security/vuxml: add FreeBSD SAs issued on 2026-08-25
FreeBSD-SA-26:56.hwpmc affects all supported releases
FreeBSD-SA-26:57.unix affects 15.0R and 15.1R
FreeBSD-SA-26:58.sound affects all supported releases
FreeBSD-SA-26:59.mac_do affects 15.0R and 15.1R
FreeBSD-SA-26:60.ppp affects all supported releases
FreeBSD-SA-26:62.tty affects all supported releases
FreeBSD-SA-26:63.posixshm affects all supported releases
igc: Restore the watchdog event counter
The MFC of the fatal memory-error recovery dropped watchdog_events from
the softc. The driver still increments it, includes it in
IFCOUNTER_OERRORS, and exports it as the watchdog_timeouts sysctl.
Fixes: ee9bbfca423f ("igc: Recover from fatal internal memory errors")
iflib: Allow conditional LED device support
A driver class may implement LED control even though the capability is
not available on every device or firmware version it supports. Add an
optional capability method and consult it before creating the led(4)
device. Default to supported so existing providers are unchanged.
This will be used by bnxt which blends PF and VF in the same driver.
(cherry picked from commit 2519e19f05e0c3e5925bf81b729b4c28f2ad1af6)
igc: Report corrected internal ECC errors
I225 and I226 do not interrupt for corrected internal ECC errors.
Instead, the DMA packet buffer and PCIe memories expose sticky status
bits in PBECCSTS and PCIEECCSTS.
Sample these bits with the regular hardware statistics update, preserve
the PBECCSTS ECC enable state while clearing its RW1C indication, and
expose separate counters for the DMA packet buffer, PCIe transmit-data
memory, and PCIe retry buffer.
These counters represent observed indications rather than an exact error
count because multiple corrections between samples collapse into one
sticky status bit.
Hardware validation used an I225-IT (rev 3) and a debug kernel that
wrote only the documented self-clearing injection bits. Each test
armed the injector, exercised the owning RAM with traffic, and compared
the corresponding counter before and after.
[15 lines not shown]
igc: Recover from fatal internal memory errors
I225 and I226 report uncorrectable internal memory errors through
ICR.FER and identify the affected region in PEIND. Depending on the
region, hardware stops transmit or all PCIe and DMA traffic until the
port is reset and reinitialized.
Enable the fatal error interrupt and capture its read clear status in
the interrupt filter. Mask the cause while an iflib reset is pending,
report the affected memory regions, and expose per region indication
counters.
PCIe region parity failures require a different recovery order from a
normal reset: assert DEV_RST, wait at least 3 ms, disable PCIe master
requests, clear PCIEERRSTS, and then reinitialize the port. Follow that
sequence before entering the normal reset path and clear the remaining
LAN status afterward.
The I225/I226 PBECCSTS layout is unrelated to the PCH layout previously
[21 lines not shown]
ixgbe: Defer E610 thermal shutdown to iflib
The E610 firmware event handler invoked ixgbe_if_stop() directly from
IFDI_UPDATE_ADMIN_STATUS(). This reset the device without the iflib
queue lifecycle and left the interface marked running after its hardware
was stopped.
Request an iflib reset instead. Fail the automatic initialization once
so the reset transaction stops the interface and publishes that state.
A later operator-requested initialization remains possible, matching the
previous recovery policy without bypassing iflib.
(cherry picked from commit 3aac283613bd3fd0228a06d6c854ca0bf190ecfb)
ixgbe: Defer firmware recovery transitions to iflib
The firmware-mode callout invoked ixgbe_if_stop() directly. This
performed a full device reset without the iflib context lock or the
iflib queue lifecycle. It could also poll the E610 firmware command
interface from callout context while identification was active.
Request an iflib reset from the callout instead. Reject initialization
while firmware recovery remains active. This leaves the interface
stopped and lets iflib publish that state. Request initialization when
firmware exits recovery so an administratively-up interface can recover
without operator intervention.
