vchiq: Merge two commits from Linux
6e474d8e3981 ("staging: vchiq_shim: avoid code duplication") refactors
some code which makes applying the subsequent patch easier.
49bec49fd7f2 ("staging: vc04_services: remove vchiq_copy_from_user")
addresses a user-triggerable integer overflow via the
VCHIQ_IOC_QUEUE_MESSAGE ioctl on /dev/vchiq (which has mode 0600 by
default). It also addresses insufficient validation of user-controlled
addresses in vchiq_copy_from_user().
Update the bcm2835_audio driver to follow the change to
vchi_msg_queue().
Reported by: Vicki Pfau
Reviewed by: Abdelkader Boudih <freebsd at seuros.com>
Tested by: Abdelkader Boudih <freebsd at seuros.com>
Tested by: Marco Devesas Campos <devesas.campos at gmail.com>
MFC after: 2 weeks
[2 lines not shown]
libusb: Add an XXX comment for possible duplicate callback IDs
If next_callback_id wraps we could end up with two callbacks with the
same ID. I recommitted the original change despite this issue in order
to fix the libusb API as soon as possible after SHLIB_MAJOR was bumped
in commit 527a82474cb3 (libusb: versioning symbols).
It's very unlikely in practice that software will register and
deregister a sufficient number of callbacks to trigger this, but it is
a real issue to be fixed in a subsequent commit.
Sponsored by: The FreeBSD Foundation
libusb: change callback register handler to int
libusb upstream uses int for register handler. This causes some library
user (like pyusb) to assume that we have int in all implementations and
therefore provides a 4 byte storage only. This causes Segmentation
fault as we will right the pointer.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54211
(cherry picked from commit ce9ced951a0b9d004a3b007d4ac6e9087a1301a2)
netstat(1): Add nexthop statistics support with -os flag
Add support nexthop statistics and update its manual.
While here, fix manual of other nexthop related options.
Reviewed by: kfv
Differential Revision: https://reviews.freebsd.org/D58538
snd_uaudio: Use uDWord for the UAC2 sample rate
uaudio20_set_speed() split the sample rate into bytes by hand. Use
uDWord and USETDW() instead.
No functional change intended.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59066
clk: Correct SpacemitT typo
SpacemiT has only one T.
Fixes: dcb10e3add17 ("clk: Initial support for the SpacemiT K1 clock control units")
Sponsored by: The FreeBSD Foundation
dpaa/dtsec: advertise RX/TX csum
Apply 6464974 to dTSEC, since it supports the same offload capabilities
as mEMAC.
The DPAA_CSUM_TX_OFFLOAD macro moves from if_memac.c to the shared
dpaa_eth.h since both drivers now reference it.
DPAA: Minor performance improvements
* Add interrupt coalescing for DQRR and MR, with thresholds and period
as tunable sysctls under the `hw.qman` tree.
* Do lazy/sloppy buffer management to avoid constantly checking
thresholds via QMan portal round-trips.
* Add cache stashing to prewarm caches, reducing latency.
* Fix the definition of Context_A in the init_fq MC command/result
structures, they're 64-bit fields, not 32-bit.
* Reorder the dpaa_eth_frame_info as a bit of cleanup.
* Take advantage of the fact that UMA small allocations are returned in
the DMAP, and avoid pmap_kextract().
These changes together improve throughput by ~1.5%
(925Mbps->935-940Mbps) consistently, and reduce CPU usage by a bit,
increasing idle CPU from 30%->35% minimum.
fman: Fix duplicate port identifiers
fman_qman_channel_id returns the QMan FMan channel for a given port.
If a port isn't found, the wrong channel number will be returned.
sdhci_fsl_fdt: Add support for PowerPC eSDHC controllers
Migrate all PowerPC QorIQ to the sdhci_fsl_fdt SDHC driver. There are a
few differences that need to be accounted for:
* On PowerPC device trees, the `clock-frequency` property defines the
clock rate, not a `clocks` reference property.
* On some older SoCs (P1022 only?) the BURST fields of the WML register
are reserved, and must be 0x10, so add a FSL quirk (errata field) to
account for this.
* The PowerPC eSDHC controllers must have the DMA SNOOP bit set for DMA
to work properly and avoid corruption.
As part of this, make the fallback "fsl,esdhc" compat data work for
PowerPC. If these fallbacks are not compatible with ARM SoCs, newer
compat strings could be added for those, but the conservative catch-all
should work for most SoCs, though perhaps less optimal.
Differential Revision: https://reviews.freebsd.org/D58630
powerpc/dma: Fix accounting and loading large segments
When the first page of a segment fits alignment, the second likely does
not, so the DMA infrastructure (must_bounce()) thinks it needs to bounce
the pages. Fix this by passing the previous end (address of byte
following the previous segment) as a third argument to must_bounce(), so
that the alignment check is done against the start of a new segment if
and only if necessary, instead of the current page.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58627
sdhci_fsl_fdt: Allow setting extra quirks
Respect the `hw.sdhci.quirk_set` and `hw.sdhci.quirk_clear` tunables in
the QorIQ eSDHC driver. This lets us tweak quirks for debugging or
platform specifics.
tests/sys/posixshm/posixshm_test.c::accounting fix after st_size changes
st_blksize is defined by POSIX as the 'preferred I/O block size for this
object.' It is wrong to use st_blksize as the unit for st_blocks and
expect it to be equal to the object size regardless of the change of
st_blksize.
Fixes: 3a1bf59d195c ("shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59014
bcm2835_audio: Remove wrong chn_intr()
chn_trigger() calls bcmchan_trigger() with the channel lock held.
However, bcmchan_trigger() calls chn_intr(), which also tries to lock,
which results in a lock recursion panic. chn_intr() is meant to be
called by the interrupt handler and not inside CHANNEL_TRIGGER()
methods. Remove the call altogether, the bcm2835_worker_play_start()
call that comes after is enough.
Fixes: 69cab2d1bfb5 ("Fix locking in bcm2835_audio driver")
Reported by: Marco Devesas Campos <devesas.campos at gmail.com>
Tested by: Marco Devesas Campos <devesas.campos at gmail.com>
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59055
pci: Do not reconcile MPS across PCI domains
A PCI function can provide a host bridge into a synthetic PCI domain.
Intel VMD does this: the host facing VMD function remains in its
original domain while the hidden Root Ports and endpoints appear in a
separate domain. The VMD function's Device Control does not describe
an upstream link in that synthetic hierarchy.
The hierarchy wide cold pass incorrectly used the VMD function's MPS
to reprogram the hidden ports and their endpoints. Stop both cold
reconciliation and runtime path walks at a PCI domain boundary. The
real Root Ports within the VMD domain continue to reconcile their
endpoints normally.
Reviewed by: imp
Tested by: Michael Butler <imb at protected-networks.net>
Fixes: 8e9fe9996a1f ("pci: Reconcile MPS before attaching PCIe devices")
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58837
[2 lines not shown]
ixgbe: Quiesce VFs across PF reset
Stop VF transmit and receive in hardware, clear PF-side mailbox CTS,
and notify active VFs before resetting a PF. A PF reset invalidates VF
queue state, so the no-CTS control message makes cooperative VFs
discard stale state and renegotiate after the PF returns.
The hardware queue gates synchronously prevent further VF DMA. Do not
hold the exclusive iflib context lock for a fixed VF-watchdog interval
after the reset. Report the PF link transition directly instead of
dispatching mailbox work from the stop path, which could otherwise
re-enable VF I/O mid-reset.
The CTS, PF-control, and VF queue controls follow the reset mechanisms
used by DPDK.
(cherry picked from commit aea4240ef5834fb4a47f80c659c80f902cb4bb06)
ixgbe: Use PF MTU for 82599 VF jumbo policy
The shared maximum frame size is raised by VF LPE requests, so it
cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo
restriction. Consult the PF ifnet MTU instead.
Also correct the API 1.1 and later comparison so a jumbo VF is enabled
when, and only when, the PF itself uses a jumbo MTU. This matches the
policy implemented by DPDK.
(cherry picked from commit 2a803e6f349c3d6cf770089f8a71bc5139308465)
ixgbe: Apply the 82599 D3 link workaround only for D3
ixgbe_stop_mac_link_on_d3_82599() implements the workaround for
82599 erratum 33. It forces incompatible auto-negotiation settings
before the device enters D3, and reset clears them when returning to
D0.
ixgbe_if_stop() is also used for ordinary interface reconfiguration
and recovery. Those paths do not enter D3 and should not program
this power-management workaround. They continue to stop the adapter
and disable the transmit laser.
Move the call to ixgbe_setup_low_power_mode(), after
ixgbe_if_stop(). This preserves the required ordering for detach,
shutdown, and suspend while avoiding the D3 settings during ordinary
restarts.
(cherry picked from commit d025b84268ec18d55c2d3088729cf4ad7673ecac)
ixv: Defer reset after mailbox failure
When link polling loses mailbox clear-to-send or times out, request an
iflib reset instead of continuing with stale VF state.
The driver callback runs after iflib samples reset requests, so requeue
the admin task to make iflib consume the request on its next pass
rather than waiting for an unrelated timer or interrupt.
(cherry picked from commit 2a2867c89a7ec2d89ad0a1be8847bb9dc0a4a9f0)
ixgbe: quarantine repeatedly faulting legacy VFs
A guest can reinitialize after a VF function-level reset and
repeatedly strand an 82599 or X540 PF with invalid descriptor DMA
targets. Count only distinct Received Master Abort events accepted by
the qualified transmit-stall detector and quarantine the VF after five
events.
Preserve quarantine across PF reinitialization, reject reset mailbox
requests, and keep transmit, receive, and clear-to-send disabled.
Recreating SR-IOV clears quarantine. Expose the affected pools through
a read-only bitmap.
After a successful quarantine FLR, leave the function in post-FLR
configuration, explicitly keep decode and bus mastering disabled,
verify the Command register, and refresh its PCI-layer cache so a later
restore cannot re-enable the function.
This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure
[7 lines not shown]
ixgbe: Recover legacy VFs from invalid DMA targets
82599 and X540 lack the X550 malicious-driver detector. Detect a VF
whose PCI status reports a received master abort while its transmit
ring has outstanding descriptors and makes no progress across
consecutive samples.
Consume the accepted PCI status latch, gate that VF I/O, and recover
one pending VF per task pass with round-robin selection. This prevents
an unreadable function from starving detection or recovery of other
VFs.
Save the complete writable VF PCI configuration before FLR, restore it
afterward, and verify the hardware-backed Command state. Preserve the
first good snapshot and pending state across reset events until restore
and verification succeed.
Introduce a common I/O-disabled policy bitmask so later quarantine
policy can extend traffic gating without duplicating fault-state
[3 lines not shown]
pci: Skip PF SR-IOV state handling for VFs
A VF's pci_devinfo references its PF's pcicfg_iov for resource
bookkeeping, but only the PF implements the SR-IOV capability.
pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as
an owned capability and accessed the PF capability offset in VF
configuration space. Saving a VF could therefore replace the shared
PF settings with unrelated VF register values.
Skip SR-IOV capability save and restore for PCICFG_VF children. The
generic PCI and PCIe state of the VF remains preserved. This is also
required by drivers that save VF state around a PF-driven
function-level reset.
(cherry picked from commit 78547d542f776d366c36b5a2fc747ddfe99523c6)
ixgbe: force receive drops on every VF queue
PFQDE is indexed by absolute receive queue, but the driver programs one
index per VF. Only the first quarter or half of the VF queues therefore
have queue-drop isolation, depending on the virtualization mode. The
flow-control path can also clear those bits even though SR-IOV requires
them independently of the PF pause policy.
Program every queue in a VF pool before enabling receive for that VF.
For an X550-family VF with an administrative port VLAN, also hide the
VLAN tag as the hardware requires. Keep PF flow-control changes
confined to the PF SRRCTL registers, and clear the VF queue settings
when SR-IOV is torn down and the queues can be reassigned to the PF.
(cherry picked from commit 4383ab82b0bbaf1c78ecdf4eb7628f1e154db24b)
ixgbe: recover from X550 malicious-driver events
The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.
Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.
Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
[21 lines not shown]
ixgbe: complete PF cleanup after VF FLR
The 82599, X540, and X550 documentation identifies VF registers which
retain state across VFLR and must be reconfigured before a VF is reused.
The VF reset path already initializes its queue-owned registers, but the
PF only cleared VF mailbox memory and transmit head write-back addresses
after a cooperative mailbox reset. A bare hardware VFLR therefore left
both behind on affected devices.
Move TDWBA cleanup into the common reset path. Clear CTS when VFLR
invalidates the mailbox session, and accept only VF_RESET during the
reset pass before restoring VF traffic.
Clear VFMBMEM through the PFU/VFU semaphore. Recheck VFREQ while
holding PFU so a reset event cannot erase a request posted between the
initial mailbox check and the clear. Dispatch an already-read message
even if the residual clear fails, but keep cleanup pending until a
synchronized clear succeeds. Retry cleanup in the same admin pass
after a failed message read or clear.
[17 lines not shown]
ixgbe: Validate SR-IOV before restarting the PF
A deterministic IOV configuration error currently reaches the driver
only after iflib has stopped the PF. The required cleanup restart then
causes an avoidable carrier flap.
Follow the igb pattern and validate the request in the PCI IOV method
before entering the restart transaction. Reject queue layouts wider
than the selected virtualization pool before they can alias unrelated
82599 registers.
(cherry picked from commit 703c756a2d298e5841471eb7d4d40f95a0dafe50)
ixgbe: restart iflib around SR-IOV reconfiguration
The IOV callback changes the PF pool, virtualization mode, and hardware
queue indices while iflib still considers the old queue layout live.
Teardown likewise leaves the software pool and mode at their SR-IOV
values.
Use iflib stop/mutate/restart transactions for both transitions.
Disable VF DMA and PCI VF Enable before queue reuse, let outstanding
transactions drain, and restore the non-IOV pool and queue indices on
teardown.
Remove the redundant driver-local pci_iov_detach() wrapper; iflib
already performs that check centrally before the driver detach
callback.
It may be possible to avoid some restart in the future on this hardware
pausing DMA and remapping rings but not pursued yet.
(cherry picked from commit 86199f1a74abc76c3bb1ed15ccee7df3cabf3d7b)
