Since SCTP keeps fibnum in the SCTP protocol control block,
the code can't just defer the processing to the IPv4 or IPv6
layer. Therefore it needs to be implemented in the the SCTP
layer and it needs to call the socket layer function.
PR: 300091
Reviewed by: tuexen
Fixes: caccbaef8e ("socket: Move SO_SETFIB handling to protocol layers")
(cherry picked from commit 7b8151b0cd)
pf_hash_pool() hashes the first address of a pool as a whole struct
pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr
or pfr_ktable pointer.
An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on
every load, so with "set keepcounters" the rule never matches its
predecessor and loses its counters on every reload. The pointers also
differ between hosts: once a filter rule in the main ruleset has an
interface or table pool, pfsync peers disagree on the ruleset checksum
and bind every synced state to the default rule.
Hash the address with that union cleared. The rest of the address,
including the prefix length of an interface address, is hashed as
before, and the hash of a rule with a plain address pool does not
change.
Reviewed by: kp
Fixes: c6bcf6e6fd ("pf: include all elements when hashing rules")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60370
(cherry picked from commit e6dc001d7a)
pfr_insert_kentry() returned the error of pfr_route_kentry() and
leaked the entry it had created; pfr_insert_kentries() stopped at the
first entry it could not route and leaked it and the rest of the work
queue, which no caller frees. Destroy an entry that cannot be routed
and go on with the next.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60532
(cherry picked from commit 989d72fd3d)
DIOCSETREASS stored V_pf_status.reass twice with no lock, first the
flags it was given and then, if reassembly was not among them, zero.
pf_normalize_ip() and pf_normalize_ip6() read the flags with the rules
lock held for reading, so a packet could see the intermediate value.
Compute the flags first and store them once, with the rules lock held
for writing, as DIOCSETDEBUG and DIOCSETHOSTID do.
Reviewed by: kp
Fixes: 39282ef356 ("pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rules")
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60531
(cherry picked from commit b951994edd)
Readers check rms->writers without a fence, and rms_wunlock() drops
it with a plain store. rms_wlock() interrupts every CPU before the
first writer blocks readers, but nothing orders them when the last
writer leaves: on a weakly ordered CPU a reader can see the count
reach zero and still read what the writer replaced, such as callbacks
of a module unloaded under the lock.
Fence every CPU before the last writer drops the count: rename
rms_wlock_switch() to rms_block_readers() and add
rms_unblock_readers(), a wrapper for cpus_fence_seq_cst(). Readers
stay fence-free; the cost lands on the rare unlock.
Reviewed by: mjg
Discussed with: kib
Fixes: 1f162fef76 ("Add read-mostly sleepable locks")
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60658
(cherry picked from commit 2b911d947b)
pf_src_connlimit() queues an entry for pf_overload_task() when a
source exceeds max-src-conn or max-src-conn-rate and the rule has an
overload table. The entry holds a pointer to the rule, and the task
runs from taskqueue_swi with the vnet of the queue. Nothing drained
the task when the vnet went away: an entry queued just before could
be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
that was gone.
Drain the task at the start of pf_unload_vnet_purge(), before the
unlinked rules are freed. No packet can queue another by then, as the
hooks are already removed.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60529
(cherry picked from commit 92d66a6b47)
if_gre(4) registers net.link.gre with the static OID number IFT_TUNNEL.
That number is an interface type that several tunnel drivers share, not
one that belongs to gre(4). if_me(4) used it too, which made loading
both modules panic until 21f2245de2. Nothing addresses the node by
number, so use OID_AUTO as if_me(4) now does.
Suggested by: markj
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 80bc1d0e3e)
if_me(4) registers its net.link.me node with the static OID number
IFT_TUNNEL, the same number if_gre(4) has used for net.link.gre since
2003, so the two tunnel drivers collide under net.link. Until
d35c4cfad5 that only printed a warning and left two nodes with the
same number; since then sysctl_register_oid() panics, so loading if_me
after if_gre (or the other way round) takes the box down:
kldload if_gre
kldload if_me
panic: sysctl: OID number(131) is already in use for 'me'
Use OID_AUTO like the other tunnel drivers. Nothing addresses the node
by number.
Reviewed by: ae
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60536
(cherry picked from commit 21f2245de2)
For a lightly used ring iflib_txd_db_check() may defer zero descriptors,
so its "pending >= limit" test is true even when nothing has been queued
since the last doorbell. iflib_txq_drain() calls it before, inside and
after its loop, so a sender that drains its own packet wrote the tail
register three times per packet, twice with the value the hardware
already had.
The log of 81be655266 ("iflib: ensure that tx interrupts enabled and
cleanups") calls skipping the doorbell when db_pending is zero "an
obvious missing optimization"; the comparison against a limit of zero
defeated it. vmx(4) and mgb(4) have dropped such repeated requests in
the driver since 2019. Return early when nothing is pending.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60290
(cherry picked from commit 4a0ec46993)
dev.igc.N.fc read and wrote a function-static variable shared by every
igc device, so a read returned the last value written to any of them (3
until the first write), not the state of the device. The softc value
started as 0, which is also the value of "no flow control", while the
hardware was set up for full flow control. As a result:
- Writing 0 was taken for no change and did nothing, unless another
value had been written to that device before.
- igc_reset() took a softc value of 0 for "not set", so a device set to
0 went back to full flow control on the next init.
- With more than one receive queue the driver enabled per-queue drop
(SRRCTL.DROP_EN), which is meant for a MAC that does not send pause
frames, although the MAC was told to send them.
- Values out of range were accepted and ignored.
A write only forced the MAC's flow control bits. The pause bits
advertised to the link partner, the pause thresholds and DROP_EN stayed
as the last init had set them, and the next link event resolved flow
control from the stale advertisement again: a port set to 0 came back
honoring pause frames, for example.
Start the softc value as full, report it, use it as it is in
igc_reset(), reject invalid values, and apply a change by
reinitializing the interface, as the dmac and eee_control sysctls do.
Two things behave differently now. Changing the mode of a running
interface takes the link down to renegotiate. And with the default
mode and more than one receive queue DROP_EN is no longer set: a full
receive ring makes the MAC send pause frames, and holds up the other
queues, where it used to drop that queue's packets. Setting fc to 0 or
1 selects per-queue drop.
Tested on I226-V ports with four receive queues: for each mode, the
flow control bits in CTRL, the pause thresholds and DROP_EN were read
back, and the mode the link partner resolved, also after a down/up.
Reviewed by: gallatin
Fixes: 517904de5c ("igc(4): Introduce new driver for the Intel I225 Ethernet controller.")
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60363
(cherry picked from commit 68386f6b55)
The purge thread sets PFI_IFLAG_REFS on the interfaces that states
refer to without the rules lock, under which the other flags are
changed. The updates can interleave, so that a "set skip on" is lost,
or outlives its removal, until the next ruleset load.
Use atomic operations to modify the flags. In the purge thread, only
write if the flag is not already set.
Reviewed by: kp
Approved by: kp (mentor)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60107
(cherry picked from commit c1241c6e30)
epoch_trace_report() assigned the return value of RB_INSERT() back to
the new element. When two threads report the same stack concurrently,
the loser's RB_INSERT() returns the element already in the tree, and
that element was freed while still linked, leaking the new allocation.
The next lookup touches freed memory; KASAN catches it as a
use-after-free.
Keep the return value separate and free the new element instead. The
thread that won the race prints the report, so return without printing
it a second time.
Reviewed by: markj
Fixes: 173c062a56 ("Improve EPOCH_TRACE")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60162
(cherry picked from commit dd5dc8f6e5)
pfr_clr_astats() looks up each address it is given and inserts the entry
it finds at the head of a work queue. If the same address is given more
than once, the entry is inserted twice and the second insertion makes it
its own successor. pfr_clstats_kentries() then walks the queue forever,
with the rules lock held for writing, so packet processing and every
other pf operation in that vnet stop as well. To reproduce:
pfctl -e
pfctl -t foo -T add 192.0.2.1
pfctl -t foo -T zero 192.0.2.1 192.0.2.1
Do as pfr_del_addrs() does: clear pfrke_mark on the entries named, then
queue an entry only the first time it is seen. An address given more
than once is cleared, and counted, once. Validate all addresses before
any entry is touched.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60103
(cherry picked from commit ee05a360b0)
Currently our man(1) utility search manages only in $lang_country.$charset, $lang.$charset and,
as failover, in en.$charset which is historical behavior.
But nowadays most of ported software uses only $lang subdirectories for translated manpages
instead of use full locale notation, for example, share/ja/man1, share/de/man1, share/ru/man1.
In such cases, our man(1) utility cannot find any translated manpages and silently fallback to english version.
Add $man_lang in search path allows man(1) search and use translated manpages under historical and modern path traditions
MFC after: 1 day
MFC to: stable/15 stable/14
Reviewed by: ziaee, fernape
Approved by: fernape
Differential Revision: https://reviews.freebsd.org/D55805
(cherry picked from commit 5250c98908)
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
correction to both 32-bit and 64-bit switch paths.
The 2015 change moved the release after the stack switch because the old
implementation continued through pmap_activate() and optional state
restoration on the outgoing thread's stack after making that thread
runnable. The switch path has since changed: after the release it only
polls wired td_lock state using registers, then immediately loads the
incoming PCB_SP before updating per-CPU state or making any calls.
cpu_switch() also runs with external and decrementer interrupts disabled
by spinlock_enter(). Thus this does not restore the post-release call
window that the 2015 change corrected.
Reviewed by: jhb, jhibbits
Approved by: jhb (mentor)
Fixes: 53607fe3cc ("Fix an extremely subtle concurrency bug...")
Fixes: 7a49d964d3 ("Merge r278429 from ppc64:")
Fixes: 8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59742
(cherry picked from commit 0571d8a0cc)
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355)
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118)
vmm doesn't implement them, and after commit 2272fac218
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72)
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <[email protected]>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a68145)
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: pouria, tuexen, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60143
(cherry picked from commit 80af0a32e4)
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c)
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <[email protected]>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28cc)
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394ab)
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d)
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by: zlei, ae, glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59919
(cherry picked from commit 10729d0ce1)
aout_coredump() was removed in commit 1eecfae3e5.
No functional change intended.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4523cbbfef)
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8)
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d150619)
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59726
(cherry picked from commit cb035c19c3)
atomic_load_* is a read, not a write. Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0aa055edc1)
vfs_register hashes the filesystem name and uses it for sysctl oids.
A filesystem name which hashes to 0 crashes in sysctl_register_oid().
Map 0 to 1 to prevent the kernel crash.
This can be tested with "udf2" as the filesystem name.
MFC after: 1 month
MFC to: stable/15 stable/14
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59839
(cherry picked from commit 3897678132)
grab_mcontext() only put the second halves of vs0-31 into the context
while the thread owned the VSX unit, but sigreturn(2) gives ownership
up so that the next use reloads the registers lazily. A signal that
arrives right after a sigreturn, like one the handler's mask was
holding back, got a context without them and its own sigreturn then
zeroed them in the PCB.
The halves saved in the PCB are current whenever the FP state is, since
VSX instructions can't run without PCB_VSX and save_fpu() stores them
in that case, so export them together with the FP registers.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60754
(cherry picked from commit 64b2fea9a2)
(cherry picked from commit 0e9af9fb72)
We don't have anything to tunnel without INET or INET6, so just smack
it with the same config(5) hammer that ovpn uses and exclude it from
such builds.
Reported by: mjg
Reviewed by: emaste, markj
(cherry picked from commit 8430de47aa)
c4640126f1 ("loader.efi: Apply command-line DHCP overrides earlier")
was really good, but moving it just one statement earlier is even
better. polarian on Libera describes a GELI setup on a system that
doesn't advertise a serial console via ConOut. They don't have serial
input at the point that they would get prompted for the GELI passphrase,
but if we parse args just before devinit() then he can override the
console with `efibootmgr -e`. This gives UEFI one advantage over BIOS
loader, as /boot.config isn't available to provide that kind of override
if your impediment is GELI.
We also considered reading loader.env earlier, but we have a chicken/egg
problem in that we must have probed for the ESP to be able to open() it.
We would instead need a devinit_early() and devinit_late() scheme that
allows GELI probing to be deferred until the later pass, after reading
loader.env to pick up the console override. That's an idea I'd still
like to discuss because it's more robust than hoping that firmware won't
wipe out our efibootmgr(8) entries.
Tested by: polarian on Libera
Reviewed by: imp
(cherry picked from commit 78887369c4)
The bounds check rejected any access ending exactly at the end of the
register block, so a four byte write at offset 0xffc was refused,
returning EINVAL and killing the VM.
PR: 291063
Fixes: 75909086a4 ("bhyve: allow read/write to full CRB buffer")
Sponsored by: Defenso
Signed-off-by: Quentin Thébault <[email protected]>
Reviewed-by: aokblast, kevans, markj
(cherry picked from commit 4505445ccd)
If an explicit loader wasn't requested, then bhyveload(8) maintains a
/boot handle that it can use for swapping to a different flavor. This
means that we expose all of the host /boot to the sandbox for the
duration of script execution.
Add a callback to ack that we're OK with the interpreter so that
bhyveload(8) can release the bootfd. This is worth doing because it's
prior to guest script execution, so we're still running a reasonably
untainted process.
Reviewed by: imp, jhb
(cherry picked from commit 619d092177)
As noted in the comment, some headsets with a hardware sidetone are
incredibly sensitive and emit immediate feedback upon attach with the
current system-wide default of 75%. Drop it down just for snd_uaudio(4)
to avoid incredibly unpleasant surprises.
Reviewed by: christos
(cherry picked from commit c3c6a6c782)
The Logitech H390, for instance, has the following interface layout:
~~
7 INPUT 34 INPUT 10 INPUT
Mic (0x201) Mic (0x201) USB Stream (0x101)
| | |
v v |
19 FEATURE 35 FEATURE |
| | |
v v |
25 EXTENSION +------> 36 MIXER <---+
| |
v v
13 OUTPUT 22 FEATURE
USB Stream (0x101) |
v
16 OUTPUT
Speaker (0x301)
~~
The 7->13 path on the left is a typical microphone-in configuration,
while the right side is a little more complicated. The 34 -> 35 -> 36
leg is describing a hardware sidetone control, while the other is a
standard audio-out configuration.
During feature unit evaluation, we need to pick up the scenario of node
35 above, which is directly wiring the microphone to the speaker. Right
now we'll likely tie it to the pcm/vol levels and this unit will emit
a very prompt feedback screech, but it's really shaped more like a
MONITOR control.
This avoids mishandling feature unit 22 because that's evaluated in one
of the other cases: one of the inputs is the USB stream, so it's
wired up as a PCM.
One note on this headset: the presence of mixer 36 currently breaks the
`vol` control, leaving only `pcm` to control the volume. Given that it
has both Mic and USB input, I suspect we get a 1:1 cluster configuration
for the Mic input but something more complicated for the USB input that
we end up ignoring. Thus, "vol" might technically control the monitor
volume but isn't wired up to the USB input cluster. I have not had a
chance to confirm this, yet.
PR: 291424
Reviewed by: christos
(cherry picked from commit f01b594b7f)
Kernel mode program, trace, breakpoint and machine check exceptions go
through dbtrap, which saves the registers on trapstk and, if KDB doesn't
want the trap, restores them from there and continues with the normal
trap handler. There was just one trapstk for all CPUs, so when two of
them trapped at the same time they overwrote each other's frame and one
of them carried on with the other's registers. DTrace fbt probes are
these traps, so a probe on a function that runs on several CPUs at once
took the kernel down within seconds.
Keep the stack in the pcpu instead. The boot CPU gets a static one,
since it's set up before malloc works, the others allocate theirs in
cpu_pcpu_init() like the Book-E critical interrupt stack.
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60362
(cherry picked from commit eaaf838e33)
(cherry picked from commit 268e7c2ff7)
Without it, LLVM libunwind doesn't know where to stop when unwinding the
main thread, so it uses a stale LR as the return address and crashes.
Our libunwind doesn't do that since 5866c369e4 reverted it, but
programs that bundle their own copy, like ClickHouse, are hit by it.
amd64, arm64, i386 and riscv already have the same annotation.
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60740
(cherry picked from commit c4fde87a32)
(cherry picked from commit aaa1abfc0b)
This is the program that found the races fixed in 1f1043d550. One
thread keeps a pattern in f14-f31 across a signal, while helpers pinned
to the same CPU keep different patterns in the real registers and get
woken up from another CPU to preempt it at random points. If the kernel
ever hands it somebody else's registers, the pattern doesn't match.
The register loads, the thr_kill() and the handshake with the helper are
in assembly so that nothing touches the FP registers between sigreturn
and the check. It runs for ten seconds and is skipped with fewer than
two CPUs.
Requested by: adrian
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60411
(cherry picked from commit 35a226dded)
(cherry picked from commit 8d36589470)
The LAN8700 / LAN8710 PHYs were Standard Microsystems Corporation parts,
which early on used SMC as an abbreviation but they were using SMSC when
they were exclusively an IC maker (as opposed to full add-in NICs).
SMSC was acquired by Microchip in 2012. I kept the pre-acquisition
name, as NetBSD (from where we obtained miidevs) uses SMSC.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56819
(cherry picked from commit 89c883c09a)
(cherry picked from commit f2f67df8c9)
The <machine/ieeefp.h> headers wrap their deprecated FPU control
prototypes in __BEGIN_DECLS/__END_DECLS but rely on the includer to
have pulled in <sys/cdefs.h>. Including <floatingpoint.h> first on
arm, arm64, powerpc and riscv (or amd64 <machine/ieeefp.h> with
__IEEEFP_NOINLINES__) fails with "unknown type name '__BEGIN_DECLS'".
This breaks e.g. devel/py-pyinstaller.
Suggested by: jhb
Reviewed by: jhb
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59659
(cherry picked from commit 9d50245a0f)
(cherry picked from commit 252500da3a)
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
(cherry picked from commit 82af7f44eb)
Currently, userdisk_init() iterates through disks and
checks whether DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls
are available for the device. If either ioctl fails, userdisk_init()
returns ENXIO with ud_info only partially initialized.
devinit() records the failure, but loader_main() ignores
devinit()'s return value, so later code may access an
uninitialized entry.
In certain cases this code can still boot from a disk even if
userdisk_init() returns ENXIO, for example, when the first of
two disks is valid and the second errors out.
To address this issue while not breaking the current behavior, do
the following:
- Zero-initialize the userdisk_info array and use a zero media size
to mark disks that do not support the ioctls mentioned above or
report an empty medium.
- Update userdisk_print() not to print unusable disks.
- Update userdisk_open() to return EIO for unusable disks.
- Update extract_currdev() to pick the first usable disk
instead of the first disk. Introduce userboot_disk_firstunit()
for that.
Additionally, reset counters on ud_info allocation failure to prevent
accessing unallocated data.
Reviewed by: jhb (previous version), markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59262
(cherry picked from commit 4445d03958)
The device has multiple PIDs as it supports different USB profiles.
Approved by: adrian
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60482
(cherry picked from commit 95432767dd)
Ubuntu 24.04 is the most recent LTS release. Use it and the previous
22.04 LTS for cross build testing.
Reported by: emaste, jhb
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/1399
(cherry picked from commit 386e2dc442)
[compiler-rt] Add interceptors for free_[aligned_]sized for asan+hwasan (#189109)
This avoids a jemalloc assertion when running sanitized applications
against glib, which uses free_sized(3).
PR: 298943
MFC after: 1 week
(cherry picked from commit a3fbf20c05)
asan: refactor interceptor allocation/deallocation functions (#145087)
Do some refactoring to allocation/deallocation interceptors. Expose
explicit per-alloc_type functions and stop accepting explicit AllocType.
This ensures we do not accidentally mix.
NOTE: This change rejects attempts to call `operator new(<some_size>,
static_cast<std::align_val_t>(0))`.
For https://github.com/llvm/llvm-project/issues/144435
Signed-off-by: Justin King <[email protected]>
This a prerequisite for adding sanitizer interceptors for free_sized(3)
and free_aligned_sized(3).
PR: 298943
MFC after: 1 week
(cherry picked from commit 6b0f64133c)
After base ef758b59a4 we can enable usage
of .preinit_array in compiler-rt's sanitizers. The comment that stated
"On FreeBSD, .preinit_array functions are called with rtld_bind_lock
writer lock held. It will lead to dead lock ..." can also be removed.
PR: 298943
MFC after: 1 week
(cherry picked from commit 0008561567)
The virtio-gpu resource formats are defined by byte order in memory,
while vt(4) and the X server (through vt_fb and the fb mmap) write
native 32-bit 0x00RRGGBB pixels into the shadow framebuffer. On a
big-endian guest such as powerpc64 those pixels land in memory as
00 RR GG BB, which the host interprets under B8G8R8X8 with red and
blue swapped and the padding byte taken as blue: white renders yellow
and blue renders black.
Request X8R8G8B8 on big-endian guests instead, which is also what the
Linux driver does (DRM_FORMAT_HOST_XRGB8888). Reproduced with a colour
test pattern on a powerpc64 QEMU pseries guest using the identically
coded out-of-tree fork of this driver (graphics/virtio-gpu-qemu-kmod);
little-endian guests are unchanged.
Differential Revision: https://reviews.freebsd.org/D60085
Approved by: jhibbits
MFC after: 1 week
(cherry picked from commit 7cf02164a5)
(cherry picked from commit ceaf30c92e)
When ERELOOKLUP is returned by a file operation
(always vop_lookup?) the operation is retried without
doing nfsrv_statsend().
This patch fixes this problem,
The only effect of the bug was bogus "nfsstat -d"
output.
PR: 298534
(cherry picked from commit 9a237074d3)
The rfb code maintains an array of CRCs for 32x32 tiles in the
framebuffer. This array is sized statically based on the rfb code's
notion of the maximum framebuffer size, which changed in commit
fb51ddb20d without updating the rfb code.
Morever, writes to the framebuffer BAR can modify the recorded height
and width of the framebuffer. These values were not validated against
the maximum at all, unlike the parameters set via bhyve config.
Fix these problems:
- Define the maximum width and height in a shared header file so that
they do not get out of sync again.
- In pci_fbuf_render(), don't resize the console if the new dimensions
are too large.
- Add a mutex to synchronize framebuffer BAR I/O with the rfb thread.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101311
Fixes: fb51ddb20d ("bhyve: increase fbuf display resolution limit")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60680
The length of each block in the stream must be non-zero. This is
assumed in hda_transfer(), otherwise an out-of-bounds read or write is
possible.
Use atomic loads to access stream descriptor fields, since they are
guest-controlled. Make sure that the descriptor array is suitably
aligned so that we can drop the __packed annotation from the structure
definition; per section 3.3.42 of the HDA spec the BDL pointer is
supposed to be 128-byte aligned, in fact.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101310
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60678
rts->erst_p and rts->erstba_p are pointers to guest-controlled memory
which describe the event rings and pending event array, respectively.
The device model was not validating the size nor saving the value.
As a result, the bounds checks in pci_xhci_insert_event() were
susceptible to TOCTOU races.
Fix pci_xhci_rtsregs_write() to save the ring size in a softc field.
Validate that the size isn't larger than the maximum allowed by the XHCI
specification (64KB, or 4096 TRBs).
When processing TRBs, make sure we don't load fields more than once.
Make sure that pci_xhci_trb_next() doesn't return a pointer to host
memory. When handling ERDP writes, make sure that the guest-supplied
address is actually a pointer into the TRB array, and ignore the write
if not.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101309
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Differential Revision: https://reviews.freebsd.org/D60677
sndbuf_resize() and sndbuf_remalloc() drop the channel lock in order to
allocate the new buffer(s) with M_WAITOK. Before doing that they verify
that the buffer is not mapped, but this could change while the lock is
dropped, as there is no higher-level synchronization which prevents
buffer resize (e.g., via the SNDCTL_DSP_SETBLKSIZE ioctl) from happening
concurrently with mmap. Thus, these checks are insufficient.
Modify sndbuf_resize() and sndbuf_remalloc() to revalidate after
reacquiring the lock. Extend them to check for a couple of channel
flags, mirroring the check in chn_resizebuf(). Modify chn_resizebuf()
to revalidate state after reacquiring the channel lock.
We could also allocate new buffers with M_NOWAIT and so avoid dropping
the lock. Then, I think we could go even further and invoke
CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS with the channel lock
held. But really it would be better to ensure that dsp operations are
serialized; there is no reason for mmap and chn_resizebuf() to be able
to run in parallel, we should not be relying on the channel lock for
this. So, let's keep a more minimal approach here.
Add a simple regression test.
Approved by: so
Security: FreeBSD-SA-26:71.sound
Security: CVE-2026-101308
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60554
Most implementations of CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS
were not checking this. This is probably not a big problem: it's
unlikely for sndbuf_resize() to fail due to the refcount check in this
case since it's operating on the hardware buffer, which doesn't get
mmaped. But, I will add more reasons for it to fail in the next patch,
so let's be more careful.
This change modifies various CHANNEL_SETBLOCKSIZE implementations to
check for errors. In some cases I reordered things to avoid updating
driver state until after sndbuf_resize() succeeds.
