aboutsummaryrefslogtreecommitdiff
path: root/sys/dev
Commit message (Collapse)AuthorAgeFilesLines
...
* ufshci: skip the reinit when the new link worksJaeyoon Choi2026-09-021-4/+19
| | | | | | | | | | | | | | | UFSHCI_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH always rebuilt the link after the gear switch. It threw away a working HS link and ended up in PWM. The reinit is only needed for a dead link. There the local side reports HS and the peer never answers. A local readback cannot tell the two apart. Peer traffic can. Probe the peer with DME_PEER_GET after the switch. Skip the reinit when the probe succeeds. Log it when the probe fails. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D59299
* ufshci: set HS series per platform and adapt type per gearJaeyoon Choi2026-09-026-9/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver always asked for Rate-B. It never set the adaptation type. The Snapdragon X Elite firmware tunes the PHY for Rate-A. A Rate-B link dies at every gear there. HS-G4 and above need initial adaptation. This is a UniPro rule. It applies to every host. Add an hs_series field to the device tables. Use Rate-A on the Snapdragon X Elite. Keep Rate-B on the PCI hosts. A table entry without an HS series fails to attach. Set PA_TxHsAdaptType to initial adaptation at HS-G4 and above. Leave it alone below that. Hosts before UniPro 1.8 do not have it. The Galaxy Book 4 Edge now links at HS-G5 Rate-A. fio results (128k sequential, 4k random, posixaio): QD | SEQ_R(MiB/s) | SEQ_W(MiB/s) | RND_R(kIOPS) | RND_W(kIOPS) ----+--------------+--------------+--------------+------------- 1 | 1357 | 1221 | 12.1 | 27.2 4 | 3103 | 3234 | 46.5 | 92.9 32 | 3508 | 3238 | 176.4 | 125.0 Sequential writes land in the WriteBooster buffer. Sustained writes drop to 556 MiB/s once the buffer runs out. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D59298
* ufshci: fix the Snapdragon X Elite reference clockJaeyoon Choi2026-09-022-1/+22
| | | | | | | | | | | | | | | | The driver's ACPI table set bRefClkFreq to 19.2 MHz. The Snapdragon X Elite feeds the device 38.4 MHz from its CXO. The firmware has no property for it. The device ran its PLL from the wrong base. Every HS mode failed. PWM still worked. The attribute is persistent. The wrong value survived reboots. Set 38.4 MHz in the table. Read the attribute first. Write it only when the value differs or the read fails. Log a changed value and a failed read. Verified on the Galaxy Book 4 Edge. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D59297
* rtwn: add support for the RTL8723BUAhmad Khalifa2026-09-0120-0/+2411
| | | | | | | | Pushed using the RTL8723BU. Reviewed by: ziaee, avos, adrian Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59205
* rtwn: fix typo s/rtwm/rtwnAhmad Khalifa2026-09-011-2/+2
|
* tpm: Move user copies outside the TPM 1.2 lockKevin Bowling2026-09-011-29/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | The character-device paths held the transaction and lifecycle lock while uiomove() accessed user memory. A user page fault could therefore delay suspend or detach, and a copyout failure occurred while the TPM response was still active. Copy commands into the bounded stack buffer before taking the lock. For reads, validate the response header, buffer the complete response while the lock is held, finish the TPM transaction, and copy it to userspace after unlocking. Use a non-blocking allocation so memory pressure cannot turn response buffering into another lifecycle wait. NetBSD uses the same separation but limits responses to its fixed 1 KiB buffer. Allocate the TPM-advertised response length to preserve the existing FreeBSD support for larger streamed responses. On a ThinkPad T440p with an STMicro TPM 1.2, a PCR read into a 4 KiB userspace buffer returned the expected 30-byte response. A deliberately short five-byte read failed cleanly, relinquished locality zero, and the next PCR read succeeded. Reviewed by: kevans MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59238
