Page MenuHomeFreeBSD

if_bnxt: drop epoch_arr[] to detect EPOCH bit toggle
AcceptedPublic

Authored by sumit.saxena_broadcom.com on Aug 3 2026, 1:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Sep 2, 1:23 PM
Unknown Object (File)
Wed, Sep 2, 7:48 AM
Unknown Object (File)
Mon, Aug 31, 6:30 AM
Unknown Object (File)
Sun, Aug 30, 12:13 AM
Unknown Object (File)
Tue, Aug 25, 2:27 AM
Unknown Object (File)
Mon, Aug 24, 7:08 PM
Unknown Object (File)
Sun, Aug 23, 9:21 AM
Unknown Object (File)
Sat, Aug 22, 10:40 AM
Subscribers
None

Details

Summary

The EPOCH array size is 4096 but the driver does not enforce any limit
on ring size, so setting ring size >4096 corrupts adjacent memory
and leads to undefined behavior.

Toggle epoch_bit directly at every ring-producer wrap point (TX/RX
encap and refill, MPC crypto commands, kTLS presync/replay) instead of
looking it up per-index in the doorbell path, dropping the now-unused
epoch_arr[] snapshot array.

Reported by: Drew Gallatin

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

sumit.saxena_broadcom.com retitled this revision from if_bnxt: move EPOCH bit handling into the doorbell path to if_bnxt: drop epoch_arr[] to detect EPOCH bit toggle.
sumit.saxena_broadcom.com edited the summary of this revision. (Show Details)
This revision is now accepted and ready to land.Aug 4 2026, 7:43 PM