* On SIGINFO, print the current path to stderr rather than stdout.
* Do so immediately, instead of the next time we finish a directory.
* Document this behavior in the manual page.
PR: 296861
MFC after: 1 week
Fixes: d1588599c0 ("Report the next directory being scanned ...")
Reviewed by: wollman
Differential Revision: https://reviews.freebsd.org/D58702
Killing a knote releases its file reference, and releasing the last one
runs the close path inline.
panic: _mtx_lock_sleep: recursed on non-recursive mutex ttymtx
Revoking a controlling tty during exit reaches this whenever a knote is
still registered on it.
Released the knlist lock around the drop and restart the walk.
The knote stays valid while the lock is released.
MFC: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D58681
No functional change, as current callers either don't check the return
value or check it against OCS_HW_RTN_SUCCESS only.
Found with: clang -Werror=assign-enum
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146.
MFC after: 1 second
Stop VF transmit and receive in hardware, clear PF-side mailbox CTS,
and notify active VFs before resetting a PF. A PF reset invalidates VF
queue state, so the no-CTS control message makes cooperative VFs
discard stale state and renegotiate after the PF returns.
The hardware queue gates synchronously prevent further VF DMA. Do not
hold the exclusive iflib context lock for a fixed VF-watchdog interval
after the reset. Report the PF link transition directly instead of
dispatching mailbox work from the stop path, which could otherwise
re-enable VF I/O mid-reset.
The CTS, PF-control, and VF queue controls follow the reset mechanisms
used by DPDK.
MFC after: 2 weeks
The shared maximum frame size is raised by VF LPE requests, so it
cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo
restriction. Consult the PF ifnet MTU instead.
Also correct the API 1.1 and later comparison so a jumbo VF is enabled
when, and only when, the PF itself uses a jumbo MTU. This matches the
policy implemented by DPDK.
MFC after: 2 weeks
ixgbe_stop_mac_link_on_d3_82599() implements the workaround for
82599 erratum 33. It forces incompatible auto-negotiation settings
before the device enters D3, and reset clears them when returning to
D0.
ixgbe_if_stop() is also used for ordinary interface reconfiguration
and recovery. Those paths do not enter D3 and should not program
this power-management workaround. They continue to stop the adapter
and disable the transmit laser.
Move the call to ixgbe_setup_low_power_mode(), after
ixgbe_if_stop(). This preserves the required ordering for detach,
shutdown, and suspend while avoiding the D3 settings during ordinary
restarts.
MFC after: 2 weeks
When link polling loses mailbox clear-to-send or times out, request an
iflib reset instead of continuing with stale VF state.
The driver callback runs after iflib samples reset requests, so requeue
the admin task to make iflib consume the request on its next pass
rather than waiting for an unrelated timer or interrupt.
MFC after: 2 weeks
ixgbe_if_stop() disables the transmit laser on every 82599 SFP fiber
port, but the iflib initialization path did not re-enable it. Re-enable
the laser before deferred SFP module setup so interface
reinitialization cannot leave either single-speed or multispeed optics
dark.
The hardware wrapper is a no-op when laser control is unavailable. The
placement follows Intel ix-3.4.39; this version deliberately applies to
every SFP port affected by the stop path.
MFC after: 1 week
A guest can reinitialize after a VF function-level reset and
repeatedly strand an 82599 or X540 PF with invalid descriptor DMA
targets. Count only distinct Received Master Abort events accepted by
the qualified transmit-stall detector and quarantine the VF after five
events.
Preserve quarantine across PF reinitialization, reject reset mailbox
requests, and keep transmit, receive, and clear-to-send disabled.
Recreating SR-IOV clears quarantine. Expose the affected pools through
a read-only bitmap.
After a successful quarantine FLR, leave the function in post-FLR
configuration, explicitly keep decode and bus mastering disabled,
verify the Command register, and refresh its PCI-layer cache so a later
restore cannot re-enable the function.
This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure
policy to X540 as defense in depth; the CVE does not list X540. Intel
documents the 82599 issue in:
http://iommu.com/datasheets/ethernet/controllers-nics/intel/ixgbe/Intel_82599_Application_Note_655276.pdf
MFC after: 2 weeks
Security: CVE-2021-33061
82599 and X540 lack the X550 malicious-driver detector. Detect a VF
whose PCI status reports a received master abort while its transmit
ring has outstanding descriptors and makes no progress across
consecutive samples.