* tpm: Bound TPM 1.2 locality ownershipKevin Bowling2026-09-012-39/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A TIS locality must remain active while a command is in flight, but should be relinquished once the command completes or is abandoned. The driver retained locality zero after probe, initialization, and resume, and several transaction error paths returned without releasing it. Closing the device after writing a command without reading its response had the same effect. Track locality ownership and whether a command is awaiting its response. Release locality after probe, initialization, and resume; retain it only across a successful command write and its matching response read. Abort and release on errors, replacement commands, close, and detach. Wait for locality during ISA probe instead of assuming an immediate grant, release locality acquired by the probe, and stop treating the command-style TPM_ACCESS register as restorable state. On a ThinkPad T440p with an STMicro TPM 1.2, the old driver left TPM_ACCESS at 0xa1 immediately after attach. The new driver left it at 0x81 after attach, completed PCR reads, and closing with an unread response. PCR reads also survived an unload and reload without TPM or locking diagnostics. Reviewed by: kevants MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59237
* tpm: Remove Giant from the TPM 1.2 driverKevin Bowling2026-09-012-146/+261
| | | | | | | | | | | | | | | | | | | | | | | | | | | Serialize TPM 1.2 commands, character-device methods, and power transitions with an sx lock, following the command ownership model used by the TPM 2.0 driver. Reject new operations once detach starts and drain the character device before releasing transport resources. Giant also closed the interrupt race between the final TIS status check and tsleep. Replace that implicit dependency with a mutex and condition variable, use an absolute deadline across unrelated wakeups, and make the interrupt handler MPSAFE. Create the device node atomically with its softc and finish failed write transactions so every command path releases its transport state. The polling path was validated on ThinkPad T430 and T440p systems with their STMicro TPM 1.2 devices enabled. Exclusive-open behavior, 100 consecutive PCR reads, and module unload and reload completed without errors on both systems. Two consecutive S3 cycles on each system preserved PCR values and command access, including another 100 PCR reads after resume, without lock or TPM diagnostics. Reviewed by: kevans, seuros MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59211
* tpm: Restore TPM 1.2 TIS state after resumeKevin Bowling2026-09-011-21/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Firmware restores the state saved by TPM_ORD_SaveState, but the TIS interrupt, locality, and command FIFO state are not guaranteed to survive S3. The legacy driver previously treated resume as a no-op. Revalidate the interface and device identity, disable and acknowledge stale interrupts, restore the configured interrupt vector, reacquire locality zero, and return the FIFO to command-ready state. Also disable TIS interrupts during initial setup when the device uses polling so firmware settings cannot leave an unhandled interrupt enabled. TIS 1.3 Table 22 makes the interrupt control registers locality protected. Acquire locality before disabling or programming them during initial setup and resume rather than relying on probe retaining locality. Keep TPM self-test outside the resume critical path. It can take minutes on some TPM 1.2 devices and is not required to restore the transport state. The two-commit suspend and resume series completed two consecutive S3 cycles on a ThinkPad T440p with its STMicro TPM 1.2 Security Chip enabled. PCR 0 was readable with the same value before and after each cycle, and no SaveState or TIS restoration errors were logged. The locality ordering completed another two consecutive S3 cycles on a ThinkPad T430 with the same STMicro TPM in polling mode. PCR 0 again remained stable, and TPM access recovered without errors after each resume. PR: 291067 Reviewed by: kevans Sponsored by: BBOX.io MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D59193
* tpm: Correct the TPM 1.2 suspend transactionKevin Bowling2026-09-011-13/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The legacy driver wrote TPM_ORD_SaveState directly to the command FIFO, but used ordinal 156 instead of the TPM 1.2 ordinal 152 and never completed the transaction through the transport start and end methods. On a TIS device this omitted TPM_STS_GO, and the response read used the header length as flags instead of requesting the complete parameter size. The legacy Atmel reader would also dereference the null byte-count pointer. Send the header-only command through the normal transport lifecycle, validate the response header and TPM result, and retry TPM_WARN_RETRY for a bounded five seconds. Fail suspend rather than enter S3 after an unsuccessful state save. This follows the TPM 1.2 SaveState command definition and the bounded retry policy used by other TPM 1.2 implementations. The stock driver failed to resume a ThinkPad T440p with its STMicro TPM 1.2 Security Chip enabled; disabling the chip made S3 reliable. With this change and the following TIS resume restoration, the enabled TPM completed two consecutive S3 cycles. PCR 0 was readable with the same value before and after each cycle, and no TPM errors were logged. PR: 291067 Reviewed by: kevans MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59192
