crontab -r only unlinks the crontab file, so spawn it directly with
unlinkat() relative to conf.rootfd. This also makes the crontab
removal work with pw -R.
MFC After: 1 week
rmat() used stat() with a path relative to the current working
directory, so it never found the job files in /var/at/jobs and the
at(1) jobs of a deleted user were never removed.
ef7d0eb948 also broke it by introducing a typo: /usr/sbin/atrm instead
of /usr/bin/artm.
Use fstatat() with the directory fd to stat the job files relative to
the at jobs directory, and unlinkat() them directly instead of spawning
atrm.
Those changes allow us to make it works with pw -R.
MFC After: 1 week
bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at
which point they haven't yet been assigned a domain. Thus, bufdomain()
returns &bdomain[-1], which trips the array-bounds sanitizer.
This is harmless since we don't use the result in that case, but let's
avoid the invalid access to begin with. This is sufficient to let an
amd64 kernel boot to a login prompt with -fsanitize=array-bounds
configured.
Reported by: Andrew Griffiths <[email protected]>
Reviewed by: rlibby, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59381
On ll/sc architectures casueword32() may report a spurious
store-conditional failure (reservation lost to an interrupt, preemption,
or another CPU touching the same reservation granule), and this is
indistinguishable from a genuine comparison mismatch: both return 1.
That is intentional since D20772 and documented in casueword(9) ("The
store can fail on load-linked/store-conditional architectures."), so
callers must cope.
do_lock_normal() does not fully cope. When the initial
UMUTEX_UNOWNED -> id acquire CAS fails spuriously, the observed owner is
still UMUTEX_UNOWNED, so neither the UMUTEX_CONTESTED branch nor the
real-owner case applies, and execution falls through past the "rv == 1
but not contested, likely store failure" comment into the sleep path.
There, the contested-bit CAS (expecting the observed owner, i.e.
UMUTEX_UNOWNED) succeeds because the mutex really is unowned, stamping
m_owner = UMUTEX_CONTESTED with no owner tid, and the thread sleeps on
"umtxn" forever: nobody owns the mutex, so no unlock and no wakeup ever
arrive. In _UMUTEX_TRY mode the same situation returns a false EBUSY
for a free mutex.
Treat an observed owner of UMUTEX_UNOWNED like UMUTEX_CONTESTED: try to
acquire the mutex, setting the contested bit, instead of falling through
to the sleep path. rv == 1 with the observed value equal to the
expected value can only mean a spurious store failure, so the mutex is
free. If the acquire CAS fails again, the outer loop restarts and
re-evaluates ownership. The contested bit set with no waiters present
only costs the matching unlock one trip through the kernel.
This was hit in practice on powerpc64le (POWER9): the Swift runtime's
Synchronization.Mutex issues _umtx_op(UMTX_OP_MUTEX_LOCK) directly with
no userspace fast path, so an uncontended lock of an unowned mutex runs
the kernel CAS exactly where a spurious failure deadlocks
(single-threaded process parked on "umtxn" with m_owner == 0x80000000,
observed as Foundation.Process.run() hanging). libthr mostly masks the
bug because pthread_mutex_lock() enters the kernel only when there is a
real owner that will eventually issue a wakeup.
The mechanism was confirmed with an experimental powerpc kernel that
instead retried the ll/sc sequence inside casueword32()/casueword();
that also eliminated the hang, but is not proposed here since the
single-attempt semantics of casueword(9) are intentional.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59338
All other usages of SCF_SIGNATURE are protected by IPSEC_SUPPORT
or TCP_SIGNATURE.
No functional change intended.
Reported by: Hannes Elfert
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
When processing the ACK of the initial TCP handshake using the
SYN cookie, don't increment the counter for unexpected
signatures (tcps_sig_err_sigopt). The correct
counter (tcps_sig_rcvbadsig) for bad signatures is already
incremented in TCPMD5_INPUT().
