ice: Report SR-IOV VF status
Report the VF MAC, allocated transmit and receive queues, exact trunk
VLAN-filter count and capacity, negotiated virtchnl API, configured MAC,
VLAN, spoof-check, and promiscuous-mode policy, automatic link-state
policy, PF traffic permission, and fault containment through iflib.
Expose mirror configuration and active hardware rules, precise
malicious-driver isolation and counters, software mailbox-overflow
isolation and counters, VF-owned MAC-filter count and limit, and reset
diagnostics through a versioned driver.ice extension. Distinguish a
failed VF reset from a required VSI rebuild, which may still be pending
rather than failed. Keep the namespace schema local to the driver so
future extensions need no changes to common network headers or the
formatter.
Invalidate cached VF handshakes during preparation for an externally
initiated device reset, before releasing the context lock to wait for
hardware. Mark the VFs as requiring rebuild even if an early PF rebuild
[14 lines not shown]
ice: Protect the PF mailbox from flooding VFs
Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher. E830 controllers use their per-VF hardware
in-flight-message watermark. On older controllers, attribute a
congested mailbox snapshot to its sender, reset it with its queues
disabled, and discard its subsequent requests. Advance snapshot
accounting even for discarded requests. A physical VFLR, PF reset, or
IOV recreation releases the VF. A blocked VF can still submit mailbox
messages after reset, so discarding requests does not stop it from
replenishing the shared queue.
Process at most one initially full mailbox immediately. If producers
keep it nonempty, mask only the mailbox interrupt cause and let the
periodic admin timer schedule bounded drain work. Keep the shared admin
vector enabled so that OICR and other control-queue events can still be
serviced. Re-enable the mailbox cause after draining and recheck the
queue head for arrivals while the cause was masked. Retry failed reads
through the same deferred path instead of treating them as an empty queue.
[14 lines not shown]
ice: Isolate VFs after malicious-driver detection
Consume the per-function MDD latches to attribute transmit and receive
events to the offending VF. Treat the global debug registers only as
the last-cause diagnostic, add the missing Tx data-protection cause, and
select the E830 TCLAN register addresses when required.
Block every virtchnl request from an offending VF, reset it, and leave
its queues and interrupt mappings unconfigured. Most MDD classes stop a
queue, but Tx data protection only drops the offending packet; the reset
makes the reported blocked state an actual DMA fence for every class.
Complete VFR without restoring resources so a later physical FLR can
create a new reset edge and recover the function.
Complete VFR before restoring queue and interrupt mappings. E810 does
not retain mapping writes while VFSWR remains asserted; retaining the
original hardware order prevents an immediate post-attach VFR from
leaving queue-map enable clear.
[25 lines not shown]
ice(4): Correct SR-IOV filter defaults
The documented VLAN and MAC filter limits are reversed. Match the
defaults in the driver schema: 64 VLAN filters and 16 non-primary MAC
filters per VF.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59027
ice: Make VF MAC filter requests idempotent
VF drivers replay their address filters after reset and may retry a
request whose reply was lost. The PF tracked only a count and
incremented it after an idempotent hardware add, so duplicate replays
eventually exhausted the quota. It then rejected an entire address
batch, including the administrator-assigned address.
Track exact non-primary MAC filter membership within each VF quota.
Validate a complete batch before changing hardware, charge only unique
absent addresses, and update ownership after each successful operation.
Preserve an administrator-assigned address when the VF is not permitted
to change it.
Validated on an E810-XXV with a host-attached iavf VF. The configured
filter quota was filled, then the complete set was replayed across VFR
and PF reset without a duplicate warning or ADD_ETH_ADDR NACK. Deleting
an absent address was a no-op. With allow-set-mac disabled, the guest
could not remove its administrator-assigned filter, while multicast
[5 lines not shown]
ice: Add VF reset and policy failure injection
Extend the optional ICE failure-injection facility with points for the
MAC anti-spoof firmware update and each mandatory VF reset stage.
The reset points report a failed Tx drain command, VFR timeout, receive
queue disable, or final PCIe transaction drain after the corresponding
hardware operation. This permits fail-closed state and recovery tests
without deliberately leaving live DMA during teardown.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59025
ice: Quiesce VFs before device reset
Reset preparation notifies cooperative VFs, then immediately releases
queue maps and firmware topology. A VF which ignores the notification
can continue DMA while the PF tears down the resources which describe
it.
Assert VFSWR for each configured VF before teardown. Run the mandatory
firmware drain serially, disable active receive queues, verify that PCIe
transactions have drained, and leave the VF held until its VSI rebuild
succeeds. Block ordinary mailbox requests as soon as quiesce begins so
a hostile VF cannot re-enable queues in the warning interval.
