bhyve/riscv: fix PCIe FDT interrupt-map entry stride
In bhyve arm64, each PCIe interrupt-map entry spans 10 cells because the
ARM GIC specifies #interrupt-cells = 3. On RISC-V, the APLIC uses
#interrupt-cells = 2, so each entry spans only 9 cells.
When the PCIe FDT code was originally adapted from arm64, the property
allocation size and cell assignments were reduced to 9 cells per entry,
but the loop multiplier retained the 10-cell stride. This caused the
interrupt-map array to be packed incorrectly with gaps, breaking PCI
interrupt routing in guest operating systems and overflowing the
allocation by 16 cells.
Correct the loop stride to 9 cells so the interrupt map is properly
formed.
Reviewed by: jrtc27
Fixes: 7ab1a32cd43c ("bhyve/riscv: Initial import")
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D61473
if_geneve: Ignore reserved bits on receive
RFC 8926 section 3.4 requires the reserved fields of geneve header
to be ignored on receipt.
While here, remove the needless htons() from the version check, as
geneve_ver is a 2-bit bitfield with no byte order.
Fixes: e44d2e941e8e ("if_geneve: Add Support for Geneve (RFC8926)")
if_geneve: Do not byte-swap the option length
geneve_optlen is a 6-bit bitfield within a single byte, so it has no
byte order. Applying ntohs() to it on little-endian machines turned
an option length of 1 into 256, causing every received packet carrying
options to dropped.
PR: 300453
Reviewed by: pouria
Fixes: e44d2e941e8e ("if_geneve: Add Support for Geneve (RFC8926)")
Revert "sound/midi: Drain the mpu401 callout before device teardown"
This was committed to main by accident, but was also buggy.
This reverts commit 91539591d7f8dd8ca24ced875bd16c3ba3c7d201.
aw_sid: Add support for the H6
Add the SID of the H6. The efuse starts at 0x200 like on the other
64 bits SoCs and starts with the 16 bytes of the chip ID, which awg(4)
uses to create a MAC address when the firmware did not give it one.
The thermal sensor calibration data is not added, there is no driver
for the thermal sensors of the H6.
Tested on: H6
axp81x: Honor the enable delay of the regulators
axp8xx_regnode_enable() always reported a delay of 0, so the
regulator-enable-ramp-delay property of the FDT was ignored. On the
Pine H64 model B the Ethernet PHY is supplied by ALDO2, which has a
delay of 100ms, and awg(4) resets the controller right after enabling
it, before the PHY is ready: the soft reset timed out and the interface
did not attach. Return the delay when enabling a regulator, like the
fixed regulator driver does.
Fixes: c175fd0fe8a3 ("axp81x: Add support for AXP803")
Tested on: H6
awg: Use the MAC address of the FDT
The firmware gives the MAC address of the controller in the FDT, in the
mac-address or local-mac-address property. awg(4) only used the address
in the registers, which is set when the firmware used the controller,
and the one created from the SID. On the Pine H64 the firmware does not
initialise the Ethernet and the SID driver does not support the H6, so a
random address was created and it changed at every boot.
Use fdt_ether_get_addr(), it takes the address of the FDT and keeps the
current one when there is none.
Tested on: H6
sound/midi: Drain the mpu401 callout before device teardown
midi_uninit() frees the snd_midi that mpu401_intr() reaches through
midi_in() and midi_out(), but the callout that calls it was drained
afterwards. Drain it first, and clear M_TXPEND so that a firing handler
does not re-arm itself.
Fixes: f960b33d35da ("sound/midi: Drain the mpu401 callout")
MFC with: f960b33d35da
Sponsored by: The FreeBSD Foundation
modstat: check errno before calling feature_present
feature_present will overwrite errno if COMPAT_FREEBSD13 is not present.
Reported by: llm-postcr
Fixes: ef726c645300 ("modstat: allow compat support to fail in tests")
swapoff: don't leak vnode pointer to device
After looking up the device path, we compare the vnode to the vnode of
each swap device. Prior to this change we leaked a vnode reference to
the device we're trying to remove from the swap pool.
Effort: CHERI upstreaming
Reviewed by: kib, markj
Reported by: llm-postcr
MFC after: 3 days
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D61464
modstat: allow compat support to fail in tests
v1 and v2 versions of stuct module_stat are now gated by COMPAT_ ifdefs
so allow the otherwise valid query to fail with EINVAL.
