Page MenuHomeFreeBSD

bnxt_re: Fix witness reported calltrace while unloading driver
ClosedPublic

Authored by sumit.saxena_broadcom.com on Aug 3 2026, 12:25 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Oct 13, 3:44 AM
Unknown Object (File)
Tue, Oct 13, 2:28 AM
Unknown Object (File)
Mon, Oct 12, 3:41 PM
Unknown Object (File)
Mon, Oct 12, 3:40 PM
Unknown Object (File)
Mon, Oct 12, 3:40 PM
Unknown Object (File)
Mon, Oct 12, 3:39 PM
Unknown Object (File)
Mon, Oct 12, 3:29 PM
Unknown Object (File)
Mon, Oct 12, 3:51 AM
Subscribers

Details

Summary

bnxt_unregister_dev() called synchronize_rcu() while holding
bp->en_ops_lock, which witness flags as a sleeping-while-locked
violation on driver unload. Drop the lock around the RCU grace period
and reacquire it afterward.

Also gate the RoCE extended-stats hex dump in
bnxt_qplib_qext_stat() behind bootverbose instead of printing it
unconditionally.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

sys/dev/bnxt/bnxt_en/bnxt_ulp.c
114

Aren't you still sleeping while holding a lock? This isn't our msleep, which drops the lock and re-acquires it, but the linux kpi one, which does pause_sbt() under the hood.

again, I *HATE* that you mix linux and freebsd in the driver. it makes it almost impossible to reason about

sys/dev/bnxt/bnxt_en/bnxt_ulp.c
114

Will fix up this in next revision.

AI scan :

  • The wait loop gave up after ~1 second and returned 0 (success) regardless of whether ulp->ref_count actually reached zero, telling callers unregistration completed when a ULP consumer might still hold a reference into the ulp_ops/async_events_bmap state this function just tore down. At least one caller (bnxt_re_dev_unreg() in bnxt_re/main.c) does check this return value and logs on failure. Return ETIMEDOUT when the loop exits without ref_count reaching zero.
This revision is now accepted and ready to land.Sep 10 2026, 3:04 PM