Merge commit 1f332ae4f1b3 from llvm-project (by Alexander Kornienko):
Fix -Wformat diagnostic after #190965 (#193704)
Fixes libunwind compiler diagnostic when building with clang after
034d4dcad6396d1241e8262e69871b8d61da7e4f:
```
In file included from libunwind/src/libunwind.cpp:31:
In file included from libunwind/src/UnwindCursor.hpp:52:
libunwind/src/CompactUnwinder.hpp:339:46: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
338 | "function starting at 0x%llX",
| ~~~~
| %lX
339 | compactEncoding, functionStart);
| ^~~~~~~~~~~~~
libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
215 | #define _LIBUNWIND_DEBUG_LOG(msg, ...) _LIBUNWIND_LOG(msg, __VA_ARGS__)
| ~~~ ^~~~~~~~~~~
libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
[21 lines not shown]
kern.mk: make clang 23 -Wunused-but-set-global non-fatal
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
bsd.sys.mk: make clang 23 -Wunused-but-set-global non-fatal
This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.
MFC after: 3 days
ice: Fail closed when VF reset does not complete
ice_reset_vf() logs failures to drain PCIe transactions, issue the
mandatory zero-queue command, or observe VFR completion, but still
publishes VFACTIVE. A VF can resume against reset state which the PF
knows is incomplete.
Return an error from the reset operation and retain a reset-failed flag
when any mandatory stage fails. Reject ordinary virtchnl requests while
the failure persists. Publish VFACTIVE only after every stage succeeds.
A later VFLR or PF rebuild can recover the VF and clear the failure.
Remove tracked queue leaves before clearing their software state. The
reset-only AdminQ command drains hardware queues but does not update the
shared scheduler database; losing that bookkeeping can strand queue
resources across VF teardown and recreation.
After a successful VF reset, discard software switch filter state whose
hardware rules were reset and clear guest-owned MAC and VLAN tracking.
[16 lines not shown]
ice: Enforce VF MAC anti-spoof policy
The SR-IOV schema enables MAC anti-spoofing by default, but the driver
never programs the VSI security section. A VF can therefore transmit
with an arbitrary source address despite the configured policy.
Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset. Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.
Validated on E810 hardware with host-attached and Linux passthrough
VFs. Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped. After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.
An injected MAC anti-spoof update failure left the VF inactive.
Destroying and recreating the SR-IOV configuration restored the policy
and traffic.
[4 lines not shown]
ice: Add malformed virtchnl injection points
Extend the optional ice(4) failure injection facility with semantic
corruption points for queue configuration, RSS keys and tables, and
interrupt mappings.
Each point mutates an otherwise valid request after the common
virtchnl length check. This exercises the PF semantic validators with a
real VF while preserving the normal wire format and mailbox path.
The queue point selects unaligned Tx or Rx bases, an unaligned or
unrepresentable receive buffer, an invalid frame size, duplicate queue
IDs, or a bad VSI. The RSS points select short advertised data or an
out-of-range LUT entry. The interrupt point selects an invalid ITR,
traffic on vector zero, duplicate vectors, or a bad VSI.
The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.
[3 lines not shown]
ice: Validate VF virtchnl configuration
Virtchnl requests originate in guest-controlled VFs. The existing PF
implementation checked message shape but allowed several hardware-facing
values through without complete semantic validation.
Require the exact RSS key and LUT sizes advertised to the VF, validate
every LUT entry, and pass only the validated LUT length to firmware. A
short LUT previously caused the AdminQ command to read beyond the
received request.
Validate queue ring bases, descriptor counts, receive buffer units,
maximum frame sizes, and per-VSI consistency before disabling or
changing any queue. This also prevents the 32-bit receive ring length
from being truncated through a 16-bit validation helper.
Advertise the PF frame-size limit in VF resources. Leaving max_mtu
zero causes Linux iavf to request a 16382-byte frame, beyond the
9728-byte limit enforced by this driver.
[20 lines not shown]
man: Link enic.4 to if_enic.4
For consistency, create a symbolic link from enic.4 to also if_enic.4
Reviewed by: ziaee, #manpages
Differential Revision: https://reviews.freebsd.org/D59755
MFC after: 3 days
acpi: Set status to AE_ERROR if device suspend failed
Previously, we would be returning AE_OK from acpi_EnterSleepState().
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59735
nuageinit: fix support on OpenStack
Change added in 90a7728cd8905cd26b90d06f7873df8bad43ae9a contained a
lot of bugs:
- If all network interfaces correctly respond to DHCP, then pwait was
waiting forever.
- If there was more than 1 interface, then "cat
/tmp/ephemeraldhcp.*.pid" joined pid numbers into one long string.
