From nobody Fri Oct 09 10:12:42 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j1N2z0jGSz6vRPg for ; Fri, 09 Oct 2026 10:12:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j1N2y4bh5z4Xwy for ; Fri, 09 Oct 2026 10:12:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540762; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UgPAl+NPn7P/nfRSI6kDj3ynpK9SPrk+7yXWbJm3MHc=; b=okyi1fN0KFtcLXXgsbGhR1ZfXAIcxJtRsEg9kZ+r6/9op5sJxh1zVtmvgjEZxyhBghA+YS KU/NM1cV1BJtImShV0kj2ujd4KNOrQf2aRDyxXcuZrjCMbK+LcaMw6lVClQ1WaDGR0kNd6 HRVOSckrkT0d63Ft9cAYnrhhIoHC40V9UD9nb2DO2x5GLMFBsNlRIbceQmyy6ID72MCp70 DRn8s6imQjzNkzoU5lzGoWXksycrj/Bo5WldcQzAQlIqiaXXfhquUQz0dqh2arGRpKkBaf v0eI7LTwMMfvTZUjraM/J1XhsF0ln9Mw+w/H5+3fYsqhSW6sa9aQPlrNxZthzg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791540762; b=FBZqGcuAtTzWRBu5ersPNDJEosnTg0vbQq/+a8DFjMuOZacWqNQYk8st887SFyLjLGbMRm PJfP6kqJydSvIzdF8ky0OqSGi1z0iq4BkO7p5SoWz7xj34voKhJ/gj6bG7yiL6C/CT7BXs 4vx1rV4ZxTUtUBvyeggG4w9eysvhZcjtuzeckDYo0W/0Khi2E99BbbTIB4r/z+OGZ+I9EE bhZH7DWWW7ocN8flsOR2oU4BbfIoCSlMQEEnfypYBIcyUk3+l4foT3vAr8HKoKpUvBe0a3 PlpPR7NwaE18/djkP8/ldFPoUwMQmOfK2mg8VIkCMXdUnyF4BBjRMJ1aPzhDmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540762; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UgPAl+NPn7P/nfRSI6kDj3ynpK9SPrk+7yXWbJm3MHc=; b=dviuzmwBkqJNKRp5GgbMc75n9sMcRY3gERZdFC1E0b0q2m5ttuKV8FJn8yrtcPdD6riOjt /uw6t9VBfDI0nRPJcDhQAw+GpdYDLannrm6XXLmRnCUZyUP+KQYw9RyvmCRGASWxVU8CwJ JjSyayoNX4+Tn2PD+om9JxexPjHazWniJS4ttRz76iInKmQ5va5wUDGaeuqTI2WNeL3mAC jYzuUNkncfv7kwHmO1a59M8E8JOR/XQw+FhnWVY5nd93YCasZE/gQeOxx3u66Y42y1DoGo 7vvsW+vJrEvzTIdtifMtODmdq7JMr1ZHAQAruG+gOska5n6AH0B0Q5s0MqOQ6Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j1N2y3Dtyz1L3y for ; Fri, 09 Oct 2026 10:12:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 41b3c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 09 Oct 2026 10:12:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Sumit Saxena From: Sumit Saxena Subject: git: 9330b2f73c04 - main - if_bnxt: Fix HWRM mailbox/DMA teardown race on detach List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ssaxena X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9330b2f73c04f06e39da5cf2279682a607185601 Auto-Submitted: auto-generated Date: Fri, 09 Oct 2026 10:12:42 +0000 Message-Id: <6ac8be1a.41b3c.51fb5ade@gitrepo.freebsd.org> The branch main has been updated by ssaxena: URL: https://cgit.FreeBSD.org/src/commit/?id=9330b2f73c04f06e39da5cf2279682a607185601 commit 9330b2f73c04f06e39da5cf2279682a607185601 Author: Sumit Saxena AuthorDate: 2026-07-31 15:43:59 +0000 Commit: Sumit Saxena CommitDate: 2026-10-09 08:24:43 +0000 if_bnxt: Fix HWRM mailbox/DMA teardown race on detach iflib's generic device-deregister path never drains the admin task before calling IFDI_DETACH, so bnxt_update_admin_status() (scheduled once/sec) could still run concurrently with bnxt_detach(), racing on softc->hwrm_lock and the shared HWRM request/response DMA buffer that bnxt_detach() destroys. That race could leave the firmware-side HWRM mailbox inconsistent, surfacing as "Timeout sending HWRM_VER_GET" on the next module load. Add a softc->detached guard: set it as the first statement in bnxt_detach(), and bail out of bnxt_update_admin_status() immediately when it's set. Reviewed by: gallatin MFC after: 2 weeks Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58607 --- sys/dev/bnxt/bnxt_en/bnxt.h | 3 +++ sys/dev/bnxt/bnxt_en/if_bnxt.c | 8 ++++++++ 2 files changed, 11 insertions(+) diff --git a/sys/dev/bnxt/bnxt_en/bnxt.h b/sys/dev/bnxt/bnxt_en/bnxt.h index f0b9d114ad72..e50c4157ac0b 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt.h +++ b/sys/dev/bnxt/bnxt_en/bnxt.h @@ -1350,6 +1350,9 @@ struct bnxt_softc { struct bnxt_nvram_info *nvm_info; bool wol; bool is_dev_init; + /* Cross-thread flag; access only via atomic_load_acq_int()/ + * atomic_store_rel_int(), never as a plain bool. */ + volatile int detached; struct bnxt_hw_lro hw_lro; uint8_t wol_filter_id; uint16_t rx_coal_usecs; diff --git a/sys/dev/bnxt/bnxt_en/if_bnxt.c b/sys/dev/bnxt/bnxt_en/if_bnxt.c index f179250ebbe0..2ea1fc97fd92 100644 --- a/sys/dev/bnxt/bnxt_en/if_bnxt.c +++ b/sys/dev/bnxt/bnxt_en/if_bnxt.c @@ -3202,6 +3202,11 @@ bnxt_detach(if_ctx_t ctx) struct bnxt_vlan_tag *tmp; int i; + /* Set first: the admin task isn't drained before IFDI_DETACH and can + * still fire concurrently, so it must see this immediately via + * atomic_store_rel_int()/atomic_load_acq_int(). */ + atomic_store_rel_int(&softc->detached, 1); + bnxt_mpc_irq_cleanup(softc); bnxt_rdma_aux_device_uninit(softc); cancel_delayed_work_sync(&softc->fw_reset_task); @@ -4217,6 +4222,9 @@ bnxt_update_admin_status(if_ctx_t ctx) if (!BNXT_PF(softc)) return; + if (atomic_load_acq_int(&softc->detached)) + return; + bnxt_hwrm_port_qstats(softc); if (BNXT_CHIP_P5_PLUS(softc) &&