Reported by: Hannes Elfert
Reviewed by: rscheff
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59302
Wake-on-LAN capability was inferred from NVM bits on every MAC even
though 82599 support is board and sometimes port specific. Private
sysctls formed a second policy interface, and the driver neither
coordinated the controller wake source with PCI PME nor reliably
rebuilt address filters erased by the stop-time reset.
Use the standard ifconfig wake capabilities. Derive support from the
82599 board and port matrix or the X540-and-newer NVM capability.
Require D3hot PME support, and use the NVM APME bit only to select the
initial magic-packet policy after initializing the LAN function number.
Snapshot requested filters before the terminal stop so shared reset and
PHY code sees the active wake policy. After reset, restore RAR0, the
multicast table, receive filtering, and the optical laser before arming
WUFC, WUC, and PCI PME. Remove device wake sources before clearing PCI
PME on detach, resume, and when wake is disabled. Clear autonomous APM
so ifconfig remains authoritative.
Treat X550EM low-power-link-up failure as best effort and allow shutdown
to continue after a wake-programming error.
The 82599, X540, X550, and E610 datasheets document the standard ACPI
wake filters used here; the E610 ACPI path includes magic-packet wake.
Validated on a dual-port E610. Both ports completed three direct-D3
cycles covering wake disabled and magic-packet wake armed. A system S3
cycle woke through ix0 with WUS 0x00000002 (magic packet). Link and
traffic recovered after each transition.
Note that many add-in cards in this family do not support WoL; LOM and
OCP cards are more likely. The E610 as tested does.
MFC after: 2 weeks
Sponsored by: Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by: BBOX.io
When receiving a SYN segment with an MD5 option on a listening socket,
which has not enabled TCP MD5 support, increment the counter for
unexpected signatures (tcps_sig_err_sigopt).
Reviewed by: rscheff
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D59303
Whenever we create a user-space mapping, we always set ATTR_S1_PXN in
the PTE, which blocks execution of user-space code while running in
kernel mode. However, when seeking to determine whether we need to
perform an icache flush before installing the new PTE, we test whether
sometimes the old PTE or other times the new PTE has ATTR_S1_XN set.
The trouble is that ATTR_S1_XN is defined as the bitwise OR of
ATTR_S1_PXN and ATTR_S1_UXN, and so the test for whether ATTR_S1_XN is
set is satisfied if either of its constituent bits is set, i.e., we
write (l3e & ATTR_S1_XN) != 0. Consequently, the test is always true.
In practice, I believe that the ill effects of this bug are limited:
In pmap_enter(), in rare circumstances, e.g., wiring a code page, an
unnecessary icache flush will be performed. In pmap_enter_l2() and
pmap_enter_l3c(), no icache flush will be performed. However,
typically an icache flush would have already been performed on each of
the constituent base pages.
Reviewed by: kib, markj
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D59265
The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index. Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.
Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.
Reported by: Daniel Braniss <[email protected]>
Tested by: Daniel Braniss <[email protected]>
Obtained from: Intel ixl 1.14.2
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59336
gzoned(8) is a new GEOM class that exposes a host-managed zoned device
(similar to ZAC/ZBC drives) on top of regular, non-zoned providers.
The created medium is sliced into equally sized zones, by default
sequential-write-required. Such zones can be turned into conventional
zones if desired. The zoned drive's state and configuration is
persistent through metadata at the tail of the backing provider, meaning
the zoned device gets recreated at the provider retaste. Zone state
changes only mark the table dirty with BIO_FLUSH committing it,
mirroring drives whose zone state is volatile until a cache flush.
The new class tries to emulate real zoned drives by incorporating
per-zone write pointers and support for BIO_ZONE management commands.
Fault emulation through zone conditions (RWP recommended, offline, R/O),
URSWRZ bit toggling and concurrent open zone limits are additional
features useful for testing.
While at it, fix zonectl's report of write pointer LBAs for zones that
should have none, remove its forced debug flags and allow the geom(8)
shared subroutines to detect host-managed drives.
ATF-sh tests for gzoned(8) and zonectl(8) (dogfooded by gzoned(8)) are
included, featuring helpers (see zoned_subr.sh) for testing zoned
storage support in other components or GEOM classes.