Consume the accepted PCI status latch, gate that VF I/O, and recover
one pending VF per task pass with round-robin selection. This prevents
an unreadable function from starving detection or recovery of other
VFs.
Save the complete writable VF PCI configuration before FLR, restore it
afterward, and verify the hardware-backed Command state. Preserve the
first good snapshot and pending state across reset events until restore
and verification succeed.
Introduce a common I/O-disabled policy bitmask so later quarantine
policy can extend traffic gating without duplicating fault-state
checks.
MFC after: 2 weeks
A VF's pci_devinfo references its PF's pcicfg_iov for resource
bookkeeping, but only the PF implements the SR-IOV capability.
pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as
an owned capability and accessed the PF capability offset in VF
configuration space. Saving a VF could therefore replace the shared
PF settings with unrelated VF register values.
Skip SR-IOV capability save and restore for PCICFG_VF children. The
generic PCI and PCIe state of the VF remains preserved. This is also
required by drivers that save VF state around a PF-driven
function-level reset.
MFC after: 2 weeks
Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.
During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).
Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.
Signed-off-by: Sujithra Periasamy <[email protected]>
Reviewed by: markj
MFC after: 1 week
Sponsored by: Google
Differential Revision: https://reviews.freebsd.org/D58696
PeriphID and CellID values are determined by macros which take an
index. They currently receive a bus offset which has a stride of 4 bytes.
This causes the ID1-3 registers to report incorrect values.
Scale the offset before passing it to the macro to fix this.
Tested with kvm-unit-tests/arm/pl031.
Signed-off-by: Kajetan Puchalski <[email protected]>
Reviewed by: jrtc27
Fixes: 014d7082a2 ("bhyve: Implement a PL031 RTC on arm64")
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2358
Closes: https://github.com/freebsd/freebsd-src/pull/2358
PFQDE is indexed by absolute receive queue, but the driver programs one
index per VF. Only the first quarter or half of the VF queues therefore
have queue-drop isolation, depending on the virtualization mode. The
flow-control path can also clear those bits even though SR-IOV requires
them independently of the PF pause policy.
Program every queue in a VF pool before enabling receive for that VF.
For an X550-family VF with an administrative port VLAN, also hide the
VLAN tag as the hardware requires. Keep PF flow-control changes
confined to the PF SRRCTL registers, and clear the VF queue settings
when SR-IOV is torn down and the queues can be reassigned to the PF.
MFC after: 2 weeks
The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.
Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.
Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
mailbox interrupt edge, while suppressing already-fenced pools. Latch a
PF reset request until the next hardware initialization.
The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue
bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS,
which has reserved-zero bits, also reads as all ones and confirms dead
MMIO.
Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates,
which hardware otherwise reports as queue-context changes. Serialize
that window with the iflib context lock and resample pending work after
MDD is restored.
Apply the per-pool recovery model used by igb(4) in a2ed165f00 to the
existing DPDK-derived X550 hooks. The same register interface is
documented for X552 and X553, so cover the entire X550 family. Document
that VF traffic remains disabled until the reset handshake completes.
MFC after: 2 weeks
Relnotes: yes
The 82599, X540, and X550 documentation identifies VF registers which
retain state across VFLR and must be reconfigured before a VF is reused.
The VF reset path already initializes its queue-owned registers, but the
PF only cleared VF mailbox memory and transmit head write-back addresses
after a cooperative mailbox reset. A bare hardware VFLR therefore left
both behind on affected devices.
Move TDWBA cleanup into the common reset path. Clear CTS when VFLR
invalidates the mailbox session, and accept only VF_RESET during the
reset pass before restoring VF traffic.
Clear VFMBMEM through the PFU/VFU semaphore. Recheck VFREQ while
holding PFU so a reset event cannot erase a request posted between the
initial mailbox check and the clear. Dispatch an already-read message
even if the residual clear fails, but keep cleanup pending until a
synchronized clear succeeds. Retry cleanup in the same admin pass
after a failed message read or clear.
