From nobody Fri Oct 09 10:12:56 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j1N3F2cPsz6vRKd for ; Fri, 09 Oct 2026 10:12:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j1N3F19Mmz4YDw for ; Fri, 09 Oct 2026 10:12:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540777; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=NMbTz6ZosNSBkdKlUyNVeMynxteq/qfIIQn6lFAYSYU=; b=V1upUx5vNCsg/OPogOHtin6uLJXR+XRlzRPvig4Ytv4AZu+AZIz/jYPlgSJgbeoYDBtAw2 ISDSh4hxFHZsnCbbGp6eNp3PeCtSqMI5y/T3KfmXLU22aeLj2foQ5vop8mdNfCNewEDcUr 1qmX+xK7ZAXz5+guDorb4JrgOBYgSlypVRYBq+ytd0Stxtf9Z8YCjKi+O7erNG4RY6o+El wdcGxnw/mZ+boz9IGbDzm1x3FGtY44TJWiY9RagR5AV8PH6Y4OvWtHylAcGLYyPZ1CD5LN DpmyQf5IjuXDRvCVb3/+1eeDoZkrzV67MfPYNF9jYzGq2cmUCiAv3pNU3ZyICw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791540777; b=gOi5oVvtWJpbBfZ5p8p/aYonVT9A1Ne0eigp6tSAqgt62l0XW3aoLUEQTOjCflI2Moz0iq h1j9BVoM5/nGlQhpPoCIRUpy5LKVwIQTq8CW9NHO2Poazf2Akz9eJo6wCZGlD856LYaOgN QSiBQDEZ2S7Trh43gl0VXrGRTlJ9Q+Z3MXaOq4LRQuuO5OGctShVsiUtrvQe1s18+k++3l UJ9/LMDLqx1tbj2Ai+n2zBdhEJAPJlon0DwTzekoeXL1NZ7IpIWKzudUO4gXZ3D+rXzOzs CUGcVYbblt3rqqa2iejEjnRtMYGze+xFhZphAqFEsKETOY+QgBP8Safi/+AWzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540777; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=NMbTz6ZosNSBkdKlUyNVeMynxteq/qfIIQn6lFAYSYU=; b=eNOJ1h88F3uUiM4TEq8XA6LWG0BqE+1qbd/F3QS0v7mtvxrdmiRKx5+GW9FtZg9FnRZggh r0evvqYvwg+USPUTGnAlRIXAKKPGCw4Kyn/NKVQ/ZImv1/FGKWryR6T7JY3+EOzBaFYPA1 mL/5yWRjrXFJnS9FSoAxTY4s/WkYv7pecE1jiLa/s26I40nmeLM2dhUfYxJZBpj55XfHsl ZV7OmLxTmr5SeEOyy8eu2u7zixlLpMvIh5prsTYo6EkrhCRdcDHEILfZLCdgEJrBSc+Egr qBLMUYTEYEa/HMmjRStuvEChaY6ULN1qyLtyms85+T0hox7+21ZaiEtuE5mS4g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j1N3D5Pzwz1LTV for ; Fri, 09 Oct 2026 10:12:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 42c99 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 09 Oct 2026 10:12:56 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Sumit Saxena From: Sumit Saxena Subject: git: ed1f24d3e1a1 - main - if_bnxt: drop epoch_arr[] to detect EPOCH bit toggle List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ssaxena X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ed1f24d3e1a1c0f85bf3eda0337cfbf76bc34cf6 Auto-Submitted: auto-generated Date: Fri, 09 Oct 2026 10:12:56 +0000 Message-Id: <6ac8be28.42c99.1a659040@gitrepo.freebsd.org> The branch main has been updated by ssaxena: URL: https://cgit.FreeBSD.org/src/commit/?id=ed1f24d3e1a1c0f85bf3eda0337cfbf76bc34cf6 commit ed1f24d3e1a1c0f85bf3eda0337cfbf76bc34cf6 Author: Sumit Saxena AuthorDate: 2026-08-03 05:03:22 +0000 Commit: Sumit Saxena CommitDate: 2026-10-09 08:24:45 +0000 if_bnxt: drop epoch_arr[] to detect EPOCH bit toggle The EPOCH array size is 4096 but the driver does not enforce any limit on ring size, so setting ring size >4096 corrupts adjacent memory and