* Fixed some clocks divide width.priittrees2026-09-011-6/+6
| | | | | | | | | | clk_cpll_div_333m_div, clk_cpll_div_125m_div, clk_cpll_div_50m_div, clk_cpll_div_25m_div, clk_cpll_div_100m_div, clk_osc0_div_750k_div did not respond Rockchip RK3568 TRM Part1 V1.1-20210301.pdf documentation page 79. I changed them correctly. Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/2287
* bxe(4): don't feed a zero page size to ilog2 during ILT initNick Price2026-08-311-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | FreeBSD's bxe hardwires CNIC_SUPPORT() to 0, so bxe_ilt_set_info() never enters the block that initializes the SRC and TM ILT clients. Those two clients are left zeroed (page_size 0, flags 0), yet ecore_ilt_init_page_size() calls ecore_ilt_init_client_psz() for all four clients unconditionally. For SRC and TM that evaluates ILOG2(page_size >> 12), i.e. ilog2(0). On an INVARIANTS kernel ilog2() asserts "ilog argument must be nonzero" and panics the machine the first time the interface is brought up (bxe_init -> bxe_nic_load -> bxe_init_hw -> ecore_ilt_init_page_size). On a non-INVARIANTS kernel it silently programs a bogus page-size register instead. Restore the else branch that upstream Linux bnx2x carries: when CNIC is not supported, mark the SRC and TM clients with ILT_CLIENT_SKIP_INIT and ILT_CLIENT_SKIP_MEM so ecore_ilt_init_client_psz() skips them. Root-caused from a crash dump on a BCM57810 (device 0x168e): the ILT clients showed CDU and QM populated and SRC and TM zeroed with no skip flag set. Reviewed by: adrian Approved by: adrian (mentor) Differential Revision: https://reviews.freebsd.org/D58587 Signed-off-by: Nick Price <nprice@FreeBSD.org>
* igbv: Fence DMA while sanitizing retained queuesKevin Bowling2026-08-313-2/+87
| | | | | | | | | | | | | | | | | | | | The 82576 and I350 retain VF queue enable and DMA address state across VFLR. iflib enables PCI bus mastering before driver attach, so stale state left by a previous owner can otherwise issue DMA before igbvf has completed its first reset and queue sanitization. Disable PCI bus mastering immediately after mapping the VF BAR. Keep it disabled until reset and queue sanitization succeed, verify both disable and enable through PCI command-register readback, and wait for pending transactions before treating the fence as complete. Resanitize on stop before iflib releases queue mappings. The sanitizer and recovery were exercised on I350 and 82576 VFs. Forced queue-disable failure left the VF down, and a later administrative down/up recovered it; successful I350 VFs passed bidirectional traffic with no errors or drops. Sponsored by: BBOX.io
* e1000: Configure PCH low-power link modes for suspendKevin Bowling2026-08-311-0/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PCH suspend path kept a wake link fully powered and did not restore the negotiated EEE modes after its stop-time reset. Intel provides the ULP entry and exit machinery in the shared code, but FreeBSD did not invoke its Sx policy. Enter ULP on LPT and newer PCH controllers when wake is armed without directed-unicast, multicast, or broadcast filters, which ULP cannot preserve. For a link retained by host wake or management, restore the 100BASE-TX and 1000BASE-T LPI controls selected by the local advertisement and the cached link-partner ability. Keep these power reductions best-effort: wake filters and PME are already configured independently, and a ULP or EEE failure is logged without converting an optional power optimization into a suspend failure. The existing PCH resume workaround forcibly exits ULP and clears automatic Sx LPI state before normal initialization. Validated on a ThinkPad T440p with an I217-LM. FBT confirmed that the helper received the magic-wake mask during device suspend. The shared ULP helper returned its documented no-op for the initial I217 device ID. A full S3 cycle resumed cleanly. On a ThinkPad P51 with an I219, full S3 waited for a magic packet and then resumed with the 1-Gbps link and traffic restored. MFC after: 2 weeks Sponsored by: BBOX.io