The 82599 also retains VFMAILBOX.VFU across VFLR. Leave a VF-owned
mailbox intact initially so a live post-reset writer can finish. Retry
cleanup from the admin timer and, after a two-second grace period, use
PFMAILBOX.RVFU only when VFU remains set and no request has been posted.
Clear the mailbox under PFU afterward. This recovers an abandoned
pre-reset owner without sleeping under the iflib context lock or
immediately stealing from a new reset request.
Suppress mailbox dispatch once iflib has cleared IFF_DRV_RUNNING so a
pending reset request cannot re-enable VF traffic inside the PF stop
path. Periodically sample aggregate VFREQ, VFACK, and VFLR registers,
masked to active VFs, so work suppressed across a stop/restart and a
bare 82599 VFLR without EICR_MAILBOX are both discovered without another
interrupt edge.
MFC after: 2 weeks
For some complex nullfs mount configurations, it is possible to get the
covered vnode lock for the mount shared with some inside-mount vnode
lock. Then at unmount time, vflush() would recurse on the covered vnode
lock when reclaiming the vnode.
Work around it, by temprorarily allowing recursion on the covered vnode
lock. Disable recursion after the unmount if it was not enabled before.
PR: 297174
Reviewed by: jah
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58567
Also add vnode locking wrappers for lockcanrecurse(9) and
lockdisablerecurse(9).
Reviewed by: jah
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58567
A deterministic IOV configuration error currently reaches the driver
only after iflib has stopped the PF. The required cleanup restart then
causes an avoidable carrier flap.
Follow the igb pattern and validate the request in the PCI IOV method
before entering the restart transaction. Reject queue layouts wider
than the selected virtualization pool before they can alias unrelated
82599 registers.
MFC after: 2 weeks
The IOV callback changes the PF pool, virtualization mode, and hardware
queue indices while iflib still considers the old queue layout live.
Teardown likewise leaves the software pool and mode at their SR-IOV
values.
Use iflib stop/mutate/restart transactions for both transitions.
Disable VF DMA and PCI VF Enable before queue reuse, let outstanding
transactions drain, and restore the non-IOV pool and queue indices on
teardown.
Remove the redundant driver-local pci_iov_detach() wrapper; iflib
already performs that check centrally before the driver detach
callback.
It may be possible to avoid some restart in the future on this hardware
pausing DMA and remapping rings but not pursued yet.
MFC after: 2 weeks
Drivers which remap PF queues need a stop/mutate/restart transaction
only when the interface has live queues. Permit their IOV
initialization callback while the interface is administratively down
and leave it down afterward.
This restores the standard boot-time iovctl.conf workflow for igb and
lets other opt-in drivers configure VFs before netif brings the PF up.
MFC after: 1 week
Intel 82599 supports FLR on VFs but reports FLR support only in the PF
Device Capabilities register. The VF register therefore leaves the FLR
Capable bit clear, and pcie_flr() rejects the reset.
Intel documents the zeroed VF PCIe capability structure as erratum 35
in the 82599 Specification Update (B0=Yes; NoFix).
Add a positive FLR quirk for the 82599 VF. Keep the capability check
for every other function, so an unknown nonconforming VF cannot make
pcie_flr() report success when its reset request was ignored.
SR-IOV requires VFs to support FLR, but a clear capability bit cannot
distinguish the 82599's misadvertisement from a VF that fails to
implement it.
MFC after: 1 week
Keep warn-only behavior as the default. Add an opt-in policy that
clears endpoint decoding and bus mastering when a newly discovered
function cannot match its active path, while never disabling bridge
functions and their subtrees.
MFC after: 2 weeks
Add a boot-time ceiling for MPS reconciliation. Apply it only while an
entire cold-enumerated link can be configured consistently, and leave
an established active path unchanged.
MFC after: 2 weeks
Reconcile each newly enumerated link as a unit before child drivers
attach. Firmware may leave Bus Master Enable set after handoff, so use
the bus attachment state rather than that bit to identify the cold
phase.
Preserve an established hierarchy during rescan and hot-add. Refuse a
reduction below a switch because recursive enumeration may already have
made a sibling subtree live; lowering only the local port or Root Port
would produce an inconsistent path. Report capability and active-use
conflicts distinctly.
Handle OFW PCI buses that clone the generic enumeration path.
