pci: Preserve adjusted PCIe control state
The PCI bus changes live capability registers after the initial
configuration snapshot has been saved. A later driver reprobe restores
that snapshot and can silently undo the adjustment.
Update the cached Device Control and Root Control bits together with
pcie_adjust_config() writes. Route the persistent Maximum Read Request
setter and the bus-owned AER control changes through that helper as
well, so they share the same restore semantics as MPS reconciliation.
Document the persistent-write contract. Merge only explicitly adjusted
bits into the saved image so unrelated or transient bits observed during
the hardware read-modify-write cannot become persistent.
MFC after: 2 weeks
pci: Ignore SR-IOV VFs when tuning MPS
The VF Device Control MPS and MRRS fields are reserved and preserved.
VF transactions use the PF MPS, so a hardwired VF value must not be
used to retune the shared PCIe hierarchy.
Document the previously undocumented tuning knob and clarify why a VF
may continue to display its reserved hardwired value.
This fixes an instant crash/reboot on my Zen3 system with 82599 VFs.
MFC after: 1 week
ixv: reconcile VLAN filters through the mailbox
VLAN registration callbacks only update the software shadow, leaving
the PF unaware until a later full initialization. Initialization then
retries each failed request in a tight loop, while skipping replay
entirely when local hardware filtering is disabled.
Send additions and removals as soon as the desired state changes,
independent of the VF local-filter capability. Replay the desired
memberships after reset and retry a bounded batch per timer tick. Stop
after the first failure so a silent PF can consume only one mailbox
timeout per pass, while a responsive PF can drain several requests.
Treat the retry window as a no-progress deadline: advance it when
pending work succeeds so a large backlog can drain, but leave entries
dormant after a sustained failure.
A successful mailbox request wakes a dormant backlog. Dispatch
timer-driven retries only while iflib marks the VF running, so a stale
timer tick cannot restore PF VLAN state after the stop path resets the
[14 lines not shown]
powerpc/pmap: Support booke64 kernel pmap growing
In preparation of increasing the KVA on powerpc64 to 2TB to mirror
amd64's, rework the 64-bit Book-E pmap to not allocate all page table
pages at boot time, since that would be a waste of a lot of memory.
Instead, allocate all page table pages for the higher levels, leaving
the leaves (page directories) for dynamic allocation. This cuts the
boot-time page table size down from ~64MB to ~8MB with the current 32GB
KVA size, and bumping to 2TB KVA the boot-time page table is still ~8MB
instead of ballooning to ~4GB of mostly wasted space.
prometheus_sysctl_exporter: don't abort on bad labels
We can probaby consider these kernel bugs, in which case asserting is
not the most helpful thing we can do. Let's emit the necessary details
to stderr and exit non-zero to aid debugging these without completely
blocking the ability to export all of the well-formed metrics.
Reviewed by: rew
Differential Revision: https://reviews.freebsd.org/D57983
ixgbe: implement VF secondary MAC filters
The PF advertises the legacy SET_MACVLAN mailbox request but always
rejects it. The request installs secondary unicast addresses.
Allocate an owned RAR pool for VF secondary addresses, reserve low
entries for PF filters, and place VF-primary addresses at the top of
the usable RAR range. Reject address collisions and cap each VF at
three secondary filters so one guest cannot exhaust the shared table.
Clear secondary filters on VF or PF reset and on SR-IOV teardown. This
hardware can anti-spoof only the VF primary source address. Reject
secondary filters while MAC anti-spoofing is configured, so installing
them requires an explicit administrative policy choice. Report optional
filter-table allocation failure without disabling SR-IOV.
Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in
a2ed165f0049 to DPDK's ixgbe SET_MACVLAN mailbox semantics.
[2 lines not shown]
ixgbe: enforce VF promiscuity and multicast policy
The allow-promisc IOV property is advertised but ignored, and the PF
rejects the xcast request used by modern VFs. Negotiate mailbox APIs
1.2 and 1.3, implement pool-scoped xcast modes, and require
allow-promisc for requested all-multicast or unicast-promiscuous modes.
The VF mailbox can carry only 30 multicast hashes. When ixv has a
larger list, request the API 1.2 all-multicast xcast mode instead of
extending the legacy SET_MULTICAST message. The PF grants that fallback
only to VFs configured with allow-promisc; otherwise ixv reports that
only the first 30 addresses are active.
Reset xcast state with the VF and have ixv replay the mode implied by
its interface flags after multicast updates.
Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc
policy adapted from igb(4) in a2ed165f0049.
[2 lines not shown]
ixgbe: Preserve priority-tagged traffic with SR-IOV
VID 0 carries only 802.1p priority and does not identify VLAN
membership. Keep VFTA bit zero in the persistent PF shadow table so
reset and SR-IOV replay admit priority-tagged frames while VLAN
filtering is enabled.