Return 0 from CHANNEL_SETBLOCKSIZE to indicate an error, as it otherwise
returns the new block size. We could change the interface to return
both an error number and a block size, but that would break at least one
out-of-tree driver and I wish to avoid that here. Make sure that errors
from CHANNEL_SETFRAGMENTS are returned to userspace.
Approved by: so
Security: FreeBSD-SA-26:71.sound
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60553
We have identified some cases where silent slot loss can occur
when operations on NFS mounts are aborted. We experience this
when using NFSv4.2, but it likely also occurs with NFSv4.1.
A slot is acquired for compound operations by nfsv4_setsequence()
and freed by newnfs_request(). Any call path that abandons the
compound before reaching newnfs_request() loses the slot permanently.
We identified four call sites where this happens, one of
which where it actually does happen for us in a semi-reproducible
way, which allowed us to develop a candidate patch, attached.
The patch adds one function, nfsv4_freeunsentslot(), to
nfs_clcomsubs.c. It is called from each of the four call
sites: nfsrpc_writerpc(), nfsrpc_writeds(), and two in
nfsrpc_setextattr().
nfsv4_freeunsentslot() calls nfsv4_freeslot() with resetseq
set to true because the aborted RPC will never be sent and
therefore the slot sequence ID should not advance.
With this patch and other diagnostics, we have confirmed
that slot loss does not occur under the conditions that
otherwise cause it in our environment.
PR: 298416
(cherry picked from commit 77a7a48a1c)
Fixes and new features include:
hostapd:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
- fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* remove the driver interface for now obsolete Host AP driver
* remove the driver interface for now obsolete Atheros WEXT interface
* move supported, basic, and Beacon TX rate configuration to be at BSS
level instead of per-radio for all BSSs
* fix various issues in Multiple-BSSID functionality
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* support Automated Frequency Coordination (AFC) on the 6 GHz band
* improve GAS/ANQP processing to support larger ANQP responses
* a large number of other fixes, cleanup, and extensions
wpa_supplicant:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
MFC after: 2 months
Merge commit '513264698a892550ba20aeb9da7f360417fdc63b'
(cherry picked from commit 71e72c9e91)
I inadvertantly added gratuitous changes to upstream. Revert the
gratuitous parts of 676041c41b
Suggested by: cy
Fixes: 676041c41b
Sponsored by: Netflix
(cherry picked from commit cab9ccf3ff)
Historically, these have been differnet values, and only one was defined
or they were defined as different values. Now that they are about to be
the same value, add #ifdef to cope.
Sponsored by: Netflix
Reviewed by: olce, val_packett.cool, adrian
Differential Revision: https://reviews.freebsd.org/D45418
(cherry picked from commit 676041c41b)
The variable 'amd_npmcs' is not yet present in this branch.
This is a direct commit to stable/14.
Reported by: Jenkins
Sponsored by: The FreeBSD Foundation
trap() and set_mcontext() change the FP/VMX/VSX ownership state in
several steps with preemption enabled. A context switch in between
leaves the thread computing with another thread's register contents:
- enable_fpu()/enable_vec() set PCB_FPU/PCB_VEC before loading the
registers, so a switch mid-load saves a half-loaded unit over the PCB.
- set_mcontext() clears the frame's MSR bits and then the PCB flags;
a switch in between re-enables the unit, and the thread returns to
user space with it enabled but not owned, so it is neither saved nor
restored until the next signal.
Both paths run after every sigreturn(2), setcontext(2) and
swapcontext(3). A POWER9 test that keeps f14-f31 live across a signal,
with other threads using the FPU on the same CPU, saw 283 corrupted
round trips out of 882000; none after this change.
Hold a critical section around both, as amd64 and arm64 do.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60054
(cherry picked from commit 1f1043d550)
(cherry picked from commit 61afe54265)
On main, casting PHYS_TO_DMAP(pa) does not require casting to pt_entry_t
* because it returns void * after fe3e92e686 ("PHYS_TO_DMAP: Return a
void * instead of a vm_offset_t"). That was not MFCed to stable/14 and
stable/15, thus cast the return value of PHYS_TO_DMAP(pa) to
pt_entry_t * to fix build failure.
Approved by: jhb (mentor)
Fixes: 904efcc643 ("powerpc/radix: include page tables...")
Sponsored by: FreeBSD Foundation
PowerPC64 radix minidumps use a 64KB root directory followed by three
levels of 4KB page tables. Add an MMU backend which walks those tables,
handles large-page leaves, and decodes their always-big-endian entries
on both powerpc64 and powerpc64le.
Reject old radix minidumps whose pmap section is empty with a specific
diagnostic. Add a synthetic powerpc64le dump test which reads a page
through both its kernel and direct-map addresses.
PR: 298532
Reviewed by: jhb
Approved by: jhb (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59743
(cherry picked from commit 592ede65bd)
The radix pmap did not implement the minidump pmap callbacks, so radix
minidumps were emitted with an empty pmap section. Such dumps do not
contain enough information for libkvm to translate kernel virtual
addresses.
Snapshot the 64KB radix root table in the pmap section, add lower-level
page-table pages to the sparse dump, and include pages backing non-DMAP
kernel mappings. Keep the bulk direct map out of the dump while
retaining the relocated kernel image.
PR: 298532
Reviewed by: jhb
Approved by: jhb (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59743
(cherry picked from commit a38a698704)
libkvm locates the sparse page array after the page-rounded PTE table
size, but the ARM minidump writer emitted only the unrounded size. When
the table size was not page-aligned, libkvm therefore read every dumped
physical page at the wrong offset.
The mismatch was introduced when libkvm began rounding ptesize. It has
affected ARM minidumps since ffdeef3234 ("libkvm: Improve physical
address lookup scaling."). It is exposed when the dumped KVA span is not
a multiple of 4 MiB.
Zero-pad the final PTE page and include the padding in the dump size.
Reviewed by: jhb
Approved by: jhb (mentor)
Fixes: ffdeef3234 ("libkvm: Improve physical address lookup scaling.")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59716
(cherry picked from commit 4cb357c61c)
Cirrus CI shutted down its service on June 1, 2026 and its CI dashboard
website (https://cirrus-ci.com) is now inaccessible. Since these files
are no longer used, remove them from the repository.
Reviewed by: brooks, emaste, lwhsu
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59858
(cherry picked from commit 8d31b7856f)
The radix kremove implementation cleared a kernel PTE without
invalidating its TLB entry. Reusing crashdumpmap could therefore keep
accessing an old physical page, causing minidumps to contain repeated
stale page contents.
Invalidate the removed kernel mapping and synchronize newly installed
kernel PTEs before they are accessed.
Reviewed by: jhibbits
Approved by: olce (mentor)
Fixes: 65bbba25d2 ("powerpc64: Implement Radix MMU for POWER9 CPUs")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59728
(cherry picked from commit 8970a9f2ef)
The regular powerpc64 core probes only checked the kernel ELF and thus
also matched minidumps. In particular, the powerpc64le probe could
claim a minidump before the minidump backend and then reject it as an
invalid ELF core.
Exclude minidumps from both regular powerpc64 probes and add a
regression test that verifies a powerpc64le minidump reaches the
minidump parser.
Reviewed by: jhibbits
Approved by: olce (mentor)
Fixes: f4eb39ba6b ("[PowerPC64LE] libkvm powerpc64le support.")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59719
(cherry picked from commit 51b1272fca)
Correct the byte order at the driver interfaces that do not operate in
host order. Encode little-endian Admin Queue VSI and MAC/VLAN fields,
and decode firmware-provided queue handles, statistics indices, and
event parameters before using them.
Decode transmit descriptor writeback before examining it, and construct
VLAN descriptor fields in host order for the final descriptor
conversion. Store paged HMC descriptors in little-endian form and retain
the selected field bits when reading HMC contexts.
Keep MMIO values in host order for bus-space accessors and remove the
obsolete le16_to_cpu no-op macro. In particular, retain the atomic
bus_space_read_8() used for 64-bit registers.
On big-endian systems, the unconverted perfect-match filter flag is
presented to firmware as 0x0100 instead of 0x0001. Firmware rejects that
command with EINVAL, leaving receive traffic functional only in
promiscuous mode.
Reviewed by: kbowling
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation, Reliable Computer Systems Lab
Pull Request: https://github.com/freebsd/freebsd-src/pull/2408
(cherry picked from commit bf8c4eaee6)
After more than, I don't know, maybe 10k operations: mount, copy,
remove, verify and unmount cycles, one cp command hung in
close() / ncl_flush and never recovered. The machine and the mount
continued to work normally through a new connection, but the writes
using the old connection stayed frozen.
I did not understand exactly what happened. I traced what appears to
be the issue in the code. My current understanding is that
clnt_vc_soupcall() saw the EOF and woke the caller waiting for RPC
replies, but one caller remained blocked in sosend().
That thread continued holding a reference to the old client, preventing
it from being completely cleaned up.
The attached patch calls socantsendmore() when EOF is received, which
should wake the blocked sender and let the normal reconnect code replace
the connection.
(cherry picked from commit 49bec8c3dc)
When clnt_vc_destroy() is called, it might not be the
current connection. Without this patch, if it is not
the current connection, xp_p2 is set NULL and xprt is released
when it should not be released.
This patch adds a check for "current connection" to fix
the problem. Found during testing to the client RDMA code,
but could happen for TCP as well.
(cherry picked from commit 81a6514689)
eXpat 2.9.0 deprecates XML_GetCurrentLineNumber() in favour of
XML_GetCurrentLineNumber64(). The new function behaves the same
as the old one but is not prone to 32 bit integer wrap-around.
(cherry picked from commit 657c089950)
ARI changes RID interpretation only for the device on a downstream
port's secondary bus. pcib_xlate_ari() applied that translation to
every config access through an ARI-enabled bridge, including cycles
forwarded to a subordinate bus.
A non-zero slot on a subordinate bus then panics an INVARIANTS kernel
and is misrouted otherwise. Translate only when the access targets
this bridge's secondary bus.
Reviewed by: kib, jhb
Fixes: 55d3ea1731 ("Add support for PCIe ARI")
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D60033
(cherry picked from commit 10409ee40b)
This driver was removed several years ago.
Fixes: c1c9764296 ("Remove the si(4) driver and sicontrol(8) for Specialix serial cards.")
(cherry picked from commit 600c16c71b)
rtld has always been built PIC since commit
7ca8e6a670. The stale #ifdef might
confuse a reader by thinking rtld can be built as non-PIC.
Reviewed by: kib
Sponsored by: AFRL, DARPA
Differential Revision: https://reviews.freebsd.org/D58623
(cherry picked from commit ec8985a100)
All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.
Reported by: Jane Smith <[email protected]> (via D57785)
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58542
(cherry picked from commit 486dfbb67e)
All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front. The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.
Reviewed by: jrtc27, kib
Differential Revision: https://reviews.freebsd.org/D58541
(cherry picked from commit 535eb24d84)
Previously all the 'goto out' statements after the image was loaded into
memory returned success rather than an error. This is despite comments
indicating some of these conditions were in fact errors, and some of
these error conditions (such as missing PT_DYNAMIC) are treated as errors
in the kernel linker.
In addition, when failing to looking up the symbols for the linker
set, those cases returned failure leaking memory (though it's clear
from the original code from commit ca49b3342d that only the second
failure was intended to be an actual error).
To avoid more confusion, move the assignment of `ret` to just before
the `out` label so that `goto out` always returns an error. This is a
more consistent pattern with other code in the tree that tends to use
labels for the error case.
Restructure some other code to avoid a few bogus errors.
Specifically, a symbol table is not required so don't treat lack of a
symbol table as an error. Also, if the start symbol for the module
metadata linker set is not found, don't treat that as an error either.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D58540
(cherry picked from commit 80ee17c028)
Commit 505222d35f removed a batch of code that this goto used to skip
around.
Reviewed by: olce, kib, markj
Fixes: 505222d35f ("Implement the long-awaited module->file cache database. A userland tool (kldxref(8)) keeps a cache of what modules and versions are inside what .ko files. I have tested this on both Alpha and i386.")
Differential Revision: https://reviews.freebsd.org/D58539
(cherry picked from commit 8aec309852)
This matches the documented prototype and avoids spurious
-Wincompatible-pointer-types-discards-qualifiers warnings when passing
a constant pathname.
Sponsored by: AFRL, DARPA
(cherry picked from commit 09da089955)
Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.
Reviewed by: gallatin, markj
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D57973
(cherry picked from commit 9cee48180d)
If an mbuf's length in the chain for an encrypted TLS record exactly
matches the remaining length of header bytes to skip, skip the mbuf
entirely rather than adding a zero-length iovec entry.
Sponsored by: Chelsio Communications
(cherry picked from commit 1756d1cab3)
Both the Extended Attribute Record in the base ISO-9660 standard and
the RockRidge timestamp extension support a file creation timestamp.
Use this to populate the birthtime if present.
Reviewed by: markj (earlier version)
Differential Revision: https://reviews.freebsd.org/D57526
(cherry picked from commit 3d945604ef)
The extended attribute record includes four different timestamps: file
creation, file modification, file expiration, and file effective date.
Only the first two are meaningful for stat(2). The latter two (if
handled) would presumably affect if a file is visible for not.
Previously, the logic here was a bit contorted and made use of the
effective time. It also seemed to treat the creation time as a change
time timestamp.
Instead, simplify the logic such that the modification time is set to
either the modification time (if present), or the creation time. The
access and change times are then set to the modification time.
NB: This is not used if RockRidge extensions are present, and makefs
does not generate the extended attributes record.
Differential Revision: https://reviews.freebsd.org/D57748
(cherry picked from commit f6dd01b417)
Pass the length of a RockRidge attribute to the handler functions and
validate that length in each handler. If a parsing error is detected,
abort the entire parsing pass.
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D57136
(cherry picked from commit 9cd0d62313)
RFC 1994 does not place any limit on the length of the value field in
challenge messages except that the length is a single octet which
bounds the maximum length to 255.
NB: I'm not sure why the local[] and peer[] arrays contain room for an
authentication name (AUTHLEN) in addition to a challenge value/response,
but I've just left that in place.
PR: 271955
Reported by: Robert Morris <[email protected]>
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D57138
(cherry picked from commit 7e971892df)
Only fetch the optional mode argument to ID0open to pass to open(2) if
O_CREAT is present in the flags argument. It is UB to fetch an
argument that doesn't exist. On CHERI this UB results in a fault.
Reviewed by: brooks
Obtained from: CheriBSD
Sponsored by: AFRL, DARPA
Differential Revision: https://reviews.freebsd.org/D57137
(cherry picked from commit b5a8b933d4)
This mostly just fixes indentation and continuations and adds spaces
after commas and around binary operators and parentheses around return
values, but cd9660_rrip_extref() was so egregiously unreadable I
rewrote it. Note that this was done manually, so I may have missed a
few spots, and I made no attempt to fix over-long lines.
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D55865
(cherry picked from commit e6a77f81d1)
[Clang][ExprConst] Drop PRValue for nothrow new (#226753)
A user defined operator new can accept prvalue for nothrow. However, it
should not be a ConstExpr. Early returns by
isUsableAsGlobalAllocationFunctionInConstantEvaluation instead of doing
LValue evaluation.
Also, move CheckPlacement new logic into new OpCode. This decouples
checking from Interp.cpp to Compiler.cpp.
This fixes "Assertion failed: (E->isGLValue() ||
E->getType()->isFunctionType() || E->getType()->isVoidType() ||
isa<ObjCSelectorExpr>(E->IgnoreParens())), function EvaluateLValue" when
building the databases/mariadb123-server port.
MFC after: 1 week
(cherry picked from commit ca3747034e)
This change allows for fine-grained capabilities per counter index. This
is particularly useful for AMD where subclasses are not exposed to the
general PMC code, but other architectures also have asymmetric behaviors
when it comes to specific counter indices.
A new PMC_OP_GETCAPS op is added to the hwpmc(4) ioctl interface.
Reviewed by: mhorne
Sponsored by: Netflix
Pull Request: https://github.com/freebsd/freebsd-src/pull/2058
(cherry picked from commit 44a983d249)
Currently, bhyveload(8) does not validate the supplied disk
image path. For example, it allows passing the /dev/null
device, which later fails in userboot because it does not
support DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls (see
userdisk_init() in stand/userboot/userboot/userboot_disk.c).
Fix that by checking DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls early.
A similar check already exists in bhyve(8). While here, make
cb_diskioctl() report the obtained sector size instead of
hard-coding 512.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59253
(cherry picked from commit 51234535dd)
[Clang][Sema] Create LocalScope for Variable Template (#228280)
A variable template should create its own LocalScope, as it should be
opaque to other instantiations. This can occur when there are multiple
instantiations in the same lexical scope. The correct behavior is that
these instantiations should not be chained together.
Assisted-by: Claude # Test ReleaseNote
Fixes: #134148
This fixes an assertion while building the devel/glaze port.
PR: 276265
MFC after: 3 days
(cherry picked from commit fe9c713787)
Note there is ongoing work to add LoongArch support to the base system,
but having target support in llvm is an essential component.
This must be explicitly enabled using WITH_LLVM_TARGET_LOONGARCH.
Reviewed by: dim
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59899
(cherry picked from commit 2f49e40a68)
[DebugInfo] Fill Column 0 if Line is not found (#227559)
It is possible that user specified line 0 as the start of the line in C
language (using `# 0`). However, it is rejected by the Lexer as we have
no line but still carries column information. As a result, we fill
column to 0 if we cannot find line.
Assisted-by: Claude # Test
Fixes: #56186
This fixes a fatal error when building the textproc/peg port.
PR: 264853
MFC after: 3 days
(cherry picked from commit 37c9eba164)
Upstream commit 7b47b40b1 ("adapt Makefile to ssh-sk-client everywhere")
adapted the Makefiles to ssh-sk-client. Do the same here.
Reviewed by: emaste
Approved by: emaste (mentor)
Differential Revision: https://reviews.freebsd.org/D49795
(cherry picked from commit 65d8491719)
Remove semi-transparent pixels around the orb. These become more
pronounced when the orb is used as the spash screen image.
While here also strip metadata.
MFC after: 3 days
Reviewed by: tsoome
Differential Revision: https://reviews.freebsd.org/D60163
(cherry picked from commit f7663278c2)
Provide a convenient in-place sed edit command to update the FreeBSD
VersionAddendum dates with today's date.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0ec81f6a53)
(cherry picked from commit 2ba5b9da2b)
A bug fix was committed locally and submitted upstream. Document it in
our upgrade instructions, as these sometimes take a long time before
getting merged.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 6531070132)
(cherry picked from commit 14d6926293)
SRCS entries are kept in the same order and with the same line breaks as
upstream, to make comparison easier.
No functional change intended.
Reviewed by: emaste
Approved by: emaste (mentor)
Differential Revision: https://reviews.freebsd.org/D49793
(cherry picked from commit 9440aad19d)
- Show how to start a NOAUTOed interface
- "configured" is not quite right, try to improve that
MFC after: 3 days
Event: EuroBSDcon Devsummit 2026
Reviewed by: adrian
Discussed with: Antranig Vartanian <[email protected]>
Differential Revision: https://reviews.freebsd.org/D59571
(cherry picked from commit fa7094c5b0)
Netgraph document descriptions are all over the place, wordsmith them
into a standard format of "%s netgraph node", trying to describe them
better to enhance accessiblity of apropos results.
Event: EuroBSDcon 2026
MFC after: 3 days
Reviewed by: dteske, glebius
Discussed with: des, dteske, glebius
Differential Revision: https://reviews.freebsd.org/D59643
(cherry picked from commit b1e3d6a668)
A typo in the sysctl for RPI0 PWM channel 2 was causing it to
write to the wrong register, leaving it misconfigured if used.
PR: 298301
MFC after: 3 days (problem reported on 14.4)
Reviewed by: adrian
Reported by: Attila Kover <[email protected]>
Differential Revision: https://reviews.freebsd.org/D59644
(cherry picked from commit 32878e64e6)
This also installs the pkg key from the current source tree instead of
using the one currently installed on the host.
Reviewed by: dch
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D52615
(cherry picked from commit e21e6e96b6)
Currently, when bhyveload(8) fails to boot the guest,
it drops into the loader prompt waiting for user input.
This behaviour is inconvenient when using bhyveload(8) from
scripts.
Make it exit when it receives EOF from console input.
PR: 286289
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59226
(cherry picked from commit 8c20260bc5)
sched_slice_min should always to be greater than zero. When modifying
sched_slice through sysctl, if the new value is less than
SCHED_SLICE_MIN_DIVISOR, sched_slice_min is computed to zero. Add
imax(1, ...) to prevent this.
tdq_slice() should not return a value less than sched_slice_min since
that will cause integer underflow of ts2->ts_slice in
sched_ule_fork_thread. SCHED_SLICE_MIN_DIVISOR is currently set to 6 so
when load is 5 and sched_slice is 4, the two if conditions in
tdq_slice() will pass and the function will return zero. Thus use imax()
so tdq_slice returns sched_slice_min at minimum.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59408
(cherry picked from commit 477d2ea792)
In ULE ts_slice stores the number of ticks of slice passed not
remaining.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59407
(cherry picked from commit 872074c50e)
The comment "was incremented in schedcpu()" doesn't give enough
background for decrementing ts_slptime by 1 (thus ignoring decay_cpu()
for 1 ts_slptime). More accurately, ts_slptime is decremented by 1
because decay_cpu() has already executed once in schedcpu() when
ts_slptime was 1.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59406
(cherry picked from commit cd33abbce5)
'awake' checks if a thread, not a process, is awake.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59404
(cherry picked from commit 6c0c77e190)
The comment says the new thread's priority is not a realtime priority
while the code states pri > PRI_MAX_ITHD which is interrupt priorities
not realtime.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59402
(cherry picked from commit 351f673318)
Commit 62fa74d95a ("Add support for the new cpu...") removed all uses
of KTR_ULE, leaving the macro unused.
Reviewed by: olce
Approved by: olce (mentor)
Fixes: 62fa74d95a ("Add support for the new cpu...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59399
(cherry picked from commit 7997d2a181)
In old Unix, the whole process address space including scheduler-related
data was paged out to disk. We now allocate thread-related data with UMA
on wired memory which never page out. Thus this comment is now obsolete.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59398
(cherry picked from commit 46416a57eb)
In b43179fbe8 ("Create a new scheduler api..."), schedclock() was
renamed to sched_clock() but the function name in the comment remained
still. Update the comment to reflect up-to-date name for schedclock().
Reviewed by: olce
Approved by: olce (mentor)
Fixes: b43179fbe8 ("Create a new scheduler api...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59397
(cherry picked from commit 5d67118d2c)
When NICE_WEIGHT * (PRIO_MAX - PRIO_MIN) exceeds the timeshare range,
two CPU-bound threads with different nice values can have the same
priority as their nice values are clamped to the timeshare range limit.
Add static assertion on NICE_WEIGHT to ensure that there is always
enough room for nice values in the both end of the timeshare priority
range.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59396
(cherry picked from commit e90be6fdf0)
'dumping' is true only when kernel is dumping after crash (see
minidumpsys()) so KERNEL_PANICKED() will catch this.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59395
(cherry picked from commit 1dfefffcbd)
kern.sched.4bsd.followon was enabled only for KSE. It was never compiled
since ad1e7d285a and KSE was removed years ago. Now it's time to
remove this tunable.
Reviewed by: olce
Approved by: olce (mentor)
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59394
(cherry picked from commit d29c9f5aca)
bitmap_ctor() computed the allocation size as
roundup2(bits, LONG_BIT) / (LONG_BIT / 8)
The dividend is a count of bits, so converting it to bytes requires
dividing by 8 (bits per byte), not by LONG_BIT / 8 (bytes per long).
The two divisors happen to coincide on LP64, but on ILP32 platforms
the head bitmap was allocated at twice the required size; for a
FAT32 file system with close to 2^28 clusters, that is 64 MiB instead
of 32 MiB.
The extra half of the allocation was never accessed, so there is no
functional change other than the reduced memory footprint.
Pull Request: https://github.com/freebsd/freebsd-src/pull/2440
(cherry picked from commit 269002da45)
All of the security content from 3.0.22 has been merged to this branch
already; this follows through with the remainder of the changes to
finish off the version update -- in part to make future updates easier.
This is a direct commit to :stable/14.
See commit 3180d4d82f5 a description of the content update done between
the two versions, as well as the update methodology used when importing
OpenSSL 3.0.22.
A race is possible otherwise: vfs_busy() may return after an unmounted
filesystem has been removed from the global mount list. That is,
vfs_busy() will block until vfs_mount_destroy() sets MNTK_REFEXPIRE, and
at that point the mountpoint has been removed from the mountlist, so
TAILQ_FOREACH can return an invalid value.
Simply do not block if the mountpoint is being unmounted.
Reviewed by: kib
Fixes: eca39864f7 ("Add sysctl KERN_LOCKF")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59982
(cherry picked from commit dd16a5f53b)
If we are inserting a run of pages into a VM object and fail at some
point due to a memory allocation failure, we have to free all of the
pages in the run. We do that by resetting some fields and calling
vm_page_free_toq() on each page; this removes the page from the object
and frees it back to the buddy allocator.