MFC after: 2 weeks
The PCI bus changes live capability registers after the initial
configuration snapshot has been saved. A later driver reprobe restores
that snapshot and can silently undo the adjustment.
Update the cached Device Control and Root Control bits together with
pcie_adjust_config() writes. Route the persistent Maximum Read Request
setter and the bus-owned AER control changes through that helper as
well, so they share the same restore semantics as MPS reconciliation.
Document the persistent-write contract. Merge only explicitly adjusted
bits into the saved image so unrelated or transient bits observed during
the hardware read-modify-write cannot become persistent.
MFC after: 2 weeks
The VF Device Control MPS and MRRS fields are reserved and preserved.
VF transactions use the PF MPS, so a hardwired VF value must not be
used to retune the shared PCIe hierarchy.
Document the previously undocumented tuning knob and clarify why a VF
may continue to display its reserved hardwired value.
This fixes an instant crash/reboot on my Zen3 system with 82599 VFs.
MFC after: 1 week
VLAN registration callbacks only update the software shadow, leaving
the PF unaware until a later full initialization. Initialization then
retries each failed request in a tight loop, while skipping replay
entirely when local hardware filtering is disabled.
Send additions and removals as soon as the desired state changes,
independent of the VF local-filter capability. Replay the desired
memberships after reset and retry a bounded batch per timer tick. Stop
after the first failure so a silent PF can consume only one mailbox
timeout per pass, while a responsive PF can drain several requests.
Treat the retry window as a no-progress deadline: advance it when
pending work succeeds so a large backlog can drain, but leave entries
dormant after a sustained failure.
A successful mailbox request wakes a dormant backlog. Dispatch
timer-driven retries only while iflib marks the VF running, so a stale
timer tick cannot restore PF VLAN state after the stop path resets the
VF.
Because the callbacks now update the PF or retain failed work for
retry, do not restart the VF for VLAN configuration changes. This
avoids resetting and flapping the interface for every VLAN addition or
removal.
Also keep receive VLAN stripping synchronized in both the enabled and
disabled cases.
Adapt the bounded VLAN reconciliation scheme from igb VF commit
fdce3830d9 to the ixgbe VF mailbox.
MFC after: 1 week
In preparation of increasing the KVA on powerpc64 to 2TB to mirror
amd64's, rework the 64-bit Book-E pmap to not allocate all page table
pages at boot time, since that would be a waste of a lot of memory.
Instead, allocate all page table pages for the higher levels, leaving
the leaves (page directories) for dynamic allocation. This cuts the
boot-time page table size down from ~64MB to ~8MB with the current 32GB
KVA size, and bumping to 2TB KVA the boot-time page table is still ~8MB
instead of ballooning to ~4GB of mostly wasted space.
We can probaby consider these kernel bugs, in which case asserting is
not the most helpful thing we can do. Let's emit the necessary details
to stderr and exit non-zero to aid debugging these without completely
blocking the ability to export all of the well-formed metrics.
Reviewed by: rew
Differential Revision: https://reviews.freebsd.org/D57983
The PF advertises the legacy SET_MACVLAN mailbox request but always
rejects it. The request installs secondary unicast addresses.
Allocate an owned RAR pool for VF secondary addresses, reserve low
entries for PF filters, and place VF-primary addresses at the top of
the usable RAR range. Reject address collisions and cap each VF at
three secondary filters so one guest cannot exhaust the shared table.
Clear secondary filters on VF or PF reset and on SR-IOV teardown. This
hardware can anti-spoof only the VF primary source address. Reject
secondary filters while MAC anti-spoofing is configured, so installing
them requires an explicit administrative policy choice. Report optional
filter-table allocation failure without disabling SR-IOV.
Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in
a2ed165f00 to DPDK's ixgbe SET_MACVLAN mailbox semantics.
MFC after: 1 week
Relnotes: yes
The allow-promisc IOV property is advertised but ignored, and the PF
rejects the xcast request used by modern VFs. Negotiate mailbox APIs
1.2 and 1.3, implement pool-scoped xcast modes, and require
allow-promisc for requested all-multicast or unicast-promiscuous modes.
The VF mailbox can carry only 30 multicast hashes. When ixv has a
larger list, request the API 1.2 all-multicast xcast mode instead of
extending the legacy SET_MULTICAST message. The PF grants that fallback
only to VFs configured with allow-promisc; otherwise ixv reports that
only the first 30 addresses are active.