Reviewed by: asomers, fuz, ken
Sponsored by: Google Summer of Code 2026
Pull Request: https://github.com/freebsd/freebsd-src/pull/2326
Root-only ATF program hitting negative allocate/attach/read-write paths
and asserting the exterr(3) text. AMD/IBS cases skip without the PMC
class; program skips without hwpmc.
Additional changes by mhorne@:
- Move and rename to the established test directory tests/sys/pmc
- Remove broken test amd_missing_pmu_flag; fixed by recent change
6c4d9b9af1
- Add ATF_REQUIRE_FEATURE("exterr_strings") to skip the tests on kernels
compiled without the strings
- Remove arch-conditional compilation; tests are properly gated by PMC
class check
- Fix copyright formatting
Reviewed by: Ali Mashtizadeh <[email protected]>
Signed-off-by: Andre Silva <[email protected]>
Co-authored-by: mhorne
Sponsored by: AMD
Pull Request: https://github.com/freebsd/freebsd-src/pull/2180
This change adds support for AMD's UMC performance counters. It is a
bit more complicated than existing counters because the enable bit has
moved. This supports Zen 4 through most Zen 6 chips as UMC counters are
per-node, where a node does not necessarily translate to a NUMA domain.
A few follow up changes to PMC will address this limitation.
Reviewed by: mhorne
Sponsored by: Netflix
Pull Request: https://github.com/freebsd/freebsd-src/pull/2368
The namespace character device does not initialize si_iosize_max, so
physio falls back to DFLTPHYS and can produce a bio larger than the
qpair payload DMA tag on a controller whose maximum transfer size is
below 64KB. Such a bio fails DMA mapping and is never submitted.
Approved by: ngie (co-mentor)
MFC after: 1 week
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D59152
bus_dmamap_load_mem() reports most mapping failures, including EFBIG,
only through its callback and then returns zero. nvme_payload_map()
logged the error without telling the submission path, so the tracker
stayed on the outstanding list with no command submitted and no
timeout armed, stalling all later I/O on the queue behind it.
Approved by: ngie (co-mentor)
MFC after: 1 week
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D59151
Fix the constant case label to properly handle translation faults
caused by DTrace probes. Alignment errors are not expected to be
generated, so stop handling them.
While at it, correct an amd64-specific comment and add a comment
regarding the missing faulting address which could be addressed by a
later improvement.
PR: 298064
MFC after: 1 month
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59281
Use an unprivileged load to access user memory from dtrace_copy, which
is running in SVC mode.
Abort the loop if the load is trapped, as it is useless, hence
wasteful, to keep faulting on successive addresses. I believe that
this de-pessimization should also be done on aarch64 and riscv.
PR: 298064
MFC after: 1 month
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59280
Move the dtrace_trap hook at the start of the abort handler to exit
early when a trap is handled by DTrace.
Fix the type argument to be the actual fault type instead of the value
of the FAR. The latter will need to be added to the trapframe, until
then DTrace will report unmapped addresses as the null address.
Correct the comment of the PUSHFRAMEINSVC assembler macro to reflect
that coming from SVC32 mode is expected for DTrace traps.
PR: 298064
MFC after: 1 month
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59279
The new watchdog code triggers spurious watchdog resets on
NICs doing KTLS offload. Fix this by using the actual segments
consumed by the NIC driver's isc_txd_encap.
The issue is that rs_pending is updated using an estimate of
the descriptors that will be used for the current packet,
based on what bus_dma produced. However, NICs which support
ktls offload may do extra DMAs (and consume extra
descriptors) to derive crypto state when re-transmitting
TLS segments. This is the reason for allowing drivers to control
ift_pad. When this happens, the estimated rs_pending may undercount.
This may also happen if NIC drivers consume extra descriptors for
other reasons. (eg, hw errata handling on e1000)
Reviewed by: kbowling
Differential Revision: https://reviews.freebsd.org/D59321
Sponsored-by: Netflix
Rename the members of struct ebuf to match their function, replace
bcopy() with memcpy(), add comments explaining what each function does.
