Page MenuHomeFreeBSD

if_bnxt: Fix HWRM mailbox/DMA teardown race on detach
AcceptedPublic

Authored by sumit.saxena_broadcom.com on Aug 3 2026, 12:19 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Sep 4, 11:18 AM
Unknown Object (File)
Thu, Sep 3, 8:23 PM
Unknown Object (File)
Thu, Sep 3, 11:19 AM
Unknown Object (File)
Tue, Sep 1, 1:00 AM
Unknown Object (File)
Tue, Aug 25, 3:36 AM
Unknown Object (File)
Mon, Aug 24, 4:03 PM
Unknown Object (File)
Sun, Aug 23, 4:56 PM
Unknown Object (File)
Fri, Aug 21, 9:52 PM
Subscribers
None

Details

Summary

iflib's generic device-deregister path never drains the admin task
before calling IFDI_DETACH, so bnxt_update_admin_status() (scheduled
once/sec) could still run concurrently with bnxt_detach(), racing on
softc->hwrm_lock and the shared HWRM request/response DMA buffer that
bnxt_detach() destroys. That race could leave the firmware-side HWRM
mailbox inconsistent, surfacing as "Timeout sending HWRM_VER_GET" on
the next module load.

Add a softc->detached guard: set it as the first statement in
bnxt_detach(), and bail out of bnxt_update_admin_status() immediately
when it's set.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped