igc: additionally disable PCIe ASPM for I226
Always disable PCIe ASPM for i226 type cards to improve stability
and wire sysctl calls to iflib_request_reset instead of igc_if_init
as this will stall the drivers RX path.
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
(cherry picked from commit 4a28d390f5fbae2483e88805559881b04ccf9a80)
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[9 lines not shown]
coredump: Don't assume that the number of ELF segments is consistent
In an ELF coredump, each dumped vm_map_entry is represented by a
segment. __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.
each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls. If the map is shared with another
process, via rfork(), then the map can change. cb_put_phdr() did not
account for this, and so could write out of bounds.
Add a check to prevent this; simply do not write out excess segments.
Approved by: so
Security: FreeBSD-SA-26:55.elf
Security: CVE-2026-58088
Reported by: Maik Muench of Secfault Security
[3 lines not shown]
sysvsem: Fix a TOCTOU race in semctl({GET,SET}ALL)
These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock. A comment explains why this is (probably) safe. Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped. This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.
Replace the assertions with runtime checks.
Approved by: so
Security: FreeBSD-SA-26:54.sysvsem
Security: CVE-2026-58087
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58421
wg(4): Add a test that the driver handles a decryption failure
The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel. The driver should then fail to
respond to the ping and increment the input error counter on the
interface.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
wg(4): Check for crypto operation errors
In particular, handle authentication errors due to bad MACs when
decrypting packets.
Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous. Software sessions are always synchronous in practice, so
this should be a nop.
Approved by: so
Security: FreeBSD-SA-26:52.if_wg
Security: CVE-2026-58085
Reviewed by: markj
Sponsored by: Chelsio Communications
[IR][NFC] Remove unused helpers for inserting dbg intrinsics (#212304)
As a result of the almost complete transition from debug intrinsics to
debug records, a few functions are now unused in the public API. This
patch removes those.
[RISCV] Update TTI for llvm.experimental.cttz.elts (#214795)
This implements the CostModelling in the RISCV-TTI as discussed in:
https://github.com/llvm/llvm-project/pull/184578
It takes the legalization and non-boolean element-type lowering into
account, instead of falling back to the generic BasicTTIImpl path. This
now gets rid of the assertion-crash mentioned on the original PR.
[AMDGPU][NFC] Pre-commit test for eliminateFI SVS fallback path crash. (#215180)
On a flat-scratch target, a frame index used by a VALU instruction
reaches the generic SGPR-scavenging path in
`SIRegisterInfo::eliminateFrameIndex`. When the function has a frame
register but no SGPR is free for the scavenger, control enters the
branch that assumes no frame register exists (the flat-scratch SVS /
fatal-error fallback), whose guard `assert(!FrameReg && "there is a
frame register!")` then fires.
This PR got a test that catches the above mentioned crash!
---------
Co-authored-by: Christudasan Devadasan <christudasan.devadasan at amd.com>
[Verifier] Reject an empty non-'distinct' !llvm.access.group node (#214703)
visitAccessGroupMetadata misses one case: a node that is empty but not
'distinct'. It is not a valid access group, and the list loop runs zero
times, so nothing is reported:
store double %v, ptr %q, !llvm.access.group !0
!0 = !{}
That IR reaches addToAccessGroupList(), which reads a node with no
operands as an access group and trips its isValidAsAccessGroup() assert.
Check the operand count first, so an empty node must be 'distinct'. Two
tests used !{} as an access group and now use distinct !{}.
Unlocks #214509
[AMDGPU] Add custom lowering of llvm.convert.to.arbitrary.fp for FP8 (#213813)
Lower ISD::CONVERT_TO_ARBITRARY_FP to the packed hardware conversions on
subtargets that have the OCP fp8 formats.
An f32 source becomes V_CVT_PK_FP8_F32 or V_CVT_PK_BF8_F32. An f16
source becomes V_CVT_PK_FP8_F16 or V_CVT_PK_BF8_F16, which only gfx1250
and later have. A scalar conversion converts one lane and leaves the
other unused, a v2 conversion fills both lanes of the packed result.
Assisted-by: Claude-Opus-5
pf: attempt to handle overlapping group and interface names
pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.
PR: 297220
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)
pf: check if a group has a kif before dereferencing it
It's possible for interface groups to not have had a pfi_kkif assigned to
them, so before we pass that pointer to pfi_kkif_update() we must check if it's
actually set.
We've seen panics such as this, where we get an address update for an interface
that belongs to a group without associated pfi_kkif:
Tracing pid 12 tid 100034 td 0xfffff80100d2a000
kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340
panic() at panic+0x43/frame 0xfffffe0067eed3a0
trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0
calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0
--- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 ---
pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500
pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550
pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0
srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610
[20 lines not shown]
pf: attempt to handle overlapping group and interface names
pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.
PR: 297220
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)
pf: check if a group has a kif before dereferencing it
It's possible for interface groups to not have had a pfi_kkif assigned to
them, so before we pass that pointer to pfi_kkif_update() we must check if it's
actually set.
We've seen panics such as this, where we get an address update for an interface
that belongs to a group without associated pfi_kkif:
Tracing pid 12 tid 100034 td 0xfffff80100d2a000
kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340
panic() at panic+0x43/frame 0xfffffe0067eed3a0
trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0
calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0
--- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 ---
pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500
pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550
pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0
srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610
[20 lines not shown]