If the page is supposed to be wired, we reset the reference count, but
this was done incorrectly: the VPRC_OBJREF flag must be retained as the
page still belongs to an object. Resetting it to zero will cause a
panic in vm_page_free_prep(): vm_page_free_object_prep() will subtract
VPRC_OBJREF from the refcount, causing underflow, and
vm_page_free_prep() subsequently calls panic() if the refcount is
non-zero.
Reviewed by: alc, kib
Fixes: fee2a2fa39 ("Change synchonization rules for vm_page reference counting.")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59908
(cherry picked from commit 742e58ddc9)
Avoid printing timer addresses, so as to not divulge information about
the address space layout.
In ip.c, print the actual SPI instead of a pointer to the SPI in the
header buffer.
When debug logging is enabled, don't leak pointers when logging function
arguments or return values.
Reported by: Reo Shiseki
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
(cherry picked from commit c91777f23a)
The security.mac.bsdextended.rules.<N> node handler takes N as
`index = name[0]` (a signed int) and only checks
`index >= MAC_BSDEXTENDED_MAXRULES`. A negative index is caught on
the read branch, but the write-only add and delete
branches proceed to `rules[index]` unconditionally.
Reject `index < 0` alongside the existing upper-bound check.
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: markj
MFC after: 2 weeks
(cherry picked from commit 5d0b87669a)
These files provide no value in the FreeBSD tree proper and change
frequently, depending on what machine I generate the release tarball on
(and what versions of autotools are on the host). Nuke the autogenerated
files to avoid bloating commit history/the tree.
MFC after: 3 days
Requested by: Benjamin Jacobs <[email protected]>
(cherry picked from commit cfe443e1e6)
- sysutils/ataidle is no more: it was superseded by camcontrol(8).
- Sort the models table alphabetically.
- Use the SPDX License ID instead of the longhand licensing tort in the
manpage header.
- Note that the driver has been heavily modified in 15.1 and later to
support additional platforms and functionality.
- Trim down SYNOPSIS.
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59470
(cherry picked from commit 7a039603a4)
The receive queue of a PAPR logical LAN is filled in by the hypervisor, so
its fields are big endian, but llan_intr() read the offset and the length of
each frame natively. On a little endian kernel the length of a 134 byte
frame reads as 0x86000000, and ether_input() discards the mbuf because m_len
is not even large enough for an ethernet header. No frame is ever received.
Reproduced on a POWER9 pseries guest with a spapr-vlan interface. Before:
llan0: discard frame w/o leading ethernet header (len -2046820352
pkt len -2046820352)
llan0 1500 <Link#1> 52:54:00:12:34:56 123 118 0 5838733312 7 0
that is 118 input errors out of 123 packets, dhclient(8) never completes and
ping(8) loses every packet, although transmit works because the transmit
path passes the lengths in hcall registers rather than through memory.
Afterwards the interface gets a DHCP lease and ping reports no loss.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59926
Approved by: jhibbits
(cherry picked from commit 6429199a21)
(cherry picked from commit d8cbdc3b09d0196e2f23a2e1f934fa0811eb28b7)
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 8f0789bee7)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
(cherry picked from commit bea7b932b9)
Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.
All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit d00da14532)
A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process. Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.
The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 17fca802de)
This tests what FreeBSD-SA-26:56.hwpmc fixed.
exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.
exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.
Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 068957e040)
void* casting is still necessary on stable/1{4,5} due to it being
removed only in fe3e92e686.
Fixes: 1072126189
Approved by: jhibbits
(cherry picked from commit cb826c230d)
mmu_radix_sync_icache() adds the offset of va within its page to the
physical address it gets from mmu_radix_extract_locked(). That address
already includes the offset - the extract routines return the physical
address of the byte, not of the frame - so the offset is counted twice
and __syncicache() is handed frame + 2 * offset.
The hash MMU counterpart, moea64_sync_icache(), has to add the offset
because PVO_PADDR() yields only the frame. Here the addition is wrong.
Fixes: 6f0b2a235a ("powerpc/pmap: Add pmap_sync_icache() for radix pmap")
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59870
(cherry picked from commit 9d0859637f)
(cherry picked from commit 1072126189)
Turns out that ever since introducing ELFv2 support, it was missing
ASLR, it was only used for ELFv1 processes.
Reviewed by: jhibbits (via IRC #powerpc64)
MFC after: 1 week
(cherry picked from commit 30ed27ff25)
(cherry picked from commit edb560a7cc)
This is a backport of an upstream commit to fix:
dtls: reset init_off before retransmitting a message
Approved by: so
Security: FreeBSD-SA-26:68.openssl
Security: CVE-2026-84782
The FD_RESOLVE_BENEATH flag was intended to try to resolve bugzilla PR
262179 without entirely disallowing fd passing between jails. However,
one can use renameat() to bypass the restriction: upon receiving a
directory fd with FD_RESOLVE_BENEATH set, a jailed process can still
move its CWD or one of its ancestors to the directory, and just cd
out of its jail root.
So disallow renameat() when either the source or destination directory
fds has FD_RESOLVE_BENEATH set, like we do with fchdir() and fchroot()
to prevent similar escapes.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101305
PR: 262179
Reported by: [email protected]
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59875
When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode. This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag. For
regular fdescfs mounts, this metadata is copied via dupfdopen().
Fix the problem by passing up this metadata through the nameidata
structure. Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n. Add some
regression tests as well.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101304
Reported by: Jan Bramkamp
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59886
These routines let one compute the intersection of two sets of filecaps
or capability rights, just as filecaps_merge() and cap_rights_merge()
compute the union. This will be useful in an upcoming patch.
filecaps_intersect() is complex due to the need to merge sets of ioctls.
For now this is implemented with a dumb nested loop on the basis that
ioctl lists are typically short enough that this is fine. It may be
better to instead sort the two lists first and step through them
together.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59885
In a couple of places we want to know whether someone has limited rights
on an fd. There, we want a predicate which determines whether the set
of rights is smaller than CAP_ALL, and whether there are explicit ioctl
or fcntl lists. Factor this out into a helper function, in preparation
for use elsewhere.
No functional change intended.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59884
semop() may sleep waiting for a semaphore. Upon waking up, it checks to
see if the set's sequence number has changed, indicating that the set
was removed. The sequence number is not wide enough to prevent a false
negative due to wraparound, in which case the subsequent access of
`semakptr->u.__sem_base[sopptr->sem_num]` may be out of bounds. This
race can be leveraged to elevate privileges.
Fix this by introducing a 64-bit sequence number for each semaphore
pool. This is wide enough to make the race impossible to hit. Allocate
a separate array for them, as we cannot really change the layout of
struct semid_kernel since some userspace tools (e.g., ipcrm(1)) embed
the layout.
While here, use semvalid() instead of open-coding its implementation,
convert a couple of flags to be bool, and use a better variable name to
store required permissions.
Approved by: so
Security: FreeBSD-SA-26:64.sysvsem
Security: CVE-2026-58098
Reported by: Reo Shiseki
Reported by: Andrew Griffiths
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59347
EDK2's QemuBootOrderLib inspects the bootorder file provided
via fw_cfg and requires it to be NUL-terminated. Otherwise,
it rejects the supplied bootorder and falls back to its
default boot order.
Currently, bhyve registers bootorder with qemu_fwcfg_add_file()
using bootorder_len returned by open_memstream(), which excludes
the trailing NUL byte.
Fix that by passing bootorder_len + 1 to qemu_fwcfg_add_file() so
the fw_cfg payload is properly NUL-terminated.
PR: 279720
Reviewed by: markj
Found with: codex (gpt-5.6-sol)
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59859
(cherry picked from commit b27a221ef7)
When performing an unconnected sendto() on a v6 UDP socket in a classic
jail, we were not applying the usual policy of replacing the loopback
addr with the jail's primary IP. Compare with, e.g., udp6_connect() or
the IPv4 udp_send(). Fix that.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: bz, glebius
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59772
(cherry picked from commit fecb9537a8)
If the entire plaintext is zero-filled, the backwards walk in
tls13_find_record_type() would return the offset of the last byte of the
TLS header. This causes an underflow when decrypting, resulting in a
null pointer dereference.
Fix the bug and add a regression test.
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59767
(cherry picked from commit 7c5e457d3a)
TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload. In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.
Reviewed by: ziaee, gallatin, markj
Relnotes: yes
Sponsored by: Netflix
Sponsored by: Chelsio Communications
Co-authored-by: John Baldwin <[email protected]>
Differential Revision: https://reviews.freebsd.org/D57974
(cherry picked from commit 08cda4bcd4)
The kern.proc.kstack handler allocates its output and stack buffers
before deliberately checking p_candebug again under the process lock.
If trace-control state changes between authorization checks, the failure
path balances the process and exec state but leaks both buffers.
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Fixes: 8b5abd9027 ("kern_proc.c: disallow execve around sysctl kern.proc.kstacks")
Reviewed by: markj
MFC after: 1 week
(cherry picked from commit 3484217cc4)
Intel LPSS I2C controllers enumerated through ACPI rather than PCI never
attach on Haswell and Broadwell, so every device behind those buses is
lost. On a Dell XPS 13 9343 that hides the I2C HID touchpad and leaves
only the PS/2 fallback, which the firmware does not restore after S3.
Three causes, all on the ACPI path:
Firmware may leave an LPSS function in D3, where its registers read as
all-ones and set_controller() fails with "controller error during
attach-1". Run _PS0 before mapping them. The PCI path does not need
this, which is why the gap went unnoticed.
INT33C2, INT33C3, INT3432 and INT3433 are Lynx Point-LP and Wildcat
Point-LP, which ig4_pci.c already classifies as IG4_HASWELL; the ACPI
path called everything but APMC0D0F an Atom SoC.
The functional clock stays gated until bit 0 of IG4_REG_CLK_PARMS is
set. Until then the controller accepts writes into the TX FIFO, never
drives the bus, raises no interrupts, and every transfer ends in
IIC_ETIMEOUT. Linux ungates the same bit in acpi_lpss.c. Doing it in
ig4iic_set_config() covers resume as well as attach.
With all three in place the touchpad attaches as iichid0/hmt1 with
multi-touch and survives suspend and resume.
PR: 298558
Tested by: Please (XPS 13 9343, Broadwell-U, 15.1-RELEASE-p3)
Reviewed by: wulf
MFC after: 1 week
(cherry picked from commit e75f61962c)
If something goes very badly (e.g. forcibly removing a medium while
the OS tries to start it), this could end up in params.blksize being 0
(and params.disksize 1). Avoid an integer divide fault, panicking the
kernel, by bailing out before.
MFC after: 3 days
(cherry picked from commit 34ae0f7834)
Commit 851dffef53 added the Lunar Lake-M I2C controllers 0 through 3
(0xa878-0xa87b), which sit on PCI device 0x15. The platform exposes two
further controllers at 0xa850 and 0xa851 on PCI device 0x19, reported by
Intel as I2C #4 and #5. This mirrors the layout already handled for
Arrow Lake-U, where both the 0x777x and 0x775x ranges are listed.
On an HP OmniBook X Flip 16-as0xxx (Core Ultra 9 288V) the firmware
enables only four of the six controllers, and both HID devices sit on
the two that were missing: an ELAN2514 touchscreen on controller 4 and
a SYNA3503 touchpad on controller 5. Neither attaches without this
change, so the machine has no working pointing device.
Like the other four, these use the Tiger Lake revision of the I2C IP;
Linux treats 0xa850/0xa851 identically to 0xa878-0xa87b in
intel-lpss-pci.c.
Tested on: HP OmniBook X Flip 16-as0xxx (Intel Core Ultra 9 288V)
Reviewed by: vexeduxr
MFC after: 2 weeks
Signed-off-by: Kang Kang <[email protected]>
Pull Request: https://github.com/freebsd/freebsd-src/pull/2406
(cherry picked from commit 6b92093fdf)
this patch adds PCI IDs to the ig4(4) driver:
- Lunar Lake-M (0xa878, 0xa879, 0xa87a, 0xa87b)
These controllers use the Tiger Lake hardware revision of the I2C IP.
Adding these IDs enables support for peripherals connected to the I2C Bus.
Tested on: Intel Lunar Lake (LENOVO_MT_21QX_BU_Think_FM_ThinkPad T14s Gen 6)
Signed-off-by: Defenso-EBO <[email protected]>
MFC after: 2 weeks
Sponsored by: Defenso
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1995
(cherry picked from commit 851dffef53)
When compiling the kernel with gcc 14, errors similar to the following
are emitted:
sys/dev/cxgbe/iw_cxgbe/ev.c: In function 'c4iw_ev_handler':
sys/compat/linuxkpi/common/include/linux/xarray.h:132:23: error: statement with no effect [-Werror=unused-value]
132 | flags == 0; \
sys/dev/cxgbe/iw_cxgbe/ev.c:274:17: note: in expansion of macro 'xa_unlock_irqrestore'
274 | xa_unlock_irqrestore(&dev->cqs, flag);
| ^~~~~~~~~~~~~~~~~~~~
sys/compat/linuxkpi/common/include/linux/xarray.h:132:23: error: statement with no effect [-Werror=unused-value]
132 | flags == 0; \
sys/dev/cxgbe/iw_cxgbe/ev.c:283:17: note: in expansion of macro 'xa_unlock_irqrestore'
283 | xa_unlock_irqrestore(&dev->cqs, flag);
| ^~~~~~~~~~~~~~~~~~~~
It looks like the intent of the "flags == 0" statement was to make the
'flags' macro argument not unused, but it still results in a warning.
Use the construct "(void)flags" instead.
Reviewed by: bz
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D59787
(cherry picked from commit aca53fc2a6)
parse_mw_buf() copies option names from privileged sysctl input into
eight-byte stack buffers. Unbounded %s conversions permit option tokens
longer than seven bytes to write past those buffers before the parser
validates them.
Limit each conversion to seven characters, leaving space for the
terminating NUL.
Signed-off-by: Yudi Yang <[email protected]>
Fixes: 96f556f504 ("NTB Tool: Test driver for NTB hardware drivers.")
Reviewed by: markj
MFC after: 1 week
(cherry picked from commit 602d1b994a)
AMD doesn't encode page depth in eptp. As a result, the page level is
decided by the host la57 value. Without this, it uses 4 level page and
therefore cause machine enable la57 have garbage page translation.
PR: 291768
Reviewed by: kib
Tested by: Antranig Vartanian <[email protected]>
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57978
(cherry picked from commit ef26f64c11)
bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at
which point they haven't yet been assigned a domain. Thus, bufdomain()
returns &bdomain[-1], which trips the array-bounds sanitizer.
This is harmless since we don't use the result in that case, but let's
avoid the invalid access to begin with. This is sufficient to let an
amd64 kernel boot to a login prompt with -fsanitize=array-bounds
configured.
Reported by: Andrew Griffiths <[email protected]>
Reviewed by: rlibby, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59381
(cherry picked from commit e1d903bbfa)
We use first loop only for possible needed realloc, so it is not
required to restrict end condition.
Also check realloc() return value before accessing.
This is direct commit to stable/14.
Reported by: dim
Differential Revision: https://reviews.freebsd.org/D56616
Do not assign `b` in the `ATF_REQUIRE` macro. Set and test `b`
separately to avoid the issue cited by clang++/g++ after
implementing the change referenced in [1].
MFC after: 2 weeks
Reported by: clang (-Wparenthesis)
Reference: https://github.com/freebsd/atf/pull/72
(cherry picked from commit 4ae95fe823)
ATF_TESTS_C automatically adds the appropriate library to LDADD --
there's no need to manually append the same library.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59411
(cherry picked from commit 5b10c3c3e3)
mmu_radix_extract() walks the page tables without holding the pmap lock,
unlike its hash MMU counterpart moea64_extract(). A concurrent unmap can
free and recycle the page table page being walked, so the read returns
whatever now occupies that memory and the caller gets a physical address
that never existed.
That is how mmu_radix_sync_icache() came to hand a bogus address to
__syncicache() and panic the machine. Commit 1574ca1955 worked around
it by taking the pmap lock in mmu_radix_sync_icache(), but the machine
independent callers of pmap_extract() - vm_sync_icache(), proc_rwmem()
and the vslock() paths - remain exposed to the same failure.
Rename the existing body to mmu_radix_extract_locked(), which asserts the
lock, and make mmu_radix_extract() a thin wrapper that acquires it.
mmu_radix_sync_icache() already holds the pmap lock, so it calls the
locked variant directly and neither recurses nor reacquires the lock once
per page.
Suggested by: alc
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59320
Reviewed by: markj, jhibbits
(cherry picked from commit 42c69445ca)
mmu_radix_sync_icache() walked the page tables with an unlocked
pmap_extract() and passed the result straight to PHYS_TO_DMAP(),
checking only that it was non-zero. Nothing keeps the mapping - or the
page table page holding it - alive across that window: if another thread
of the same process tears a mapping down concurrently, the page table
page can be freed and reused, so pmap_extract() reads arbitrary memory
and returns a bogus physical address. __syncicache() then dereferences
an unmapped direct map address and the kernel takes a data storage
interrupt:
fatal kernel trap:
exception = 0x300 (data storage interrupt)
virtual address = 0xc003317ca6022a00
dsisr = 0x40000000
srr0 = 0xc000000000f59460 (__syncicache)
lr = 0xc000000000f23588 (mmu_radix_sync_icache)
pid = 23878, comm = skyframe-evaluator-
panic: data storage interrupt trap
The faulting addresses decode to physical addresses far beyond installed
memory (~140 TB and ~900 TB on a 256 GB machine), i.e. translations that
never existed.
The hash MMU implementation of the same method, moea64_sync_icache(),
already holds PMAP_LOCK() across the loop; do the same here.
mmu_radix_extract() does not acquire the pmap lock itself, so this
introduces no recursion.
JIT workloads reach this path constantly: ppc_instr_emulate() calls
pmap_sync_icache() on the faulting address for the SIGILL "second
chance" retry, so a multithreaded JVM executing freshly written code
races against its own threads' mmap/munmap. Every panic observed here
was in a JVM thread.
Tested on POWER9 (radix MMU) with a bazel/JVM build loop that previously
panicked the machine twice within ten minutes: afterwards 13 consecutive
builds and more than 10 hours of uptime with no panic, on both
15.1-RELEASE and 16.0-CURRENT.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59311
Reviewed by: jhibbits, adrian
(cherry picked from commit 1574ca1955)
This was a rather dumb miss on my part in commit 42442d7a6e.
LK_CANRECURSE is clearly needed in any case in which the covered vnode
is held exclusive across the call to VFS_ROOT(), regardless of whether
it was initially held exclusive or upgraded. The commit message for
that change also noted that unionfs lookup only worked without
LK_CANRECURSE due to a coincidence of the then-current unionfs
implementation. As it happens, said coincidence was recently removed
in commit b952606b4f ("unionfs_lock(): eliminate LK_CANRECURSE special-
case").
PR: 298201
Reported by: olivier
Fixes: 42442d7a6e "Generalize the VV_CROSSLOCK logic in
vfs_lookup"
Reviewed by: kib, markj, pho
Tested by: pho
Differential Revision: https://reviews.freebsd.org/D59494
(cherry picked from commit f57ce26f25)
When an NSS backend returns a canonical pw_name or gr_name that differs from
the lookup name supplied by the NFSv4 upcall, nfsuserd stores the successful
mapping in the kernel cache under the canonical name instead of the requested
name.
This causes the retry lookup performed by nfsv4_strtouid() or
nfsv4_strtogid() to miss the newly inserted cache entry, resulting in the
default UID/GID being returned although the NSS lookup itself succeeded.
PR: 296753
(cherry picked from commit 1771ab245c)
All communication between hastd nodes and internally between hastd and
its worker children passes through the same pair of send / receive
functions. The receive function uses recv(2) with the MSG_WAITALL flag,
which in theory means we should never get a short read. However, when
handing off a socket to a worker child, we also pass a variable-length
string identifying the type of socket we're passing, and reading this
string relies on a short read. This used to work because the arrival of
the descriptor would interrupt the recv(2) call, but this bug was fixed
when the AF_UNIX code was rewritten a while ago and hastd has been
broken ever since.
Fixing the length of the protocol name to four characters including the
terminating null solves the short-read bug by never requiring a short
read (nothing else in hastd requires one).
Note that this issue appears to have been reported independently first
by Alessandro Sagratini in PR 292322 and then by Martin Vidovic in
D57511. I ended up going in a different direction than Martin's patch,
but his analysis was invaluable, hence the double credit below.
PR: 292322
Reported by: Martin Vidovic <[email protected]>
MFC after: 1 week
Event: EuroBSDcon DevSummit 2026
Reviewed by: xtronom_gmail.com, kevans, glebius, gjb
Differential Revision: https://reviews.freebsd.org/D59521
(cherry picked from commit b7e5c2e008)
The proto-libnv implementation embedded in hastd pads names and values
out to the nearest multiple of eight bytes, but leaves the padding
uninitialized, leaking up to 14 bytes of recycled heap per pair in a
message.
While here, switch from bcopy() to memcpy().
MFC after: 3 days
Reviewed by: kevans, emaste
Differential Revision: https://reviews.freebsd.org/D59343
(cherry picked from commit 911bda7cff)
The script was passing the wrong device name to `graid3 insert` and
didn't notice that the command was failing.
MFC after: 1 week
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59564
(cherry picked from commit 4cc85d1f00)
The lock acquisition in g_raid3_ctl_insert() was improperly dropped a
while ago, making it impossible to add or replace a device in an
existing graid3. This went unnoticed because the tests are broken.
MFC after: 1 week
Fixes: fcf69f3dbc ("Consistently use gctl_get_provider instead of home-grown variants.")
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59563
(cherry picked from commit 9094f86b57)
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
(cherry picked from commit bcd0d76d48)
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
(cherry picked from commit d577b4ed58)
Fix -Wformat diagnostic after #190965 (#193704)
Fixes libunwind compiler diagnostic when building with clang after
034d4dcad6396d1241e8262e69871b8d61da7e4f:
```
In file included from libunwind/src/libunwind.cpp:31:
In file included from libunwind/src/UnwindCursor.hpp:52:
libunwind/src/CompactUnwinder.hpp:339:46: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
338 | "function starting at 0x%llX",
| ~~~~
| %lX
339 | compactEncoding, functionStart);
| ^~~~~~~~~~~~~
libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
215 | #define _LIBUNWIND_DEBUG_LOG(msg, ...) _LIBUNWIND_LOG(msg, __VA_ARGS__)
| ~~~ ^~~~~~~~~~~
libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
181 | fprintf(stderr, "libunwind: " msg "\n", __VA_ARGS__); \
| ~~~ ^~~~~~~~~~~
In file included from libunwind/src/libunwind.cpp:31:
In file included from libunwind/src/UnwindCursor.hpp:52:
libunwind/src/CompactUnwinder.hpp:458:39: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
457 | "function starting at 0x%llX",
| ~~~~
| %lX
458 | encoding, functionStart);
| ^~~~~~~~~~~~~
libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
215 | #define _LIBUNWIND_DEBUG_LOG(msg, ...) _LIBUNWIND_LOG(msg, __VA_ARGS__)
| ~~~ ^~~~~~~~~~~
libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
181 | fprintf(stderr, "libunwind: " msg "\n", __VA_ARGS__); \
| ~~~ ^~~~~~~~~~~
```
This avoids a -Werror failure with clang >= 23.
MFC after: 3 days
(cherry picked from commit 8a8c14464d)
On ll/sc architectures casueword32() may report a spurious
store-conditional failure (reservation lost to an interrupt, preemption,
or another CPU touching the same reservation granule), and this is
indistinguishable from a genuine comparison mismatch: both return 1.
That is intentional since D20772 and documented in casueword(9) ("The
store can fail on load-linked/store-conditional architectures."), so
callers must cope.
do_lock_normal() does not fully cope. When the initial
UMUTEX_UNOWNED -> id acquire CAS fails spuriously, the observed owner is
still UMUTEX_UNOWNED, so neither the UMUTEX_CONTESTED branch nor the
real-owner case applies, and execution falls through past the "rv == 1
but not contested, likely store failure" comment into the sleep path.
There, the contested-bit CAS (expecting the observed owner, i.e.
UMUTEX_UNOWNED) succeeds because the mutex really is unowned, stamping
m_owner = UMUTEX_CONTESTED with no owner tid, and the thread sleeps on
"umtxn" forever: nobody owns the mutex, so no unlock and no wakeup ever
arrive. In _UMUTEX_TRY mode the same situation returns a false EBUSY
for a free mutex.
Treat an observed owner of UMUTEX_UNOWNED like UMUTEX_CONTESTED: try to
acquire the mutex, setting the contested bit, instead of falling through
to the sleep path. rv == 1 with the observed value equal to the
expected value can only mean a spurious store failure, so the mutex is
free. If the acquire CAS fails again, the outer loop restarts and
re-evaluates ownership. The contested bit set with no waiters present
only costs the matching unlock one trip through the kernel.
