git: a48a50919da5 - main - if_bnxt: ktls: Reject new kTLS sessions once driver is detaching

The branch main has been updated by ssaxena:

URL: https://cgit.FreeBSD.org/src/commit/?id=a48a50919da5549b2a5a2141042087a25879435e

commit a48a50919da5549b2a5a2141042087a25879435e
Author:     Sumit Saxena <sumit.saxena@broadcom.com>
AuthorDate: 2026-07-31 15:53:02 +0000
Commit:     Sumit Saxena <ssaxena@FreeBSD.org>
CommitDate: 2026-10-09 08:24:44 +0000

    if_bnxt: ktls: Reject new kTLS sessions once driver is detaching
    
    bnxt_tls_snd_tag_alloc() only gated on BNXT_STATE_OPEN, which is set
    once by bnxt_open()/bnxt_attach_pre() but never cleared again, so it
    could not reject new sessions once bnxt_detach() started tearing
    things down. The snd_tag_alloc_ref-based wait in bnxt_detach(), which
    waits for in-flight allocators to exit, was already in place, but
    without this gate new sessions could keep being created for the
    entire duration of that wait, extending it indefinitely instead of
    just draining existing ones.
    
    Reject new sessions once softc->detached is set, and reset it back to
    false in bnxt_attach_pre() so it doesn't wrongly persist across a
    detach/reattach cycle.
    
    Reviewed by:    gallatin
    MFC after:      2 weeks
    Sponsored by:   Broadcom Inc.
    Differential Revision:  https://reviews.freebsd.org/D58612
---
 sys/dev/bnxt/bnxt_en/bnxt_ktls.c | 12 ++++++++++++
 sys/dev/bnxt/bnxt_en/if_bnxt.c   |  1 +
 2 files changed, 13 insertions(+)

diff --git a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
index 0578de559910..90c59607f336 100644
--- a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
+++ b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c
@@ -180,8 +180,20 @@ int bnxt_tls_snd_tag_alloc(if_t ifp, union if_snd_tag_alloc_params* params,
 	if (!test_bit(BNXT_STATE_OPEN, &priv->state))
 		return (EPROTONOSUPPORT);
 
+	if (atomic_load_acq_int(&priv->detached))
+		return (EPROTONOSUPPORT);
+
+	/*
+	 * Re-check `detached` after incrementing snd_tag_alloc_ref so
+	 * bnxt_detach()'s drain loop can see this ref and wait for it.
+	 */
 	atomic_add_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
 
+	if (atomic_load_acq_int(&priv->detached)) {
+		atomic_subtract_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
+		return (EPROTONOSUPPORT);
+	}
+
 	if (priv->ktls_info->init == 0) {
 		counter_u64_add(ktls->err_counters[BNXT_KTLS_TX_UNINITIALIZED], 1);
 		atomic_subtract_32(&priv->ktls_info->snd_tag_alloc_ref, 1);
diff --git a/sys/dev/bnxt/bnxt_en/if_bnxt.c b/sys/dev/bnxt/bnxt_en/if_bnxt.c
index 6768e313f78d..25b535a67af8 100644
--- a/sys/dev/bnxt/bnxt_en/if_bnxt.c
+++ b/sys/dev/bnxt/bnxt_en/if_bnxt.c
@@ -2661,6 +2661,7 @@ bnxt_attach_pre(if_ctx_t ctx)
 	softc->slot = pci_get_slot(softc->dev);
 	softc->function = pci_get_function(softc->dev);
 	softc->dev_fn = PCI_DEVFN(softc->slot, softc->function);
+	atomic_store_rel_int(&softc->detached, 0);
 
 	bnxt_set_flags_by_devid(softc);