When ena_detach is called, we first call ether_ifdetach(),
which destroys internal addresses of ifp. One such address
is ifp->if_addr->ifa_addr. Then during ena_destroy_device(),
if_link_state_change() is called, eventually trying to access
ifp->if_addr->ifa_addr->sa_family. This causes an access
to garbage memory and crashes the kernel.
Ticket [1] was opened to the FreeBSD community to add null
check in the code of if_link_state_change().
A fix was submitted in commit [2], however it was noted
that it is our driver's responsibilty to not call
if_link_state_change() after calling ether_ifdetach().
This commit makes sure if_link_state_change() is not called
after ether_ifdetach().
[1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813
[2]: https://reviews.freebsd.org/D39614
Fixes: 32f63fa7f9 ("Split ENA reset routine into restore and destroy stages")
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
In [1], the FBSD community exposed a bug in the fbsd/ena driver.
Bug description:
----------------
Current function call order is as follows:
1. ena_attach()
1.1. ena_setup_ifnet()
1.1.1. Registration of ena_get_counter()
1.1.2. ether_ifattach(ifp, adapter->mac_addr);
1.2. Statistics allocation and initialization.
At point 1.1.2, when ether_ifattach() returns, the interface is available,
and stats can be read before they are allocated, leading to kernel panic.
Also fixed a potential memory leak by freeing the stats since they were
not freed in case the following calls failed.
Fix:
----
This commit moves the statistics allocation and initialization to happen
before ena_setup_ifnet()
[1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268934
Fixes: 9b8d05b8ac ("Add support for Amazon Elastic Network Adapter (ENA) NIC")
Fixes: 30217e2dff ("Rework counting of hardware statistics in ENA driver")
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
- Increase verbosity to direct i/o code path (iores != 0)
- Fix pin inversion configuration
- Allow forcing the use of indirect access channel via hint.gpio.0.flags=2
- Document the PREFER_INDIRECT_CHANNEL tunable in nctgpio(4)
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/719
Add some extra files for building the driver as part of the kernel.
Change some #defines to match those used when building as a module.
PR: 268354
Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/779
I do not know why this is here but it blocks compilation.
Removing it makes the builtin option the same as the module build
Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/779
internal_ram_wr() only takes 3 args when ECORE_CONFIG_DIRECT_HWFN
is defined
Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/779
SRIOV is being enabled in ecore.h but by then
the qlnx_os.h header has been processed and not
included the relevant headers
Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/779
Older Chromebooks have issues in their embedded controller (EC) firmware
which need working around in atkbd and atkbdc. On these systems, rather
than use a standard EC, Google used their own arm-based EC. For a while,
its firmware incorrectly implemented the i8042, requiring workaroundsd
in the driver.
Implement a heuristic recommended by MrChromebox <mrchromebox@gmail.com>
to detect them: If the bios.version starts with Google_, or the maker is
either Google or GOOGLE, assume that it's a chromebook with the affected
bios. While this isn't strictly true, the number of updated systems
without the bug is very small and this will exclude all the non-Google
coreboot user that use a standard EC. There's no simple way to test the
hardware to see if it's implemented with the buggy EC.
Sponsored by: Netflix
Reviewed by: jon@thesoo.org, MrChromebox
Differential Revision: https://reviews.freebsd.org/D40789
The DMA scatter/gather list for mrsas passthrough ioctl commands is
stored in a SGL at the end of the DCMD frame. Given the SGL member at
the end of the DCMD frame it seems likely this S/G list is formatted
as a fixed-width structure such as the type mrsas_sge64 and not as a
iovec which contains a kernel pointer and length that vary with the
native architecture size.
Reviewed by: imp
Obtained from: CheriBSD
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D40727
On Purism coreboot systems the quirks mode in atkbdc prevents built in
Keyboard from being used. Add quirk to prevent that.
MFC After: 2 weeks
PR: 271737
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D40405
- Replace a magic number with CTS_NVME_VALID_SPEC.
- Set the transport and protocol versions the same as for XPT_PATH_INQ.
Probably we shouldn't bother with setting the version in the 'spec'
member of ccb_trans_settings_nvme at all and use the transport
and/or protocol version field instead.
