM=; b=tNLVCNZyQrtkEhSJZl1SzHuAMFpc4kGHLSglQWjfIQLFE1voYNLxmPcZr9jxOsi/ghPHMj 3P4kT9d9MfjuIjgpiF7H61qOuFICnn3fYCwhf3LpUXK0l93NP47pWzHBe8z7iF6yMRuTKS F/4FTPPiclymq0GYaJPQEM2G5K8iT4qwC3Sm1LW7w+k+vD/bM7r/4C+yBe1qGvxNLnd52g R/4G7tgQnaCnjcts/LJbcniO7ISuwYLTNWCNOnv1IoN+35Ui425DtgGlAMpA4ELoARp3Qy fbZO53DjkuetvBhBaX5IF1iTEaZjhJiegFZHMWoOk2THhBdh1qEcxkmXkAi4vg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793317050; b=RWfrNspfeD0QZXZc+cHstYJnlAxsD15pz0VNPzPoVqYAhfS+tiT/2c6VtOTMwINHuQifvS wVCbIRMIasez28SWhIzs2jG6oLZb7Hx+NRNBhok0AG88Z3FpX8vVOj9xSre5ofWp6hQd9Q cnFLNLhMozi0d3Dkk+iIM4PttZzC8uSPQm9qr0PUacwmXG+aWI1LrBmoTwwK3M03jCcOFK bmTHxWvzk4DQOTedETmPneDUuJUP4sNA20aGOymikIC1EYz1Gj3xZNKDYZ9pdh0qB238Gm 68VhrDd06dcAQ/5g8iVkc8UM3OXBKgTf8sf4Nj+9Vyz3l5TooULzoFUEGgM2uA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XOK0m5E151MIrtBSzMT+s4ZD+IQAQioheqFZ8NieBlM=; b=pswHWBdhV2eJfD4MjlKzRMMq7E2Yyx2eSk8dItBcK9zoYUWfEu3oQuOQw9eejXZCLsCd07 leJV9tIVV1+nGpJX2hmLIed3Cd/eQgwvotvphj2lz7CTM6KDpQJupwR8OOfB5PXsZVDm2K IKK90R6BQYj2z34CyLPUU8gcsoe7fHUvoYCqxCze1qVvym+Jnu7qTesJVsPUtnAv+2Pypg V/3mHzQwmuSODgVXcHW2o2AdPz3YNGqdHWN1WibzfyC5t1/38Ck0u9C5iPtLGbbCwqPcCV M6s4E0lHbEmb24oEA1pnhWrXgLZEZ7R9tj3IodtWZ/lOvEi7e5PiXG+xJ7ntsA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jG0yL4CqYz12Cr for ; Thu, 29 Oct 2026 23:37:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c8f3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 23:37:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Sumit Saxena From: Kevin Bowling Subject: git: 063f4a2617c7 - stable/15 - if_bnxt: Fix HWRM mailbox/DMA teardown race on detach List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 063f4a2617c74e63912ce1aabcfad03aa7234ebc Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 23:37:30 +0000 Message-Id: <6ae3d8ba.3c8f3.3bef85de@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=063f4a2617c74e63912ce1aabcfad03aa7234ebc commit 063f4a2617c74e63912ce1aabcfad03aa7234ebc Author: Sumit Saxena AuthorDate: 2026-07-31 15:43:59 +0000 Commit: Kevin Bowling CommitDate: 2026-10-29 23:25:50 +0000 if_bnxt: Fix HWRM mailbox/DMA teardown race on detach iflib's generic device-deregister path never drains the admin task before calling IFDI_DETACH, so bnxt_update_admin_status() (scheduled once/sec) could still run concurrently with bnxt_detach(), racing on softc->hwrm_lock and the shared HWRM request/response DMA buffer that bnxt_detach() destroys. That race could leave the firmware-side HWRM mailbox inconsistent, surfacing as "Timeout sending HWRM_VER_GET" on the next module load. Add a softc->detached guard: set it as the first statement in bnxt_detach(), and bail out of bnxt_update_admin_status() immediately when it's set. Reviewed by: gallatin Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58607 (cherry picked from commit 9330b2f73c04f06e39da5cf2279682a607185601) --- sys/dev/bnxt/bnxt_en/bnxt.h | 3 +++ sys/dev/bnxt/bnxt_en/if_bnxt.c | 8 ++++++++ 2 files changed, 11 insertions(+) diff --git a/sys/dev/bnxt/bnxt_en/bnxt.h b/sys/dev/bnxt/bnxt_en/bnxt.h index 77970bf0ac02..b23f99497310 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt.h +++ b/sys/dev/bnxt/bnxt_en/bnxt.h @@ -1354,6 +1354,9 @@ struct bnxt_softc { struct bnxt_nvram_info *nvm_info; bool wol; bool is_dev_init; + /* Cross-thread flag; access only via atomic_load_acq_int()/ + * atomic_store_rel_int(), never as a plain bool. */ + volatile int detached; struct bnxt_hw_lro hw_lro; uint8_t wol_filter_id; uint16_t rx_coal_usecs; diff --git a/sys/dev/bnxt/bnxt_en/if_bnxt.c b/sys/dev/bnxt/bnxt_en/if_bnxt.c index 61a9c7bde6b6..56c562ea1b7f 100644 --- a/sys/dev/bnxt/bnxt_en/if_bnxt.c +++ b/sys/dev/bnxt/bnxt_en/if_bnxt.c @@ -3240,6 +3240,11 @@ bnxt_detach(if_ctx_t ctx) struct bnxt_vlan_tag *tmp; int i; + /* Set first: the admin task isn't drained before IFDI_DETACH and can + * still fire concurrently, so it must see this immediately via + * atomic_store_rel_int()/atomic_load_acq_int(). */ + atomic_store_rel_int(&softc->detached, 1); + bnxt_mpc_irq_cleanup(softc); bnxt_rdma_aux_device_uninit(softc); cancel_delayed_work_sync(&softc->fw_reset_task); @@ -4255,6 +4260,9 @@ bnxt_update_admin_status(if_ctx_t ctx) if (!BNXT_PF(softc)) return; + if (atomic_load_acq_int(&softc->detached)) + return; + bnxt_hwrm_port_qstats(softc); if (BNXT_CHIP_P5_PLUS(softc) &&