Effort: CHERI upstreaming
Reviewed by: markj
Reported by: llm-postcr
Sponsored by: Innovate UK
Fixes: 1ebf46ecb627 ("modstat: don't copyout while holding a lock")
Differential Revision: https://reviews.freebsd.org/D61460
amd64/vmm: Don't advertise AMD PerfMonV2 or performance counters
vmm does not handle CPUID leaf 0x80000022, so a FreeBSD guest on a
Family 19h or later host panics on "kldload hwpmc", which trusts the
PerfMonV2 bit and writes AMD_PMC_GLOBAL_CTL.
Tested by: Osvaldo Janeri Filho <ojanerif at amd.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D61141
(cherry picked from commit 8fb539b081dbfe3e93e607a5d4d36184c53c8aaf)
amd64/vmm: Don't advertise AMD PerfMonV2 or performance counters
vmm does not handle CPUID leaf 0x80000022, so a FreeBSD guest on a
Family 19h or later host panics on "kldload hwpmc", which trusts the
PerfMonV2 bit and writes AMD_PMC_GLOBAL_CTL.
Tested by: Osvaldo Janeri Filho <ojanerif at amd.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D61141
(cherry picked from commit 8fb539b081dbfe3e93e607a5d4d36184c53c8aaf)
netlink: Pre-register the missing devctl event systems
devctl_notify() can be called with a mutex held. If the event system is
not listed in devctl_systems[], sysevent_get_group() calls
sysevent_new_group(), which calls strdup() with M_WAITOK, and we may end
up sleeping while holding a non-sleepable mutex.
Add the missing systems.
While here, remove the nonexistent KERNEL system.
PR: 299272
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61161
(cherry picked from commit 66d078c17294ca2ea225e4926a8cd9697dda57ed)
allwinner: a33: Fix the pin number of PE17
The PE17 entry of the pad table of the A33 had the pin number 16, the
one of PE16, so the pinctrl of PE17 configured PE16 and a <&pio 4 17>
specifier could not be mapped.
Reported by: llm-postcr
Fixes: cf72965fbf02 ("Allwinner: Add A33 support")
aw_ccu: h6: Allow the IR and W1 clocks to change their parent
The IR clock was defined without AW_CLK_REPARENT, so only the current
parent was used to find a rate. The firmware leaves the mux on osc32k,
from which the best rate is 32768Hz, and aw_cir asks for exactly 3MHz,
which osc24M can give. The request failed and r_ir did not attach. Do
the same as the main CCU for the CIR-TX clock and let the clock use the
best parent, and do the same for the 1-wire clock which is the same.
Reported by: llm-postcr
Fixes: 69919babdac7 ("aw_ccu: h6: Add the IR, W1, RSB and RTC clocks of the R CCU")
Tested on: H6
axp81x: Fix the number of steps of the first range of DCDC5
The voltage of DCDC5 goes from 800mV to 1120mV in 10mV steps with the
codes 0x00 to 0x20, then from 1140mV to 1840mV in 20mV steps with the
codes 0x21 to 0x44. The first range has 32 steps and not 42, so every
code above 32 was decoded and encoded wrongly: the driver read 1160mV
for the 1.2V that the firmware sets for the DRAM, did not see it in the
range of the FDT and wrote a code that is really 1280mV. The same
happens for the other voltages, 1.36V is set to 1.46V and 1.5V to 1.6V.
It also made the voltage reported for the regulator wrong.
Reported by: llm-postcr
Fixes: c175fd0fe8a3 ("axp81x: Add support for AXP803")
Tested on: A64
aw_ccu: h616: Set the lock enable bit of the PLLs
The lock status bit of a PLL is only updated when its lock enable bit,
bit 29, is set, and the firmware only sets it for the PLLs it uses.
Enabling another PLL, or changing the rate of an enabled one, then
waited for a lock that never came and ended after a second with an
error. Set the bit on all the PLLs when attaching, like Linux does.