* e1000: Rework Wake-on-LAN policy and programmingKevin Bowling2026-08-315-144/+502
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver used the NVM APME default as both the hardware-support decision and the mutable filter mask. Consequently, an NVM-disabled but capable port did not advertise wake support, disabling a wake mode once could keep it disabled across later suspends, and directed-unicast wake could never be selected. Require the PCI power management capability to report D3hot PME support before advertising or arming wake. A PM capability alone does not mean the function can signal PME from the state used during system sleep. Separate the board and port capability matrix from the NVM-selected magic packet default. Read the proper per function NVM word on igb controllers, cover the newer PCH generations, and retain the documented legacy, multi-port, and OEM restrictions. Decode the distinct APM Enable locations used by 82544, 82541EI/82547EI, and the later 8254x parts. Do not advertise wake on the 82541ER, whose power-management logic cannot assert PME for wake events. For I210/I211 internal iNVM, use the hardware-loaded WUC.APME state; the shared reader does not expose the optional Initialization Control 3 word. Build WUFC from the enabled ifnet capabilities for each suspend. Reconstruct RAR0, the multicast table, and the receive filter after the stop-time reset so unicast and multicast wake use the current interface state. Fill the MTA on legacy PCI/PCI-X controllers and 82575 through 82580 when the address list overflows; their multicast wake matchers require the indexed MTA bit and do not use RCTL.MPE as a substitute. Do not access PF-only wake CSRs from the igb VF suspend and resume paths. Use the shared BM page access helpers and propagate every PHY receive address and wake-register programming failure. On resume, perform the required LCD reset before clearing host PHY-wake ownership, report the saved PHY or MAC wake cause, and clear PCI PME after removing the device wake source. Preserve management engine wake ownership throughout. Keep WUC.APME set only when early 82545EM/82546EB manageability needs its D3 clock-tree workaround; ordinary host wake uses PCI PME. Keep the link powered while host wake is armed. With no host wake, evaluate management pass-through at each suspend. Leave a management-owned link untouched and keep PCI PME enabled. Otherwise, use the Intel shared code PHY power-down hook, or its matching SerDes shutdown hook on igb fiber and SerDes devices. Track that state and restore the link without another PHY reset before hardware initialization. Ordinary ifconfig down behavior is unchanged. Apply and undo the PCH Sx workarounds across their full supported range. Use controller-specific CTRL and laser semantics, and restore RCTL when wake setup fails. Always run the pending PCIe-transaction drain and bus-master-disable sequence before D3. Suspend reports a wake programming failure rather than sleeping without wake, shutdown logs it and continues through the fencing sequence. Do not apply the ICH/PCH IGP3 D3 power-down workaround to igb controllers. The merged driver inherited an unconditional call from the em-only driver. On 82575 and 82576 it asserted CTRL.PHY_RST after the wake filters were armed, preventing the link from receiving wake traffic. The implementation was checked against the Intel controller data sheets, the Intel Linux e1000, e1000e, and igb lifecycle code, DPDK, and the Intel FreeBSD em-7.7.8 and igb-2.5.31 drivers. The 8254x audit also covered the PCI/PCI-X Software Developer's Manual, the 82541/82547 NVM guide, and the 82544, 82545, and 82546 specification updates. The out of tree drivers carry the family-specific power down and reset block hooks but do not call them from suspend. DPDK supplies the stop/start pairing. On PCH controllers including an 82579LM, I217-LM, and various I219s, device-only D3 tests observed PME and BM_WUS.MAG for a magic packet, no PME with every host filter disabled, and BM_WUS.EX with only directed-unicast wake enabled. With dev.em.0.wake enabled, ACPI S3 slept until a delayed magic packet and resumed with the interface operational. After wake traffic stopped and resume completed, a second cycle again waited for a newly delayed