In virtualization mode, also reserve VLVF slot zero and restore PF and
eligible VF pool memberships. A VFTA hit alone admits the tag globally
but does not deliver it to the correct pools.
This matches the priority-tag treatment in em/igb.
MFC after: 1 week
ixgbe: preserve VLAN ownership with SR-IOV
The VF VLAN capability is checked but never granted, and no SR-IOV
configuration property exposes the existing default-VLAN support. PF
VLAN updates also replace VFTA registers from a PF-only shadow, erasing
live VF filters.
Expose access VLAN and trunk policy through the IOV schema. Track each
VF VLAN as desired state, restore the administrative VLAN after reset,
and use the native VLVF helper for incremental PF and VF ownership
changes.
Keep VLAN filtering enabled while SR-IOV is active. When PF hardware
filtering is disabled, admit every VLAN to the PF without bypassing
per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and
VF desired state after reset or a filtering-mode transition, and
restore PF-only state on teardown.
When the last VF leaves a VLAN still owned by the PF, free its VLVF
[14 lines not shown]
ixgbe: enforce configured VF anti-spoofing
The SR-IOV schema advertises MAC anti-spoofing and enables it by
default, but the VF configuration was never consumed and the hardware
policy remained disabled.
Record the configured policy and apply MAC and VLAN anti-spoofing
throughout VF initialization and reset. On X550-family devices, also
protect the LLDP and flow-control Ethertypes and enable per-VF
spoof-event accounting. Remove the driver-owned state during SR-IOV
teardown.
Adapt the anti-spoof configuration lifecycle used by igb(4) in
a2ed165f0049 to the ixgbe hardware controls.
MFC after: 1 week
Relnotes: yes
14.5: create releng/14.5 branch
Update from PRERELEASE to BETA1
Switch pkg(8) configuration to use the quarterly repositories
Bump __FreeBSD_version to 1405000
Approved by: re (implicit)
Sponsored by: OpenSats Initiative
evdev: add devnum sysctl
Add a sysctl entry for the evdev device number (devnum) to allow
libudev-devd to populate the corresponding device information
fields (MAJOR and MINOR) when running in a jail with no input devices
exposed through devfs.
Signed-off-by: Quentin Thébault <quentin.thebault at defenso.fr>
Reviewed by: wulf
Sponsored by: Defenso
(cherry picked from commit 746c374aa94b46712e6defb3ab56dd2d6ad8db64)
bsdinstall: add a hardening knob for unprivileged kenv access
It makes sense.
Reviewed by: zleei
Differental Revision: https://reviews.freebsd.org/D57755
stdio: *memstream: grow the buffer by 1.5x on write
This improves performance by reducing the number of allocations as we
write into the memstream, both in the fully buffered case with larger
memstreams and also more trivially in the line- and un-buffered case as
they flush back to the underlying buffer more often.
The inspiration for this was taken from Apple's implementation in
https://github.com/apple-oss-distributions/libc, but expanded to include
wmemstream for consistency. I've added a test for the bug that I hit in
libder that caused me to notice this in the first place, and fixed that
bug in this version.
Reviewed by: des, jhb (both slightly previous version)
Sponsored by: Klara, Inc.
(cherry picked from commit a3a884c0d43ab02187022be9ae9084e6c725ba68)
stdio: *memstream: decouple the buffer size from the stream length
It's useful to be able to track both facts with a single variable, but
it also makes it more difficult to change how the buffer size scales.
As an example, Apple's implementation seems to scale the buffer size by
1.5x on growth, presumably in an attempt to reduce trips into realloc().
This might be questionable in the face of stdio buffering, but avoiding
serious churn in the line- or un-buffered case is a net positive if
doing so isn't incredibly invasive.
Reviewed by: des, jhb, obiwac
Sponsored by: Klara, Inc.
(cherry picked from commit 781defc7eb061a82b1e3e8dbc6b34993f23e79a6)
stdio: *memstream: slightly streamline growth function
Inverting the condition after realloc*() is a minor cleanup, but makes
the success path a little cleaner to ease a future change.
Reviewed by: des, jhb
Sponsored by: Klara, Inc.
(cherry picked from commit 28327c58ee6de7ddbdcf0e56352b257d37f2103d)
hid: u2f: stop interrupts on last-close
This fixes an issue with the Solo2 (and likely some of the Nitrokey
family) where hangs would occur with OpenSSH- it issues a CANCEL prior
to closing the device unconditionally, and without draining the read
endpoint we end up seeing the response to that CANCEL the next time
OpenSSH tries to connect. This throws the entire command/response
sequence out of whack.