Reset xcast state with the VF and have ixv replay the mode implied by
its interface flags after multicast updates.
Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc
policy adapted from igb(4) in a2ed165f00.
MFC after: 1 week
Relnotes: yes
VID 0 carries only 802.1p priority and does not identify VLAN
membership. Keep VFTA bit zero in the persistent PF shadow table so
reset and SR-IOV replay admit priority-tagged frames while VLAN
filtering is enabled.
In virtualization mode, also reserve VLVF slot zero and restore PF and
eligible VF pool memberships. A VFTA hit alone admits the tag globally
but does not deliver it to the correct pools.
This matches the priority-tag treatment in em/igb.
MFC after: 1 week
The VF VLAN capability is checked but never granted, and no SR-IOV
configuration property exposes the existing default-VLAN support. PF
VLAN updates also replace VFTA registers from a PF-only shadow, erasing
live VF filters.
Expose access VLAN and trunk policy through the IOV schema. Track each
VF VLAN as desired state, restore the administrative VLAN after reset,
and use the native VLVF helper for incremental PF and VF ownership
changes.
Keep VLAN filtering enabled while SR-IOV is active. When PF hardware
filtering is disabled, admit every VLAN to the PF without bypassing
per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and
VF desired state after reset or a filtering-mode transition, and
restore PF-only state on teardown.
When the last VF leaves a VLAN still owned by the PF, free its VLVF
slot while retaining the shared VFTA bit. This prevents a trunk VF from
exhausting the 64-entry VLVF table by cycling VLAN memberships.
Adapt the VLAN ownership model introduced for igb(4) in a2ed165f00 to
ixgbe's native VLVF machinery.
Match Linux receive semantics by exposing a stripped VLAN tag only
when that VID was registered by the VF. A PF-assigned port VLAN is an
administrative tag and must be delivered to the VF as untagged traffic;
otherwise the stack dispatches it to a nonexistent VLAN interface and
access-VLAN receive traffic is blackholed.
MFC after: 1 week
Relnotes: yes
The SR-IOV schema advertises MAC anti-spoofing and enables it by
default, but the VF configuration was never consumed and the hardware
policy remained disabled.
Record the configured policy and apply MAC and VLAN anti-spoofing
throughout VF initialization and reset. On X550-family devices, also
protect the LLDP and flow-control Ethertypes and enable per-VF
spoof-event accounting. Remove the driver-owned state during SR-IOV
teardown.
Adapt the anti-spoof configuration lifecycle used by igb(4) in
a2ed165f00 to the ixgbe hardware controls.
MFC after: 1 week
Relnotes: yes
When fts_children() is called, sp->fts_child is set. On the
next fts_read() call, fts_safe_changedir() was incorrectly
passed p->fts_dirfd (pointing to the parent directory) instead
of -1. This caused fts to fchdir to the parent instead of the
child directory, silently skipping the contents of 3rd-level
subdirectories. This was observed as a failure in
nmtree_test:mtree_create which calls fts_children() internally.
Add regression test accpath_correct_after_descent that calls
fts_children() on each directory entry and verifies files at
depth 3 are still visited correctly. The test fails with the
unfixed libc and passes with the fix.
Reported by: Herbert J. Skuhra <[email protected]>
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Fixes: 4bd01d6ae0 ("fts: refactor to use fd-relative")
Pull Request: https://github.com/freebsd/freebsd-src/pull/2354
The MTA is shared by the PF and all VFs. The VF mailbox handler only
ORs new bits, so hashes survive list removal and VF reset. Conversely,
PF multicast updates replace the whole table with PF-only state and
discard live VF filters.
Rebuild the table from the PF list and every active VF whenever either
changes. Clear VF multicast state during reset and PF reinitialization,
and remove all VF hashes on SR-IOV teardown. Keep the software shadow
and multicast control state synchronized, and avoid writes to unchanged
MTA registers.
Adapt the aggregate desired-state rebuild introduced for igb(4) in
a2ed165f00 and its write-elision scheme from 350211ab17 to ixgbe's
shared MTA.
MFC after: 1 week
Dag-Erling Smørgrav