magic packet. Traffic restored after both host and firmware wake were enabled. An 82574L woke from S3 after one magic packet, reported MAC wakeup status, and returned with link and traffic operational. On 82571EB and 82573L adapters, device-only D3 tests observed WUS.MAG and PCI PME status after a magic packet, then returned to D0 with link and traffic operational. Full S3 did not wake either add-in card. The positive device tests and negative S3 isolate the remaining failure outside the MAC filter programming and my cards may lack aux power wiring because the link was off in S3. On 82575EB and 82576 adapters, pre-fix device only D3 tests left PMCSR at 0x2103 despite ten verified magic packets, and the handoff showed CTRL.PHY_RST asserted. With the em-family gate, identical tests changed PMCSR from 0x2103 to 0xa103, resume reported WUS.MAG, and both links returned operational. S3 testing on these separated controller from board behavior. An Intel 82576 card retained link in S3 and woke the system from a delayed magic packet, reported WUS.MAG, and returned with interface operational. The tested 82575 add-in card lost its link LED in S3 and retained no WUS cause after manual resume, although its identical D3hot test passed. That points the 82575 S3 result to card aux power wiring as well. D3 tests were performed on I210 and I350 but S3 has not yet been attempted on them. lem(4) testing has not been attempted yet. Community reports of success and failure are welcome. PR: 232708, 238411, 295443, 296675 MFC after: 2 weeks Sponsored by: BBOX.io
* igc: Correct Wake-on-LAN filter programmingKevin Bowling2026-08-307-65/+181
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The attach path translated WUC.APME into a saved link-change filter, then advertised magic-packet wake. Suspend removed unselected magic, unicast, and multicast bits from that saved value, commonly leaving no hardware wake filter at all. The destructive masking also made later capability changes ineffective. Advertise the I225/I226 wake filters whenever PCI power management is available and enable magic-packet wake by default. Build a fresh WUFC mask for every suspend, and explicitly clear WUC, WUFC, and PCI PME when wake is disabled. Require the PCI power-management capability to report D3hot PME support before advertising or arming wake. A PM capability alone does not mean the function can signal PME from the state used during system sleep. Reconstruct RAR0, the multicast table, and the receive filter after the stop-time reset so unicast and multicast wake use the current interface state. Keep the PHY powered while wake is armed, drain pending PCIe transactions, and disable bus mastering before D3. Clear the sticky base and extended wake status before arming filters. On resume, report the saved hardware wake cause, clear the device wake source, and then clear PCI PME. Run the DMA-fencing sequence even when wake programming fails, while allowing shutdown to continue after logging the failure. Explicitly restore PCI bus mastering during initialization so an iflib-local resume after another child rejects suspend can restart the device. Restore the Intel shared code PHY power down test from DPDK. The FreeBSD split inverted the reset-block condition, so its dormant hook would power down only when firmware explicitly vetoed the operation. Do not copy the generic legacy management test verbatim. The I225 and I226 define MANC bits 0 and 1 as flow-control and NC-SI discard controls, not SMBus and ASF enable bits. Preserve the link when the documented TCO receive path is enabled; the shared reset-block test separately honors the firmware keep-link-up veto. This follows section 8.21.1 of the Foxville Software User Manual. Evaluate management pass-through at each suspend. When neither a host wake filter nor management requires the link, invoke the shared-code power-down hook before D3. Leave a management-owned link untouched and restore a link previously powered down by the driver without another PHY reset. This follows DPDK's stop/start pairing without changing ordinary ifconfig down behavior. The implementation was checked against the Intel I225/I226 programming model, the Intel Linux igc lifecycle, and DPDK. On an I225-LM, a device-only D3 test observed PME for a valid magic packet and no PME with every host wake filter disabled. Both cases resumed to D0 with the link and configured addresses operational. The I225 system also completed a full ACPI S3 cycle and resumed with link, configured addresses, and traffic operational. On an I226-V, a device-only D3 test changed PMCSR accordingly after a magic packet. With dev.igc.0.wake enabled, a full ACPI S3 cycle remained asleep until a delayed magic packet and resumed with link, addresses, and traffic operational. PR: 282140 Obtained from: DPDK (shared-code power-down structure) MFC after: 2 weeks
