netmap: Fix a race in kqueue registration
We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58677
netmap: Fix driver name handling
if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.
While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.
Reported by: syzkaller
Reviewed by: vmaffione
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58676
Revert "release: Ship firmware from kmods repo on DVD"
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146694ee490543b35e3349e060936fde4.
MFC after: 1 second
Approved by: re (cperciva)
(cherry picked from commit ca0cff79320d49d3f10bd3aa3c472fa450a5c494)
(cherry picked from commit daf81f32f834f8619dceca745758983ccc767866)
Revert "release: Ship firmware from kmods repo on DVD"
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146694ee490543b35e3349e060936fde4.
MFC after: 1 second
(cherry picked from commit ca0cff79320d49d3f10bd3aa3c472fa450a5c494)
Revert "release: Ship firmware from kmods repo on DVD"
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146694ee490543b35e3349e060936fde4.
MFC after: 1 second
(cherry picked from commit ca0cff79320d49d3f10bd3aa3c472fa450a5c494)
Revert "release: Ship firmware from kmods repo on DVD"
This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build. I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.
This reverts commit bda8028146694ee490543b35e3349e060936fde4.
MFC after: 1 second
sys/socket.h: Fix AF_MAX
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
(cherry picked from commit ddd850aa7720f77b6605599655df898b16ed74cc)
sys/socket.h: Fix AF_MAX
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
(cherry picked from commit ddd850aa7720f77b6605599655df898b16ed74cc)
manuals: Fix more Fx and nearby mechanical typos
Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.
The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Others had other parts of
the sentence supplied as an argument to Fx.
While here, fix the other mechanical typos visible on those specific
screenfulls. Correct section typo AUTHOR to AUTHORS, markup utilities
with Sy, and apply line break after the end of a sentence.
PR: 297248
MFC after: 3 days
Reported by: wosch (are you sure that's all of the broken Fx'es?)
[7 lines not shown]
manuals: Fix Fx and nearby mechanical typos
Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.
The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Another, FreeBSD Foundation
was misrepresented as an operating system version instead of an author.
Two more had other parts of the sentence supplied as an argument to Fx.
While I had those open, fix the other mechancial typos visible on those
specific screenfulls. Fix a list width glitch, correct section typo
AUTHOR to AUTHORS, and switch AUTHORS sections containing prose to
prose-mode so that they wrap freely when rendered.
PR: 297248
[7 lines not shown]
ixgbe: Quiesce VFs across PF reset
Stop VF transmit and receive in hardware, clear PF-side mailbox CTS,
and notify active VFs before resetting a PF. A PF reset invalidates VF
queue state, so the no-CTS control message makes cooperative VFs
discard stale state and renegotiate after the PF returns.
The hardware queue gates synchronously prevent further VF DMA. Do not
hold the exclusive iflib context lock for a fixed VF-watchdog interval
after the reset. Report the PF link transition directly instead of
dispatching mailbox work from the stop path, which could otherwise
re-enable VF I/O mid-reset.
The CTS, PF-control, and VF queue controls follow the reset mechanisms
used by DPDK.
MFC after: 2 weeks
ixgbe: Use PF MTU for 82599 VF jumbo policy
The shared maximum frame size is raised by VF LPE requests, so it
cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo
restriction. Consult the PF ifnet MTU instead.
Also correct the API 1.1 and later comparison so a jumbo VF is enabled
when, and only when, the PF itself uses a jumbo MTU. This matches the
policy implemented by DPDK.
MFC after: 2 weeks
ixgbe: Apply the 82599 D3 link workaround only for D3
ixgbe_stop_mac_link_on_d3_82599() implements the workaround for
82599 erratum 33. It forces incompatible auto-negotiation settings
before the device enters D3, and reset clears them when returning to
D0.
ixgbe_if_stop() is also used for ordinary interface reconfiguration
and recovery. Those paths do not enter D3 and should not program
this power-management workaround. They continue to stop the adapter
and disable the transmit laser.
Move the call to ixgbe_setup_low_power_mode(), after
ixgbe_if_stop(). This preserves the required ordering for detach,
shutdown, and suspend while avoiding the D3 settings during ordinary
restarts.
MFC after: 2 weeks
ixv: Defer reset after mailbox failure
When link polling loses mailbox clear-to-send or times out, request an
iflib reset instead of continuing with stale VF state.
The driver callback runs after iflib samples reset requests, so requeue
the admin task to make iflib consume the request on its next pass
rather than waiting for an unrelated timer or interrupt.
MFC after: 2 weeks
ixgbe: Re-enable the SFP laser during initialization
ixgbe_if_stop() disables the transmit laser on every 82599 SFP fiber
port, but the iflib initialization path did not re-enable it. Re-enable
the laser before deferred SFP module setup so interface
reinitialization cannot leave either single-speed or multispeed optics
dark.
