ixv: Wire iflib suspend and resume methods
Register the standard iflib device suspend and resume methods so the
framework reinitializes the VF datapath after a system power
transition.
Sponsored by: BBOX.io
(cherry picked from commit 10d09e6e8a7ff141b5dc39e6ddca5b7c2cb0b66b)
iavf: Wire iflib suspend and resume methods
Register the iflib device suspend and resume methods so the existing
driver callbacks run during system power transitions. This stops
mailbox retry work before suspend and lets iflib reinitialize the
datapath after resume.
Sponsored by: BBOX.io
(cherry picked from commit b8fe6d7055b3a274cd646d0a6b5d3928f2fd7d7a)
axgbe: Wire iflib power management methods
Register the standard iflib device methods for shutdown, suspend, and
resume. This gives axgbe the framework managed reinitialization used by
other iflib drivers after a power transition.
Sponsored by: BBOX.io
(cherry picked from commit 2397b18ceb5d69d4d4e3bd0b3ca07dcd077bf843)
enic: Route resets through iflib lifecycle
Mark the driver stopped after attach so its first IFDI_STOP() call
does not repeat hardware shutdown.
Defer error interrupt recovery through iflib instead of calling
driver stop and init methods from interrupt context. Let iflib own
the stop and restart around MTU changes as well, avoiding duplicate
lifecycle operations.
Sponsored by: BBOX.io
(cherry picked from commit 58f985559ee689e50233b9113df4f37375b48c2d)
iflib: Do not hold the ifnet lock across registration
iflib_device_register() acquired IFNET_WLOCK to preserve lock order
when ether_ifattach() was called with the context lock held. The context
lock is now released around ether_ifattach(), making registration-wide
ifnet serialization unnecessary.
Keeping IFNET_WLOCK across driver attachment also allows synchronous
interface event handlers to recurse on it. The rtnetlink interface-group
dump does so through if_foreach_group() while handling the interface
attachment event.
Remove the outer lock and the corresponding failure-path unlock and
relock transitions. Continue to drop the context lock around
ether_ifattach() and taskqueue drains, and preserve context-lock coverage
for driver attach and detach.
Validated under WITNESS on 82576 and I226 controllers. Multiple VF
attach and detach cycles, netmap control operations, and every iflib
[13 lines not shown]
tpm: Move user copies outside the TPM 1.2 lock
The character-device paths held the transaction and lifecycle lock while
uiomove() accessed user memory. A user page fault could therefore delay
suspend or detach, and a copyout failure occurred while the TPM response
was still active.
Copy commands into the bounded stack buffer before taking the lock. For
reads, validate the response header, buffer the complete response while
the lock is held, finish the TPM transaction, and copy it to userspace
after unlocking. Use a non-blocking allocation so memory pressure
cannot turn response buffering into another lifecycle wait.
NetBSD uses the same separation but limits responses to its fixed 1 KiB
buffer. Allocate the TPM-advertised response length to preserve the
existing FreeBSD support for larger streamed responses.
On a ThinkPad T440p with an STMicro TPM 1.2, a PCR read into a 4 KiB
userspace buffer returned the expected 30-byte response. A deliberately
[8 lines not shown]
tpm: Bound TPM 1.2 locality ownership
A TIS locality must remain active while a command is in flight, but
should be relinquished once the command completes or is abandoned. The
driver retained locality zero after probe, initialization, and resume,
and several transaction error paths returned without releasing it.
Closing the device after writing a command without reading its response
had the same effect.
Track locality ownership and whether a command is awaiting its response.
Release locality after probe, initialization, and resume; retain it only
across a successful command write and its matching response read. Abort
and release on errors, replacement commands, close, and detach.
Wait for locality during ISA probe instead of assuming an immediate
grant, release locality acquired by the probe, and stop treating the
command-style TPM_ACCESS register as restorable state.
On a ThinkPad T440p with an STMicro TPM 1.2, the old driver left
[10 lines not shown]
tpm: Remove Giant from the TPM 1.2 driver
Serialize TPM 1.2 commands, character-device methods, and power
transitions with an sx lock, following the command ownership model used
by the TPM 2.0 driver. Reject new operations once detach starts and
drain the character device before releasing transport resources.
Giant also closed the interrupt race between the final TIS status check
and tsleep. Replace that implicit dependency with a mutex and condition
variable, use an absolute deadline across unrelated wakeups, and make
the interrupt handler MPSAFE.
Create the device node atomically with its softc and finish failed write
transactions so every command path releases its transport state.