* pci: Expose PME support by power stateKevin Bowling2026-08-302-0/+20
| | | | | | | | | | | | | | | | | | | | The presence of the PCI power management capability does not imply that a function can signal PME# from every power state. Drivers which advertise wake based only on pci_has_pm() can consequently expose wake modes that cannot work. Add pci_has_pme() to query the PME_Support bitmap for a specific state. Use it to implement LinuxKPI pci_pme_capable(), removing its duplicate PME_Support decoder. Validated the helper against PCI PMC capability values from 82571EB, 82573L, 82579LM, I210, I225, and I226-V controllers. The 82571 and 82573 reported PMC 0xc822, while the I226-V reported 0xc823. In both values, bits 15, 14, and 11 advertise PME from D3cold, D3hot, and D0; the low-bit difference is only the PM capability version. MFC after: 2 weeks Sponsored by: BBOX.io
* dpaa/fman_xmdio: Make xmdio a "real" MDIOJustin Hibbits2026-08-301-6/+45
| | | | | | Instead of forcing an `mdio` pseudo-device to hang off the xmdio, rename xmdio to "mdio" and make it an ofw bus device, akin to the mii_fdt driver, so that children can get the device tree goodies.
* dpaa/fman: Pad the qman channel search arrayJustin Hibbits2026-08-301-3/+3
| | | | | | | The loop goes over the qman channel total (16), so if a port ID is not found in the list it could walk off the end of the list and return garbage. Not a problem in practice, as only valid ports are included in our device trees, but protect it anyway.
* e1000: Recover from igb(4) controller DEV_RSTKevin Bowling2026-08-293-18/+283
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CTRL.DEV_RST resets every port on an 82580 and newer igb device. Hardware reports the event to each affected function through ICR.DRSTA and requires software to reinitialize the port registers and descriptor rings. The driver neither enabled nor handled this cause, so a reset initiated by another function could leave a running interface using stale state. In FreeBSD, we do not currently send this, but other OSes including Linux do, so a PF passed through to such a guest or FreeBSD as a guest running with a passthrough PF on the same controller can be wedged. Enable DRSTA for 82580 and newer PFs in both MSI-X and shared MSI/legacy modes. Bit 30 is reserved on 82575 and is the TCP timer on 82576, so leave it masked on those parts. Latch the event without programming port registers from the interrupt filter. Defer the iflib reset request to admin-task context because the request takes STATE_LOCK. Use IAM to auto-mask shared interrupts on the first ICR read. Keep admin, queue-vector, and interrupt-rearm work quiesced until initialization succeeds. Follow the device reset handshake before the first CTX-owned register programming: wait for GCR to report that the device reset and pending PCIe transactions have completed, then acknowledge STATUS.DEV_RST_SET. Also verify EEPROM autoload and PF reset completion on I350 and newer parts. This follows the Intel 82580 Datasheet, section 4.3.2, and the Intel I350 Datasheet, section 4.3.4. Detect a completed reset from STATUS even when the interface was down. A bounded timeout falls back to the requested port reset. Retain staged reset state through the complete initialization. Check ICR.DRSTA, GCR, and STATUS.DEV_RST_SET after all registers and rings have been rebuilt. If another reset arrived while interrupts were masked, reject the incomplete initialization and repeat the handshake. If both MMIO and PCI configuration space have disappeared, leave the interface stopped rather than queueing an endless recovery loop. Validated on an I210 with INVARIANTS and WITNESS. Injecting CTRL.DEV_RST while igb0 was running recovered through a full iflib initialization in both MSI-X and MSI modes without a panic. STATUS.DEV_RST_SET and GCR.DEV_RST_IN_PROGRESS cleared, enabled DMA coalescing was restored. Injecting the reset while igb0 was down left DEV_RST_SET latched; the first ifconfig up consumed it. On a dual-port 82580, synthetic DRSTA injection produced one complete reinitialization in four-queue MSI-X and shared-MSI modes. Five repeated events produced five clean reinitializations without a panic or watchdog. A raw CTRL.DEV_RST test is not counted because Intel's shared code deliberately avoids that unreliable operation on 82580. On an I350, a real device-wide reset initiated by a sibling function produced one reinitialization while igb0 was running and restored its carrier and enabled state. With igb0 down, STATUS.DEV_RST_SET remained latched until the first up, which consumed it and restored the correct state. The host remained healthy in both cases. MFC after: 2 weeks Sponsored by: BBOX.io