(cherry picked from commit 43aa553ef45a4345bdfabadae40d811730151144)
ixgbe: Defer ECC recovery to iflib
The link interrupt filter performed a full hardware reset in interrupt
context. This bypassed iflib stop and initialization, including queue
quiescence and restoration of temporary LED state.
Record the ECC event in the administrative request mask and ask iflib
to perform the reset from its taskqueue. Keep the ECC cause masked
until reset so the intermediate admin pass cannot re-enable a sticky
condition. Handle ECC independently of Flow Director and in legacy
interrupt mode.
Remove the redundant EICR write; the filter has already cleared the
reported causes. Also remove the accompanying complement-mask update
of mac.flags. It set every flag except DOUBLE_RESET_REQUIRED and had
no place in ECC recovery.
(cherry picked from commit c28f2c551daf07345ac78b74459efe1014c49464)
ixl: Add led(4) identification support
Expose each physical port identification LED through /dev/led/ixl*.
Use the existing GPIO LED helpers for most devices and the PHY
provisioning interface for X710 10GBASE-T adapters.
Preserve and restore the original GPIO or PHY indication mode,
including before the interface is stopped.
(cherry picked from commit 8b2e75970c0328e7397290417cc06e9d9c763d2a)
ixgbe: Add led(4) identification support
Expose the physical port identification LED through /dev/led/ix*.
Save and restore the NVM-selected LEDCTL value around each request.
The X550 operations also clear their PHY manual override before the
register is restored.
Use the dedicated firmware port-identification command on E610. Its
interface selects between firmware blinking and the original mode
rather than directly controlling LEDCTL.
Restore the normal indication before a device stop or reset.
(cherry picked from commit fb7e249ce4fd03fe53e4407efe661f9e94852bb6)
igc: Remove invalid debug ring pointer iteration
The debug routine reads queue registers by queue index. It also
advanced unused pointers to rings embedded in queue structures. Those
pointers had the wrong stride and could proceed beyond the ring object.
Remove the unused pointer arithmetic.
(cherry picked from commit 423927d6c3dc87628fc2a19f25b5b5c07b3b73e2)
e1000: Fix the multiqueue debug register dump
The debug routine advanced ring pointers as if rings were contiguous.
They are embedded in queue structures, so rings beyond queue zero had
the wrong stride. The bogus queue index could cause an invalid MMIO
read and panic the machine.
Index the queue arrays first and then select the embedded ring.
(cherry picked from commit 7dd826171b69a01c234ba6e9117917398ba2705e)
e1000: Identify SerDes adapters with LED blink
The generic LED on and off operations do not handle internal SerDes
media, leaving the led(4) device ineffective on my I210 fiber port.
Use the hardware blink operation for the on phase on internal SerDes.
The off phase restores the saved OEM LED configuration as before.
(cherry picked from commit 28f96cc3748fc46408cc6ab6172f09bc2182cad7)
igc: Add led(4) identification support
I225 and I226 expose three programmable LED outputs. Use LED1 for
adapter identification, following the convention in DPDK. Preserve the
OEM configuration across identification requests.
Restore the OEM configuration before a device reset so an active led(4)
pattern cannot leave the output overridden across stop or detach.
The LED mode values follow the Intel I225 Software User Manual.
(cherry picked from commit 19f75b38199b9d30e85fab83e61ff36b0b9ed015)
igb(4): Document identification LED device nodes
The shared em(4) manual page lists only the em device-node name.
Document the /dev/led/igb* name as well.
(cherry picked from commit fc0e6adb9d26f94616db5357afcbb585e4176c6d)
ixgbe: Defer firmware recovery transitions to iflib
The firmware-mode callout invoked ixgbe_if_stop() directly. This
performed a full device reset without the iflib context lock or the
iflib queue lifecycle. It could also poll the E610 firmware command
interface from callout context while identification was active.
Request an iflib reset from the callout instead. Reject initialization
while firmware recovery remains active. This leaves the interface
stopped and lets iflib publish that state. Request initialization when
firmware exits recovery so an administratively-up interface can recover
without operator intervention.
(cherry picked from commit 43aa553ef45a4345bdfabadae40d811730151144)