- "for iface in $left; do kill -15 $left; done" is not using $iface.
Tested by: adam.mizerski at ovhcloud.com
Sponsored by: OVHcloud
Pull Request: https://github.com/freebsd/freebsd-src/pull/2436
icmp: Limit routing table updates to the FIB of the redirect
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
arm64/vmm: vtimer: Read CNTPCT_EL0 through a dedicated macro
CNTPCT_EL0 needs to be read after an ISB in order to ensure a consistent
value irrespective of speculative execution.
Make existing reads of CNTPCT_EL0 use a new dedicated accessor macro
that expands to the correct instruction sequence.
Signed-off-by: Kajetan Puchalski <kajetan.puchalski at arm.com>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2423
arm64: Add ACPI support to GICv5 driver
Add ACPI support to the GICv5 IRS, ITS and IWB drivers. Device parameters are
derived from the MADT and IORT tables.
Reviewed by: andrew
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D59171
ig4(4): fix attach of ACPI-enumerated LPSS controllers
Intel LPSS I2C controllers enumerated through ACPI rather than PCI never
attach on Haswell and Broadwell, so every device behind those buses is
lost. On a Dell XPS 13 9343 that hides the I2C HID touchpad and leaves
only the PS/2 fallback, which the firmware does not restore after S3.
Three causes, all on the ACPI path:
Firmware may leave an LPSS function in D3, where its registers read as
all-ones and set_controller() fails with "controller error during
attach-1". Run _PS0 before mapping them. The PCI path does not need
this, which is why the gap went unnoticed.
INT33C2, INT33C3, INT3432 and INT3433 are Lynx Point-LP and Wildcat
Point-LP, which ig4_pci.c already classifies as IG4_HASWELL; the ACPI
path called everything but APMC0D0F an Atom SoC.
The functional clock stays gated until bit 0 of IG4_REG_CLK_PARMS is
[12 lines not shown]
ice: Add a failure injection facility
Add compile-time optional, non-sleeping fail points around every VF
creation resource boundary, before VF VSI reconstruction, and in the
GET_STATS validation path.
Provide an ICE-wide wrapper and device selector so other driver
subsystems can add scoped points without duplicating the failpoint
plumbing. Keep the current SR-IOV points and VF selector in an iov
child namespace.
Compile the facility only with options DRIVER_FAILPOINTS. This shared
option avoids a separate kernel option for every driver that provides
test-only injection hooks. Ordinary kernels contain no ICE failpoint
objects or sysctl nodes. Require an exact PF device name and
optionally a VF index before any point can fire. This prevents a stale
test setting from affecting another PF.
The hooks exposed two reset-lifetime defects while validating the
[13 lines not shown]
ice: Make VF VLAN requests idempotent
VF drivers replay their VLAN filters after a reset and may retry a
request whose reply was lost. The PF tracked only a count and sent
every requested ID back to the switch. After PF reset replay had
already restored the filters, duplicate VID 0 failed with
ICE_ERR_ALREADY_EXISTS and NACKed the entire VF batch.
Track exact VLAN membership for each VF. Compact requests to unique
IDs whose membership changes, enforce the configured limit against
those IDs, and update membership after each hardware operation so
partial failures cannot undercount filters. Treat already-present
adds and already-absent deletes as successful reconciliation and
suppress their misleading low-level error dump.
Validated on an E810-XXV with a host-attached iavf VF. A three-filter
limit was filled with VIDs 0, 1, and 4094. PF and CORE resets replayed
all three without a duplicate warning or ADD_VLAN NACK, and DTrace
confirmed a three-VID replay reached the PF. A fourth unique VID was
[8 lines not shown]
ice: Fix SR-IOV VF resource cleanup
ice_iov_uninit() freed each VF interrupt-map array without returning the
reserved indices to the device interrupt resource manager. Repeated VF
create and destroy cycles therefore exhausted the PF interrupt map even
though no VFs remained.
Return the interrupt allocation before freeing its map. Also split
software-only VSI release from hardware teardown so failures before
ice_initialize_vsi() do not issue invalid RSS, scheduler, and Free VSI
commands for an object firmware has never seen.
Keep a VF disabled until all of its resources and hardware state have
been created successfully. Clear the enabled state before teardown and
after any failed add so asynchronous mailbox processing cannot use a
partial or freed VSI. Consume VFLR status for inactive VF slots without
trying to reset a nonexistent VSI.
Track whether firmware currently owns each VSI and clear that ownership
[14 lines not shown]
powerpc/pmap: Use dcbz to zero pages in the radix pmap
pagezero() was a plain store loop (bzero), which under the kernel build
flags (-mno-vsx -msoft-float) compiles to byte stores. dcbz
establishes a zeroed cache line directly in the cache without a
read-for-ownership fetch from memory, roughly halving the memory
transactions of page zeroing.