Reported by: llm-postcr
Fixes: 92b59f3d010d ("aw_clk: Wait for the PLL to lock when enabling it")
axp209: Allow the interrupt handler to sleep
The interrupt handler reads and writes the registers of the PMU with
IIC_INTRWAIT, which can sleep when the bus is busy, and the I2C
controller the AXP209 is on in the A10 and A20 waits for the end of the
transfer. The handler runs in an interrupt thread, which cannot sleep
unless the interrupt is marked as sleepable, so an interrupt of the PMU
would panic a kernel with INVARIANTS. Mark it, the interrupt is not
shared, like it was done for the axp81x driver.
Reported by: llm-postcr
Fixes: 30068a1de9e3 ("Add support for interrupts, sensors and GPIO for AXP209 PMIC")
allwinner: a31s: Fix the pin number of PH28
The PH28 entry of the pad table of the A31s had the pin number 27, the
one of PH27, so the pinctrl of PH28 configured PH27 and a <&pio 7 28>
specifier could not be mapped. This was fixed for the A31 in
222947a74223 but not in the copy for the A31s.
Reported by: llm-postcr
Fixes: ccf8caad1413 ("Add the Allwinner A31 and A31s padconf support. It's currently unused, but")
aw_gpio: Return the error when an interrupt cannot be mapped
aw_gpio_pic_map_intr() returned success without setting the interrupt
source when aw_gpio_pic_map_gpio() failed, which happens for a pin that
has no interrupt function or for an unsupported mode. The caller then
went on with an uninitialized pointer. Return the error.
Reported by: llm-postcr
Fixes: 0fe5379c6a99 ("arm: allwinner: Add GPIO Interrupt support")
allwinner: h616: Put the PI pins in bank 8
The PI0 to PI16 entries of the pad table had port 9 and interrupt bank 9
but the PI bank is the ninth one, bank 8, at offset 0x120. Bank 9 is a
bank that does not exist, so the configuration, data, drive and pull of
these pins, and their interrupt registers, were accessed at the wrong
place and a <&pio 8 N> specifier, like the one of the card detect GPIO
of some boards, did not find its pin.
Use 8 for the port and the interrupt bank, like the other entries do
with the position of their letter.
Reported by: llm-postcr
Fixes: e506af08bb52 ("aw_gpio: Add support for H616")
aw_ccu: d1: Set the lock enable bit of the PLLs
The lock status bit of a PLL is only updated when its lock enable bit,
bit 29, is set, and the firmware only sets it for the PLLs it uses.
Enabling another PLL, or changing the rate of an enabled one, then
waited for a lock that never came and ended after a second with an
error. Set the bit on all the PLLs when attaching, like Linux does.
Reported by: llm-postcr
Fixes: 92b59f3d010d ("aw_clk: Wait for the PLL to lock when enabling it")
xdr: Fix xdr_string
Forcing maxsize to RPC_MAXDATASIZE breaks code that deliberately uses
XDR with longer strings than permitted by SunRPC.
MFC after: 1 week
Fixes: 6448ec89e739 (" * limit size of buffers to RPC_MAXDATASIZE")
Fixes: e17d7ab869bb ("xdr_string: don't leak strings with xdr_free")
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, brooks
Differential Revision: https://reviews.freebsd.org/D59994
(cherry picked from commit d2018cedb414ef17e77b7fc2fa19fd81328da46b)
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
[11 lines not shown]
xdr_string: don't leak strings with xdr_free
Historically (and in a small amount of older software such as OpenAFS),
developers would attempt to free XDR strings with
xdr_free((xdrproc_t)xdr_string, &string)
This resulted in xdr_free calling xdr_string with only two intentional
arguments and whatever was left in the third argument register. If the
register held a sufficently small number, xdr_string would return FALSE
and not free the string (no one checks the return values).
Software should instead free strings with:
xdr_free((xdrproc_t)xdr_wrapstring, &string)
Because buggy software exists in the wild, act as though xdr_wrapstring
was used in the XDR_FREE case and plug these leaks.
[9 lines not shown]
aio_mlock.2: Expand document description
+ The old one renders broken because Xr is not correct/portable in Nd
+ Take this opportunity to explain it better using mlock description
MFC after: 3 days
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D61334
tests/sys/kern/ssl_sendfile: double timeouts for :grow and :truncate
The :grow and :truncate testcases fail semi-regularly in CI with
timeouts. Double the timeout to reduce false positives with the tests.
PR: 300699
MFC after: 1 week
Reviewed by: siva
Differential Revision: https://reviews.freebsd.org/D61444