leads to undefined behavior. Toggle epoch_bit directly at every ring-producer wrap point (TX/RX encap and refill, MPC crypto commands, kTLS presync/replay) instead of looking it up per-index in the doorbell path, dropping the now-unused epoch_arr[] snapshot array. Reported by: gallatin Reviewed by: gallatin MFC after: 2 weeks Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58620 Change-Id: I4673d64670ee0e8ea256b8a8932724bbd73f710d --- sys/dev/bnxt/bnxt_en/bnxt.h | 3 --- sys/dev/bnxt/bnxt_en/bnxt_ktls.c | 24 ++++++++++++++++++------ sys/dev/bnxt/bnxt_en/bnxt_mpc.c | 5 +++++ sys/dev/bnxt/bnxt_en/bnxt_txrx.c | 26 ++++---------------------- sys/dev/bnxt/bnxt_en/if_bnxt.c | 4 ++-- 5 files changed, 29 insertions(+), 33 deletions(-) diff --git a/sys/dev/bnxt/bnxt_en/bnxt.h b/sys/dev/bnxt/bnxt_en/bnxt.h index 14f17b6d288a..e8ffc9fdb057 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt.h +++ b/sys/dev/bnxt/bnxt_en/bnxt.h @@ -606,8 +606,6 @@ struct bnxt_grp_info { uint16_t ag_ring_id; }; -#define EPOCH_ARR_SZ 4096 - struct tx_bd_opaque { uint16_t idx; uint16_t bds:15, @@ -690,7 +688,6 @@ struct bnxt_ring { uint32_t db_epoch_mask; uint8_t db_epoch_shift; - uint64_t epoch_arr[EPOCH_ARR_SZ]; bool epoch_bit; }; diff --git a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c index 90c59607f336..31549707d275 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_ktls.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_ktls.c @@ -1655,6 +1655,8 @@ static int bnxt_ktls_submit_mbuf(struct bnxt_softc *softc, struct bnxt_ring *txr } prod = RING_NEXT(txr, prod); + if (prod == 0) + txr->epoch_bit = !txr->epoch_bit; if (pi->ipi_tso_segsz != 0) { /* Preserve the connection's actual negotiated MSS. */ @@ -1711,6 +1713,8 @@ static int bnxt_ktls_submit_mbuf(struct bnxt_softc *softc, struct bnxt_ring *txr tbd->flags_type = htole16(flags_type); prod = RING_NEXT(txr, prod); + if (prod == 0) + txr->epoch_bit = !txr->epoch_bit; tbd = &((struct tx_bd_long *)txr->vaddr)[prod]; tbd->len = htole16(segs[seg].ds_len); @@ -1722,6 +1726,8 @@ static int bnxt_ktls_submit_mbuf(struct bnxt_softc *softc, struct bnxt_ring *txr tbd->flags_type = htole16(flags_type); prod = RING_NEXT(txr, prod); + if (prod == 0) + txr->epoch_bit = !txr->epoch_bit; txr->prod = prod; @@ -1773,6 +1779,8 @@ static void bnxt_ktls_pre_xmit(struct bnxt_softc *bp, struct bnxt_ring *txr, } prod = RING_NEXT(txr, prod); + if (prod == 0) + txr->epoch_bit = !txr->epoch_bit; /* Copy pre-cmd to TX desc ring*/ pcmd1 = &((struct tx_bd *)txr->vaddr)[prod]; @@ -1785,6 +1793,7 @@ static void bnxt_ktls_pre_xmit(struct bnxt_softc *bp, struct bnxt_ring *txr, } else { memcpy(pcmd, pre_cmd, space); prod = 0; + txr->epoch_bit = !txr->epoch_bit; pcmd1 = &((struct tx_bd *)txr->vaddr)[prod]; pcmd = (uint8_t *)pcmd1; memcpy((uint8_t *)pcmd, (uint8_t *)pre_cmd + space, @@ -1793,6 +1802,8 @@ static void bnxt_ktls_pre_xmit(struct bnxt_softc *bp, struct bnxt_ring *txr, } prod = RING_NEXT(txr, prod); + if (prod == 0) + txr->epoch_bit = !txr->epoch_bit; tx_buf->inline_bds = CRYPTO_PREFIX_CMD_BDS - 1; txr->prod = prod; } @@ -1952,6 +1963,7 @@ static int bnxt_ktls_tx_ooo(struct bnxt_softc *bp, struct bnxt_ring *txr, bool update_inorder = false; uint32_t tx_prod; uint16_t running_bds; + bool epoch_bit; ktls = bp->ktls_info; @@ -2031,13 +2043,12 @@ static int bnxt_ktls_tx_ooo(struct bnxt_softc *bp, struct bnxt_ring *txr, pcmd.flags = htole32(presync_flags); /* - * Save tx ring producer index and running_bds accumulator before - * writing presync command, it will be used to move the producer - * index backwards to discard presync command and restore running_bds - * to the state of before sending presync command, if replay packet fails. + * Save producer/running_bds/epoch_bit before the presync command so + * they can be rolled back if the replay packet fails to post. */ tx_prod = txr->prod; running_bds = txr->running_bds; + epoch_bit = txr->epoch_bit; bnxt_ktls_pre_xmit(bp, txr, kctx_tx->kid, &pcmd); @@ -2047,12 +2058,13 @@ static int bnxt_ktls_tx_ooo(struct bnxt_softc *bp, struct bnxt_ring *txr, if (fwd) counter_u64_add(ktls->counters[BNXT_KTLS_TX_SEQ_FWD_REPLAY], 1); /* - * If replay failed, discard presync BD by rolling back both the - * producer index and restore running_bds accumulator. + * If replay failed, discard presync BD by rolling back the + * producer index, running_bds accumulator, and epoch_bit. */ if (rc) { txr->prod = tx_prod; txr->running_bds = running_bds; + txr->epoch_bit = epoch_bit; } } diff --git a/sys/dev/bnxt/bnxt_en/bnxt_mpc.c b/sys/dev/bnxt/bnxt_en/bnxt_mpc.c index 4e35b3bdca9c..1182a5baede5 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_mpc.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_mpc.c @@ -564,6 +564,7 @@ int bnxt_hwrm_mpc_ring_alloc(struct bnxt_softc *softc) txr->prod = 0; txr->cons = 0; + txr->epoch_bit = false; memset(txr->tx_mpc_buf_ring, 0, txr->ring_size * sizeof(struct bnxt_sw_mpc_tx_bd)); @@ -874,6 +875,10 @@ int bnxt_start_xmit_mpc(struct bnxt_softc *softc, struct bnxt_ring *txr, return EBUSY; prod = txr->prod; + /* Wraps the ring at most once since total_bds < ring_size; toggle + * epoch_bit to match, as prod advances directly here, not per-BD. */ + if ((uint32_t)prod + total_bds >= txr->ring_size) + txr->epoch_bit = !txr->epoch_bit; txbd = &((struct tx_bd_long *)txr->vaddr)[prod]; tx_buf = &txr->tx_mpc_buf_ring[prod]; diff --git a/sys/dev/bnxt/bnxt_en/bnxt_txrx.c b/sys/dev/bnxt/bnxt_en/bnxt_txrx.c index 72de950bea0d..c621300ad877 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_txrx.