* gpioled: defer gpio pin writes to a taskqueueAbdelkader Boudih2026-08-291-3/+26
| | | | | | | | | | | | led(4) invoked the led_t callback with its mutex held, including from the blink callout, so the callback must not sleep. PR: 251032 MFC After: 1 week Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59263
* e1000: Correct igb(4) DMA coalescing register programmingKevin Bowling2026-08-293-26/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The disabled path wrote the complement of DMAC_EN to DMACR. That set every other field, including reserved bits, the one-shot EXIT_DC command, watchdog enables, receive threshold, and PCIe Lx selection. When DMA coalescing was enabled, the requested watchdog and Lx-delay values were ORed into their reset values rather than replacing the fields. PCIEMISC.LX_DECISION was also cleared, preventing DMACR.DMAC_Lx from controlling PCIe low-power entry. Disable coalescing by clearing only DMAC_EN and retaining the documented DMAC_Lx policy and watchdog fields. On enable, replace the variable fields under their masks, select DMA requirements for PCIe low-power entry, and program the loopback and BMC watchdog policies independently of prior state. Make igb_init_dmac() the sole owner of this policy, including when SR-IOV is active, so later IOV initialization cannot overwrite it. Apply this consistently to I350, I354, and I210 while preserving the I354-specific timer units. Leave I210 reserved fields at their required encodings and do not expose the ineffective control on I211. Validated on I210 and I350 hardware. Repeated I210 enable, disable, and reset cycles preserved the watchdog, Lx, TTLX, and LX_DECISION fields. On I350, dmac values of 250, 1000, and 10000 programmed DMACWT as 0x7, 0x1f, and 0x138, respectively, while retaining a four-tick TTLX and leaving the reserved and watchdog fields stable. A real reset initiated by a sibling function restored the enabled dmac=1000 tuple and a down interface path restored the disabled tuple. MFC after: 2 weeks Sponsored by: BBOX.io
* e1000: Report corrected LAN management FIFO ECC errorsKevin Bowling2026-08-293-1/+15
| | | | | | | | | | | | | | | | | | | | | | I350 and I354 report a corrected ECC error in the LAN transmit management FIFO through LANPERRSTS bit 16. Unlike the parity status in the same register, this condition neither interrupts nor stops traffic. Poll the latch with the other corrected error status, increment a dedicated counter, and clear only its RW1C bit. Expose it as dev.igb.N.memory_errors.corrected_lan_mng_fifo. Fatal error handling returns before the periodic statistics sweep and may reset the device. Drain all I350 and I354 corrected-error status in the admin task before recovery so the reset does not discard pending indications. This follows section 6.21.16 of the Intel Atom Processor C2000 Product Family Integrated GbE Controller Programmer's Reference Manual, document 537426 revision 1.5. MFC after: 2 weeks Sponsored by: BBOX.io
* e1000: Handle I354 internal memory errorsKevin Bowling2026-08-292-43/+50
| | | | | | | | | | | | | | | | | | | | | | | | | The Atom C2000 integrated GbE programming reference documents the I354 internal memory error architecture. It shares the I350 PEIND and ICR.FER routing, DMA and packet-buffer status, LAN parity status, and required reset recovery. Extend the existing I350 recovery and corrected error accounting paths to I354. Keep the PCIe corrected error mask family-specific. C2000 PCIEECCSTS ends at the transmit write-data indication in bit 4 and does not implement the I350 retry buffer indication in bit 5. Do not expose the corresponding retry counter on I354. The PRM overview says a PCIe region failure requires a system reboot, while the individual PCIEERRSTS fields prescribe CTRL.RST followed by port reinitialization. Use the register specific recovery, matching the existing I350 path; failed reinitialization still leaves the port down. This follows sections 5.6 and 6.21 of the Intel Atom Processor C2000 Product Family Integrated GbE Controller Programmer's Reference Manual, document 537426 revision 1.5. MFC after: 2 weeks Sponsored by: BBOX.io