This call used to break Yubikeys in some situations, but the fix that
landed in 28d85db46b48 ("xhci: Do not drop and add bits in xhci") seems
to have addressed that- presumably we sometimes end up stopping the
command and desyncing at the controller level. This probably implies
that we need a SYNCWRITE HID quirk, but that requires a little more work
in usbhid_sync_xfer() and this doesn't seem to cause any problems in
normal usage.
Reviewed by: aokblast, wulf
(cherry picked from commit 2e3892671a6fe2bceff6a9d8b439e7acd27dc28a)
usbdump: add -t to omit timestamps
Matches tcpdump naming, but without getting more intense as you add more
-t. This slightly reduces the post-processing needed on usbdump output
to diff two transactions.
Reviewed by: adrian
(cherry picked from commit 87fb416ac8828d07fdf23a2c0d35d88efafce2af)
rockchip: fix stack overflow in rk8xx_rtc
Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
triggering SSP when ntpd set the time on the RockPro64, at the very
least. A minor oops meant that the weeks mask was getting tossed into
the wrong field, and the mask was never populated. The mask is 0x7 for
all three of these, thus overflowing the `data` array in settime by one
byte.
PR: 296719
Reported by: jsm, "Tenkawa" on Discord
Reviewed by: mmel
(cherry picked from commit d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6)
kern: syscall_thread_enter() cannot fail
Attempting to handle the error gracefully can easily result in missing
SIGSYS, so this was made to always succeed in
39024a89146 ("syscalls: fix missing SIGSYS for several ENOSYS errors")
and returns the nosys entry on failure.
Drop the pretense of returning an error and clean up a few dead error
paths.
Reviewed by: kib, markj
(cherry picked from commit eca26803d880060555393ab89b44b967cd467a0e)
evdev: use a prometheus-safe label for ev_sysctl_tree
Prometheus doesn't allow spaces, let's normalize this to what we use
elsewhere for consistency. The sysctl exporter could probably do this
itself, but let's decouple that from the immediate problem: matching the
label between the exported data and in-tree is nice for greppability.
PR: 296179
Reviewed by: asomers, wulf
(cherry picked from commit cb8bda40695f5d402f334f48795b1ab27b72dce5)
kern: osd: trash a slot's methods upon deregistration
This both lets us quickly identify a slot that's been deallocated while
debugging, and forces us to take a fault if something tries to call one
of the methods anyways somehow with osd_destructors[slot - 1] == NULL.
Reviewed by: imp, jamie
(cherry picked from commit 4ffa7e126ed0081b804bda6fb71a60acf49dabda)
kern: osd: abstract away the math for locating a slot method
It's relatively simple, but we'll do it a couple of times; pull it
out into a macro.
Reviewed by: imp (previous version), jamie
(cherry picked from commit 72ebcfae48c42cb28ab6142980416082f8d70abc)
kern: add a security knob to disable unprivileged access to kenv
We sometimes store sensitive things in the kenv that get zapped, but we
really shouldn't rely on that zapping to actually happen. Most
unprivileged processes don't really need to read from the kernel
environment in the first place, so add a knob that allows it to be
disabled.
Note that we consider jailed root to be unprivileged from this
perspective; they have their own meta/env concepts and we should
encourage users to take advantage of those for passing information to
jails.
Relnotes: yes (The capability to disable unpriv access exists)
"Hey we should do something about that": dch
Reviewed by: imp, ziaee, zlei (all slightly previous version)
(cherry picked from commit 4fd518fcb2bbee4c8c41215d6993b923ef57a0e5)
adjtime(2): document that delta can be NULL
The current verbiage somewhat indicates that always adjusts the time,
which hasn't been true as far back as I had the energy to `git blame`.
Reviewed by: imp
(cherry picked from commit 8ed580b1d3811e73e25db3d8a9fd235156c65387)
rights(4): fix our representation of the unused bits
The current format seems to be a little confusing, and the version of it
for index 0 was broken by the below-referenced commit. Break our
UNUSED macros out into one per unused bit to enumerate the entirety of
the space and make it easier to claim an unused one.
Fixes: b165e9e3ea4e327fc ("Add fchroot(2)")
Reviewed by: oshogbo (previous version), kib, markj
(cherry picked from commit 57fefbee1f959d0c65376dbdad309d01c182d710)
socket: remove tautological condition in so_unsplice()
so2rele was introduced in 1000cc4a0d3 and it was necessary there, but
the cleanup in a837d1fe49e0255 rendered it redundant if our own KASSERT
is to be believed: we've asserted that `so2->so_splice_back == sp` and
`sp` has been dereferenced above, so there's no condition left where
we shouldn't release the socket reference at the end. Indeed, the
change in so_splice() to NULL out sp->dst removes that possible state of
a partially constructed splice: if sp->dst is set, it has been ref'd.
Reviewed by: gallatin, markj
(cherry picked from commit 8a3d28375450946e4b0de239c9239df54c22d298)
