proc_realparent(): do not mark the child as orphan when reparenting to p_opptr pid
Reported and reviewed by: markj
Fixes: 8cef3c9b768a ("proc_realparent(): assert that an orphaned child has real parent != parent")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58566
kqueue: do not buffer the whole knote report when sizing it
kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.
A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D58536
PR: 296835
MFC after: 1 week
bhyve: tpm: Avoid printing a message when clearing the cancel bit
Some drivers do this routinely, e.g., FreeBSD's tpm20 does this every
time it sends a command in tpmcrb_transmit(). This causes the console
to fill up with messages. Instead, only print a warning if the cancel
bit is set to one.
Reviewed by: corvink
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D52425
tests/libc: Fix fortify_source uio tests
Some of the preadv() and readv() tests were not initializing the iovecs
they pass to the system call. When the system call is expected to fail,
that's fine since the FORTIFY_SOURCE checks cause the process to be
aborted. However, in the rest of the test cases, the (p)readv() call
could cause spurious test failures, e.g., when an uninitialized iov
entry points to the current stack frame and the canary gets overwritten.
Modify the tests to explicitly initialize iov entries to avoid this.
The "iov" variants don't have this problem, so leave them alone.
Reviewed by: kevans
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58289
ppp: Reject invalid endpoint discriminator options
Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.
PR: 271910
Reported by: Robert Morris
Reported by: Décio Brandão (0xDBJ)
Reviewed by: emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58554
amd64: Mark the trapframe as initialized in ipi_bitmap_handler()
Fixes: fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
malloc: Fix domainset usage in malloc_domainset() for large allocs
We should of course pass the provided domainset rather than copying what
plain malloc() does.
Fixes: 89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58316
malloc: Refactor redzone and sanitizer handling
malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset(). Refactor the
implementations to reduce this a bit.
Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.
Reviewed by: rlibby
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58272
uma: Insert KASAN redzones after slab-allocated items
Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab. Try to overcome this by adjusting the allocation size to
include a redzone following the object.
With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic. Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.
Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well. It
might be worthwhile to provide a stronger guarantee here.
Add an assertion to item_ctor() that the returned item is properly
aligned. I couldn't see any pre-existing checks which verify this.
[5 lines not shown]
if_gif: Add netlink support with tests
Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666
ixgbe: clear VF head write-back state on reset
VF reset and FLR do not clear the transmit head write-back address
registers. A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.
After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF. Derive the queue
count from the active IOV mode so peer queue state is not touched.
Linux commit dbf231af81a7 documents the hardware behavior. The FreeBSD
implementation follows the local queue mapping and register interfaces.
MFC after: 1 week
ixgbe: dispatch PBA string reads through EEPROM ops
E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation. Dispatch through the EEPROM
operation table so device overrides are honored.
Initialize the generic operation for devices that use the ordinary
EEPROM representation.
Obtained from: Intel ix 3.4.39
MFC after: 1 week
ixgbe: fix host interface timeout detection
The host-interface polling loop was scaled from milliseconds to
microseconds, but its terminal test was left using the unscaled timeout.
Completion at that intermediate iteration can be reported as a timeout,
while actual expiry is not recognized and can accept stale status.
Test against the scaled loop bound used by the polling loop.
Fixes: f46d75c90f5f ("ixgbe: improve MDIO performance by reducing semaphore/IPC delays")
MFC after: 1 week
ixgbe: disable VF multicast reception for empty list
Clear ROMPE for an empty list and enable it only for a nonempty list.
FreeBSD already clears ROMPE when resetting a VF, so that part of the
DPDK change is not needed.
DPDK commit message
net/ixgbe: fix over using multicast table for VF
VMOLR.ROMPE allows a VF to receive packets matching the shared multicast
table. Leaving it enabled after the VF removes its last multicast
address lets PF or peer-VF table entries continue selecting that VF.
Signed-off-by: Wei Zhao <wei.zhao1 at intel.com>
Acked-by: Qi Zhang <qi.z.zhang at intel.com>
Obtained from: DPDK (dc5a6e7422)
MFC after: 1 week
ixgbe: check negotiated API for VF queue query
The GET_QUEUES handler switches on msg[0], which contains the mailbox
command rather than the negotiated API version. It therefore cannot
reject API 1.0 or an unnegotiated VF as intended.
Switch on the API version stored for the VF.
MFC after: 1 week
ixgbe: reject VF requests before CTS
A VF that sends a non-reset request before completing reset negotiation
has not received CTS. The PF ignores the request but currently reports
success, leaving the VF with a false view of the programmed state.
Return failure for the ignored request. This restores the behavior lost
when the mailbox helpers were renamed.
Fixes: 36c516b31136 ("ixgbe: update if_sriov to use the new mailbox apis")
MFC after: 1 week
ixgbe: avoid signed overflow in pause time calculation
pause_time is promoted to signed int before multiplication. Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.
Make the multiplier unsigned so the calculation has the intended u32
semantics. Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction. The 82598-specific flow
control operation contains the identical expression, so correct it as well.
MFC after: 1 week
ixgbe: fix unaligned access in ixgbe_update_flash_X550()
ixgbe_host_interface_command() treats its buffer as a u32 array. The
local union contained only byte-sized fields, giving it one-byte stack
alignment and allowing unaligned accesses on strict-align systems.