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_txrx.c @@ -103,7 +103,6 @@ bnxt_isc_txd_encap(void *sc, if_pkt_info_t pi) uint16_t lflags = 0; uint32_t cfa_meta; int seg = 0; - uint8_t wrap = 0; struct tx_bd_opaque *opq; txr->prod = pi->ipi_pidx; @@ -170,17 +169,9 @@ bnxt_isc_txd_encap(void *sc, if_pkt_info_t pi) if (need_hi) { flags_type |= TX_BD_LONG_TYPE_TX_BD_LONG; - /* Handle wrapping */ - if (pi->ipi_new_pidx == txr->ring_size - 1) - wrap = 1; - pi->ipi_new_pidx = RING_NEXT(txr, pi->ipi_new_pidx); - - /* Toggle epoch bit on wrap */ - if (wrap && pi->ipi_new_pidx == 0) + if (pi->ipi_new_pidx == 0) txr->epoch_bit = !txr->epoch_bit; - if (pi->ipi_new_pidx < EPOCH_ARR_SZ) - txr->epoch_arr[pi->ipi_new_pidx] = txr->epoch_bit; tbdh = &((struct tx_bd_long_hi *)txr->vaddr)[pi->ipi_new_pidx]; #ifdef KTLS_IFLIB_SUPPORT @@ -236,13 +227,9 @@ bnxt_isc_txd_encap(void *sc, if_pkt_info_t pi) for (; seg < pi->ipi_nsegs; seg++) { tbd->flags_type = htole16(flags_type); - if (pi->ipi_new_pidx == txr->ring_size - 1) - wrap = 1; pi->ipi_new_pidx = RING_NEXT(txr, pi->ipi_new_pidx); - if (wrap && pi->ipi_new_pidx == 0) + if (pi->ipi_new_pidx == 0) txr->epoch_bit = !txr->epoch_bit; - if (pi->ipi_new_pidx < EPOCH_ARR_SZ) - txr->epoch_arr[pi->ipi_new_pidx] = txr->epoch_bit; tbd = &((struct tx_bd_long *)txr->vaddr)[pi->ipi_new_pidx]; tbd->len = htole16(pi->ipi_segs[seg].ds_len); @@ -251,13 +238,10 @@ bnxt_isc_txd_encap(void *sc, if_pkt_info_t pi) } flags_type |= TX_BD_SHORT_FLAGS_PACKET_END; tbd->flags_type = htole16(flags_type); - if (pi->ipi_new_pidx == txr->ring_size - 1) - wrap = 1; + pi->ipi_new_pidx = RING_NEXT(txr, pi->ipi_new_pidx); - if (wrap && pi->ipi_new_pidx == 0) + if (pi->ipi_new_pidx == 0) txr->epoch_bit = !txr->epoch_bit; - if (pi->ipi_new_pidx < EPOCH_ARR_SZ) - txr->epoch_arr[pi->ipi_new_pidx] = txr->epoch_bit; txr->prod = pi->ipi_new_pidx; return 0; @@ -451,8 +435,6 @@ bnxt_isc_rxd_refill(void *sc, if_rxd_update_t iru) pidx = 0; rx_ring->epoch_bit = !rx_ring->epoch_bit; } - if (pidx < EPOCH_ARR_SZ) - rx_ring->epoch_arr[pidx] = rx_ring->epoch_bit; } return; diff --git a/sys/dev/bnxt/bnxt_en/if_bnxt.c b/sys/dev/bnxt/bnxt_en/if_bnxt.c index 0c0f896f2c12..0757985fa49f 100644 --- a/sys/dev/bnxt/bnxt_en/if_bnxt.c +++ b/sys/dev/bnxt/bnxt_en/if_bnxt.c @@ -1714,7 +1714,7 @@ bnxt_thor2_db_rx(void *db_ptr, uint16_t idx) ((uint64_t)ring->phys_id << DBR_XID_SFT)); /* Add the PI index */ - db_val |= DB_RING_IDX(ring, idx, ring->epoch_arr[idx]); + db_val |= DB_RING_IDX(ring, idx, ring->epoch_bit); bus_space_barrier(db_bar->tag, db_bar->handle, ring->doorbell, 8, BUS_SPACE_BARRIER_WRITE); @@ -1738,7 +1738,7 @@ bnxt_thor2_db_tx(void *db_ptr, uint16_t idx) ((uint64_t)ring->phys_id << DBR_XID_SFT)); /* Add the PI index */ - db_val |= DB_RING_IDX(ring, idx, ring->epoch_arr[idx]); + db_val |= DB_RING_IDX(ring, idx, ring->epoch_bit); bus_space_barrier(db_bar->tag, db_bar->handle, ring->doorbell, 8, BUS_SPACE_BARRIER_WRITE);