Reviewed by: kevans, emaste
Differential Revision: https://reviews.freebsd.org/D59310
A HAST message can be empty, in which case ebuf_add_tail() does nothing
and ebuf_data() returns NULL because the size of the ebuf is zero, but
hast_proto_recv_hdr() asserts that the return value is not NULL,
resulting in an immediate crash if hastctl or hastd receive an empty
message. This is trivially reproducable by running `hastctl status` or
`hastctl role init` (as the rc script does prior to stopping hastd).
To avoid this, don't try to grow the ebuf or receive additional data
if the header size is zero.
PR: 298085
MFC after: 3 days
Reviewed by: kevans, gjb
Differential Revision: https://reviews.freebsd.org/D59306
Build a 4.5 GiB FAT32 image whose LOST.DIR cluster sits exactly 4 GiB above
the single cluster of a PAYLOAD.BIN, so that truncating the offset of the
former to 32 bits yields the offset of the latter, then inject a lost cluster
chain and let fsck_msdosfs(8) reconnect it.
The test asserts both halves of the bug fixed in the previous commit: that
PAYLOAD.BIN's cluster is unchanged, and that a second pass no longer reports
the chain as lost, which it only stops doing once the directory entry reaches
the real LOST.DIR.
newfs_msdos(8) -C only calls ftruncate(2) and nothing outside the reserved
area, the FATs and a handful of clusters is ever written, so the image stays
sparse and costs about 2 MiB on disk.
The geometry is read back out of the BPB rather than assumed, so
newfs_msdos(8) stays free to lay the file system out differently; the test
fails with a clear message if the volume ever becomes too small to hold a
cluster a full 4 GiB beyond the data area.
MFC after: 1 week
reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit
arithmetic and widened the result only on assignment:
lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
+ boot->FirstCluster * boot->bpbBytesPerSec;
cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo
2**32. Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases
the offset exactly 4 GiB below it, which on such a volume is ordinary
file data.
That offset is used for both the read and the write: reconnect() reads a
cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY
or SLOT_DELETED byte, which arbitrary data readily provides, stores the
new directory entry in that slot, and writes the cluster back to the
same wrong place. Thirty-two bytes of an unrelated file are silently
replaced by a directory entry, and since that entry never reaches the
real LOST.DIR the chain stays lost, so the next run damages another
slot.
Cast to off_t before multiplying. This was the only cluster-to-offset
conversion multiplying a cluster number by the cluster size; the others
in dir.c and fat.c compute a 32-bit sector number first and widen that,
which cannot overflow because the sector count is itself 32-bit.
The bug was observed in the field on a FAT32 stick where LOST.DIR had
been created after a multi-gigabyte file was copied onto it, corrupting
that file every time the volume was checked.
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2347
Exercise each of the 32-bit BIOS Parameter Block and FSInfo fields that
readboot() decodes, using values whose most significant byte has its high
bit set. Each case checks two things: that fsck_msdosfs(8) reports the
full unsigned 32-bit value back on stdout, and that nothing writes a
sanitizer runtime error to stderr.
The second check is what catches a byte-at-a-time decode. Shifting such
a byte left by 24 is undefined, but every compiler we use wraps it into
the same bit pattern, so the decoded value alone cannot tell a correct
decode from an overflowing one. In a WITH_UBSAN build bsd.sanitizer.mk
compiles with -fsanitize=undefined and -fsanitize-recover=undefined, so
the shift is reported on stderr and execution continues, which the test
can then assert on. Against the byte-at-a-time decode these cases fail
in a WITH_UBSAN build and pass without it.
Note that the stderr check also fails on unrelated undefined behavior
that these images reach anywhere in fsck_msdosfs(8), which is intended.
MFC after: 1 week
readboot() decoded the 32-bit little-endian BIOS Parameter Block and
FSInfo fields by shifting the individual bytes of a u_char array into
place. The u_char operands are promoted to signed int, so shifting a
most significant byte of 0x80 or greater left by 24 overflows int, which
is undefined behavior. Use le32dec() from <sys/endian.h> instead, which
is both well defined and easier to read.