The hardware wrapper is a no-op when laser control is unavailable. The
placement follows Intel ix-3.4.39; this version deliberately applies to
every SFP port affected by the stop path.
MFC after: 1 week
ixgbe: quarantine repeatedly faulting legacy VFs
A guest can reinitialize after a VF function-level reset and
repeatedly strand an 82599 or X540 PF with invalid descriptor DMA
targets. Count only distinct Received Master Abort events accepted by
the qualified transmit-stall detector and quarantine the VF after five
events.
Preserve quarantine across PF reinitialization, reject reset mailbox
requests, and keep transmit, receive, and clear-to-send disabled.
Recreating SR-IOV clears quarantine. Expose the affected pools through
a read-only bitmap.
After a successful quarantine FLR, leave the function in post-FLR
configuration, explicitly keep decode and bus mastering disabled,
verify the Command register, and refresh its PCI-layer cache so a later
restore cannot re-enable the function.
This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure
[6 lines not shown]
pci: Skip PF SR-IOV state handling for VFs
A VF's pci_devinfo references its PF's pcicfg_iov for resource
bookkeeping, but only the PF implements the SR-IOV capability.
pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as
an owned capability and accessed the PF capability offset in VF
configuration space. Saving a VF could therefore replace the shared
PF settings with unrelated VF register values.
Skip SR-IOV capability save and restore for PCICFG_VF children. The
generic PCI and PCIe state of the VF remains preserved. This is also
required by drivers that save VF state around a PF-driven
function-level reset.
MFC after: 2 weeks
ixgbe: Recover legacy VFs from invalid DMA targets
82599 and X540 lack the X550 malicious-driver detector. Detect a VF
whose PCI status reports a received master abort while its transmit
ring has outstanding descriptors and makes no progress across
consecutive samples.
Consume the accepted PCI status latch, gate that VF I/O, and recover
one pending VF per task pass with round-robin selection. This prevents
an unreadable function from starving detection or recovery of other
VFs.
Save the complete writable VF PCI configuration before FLR, restore it
afterward, and verify the hardware-backed Command state. Preserve the
first good snapshot and pending state across reset events until restore
and verification succeed.
Introduce a common I/O-disabled policy bitmask so later quarantine
policy can extend traffic gating without duplicating fault-state
[3 lines not shown]
riscv/vmm: allow vmm to be built in kernel
Fixes: ed85203fb7a0 ("vmm: Deduplicate VM and vCPU state management code")
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58697
gve: Implement AQ batching for queue creation and destruction
Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.
During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).
Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.
Signed-off-by: Sujithra Periasamy <sujithra at google.com>
[4 lines not shown]
bhyve: rtc_pl031: Fix PeriphID and CellID values
PeriphID and CellID values are determined by macros which take an
index. They currently receive a bus offset which has a stride of 4 bytes.
This causes the ID1-3 registers to report incorrect values.
Scale the offset before passing it to the macro to fix this.
Tested with kvm-unit-tests/arm/pl031.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: jrtc27
Fixes: 014d7082a239 ("bhyve: Implement a PL031 RTC on arm64")
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2358
Closes: https://github.com/freebsd/freebsd-src/pull/2358
ixgbe: force receive drops on every VF queue
PFQDE is indexed by absolute receive queue, but the driver programs one
index per VF. Only the first quarter or half of the VF queues therefore
have queue-drop isolation, depending on the virtualization mode. The
flow-control path can also clear those bits even though SR-IOV requires
them independently of the PF pause policy.
Program every queue in a VF pool before enabling receive for that VF.
For an X550-family VF with an administrative port VLAN, also hide the
VLAN tag as the hardware requires. Keep PF flow-control changes
confined to the PF SRRCTL registers, and clear the VF queue settings
when SR-IOV is torn down and the queues can be reassigned to the PF.
MFC after: 2 weeks
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
(cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
ixgbe: complete PF cleanup after VF FLR
The 82599, X540, and X550 documentation identifies VF registers which
retain state across VFLR and must be reconfigured before a VF is reused.
The VF reset path already initializes its queue-owned registers, but the
PF only cleared VF mailbox memory and transmit head write-back addresses
after a cooperative mailbox reset. A bare hardware VFLR therefore left
both behind on affected devices.
Move TDWBA cleanup into the common reset path. Clear CTS when VFLR
invalidates the mailbox session, and accept only VF_RESET during the
reset pass before restoring VF traffic.
Clear VFMBMEM through the PFU/VFU semaphore. Recheck VFREQ while
holding PFU so a reset event cannot erase a request posted between the
initial mailbox check and the clear. Dispatch an already-read message
even if the residual clear fails, but keep cleanup pending until a
synchronized clear succeeds. Retry cleanup in the same admin pass
after a failed message read or clear.
[17 lines not shown]
ixgbe: recover from X550 malicious-driver events
The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.
Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.
Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
[20 lines not shown]