This was hit in practice on powerpc64le (POWER9): the Swift runtime's
Synchronization.Mutex issues _umtx_op(UMTX_OP_MUTEX_LOCK) directly with
no userspace fast path, so an uncontended lock of an unowned mutex runs
the kernel CAS exactly where a spurious failure deadlocks
(single-threaded process parked on "umtxn" with m_owner == 0x80000000,
observed as Foundation.Process.run() hanging). libthr mostly masks the
bug because pthread_mutex_lock() enters the kernel only when there is a
real owner that will eventually issue a wakeup.
The mechanism was confirmed with an experimental powerpc kernel that
instead retried the ll/sc sequence inside casueword32()/casueword();
that also eliminated the hang, but is not proposed here since the
single-attempt semantics of casueword(9) are intentional.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59338
(cherry picked from commit c5d9485e7d)
The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index. Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.
Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.
Reported by: Daniel Braniss <[email protected]>
Tested by: Daniel Braniss <[email protected]>
Obtained from: Intel ixl 1.14.2
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59336
(cherry picked from commit 429cb53701)
Previously, we would precompile D test dependencies using the
host's dtrace, which unconditionally outputs ELF files in the
host's format. This breaks the cross-compile build with errors
like the following:
dtrace: failed to link script: incorrect ELF machine type for
object file: tst.usdt.pieo
--- usdt.o ---
*** Failed target: usdt.o
This patch moves compilation to runtime for all C-based testcases
that have a dependent D source file.
Reviewed by: markj
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59030
(cherry picked from commit 60d78908f5)
This fixes the build with gcc 16's aggressive inlining.
Reviewed by: ngie
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59538
(cherry picked from commit 243bdaff75)
Add explicit D3hot and D3cold names and the bounds needed by
pci_has_pme(), while retaining PCI_POWERSTATE_D3 == 3. D3cold is a
capability-query state here, not a newly supported power transition.
This avoids importing the ACPI D3cold changes for the PME and igc
Wake-on-LAN backports.
Use pci_has_pm() to check capability presence instead of pp_location,
which is not present in stable/14. Keep the PCI configuration structure
layout unchanged.
Fixes: d831cb2ad3 ("pci: Expose PME support by power state")
Fixes: 443dc80b71 ("igc: Correct Wake-on-LAN filter programming")
The attach path translated WUC.APME into a saved link-change filter,
then advertised magic-packet wake. Suspend removed unselected magic,
unicast, and multicast bits from that saved value, commonly leaving no
hardware wake filter at all. The destructive masking also made later
capability changes ineffective.
Advertise the I225/I226 wake filters whenever PCI power management is
available and enable magic-packet wake by default. Build a fresh WUFC
mask for every suspend, and explicitly clear WUC, WUFC, and PCI PME when
wake is disabled.
Require the PCI power-management capability to report D3hot PME support
before advertising or arming wake. A PM capability alone does not mean
the function can signal PME from the state used during system sleep.
Reconstruct RAR0, the multicast table, and the receive filter after the
stop-time reset so unicast and multicast wake use the current interface
state. Keep the PHY powered while wake is armed, drain pending PCIe
transactions, and disable bus mastering before D3.
Clear the sticky base and extended wake status before arming filters.
On resume, report the saved hardware wake cause, clear the device wake
source, and then clear PCI PME. Run the DMA-fencing sequence even when
wake programming fails, while allowing shutdown to continue after
logging the failure. Explicitly restore PCI bus mastering during
initialization so an iflib-local resume after another child rejects
suspend can restart the device.
Restore the Intel shared code PHY power down test from DPDK. The
FreeBSD split inverted the reset-block condition, so its dormant hook
would power down only when firmware explicitly vetoed the operation.
Do not copy the generic legacy management test verbatim. The I225 and
I226 define MANC bits 0 and 1 as flow-control and NC-SI discard
controls, not SMBus and ASF enable bits. Preserve the link when the
documented TCO receive path is enabled; the shared reset-block test
separately honors the firmware keep-link-up veto. This follows section
8.21.1 of the Foxville Software User Manual.
Evaluate management pass-through at each suspend. When neither a host
wake filter nor management requires the link, invoke the shared-code
power-down hook before D3. Leave a management-owned link untouched and
restore a link previously powered down by the driver without another
PHY reset. This follows DPDK's stop/start pairing without changing
ordinary ifconfig down behavior.
The implementation was checked against the Intel I225/I226 programming
model, the Intel Linux igc lifecycle, and DPDK.
On an I225-LM, a device-only D3 test observed PME for a valid magic
packet and no PME with every host wake filter disabled. Both cases
resumed to D0 with the link and configured addresses operational.
The I225 system also completed a full ACPI S3 cycle and resumed with
link, configured addresses, and traffic operational.
On an I226-V, a device-only D3 test changed PMCSR accordingly after a
magic packet. With dev.igc.0.wake enabled, a full ACPI S3 cycle
remained asleep until a delayed magic packet and resumed with link,
addresses, and traffic operational.
PR: 282140
Obtained from: DPDK (shared-code power-down structure)
(cherry picked from commit 90bee82638)
The presence of the PCI power management capability does not imply that
a function can signal PME# from every power state. Drivers which
advertise wake based only on pci_has_pm() can consequently expose wake
modes that cannot work.
Add pci_has_pme() to query the PME_Support bitmap for a specific state.
Use it to implement LinuxKPI pci_pme_capable(), removing its duplicate
PME_Support decoder.
Validated the helper against PCI PMC capability values from 82571EB,
82573L, 82579LM, I210, I225, and I226-V controllers. The 82571 and
82573 reported PMC 0xc822, while the I226-V reported 0xc823. In both
values, bits 15, 14, and 11 advertise PME from D3cold, D3hot, and D0;
the low-bit difference is only the PM capability version.
Sponsored by: BBOX.io
(cherry picked from commit c4e24e95c3)
A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.
Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.
pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59063
(cherry picked from commit f1f58bdf7b)
A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.
Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59207
(cherry picked from commit 5f78d02469)
bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.
Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59206
(cherry picked from commit dc4f80da18)
SR-IOV VFs are instantiated from their PF and intentionally do not
receive an ACPI handle by matching their runtime BDF. Consequently,
ACPI locality queries for a VF fall back to the upstream bus. This is
usually sufficient, but loses a _PXM supplied specifically for the PF.
Use the PCI core's owning-PF accessor for BUS_GET_DOMAIN and
BUS_GET_CPUS requests made for a VF. This preserves the VF's lack of
an ACPI handle while allowing its CPU and NUMA placement to follow the
PF.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59062
(cherry picked from commit 1a2a88684a)
SR-IOV VFs are instantiated dynamically from their PF rather than
enumerated from ACPI. A VF's runtime slot and function can match an
unrelated _ADR below the bridge. acpi_pci_save_handle() stores that
handle in the VF's devinfo before acpi_pci_update_device() runs.
If the handle is already bound to another device_t whose parent is not
acpi0, acpi_pci_update_device() panics under INVARIANTS. Without
INVARIANTS, the VF retains the unrelated handle, so subsequent ACPI
lookups, including NUMA and power-management operations, can act on the
wrong namespace node.
Skip ACPI namespace matching for VFs.
Reviewed by: jhb
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59061
(cherry picked from commit 8b74806161)
By default, makefs uses the host environment's user and group databases
when creating filesystems. This causes makefs to fail when trying to
create files owned by users or groups which don't exist in the host
environment, for example when creating a VM with packages pre-installed
which added their own users/groups.
Pass "-N ${DESTDIR}/etc" to makefs to point it at the user and group
databases from the image being created.
MFC after: 1 week
Sponsored by: Amazon
(cherry picked from commit 7ca0c1eba2)
The strtoul function sets errno on error, but does not clear it on
success; when using strtoul and checking errno (as one should) for
ERANGE / EINVAL afterwards, it's important to zero errno first.
While here, remove a dead store.
Reviewed by: phk
Fixes: 4fe8c1b67b ("Add error and range checking ... ")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59270
(cherry picked from commit 6ddb10cf6b)
This test has not passed since 185becb1e1
(the libarchive 3.8.9 upgrade).
PR: 297505
MFC after: 1 week
Reviewed by: siva
Differential Revision: https://reviews.freebsd.org/D59314
(cherry picked from commit 064d190cda)
The 82579 PCIm2PCI arbiter can acknowledge a host MAC CSR write while
the Management Engine is accessing another CSR. The host write can be
lost; subsequent target accesses may no longer be claimed by the MAC and
can hang the system.
For 82579 controllers with valid management firmware, wait for the ME
CSR access indication before every MAC CSR write. Keep the wait bounded
and use DELAY because writes occur in interrupt and datapath contexts.
Verify every transmit and receive tail write. If a tail does not hold
the requested value, disable its datapath direction and request a full
iflib reset.
Keep the ordinary register-write path as a direct MMIO write behind a
predicted per-device gate. Contain the wait and tail recovery in the
82579 slow path rather than adding tail-specific accessors and state to
the rest of the e1000 family.
Documentation on the PCH NICs is scare so Intel's Linux e1000e fixes
publicly document the hardware failure and required serialization as
commits bdc125f73f3c and d601afcae2fe. This implementation is a bit
cleaner.
Tested on a Thinkpad T430 (82579LM) with a test kernel to simulate ME
contention without incident as well as lost tail writes causing a
succesful recovery.
Sponsored by: BBOX.io
(cherry picked from commit e7aa5a5a3f)
Sort the existing LPSS peripheral SPI controller PCI ID table by
numeric device ID so new entries have an unambiguous insertion point.
Reviewed by: wulf
Differential Revision: https://reviews.freebsd.org/D58996
(cherry picked from commit 728775442c)
The shared base code already selects and configures the 82598 BX,
82599 KR, 82599 SFP Express Module, X552 XFI, X553 QSFP, and X553 N
QSFP device IDs, but the FreeBSD probe table omits them while DPDK lists
them.
Sponsored by: BBOX.io
(cherry picked from commit 27f0491e36)
Validate the IVRS table and every subtable length before using either
to form iterator bounds. Reject truncated typed IVHD blocks instead of
passing them to a type-specific callback.
Within each IVHD payload, correct the lower-bound comparison for
extended range entries and validate fixed-size entries, paired range
terminators, the fixed HID body, and the variable HID UID before
dereferencing or advancing. Malformed firmware can no longer drive
either iterator beyond its enclosing object.
Reviewed by: kib
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58724
(cherry picked from commit 4a2494d76a)
T2, T1, and some pre-T1 Macs advertise a legacy PIO
range in the SMC ACPI _CRS alongside a live MMIO window, but the
silicon behind the PIO range is bogus.
Try MMIO first, validate via LDKN >= 2, fall back to PIO if that
fails or no MMIO resource is present. Drop "(T2)" from the backend
message since MMIO isn't T2-exclusive.
MFC: 1 week
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D58839
(cherry picked from commit 37826269b4)
Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57854
(cherry picked from commit 126f82a3eb)
Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).
Each sysctl is registered only if the key exists on the hardware.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57853
(cherry picked from commit 6a1bd5212f)
Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.
Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57844
(cherry picked from commit bb1e071be4)
asmc_key_dump() used I/O port macros (ASMC_DATAPORT_WRITE/READ,
asmc_command()) unconditionally. On T2 Macs, sc_ioport is NULL
(MMIO backend is used instead), causing a page fault when
ASMC_DEBUG triggers asmc_dumpall() during attach.
Add an MMIO guard at the top of asmc_key_dump(): delegate to
asmc_key_dump_by_index() + asmc_key_read() for MMIO devices,
consistent with the rest of the T2 code paths.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D56748
(cherry picked from commit e37e49bfaa)
T2 Macs (2018+) expose the SMC via memory-mapped registers instead of
I/O ports. Add asmcmmio.c/asmcmmio.h implementing the MMIO transport:
key read/write, getinfo, getbyindex, and a poll-based wait with
exponential backoff.
The driver probes for MMIO at attach time by checking the LDKN firmware
version key; if MMIO is available it is used, otherwise the standard
I/O port backend is used.
T2 fan speeds use IEEE 754 floats instead of fpe2 fixed-point.
Per-fan manual mode uses F%dMd keys instead of the FS! bitmask.
Battery charge limit is exposed via dev.asmc.N.battery_charge_limit.
Tested on:
MacBookPro16,2 (A2251, iBridge2,10)
MacBookPro15,4 (A2159, iBridge2,8)
MacBookAir8,2 (A1932, iBridge2,5)
Mac mini 8,1 (A1993, iBridge2,7)
iMac20,2 (A2115, iBridge2,16)
iMacPro1,1 (A1862, iBridge1,1)
MFC after: 2 weeks
Reviewed by: ngie, adrian
Differential Revision: https://reviews.freebsd.org/D57086
(cherry picked from commit a48b900300)
Older SMC firmware exposed AUPO as a Wake-on-LAN control. On updated
firmware, the key controls automatic power-on when AC power is restored
after a power loss; WoL is handled by the GBE controller instead.
Rename the sysctl to reflect the current semantics. No compatibility
alias is provided as the sysctl has not appeared in any release.
Reviewed by: ziaee, adrian
Differential Revision: https://reviews.freebsd.org/D56747
(cherry picked from commit 36b399f55e)
Probe SMC keys at attach time to detect hardware capabilities,
supporting all Intel Apple machines without per-model entries.
Sensors are discovered by scanning sorted SMC key ranges for
known prefixes and types. Capabilities such as SMS, fan safe
speed, and ambient light are detected by key presence.
A global key description table provides human-readable names
for well-known temperature sensors.
Tested on:
- MacBook Pro (Early 2007, Mid 2014, Mid 2015)
- MacBook Air (Early 2015, Mid 2017)
- iMac (Mid 2011, Late 2013)
- Mac mini (Mid 2011)
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D56405
(cherry picked from commit e7f4269dbf)
Apple SMCs contain numerous undocumented voltage, current, power,
and ambient light sensors. This change adds automatic detection
and registration of these sensors as sysctls.
New sysctl trees:
dev.asmc.0.voltage.* - Voltage sensors (millivolts)
dev.asmc.0.current.* - Current sensors (milliamps)
dev.asmc.0.power.* - Power sensors (milliwatts)
dev.asmc.0.ambient.* - Ambient light sensors
Implementation:
- Scans all SMC keys at attach time via asmc_key_dump_by_index()
- Identifies sensors by key prefix patterns:
- Voltage: VC*, VD*, VG*, VP*, VI*
- Current: I{C,D,G,M,N,O,H,P,B,A,L}*
- Power: P{C,D,N,S,T,H,F,Z,z}*
- Light: ALV*, ALS*
- Dynamically creates sysctls for detected sensors
- Supports 8 fixed-point SMC data types:
- sp78, sp87, sp4b, sp5a, sp69, sp96, sp2d, ui16
- Auto-converts all values to milli-units (mV, mA, mW)
On Mac Mini 5,1, detects:
- 7 voltage sensors
- 18 current sensors
- 27 power sensors
- 2 ambient light sensors
Enables power consumption monitoring, voltage rail debugging,
and ambient light detection without hardcoding model-specific
sensor lists.
Tested on:
- Mac Mini 5,1 (2011) running FreeBSD 15.0-RELEASE
- 54 sensors auto-detected and exposed via sysctl
- All sensor types verified with multimeter readings
- Fixed-point conversions validated against known values
- Memory management tested (malloc/free on detach)
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D55807
(cherry picked from commit aae9068404)
This commit adds support for the MacBookPro13,1 (late 2016, 13-inch). The SMC
keys were collected from https://logi.wiki/index.php/SMC_Sensor_Codes. Two
temperature keys are omitted because they fail to be read: TI0P (IO Proximity)
and Ta0P (Ambient Air).
Note that the with this model the `dev.asmc.0.fan.0.minspeed` setting only
applies when the fans have been activated by the system. In my testing, the fans
did not spin up until CPU temperatures hit about 80C. At lower temperatures, the
fans will happily ignore the minimum speed and remain at 0 rpm.
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2137
(cherry picked from commit b5b9c65a68)
This patch adds a debugging interface to read and write arbitrary
Apple SMC keys by name through sysctl, enabling hardware exploration
and control of undocumented features.
The interface provides four sysctls under dev.asmc.0.raw.*:
- key - Set the 4-character SMC key name (e.g., "AUPO")
- value - Read/write key value as a hex string
- len - Auto-detected key value length (can be overridden)
- type - Read-only 4-character type string (e.g., "ui8", "flt")
Implementation includes a new asmc_key_getinfo() function using SMC
command 0x13 to query key metadata. The interface automatically
detects key lengths and types, uses hex string encoding for
arbitrary binary values, and is safe for concurrent access via
CTLFLAG_NEEDGIANT.
This interface was essential for discovering that the AUPO key
enables Wake-on-LAN from S5 state, and for mapping all 297 SMC keys
on Mac Mini 5,1.
Reviewed by: ngie, adrian, markj
Differential Revision: https://reviews.freebsd.org/D54441
(cherry picked from commit 3e27114a7f)
ofw_pcibus now uses pci_iov_get_pf() to inherit PF locality for
VFs, but the accessor was inadvertently left in an uncommited ACPI
change. This breaks powerpc builds.
Expose the accessor from the PCI core and provide a stub when PCI_IOV
is omitted. Record VF ownership before pci_add_child() so child added
callbacks can safely query it, and remove the later redundant
assignment.
Sponsored by: BBOX.io
(cherry picked from commit 3481a9cdc4)
The TSO workaround splits the final DMA segment to create a four byte
sentinel descriptor. Intel documents the premature descriptor writeback
erratum and this workaround in the 82540EP and 82545GM specification
updates (erratum 3) and the 82546GB specification update (erratum 1).
Limit the workaround and its preceding TSO state to the legacy PCI and
PCI-X controllers so PCIe controllers retain their natural descriptor
layout using one fewer descriptor per TSO packet, no split of the final
segment, and one less four byte DMA.
Sponsored by: BBOX.io
(cherry picked from commit 2a7af8ebcf)
BUS_GET_DOMAIN can report a PCI function's firmware locality, including
an SR-IOV VF's inherited PF locality, but ordinary OFW PCI functions
still use the shared bus DMA tag. Consequently, busdma metadata and
coherent memory can be allocated from the bus's domain instead of the
function's domain.
Create and cache a child tag for each function that requests a DMA tag
and apply its reported domain without modifying the shared parent tag.
Apply the same domain to the private IOMMU tag already created by the
pSeries PCI bus. Destroy cached tags when PCI children are removed so
VF create and destroy cycles do not leak them.
Reviewed by: PowerPC (jhibbits)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59065
(cherry picked from commit df6bbc9b17)
PCI VFs are allocated dynamically and have no corresponding OFW node.
The zero-filled OFW PCI devinfo currently leaves obd_node as 0, which
is not the invalid-node sentinel and can send NUMA lookup through an
unrelated firmware node.
Initialize dynamically allocated devinfo with an invalid OFW node. For
VF locality queries, use the owning PF's node when it exists. Fall back
to the PCI bus when neither the VF nor PF has a firmware node.
This preserves existing CPU-locality behavior for ordinary PCI devices
while making VF domain and interrupt placement follow their PF.
Reviewed by: PowerPC (jhibbits)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59064
(cherry picked from commit f003e86335)
The previous patch assumes that we don't want to reset toggle bit in
STOPPED_STEP. However, a device can explicitly call
usbd_clear_data_toggle if necessary. As a result, instead of not
dropping the bit unconditionally, we added a field in xhci to specify
that we want to drop it, so that usbd_clear_data_toggle can handle it
correctly.
Reported by: oh
Reviewed by: kevans
Tested by: oh
Fixes: 28d85db46b ("xhci: Do not drop and add bits in xhci")
(cherry picked from commit 0f59df8386)
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
with no hashing. A memset() at the top of zfs_dnode_stat() zeroes the
remaining fields so they no longer hold stack garbage.
Tested on 16.0-CURRENT (amd64), ZFS-on-GELI root: rebuilt and re-signed
the EFI loader; the system boots under UEFI Secure Boot with
mac_veriexec active.
(boot1 segment was modified by kevans)
PR: 295935
Sponsored by: Defenso
Reviewed-by: kevans
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2271
(cherry picked from commit b567434a59)
Some devices take a little longer, and the spec doesn't really seem to
mandate a maximum. The common path in usbd_req_set_address() has
already been bumped to 1s and I have a headset (Logitech H390) that does
need a little bit longer, so let's match it in xhci.
Reviewed by: aokblast
(cherry picked from commit 135df77854)
It was intended that one could close the hole back in loader, but the
sysctl was actually not marked TUNABLE. The hardening menu option thus
did nothing, because we wouldn't read the value from kenv.
Reported by: markj
Fixes: 6e81fbf583 ("bsdinstall: add a hardening knob [...]")
Fixes: 4fd518fcb2 ("kern: add a security knob to disable [...]")
(cherry picked from commit 8befc9e8b1)
We can probaby consider these kernel bugs, in which case asserting is
not the most helpful thing we can do. Let's emit the necessary details
to stderr and exit non-zero to aid debugging these without completely
blocking the ability to export all of the well-formed metrics.
Reviewed by: rew
(cherry picked from commit 4f42ec2f38)
Logic prior to this change would incorrectly try linking when MK_CDDL != no,
instead of MK_CTF != no, which could result in the library and the tests being
broken if/when MK_CTF == no and MK_CDDL != no (an uncommon, but possible
combination with today's build knobs).
This change updates the conditional to correctly track the value of MK_CTF, which
in turn is properly toggled to no if/when MK_CDDL == no as it's a dependent build
knob.
This [niche] build bug has been present in FreeBSD since 2014.
MFC after: 1 week
(cherry picked from commit f2e6a8b9e5)
- Scope local variables properly to each function.
- Quote variables that should be treated as single words.
- Replace `${cmd}; if [ $? -eq 0 ]` with `if ${cmd}` for simplicity.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57899
(cherry picked from commit fc186c24b1)
This makes it easier to grep for the error message to better understand
the call stack when loading firmware modules fails.
Fix a cosmetic-only style(9) bug while here in the same function related
to another logging message.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58380
(cherry picked from commit a594783bac)
This change converts the longhand form of `extern "C" {` and its
corresponding `}` into `__BEGIN_DECLS` and `__END_DECLS`, respectively.
The new form is much easier to grep for and is a best practice to use in
the FreeBSD tree.
This is meant to be a non-functional change.
MFC after: 1 week
(cherry picked from commit bc81728c00)
- Remove `\(em` from .Nm section as it's not valid mandoc markup.
- Remove the section from the .Nm directive (it's handled under the .Dt
directive).
MFC after: 1 week
Reported by: make manlint
(cherry picked from commit 5007a5d682)
radix_lockless algorithm creates its own radix tree and
allocates its own radix_masks by directly calling rnh_addaddr().
However, during destruction, it only frees the radix_tree without
freeing its allocated radix_masks.
Fix the leak by calling rn_delete() during radix_destroy().
PR: 297339
Reviewed by: melifaro
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59112
(cherry picked from commit 790817f5a7)
A HAST message can be empty, in which case ebuf_add_tail() does nothing
and ebuf_data() returns NULL because the size of the ebuf is zero, but
hast_proto_recv_hdr() asserts that the return value is not NULL,
resulting in an immediate crash if hastctl or hastd receive an empty
message. This is trivially reproducable by running `hastctl status` or
`hastctl role init` (as the rc script does prior to stopping hastd).
To avoid this, don't try to grow the ebuf or receive additional data
if the header size is zero.
PR: 298085
MFC after: 3 days
Reviewed by: kevans, gjb
Differential Revision: https://reviews.freebsd.org/D59306
(cherry picked from commit 8646d65b45)
Fix nlist(3) consumers that either expected our toolchain to prepend an
underscore to symbol names or expected nlist(3) to ignore the mismatch,
as it did until we overhauled it back in May.
While here, also fix cases where the last element in the list had an
empty string instead of NULL as sentinel.
MFC after: 3 days
Fixes: 4617a6cb82 ("nlist: Handle multiple symbol tables")
Reviewed by: kib, jhb
Differential Revision: https://reviews.freebsd.org/D59254
(cherry picked from commit cdfc673811)
The 16-byte "device_name" field was not zero-filled, so could contain
uninitialized stack data. Zero the whole struct, as that's the
prevailing pattern for this kind of conversion code, and it's more
robust in the face of future revisions to struct devstat.
Reviewed by: olce, kib
Reported by: Reo Shiseki
Fixes: a11d132f6c ("devstat: Provide 32-bit compatibility")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59309
(cherry picked from commit 7cb1a76f88)
Array indices must always be posive. We avoid this by making each index
unsigned. This mitigates out-of-bounds reads and writes.
Reported by: Ilja Van Sprundel <[email protected]>
Reviewed by: glebius
Differential revision: https://reviews.freebsd.org/D55260
(cherry picked from commit 3fdbd8a07a)
Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.
Signed-off-by: Krzysztof Galazka <[email protected]>
Reviewed by: erj
Tested by: Mateusz Moga <[email protected]>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57337
(cherry picked from commit f370d9e4d5)
Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.
Signed-off-by: Pawel Sobczyk <[email protected]>
Reviewed by: kbowling, erj, milosz.linkiewicz_intel.com
Tested by: Mateusz Moga <[email protected]>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57642
(cherry picked from commit 33e2eac3e3)
The problem observed on X550 adapters with 2.5 and 5 Gbps speeds
negotiation on some switches is not affecting E610 adapters.