The polling path was validated on ThinkPad T430 and T440p systems with
their STMicro TPM 1.2 devices enabled. Exclusive-open behavior, 100
consecutive PCR reads, and module unload and reload completed without
errors on both systems. Two consecutive S3 cycles on each system
[8 lines not shown]
tpm: Restore TPM 1.2 TIS state after resume
Firmware restores the state saved by TPM_ORD_SaveState, but the TIS
interrupt, locality, and command FIFO state are not guaranteed to
survive S3. The legacy driver previously treated resume as a no-op.
Revalidate the interface and device identity, disable and acknowledge
stale interrupts, restore the configured interrupt vector, reacquire
locality zero, and return the FIFO to command-ready state. Also disable
TIS interrupts during initial setup when the device uses polling so
firmware settings cannot leave an unhandled interrupt enabled.
TIS 1.3 Table 22 makes the interrupt control registers locality
protected. Acquire locality before disabling or programming them during
initial setup and resume rather than relying on probe retaining
locality.
Keep TPM self-test outside the resume critical path. It can take
minutes on some TPM 1.2 devices and is not required to restore the
[18 lines not shown]
tpm: Correct the TPM 1.2 suspend transaction
The legacy driver wrote TPM_ORD_SaveState directly to the command
FIFO, but used ordinal 156 instead of the TPM 1.2 ordinal 152 and
never completed the transaction through the transport start and end
methods. On a TIS device this omitted TPM_STS_GO, and the response
read used the header length as flags instead of requesting the complete
parameter size. The legacy Atmel reader would also dereference the
null byte-count pointer.
Send the header-only command through the normal transport lifecycle,
validate the response header and TPM result, and retry TPM_WARN_RETRY
for a bounded five seconds. Fail suspend rather than enter S3 after
an unsuccessful state save.
This follows the TPM 1.2 SaveState command definition and the bounded
retry policy used by other TPM 1.2 implementations.
The stock driver failed to resume a ThinkPad T440p with its STMicro
[11 lines not shown]
LinuxKPI: remove timer KPI from Linux version before 4.15
Now that semi-native drivers in main are clean of using any
pre-4.15 Linux timer KPI, remove the macros from LinuxKPI as well.
Supported versions of drm-kmod and the oldest nvidia port seem fine
based on my checks. If anything else surfaces we can deal with the
fallout; the changes to the newer KPI were mechanical in Linux and
can be applied easily.
This change can be detected by #if !defined(init_timer)
at compile time so no need for a __FreeBSD_version bump.
MFC after: 3 days
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D59688
mlx5: remove init_timer()
The init_timer() was there from day one in (dc7e38ac4da50). It was
never needed as the setup_timer() below already did more than just
that part of the job.
This is part of trying to clear up the Linux pre-4.15 timer KPI
from LinuxKPI.
MFC after: 3 days
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59681
mlx4: convert to timer_setup() Linux KPI
The Linux driver switched away from using this timer in e22979d96a55d.
Locally adjust the code to use timer_setup/from_timer in order to get
us out of Linux version 4.15 (and earlier) KPIs.
Also, right away, apply 41cb08555c416 from_timer -> timer_container_of.
MFC after: 3 days
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59680
mlx4: apply upstream changes to convert to timer_setup() Linux KPI
Apply Linux change 55c0fcc3de460 "Convert timers to use timer_setup()"
to get us out of Linux version 4.15 (and earlier) KPIs.
Also apply 41cb08555c416 from_timer -> timer_container_of.
MFC after: 3 days
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59679
mthca: apply upstream changes to convert to timer_setup() LinuxKPI
Apply upstream changes b9eaf18722221 init_timer() -> setup_timer(),
and 86cb30ec07cdc7 setup_timer() -> timer_setup() to get us out of
Linux version 4.15 (and earlier) KPIs.
Also apply 41cb08555c416 from_timer -> timer_container_of.
