amdsmu: Fix CPU-model-specific matching
For Krackan Point, CPU-model-specific matching would not work because
amdsmu_match() browses amdsmu_products[] in order and returns the first
match, and the Krackan Point's 'struct amdsmu_product' object variant
with a 'model' field of 0, indicating that any model matches, is listed
before the variant with model 0x70 in amdsmu_products[].
In practice, this means that reporting of IP blocks for Krackan Point
model 0x70 only was broken. Specifically, not all the existing blocks
were reported and most statistics were not attributed to the right
blocks.
Fix this by making amdsmu_match() parse amdsmu_products[] in reverse, so
CPU-model-generic entries can continue to appear first and new specific
ones can be added after them, which is the expected chronological order
of additions.
While here, since the CPU model is between 0 and 255, change the type
[11 lines not shown]
dpaa: Add QorIQ Security Engine (SEC) driver
The QorIQ Security Engine (SEC) generally fits into the Data Path
Acceleration Architecture, accelerating cryptographic operations.
Currently this driver does not use the QMan interface, instead relying
on the job rings, as Linux also does, to reduce complexity until needed
for network protocol acceleration, like IPSec and OpenVPN.
Initial testing via `openssl speed -engine devcrpto -evp aes-128-cbc`
yields a ~200x throughput improvement, from 105MB/s to more than 20GB/s
for 16k block sizes.
Differential Revision: https://reviews.freebsd.org/D59581
powerpc/conf: Add some crypto options to QORIQ64
With the DPAA Security Engine (SEC) KERN_TLS should provide some
enhancement over userland software TLS. Also, add IPSEC_SUPPORT, so
that ipsec can be loaded if needed.
dpaa: Add ContextA and ContextB to qman_fq_create
The SEC QMan interface stores context in context_a and context_b, so add
them to the frame queue creation.
hn: Refresh VF RSS configuration after link recovery
A VF can finish initialization or reset recovery after hn's handoff-time
RSS query returned ENXIO. In that case hn suppresses synthetic receive
hash metadata, but previously left it disabled even after the VF could
answer the queries again.
Queue an RSS refresh on a VF link-up notification, using the existing VF
worker in both transparent and non-transparent modes. Revalidate the
association, active VF path, administrative state, and carrier under
hn_lock before querying and reconfiguring synthetic RSS. Coalesce the
requests with an atomic flag and retain a request while capability
forwarding temporarily excludes the worker. Keep the existing query
validity checks and unsupported-query fallback unchanged.
This is a one-shot refresh, not a readiness poll. Recovery without a
link-up notification, or a query that still fails during the refresh,
does not trigger another retry by itself. A later link-up or normal
handoff can query again. Consuming the request while the VF path is
[17 lines not shown]
iavf: Reschedule pending virtchnl replies after the processing budget
The VC worker ignores the pending count returned by iavf_process_adminq.
If a pass exhausts its message budget, replies can remain in the receive
ring without another interrupt to schedule the worker. During init,
the iflib admin task cannot provide a backstop because init holds the
context lock while waiting for ENABLE_QUEUES to complete.
Reschedule the VC worker after a successful pass with messages remaining.
Keep the per-pass budget and do not retry AdminQ errors. Stop
self-rescheduling once detach clears INITIALIZED; the existing polling
and reset-recovery gates continue to exclude asynchronous processing.
Validation: reproduced the timeout on a three queue E835 VF under
Hyper-V. Temporary tracing showed a successful ENABLE_QUEUES reply
already in the guest receive ring after a three-message pass left two
messages pending. With the fix and no tracing, a GENERIC kernel with
WITNESS and INVARIANTS passed three batches of 30 down/up and MTU
1500/9000 cycles without enable/disable timeouts.
[3 lines not shown]
amdsmu: Hints on what to do if IP block blocking S0i3
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59674
amdsmu: Diagnose S0i3 entry after resume
Print out diagnostic information after resuming from suspend-to-idle if
we failed to enter S0i3, i.e. the IP blocks that were blocking entry to
S0i3.
Don't give detailed IP block info for other SMUs than for Phoenix, as I
have not had a chance to test these yet and the SMU seems to be very
quirky.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59673
power: Add power_resume_check eventhandler
This is intended to be used on resuming to check that everything that
happened during suspend was expected.