Also clear VFLR status only after VFRD and perform the final Transaction
Pending check before publishing VFACTIVE. This follows the VF reset
flow in section 4.1.3.3.3 of the Intel E810 Datasheet. Serializing VFs
stays below the documented limit of four concurrent VM/VF reset flows.
Validated on an E810-XXV with active host VFs and a Linux passthrough
[16 lines not shown]
iavf: Probe the Hyper-V VF device ID
The shared code already recognizes IAVF_DEV_ID_VF_HV and handles it
through the regular iavf register and virtchnl paths, but the PCI probe
table omits it. Add the missing entry so the driver attaches.
PR: 239849
(cherry picked from commit d983dc521b6ecaf054bdbe938bd1bf079030f76d)
ixgbe: Correct Wake-on-LAN configuration
Wake-on-LAN capability was inferred from NVM bits on every MAC even
though 82599 support is board and sometimes port specific. Private
sysctls formed a second policy interface, and the driver neither
coordinated the controller wake source with PCI PME nor reliably
rebuilt address filters erased by the stop-time reset.
Use the standard ifconfig wake capabilities. Derive support from the
82599 board and port matrix or the X540-and-newer NVM capability.
Require D3hot PME support, and use the NVM APME bit only to select the
initial magic-packet policy after initializing the LAN function number.
Snapshot requested filters before the terminal stop so shared reset and
PHY code sees the active wake policy. After reset, restore RAR0, the
multicast table, receive filtering, and the optical laser before arming
WUFC, WUC, and PCI PME. Remove device wake sources before clearing PCI
PME on detach, resume, and when wake is disabled. Clear autonomous APM
so ifconfig remains authoritative.
[19 lines not shown]
ixl: Reset VSI statistics after initial sampling
The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index. Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.
Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.
Reported by: Daniel Braniss <danny at cs.huji.ac.il>
Tested by: Daniel Braniss <danny at cs.huji.ac.il>
Obtained from: Intel ixl 1.14.2
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59336
(cherry picked from commit 429cb537015ea11808de23dac8c1cc7ade3a4552)
ixl: Route suspend and resume through iflib
Register the iflib device suspend and resume methods. Remove the
direct initialization from the driver resume callback because
iflib_device_resume() performs the datapath restart after the callback
returns.
Sponsored by: BBOX.io
(cherry picked from commit d5aa8022da56c5188e9f2c7068d95009ff2019be)
ixv: Wire iflib suspend and resume methods
Register the standard iflib device suspend and resume methods so the
framework reinitializes the VF datapath after a system power
transition.
Sponsored by: BBOX.io
(cherry picked from commit 10d09e6e8a7ff141b5dc39e6ddca5b7c2cb0b66b)
iavf: Wire iflib suspend and resume methods
Register the iflib device suspend and resume methods so the existing
driver callbacks run during system power transitions. This stops
mailbox retry work before suspend and lets iflib reinitialize the
datapath after resume.
Sponsored by: BBOX.io
(cherry picked from commit b8fe6d7055b3a274cd646d0a6b5d3928f2fd7d7a)
axgbe: Wire iflib power management methods
Register the standard iflib device methods for shutdown, suspend, and
resume. This gives axgbe the framework managed reinitialization used by
other iflib drivers after a power transition.
Sponsored by: BBOX.io
(cherry picked from commit 2397b18ceb5d69d4d4e3bd0b3ca07dcd077bf843)
enic: Route resets through iflib lifecycle
Mark the driver stopped after attach so its first IFDI_STOP() call
does not repeat hardware shutdown.
Defer error interrupt recovery through iflib instead of calling
driver stop and init methods from interrupt context. Let iflib own
the stop and restart around MTU changes as well, avoiding duplicate
lifecycle operations.
Sponsored by: BBOX.io
(cherry picked from commit 58f985559ee689e50233b9113df4f37375b48c2d)
iflib: Do not hold the ifnet lock across registration
iflib_device_register() acquired IFNET_WLOCK to preserve lock order
when ether_ifattach() was called with the context lock held. The context
lock is now released around ether_ifattach(), making registration-wide
ifnet serialization unnecessary.
Keeping IFNET_WLOCK across driver attachment also allows synchronous
interface event handlers to recurse on it. The rtnetlink interface-group
dump does so through if_foreach_group() while handling the interface
attachment event.
Remove the outer lock and the corresponding failure-path unlock and
relock transitions. Continue to drop the context lock around
ether_ifattach() and taskqueue drains, and preserve context-lock coverage
for driver attach and detach.
Validated under WITNESS on 82576 and I226 controllers. Multiple VF
attach and detach cycles, netmap control operations, and every iflib
[13 lines not shown]
tpm: Move user copies outside the TPM 1.2 lock
The character-device paths held the transaction and lifecycle lock while
uiomove() accessed user memory. A user page fault could therefore delay
suspend or detach, and a copyout failure occurred while the TPM response
was still active.