MFC after: 3 days
Reviewed by: jhb, emaste
Differential Revision: https://reviews.freebsd.org/D59677
Merge commit 1f332ae4f1b3 from llvm-project (by Alexander Kornienko):
Fix -Wformat diagnostic after #190965 (#193704)
Fixes libunwind compiler diagnostic when building with clang after
034d4dcad6396d1241e8262e69871b8d61da7e4f:
```
In file included from libunwind/src/libunwind.cpp:31:
In file included from libunwind/src/UnwindCursor.hpp:52:
libunwind/src/CompactUnwinder.hpp:339:46: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
338 | "function starting at 0x%llX",
| ~~~~
| %lX
339 | compactEncoding, functionStart);
| ^~~~~~~~~~~~~
libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
215 | #define _LIBUNWIND_DEBUG_LOG(msg, ...) _LIBUNWIND_LOG(msg, __VA_ARGS__)
| ~~~ ^~~~~~~~~~~
libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
[21 lines not shown]
kern.mk: make clang 23 -Wunused-but-set-global non-fatal
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
bsd.sys.mk: make clang 23 -Wunused-but-set-global non-fatal
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
ice: Fail closed when VF reset does not complete
ice_reset_vf() logs failures to drain PCIe transactions, issue the
mandatory zero-queue command, or observe VFR completion, but still
publishes VFACTIVE. A VF can resume against reset state which the PF
knows is incomplete.
Return an error from the reset operation and retain a reset-failed flag
when any mandatory stage fails. Reject ordinary virtchnl requests while
the failure persists. Publish VFACTIVE only after every stage succeeds.
A later VFLR or PF rebuild can recover the VF and clear the failure.
Remove tracked queue leaves before clearing their software state. The
reset-only AdminQ command drains hardware queues but does not update the
shared scheduler database; losing that bookkeeping can strand queue
resources across VF teardown and recreation.
After a successful VF reset, discard software switch filter state whose
hardware rules were reset and clear guest-owned MAC and VLAN tracking.
[16 lines not shown]
ice: Enforce VF MAC anti-spoof policy
The SR-IOV schema enables MAC anti-spoofing by default, but the driver
never programs the VSI security section. A VF can therefore transmit
with an arbitrary source address despite the configured policy.
Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset. Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.
Validated on E810 hardware with host-attached and Linux passthrough
VFs. Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped. After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.
An injected MAC anti-spoof update failure left the VF inactive.
Destroying and recreating the SR-IOV configuration restored the policy
and traffic.
[4 lines not shown]
ice: Add malformed virtchnl injection points
Extend the optional ice(4) failure injection facility with semantic
corruption points for queue configuration, RSS keys and tables, and
interrupt mappings.
Each point mutates an otherwise valid request after the common
virtchnl length check. This exercises the PF semantic validators with a
real VF while preserving the normal wire format and mailbox path.
The queue point selects unaligned Tx or Rx bases, an unaligned or
unrepresentable receive buffer, an invalid frame size, duplicate queue
IDs, or a bad VSI. The RSS points select short advertised data or an
out-of-range LUT entry. The interrupt point selects an invalid ITR,
traffic on vector zero, duplicate vectors, or a bad VSI.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
[3 lines not shown]
ice: Validate VF virtchnl configuration
Virtchnl requests originate in guest-controlled VFs. The existing PF
implementation checked message shape but allowed several hardware-facing
values through without complete semantic validation.
Require the exact RSS key and LUT sizes advertised to the VF, validate
every LUT entry, and pass only the validated LUT length to firmware. A
short LUT previously caused the AdminQ command to read beyond the
received request.
Validate queue ring bases, descriptor counts, receive buffer units,
maximum frame sizes, and per-VSI consistency before disabling or
changing any queue. This also prevents the 32-bit receive ring length
from being truncated through a 16-bit validation helper.
Advertise the PF frame-size limit in VF resources. Leaving max_mtu
zero causes Linux iavf to request a 16382-byte frame, beyond the
9728-byte limit enforced by this driver.
[20 lines not shown]
man: Link enic.4 to if_enic.4
For consistency, create a symbolic link from enic.4 to also if_enic.4
Reviewed by: ziaee, #manpages
Differential Revision: https://reviews.freebsd.org/D59755
MFC after: 3 days
acpi: Set status to AE_ERROR if device suspend failed
Previously, we would be returning AE_OK from acpi_EnterSleepState().
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59735
nuageinit: fix support on OpenStack
Change added in 90a7728cd8905cd26b90d06f7873df8bad43ae9a contained a
lot of bugs:
- If all network interfaces correctly respond to DHCP, then pwait was
waiting forever.
- If there was more than 1 interface, then "cat
/tmp/ephemeraldhcp.*.pid" joined pid numbers into one long string.
- "for iface in $left; do kill -15 $left; done" is not using $iface.
Tested by: adam.mizerski at ovhcloud.com
Sponsored by: OVHcloud
Pull Request: https://github.com/freebsd/freebsd-src/pull/2436
icmp: Limit routing table updates to the FIB of the redirect
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