Remove workaround, which omitted those speeds in the list
of initially advertised speeds and advertise all speeds
supported by adapter.
Signed-off-by: Krzysztof Galazka <[email protected]>
Reviewed by: kbowling
Tested by: Mateusz Moga <[email protected]>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57339
(cherry picked from commit 62d5d119ee)
Point the identification LED documentation to led(4), which describes
how to control /dev/led device nodes.
Sponsored by: BBOX.io
(cherry picked from commit af069400a8)
Change the path for the shosts.equiv file to consistently reflect
/etc/ssh/shosts.equiv across all manual pages.
This change stems from 35d4ccfb55 ("Document FreeBSD defaults and
paths.")
Reviewed by: bcr, emaste
Differential Revision: https://reviews.freebsd.org/D52203
(cherry picked from commit 336cc041a4)
Fix a documentation discrepancy, where the implementation was updated to
use uncertainty propagation for the ratio of means, but the example
output in the manual page was left unchanged.
Update the manual page example from 70.7384% to 102.3% to reflect the
actual output.
While here, also update the example in the README.
Reviewed by: ziaee
Fixes: a304ad90e9 ("Reduce the bogosity of ministat's % difference calculations.")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59157
(cherry picked from commit 595e665cb2)
The SR-IOV status change reports mailbox API 1.6 but omitted its enum
definition, leaving main unable to compile.
API 1.6 is an established ixgbe mailbox wire revision. Add it at the
end of the revision enum, before the unknown sentinel as required by
the stable numbering contract. Naming the revision does not enable
negotiation or operations which will come with the E610 support.
Reported by: Herbert J. Skuhra <[email protected]>
(cherry picked from commit 6a1703c112)
X550 family devices provide a separate RSS key, redirection table,
and MRQC register for every VMDq pool. With SR-IOV enabled, the
driver continued programming only the global RSS state and never
selected MRQC.MULTIPLE_RSS. VF-local RSS programming was therefore
ineffective.
Enable multiple-RSS mode for X550, X552, X553, and E610. Initialize
the PF pool's 64-entry key, redirection table, and RSS hash controls.
Leave each VF pool untouched so its driver retains ownership of its
RSS key and mapping.
E610 folds IPv6 extension-header traffic into its base RSS selectors
and reserves the legacy EX selector bits. Translate those requested
hash types rather than programming reserved bits.
With two E610 VFs active and four PF queue sets, eight fixed TCP flows
distributed across all four PF receive queues.
E610 uses the same per-pool mode according to the E610 Datasheet,
sections 7.1.3.6.2 and 8.2.2.8.20-21.
Sponsored by: Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by: BBOX.io
(cherry picked from commit 87406f8351)
The VF statistics registers are free running and are not cleared on
read. The existing code records attach time bases and pre-reset totals,
but never uses either when publishing counters. It instead replaces
the low hardware bits directly, so counters can inherit pre-attach
traffic or jump backward after a reset.
Accumulate modular 32- and 36-bit deltas, following DPDK, while keeping
the software totals across planned resets. Establish a fresh hardware
baseline after each successful reset and invalidate the sampling epoch
when mailbox state is lost. Detect unsolicited PF resets explicitly so
a reset while link is down cannot be mistaken for counter wrap.
Remove the unused base and saved-reset bookkeeping.
On E610, packet and octet counters remained monotonic across a VF FLR
and a PF down/up cycle. Traffic after each reset advanced both RX and
TX counters.
Sponsored by: BBOX.io
(cherry picked from commit cb85c4397b)
E610 inherits the X550-family virtualization registers, anti-spoofing
controls, and malicious-driver operations, but the frontend does not
advertise SR-IOV and cannot negotiate the mailbox revision needed by
E610 VFs.
Initialize the X550-family PF/VF mailbox registers for E610 and use
PFVFLREC for its VF reset events, following DPDK shared ixgbe code.
Advertise the E610 SR-IOV capability, accept API 1.6 only on E610, carry
the existing xcast and queue operations forward to that revision, and
return the cached physical link speed and state with the three-dword
E610 operation. Unsupported RSS and optional feature requests continue
to receive explicit failures.
SR-IOV activation also enables the existing X550-derived per-pool MDD
recovery path on E610. Document the expanded protection and link-state
coverage.
Hardware validation created 63 VFs and rejected a 64th without flapping
the running PF. Invalid TX and RX descriptor DMA independently asserted
the offender's WQBR bit, gated only that VF, preserved sibling traffic,
and recovered after the VF reset. FreeBSD ixv, FreeBSD DPDK, Linux
ixgbevf, and Linux DPDK exercised the PF mailbox and data paths.
Relnotes: yes
Sponsored by: Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by: BBOX.io
(cherry picked from commit df02513fd4)
E610 VFs no longer report the actual PF link state and speed through
VFLINKS. They can consequently report the default 10 Gb/s speed even
when the physical link uses another rate.
Negotiate mailbox API 1.6 on E610 and request the PF link state with its
three-dword operation. Retain VFLINKS as the fallback when an older PF
rejects API 1.6. Permit API 1.6 in the inherited xcast and queue
discovery helpers so negotiating the newer revision does not disable
existing operations.
Use GET_QUEUES to replace E610's one-queue fallback with the grant from
the PF. The common path continues to use one iflib queue set per data
MSI-X vector and caps the result at two queue pairs.
Preserve mailbox transport errors so the driver can distinguish an
explicit PF NACK from a transient timeout. A NACK means clear-to-send
state was lost and requires a VF reset. Preserve the last confirmed
link state across brief transport failures and publish link down after
three consecutive failures.
Poll E610 link state every two seconds, matching Intel's ixgbevf service
timer, and phase VFs across the intervening iflib timer ticks. This
avoids a mailbox polling herd when many VFs share a PF. Media-status
queries return the cached state instead of starting another synchronous
exchange. An admin interrupt caused by a mailbox reply only checks for
an unsolicited PF reset, preventing a request/reply interrupt loop.
Hardware validation on an E610 10GBASE-T PF exercised 63 VFs. Each VF
negotiated API 1.6, two queue pairs, and three MSI-X vectors. Phased
polling kept 31 active VFs idle, and all 63 recovered after a PF
down/up cycle without watchdogs.
Adapt the API 1.6 link-state operation from DPDK shared ixgbe code. The
timeout and NACK distinction follows Intel ixgbevf 5.3.25.
Sponsored by: Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by: BBOX.io
(cherry picked from commit 40367d1f3b)
Move the capability and quirk checks used by pcie_flr() into a public
side effect free helper. This lets callers determine whether an FLR
can be attempted before quiescing a device or saving state.
The helper considers the advertised PCIe FLR capability and both the
enable and disable FLR quirks.
Sponsored by: BBOX.io
(cherry picked from commit 5b48968c1a)
The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths. ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task. Even with MSI-X, the admin
interrupt was established before the task was initialized.
Initialize it alongside the other private tasks. The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.
Sponsored by: BBOX.io
(cherry picked from commit b4208a67ed)
Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.
Use a bounded delay to keep the task active while detach enters the
taskqueue drain. Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().
Reviewed by: gallatin, kgalazka
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58720
(cherry picked from commit ac56d36007)
iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change. This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.
Drain the entire private taskqueue before ether_ifdetach(). Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.
Differential Revision: https://reviews.freebsd.org/D58452
Co-authored-by: Andrew Gallatin <[email protected]>
Co-authored-by: Kevin Bowling <[email protected]>
(cherry picked from commit ba353c8950)
Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.
Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.
Reviewed by: gallatin
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58722
(cherry picked from commit 90e7dbe5e2)
Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.
Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.
Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.
A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and
driver, matching normal deregistration, so a failed attach cannot leave
a stale /dev/iov node or make the next attach report EBUSY.
A successful attach_pre can now be followed by detach before driver
queue allocation. Make the remaining queue-backed interrupt cleanup
paths tolerate absent queue arrays.
Mark a failed registration as detaching before draining the entire
private taskqueue. Drivers can register configuration tasks there, and
taskqueue_drain_all() does not wait for work queued during its drain.
Make every current non-admin callback reject detaching contexts so late
work cannot touch driver state.
Drain tasks and call ether_ifdetach() with neither the ifnet nor context
lock held. A callback already running may need either lock, while
ether_ifdetach() acquires ifnet_detach_sx. Reacquire IFNET_WLOCK before
the context lock to preserve the established lock order.
The shared automatic core-offset allocator also lacked acquisition
state. Late registration failures leaked its reference, while normal
detach could decrement a reference belonging to another device when a
configured offset or allocation failure meant that this context never
acquired one. Record acquisition explicitly and release only references
held.
Reviewed by: gallatin
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58721
(cherry picked from commit fe00ca2f88)
When IFDI_ATTACH_POST() fails (or netmap attach fails), iflib tears down with
ether_ifdetach(), taskqueue_free(ifc_tq), and IFDI_DETACH(). CTX_LOCK is still
held after ether_ifattach. ether_ifdetach() and taskqueue_drain(admin) must not
run under CTX_LOCK.
Teardown ordering (match iflib_device_deregister):
- Free the per-interface admin taskqueue after IFDI_DETACH / IFDI_QUEUES_FREE, not before.
- Drop IFNET_WLOCK() across IFDI_DETACH / IFDI_QUEUES_FREE so driver detach can sleep in
LinuxKPI workqueue drain, then retake IFNET_WLOCK() before iflib_free_intr_mem and fail_unlock.
Reviewed by: gallatin, kgalazka, #iflib
Differential Revision: https://reviews.freebsd.org/D56316
(cherry picked from commit 439132310a)
Observed below kernel panic calltrace while performing sysctl -a
operation while unloading the if_bnxt driver,
Fatal trap 9: general protection fault while in kernel mode
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02a7569940
vpanic() at vpanic+0x136/frame 0xfffffe02a7569a70
panic() at panic+0x43/frame 0xfffffe02a7569ad0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe02a7569af0
calltrap() at calltrap+0x8/frame 0xfffffe02a7569af0
trap 0x9, rip = 0xffffffff80c0b411, rsp = 0xfffffe02a7569bc0, rbp = 0xfffffe02a7569be0 ---
sysctl_handle_counter_u64() at sysctl_handle_counter_u64+0x61/frame 0xfffffe02a7569be0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02a7569c30
sysctl_root() at sysctl_root+0x22f/frame 0xfffffe02a7569cb0
userland_sysctl() at userland_sysctl+0x196/frame 0xfffffe02a7569d50
sys___sysctl() at sys___sysctl+0x65/frame 0xfffffe02a7569e00
amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe02a7569f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe02a7569f30
Root Cause:
iflib adds per-device sysctl nodes under the device tree using the device
sysctl context. Some of those nodes are counter sysctl that point at fields
inside txq→ift_br. When the if_bnxt driver is unloaded, iflib_device_deregister
runs and calls iflib_tx_structures_free, which frees the txqs ift_br. The device
sysctl tree is only freed when the device is destroyed. If sysctl -a runs during
unload, it can still traverse the device tree and call sysctl_handle_counter_u64
for those nodes. The handler does counter_u64_fetch(*(counter_u64_t *)arg1).
By then arg1 can point into freed memory and leads to use after free type kernel panic.
Fix:
flib now uses its own sysctl context for all iflib-related nodes
instead of using device’s context. And iflib sysctl context is now
removed before any queue/ring memory is freed.
Reviewed by: gallatin, ssaxena, #iflib
Differential Revision: https://reviews.freebsd.org/D55981
(cherry picked from commit d2b96f654a)
* Fix case where the source is - and the target exists.
* Only call chflags() (to remove flags that might prevent us from
replacing an existing target) in the exists case; otherwise,
to_sb.st_flags is uninitialized.
* Rename the source file in the stdin test case.
* Extend null and stdin test cases to cover the case where the
target already exists.
PR: 297681
MFC after: 1 week
Fixes: d34870708d ("install: Allow installing stdin")
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59144
(cherry picked from commit a5ff4125cf)
If one of the source files we copy is non-writeable, cp will create a
non-writeable copy. If the original is later modified, cp will fail to
overwrite the copy since it is not writeable. Using cp -f ensures the
copy always succeeds, as long as the object directory is writeable.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
(cherry picked from commit 336b6d1192)
Query the firmware for the LEDs on each physical port and expose
/dev/led/bnxt* only when alternate blinking is supported. Configure
every LED in the advertised group for identification and restore its
default firmware state before a function reset.
This follows the DPDK and Linux bnxt HWRM identification paths.
Reviewed against: DPDK, Linux
Reviewed by: Sumit Saxena <[email protected]>
Sponsored by: BBOX.io
(cherry picked from commit 98b5640786)
A driver class may implement LED control even though the capability is
not available on every device or firmware version it supports. Add an
optional capability method and consult it before creating the led(4)
device. Default to supported so existing providers are unchanged.
This will be used by bnxt which blends PF and VF in the same driver.
(cherry picked from commit 2519e19f05)
I225 and I226 do not interrupt for corrected internal ECC errors.
Instead, the DMA packet buffer and PCIe memories expose sticky status
bits in PBECCSTS and PCIEECCSTS.
Sample these bits with the regular hardware statistics update, preserve
the PBECCSTS ECC enable state while clearing its RW1C indication, and
expose separate counters for the DMA packet buffer, PCIe transmit-data
memory, and PCIe retry buffer.
These counters represent observed indications rather than an exact error
count because multiple corrections between samples collapse into one
sticky status bit.
Hardware validation used an I225-IT (rev 3) and a debug kernel that
wrote only the documented self-clearing injection bits. Each test
armed the injector, exercised the owning RAM with traffic, and compared
the corresponding counter before and after.
Coverage:
Memory Observed result
DMA packet buffer corrected_dma advanced once
PCIe transmit data corrected_pcie_tx_data advanced once
PCIe retry buffer No PCIe replay source; not exercised
The retry-buffer injector requires a real PCIe replay to read the
corrupted entry. The test root port exposed AER and DPC reporting but
no protocol error injector, so ordinary traffic could not cover that
case.
Sponsored by: BBOX.io
(cherry picked from commit 9f7633b932)
I225 and I226 report uncorrectable internal memory errors through
ICR.FER and identify the affected region in PEIND. Depending on the
region, hardware stops transmit or all PCIe and DMA traffic until the
port is reset and reinitialized.
Enable the fatal error interrupt and capture its read clear status in
the interrupt filter. Mask the cause while an iflib reset is pending,
report the affected memory regions, and expose per region indication
counters.
PCIe region parity failures require a different recovery order from a
normal reset: assert DEV_RST, wait at least 3 ms, disable PCIe master
requests, clear PCIEERRSTS, and then reinitialize the port. Follow that
sequence before entering the normal reset path and clear the remaining
LAN status afterward.
The I225/I226 PBECCSTS layout is unrelated to the PCH layout previously
copied into the igc headers. Replace those unused definitions with the
I225/I226 memory error register definitions.
Hardware validation used an I225-IT revision 3 and a debug kernel that
wrote only the documented self-clearing injection bits. It did not
synthesize interrupt or status state.
Coverage, notably DMA and Mgmt are not fully testable in my setup:
Region Observed hardware status Result
LAN PEIND 0x1, LANPERRSTS 0x200 Reset and recovered
PCIe PEIND 0x4, PCIEERRSTS 0x8 Reset and recovered
DMA DRPARC injection read back zero DFT-gated on test NIC
Mgmt Host debug strap unavailable Not injectable
The repeated LAN and PCIe tests recovered without a panic or watchdog.
A PCIe-to-LAN sequence also verified that reset-time PEIND indications
are drained before FER is unmasked.
Sponsored by: BBOX.io
(cherry picked from commit bbf93227fe)
The E610 firmware event handler invoked ixgbe_if_stop() directly from
IFDI_UPDATE_ADMIN_STATUS(). This reset the device without the iflib
queue lifecycle and left the interface marked running after its hardware
was stopped.
Request an iflib reset instead. Fail the automatic initialization once
so the reset transaction stops the interface and publishes that state.
A later operator-requested initialization remains possible, matching the
previous recovery policy without bypassing iflib.
(cherry picked from commit 3aac283613)
The firmware-mode callout invoked ixgbe_if_stop() directly. This
performed a full device reset without the iflib context lock or the
iflib queue lifecycle. It could also poll the E610 firmware command
interface from callout context while identification was active.
Request an iflib reset from the callout instead. Reject initialization
while firmware recovery remains active. This leaves the interface
stopped and lets iflib publish that state. Request initialization when
firmware exits recovery so an administratively-up interface can recover
without operator intervention.
(cherry picked from commit 43aa553ef4)
The link interrupt filter performed a full hardware reset in interrupt
context. This bypassed iflib stop and initialization, including queue
quiescence and restoration of temporary LED state.
Record the ECC event in the administrative request mask and ask iflib
to perform the reset from its taskqueue. Keep the ECC cause masked
until reset so the intermediate admin pass cannot re-enable a sticky
condition. Handle ECC independently of Flow Director and in legacy
interrupt mode.
Remove the redundant EICR write; the filter has already cleared the
reported causes. Also remove the accompanying complement-mask update
of mac.flags. It set every flag except DOUBLE_RESET_REQUIRED and had
no place in ECC recovery.
(cherry picked from commit c28f2c551d)
Expose each physical port identification LED through /dev/led/ixl*.
Use the existing GPIO LED helpers for most devices and the PHY
provisioning interface for X710 10GBASE-T adapters.
Preserve and restore the original GPIO or PHY indication mode,
including before the interface is stopped.
(cherry picked from commit 8b2e75970c)
Expose the physical port identification LED through /dev/led/ix*.
Save and restore the NVM-selected LEDCTL value around each request.
The X550 operations also clear their PHY manual override before the
register is restored.
Use the dedicated firmware port-identification command on E610. Its
interface selects between firmware blinking and the original mode
rather than directly controlling LEDCTL.
Restore the normal indication before a device stop or reset.
(cherry picked from commit fb7e249ce4)
The debug routine reads queue registers by queue index. It also
advanced unused pointers to rings embedded in queue structures. Those
pointers had the wrong stride and could proceed beyond the ring object.
Remove the unused pointer arithmetic.
(cherry picked from commit 423927d6c3)
The debug routine advanced ring pointers as if rings were contiguous.
They are embedded in queue structures, so rings beyond queue zero had
the wrong stride. The bogus queue index could cause an invalid MMIO
read and panic the machine.
Index the queue arrays first and then select the embedded ring.
(cherry picked from commit 7dd826171b)
The generic LED on and off operations do not handle internal SerDes
media, leaving the led(4) device ineffective on my I210 fiber port.
Use the hardware blink operation for the on phase on internal SerDes.
The off phase restores the saved OEM LED configuration as before.
(cherry picked from commit 28f96cc374)
I225 and I226 expose three programmable LED outputs. Use LED1 for
adapter identification, following the convention in DPDK. Preserve the
OEM configuration across identification requests.
Restore the OEM configuration before a device reset so an active led(4)
pattern cannot leave the output overridden across stop or detach.
The LED mode values follow the Intel I225 Software User Manual.
(cherry picked from commit 19f75b3819)
When a driver implements ifdi_led_func, have the framework create its
led(4) device after attach completes and the ifnet and context locks are
released.
PR: 246885
Reported by: jlduran
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D32389
(cherry picked from commit 6591a7f691)
led(4) invokes driver callbacks while holding its mutex, including
from a callout. iflib_led_func() cannot acquire the sleepable context
lock in those contexts without causing a lock-order reversal or sleeping
from the callout.
Record the latest requested state under the iflib state lock and
enqueue the existing per-device taskqueue. The task can safely take
the context lock before invoking the driver. Coalescing requests also
avoids accumulating stale blink transitions when hardware access is
slow.
Destroy the LED device before draining its task so no new callback can
race driver detach.
(cherry picked from commit 9529947519)
The 'opp-shared' property is required, but has no meaning for a
single-processor system, and is thus not present in such device trees as
the BeagleBone Black. Expand the check so we do not fail attachment in
this case.
This is a partial cherry-pick from the original commit. Intended for
merge into releng/14.5.
PR: 297788
Reported by: Rick Richard <[email protected]>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D48124
(cherry picked from commit def7999c2c)
This subclass declares its own softc structure adding necessary members
after the embedded ehci_softc_t. The full size of the struct must be
included in the driver declaration, otherwise the allocation backing the
softc is not guaranteed to be large enough.
Reported by: KASAN
Reviewed by: jrtc27, manu
Fixes: 7a58744fd0 ("Split out the attachment from the generic-ehci driver")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57951
(cherry picked from commit d5332d3a90)
When saving a coredump, savecore(8) maintains .last symlinks for the
info and vmcore artifacts, but not for the crashinfo text report.
Make crashinfo(8) create the link, pointing at the current
core.txt.<bounds> file.
This makes /var/crash/core.txt.last track the same core dump as
info.last and vmcore.last.
[mhorne: I tweaked the submission, such that the link will be created as
soon as the core.txt.X file is generated; not only after a successful
report has been written.]
Signed-off-by: Ricardo Branco <[email protected]>
Reviewed by: mhorne
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2199
(cherry picked from commit 4dfc78e0e3)
Add the hifive-fsbl, hifive-bbl, and xbootldr aliases to mkimg(1).
Add the xbootldr alias to geom(4), and thus gpart(8).
The "hifive" partition types are defined and used by various RISC-V SBCs
for locating firmware.
"xbootldr", or the Extended Boot Loader Partition is defined here:
https://uapi-group.org/specifications/specs/boot_loader_specification/
Reviewed by: emaste, markj, mhorne
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D56784
(cherry picked from commit dab8138e13)
(cherry picked from commit 54d0ae979d)
The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.
Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.
Approved by: so
Security: FreeBSD-SA-26:63.posixshm
Security: CVE-2026-58094
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59104
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the
proctree relock. After relocking the tty, it did not revalidate the
tty state, and it could end up linking a doomed tty to the calling
process' session. This race can be exploited to escalate privileges.
TIOCSPGRP has a similar race, fix that too.
Approved by: so
Security: FreeBSD-SA-26:62.tty
Security: CVE-2026-58093
Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59126
This is a rollup commit from upstream to fix:
Avoid full read buffer allocation when buffering DTLS records
ssl/record: lower the DTLS unprocessed_rcds queue limit
Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap
Add a test for restricting growth in cmp cert cache
Fix unbounded cert cache growth in cmp
Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg
Approved by: so
Obtained from: OpenSSL
Security: FreeBSD-SA-26:61.openssl
Security: CVE-2026-54874
Security: CVE-2026-63072
Security: CVE-2026-63074
Security: CVE-2026-63076
This function has a loop where it attempts to lock all channels in a
group. If doing so would block, it releases all locks, sleeps for a
bit, and tries again. However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.
Fix the inner loop: after waking up, break out of it unconditionally and
start everything again. I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels. Then we'd try again from the beginning and fail to
lock the channels we had already locked.
Approved by: so
Security: FreeBSD-SA-26:58.sound
Security: CVE-2026-58091
Reported by: Hazley Samsudin of GovTech CSG
Reviewed by: christos
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58912
When a process execve()s, pmc_process_exec() is supposed to evaluate
whether the new image is setuid/setgid and if so, whether to detach
PMCs. This was handled by pmc_can_attach(), which is effectively an
open-coded copy of cr_xids_subset().
Unfortunately, the test of the result of this function was inverted,
with the result that we'd detach PMCs only if the predicate said it was
okay to do so. It appears the bug has always been there; it seems the
intent was to return 0 on "success", i.e., it is okay to attach the
PMCs, much like p_candebug(). Commits 1c3c698ba4 and 1c40b15971
obscured this a bit.
I think this check is trying to be too clever. Let's make it simpler:
simply do not attach PMCs unless the owner is privileged. This is how,
e.g., ktrace works. I do not think it's worth trying to be more
sophisticated than this unless we can generalize the policy in a way
that's applicable to other subsystems.
Also fix a bug at the end of pmc_process_exec():
pmc_detach_one_process() will call pmc_remove_process_descriptor() for
us.
Approved by: so
Security: FreeBSD-SA-26:56.hwpmc
Security: CVE-2026-58089
Reported by: netchild
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59102
The PHY identifier word is promoted to signed int when the cast is
applied after the shift. Cast the 16-bit register value first so
identifiers with their high bit set are assembled as unsigned data.
(cherry picked from commit f4bf1da7ba)
The PHY identifier word is promoted to signed int when the cast is
applied after the shift. Cast the 16-bit register value first so
identifiers with their high bit set are assembled as unsigned data.
(cherry picked from commit f5fd839fe6)
PHY identifier words are promoted to signed int when the cast is applied
after the shift. Cast each 16-bit register value first so identifiers
with their high bit set are assembled as unsigned data.
(cherry picked from commit 13a7470096)
The driver already accumulates the clear-on-read transmit and receive
LPI event counters. Expose the 64-bit totals under the per-device eee
sysctl node.
(cherry picked from commit 13d78e4b9d)
The PHY capability display examines all 32 bits of the firmware bitmap.
Use an unsigned value so examining bit 31 does not shift a signed
integer into its sign bit.
(cherry picked from commit f7427f890c)
A manageability VLAN can select bit 31 of its VFTA register. Use an
unsigned value when constructing the register mask.