It is not meant to check for errors we should hard-fail from, rather it
should be used as an opportunity for drivers such as amdsmu(4) to check
e.g. whether the previous suspend-to-idle actually entered a deep sleep
state (S0i3).
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59740
acpi: Don't check suspend-to-idle if suspend failed
If we e.g. failed to suspend a device and suspend bounced because of
that, then we're not expected to have entered a deep sleep state in the
first place. In this situation, don't overload the user with irrelevant
information.
Reviewed by: olce
Fixes: 5f68acc931a4 ("acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59731
route/fib_algo: Fix nexthop index collision across families
fib_algo indexes its idx->nhop array by the nexthop index with
assumption of its uniqueness. Which is true except for IPv4 over
IPv6 nexthops.
Give each index space its own segment within the same array and
offset the index by the segment base. Segments are created on demand
and sized independently, so the rib's own family keeps base 0 and
tables without cross-family nexthops index exactly as before.
Reviewed by: melifaro
Discussed with: markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59552
bhyve: Add an option to prevent automatic restart in monitor mode
Monitor mode will currently unconditionally restart the guest if it
reboots, which can be incovenient in certain situations (e.g., resetting
the guest after a panic).
Address this by introducing a way to prevent automatic guest restarts
in monitor mode.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59123
db/hash: Harden hash(3) database code
The hash(3) database code does not validate the on-disk database header,
leaving it open to several OOB read and write vulnerabilities.
This change adds basic header validation and array bounds checking to
parts of the hash(3) code that can be manipulated by messing with the
database header.
Reviewed by: kevans
Sponsored by: Klara, Inc.
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58822
ice: Report SR-IOV VF status
Report the VF MAC, allocated transmit and receive queues, exact trunk
VLAN-filter count and capacity, negotiated virtchnl API, configured MAC,
VLAN, spoof-check, and promiscuous-mode policy, automatic link-state
policy, PF traffic permission, and fault containment through iflib.
Expose mirror configuration and active hardware rules, precise
malicious-driver isolation and counters, software mailbox-overflow
isolation and counters, VF-owned MAC-filter count and limit, and reset
diagnostics through a versioned driver.ice extension. Distinguish a
failed VF reset from a required VSI rebuild, which may still be pending
rather than failed. Keep the namespace schema local to the driver so
future extensions need no changes to common network headers or the
formatter.
Invalidate cached VF handshakes during preparation for an externally
initiated device reset, before releasing the context lock to wait for
hardware. Mark the VFs as requiring rebuild even if an early PF rebuild
[14 lines not shown]
ice: Protect the PF mailbox from flooding VFs
Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher. E830 controllers use their per-VF hardware
in-flight-message watermark. On older controllers, attribute a
congested mailbox snapshot to its sender, reset it with its queues
disabled, and discard its subsequent requests. Advance snapshot
accounting even for discarded requests. A physical VFLR, PF reset, or
IOV recreation releases the VF. A blocked VF can still submit mailbox
messages after reset, so discarding requests does not stop it from
replenishing the shared queue.
Process at most one initially full mailbox immediately. If producers
keep it nonempty, mask only the mailbox interrupt cause and let the
periodic admin timer schedule bounded drain work. Keep the shared admin
vector enabled so that OICR and other control-queue events can still be
serviced. Re-enable the mailbox cause after draining and recheck the
queue head for arrivals while the cause was masked. Retry failed reads
through the same deferred path instead of treating them as an empty queue.
[14 lines not shown]
ice: Isolate VFs after malicious-driver detection
Consume the per-function MDD latches to attribute transmit and receive
events to the offending VF. Treat the global debug registers only as
the last-cause diagnostic, add the missing Tx data-protection cause, and
select the E830 TCLAN register addresses when required.
Block every virtchnl request from an offending VF, reset it, and leave
its queues and interrupt mappings unconfigured. Most MDD classes stop a
queue, but Tx data protection only drops the offending packet; the reset
makes the reported blocked state an actual DMA fence for every class.
Complete VFR without restoring resources so a later physical FLR can
create a new reset edge and recover the function.
Complete VFR before restoring queue and interrupt mappings. E810 does
not retain mapping writes while VFSWR remains asserted; retaining the
original hardware order prevents an immediate post-attach VFR from
leaving queue-map enable clear.