No functional change intended.
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2350
derive_mac keeps a per-parent branch index in a global named from the
parent interface so the N nibble can increment when the same PHY is
presented more than once. That name must be a POSIX identifier; a
vlan-style parent (em0.20) is not.
Encode the ifname first (alnum unchanged, every other byte as _HH) so
the lookup stays a symbol-table hit and em0.20 does not collide with
em0_20. Same change in jib (9.2) and jng (9.4).
In jng, also address netgraph by node name. ngctl(8) treats `.' and
`:' as control characters, so ng_ether(4) names its node after the
sanitized ifname (vtnet0.20 becomes vtnet0_20). Sanitize the parent
ifname where it enters and use that for every ngctl call; ifconfig(8)
and derive_mac keep the real name. Previously jng failed outright on
such parents where jib did not.
PR: 291143
Reported by: Victor <[email protected]>
MFC after: 1 week
Reviewed by: jlduran
Differential Revision: https://reviews.freebsd.org/D59326
Invoke releasefat(fat) in checkfilesys() prior to free(fat) on exit paths
so that fatbuf, headbitmap.map, and fat32_cache entries are properly freed.
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2351
The TPM 2.0 character-device methods held the global device lock
while uiomove() accessed user memory. User page faults could therefore
delay suspend or detach even though the read response was already
buffered.
Add a per-open sleepable lock to serialize operations on each response
buffer. Stage commands under that lock before acquiring the device
lock, and copy them into the response buffer only after the lifecycle
checks succeed. This preserves an unread response when suspend or
detach rejects a write. Release the device lock before copying buffered
responses out. Also advance the response offset by the bytes actually
copied when uiomove() returns after a partial transfer.
Validated on an Intel TPM 2.0 TIS device. PCR reads and GetRandom
passed under 16-process mixed command load. A response was consumed
correctly in 5-byte, 7-byte, and remainder reads. Module unload/reload
recreated the device and entropy source without lock diagnostics.
Source inspection confirmed rejected writes preserve unread responses.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59245
OR4() reads only the low byte before writing the complete 32-bit
register. Preserve all register bits by using a matching 32-bit read.
Make BIT() produce an unsigned value so masks containing bit 31 do not
rely on a signed left shift into the sign bit. OpenBSD carries the
same change.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59244
Once a transport acquires locality, several TIS and CRB error paths
return without relinquishing it. They can also leave a partial FIFO
transaction or an active CRB command for the next operation to inherit.
Route post-locality exits through common cleanup. Reset the TIS command
state on every attempt. For CRB, cancel an active failed command when
necessary, request the idle state, and relinquish locality even when the
state transition itself fails.
Successful command handling is unchanged apart from sharing the same
cleanup path.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59243
The TIS interrupt handler can acknowledge and signal an event after
the waiter checks the device status but before it enters tsleep().
Since the handler is MPSAFE, the command lock does not close this
window. A lost wakeup can delay a completed command for its full
timeout, up to 40 seconds for long TPM 2.0 operations.
Publish the expected event under an interrupt mutex and use a generation
counter to record matching interrupts. Recheck the device predicate
without the mutex because register access may sleep on a SPI transport,
then compare the generation before atomically waiting on a condition
variable. This closes the check-to-sleep race without placing sleeping
bus operations under a mutex.
Use an absolute deadline while retrying the predicate after wakeups.
Apply the same scheme to locality acquisition, which had an equivalent
race. Leave the expected event published while polling so the
attach-time test can still prove that an advertised interrupt arrived.
Regression-tested the polling fallback on two TPM 2.0 FIFO systems with
200 concurrent PCR reads per system and repeated device suspend/resume.
Neither ACPI device exposes an IRQ, so the interrupt-mode path remains
hardware unvalidated.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59241
Mark the device as dying before teardown and destroy the character
device before freeing its private state or lock. This prevents cdev
methods from entering with a freed internal buffer or a destroyed sx.
