arm64 pmap: demote L3C pages in pmap_clear_modify()
When pmap_clear_modify() demotes a dirty L2 block mapping, it write
protects the L3 entry that maps "m", so that a subsequent write access
may repromote. However, since fd6cb031f577, the L3 entries created by
pmap_demote_l2_locked() may have ATTR_CONTIGUOUS set, and
pmap_clear_modify() was write protecting one L3 entry within an L3C page
while leaving the page's other L3 entries writeable with ATTR_CONTIGUOUS
still set. A TLB entry that a processor creates from any of those other
L3 entries may translate "m"'s virtual address and permit writes to "m"
without a fault. To fix this issue, as in pmap_remove_write(), demote
the L3C page before write protecting the L3 entry.
Found by: Claude Code (Opus 5.5)
Fixes: fd6cb031f577 "arm64 pmap: Add ATTR_CONTIGUOUS support [Part 1]"
MFC after: 1 week
ice: Restart disabled VF Tx queues from saved configuration
DPDK iavf's per-queue stop/start operations send DISABLE_QUEUES followed
by ENABLE_QUEUES without another CONFIG_VSI_QUEUES. Disabling an ice Tx
queue removes its hardware scheduler leaf, so acknowledging ENABLE alone
cannot restart it. Clearing the configured bitmap also prevents the VF
from requesting this sequence.
Track saved configuration separately from active Tx queues. Retain ring
parameters and queue handles on disable, and recreate only the selected
inactive queues on enable. Share the existing Tx context builder between
initial VSI configuration and per-queue restart. Keep the initial
Tx-at-CONFIG behavior and the existing dense-prefix CONFIG validation.
Track cleanup progress per queue and publish valid configuration only
after both Tx and Rx configuration succeed. If an enable fails, undo its
partial setup before permitting a retry. Retain hardware ownership when
cleanup fails and reject another enable of that queue rather than
silently acknowledging it. A failed post-add rollback without a software
[12 lines not shown]
vfs: Avoid integer overflow when faulting
In vn_io_fault1(), the read / write length can easily exceed INT_MAX.
Passing it directly to uiomove(), which expects an int, results in a
negative uio_resid, which to the caller looks like we read more than
was requested.
PR: 298159
MFC after: 1 week
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59412
pkt-gen: fix UDP checksum when IPv6 address ranges are used
update_ip6() left the UDP checksum stale for most packets. Unlike
update_ip(), it computed the incremental checksum delta only after the
source-address wrap, so every earlier "break" (port increment, address
increment, and both random paths) returned with udp_sum still 0 and no
correction applied. The trailing delta block also re-read oaddr/naddr
after they had been reassigned, so the source and destination deltas
could not both be accounted for.
Fold each delta in with new_udp_sum() before the corresponding break,
mirroring the structure update_ip() already uses, and drop the stale
trailing block. IPv4 was not affected.
Verified by driving update_addresses() directly and recomputing every
checksum from scratch over the real pseudo-header: 128 packets across
six range configurations, 12 mismatches before, 0 after. IPv4 passes
both before and after.
Submitted by: Olivier Cochard-Labbé <olivier at cochard.me>
fwohci: fix LPS delay, PHY_INT storm, and SID timeout recovery
Fixed the post-LPS delay from 500us to the IEEE 1394a-2000 s6.1 mandated
10ms ceiling. Handled PHY_INT by clearing W1C status bits in register 5
(masked ISBR to avoid spurious bus resets). Added a SID timeout callout
that recovers the state machine when a remote device fails to complete
self-ID. Fixed FW_PHY_SPD operator precedence and gated noisy messages
behind bootverbose/firewire_debug.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58033
(cherry picked from commit 4b3d035668211c19fc6fd5d4d207c2e8f96e7ad3)
fwe: add missing net epoch around ether_input
Wrap the if_input() call in fwe_as_input() with NET_EPOCH_ENTER/EXIT.
The network stack requires epoch protection when delivering packets
via if_input, and fwe was missing it.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57459
(cherry picked from commit a620746da173d1583b342b096419297e33d0ed15)
sdhci: don't infer a non-removable slot on Apollo Lake SDXC
Intel Apollo Lake SDXC controller reports a Slot Type of
"Embedded Slot for One Device" in SDHCI_CAPABILITIES bits, even
when the slot is a removable card reader.
This caused 48 timeouts before the boot sequence resumed.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58467
(cherry picked from commit 248d537e4ca7295a08bab60e82633d332d36e525)
fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path
M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.
xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.
Reviewed by: zlei, adrian
Differential Revision: https://reviews.freebsd.org/D57495
(cherry picked from commit 22ddc9eb1d7a4fffe78b0692bdc4ec03e1d04ac4)
ietp: guard iicbus_get_addr with devclass check
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58432
(cherry picked from commit 3fbffbcbec88932d7c7b024aca5a1e26a36f13a4)
acpi: parse resources of not-present devices that are kept enabled
acpi_probe_child() keeps PCI link devices, the RTC,
and docking stations enabled even when _STA reports them not present,
but skipped acpi_parse_resources() for them. With an empty resource
list, resource-based hint matching (BUS_HINT_DEVICE_UNIT) cannot wire
such a device to its hinted unit, and the hinted ISA device is then
created as a duplicate.
Modern AMI firmware reports the PNP0B00 RTC as not present while
handing timekeeping to the ACPI Time-and-Alarm device.