(cherry picked from commit 392fbdcf22)
VLAN, VMDq, and VF reset bit indices can reach 31. Use unsigned
values when constructing their 32-bit register masks so the shifts do
not operate on signed integers.
(cherry picked from commit bf6feffef6)
LED index three shifts the blink bit into bit 31. Convert the base to
the register width before shifting so the operation is unsigned.
This is the ixgbe counterpart of the e1000 correction imported from
DPDK commit 214cb0d7f1.
(cherry picked from commit bbdd3c4692)
The EEPROM word is promoted to signed int before the left shift when
the cast is applied to the complete expression. Cast the word first so
all 16-bit values are shifted as unsigned data.
This is the ixgbe counterpart of the e1000 correction imported from
DPDK commit b932270c66.
(cherry picked from commit baa6e3af85)
Do not modify a zero-initialized PHY control value when its preceding
read failed. Leave the PHY unchanged when the void power helpers cannot
read its current state.
This follows the defensive checks added to the corresponding e1000
helpers.
(cherry picked from commit 1121aaa075)
DPDK commit message
net/e1000/base: fix data type in MAC hash
One of the bit shifts in MAC hash calculation triggers a static analysis
warning about a potential overflow. Fix the data type to avoid this.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Barbara Skobiej <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (458734aaac)
(cherry picked from commit 3fc1786aa2)
DPDK commit message
net/e1000/base: fix MAC address hash bit shift
In e1000_hash_mc_addr_generic() the expression:
"mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"
shift by more than 7 bits always yields zero, so hash becomes not so
different. Add initialization with bit_shift = 1, and add a loop
condition to ensure bit_shift will be always in [1..8] range.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Aleksandr Loktionov <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (1749e662f6)
(cherry picked from commit cba56bc342)
DPDK commit message
net/e1000/base: fix iterator type
Fix static analysis warning about comparison between types of
incompatible width, which might lead to an infinite loop due to
overflow.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Amir Avivi <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (3d36053991)
(cherry picked from commit 5587cb18b1)
The multicast vector bit can be 31. Use an unsigned value so setting
the bit cannot shift a signed integer into its sign bit.
(cherry picked from commit 8704d29c6c)
The multicast hash bit can be 31. Use an unsigned value so setting the
bit cannot shift a signed integer into its sign bit.
(cherry picked from commit 275ca86f6a)
The i210 and i211 can occasionally fail to accept multicast table
writes, particularly while addresses are added and removed rapidly.
Read the table back and rewrite mismatches for up to three passes.
This prevents multicast reception from retaining stale filter state
while keeping the workaround limited to the affected controllers.
(cherry picked from commit bb8d0944b5)
The multicast hash bit can be 31. Use an unsigned value so setting the
bit cannot shift a signed integer into its sign bit.
(cherry picked from commit a86d65b2c9)
DPDK commit message
net/e1000/base: fix data type in MAC hash
One of the bit shifts in MAC hash calculation triggers a static analysis
warning about a potential overflow. Fix the data type to avoid this.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Barbara Skobiej <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (458734aaac)
(cherry picked from commit a09034d561)
DPDK commit message
net/e1000/base: fix MAC address hash bit shift
In e1000_hash_mc_addr_generic() the expression:
"mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"
shift by more than 7 bits always yields zero, so hash becomes not so
different. Add initialization with bit_shift = 1, and add a loop
condition to ensure bit_shift will be always in [1..8] range.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Aleksandr Loktionov <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (1749e662f6)
(cherry picked from commit e7ffea395e)
DPDK commit message
net/e1000/base: fix reset for 82580
Fix setting device reset status bit in e1000_reset_hw_82580() function
for 82580 by first reading the register value, and then setting the
device reset bit.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Barbara Skobiej <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (88a1eb79ef)
(cherry picked from commit 53e4711616)
DPDK commit message
net/e1000/base: add LPI counters
Add new fields in structure to indicate if EEE LPI entries have been
observed on Tx and Rx path.
Signed-off-by: Sasha Neftin <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (2e8078ee69)
(cherry picked from commit d1c20195c0)
DPDK commit message
net/e1000/base: fix unchecked return
Static analysis has detected a write that is not checked for errors,
leading to ignored error return value. Add a check.
Fixes: edcdb3c5f71b ("e1000/base: fix link flap on 82579")
Cc: [email protected]
Signed-off-by: Dima Ruinskiy <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (b0b6b50c20)
(cherry picked from commit c80aface0f)
Firmware may take up to one second to unconfigure ULP, and affected
Lenovo systems have required nearly two seconds. Allow 2.5 seconds
before treating the transition as a PHY failure.
This extends DPDK commit 7aa4c34581a5 using the field-tested bound
from Linux commit 3cf31b1a9eff.
(cherry picked from commit e49cb7f757)
The LTR encoding combines a value and a nonlinear scale, so encoded
values cannot be compared directly. Decode both the device latency and
the platform maximum before deciding whether to clamp the request.
(cherry picked from commit 6058dfa402)
Meteor Lake and newer PCH generations can lose packets while the MAC
and PHY clocks synchronize. Move K1 power-down to P1 and extend the
PHY K1 exit timeout before PHY access and after reset.
Use the longer 1 Gb/s PLL clock-gate timeout added by Linux so K1 can
remain enabled without the power penalty of disabling it. Apply the
workaround through the newer PTP and NVP generations.
This follows DPDK commits ba54bdc79d94 and d88ef2356ecc, with the
longer exit time observed in Linux 578294b8b60d.
(cherry picked from commit 17d90d5b93)
Some Meteor Lake and newer systems sporadically fail an MDIC PHY
transaction while the MAC and PHY clocks synchronize. Retry twice
before reporting the transaction failure.
Disable retries around PHY interface transitions where an MDI error
is expected. Preserve and restore the configured retry count on every
exit from those flows.
This follows DPDK commit bdca22d62ff0, extended to the PTP and NVP PCH
types.
(cherry picked from commit df34ccfc91)
DPDK commit message
net/e1000/base: fix semaphore timeout value
According to datasheet, software ownership of SWSM.SWESMBI bit should
not exceed 100ms. Current implementation caused incorrect timeout
counter values, where each iteration equals 50us delay. Because of that
driver was allowed to wait for semaphore even for 1.5s. This might
trigger DPC timeout.
This implementation hardcodes value to 2000, which multiplied by 50us,
gives 100ms of possible wait time.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Pawel Malinowski <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (c8bcaf0f2a)
(cherry picked from commit ea2e8b056b)
The shared semaphore helper accesses both the 82571 retry counter and
the I210 one-time-clear flag. Those fields occupy overlapping members
of the device-specific union. On 82571, incrementing the counter thus
enables the I210 recovery and clears SMBI after the first timeout.
Give 82571, generic 80003/82575, and I210/I211 users distinct acquire
paths. Preserve the legacy peer-driver policy on 82571 and one-time
recovery on I210.
The separation follows the Intel e1000 base code in DPDK.
(cherry picked from commit 2625192689)
Some transitional Tiger Lake systems shipped with an uninitialized
checksum word. Accept that state while continuing to validate newer
read-only NVM images.
(cherry picked from commit ccb8ad1f64)
DPDK commit message
net/e1000/base: improve NVM checksum handling
When reading NVM checksum, we may encounter the following scenarios:
- Checksum may be invalid, and can be updated
- Checksum may be invalid but cannot be updated because NVM is read-only
For the latter case, we should just ignore invalid checksum and not
attempt to update it.
Signed-off-by: Sasha Neftin <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (5241c17f0d)
(cherry picked from commit 8e8755e011)
DPDK commit message
net/e1000/base: fix possible variable overflow
Bits can be lost as temporary math is done on signed variables and the
result is assigned to an unsigned variable. Cast to u32 to force the
compiler to do operations on unsigned temporary variables.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Lukasz Czapnik <[email protected]>
Signed-off-by: Ciara Loftus <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (214cb0d7f1)
(cherry picked from commit b3bdffd7a4)
DPDK commit message
net/e1000/base: fix NVM data type in bit shift
There is a static analysis warning due to wrong data types being used
for NVM read data shifts. Fix it via explicit type cast.
Fixes: 38db3f7f50bd ("e1000: update base driver")
Cc: [email protected]
Signed-off-by: Przemyslaw Ciesielski <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (b932270c66)
(cherry picked from commit 146ae81c6a)
DPDK commit message
net/e1000/base: fix iterator type
Fix static analysis warning about comparison between types of
incompatible width, which might lead to an infinite loop due to
overflow.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Amir Avivi <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (3d36053991)
(cherry picked from commit 15a0db2101)
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
(cherry picked from commit 6de818285f)
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
(cherry picked from commit 800d5b7a8a)
According to Linux 5f1c3589b0f0, the X550 PHY classifier still matches
an alpha silicon ID, while the shared definitions contain the two
production IDs. This can leave production hardware on the generic
probing path and issue unnecessary PHY queries.
(cherry picked from commit 392f0af668)
The 82599 and X540 share the global RSS redirection table between the
PF and its VFs. Programming that table from the PF queue count
prevents a VF from using queue indices absent from the PF layout. A
one-queue PF consequently directs every flow for a two- or four-queue
VF to queue zero.
Program at least four queue indices while SR-IOV is active. Each pool
PSRTYPE.RQPL field masks the shared table to the queue subset available
to that function, so the PF can continue using fewer queues.
(cherry picked from commit 8b668bc7e7)
10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber. Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.
When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence. Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.
Relnotes: yes
(cherry picked from commit f9ce33b0d8)
10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber. The optics must be paired so that
the transmit and receive wavelengths cross over.
MFC after: 2 weeks
(cherry picked from commit 4220b52453)
lacp uses interface speed to separate lacp members into different
aggregation groups. It wants to use the lower 4 bits of the key
to represent the speed. This change fixes a few bugs around that:
1) Actually use the baud rate reported by the interface as the speed
(and fall back to use the baudrate associated with the media if
the interface somehow doesn't support if_baudrate)
2) Compressess the baud rates down to the 4 bits reserved for them.
Using things like FM_400G_FR8 does not fit in 4 bits (its value
is 0x1811) . In fact, interfaces faster than 1Gb/s don't fit in
4 bits using the old scheme
3) Emits a warning on the console once per boot if it encounters a
NIC with an unsupported speed to make it slightly more obvious
why LACP might not behave as expected.
This was prompted by a 400g nic with a broken media detection
reporting "unknown" as its speed, and being unable to be in the
same aggregation group with a different 400g nic that was properly
reporting its speed.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D57026
Reviewed by: slavash
(cherry picked from commit e98ed8d99f)
These are two single-pair Ethernet (SPE) variants that run at 10 Mbps.
10BASE-T1S has automotive origins and supports multiple nodes on up to
25m of cable. 10BASE-T1L is intended for building and industrial
automation and supports long-distance point to point links of over 1km.
Reviewed by: kbowling
Differential Revision: https://reviews.freebsd.org/D56952
(cherry picked from commit a3036edd02)
X550-family devices provide clear-on-read counters for transmit and
receive Low Power Idle events. Accumulate each register once in the
normal statistics poll and expose the monotonic totals below the eee
sysctl node. Document the counters together with the existing EEE
control.
Obtained from: Intel ix 3.4.39
(cherry picked from commit ff86fd4f36)
The VF link-status path can receive 2.5 and 5 Gb/s speed bits from
X550-family PFs, but media reporting has no cases for them. The
bootverbose message also assumes every non-10-Gb/s link is 1 Gb/s.
Expose the corresponding ifmedia subtypes and derive the diagnostic
speed through the shared link-speed conversion helper.
(cherry picked from commit a884921abb)
The flow-control sysctl represents the configured policy, while
current_mode is the mode negotiated with the link partner. Comparing a
new request with current_mode can needlessly reprogram an unchanged
policy or skip a requested policy change that happens to match the
current negotiation result.
Compare with requested_mode before deciding that no update is needed.
(cherry picked from commit c410551b9f)
The generic checksum walker trusts NVM section pointers and lengths and
iterates with a 16-bit index. A corrupt section that crosses the end of
the EEPROM can wrap the index and leave the driver in an effectively
unbounded read loop during attach.
Validate each non-empty section against the discovered EEPROM word size
before reading it, and use widened arithmetic for the inclusive end and
iterator.
(cherry picked from commit be3e1068ea)
missed_rx and total_missed_rx are never populated. As a result, the
GPRC erratum workaround does not remove missed packets and iqdrops
always remains zero. The rx_missed_packets sysctl and input-error total
also expose only MPC bank zero.
Read and accumulate all eight MPC banks. Use the interval total to
correct GPRC and the cumulative total for iqdrops, input errors, and the
aggregate sysctl. This matches DPDK's coverage of the hardware banks.
(cherry picked from commit 660099c985)
sc->max_frame_size represents the largest frame requested by the PF or
an active VF. The MTU callback replaces it with the PF frame size, so
a subsequent reinitialization can program MHADD below an active VF's
jumbo-frame request.
Recompute the aggregate before hardware initialization and use it when
programming MHADD. Recompute after each VF LPE request as well, so a
reduced request can lower the hardware limit when no other function
needs the previous value.
(cherry picked from commit 877f0ee40c)
A PF reset has a warning interval before the hardware reset begins.
Cooperative VF drivers respond to the reset event by stopping and
releasing their receive buffers, but notifying VFs did not stop the
hardware queues. An active VF could therefore DMA through its old
rings into freed mbuf clusters during the warning interval.
Put every enabled VF in reset, drain its PCIe transactions, disable its
queues, wait for receive queue shutdown, and drain transactions again
before tearing down the PF HMC and AdminQ.
Hold VFs in reset again while rebuilding the firmware topology. Release
VF reset before programming the replacement VSI and queue mappings,
since VF reset clears those registers, and publish VFACTIVE only after
reconstruction succeeds. Leave a VF held in reset if rebuilding it
fails.
Fixes: 983e628a0c ("ixl: Rebuild VF resources after a PF reset")
(cherry picked from commit 0048dfddc0)
A PF reset indication leaves IAVF_STATE_RESET_PENDING set while the
VF recreates its AdminQ and negotiates new resources. The ordinary
AdminQ task refuses to consume messages while that state is set.
Consequently, the first DISABLE_QUEUES reply after successful mailbox
rediscovery remains in the receive queue and initialization times out.
Later retries and manual interface restarts repeat the same cycle.
Clear the stale reset indication once VERSION and GET_VF_RESOURCES have
succeeded, before enabling interrupts and resuming normal virtchnl
requests.
(cherry picked from commit 02fbb1ce07)
A PF link event remains cached while a VF is administratively down.
Media status queries called iavf_update_link_status() and published
that cached state as link-up, while the stopped admin path immediately
published link-down. Consumers reacting to link events could turn
this into an unbounded notification loop and prevent interface detach
from draining its link-state task.
Keep the cached PF state, but only publish link-up after iflib has
marked the VF running. A subsequent admin pass publishes the cached
state after a successful initialization.
(cherry picked from commit 46241b7d66)
The hardware identifies each VF with TX and RX malicious-driver
status latches, but the driver combined all events into one counter
and reported only the last VF found.
Consume every PF and VF latch, keep per-direction VF counters, and
rate-limit per-VF diagnostics. Keep the software block until a
successful VF or PF reset reconstructs its resources.
Match Linux i40e policy by leaving a detected VF blocked by default.
Add an opt-in hw.ixl.mdd_auto_reset_vf tunable that notifies and
resets the VF for installations that prefer availability. DPDK
provides the register clear and per-VF attribution precedent; Linux
provides the recovery policy.
(cherry picked from commit 93f1065920)
ixl_if_init() returned early after AdminQ reconstruction, LAA, or
VSI initialization failures. Since IFDI_INIT has no return value,
iflib then marked the interface RUNNING and enabled its interrupts
and timers despite the incomplete hardware state.
Use iflib_init_failed() on each incomplete path. Also stop at the
first ring-enable error and tear down any partially enabled rings
before reporting failure. This keeps the interface stopped and
makes a later initialization attempt start from a bounded state.
(cherry picked from commit f008b582c9)
A PF or EMP reset destroys the firmware switch topology, including
every VF VSI. The driver rebuilt only its PF VSI and left configured
VFs with stale switch element and VSI identifiers.
Notify VFs before a driver initiated reset, recreate the IOV VEB, and
rebuild each configured VF VSI and queue mapping after the PF switch
is restored. Keep a VF out of VFACTIVE if its reconstruction fails
so one failure cannot expose incomplete resources or prevent the PF
and other VFs from recovering.
Invalidate cached VF firmware identifiers and runtime state before
recreating the VEB. If VEB creation itself fails, teardown and mailbox
paths can no longer use pre-reset SEIDs or VSI data.
Factor the common VEB setup out of IOV initialization so initial
setup and post-reset reconstruction use the same topology and filter
sequence.
(cherry picked from commit 983e628a0c)
Add access and trunk VLAN policy to the SR-IOV schema. Access VFs
use a hardware PVID and cannot alter their VLAN membership. Trunk VFs
may register up to 16 VLANs, while VLAN 0 remains implicitly admitted
for untagged and priority-tagged traffic.
Enable hardware VLAN anti-spoofing and maintain the MAC-by-VLAN filter
cross-product used by DPDK. Apply Linux's untrusted-VF limits of 18 MAC
addresses and 16 VLANs so one guest cannot consume the shared PF filter
table without bound.
Document the access and trunk policy in ixl(4).
(cherry picked from commit e2daa5c06c)
pfsync packets were allocated with m_get2(), which can't return packets
larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work.
Use m_get3(), which can allocate sufficiently large mbufs.
Extend the pfsync:bulk test case to provoke this problem.
PR: 297307
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 7e2781fdcf)
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
(cherry picked from commit c08a97fa27)
Treat each stage of VF reset and VSI reconstruction as fallible. Keep
the VF out of VFACTIVE when PCIe drain, reset completion, VSI
release, or VSI allocation fails, following the DPDK PF reset model.
Propagate initial reset failures back through pci_iov_vf_add and unwind
the VF queue allocation.
Free the old software filter list before initializing a replacement VSI.
ixl_init_filters() previously replaced the list head without freeing its
entries, so every VF FLR leaked all MAC and VLAN filter objects. Reset
the associated counters and VLAN bitmap with the list.
Avoid allocating an initial VSI only to destroy it during the required
initial VF reset, and remove redundant broadcast/filter programming from
VSI setup. Also delete a partially created VSI when later Admin Queue
setup fails.
(cherry picked from commit ee52b925fa)
Bound variable-length virtchnl messages before computing their expected
length, following the newer Intel virtchnl implementation.
Validate VF ring sizes and alignments before programming HMC contexts.
DPDK uses 128-byte ring alignment and 64 through 8160 descriptors;
the virtchnl ABI further specifies TX multiples of 8 and RX multiples
of 32. Preserve the 4096-descriptor limit on X722.
Validate queue bitmaps before changing any rings, validate all queue
and interrupt contexts before applying a request, and reject invalid
RSS table entries. Also avoid sending an ACK after VLAN-strip setup
fails and reply to delete-VLAN errors with the correct opcode.
These checks prevent malformed or oversized requests from an untrusted
VF from partially programming resources outside its allocation.
(cherry picked from commit e779914354)
The VF array is zeroed at allocation, but its sysctl contexts were
only populated after each VF was successfully added. If VF setup
failed, IOV teardown still passed every requested VF context to
sysctl_ctx_free(). An untouched context is not an initialized empty
TAILQ and caused a page fault during teardown.
Initialize every VF context with the array so both successful setup
and partial-failure cleanup have a valid lifetime.
(cherry picked from commit ae122c5443)
iavf uses descriptor writeback by default. Hardware writes completion
status into a transmit descriptor only when it completes a descriptor
marked RS. iavf marked every packet RS even though its report-status
queue recorded and inspected only descriptors selected by iflib. The
other completion writes could not help reclaim descriptors.
iflib marks selected packets with IPI_TX_INTR as completion
checkpoints. It forces a checkpoint as deferred work or ring pressure
grows. Retain EOP on every packet, but set RS only at those
checkpoints.
The deprecated head-writeback option on 700-series VFs gets the same
batching: each RS checkpoint permits hardware to publish the completed
ring head.
DPDK uses the same sparse RS design. Let iflib choose the adaptive
interval for FreeBSD. This is a PCIe/memory bandwidth savings.
(cherry picked from commit 8eb4403e9d)
ixl uses head writeback by default. Hardware publishes the transmit
ring head through DMA only after completing a descriptor marked RS.
Marking every packet requested much more frequent head updates than
iflib needs to reclaim descriptors.
iflib marks selected packets with IPI_TX_INTR as completion
checkpoints. It forces a checkpoint as deferred work or ring pressure
grows. Retain EOP on every packet, but set RS only at those
checkpoints. This batches head writebacks while preserving bounded
descriptor reclamation.
The optional descriptor writeback mode benefits as well. ixl already
recorded only IPI_TX_INTR descriptors in its report-status queue, so
status written for every other packet was not inspected.
DPDK uses the same sparse RS design. Let iflib choose the adaptive
interval for FreeBSD. This is a PCIe/memory bandwidth savings.
(cherry picked from commit dd32931271)
A PF reset or loss of virtchnl service can make visible interface
initialization wait up to ten seconds and then return from the void
ifdi_init callback. Iflib consequently marks the interface running even
though its queues were not initialized, and no retry is scheduled when
the PF returns.
Check reset readiness without polling during reinitialization, propagate
queue-message submission errors, and bound a silent enable or disable to
one mailbox timeout. Report unsuccessful initialization to iflib and
publish link-down state without polling the stopped mailbox.
A VFLR also discards the Admin Queue and permits the PF to replace the
VF VSI. Track when full virtchnl rediscovery is required, renegotiate the
API version, refresh and validate the VF resources before using a cached
VSI ID, and replay the MAC and VLAN filters cleared by reset. Bound each
runtime discovery attempt while preserving the existing attach-time wait.
While the VF remains administratively up, retry complete
initialization after 250 ms, one second, four seconds, and then at a
capped eight-second interval.
(cherry picked from commit e9a4d3969a)
The 82542-specific setup routine unconditionally reads the NVM
default, overwriting a flow-control mode selected by software. It
also removes transmit PAUSE support from all 82542 revisions even
though the hardware restriction applies only to rev 2.0.
Resolve the NVM default only when requested, scope the transmit
restriction to rev 2.0, and replace integer bit masking of the enum
with explicit valid mode transitions. This restores the behavior
from before the Intel shared-code split and resolves -Wassign-enum.
Reported by: glebius
(cherry picked from commit 2f1d9ab962)
The primary and mirror-VSI ifdi_init callbacks can return early when
reset state or hardware queue and filter setup prevents initialization.
Iflib then marks the interface running and enables interrupts although
the driver did not finish bringing it up.
Report each non-detach failure through iflib_init_failed(). Keep the
existing ice reset and subinterface-reinitialization machinery
responsible for scheduling recovery.
(cherry picked from commit dcdc00a41d)
HWRM failures currently return from the void ifdi_init callback.
iflib then marks the interface running and enables interrupts despite an
incomplete ring or VNIC setup.
Move the hardware setup into an error-returning helper. The ifdi_init
wrapper can report failure through iflib_init_failed(), while firmware
recovery can propagate the same error through bnxt_open(). Also clear
the initialized state after partial setup is torn down.
(cherry picked from commit cb0e8f5fb6)
PSRTYPE is indexed by pool in VMDq+RSS mode, and its RQPL
field selects the number of receive queues available within the pool.
The PF occupies the last pool, but the driver programmed pool zero and
left the PF RQPL value at zero. As a result, all PF receive traffic
was directed to its first queue while SR-IOV was enabled.
Program PSRTYPE for the PF pool and encode its allocated receive queue
count.
(cherry picked from commit 49f9143d9a)
A failed VF reset or mailbox API negotiation currently returns from
the void ifdi_init callback. Iflib then marks the interface running
even though ixv left its adapter stopped. Stopped media queries can
continue polling the PF, and no timer remains active to retry when the
PF returns.
Track mailbox readiness and report unsuccessful initialization to
iflib. Stopped admin and media-status passes now publish cached
link-down state without touching the mailbox. While the VF remains
administratively up, retry complete initialization after 250 ms, one
second, four seconds, and then at a capped eight-second interval.
Preserve the requested MAC across reset, then program it once after
mailbox API negotiation. The previous two pre-reset requests each
could wait a full mailbox timeout after an established PF disappeared,
holding the iflib context lock for about two seconds before the reset
handshake.
Avoid a redundant VF reset in the stop half of an immediate iflib
reinitialization. Also remove the stop-time RAR mailbox request: reset
has already discarded CTS at that point, and successful initialization
restores the current address. Retain a reset for an ordinary
administrative stop when the mailbox was established.
(cherry picked from commit 0e56ccb5d8)
PFVFRSSRK contains ten 32-bit RSS key words, numbered 0 through 9.
The previous inclusive range incorrectly ended at 10.
Sponsored by: BBOX.io
(cherry picked from commit f177ff939a)
E610 Hyper-V VFs use PCI configuration space communication instead of
the native PF/VF mailbox. The generic E610 match currently attaches
native mailbox operations to those devices, and the imported Hyper-V
subdevice identifier is incorrect.
Correct the subdevice identifier to 0x00ff, as used by DPDK shared
ixgbe code, and reject that subtype until ixv has a complete Hyper-V
operations table.