Add a u32 member to the union to provide the required alignment and
pass that member to ixgbe_host_interface_command().
No functional change is expected on x86.
Obtained from: Intel ix 3.4.39
MFC after: 1 week
ixgbe: retry incoherent SFP identifier reads
FreeBSD's I2C helper already retries failed transactions. Limit this
new outer loop to successful reads with an invalid identifier so that
retry budget is not multiplied.
DPDK commit message
net/ixgbe: retry misbehaving SFP read
Some XGS-PON SFPs ACK I2C reads and return uninitialized data while
their microcontroller boots. A bogus identifier can cause an otherwise
working module to be marked unsupported.
Retry the identifier read several times, checking for both successful
I2C completion and a valid SFP identifier.
Signed-off-by: Stephen Douthit <stephend at silicom-usa.com>
Signed-off-by: Jeff Daly <jeffd at silicom-usa.com>
[4 lines not shown]
ixgbe: check EEPROM read in 82599 D3 path
DPDK commit message
net/ixgbe/base: fix unchecked return value
Check the return value from ixgbe_read_eeprom() before using the
control word to configure link disable during D3.
Fixes: b7ad3713b958 ("ixgbe/base: allow to disable link on D3")
Cc: stable at dpdk.org
Signed-off-by: Barbara Skobiej <barbara.skobiej at intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Obtained from: DPDK (eb3684b191)
MFC after: 1 week
ixgbe: avoid flow control counter overflow
DPDK commit message
net/ixgbe: fix flow control frame byte adjustment
LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and XOFF
packets. Their deltas are summed and used to adjust the transmitted
packet and byte counters.
Perform the addition in 64 bits so it cannot wrap before the result is
used for the byte adjustment.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: af75078fece3 ("first public release")
Cc: stable at dpdk.org
Signed-off-by: Daniil Iskhakov <dish at amicon.ru>
[4 lines not shown]
ixgbe: copy ACI buffer before command retry
DPDK commit message
net/ixgbe/base: add missing buffer copy for ACI
Add the missing buffer copy in ixgbe_aci_send_cmd().
The retry path saves the original descriptor and allocates storage for
the command buffer so both can be restored before another attempt. It
did not copy the original command buffer into that storage.
Fixes: 25b48e569f2f
Cc: stable at dpdk.org
Signed-off-by: Dan Nowlin <dan.nowlin at intel.com>
Signed-off-by: Yuan Wang <yuanx.wang at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
[2 lines not shown]
ixv: fix multicast address enumeration
if_foreach_llmaddr() adds each callback return value to its running
count. Returning the incremented count made the address indices grow
as 0, 1, 3, 7, and so on, eventually writing beyond the multicast
address array.
Return one address per callback and stop copying when the array is
full, matching the ixv-1.6.12 driver.
Fixes: ff06a8dbb677 ("Mechanically convert ixgbe(4) to IfAPI")
MFC after: 1 week
ixgbe: fail fast on VF-held PF mailboxes
The active PF mailbox operations use the legacy helpers. The mailbox API
import changed check_for_msg into a read-only probe and added up to 2,000
500-microsecond lock retries. If a VF leaves VFU set, the PF cannot acquire
the lock, busy-waits for up to one second, and leaves VFREQ pending so the
delay can repeat.
Give the legacy checker its old consume-on-check behavior so a failed read
does not leave VFREQ asserted. If VFU is already set, fail immediately
instead of retrying, while preserving retries for PF-side contention. Do
not force RVFU, which would discard peer transaction state.
MFC after: 1 week
ixgbe: respect peer mailbox ownership
A VF currently treats an existing VFU bit as a successful acquisition,
while the PF checks its own PFU bit before claiming the mailbox. Check
both the local and peer ownership bits before setting local ownership.
This prevents same-side callers from sharing the mailbox and avoids an
acquisition attempt while the peer owns it.
VFLR does not clear VFMAILBOX.VFU. Clear stale VF ownership and cached
mailbox status after the reset indication settles and before sending the
reset request, so the ownership check cannot strand a reinitialized VF.
Adapt only the live ownership checks from Intel ix 3.4.39. Do not import
its upgraded-mailbox changes, which are not active in FreeBSD.
Obtained from: Intel ix 3.4.39
MFC after: 1 week
ixgbe: isolate VF reset state
IXGBE_VF_INDEX() selects a 32-VF register bank. PFMBMEM() selects
one mailbox per VF, while ixgbe_toggle_txdctl() calculates queue
offsets from a VF number. Passing the bank index aliases VF1-31 to
VF0 and VF32-63 to VF1. Resetting one VF can therefore clear the peer
mailbox and leave its transmit queues disabled.
The VF raises its reset event before posting its mailbox request. The
PF checks reset events before mailbox messages. If both are pending,
clearing PFMBMEM during generic reset handling can erase the request
before ixgbe_read_mbx() consumes it. Clear the mailbox only from the
reset-message handler after the request has been read.
Use the VF number for queue toggling and document that API contract.
MFC after: 1 week
igc: Disable ASPM L1.2 on I226 to prevent RX stalls
I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.
Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.
Adapted from the Linux igc driver:
0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
performance issue
1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
[8 lines not shown]