Reviewed by: chuck, imp
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D40616
The ichsmb driver does not actually handle SMBALERT, other than by logging the
first 16 occurences of the ICH_HST_STA_SMBALERT_STS_SMBALERT status
flag. Because the SMBALERT is not acknowledged by the host, clearing it in the
host status register does not appear to work as long as some slave device is
pulling the SMBALERT line low, at least for C2000 chips. As a result, if a slave
device does pull SMBALERT low the interrupt handler will always loop its maximum
of 16 times attempting to clear all status register flags and device_printf the
status register. The result is the kernel message buffer is littered with these
device_printfs at every interrupt.
To remedy the problem, the ICH_HST_STA_SMBALERT_STS flag is zeroed in the read
host status register value, just as with ICH_HST_STA_INUSE_STS and
ICH_HST_STA_HOST_BUSY. This allows the loop to break when no other flags that
must be handled are set in the host status register. Additionally, because the
SMBALERT is not actually handled the SMBALERT logging is omitted as it has no
actual function at this time.
Reviewed by: imp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D39966
If MOD_LOAD fails, then MOD_UNLOAD will be called to unwind module
state, but wg_module_init() will have already deinitialized everything
it needs to in a manner that renders it unsafe to call MOD_UNLOAD
after (e.g., freed zone not reset to NULL, wg_osd_jail_slot not reset
to 0). Let's simply stop trying to handle freeing everything in
wg_module_init() to simplify it; let the subsequent MOD_UNLOAD deal with
it, and let's make that robust against partially-constructed state.
jhb@ notes that MOD_UNLOAD being called if MOD_LOAD fails is kind of an
anomaly that doesn't match other paradigms in the kernel; e.g., if
device_attach() fails, we don't invoke device_detach(). It's likely
that a future commit will revert this and instead stop calling
MOD_UNLOAD if MOD_LOAD fails, expecting modules to clean up after
themselves in MOD_LOAD upon failure. Some other modules already do this
and may see similar problems to the wg module (see: carp). The proper
fix is decidedly a bit too invasive to do this close to 14 branching,
and it requires auditing all kmods (base + ports) for potential leaks.
PR: 272089
Reviewed by: emaste
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D40708
Previously we'd jump to the `free_crypto` label, but never set `ret` to
a failure value -- it would retain success from the call just prior.
Set ret up properly.
This is part of D40708, but not the main point of the change.
We kept le(4) in the pre-12.0 purge because it was needed for Qemu/MIPS
(virtio networking didn't work) but the MIPS port has been removed.
Reviewed by: emaste
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D40683
This update contains a rewrite of the VPD parser based on the
definition of the structure of the VPD data (ident, R/O resource
data, optional R/W data, end tag).
The parser it replaces was based on a state machine, with the tags
and the parsed data controlling the state changes. The flexibility
of this parser is actually not required, and it has caused kernel
panics when operating on malformed data.
Analysis of the VPD code to make it more robust lead me to believe
that it was easier to write a "strict" parser than to restrict the
flexible state machine to detect and reject non-well-formed data.
A number of restrictions had already been added, but they make the
state machine ever more complex and harder to understand.
This updated parser has been verified to return identical parsed data
as the current implementation for the example VPD data given in the
PCI standard and in some actual PCIe VPD data.
It is strict in the sense that it detects and rejects any deviation
from a well-formed VPD structure.
PR: 272018
Approved by: kib
MFC after: 4 weeks
Differential Revision: https://reviews.freebsd.org/D34268
When running VM on ARM64 Hyper-V, we have seen netvsc/hn driver hit
assert on reading duplicated network completion packets over vmbus
channel or one of the tx channels stalls completely. This seems to
caused by processor reordering the instructions when vmbus driver
reading or updating its channel ring buffer indexes.
Fix this by using load acquire and store release instructions to
enforce the order of these memory accesses.
PR: 271764
Reported by: Souradeep Chakrabarti <schakrabarti@microsoft.com>
Reviewed by: Souradeep Chakrabarti <schakrabarti@microsoft.com>
Tested by: whu
Sponsored by: Microsoft
Previously every file that included mpi3mr_app.h but did not use
mpi3mr_mgmt_info reported error: 'mpi3mr_mgmt_info' defined but not
used.