Sponsored by: BBOX.io
(cherry picked from commit 08c41a679b)
The ifdi_init method cannot report an error, so iflib always marks an
interface running and enables its interrupts after the callback returns.
Drivers whose hardware initialization depends on an unavailable peer can
only return early and leave a falsely running interface.
Add iflib_init_failed() so a callback can leave the interface stopped.
Also add a conditional reset request for asynchronous recovery: it is
discarded if the interface is administratively down when the admin task
runs, preventing a queued retry from resurrecting a stopped interface.
Do not restore saved driver flags after an MTU or capability change when
initialization failed. Restoring the pre-init flags would overwrite the
stopped result with stale RUNNING state.
Document that reset requests require the caller to schedule the admin
task, that output remains blocked during recovery, and that iflib rather
than the driver owns the driver flags.
(cherry picked from commit 9328a7eedb)
ixv uses one queue set on 82599 and X540 VFs and assumes two on
X550-family VFs. The PF reports the queues assigned to each VF with
GET_QUEUES after mailbox API 1.1 negotiation.
Query the PF during attach. Bound symmetric iflib queue sets by the PF
grant and available MSI-X data vectors. Retain one queue set per data
vector: ixgbe VFs expose at most three vectors and one is reserved for
the mailbox. The hardware permits each pool to use a subset of its RSS
queues, so a two-queue ceiling is valid when the PF assigns four.
This enables the second data vector on 82599 and X540 while avoiding an
assumed second queue when an X550-family VF is granted only one. Keep
the existing family limits if the mailbox is unavailable or the PF uses
an older API.
(cherry picked from commit 98fad621ed)
PTHRESH controls when the device prefetches transmit descriptors,
HTHRESH controls how many host descriptors must be ready, and WTHRESH
controls completion writeback batching.
iflib places RS on selected descriptors and reclaims through those
checkpoints. The data sheets require WTHRESH to be zero when software
uses RS. Clear WTHRESH while retaining the established PTHRESH 32 and
HTHRESH 1 fetch policy.
This also follows DPDK in pairing sparse RS descriptors with
WTHRESH zero. DPDK defaults to 32/0/0, while Linux ixgbevf uses
32/1/8. The 32/1/0 setting preserves FreeBSD's prefetch policy and the
data-sheet requirement that HTHRESH be nonzero when PTHRESH is used.
(cherry picked from commit 0baf0fabdb)
The transmit-ring setup was copied from the e1000 path. On I225
and I226, bits 22 through 24 are reserved and bit 25 enables the
queue; it is not a legacy low-water threshold. Correct the field
masks, remove the nonapplicable legacy definitions, and program only
defined fields.
Use PTHRESH=8 and HTHRESH=1. Keep WTHRESH at zero so the hardware
honors sparse RS descriptors issued by iflib. Linux and DPDK use a
writeback threshold of 16, but request status on every packet. A
nonzero threshold makes hardware ignore individual RS bits and is
unsuitable for the iflib completion model.
The receive-ring setup likewise used a magic mask that left bit 20
of the five-bit WTHRESH field untouched. Define the receive threshold
fields and replace them exactly before installing the established
PTHRESH=8, HTHRESH=8, WTHRESH=4 policy.
(cherry picked from commit e2aff50727)
82576 specification-update erratum 26 says MSI-X EITR expiration can
fail to trigger receive descriptor writeback. A WTHRESH above one can
therefore leave received packets invisible until the threshold fills.
The shared threshold macros selected policy by enum ordering, so an
82576 VF fell into the generic WTHRESH=4 case. VFs always use MSI-X
and require the same WTHRESH=1 workaround as the PF.
Use PTHRESH=8 for 82575 and 82576 PFs and VFs, matching DPDK and the
current Linux PF driver. The legacy FreeBSD PF and Linux igbvf value
of 16 thrashes limited descriptor cache; no specification or erratum
requires it. Retain the i354 PTHRESH=12 exception.
Enumerate every supported igb PF and VF MAC type so each receives its
intended policy. Also clear every threshold bit before installing the
new values. The old mask retained the high WTHRESH bit, and 82575
uses six-bit fields while later controllers use five-bit fields.
(cherry picked from commit bd4182a2c9)
Commit 98b95af873 accidentally applied abe22383f1 a second
time after its complete MFC in 0817452623. It added a duplicate
em_integrated_jumbo_rx() definition and broke the build.
Revert only the duplicate application. The original MFC remains in
place.
This reverts commit 98b95af873.
iflib requests transmit completion status only on selected descriptors.
Program a zero writeback threshold so igb hardware honors those sparse
RS bits instead of writing back every descriptor in threshold-sized
batches.
Use the existing family specific prefetch threshold: eight descriptors
on most controllers and 20 on I354, with a host threshold of one. These
values match the Intel-derived Linux and DPDK drivers. Their nonzero
writeback settings are not appropriate here because those drivers set
RS on every packet.
A zero writeback threshold also avoids depending on interrupt timer
flushes affected by 82576 specification update erratum 26. Remove the
old IGB_TX_WTHRESH macro as well. It has had no callers since the iflib
conversion, so its 82575 conditional no longer implements any policy.
(cherry picked from commit fddc393d93)
Jumbo receive tuning on integrated controllers enabled PTHRESH without
a nonzero HTHRESH, contrary to the hardware programming requirements.
It also covered only the integrated MAC generations present when the
workaround was added. Enumerate every jumbo-capable ICH and PCH type
and program PTHRESH=3 with HTHRESH=1. Linux fixed the same HTHRESH
omission in b701cacdbcfb.
The 82574 path combined threshold values with the reset values using
bitwise OR. Requesting WTHRESH=4 while the reset value was one thus
programmed five. Clear the complete threshold fields before installing
the established PTHRESH=32, HTHRESH=4, WTHRESH=4 descriptor-granularity
policy.
(cherry picked from commit abe22383f1)
Jumbo receive tuning on integrated controllers enabled PTHRESH without
a nonzero HTHRESH, contrary to the hardware programming requirements.
It also covered only the integrated MAC generations present when the
workaround was added. Enumerate every jumbo-capable ICH and PCH type
and program PTHRESH=3 with HTHRESH=1. Linux fixed the same HTHRESH
omission in b701cacdbcfb.
The 82574 path combined threshold values with the reset values using
bitwise OR. Requesting WTHRESH=4 while the reset value was one thus
programmed five. Clear the complete threshold fields before installing
the established PTHRESH=32, HTHRESH=4, WTHRESH=4 descriptor-granularity
policy.
MFC after: 2 weeks
(cherry picked from commit abe22383f1)
TXDCTL programming is family dependent. 82543 erratum 35 and
82544 erratum 20 require WTHRESH to remain zero; a nonzero value
can corrupt descriptor writebacks and hang the controller. Leave all
descriptor-control thresholds at their reset values on 82542, 82543,
and 82544.
On the remaining em controllers, retain the established PTHRESH=31,
HTHRESH=1, WTHRESH=1, and descriptor granularity policy. Several
legacy specification updates identify full descriptor writeback as a
workaround for transmit descriptor-queue errata.
TXDCTL bit 22 is also family dependent. It is COUNT_DESC on the
82571 family and 80003ES2LAN. Intel shared initialization explicitly
sets raw bit 22 on both transmit queues of every supported ICH/PCH
generation, although the integrated public documentation marks it
reserved. Preserve that required setting when iflib programs the
thresholds, as DPDK does. Clearing it caused a persistent I219
transmit stall under descriptor pressure.
The combined em/igb setup also wrote LWTHRESH=1 on every em
controller. The driver does not enable the TXD_LOW interrupt
controlled by that field. Enumerate every supported em MAC type and
leave the unused low-water threshold disabled.
This keeps the legacy descriptor-writeback safety policies separate
from igb sparse-RS operation while programming only the fields
appropriate to each family.
(cherry picked from commit 66baeec9f8)
The shared ixgbe transmit path already creates SCTP context
descriptors, and the hardware exposes the same checksum capability to
VFs. Advertise it through iflib as the PF driver does.
(cherry picked from commit 4a13b8a7c5)
The flow_control and hdr_split variables have never been read. VF
flow control is controlled by the PF, while implementing header split
would require receive-path support that ixv does not provide.
(cherry picked from commit 8eeb25899a)
The iflib Flow Director path does not assign filters using the
absolute queue and pool identifiers required by SR-IOV. Reject the
combination during preflight validation rather than allowing an
unsupported configuration to alter the PF receive path.
The loader tunable is fixed before VFs can be created, so validation
also prevents the reverse ordering of this combination.
(cherry picked from commit c017bceda4)
The aggregate VF mailbox poll includes only VFs whose driver
configuration completed. A configured VF slot whose vf_add callback
failed can nevertheless report reset, request, or acknowledgement
events. Because the mailbox handler skips inactive entries, such an
event remains latched and can retrigger administrative work
indefinitely.
Build the poll masks from every configured VF index and consume reset,
message, and acknowledgement events for inactive entries without
treating them as usable VFs. Use the index rather than the pool because
early vf_add errors precede pool initialization. Also include E610
PFVFLREC in aggregate reset sampling.
(cherry picked from commit 5017a241b9)
The iflib conversion records link-status interrupts in the
administrative request mask, but the administrative task did not
consume them. Timer polling usually hid the omission; frequent mailbox
interrupts could continually rearm that timer and leave cached link
state down after hardware recovered.
Claim request batches atomically, process link-setup dependencies, and
sample hardware before publishing link state. Bound each invocation to
eight batches and requeue residual work so a continuous producer cannot
monopolize the admin taskqueue.
Queue every link-related request from the legacy interrupt path.
Unlike MSI-X, its threaded continuation services RX and does not enqueue
the admin task. This restores the event-driven behavior of ix-3.4.39.
Fixes: b2c1e8e620 ("ix(4): Run {mod,msf,mbx,fdir,phy}_task in if_update_admin_status")
(cherry picked from commit 2b763a82f9)
A PF can be resetting, handling a slow link event, or deliberately
withholding mailbox CTS while its VFs enumerate. Keep the VF attached
when the reset handshake is temporarily unavailable so a later if_init
can retry.
Never leave VF hardware running without a negotiated mailbox API: start
hardware only after reset succeeds, stop it when negotiation fails in
attach or init, and defer later recovery through iflib. This prevents a
tight reset loop while preserving recovery when the PF returns.
(cherry picked from commit 26e3a8045e)
Completion queues are allocated by attach_pre but released by
queues_free. An iflib failure between those stages leaks the allocation,
while the original size expression also underallocates the array.
Move completion queue allocation into the TX queue callback, correct its
size, and unwind it with TX state if RX allocation fails. Make interrupt
cleanup tolerate an unavailable array and reuse the array allocated
during device initialization instead of replacing and leaking it.
Release the DMA, multicast, and lock resources owned by a successful
attach_pre during detach. Avoid allocating the statistics DMA area a
second time near the end of attach_pre.
(cherry picked from commit a97e1c2450)
DMA channels are allocated by attach_pre but released by queues_free.
When iflib fails after attach_pre and before queue allocation, neither
the old detach nor queues_free path releases them.
Allocate channels with the TX queue state and make queues_free tolerate
partially allocated rings. Use it to unwind allocation failures so TX
rings are also released when RX allocation fails.
An early detach can also precede PHY initialization and interrupt
assignment. Skip absent PHY and channel state, and release the locks
owned by attach_pre on both failure and detach.
(cherry picked from commit 65228a8352)
A PCI function can provide a host bridge into a synthetic PCI domain.
Intel VMD does this: the host facing VMD function remains in its
original domain while the hidden Root Ports and endpoints appear in a
separate domain. The VMD function's Device Control does not describe
an upstream link in that synthetic hierarchy.
The hierarchy wide cold pass incorrectly used the VMD function's MPS
to reprogram the hidden ports and their endpoints. Stop both cold
reconciliation and runtime path walks at a PCI domain boundary. The
real Root Ports within the VMD domain continue to reconcile their
endpoints normally.
Reviewed by: imp
Tested by: Michael Butler <[email protected]>
Fixes: 8e9fe9996a ("pci: Reconcile MPS before attaching PCIe devices")
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58837
(cherry picked from commit 57293f4541)
Stop VF transmit and receive in hardware, clear PF-side mailbox CTS,
and notify active VFs before resetting a PF. A PF reset invalidates VF
queue state, so the no-CTS control message makes cooperative VFs
discard stale state and renegotiate after the PF returns.
The hardware queue gates synchronously prevent further VF DMA. Do not
hold the exclusive iflib context lock for a fixed VF-watchdog interval
after the reset. Report the PF link transition directly instead of
dispatching mailbox work from the stop path, which could otherwise
re-enable VF I/O mid-reset.
The CTS, PF-control, and VF queue controls follow the reset mechanisms
used by DPDK.
(cherry picked from commit aea4240ef5)
The shared maximum frame size is raised by VF LPE requests, so it
cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo
restriction. Consult the PF ifnet MTU instead.
Also correct the API 1.1 and later comparison so a jumbo VF is enabled
when, and only when, the PF itself uses a jumbo MTU. This matches the
policy implemented by DPDK.
(cherry picked from commit 2a803e6f34)
ixgbe_stop_mac_link_on_d3_82599() implements the workaround for
82599 erratum 33. It forces incompatible auto-negotiation settings
before the device enters D3, and reset clears them when returning to
D0.
ixgbe_if_stop() is also used for ordinary interface reconfiguration
and recovery. Those paths do not enter D3 and should not program
this power-management workaround. They continue to stop the adapter
and disable the transmit laser.
Move the call to ixgbe_setup_low_power_mode(), after
ixgbe_if_stop(). This preserves the required ordering for detach,
shutdown, and suspend while avoiding the D3 settings during ordinary
restarts.
(cherry picked from commit d025b84268)
When link polling loses mailbox clear-to-send or times out, request an
iflib reset instead of continuing with stale VF state.
The driver callback runs after iflib samples reset requests, so requeue
the admin task to make iflib consume the request on its next pass
rather than waiting for an unrelated timer or interrupt.
(cherry picked from commit 2a2867c89a)
A guest can reinitialize after a VF function-level reset and
repeatedly strand an 82599 or X540 PF with invalid descriptor DMA
targets. Count only distinct Received Master Abort events accepted by
the qualified transmit-stall detector and quarantine the VF after five
events.
Preserve quarantine across PF reinitialization, reject reset mailbox
requests, and keep transmit, receive, and clear-to-send disabled.
Recreating SR-IOV clears quarantine. Expose the affected pools through
a read-only bitmap.
After a successful quarantine FLR, leave the function in post-FLR
configuration, explicitly keep decode and bus mastering disabled,
verify the Command register, and refresh its PCI-layer cache so a later
restore cannot re-enable the function.
This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure
policy to X540 as defense in depth; the CVE does not list X540. Intel
documents the 82599 issue in:
http://iommu.com/datasheets/ethernet/controllers-nics/intel/ixgbe/Intel_82599_Application_Note_655276.pdf
Security: CVE-2021-33061
(cherry picked from commit 31285bddf2)
82599 and X540 lack the X550 malicious-driver detector. Detect a VF
whose PCI status reports a received master abort while its transmit
ring has outstanding descriptors and makes no progress across
consecutive samples.
Consume the accepted PCI status latch, gate that VF I/O, and recover
one pending VF per task pass with round-robin selection. This prevents
an unreadable function from starving detection or recovery of other
VFs.
Save the complete writable VF PCI configuration before FLR, restore it
afterward, and verify the hardware-backed Command state. Preserve the
first good snapshot and pending state across reset events until restore
and verification succeed.
Introduce a common I/O-disabled policy bitmask so later quarantine
policy can extend traffic gating without duplicating fault-state
checks.
(cherry picked from commit fe02e14c88)
A VF's pci_devinfo references its PF's pcicfg_iov for resource
bookkeeping, but only the PF implements the SR-IOV capability.
pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as
an owned capability and accessed the PF capability offset in VF
configuration space. Saving a VF could therefore replace the shared
PF settings with unrelated VF register values.
Skip SR-IOV capability save and restore for PCICFG_VF children. The
generic PCI and PCIe state of the VF remains preserved. This is also
required by drivers that save VF state around a PF-driven
function-level reset.
(cherry picked from commit 78547d542f)
PFQDE is indexed by absolute receive queue, but the driver programs one
index per VF. Only the first quarter or half of the VF queues therefore
have queue-drop isolation, depending on the virtualization mode. The
flow-control path can also clear those bits even though SR-IOV requires
them independently of the PF pause policy.
Program every queue in a VF pool before enabling receive for that VF.
For an X550-family VF with an administrative port VLAN, also hide the
VLAN tag as the hardware requires. Keep PF flow-control changes
confined to the PF SRRCTL registers, and clear the VF queue settings
when SR-IOV is torn down and the queues can be reassigned to the PF.
(cherry picked from commit 4383ab82b0)
The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.
Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.
Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
mailbox interrupt edge, while suppressing already-fenced pools. Latch a
PF reset request until the next hardware initialization.
The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue
bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS,
which has reserved-zero bits, also reads as all ones and confirms dead
MMIO.
Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates,
which hardware otherwise reports as queue-context changes. Serialize
that window with the iflib context lock and resample pending work after
MDD is restored.
Apply the per-pool recovery model used by igb(4) in a2ed165f00 to the
existing DPDK-derived X550 hooks. The same register interface is
documented for X552 and X553, so cover the entire X550 family. Document
that VF traffic remains disabled until the reset handshake completes.
Relnotes: yes
(cherry picked from commit dda6a00a52)
The 82599, X540, and X550 documentation identifies VF registers which
retain state across VFLR and must be reconfigured before a VF is reused.
The VF reset path already initializes its queue-owned registers, but the
PF only cleared VF mailbox memory and transmit head write-back addresses
after a cooperative mailbox reset. A bare hardware VFLR therefore left
both behind on affected devices.
Move TDWBA cleanup into the common reset path. Clear CTS when VFLR
invalidates the mailbox session, and accept only VF_RESET during the
reset pass before restoring VF traffic.
Clear VFMBMEM through the PFU/VFU semaphore. Recheck VFREQ while
holding PFU so a reset event cannot erase a request posted between the
initial mailbox check and the clear. Dispatch an already-read message
even if the residual clear fails, but keep cleanup pending until a
synchronized clear succeeds. Retry cleanup in the same admin pass
after a failed message read or clear.
The 82599 also retains VFMAILBOX.VFU across VFLR. Leave a VF-owned
mailbox intact initially so a live post-reset writer can finish. Retry
cleanup from the admin timer and, after a two-second grace period, use
PFMAILBOX.RVFU only when VFU remains set and no request has been posted.
Clear the mailbox under PFU afterward. This recovers an abandoned
pre-reset owner without sleeping under the iflib context lock or
immediately stealing from a new reset request.
Suppress mailbox dispatch once iflib has cleared IFF_DRV_RUNNING so a
pending reset request cannot re-enable VF traffic inside the PF stop
path. Periodically sample aggregate VFREQ, VFACK, and VFLR registers,
masked to active VFs, so work suppressed across a stop/restart and a
bare 82599 VFLR without EICR_MAILBOX are both discovered without another
interrupt edge.
(cherry picked from commit 33fdcdb18e)
A deterministic IOV configuration error currently reaches the driver
only after iflib has stopped the PF. The required cleanup restart then
causes an avoidable carrier flap.
Follow the igb pattern and validate the request in the PCI IOV method
before entering the restart transaction. Reject queue layouts wider
than the selected virtualization pool before they can alias unrelated
82599 registers.
(cherry picked from commit 703c756a2d)
The IOV callback changes the PF pool, virtualization mode, and hardware
queue indices while iflib still considers the old queue layout live.
Teardown likewise leaves the software pool and mode at their SR-IOV
values.
Use iflib stop/mutate/restart transactions for both transitions.
Disable VF DMA and PCI VF Enable before queue reuse, let outstanding
transactions drain, and restore the non-IOV pool and queue indices on
teardown.
Remove the redundant driver-local pci_iov_detach() wrapper; iflib
already performs that check centrally before the driver detach
callback.
It may be possible to avoid some restart in the future on this hardware
pausing DMA and remapping rings but not pursued yet.
(cherry picked from commit 86199f1a74)
Keep warn-only behavior as the default. Add an opt-in policy that
clears endpoint decoding and bus mastering when a newly discovered
function cannot match its active path, while never disabling bridge
functions and their subtrees.
(cherry picked from commit 114f4a68f2)
Add a boot-time ceiling for MPS reconciliation. Apply it only while an
entire cold-enumerated link can be configured consistently, and leave
an established active path unchanged.
(cherry picked from commit 673cb5265a)
Reconcile each newly enumerated link as a unit before child drivers
attach. Firmware may leave Bus Master Enable set after handoff, so use
the bus attachment state rather than that bit to identify the cold
phase.
Preserve an established hierarchy during rescan and hot-add. Refuse a
reduction below a switch because recursive enumeration may already have
made a sibling subtree live; lowering only the local port or Root Port
would produce an inconsistent path. Report capability and active-use
conflicts distinctly.
Handle OFW PCI buses that clone the generic enumeration path.
MFC after: 2 weeks
(cherry picked from commit 8e9fe9996a)
The PCI bus changes live capability registers after the initial
configuration snapshot has been saved. A later driver reprobe restores
that snapshot and can silently undo the adjustment.
Update the cached Device Control and Root Control bits together with
pcie_adjust_config() writes. Route the persistent Maximum Read Request
setter and the bus-owned AER control changes through that helper as
well, so they share the same restore semantics as MPS reconciliation.
Document the persistent-write contract. Merge only explicitly adjusted
bits into the saved image so unrelated or transient bits observed during
the hardware read-modify-write cannot become persistent.
(cherry picked from commit a9752e9ac8)
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b9db5a5b16)
Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.
During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).
Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.
Signed-off-by: Sujithra Periasamy <[email protected]>
Reviewed by: markj
MFC after: 1 week
Sponsored by: Google
Differential Revision: https://reviews.freebsd.org/D58696
(cherry picked from commit 36d57489ca)
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
(cherry picked from commit 196874ce2e)
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
(cherry picked from commit 3c8f8432b6)
This function is supposed to wait until all pending callbacks have been
executed. This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.
The implementation schedules a callback on each CPU and waits for them
all to run. This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed. This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.
Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order. However,
ck_epoch_poll_deferred() may determine that it is safe to execute
callbacks from epoch - 1 (or even from the current epoch if there are
no active readers), and in this case it will push those callbacks onto
the returned stack. This means that epoch_call_task() will invoke those
newer destructors before the older ones, which means that
epoch_drain_callbacks() may return early.
Fix the correctness problem by simply doing all of this twice: once the
first callback is invoked, we know that all of the callbacks that were
pending at the time that epoch_drain_callbacks() was called are
scheduled to be executed, so when the second callback is executed we
know that they must be finished. This is slow, but it is already slow,
and the slowness is less noticeable after commit dce5659499.
I note that in an ideal world, this function would not exist, and all of
the teardown would happen asynchronously, rather than the current
mismash of synchronous and asynchronous cleanup.
PR: 290201
Reviewed by: glebius
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58030
(cherry picked from commit 7bf11a2f0c)
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
(cherry picked from commit 8616b7dc38)
Some downstream projects (e.g. ElectroBSD) have removed the TIOCSTI
We already have some components (such as mail and tcsh) that build
without TIOCSTI defined. This is (existing portability support in those
projects.
Simplify things for downstreams by extending this approach to this
additional TIOCSTI user.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D50614
(cherry picked from commit 52a2b4bc5d)
(cherry picked from commit b1bb3aa65c)
The eXpat project has changed maintainers since this section was written
in 2002. Update it to reflect reality.
Discussed with: Sebastian Pipping <[email protected]>
Reviewed by: bcr
Differential Revision: https://reviews.freebsd.org/D58835
(cherry picked from commit 5e6c894510)
uart(4), unix(4) and the gzero(4) MLINK are not USB things, but they
were in the .if ${MK_USB} != "no" block. So if we build with
WITHOUT_USB, these man pages are lost. Move them out of the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9)
Panther Point changed the reset value of CTRL_EXT.DPG_EN to enable
autonomous power gating. Clear it after hardware reset on Panther Point
and Nova Point controllers to prevent unexpected Tx/Rx hangs, packet
loss, or corruption.
(cherry picked from commit 0979b0430c)
Fix a typo in the ZFS multi_dataset_4 test, where a path separator was
missing.
Reported by: markj
MFC after: 1 week
(cherry picked from commit 889d08f6b6)
Track RERC separately instead of adding receive errors to the collision
count, and read the previously omitted RXERRC register. Include RFC in
input errors because CRCERRS does not count bad-CRC runts, implementing
the I225 length-error accounting workaround alongside RUC and ROC.
Stop treating host transmit MAC discards as receive errors. Expose both
RERC and HTDPMC as dedicated MAC statistics so their overlapping counts
remain available without corrupting aggregate interface counters.
(cherry picked from commit a108ee9138)
Borrow the e1000 VLAN filter table
Ambiguous presence of the feature by Intel was settled by DPDK and
emperical testing.
Relnotes: yes
(cherry picked from commit 8f779f159e)
I225 v1 cannot receive the minimum inter-packet gap required at
2.5 Gb/s. For affected back-to-back links, Intel recommends using a
15-byte transmit IPG instead of 12 bytes.