Copy commands into the bounded stack buffer before taking the lock. For
reads, validate the response header, buffer the complete response while
the lock is held, finish the TPM transaction, and copy it to userspace
after unlocking. Use a non-blocking allocation so memory pressure
cannot turn response buffering into another lifecycle wait.
NetBSD uses the same separation but limits responses to its fixed 1 KiB
buffer. Allocate the TPM-advertised response length to preserve the
existing FreeBSD support for larger streamed responses.
On a ThinkPad T440p with an STMicro TPM 1.2, a PCR read into a 4 KiB
userspace buffer returned the expected 30-byte response. A deliberately
[8 lines not shown]
tpm: Bound TPM 1.2 locality ownership
A TIS locality must remain active while a command is in flight, but
should be relinquished once the command completes or is abandoned. The
driver retained locality zero after probe, initialization, and resume,
and several transaction error paths returned without releasing it.
Closing the device after writing a command without reading its response
had the same effect.
Track locality ownership and whether a command is awaiting its response.
Release locality after probe, initialization, and resume; retain it only
across a successful command write and its matching response read. Abort
and release on errors, replacement commands, close, and detach.
Wait for locality during ISA probe instead of assuming an immediate
grant, release locality acquired by the probe, and stop treating the
command-style TPM_ACCESS register as restorable state.
On a ThinkPad T440p with an STMicro TPM 1.2, the old driver left
[10 lines not shown]
tpm: Remove Giant from the TPM 1.2 driver
Serialize TPM 1.2 commands, character-device methods, and power
transitions with an sx lock, following the command ownership model used
by the TPM 2.0 driver. Reject new operations once detach starts and
drain the character device before releasing transport resources.
Giant also closed the interrupt race between the final TIS status check
and tsleep. Replace that implicit dependency with a mutex and condition
variable, use an absolute deadline across unrelated wakeups, and make
the interrupt handler MPSAFE.
Create the device node atomically with its softc and finish failed write
transactions so every command path releases its transport state.
The polling path was validated on ThinkPad T430 and T440p systems with
their STMicro TPM 1.2 devices enabled. Exclusive-open behavior, 100
consecutive PCR reads, and module unload and reload completed without
errors on both systems. Two consecutive S3 cycles on each system
[8 lines not shown]
tpm: Restore TPM 1.2 TIS state after resume
Firmware restores the state saved by TPM_ORD_SaveState, but the TIS
interrupt, locality, and command FIFO state are not guaranteed to
survive S3. The legacy driver previously treated resume as a no-op.
Revalidate the interface and device identity, disable and acknowledge
stale interrupts, restore the configured interrupt vector, reacquire
locality zero, and return the FIFO to command-ready state. Also disable
TIS interrupts during initial setup when the device uses polling so
firmware settings cannot leave an unhandled interrupt enabled.
TIS 1.3 Table 22 makes the interrupt control registers locality
protected. Acquire locality before disabling or programming them during
initial setup and resume rather than relying on probe retaining
locality.
Keep TPM self-test outside the resume critical path. It can take
minutes on some TPM 1.2 devices and is not required to restore the
[18 lines not shown]
tpm: Correct the TPM 1.2 suspend transaction
The legacy driver wrote TPM_ORD_SaveState directly to the command
FIFO, but used ordinal 156 instead of the TPM 1.2 ordinal 152 and
never completed the transaction through the transport start and end
methods. On a TIS device this omitted TPM_STS_GO, and the response
read used the header length as flags instead of requesting the complete
parameter size. The legacy Atmel reader would also dereference the
null byte-count pointer.
Send the header-only command through the normal transport lifecycle,
validate the response header and TPM result, and retry TPM_WARN_RETRY
for a bounded five seconds. Fail suspend rather than enter S3 after
an unsuccessful state save.
This follows the TPM 1.2 SaveState command definition and the bounded
retry policy used by other TPM 1.2 implementations.
The stock driver failed to resume a ThinkPad T440p with its STMicro
[11 lines not shown]
LinuxKPI: remove timer KPI from Linux version before 4.15
Now that semi-native drivers in main are clean of using any
pre-4.15 Linux timer KPI, remove the macros from LinuxKPI as well.
Supported versions of drm-kmod and the oldest nvidia port seem fine
based on my checks. If anything else surfaces we can deal with the
fallout; the changes to the newer KPI were mechanical in Linux and
can be applied easily.
This change can be detected by #if !defined(init_timer)
at compile time so no need for a __FreeBSD_version bump.
MFC after: 3 days
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D59688