Measured on POWER9 (Raptor Blackbird, DD2.3, bare metal), zeroing a
cold 256 MB buffer with 128-byte scalar loops:
byte stores (current libkern memset) 8.6 GB/s
doubleword (std) stores 26.8 GB/s
dcbz 34.6 GB/s
dcbz raises an alignment interrupt on caching-inhibited mappings, and
the kernel does not emulate it, so mmu_radix_zero_page() falls back to
bzero() for any page whose memattr is not the write-back default. The
internal pagezero() callers only touch freshly allocated page-table
[9 lines not shown]
ice: Report VF queue enable failures as hardware errors
The ENABLE_QUEUES handler has already validated the queue selection
before attempting to enable Rx hardware. A timeout or unexpected queue
state is an operation failure, not an invalid virtchnl parameter.
Return VIRTCHNL_STATUS_ERR_ADMIN_QUEUE_ERROR for these failures, matching
the disable path. Keep ERR_PARAM for invalid requests and attempts to
enable unconfigured queues. Preserve the recorded state of queues which
were enabled before a later queue failed.
MFC after: 2 weeks
Sponsored by: BBOX.io
ice: Make VF queue transitions idempotent
The VF mailbox handler unconditionally submitted queue-disable
commands, including when a VF repeated a request or negotiated after a
PF reset had already destroyed its queues. Firmware can reject stale
Tx queue metadata, causing a NACK and unnecessary VF recovery.
Track queue configuration and enable state across virtchnl operations,
and clear it at VF and PF reset. Apply only hardware transitions that
are not already complete while preserving progress after a partial
failure. Validate queue configurations before mutating hardware so the
state maps remain trustworthy.
FreeBSD configures Tx hardware in CONFIG_VSI_QUEUES rather than
ENABLE_QUEUES, so track Tx configuration separately from Rx
configuration and enable state. Linux ice similarly tracks per-VF Tx
and Rx queue state and skips redundant transitions.
On an E810-XXV, the prior code emitted AQ_RC_EINVAL while configuring a
[7 lines not shown]
ice: Rebuild VF VSIs after PF resets
PF and device resets discard all hardware VSI state. ice_rebuild()
only recreated the main PF VSI before replaying configuration for every
VSI. As a result, replay used stale VF VSI handles. Firmware rejected
it with AQ_RC_EACCES and the failure aborted the entire PF rebuild.
Re-add each VF VSI before replaying its configuration, and do not
publish VFACTIVE until both operations succeed. Clear the initialized
state so that the VF must negotiate again. If a VF rebuild fails, leave
it inactive and continue so that one guest cannot prevent the PF or
sibling VFs from recovering.
Mark it initialized only after the resource response is submitted
successfully, so the state follows completion of the mailbox handshake.
Make that failed state authoritative in the mailbox path. While the
firmware VSI is invalid, permit only VERSION and RESET_VF and reject
operations which require VSI state. A VFR may complete the hardware
[44 lines not shown]
ice: Quiesce queues after partial initialization
ice_if_init marks DRIVER_INITIALIZED only after all queue and filter
operations succeed, so ice_if_stop intentionally does nothing after an
initialization failure. Each failure path must therefore unwind any
hardware queues it may have configured before iflib releases their DMA
mappings.
Tx setup enables firmware scheduler queues one at a time, and Rx enable
similarly processes queues incrementally. Route failures from both
operations through cleanup paths for both the PF and mirror VSIs. The
cleanup helpers tolerate queues which were not configured, so they also
cover failures on the first queue.
This leaves failed initialization stopped as required by the
iflib_init_failed contract.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59331
enetc: Correct transmit queue timeout detection
Test the producer and consumer indices after waiting for transmit
completion. The post-decrement loop leaves timeout at -1 on exhaustion,
so testing timeout == 0 missed the actual timeout and could report one
when the final poll completed successfully.
Leave the hardware shutdown sequence unchanged. This only corrects the
diagnostic; runtime FLR recovery and command-buffer lifetime handling
remain separate work.
MFC after: 2 weeks
Sponsored by: BBOX.io
mgb: Propagate DMA setup errors and use the requested channel
Check the receive DMA and frame transfer setup results that were
previously discarded. Return EINVAL for invalid ring/writeback addresses
rather than reporting success, and stop initialization through
iflib_init_failed() when a ring could not be configured.
Use the transmit queue count for transmit initialization and the supplied
channel index for DMA operations. The driver currently allocates one
queue in each direction, so those index/count corrections are latent.
MFC after: 2 weeks
Sponsored by: BBOX.io