Program TIPG.IPGT to 0xb for pre-v2 I225 devices at 2.5 Gb/s and
restore the default at lower speeds. Avoid penalizing fixed I225 and
I226 parts.
(cherry picked from commit 709426551c)
Some devices remap the PF queues when entering or leaving SR-IOV. Add
opt-in PCI IOV helpers that hold the iflib context lock across the
complete stop, driver callback, and restart transaction.
Existing drivers continue to use the non-restarting helpers.
Sponsored by: BBOX.io
(cherry picked from commit f8fa2d77bc)
The management_pkts_drpd sysctl was wired to MNGPTC, making it an
alias of management_pkts_txd, instead of MNGPDC.
(cherry picked from commit 435cde959c)
ixgbe_if_stop() disables the transmit laser on every 82599 SFP fiber
port, but the iflib initialization path did not re-enable it. Re-enable
the laser before deferred SFP module setup so interface
reinitialization cannot leave either single-speed or multispeed optics
dark.
The hardware wrapper is a no-op when laser control is unavailable. The
placement follows Intel ix-3.4.39; this version deliberately applies to
every SFP port affected by the stop path.
(cherry picked from commit 545779a992)
Drivers which remap PF queues need a stop/mutate/restart transaction
only when the interface has live queues. Permit their IOV
initialization callback while the interface is administratively down
and leave it down afterward.
This restores the standard boot-time iovctl.conf workflow and
lets other opt-in drivers configure VFs before netif brings the PF up.
(cherry picked from commit 2cf580c694)
Intel 82599 supports FLR on VFs but reports FLR support only in the PF
Device Capabilities register. The VF register therefore leaves the FLR
Capable bit clear, and pcie_flr() rejects the reset.
Intel documents the zeroed VF PCIe capability structure as erratum 35
in the 82599 Specification Update (B0=Yes; NoFix).
Add a positive FLR quirk for the 82599 VF. Keep the capability check
for every other function, so an unknown nonconforming VF cannot make
pcie_flr() report success when its reset request was ignored.
SR-IOV requires VFs to support FLR, but a clear capability bit cannot
distinguish the 82599's misadvertisement from a VF that fails to
implement it.
(cherry picked from commit ee776a8e29)
The VF Device Control MPS and MRRS fields are reserved and preserved.
VF transactions use the PF MPS, so a hardwired VF value must not be
used to retune the shared PCIe hierarchy.
Document the previously undocumented tuning knob and clarify why a VF
may continue to display its reserved hardwired value.
This fixes an instant crash/reboot on my Zen3 system with 82599 VFs.
(cherry picked from commit 5aab616416)
VLAN registration callbacks only update the software shadow, leaving
the PF unaware until a later full initialization. Initialization then
retries each failed request in a tight loop, while skipping replay
entirely when local hardware filtering is disabled.
Send additions and removals as soon as the desired state changes,
independent of the VF local-filter capability. Replay the desired
memberships after reset and retry a bounded batch per timer tick. Stop
after the first failure so a silent PF can consume only one mailbox
timeout per pass, while a responsive PF can drain several requests.
Treat the retry window as a no-progress deadline: advance it when
pending work succeeds so a large backlog can drain, but leave entries
dormant after a sustained failure.
A successful mailbox request wakes a dormant backlog. Dispatch
timer-driven retries only while iflib marks the VF running, so a stale
timer tick cannot restore PF VLAN state after the stop path resets the
VF.
Because the callbacks now update the PF or retain failed work for
retry, do not restart the VF for VLAN configuration changes. This
avoids resetting and flapping the interface for every VLAN addition or
removal.
Also keep receive VLAN stripping synchronized in both the enabled and
disabled cases.
Adapt the bounded VLAN reconciliation scheme from igb VF commit
fdce3830d9 to the ixgbe VF mailbox.
(cherry picked from commit 9d871fa96a)
The PF advertises the legacy SET_MACVLAN mailbox request but always
rejects it. The request installs secondary unicast addresses.
Allocate an owned RAR pool for VF secondary addresses, reserve low
entries for PF filters, and place VF-primary addresses at the top of
the usable RAR range. Reject address collisions and cap each VF at
three secondary filters so one guest cannot exhaust the shared table.
Clear secondary filters on VF or PF reset and on SR-IOV teardown. This
hardware can anti-spoof only the VF primary source address. Reject
secondary filters while MAC anti-spoofing is configured, so installing
them requires an explicit administrative policy choice. Report optional
filter-table allocation failure without disabling SR-IOV.
Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in
a2ed165f00 to DPDK's ixgbe SET_MACVLAN mailbox semantics.
Relnotes: yes
(cherry picked from commit 6404ef10d6)
The allow-promisc IOV property is advertised but ignored, and the PF
rejects the xcast request used by modern VFs. Negotiate mailbox APIs
1.2 and 1.3, implement pool-scoped xcast modes, and require
allow-promisc for requested all-multicast or unicast-promiscuous modes.
The VF mailbox can carry only 30 multicast hashes. When ixv has a
larger list, request the API 1.2 all-multicast xcast mode instead of
extending the legacy SET_MULTICAST message. The PF grants that fallback
only to VFs configured with allow-promisc; otherwise ixv reports that
only the first 30 addresses are active.
Reset xcast state with the VF and have ixv replay the mode implied by
its interface flags after multicast updates.
Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc
policy adapted from igb(4) in a2ed165f00.
Relnotes: yes
(cherry picked from commit 660ea2c4da)
VID 0 carries only 802.1p priority and does not identify VLAN
membership. Keep VFTA bit zero in the persistent PF shadow table so
reset and SR-IOV replay admit priority-tagged frames while VLAN
filtering is enabled.
In virtualization mode, also reserve VLVF slot zero and restore PF and
eligible VF pool memberships. A VFTA hit alone admits the tag globally
but does not deliver it to the correct pools.
This matches the priority-tag treatment in em/igb.
(cherry picked from commit caa08ed331)
The VF VLAN capability is checked but never granted, and no SR-IOV
configuration property exposes the existing default-VLAN support. PF
VLAN updates also replace VFTA registers from a PF-only shadow, erasing
live VF filters.
Expose access VLAN and trunk policy through the IOV schema. Track each
VF VLAN as desired state, restore the administrative VLAN after reset,
and use the native VLVF helper for incremental PF and VF ownership
changes.
Keep VLAN filtering enabled while SR-IOV is active. When PF hardware
filtering is disabled, admit every VLAN to the PF without bypassing
per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and
VF desired state after reset or a filtering-mode transition, and
restore PF-only state on teardown.
When the last VF leaves a VLAN still owned by the PF, free its VLVF
slot while retaining the shared VFTA bit. This prevents a trunk VF from
exhausting the 64-entry VLVF table by cycling VLAN memberships.
Adapt the VLAN ownership model introduced for igb(4) in a2ed165f00 to
ixgbe's native VLVF machinery.
Match Linux receive semantics by exposing a stripped VLAN tag only
when that VID was registered by the VF. A PF-assigned port VLAN is an
administrative tag and must be delivered to the VF as untagged traffic;
otherwise the stack dispatches it to a nonexistent VLAN interface and
access-VLAN receive traffic is blackholed.
Relnotes: yes
(cherry picked from commit a81f97aecb)
The SR-IOV schema advertises MAC anti-spoofing and enables it by
default, but the VF configuration was never consumed and the hardware
policy remained disabled.
Record the configured policy and apply MAC and VLAN anti-spoofing
throughout VF initialization and reset. On X550-family devices, also
protect the LLDP and flow-control Ethertypes and enable per-VF
spoof-event accounting. Remove the driver-owned state during SR-IOV
teardown.
Adapt the anti-spoof configuration lifecycle used by igb(4) in
a2ed165f00 to the ixgbe hardware controls.
Relnotes: yes
(cherry picked from commit 7d3d630939)
The MTA is shared by the PF and all VFs. The VF mailbox handler only
ORs new bits, so hashes survive list removal and VF reset. Conversely,
PF multicast updates replace the whole table with PF-only state and
discard live VF filters.
Rebuild the table from the PF list and every active VF whenever either
changes. Clear VF multicast state during reset and PF reinitialization,
and remove all VF hashes on SR-IOV teardown. Keep the software shadow
and multicast control state synchronized, and avoid writes to unchanged
MTA registers.
Adapt the aggregate desired-state rebuild introduced for igb(4) in
a2ed165f00 and its write-elision scheme from 350211ab17 to ixgbe's
shared MTA.
(cherry picked from commit 1a180b4c86)
The shared VF set-RAR helper restores hw.mac.addr when the PF rejects a
requested address, but ixv ignores the error and leaves the interface
link-layer address unchanged. Subsequent initialization repeats the
rejected request while the interface appears to use an address the PF
will not deliver.
Refresh the permanent address returned by the PF after every successful
reset handshake. Copy the resulting PF-approved address back to the
interface and emit the normal link-layer address notification without
re-entering the driver initialization path. This also recovers from a
prior mailbox transport failure or a PF-side reassignment.
Adapt the igb VF address reconciliation added in a6bb3850e7.
(cherry picked from commit 4c03feacd1)
The VF admin vector carries both link and PF mailbox causes, but the
filter schedules the admin task only for link-status changes. Defer
administration for every interrupt so reset and control notifications
are serviced promptly.
(cherry picked from commit 5e05c40aff)
Struct ifnet contains an array if_afdata of AF_MAX pointers to address
information for each possible address family. Since 2013, when AF_MAX
was inadvertently changed to be equal to the highest possible value,
instead of one more than the highest possible value, this array has been
too small in theory, but this never mattered in practice because the
higher address families were not assignable to interfaces.
My recent commit which corrected the value of AF_MAX had the side effect
of breaking the KBI by changing the size and layout of struct ifnet.
This manifested itself as kernel panics when using third-party network
drivers and went unnoticed in main because if_afdata no longer exists
there. Address the issue for stable/15 and stable/14 by keeping the
correct value of AF_MAX but deliberately making if_afdata off by one,
restoring its previous size.
Fixes: ddd850aa77 ("sys/socket.h: Fix AF_MAX")
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58840
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa77 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D58827
(cherry picked from commit 79a6ad63e6)
Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one. Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.
Fixes: ddd850aa77 ("sys/socket.h: Fix AF_MAX")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: pouria, kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58826
(cherry picked from commit 6c41d928bc)
Just like vmxnet3_intr_disable_all, iflib may invoke this routine
before vmxnet3_attach_post() has run, which is before the top-level
shared data area is initialized and the device made aware of it.
PR: 294312
Sponsored by: Dell Inc.
(cherry picked from commit 01b0690c49)
igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.
Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.
Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.
While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
Differential Revision: https://reviews.freebsd.org/D58629
(cherry picked from commit 30ccf2f48c)
Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.
The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.
While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
Differential Revision: https://reviews.freebsd.org/D58628
(cherry picked from commit abdde8b602)
* On SIGINFO, print the current path to stderr rather than stdout.
* Do so immediately, instead of the next time we finish a directory.
* Document this behavior in the manual page.
PR: 296861
MFC after: 1 week
Fixes: d1588599c0 ("Report the next directory being scanned ...")
Reviewed by: wollman
Differential Revision: https://reviews.freebsd.org/D58702
(cherry picked from commit fd79bf6344)
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
(cherry picked from commit 4ebcdb8dd9)
pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.
PR: 297220
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit d2a5b5a86a)
It's possible for interface groups to not have had a pfi_kkif assigned to
them, so before we pass that pointer to pfi_kkif_update() we must check if it's
actually set.
We've seen panics such as this, where we get an address update for an interface
that belongs to a group without associated pfi_kkif:
Tracing pid 12 tid 100034 td 0xfffff80100d2a000
kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340
panic() at panic+0x43/frame 0xfffffe0067eed3a0
trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0
calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0
--- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 ---
pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500
pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550
pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0
srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610
in6_update_ifa() at in6_update_ifa+0xd52/frame 0xfffffe0067eed790
in6_ifadd() at in6_ifadd+0x29a/frame 0xfffffe0067eed8b0
nd6_ra_input() at nd6_ra_input+0xf65/frame 0xfffffe0067eeda90
icmp6_input() at icmp6_input+0x3c8/frame 0xfffffe0067eedc10
ip6_input() at ip6_input+0xa15/frame 0xfffffe0067eedcf0
sppp_input() at sppp_input+0x502/frame 0xfffffe0067eedd80
pppoe_data_input() at pppoe_data_input+0x1e7/frame 0xfffffe0067eeddf0
swi_net() at swi_net+0x128/frame 0xfffffe0067eede60
ithread_loop() at ithread_loop+0x239/frame 0xfffffe0067eedef0
fork_exit() at fork_exit+0x7b/frame 0xfffffe0067eedf30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0067eedf30
Note that pf doesn't assign pfi_kkif objects to groups created before pf has
fully started (see V_pf_vnet_active check in pfi_attach_group_event()), which is
one possible way for this to happen.
Reported by: garga
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit dc0cf0648c)
When we run 14.X jail on 15.X host system previous implementation could
not correctly detect 32-bit KBI due to jails can overwrite osreldate.
Add special handling for this case and use detection using
IP_FW_DUMP_SOPTCODES and IP_FW_XGET sockopts version.
Reported by: Vova Grebenschikov
Fixes: 704ec5e68c
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D56616
Google Cloud recommends migrating from gsutil to gcloud storage CLI.
Update gce-do-upload target to use `gcloud storage buckets create` and
`gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands.
PR: conf/297016
(cherry picked from commit 4174cc2f69)
X550-family malicious-driver detection validates the transmit
context selected by a data descriptor with Check Context set. ixgbe
sets that bit on every transmit data descriptor, but ordinary PF
packets without a VLAN or checksum offload do not create a context
descriptor. The empty context then reports an invalid MAC-header
length and blocks the PF queue as soon as MDD is enabled.
Create the existing context descriptor for every PF packet while
SR-IOV is active. This supplies the required MAC-header length and
keeps MDD from mistaking normal PF traffic for a malicious-driver
event.
(cherry picked from commit 0787b1f5b8)
During flag inconsistency report, we handle rai->rai_otherflg
as a bool, but the value is 0x40. Make it a simple number comparison.
PR: 295995
Reviewed by: markj, Faraz Vahedi <[email protected]>
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58672
(cherry picked from commit 200de1b70e)
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5)
VF reset and FLR do not clear the transmit head write-back address
registers. A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.
After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF. Derive the queue
count from the active IOV mode so peer queue state is not touched.
Linux commit dbf231af81a7 documents the hardware behavior. The FreeBSD
implementation follows the local queue mapping and register interfaces.
(cherry picked from commit 6f940ca879)
E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation. Dispatch through the EEPROM
operation table so device overrides are honored.
Initialize the generic operation for devices that use the ordinary
EEPROM representation.
Obtained from: Intel ix 3.4.39
(cherry picked from commit 9cf1aa6e68)
The host-interface polling loop was scaled from milliseconds to
microseconds, but its terminal test was left using the unscaled timeout.
Completion at that intermediate iteration can be reported as a timeout,
while actual expiry is not recognized and can accept stale status.
Test against the scaled loop bound used by the polling loop.
Fixes: f46d75c90f ("ixgbe: improve MDIO performance by reducing semaphore/IPC delays")
(cherry picked from commit db2bf4553c)
Clear ROMPE for an empty list and enable it only for a nonempty list.
FreeBSD already clears ROMPE when resetting a VF, so that part of the
DPDK change is not needed.
DPDK commit message
net/ixgbe: fix over using multicast table for VF
VMOLR.ROMPE allows a VF to receive packets matching the shared multicast
table. Leaving it enabled after the VF removes its last multicast
address lets PF or peer-VF table entries continue selecting that VF.
Signed-off-by: Wei Zhao <[email protected]>
Acked-by: Qi Zhang <[email protected]>
Obtained from: DPDK (dc5a6e7422)
(cherry picked from commit 786c71845f)
The GET_QUEUES handler switches on msg[0], which contains the mailbox
command rather than the negotiated API version. It therefore cannot
reject API 1.0 or an unnegotiated VF as intended.
Switch on the API version stored for the VF.
(cherry picked from commit 8d1d32942b)
A VF that sends a non-reset request before completing reset negotiation
has not received CTS. The PF ignores the request but currently reports
success, leaving the VF with a false view of the programmed state.
Return failure for the ignored request. This restores the behavior lost
when the mailbox helpers were renamed.
Fixes: 36c516b311 ("ixgbe: update if_sriov to use the new mailbox apis")
(cherry picked from commit 9fc83caf48)
pause_time is promoted to signed int before multiplication. Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.
Make the multiplier unsigned so the calculation has the intended u32
semantics. Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction. The 82598-specific flow
control operation contains the identical expression, so correct it as well.
(cherry picked from commit 35374c3ec6)
ixgbe_host_interface_command() treats its buffer as a u32 array. The
local union contained only byte-sized fields, giving it one-byte stack
alignment and allowing unaligned accesses on strict-align systems.
Add a u32 member to the union to provide the required alignment and
pass that member to ixgbe_host_interface_command().
No functional change is expected on x86.
Obtained from: Intel ix 3.4.39
(cherry picked from commit 8fa2a75034)
FreeBSD's I2C helper already retries failed transactions. Limit this
new outer loop to successful reads with an invalid identifier so that
retry budget is not multiplied.
DPDK commit message
net/ixgbe: retry misbehaving SFP read
Some XGS-PON SFPs ACK I2C reads and return uninitialized data while
their microcontroller boots. A bogus identifier can cause an otherwise
working module to be marked unsupported.
Retry the identifier read several times, checking for both successful
I2C completion and a valid SFP identifier.
Signed-off-by: Stephen Douthit <[email protected]>
Signed-off-by: Jeff Daly <[email protected]>
Reviewed-by: Haiyue Wang <[email protected]>
Obtained from: DPDK (774263bb4e)
(cherry picked from commit 985bef0c44)
DPDK commit message
net/ixgbe/base: fix unchecked return value
Check the return value from ixgbe_read_eeprom() before using the
control word to configure link disable during D3.
Fixes: b7ad3713b958 ("ixgbe/base: allow to disable link on D3")
Cc: [email protected]
Signed-off-by: Barbara Skobiej <[email protected]>
Signed-off-by: Anatoly Burakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (eb3684b191)
(cherry picked from commit a859814380)
DPDK commit message
net/ixgbe: fix flow control frame byte adjustment
LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and XOFF
packets. Their deltas are summed and used to adjust the transmitted
packet and byte counters.
Perform the addition in 64 bits so it cannot wrap before the result is
used for the byte adjustment.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: af75078fece3 ("first public release")
Cc: [email protected]
Signed-off-by: Daniil Iskhakov <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (bdf8608559)
(cherry picked from commit 21e03ab396)
DPDK commit message
net/ixgbe/base: add missing buffer copy for ACI
Add the missing buffer copy in ixgbe_aci_send_cmd().
The retry path saves the original descriptor and allocates storage for
the command buffer so both can be restored before another attempt. It
did not copy the original command buffer into that storage.
Fixes: 25b48e569f2f
Cc: [email protected]
Signed-off-by: Dan Nowlin <[email protected]>
Signed-off-by: Yuan Wang <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
Obtained from: DPDK (37239792b0)
(cherry picked from commit e45178957d)
if_foreach_llmaddr() adds each callback return value to its running
count. Returning the incremented count made the address indices grow
as 0, 1, 3, 7, and so on, eventually writing beyond the multicast
address array.
Return one address per callback and stop copying when the array is
full, matching the ixv-1.6.12 driver.
Fixes: ff06a8dbb6 ("Mechanically convert ixgbe(4) to IfAPI")
(cherry picked from commit 6020de5ad1)
The active PF mailbox operations use the legacy helpers. The mailbox API
import changed check_for_msg into a read-only probe and added up to 2,000
500-microsecond lock retries. If a VF leaves VFU set, the PF cannot acquire
the lock, busy-waits for up to one second, and leaves VFREQ pending so the
delay can repeat.
Give the legacy checker its old consume-on-check behavior so a failed read
does not leave VFREQ asserted. If VFU is already set, fail immediately
instead of retrying, while preserving retries for PF-side contention. Do
not force RVFU, which would discard peer transaction state.
(cherry picked from commit 2a678cfeb5)
A VF currently treats an existing VFU bit as a successful acquisition,
while the PF checks its own PFU bit before claiming the mailbox. Check
both the local and peer ownership bits before setting local ownership.
This prevents same-side callers from sharing the mailbox and avoids an
acquisition attempt while the peer owns it.
VFLR does not clear VFMAILBOX.VFU. Clear stale VF ownership and cached
mailbox status after the reset indication settles and before sending the
reset request, so the ownership check cannot strand a reinitialized VF.
Adapt only the live ownership checks from Intel ix 3.4.39. Do not import
its upgraded-mailbox changes, which are not active in FreeBSD.
Obtained from: Intel ix 3.4.39
(cherry picked from commit 409601911b)
IXGBE_VF_INDEX() selects a 32-VF register bank. PFMBMEM() selects
one mailbox per VF, while ixgbe_toggle_txdctl() calculates queue
offsets from a VF number. Passing the bank index aliases VF1-31 to
VF0 and VF32-63 to VF1. Resetting one VF can therefore clear the peer
mailbox and leave its transmit queues disabled.
The VF raises its reset event before posting its mailbox request. The
PF checks reset events before mailbox messages. If both are pending,
clearing PFMBMEM during generic reset handling can erase the request
before ixgbe_read_mbx() consumes it. Clear the mailbox only from the
reset-message handler after the request has been read.
Use the VF number for queue toggling and document that API contract.
(cherry picked from commit 4b67335676)
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
on init
Signed-off-by: Michael Adler <[email protected]>
PR: 279245
Reviewed by: Jim Thompson
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2318
(cherry picked from commit 9d30fd353d)
Some conventional PCI e1000 configurations hang when given DMA
addresses above 4 GB, particularly on systems using AMD
HyperTransport-to-PCI bridges. Linux has restricted e1000 to DMA32 in
PCI mode since 2011 for the same failure class in commit
e508be174ad36b0cf9b324cd04978c2b13c21502.
Set iflib's DMA width after determining the negotiated bus type. This
covers descriptor and packet-buffer mappings while preserving 64-bit
DMA for PCI-X and PCIe devices and providing a conditional tunable.
PR: 297064
Reported by: Alexander Leidinger <[email protected]>
Tested by: Alexander Leidinger <[email protected]>
(cherry picked from commit 4175949576)
The function create_staticobj() is only used inside this translation unit.
Clang produces a -Wmissing-prototypes warning during standard buildworld.
This warning will become a fatal compile error if MK_WERROR is enabled for hardened builds.
PR: 285870
Fixes: ee9ce1078 ("libc: tests: add some tests for __cxa_atexit...")
Signed-off-by: Zhang Qiyue <[email protected]>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2321
(cherry picked from commit 64038db825)
The files were incorrectly reporting 3.5.1 instead of 3.0.21.
This is a direct commit to stable/14 as stable/15 and later are on
OpenSSL 3.5.
PR: 297144
Fixes: d03be8cf ("crypto/openssl: make vendor imports easier/less error prone")
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146.
MFC after: 1 second
(cherry picked from commit ca0cff7932)
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e4562 (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
(cherry picked from commit ddd850aa77)
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
(cherry picked from commit b9d07a4308)
Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have. Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.
Reported by: Joshua Rogers <[email protected]>
Tested by: Décio Brandão (0xDBJ)
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58555
(cherry picked from commit e004ff15f8)
- if ! git diff --exit-code --ignore-matching-lines "^.Dd" share/man/man5/src.conf.5; then printf "\n>>> src.conf.5 was not updated as required <<<\n"; false; fi
- if grep -q "no description found" /tmp/makeman.out; then printf "\n>>> Missing description files <<<\n"; false; fi
local cfile ofile ddep odep dflags exe exstatus pid retval status
exstatus=0
retval=0
@@ -45,6 +45,28 @@ runtest()
esac
exe=${TFILE%.*}.exe
cfile=${TFILE%.*}.c
ddep=${TFILE%.*}.d
ddep=${ddep#tst.}
if[ -r "$cfile" -a -r "$ddep"];then
# The tst.xxx.c corresponding to the tst.xxx.d is usually
# (cross-)compiled on the build host and installed in the target
# system as an executable. However, when there is an associated
# xxx.d file to be included in that executable, we must compile
# xxx.d in the target system at runtime because DTrace currently
# doesn't support cross-compilation and will always use the build
# host's ELF format when calling `dtrace -G`.
# TODO add support for cross-compilation in DTrace and move it back
# to dtrace.test.mk.
ofile="${cfile%.c}.o"
odep="${ddep%.d}.o"
dtrace -C -x nolibs -h -s "$ddep"
cc -O0 -g -I. -o "$ofile" -c "$cfile"
dtrace -C -x nolibs -G -s "$ddep""$ofile"
cc -O0 -g -I. -o "$exe""$ofile""$odep"
rm -f "${ddep%.d}.h""$ofile""$odep"
fi
if[ -f "$exe" -a -x "$exe"];then
./$exe&
pid=$!
Loaded 100 of 3770 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Albin Hellqvist