Check the teardown state in command paths, honor failures from the cdev
private data interface, and publish teardown before waiting for the
lifecycle lock. Keep that lock across TPM retry delays so commands
cannot interpose and private state remains pinned, but abort before the
next retry once teardown begins.
Block new cdev operations after a successful Shutdown(STATE). Keep the
suspend gate and the TPM command under the same lock so a userspace
command cannot invalidate the saved state before S3 entry. Clear the
gate only after Startup(STATE) succeeds.
Keep entropy harvesting scheduled after a transient command or suspend
failure, but stop it while suspended or once teardown begins. Queue the
next timeout while holding the lifecycle lock so release cannot miss a
concurrent requeue.
Validated on two TPM 2.0 FIFO systems. Each completed five device
suspend/resume cycles, rejected both new and already-open cdev
operations with EBUSY while suspended, completed 200 concurrent PCR
reads, and detached cleanly while four PCR readers were active. A
ThinkPad P51 also completed a full S3 cycle with PCR 0 unchanged and
50 successful reads after resume.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59240
TIS interrupt routing and enable registers may lose their state across
S3, while the driver retains its software indication that interrupts
work. A subsequent locality or command wait can then sleep for an
interrupt that cannot arrive.
Remember whether interrupts worked before suspend and restore the
vector, pending status, and enable mask before TPM2_Startup. Put the
transport in polling mode first; the interrupt handler promotes it back
to interrupt waits only after observing an interrupt from the restored
configuration. If register restoration fails, Startup and subsequent
commands continue using polling.
Preserve the initial interrupt-enable mask, including the firmware's
trigger and polarity selection proven by the attach time interrupt test,
and restore that exact mask rather than accepting post-S3 defaults.
Program the same safe baseline for polling devices during attach and
resume. Acquire locality, disable global interrupt delivery, and
acknowledge pending status so firmware cannot leave interrupts armed
without a handler.
Use the same register programming helper during attach and resume, and
stop trying to configure interrupts after a locality acquisition
failure.
Three consecutive device suspend and resume cycles completed on a Lenovo
TPM2 FIFO device without an IRQ resource. GetRandom succeeded after
each resume, and module detach completed without errors.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59197
The TIS attach path tested its interrupt by transmitting GetRandom
before tpm20_init() allocated the internal command buffer. A TPM2 FIFO
device with a usable IRQ could therefore dereference a null
internal_priv.
Initialize the common TPM2 state before running the interrupt test.
Make common cleanup safe for partially initialized devices and leave
cleanup to the attachment after tpm20_init() fails, avoiding duplicate
release of the lock, command buffer, and random-source state.
Clear the IRQ resource pointer after releasing it when interrupt handler
setup fails so the later polling-mode detach does not release it twice.
Free the internal command allocation through its object pointer rather
than relying on its embedded buffer being the first structure member.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59196
The internal TPM2_Shutdown and TPM2_Startup paths ignored both transport
failures and the TPM response. Suspend could therefore enter S3 without
saved TPM state, while resume could restart entropy harvesting after a
failed state restoration.
Build both commands through one helper, validate their response framing
and TPM return codes, and propagate failures. Retry the standard RETRY
and TESTING responses with bounded exponential backoff. Accept
TPM_RC_INITIALIZE from Startup because firmware may already have started
the TPM during resume.
Do not enter S3 after an unsuccessful state save, and do not restart the
entropy task when TPM state restoration failed. If Shutdown fails after
the entropy task was drained, requeue it before returning so an aborted
suspend does not permanently stop harvesting.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59195
Register the iflib device suspend and resume methods. Remove the
direct initialization from the driver resume callback because
iflib_device_resume() performs the datapath restart after the callback
returns.
MFC after: 2 weeks
Sponsored by: BBOX.io
Register the standard iflib device suspend and resume methods so the
framework reinitializes the VF datapath after a system power
transition.
MFC after: 2 weeks
Sponsored by: BBOX.io
Konstantin Belousov