Reviewed by: adrian, jhb
Differential Revision: https://reviews.freebsd.org/D58047
(cherry picked from commit 21bc31ce2e4a7106ec352c9e30fc6d948b881653)
ichsmb: add Ice Lake-LP (0x34a3) and Ice Lake-N (0x38a3) SMBus device IDs
Add PCI device IDs for two Ice Lake PCH SMBus controller variants:
- 0x34a3 (Ice Lake-LP), previously listed as the generic "Ice Lake" entry (ID_ICELAKE), renamed to ID_ICELAKELP for clarity.
- 0x38a3 (Ice Lake-N), a separate PCH variant not previously supported.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D56732
(cherry picked from commit 081d3ab24e03d271a0de3b173802fbe71f52e8aa)
usbdevs: Add USB device IDs for Nuand bladeRF SDR
Add vendor and product IDs for bladeRF family of USB software defined radios manufactured by Nuand LLC.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D54733
(cherry picked from commit e7de7feb74262bfdb04d285846bac2fc6229f734)
ichsmb: Add Intel Raptor Lake SMBus controller support
Add PCI device ID 0x7a23 for Intel 700 Series (Raptor Lake) chipset SMBus controller.
This enables hardware monitoring functionality on 13th and 14th generation Intel Core platforms.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D54957
(cherry picked from commit e4bcfe4ebf03e321a5f8317491cdeea49e4f6357)
est: gate "not recognized" message behind bootverbose
On modern Intel CPUs that use HWP (hwpstate_intel: /usr/src/sys/x86/cpufreq/hwpstate_intel.c) instead of EST,
this message prints unconditionally during probe even though it is
expected and harmless. Gated behind bootverbose to reduce console
noise on systems where EST is present but considered legacy.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57616
(cherry picked from commit 85814f5912618808ebe5b7065b70344675c98b5b)
mtw(4): Fix warm reboot initialization failures for MT7601U
The mtw(4) driver works correctly on initial boot, but fails to initialize
the MT7601U WiFi adapter after a warm reboot.
Users must either physically unplug and replug the USB adapter, or perform a
full power cycle to restore functionality, if usb power is always powered
(only a replug works)
The root cause is that warm reboot does not power-cycle USB devices,
leaving the MT7601U in a stale state from the previous session.
The MCU retains its ready flag and the device ignores initialization
commands, resulting in timeout waiting for MCU to initialize errors.
At the OS Level, pinging 1.1.1.1 will work, but the speed will be very
slow. In addition in debug mode, we see thousand of error logs.
This patch addresses the issue by:
[24 lines not shown]
snd_hda: use the pin ELD to select DisplayPort audio framing
hdaa_audio_setup() reads the converter widget's ELD when choosing
between HDMI and DisplayPort audio infoframes. ELD is stored on the
output pin, so the converter has no ELD and the driver selects HDMI
framing even when the connected display uses DisplayPort.
Read the ELD from the output pin to select the correct audio framing.
The equivalent change was tested on DragonFly BSD with an Intel Kaby
Lake display-audio codec and an LG HDR 4K monitor connected over
DisplayPort. Before the change, converter node 2 had no ELD, while
output pin 5 had an 83-byte ELD identifying DisplayPort. Captured driver
commands programmed HDMI audio infoframe bytes (84 01 0a 70 01 00 00
00). After applying the change and rebooting, the commands used the
existing DisplayPort form (84 1b 44 01 00 00 00), and console tones and
desktop audio were audible.
PR: 299094
[6 lines not shown]
kern: Remove unreachable compat_freebsd8 FEATURE
COMPAT_FREEBSD8 does not exist as a kernel option, so this is dead code.
No functional change intended.
Fixes: e256f71389fb ("kernel: add missed FEATUREs compat_freebsd 8-14")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: kib
Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/80
Only build secure/libexec/ssh-sk-helper if MK_USB == no
The ssh-sk-helper utility only functions if/when MK_USB == yes.
Installing it on systems where MK_USB == no doesn't make sense.
Differential Revision: https://reviews.freebsd.org/D58246
(cherry picked from commit 4db3872aabc33088cf180599c5eaa23b6f58e6d1)
Only build secure/libexec/ssh-sk-helper if MK_USB == no
The ssh-sk-helper utility only functions if/when MK_USB == yes.
Installing it on systems where MK_USB == no doesn't make sense.
Differential Revision: https://reviews.freebsd.org/D58246
(cherry picked from commit 4db3872aabc33088cf180599c5eaa23b6f58e6d1)
nfs_clrpcops.c: Fix an mbuf leak introduced by fec497b89b1a
The calls to rpc_free_rdma_reduction() were removed, but I forgot
that newnfs_request() removes the reduction mbuf from the list
upon success, so it has to be free'd separately.
This patch does that.
The patch also disables reduction after the first loop interation.
This is necessary until nfsm_build_rdma_reduction() is patched
to handle an offset within the page array.
Reported by: markj
MFC after: 1 month
Fixes: 884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[11 lines not shown]
acpi: build dev/acpi_support/acpi_wmi_if.m on ARM64
Per Wikipedia, ACPI WMI support is available on all x86* platforms
and ARM platforms. Add the source to `files.arm64` so code that relies
on its headers (thunderbolt(4) for instance), can be built on ARM64.
MFC after: 1 month
Reviewed By: andrew
Differential Revision: https://reviews.freebsd.org/D55535
(cherry picked from commit 876d2b8392e6570a835a500d8fd7c4a5b0abf844)
libarchive: update documentation for suggested `git pull`
Replace git:// with https:// . The git:// protocol URL might not be
available, depending on firewall rules, as git:// is commonly blocked by
ISPs.
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D50470
(cherry picked from commit 5c6ad1a2d175ec84e0e50621ce746c0d34fd5679)