[25 lines not shown]
ice(4): Correct SR-IOV filter defaults
The documented VLAN and MAC filter limits are reversed. Match the
defaults in the driver schema: 64 VLAN filters and 16 non-primary MAC
filters per VF.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59027
ice: Make VF MAC filter requests idempotent
VF drivers replay their address filters after reset and may retry a
request whose reply was lost. The PF tracked only a count and
incremented it after an idempotent hardware add, so duplicate replays
eventually exhausted the quota. It then rejected an entire address
batch, including the administrator-assigned address.
Track exact non-primary MAC filter membership within each VF quota.
Validate a complete batch before changing hardware, charge only unique
absent addresses, and update ownership after each successful operation.
Preserve an administrator-assigned address when the VF is not permitted
to change it.
Validated on an E810-XXV with a host-attached iavf VF. The configured
filter quota was filled, then the complete set was replayed across VFR
and PF reset without a duplicate warning or ADD_ETH_ADDR NACK. Deleting
an absent address was a no-op. With allow-set-mac disabled, the guest
could not remove its administrator-assigned filter, while multicast
[5 lines not shown]
ice: Add VF reset and policy failure injection
Extend the optional ICE failure-injection facility with points for the
MAC anti-spoof firmware update and each mandatory VF reset stage.
The reset points report a failed Tx drain command, VFR timeout, receive
queue disable, or final PCIe transaction drain after the corresponding
hardware operation. This permits fail-closed state and recovery tests
without deliberately leaving live DMA during teardown.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59025
ice: Quiesce VFs before device reset
Reset preparation notifies cooperative VFs, then immediately releases
queue maps and firmware topology. A VF which ignores the notification
can continue DMA while the PF tears down the resources which describe
it.
Assert VFSWR for each configured VF before teardown. Run the mandatory
firmware drain serially, disable active receive queues, verify that PCIe
transactions have drained, and leave the VF held until its VSI rebuild
succeeds. Block ordinary mailbox requests as soon as quiesce begins so
a hostile VF cannot re-enable queues in the warning interval.
Also clear VFLR status only after VFRD and perform the final Transaction
Pending check before publishing VFACTIVE. This follows the VF reset
flow in section 4.1.3.3.3 of the Intel E810 Datasheet. Serializing VFs
stays below the documented limit of four concurrent VM/VF reset flows.
Validated on an E810-XXV with active host VFs and a Linux passthrough
[16 lines not shown]
iavf: Probe the Hyper-V VF device ID
The shared code already recognizes IAVF_DEV_ID_VF_HV and handles it
through the regular iavf register and virtchnl paths, but the PCI probe
table omits it. Add the missing entry so the driver attaches.
PR: 239849
(cherry picked from commit d983dc521b6ecaf054bdbe938bd1bf079030f76d)
ixgbe: Correct Wake-on-LAN configuration
Wake-on-LAN capability was inferred from NVM bits on every MAC even
though 82599 support is board and sometimes port specific. Private
sysctls formed a second policy interface, and the driver neither
coordinated the controller wake source with PCI PME nor reliably
rebuilt address filters erased by the stop-time reset.
Use the standard ifconfig wake capabilities. Derive support from the
82599 board and port matrix or the X540-and-newer NVM capability.
Require D3hot PME support, and use the NVM APME bit only to select the
initial magic-packet policy after initializing the LAN function number.
Snapshot requested filters before the terminal stop so shared reset and
PHY code sees the active wake policy. After reset, restore RAR0, the
multicast table, receive filtering, and the optical laser before arming
WUFC, WUC, and PCI PME. Remove device wake sources before clearing PCI
PME on detach, resume, and when wake is disabled. Clear autonomous APM
so ifconfig remains authoritative.
[19 lines not shown]
ixl: Reset VSI statistics after initial sampling
The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index. Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.
Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.
Reported by: Daniel Braniss <danny at cs.huji.ac.il>
Tested by: Daniel Braniss <danny at cs.huji.ac.il>
Obtained from: Intel ixl 1.14.2
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59336
(cherry picked from commit 429cb537015ea11808de23dac8c1cc7ade3a4552)
ixl: Reset VSI statistics after initial sampling
The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index. Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.
Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.
Reported by: Daniel Braniss <danny at cs.huji.ac.il>
Tested by: Daniel Braniss <danny at cs.huji.ac.il>
Obtained from: Intel ixl 1.14.2
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59336
(cherry picked from commit 429cb537015ea11808de23dac8c1cc7ade3a4552)