Fixes: 2d1d418e1e ("mpi3mr: 3rd Generation Tri-Mode NVMe/SAS/SATA...")
Reported by: amd64-gcc12 Cirrus-CI job
Sponsored by: The FreeBSD Foundation
This is required for pci_alloc_msix() to work and to thus use
MSI-X interrupts for PCI-e hotplug.
Reported by: cperciva
Reviewed by: cperciva
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D40581
The Emulex OneConnect NIC driver hasn't seen any commits other than ioctl
bug fixes (some severe) and sweeping commits since 2016. There is no
indication of new parts since 2014 or earlier. As such, deprecate the
driver with the aim of removing it prior to FreeBSD 15.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D40531
Replace direct stores to userspace addresses (never safe and broken on
modern CPUs) with a copyout. Use a static assert on the size to ensure
we don't overflow the field.
Reviewed by: markj, jhb
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D40519
This is Broadcom's mpi3mr driver for FreeBSD version 8.6.0.2.0.
The mpi3mr driver supports Broadcom SAS4116-based cards in the 9600
series: 9670W-16i, 9670-24i, 9660-16i, 9620-16i, 9600-24i, 9600-16i,
9600W-16e, 9600-16e, 9600-8i8e.
Initially only available as a module and on amd64/arm64, since that's
how it has been tested to date. Future commits will add it to the kernel
build and may expand the architectures it is supported on.
Co-authored-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Feedback-by: ken (prior versions)
Reviewed-by: imp
RelNotes: yes
Differential-Revision: https://reviews.freebsd.org/D36771
Differential-Revision: https://reviews.freebsd.org/D36772
Use a goto to clarify the control flow when there is no process
descriptor. This wins back a level of indentation.
No functional change intended.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40518
Split out the functional logic from the syscall handler into a helper
function. This keeps it separate from the syscall control-flow logic,
resulting in better readability overall. It also wins back a level of
indentation.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40294
Split out the functional logic from the syscall handler into a helper
function. This keeps it separate from the syscall control-flow logic,
resulting in better readability overall. It also wins back a level of
indentation.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40293
Split out the large chunk of functional logic from the syscall handler
into a helper function. This keeps it separate from the syscall
control-flow logic, resulting in better readability overall. It also
wins back a level of indentation.
Flip the return values of the pmc_can_allocate_row() and
pmc_can_allocate_rowindex() functions to boolean types, like their
naming implies. We weren't actually using the error codes they were
returning.
While here, make some small style cleanups. No functional change
intended.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40292
Begin splitting out the large chunks of functional logic from the
syscall handler into separate helper functions. This keeps it separate
from the syscall control-flow logic, resulting in better readability
overall. It also wins back a level of indentation.
For this and the similar changes to follow, try to keep copyin() and
copyout() calls outside of the helper functions. The changes are
intended to have no functional impact, but do address style issues.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40291
Move the functionality into a separate helper function. All other
actions in pmc_hook_handler() already have this.
While here make some small style improvements. Restructure one for loop.
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40333
Everything else I found worthy of adjustment.
- Order local variable declarations per style(9)
- Make use of __unused annotations rather than cast to void
- Remove unnecessary casts
- Add (void) casts to PMC class methods where the return value is
ignored
- A couple instances of reordering statements for clarity
- Prefer bool type where applicable
- unsigned int -> u_int
- Use uintmax_t/%j in printf calls
- Formatting of comments
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40517
- Explicitly check the value in conditional statements, per style(9)
- Add braces around more loops and conditionals, wherever it appears
(to me) to aid legibility
- Expand some assignments within if statements
- Fix formatting around list-type FOREACH macros
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40515
Handle a few things related to spacing:
- Remove redundant/superfluous blank lines (and add a couple where
helpful)
- Add spacing around binary operators
- Remove spacing after casts and before goto labels
- Adjustments for line width of 80 chars
- Tab/space character issues
Reviewed by: jkoshy
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40514
We already run nda by default on all the !x86 architectures. Switch the
default to nda. nda created nvd compatibility links by default, so this
should be a nop. If this causes problems for your application, set
hw.nvme.use_nvd=1 in your loader.conf.
Sponsored by: Netflix