* update email address in my copyright noticesAhmad Khalifa2026-08-281-1/+1
|
* acpi_pci: Honor device proximity for DMA tagsKevin Bowling2026-08-271-20/+36
| | | | | | | | | | | | | | | | | | | | A PCI function with its own _PXM still inherits a DMA tag carrying the upstream bridge's proximity domain. Resolving an SR-IOV VF's locality through its PF therefore does not affect the domain used for DMA allocations. Create and cache a private child tag when the function, or a VF's owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU tag so its constraints remain intact, then apply the function's domain without mutating a shared tag. pci_get_dma_tag() already performs the IOMMU lookup, so remove the duplicated lookup in the ACPI subclass while here. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59063
* acpi_pci: Cache PCI proximity domainsKevin Bowling2026-08-273-12/+50
| | | | | | | | | | | | | | | | | A PCI function's _PXM is stable for the lifetime of its device instance, but CPU and DMA locality queries may evaluate it repeatedly. SR-IOV amplifies this because every VF resolves locality through the same PF. Cache successful mappings and the stable absence of _PXM on the locality source device, and share that result between CPU and domain queries. Continue to retry generic evaluation or mapping errors rather than making a potentially transient failure permanent. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59207
* acpi_pci: Preserve CPU locality queries for descendantsKevin Bowling2026-08-271-0/+3
| | | | | | | | | | | | | | | | bus_generic_get_cpus() preserves the original leaf device while forwarding a request through the bus hierarchy. Consequently, acpi_pci_get_cpus() may receive a descendant below a PCI function rather than one of the PCI bus's direct children. Only apply the SR-IOV PF-locality mapping to direct PCI children. Preserve the previous ACPI CPU-locality lookup for descendants so their unrelated bus ivars are not interpreted as PCI device information. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59206
* netmap: Use ckdint.h helpers to check for overflowMark Johnston2026-08-271-7/+3
| | | | | | | | | | | | This addresses a bug in the addition overflow check added in commit 319414a926af ("netmap: Handle overflow when computing ring sizes"): that overflow wasn't actually caught by the check because "len" is promoted to size_t. PR: 297300 Fixes: 319414a926af ("netmap: Handle overflow when computing ring sizes") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58896
* vtnet: move offload functions to virtio_net.hTimo Völker2026-08-273-464/+265
| | | | | | | | | | | | | | | | | | | Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the subfunctions they call from if_vtnet.c to virtio_net.h. This allows us to call these functions from if_tuntap.c and if_ptnet.c. virtio_net.h already contained a copy of these functions, but a copy of an outdated version. The functions evolved in if_vtnet.c. In if_vtnet.c, the copy has never been used because it increments counters in their own functions. This patch removes the outdated copy from virtio_net.h and moves the new version of the functions from if_vtnet.c to virtio_net.h. if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions, and if_vtnet.c increments its counters depending on the return value. Reviewed by: tuexen MFC after: 1 month MFC to: stable/15 Differential Revision: https://reviews.freebsd.org/D57299
* i2c/sensor/w83793g: Fix unused function warningEmmanuel Vadot2026-08-271-0/+2
| | | | | | w83793g_writereg is unused so silence it. Fixes: cd3cc6e910c0f ("i2c/sensors: Add driver for W83793 hardware monitor")
* ufshci: reject new requests on a failed controllerJaeyoon Choi2026-08-271-2/+5
| | | | | | | | | | | | | | A failed controller accepted new requests, but nothing ever completed them, so the caller waited forever. The admin retry path could also resubmit a request to a dead queue. Reject new submits and admin retries on a failed controller. The submit check runs under the queue lock, so it cannot race with the queue walk in the fail path. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58948
* ufshci: handle a recovery reset before the SIM attachJaeyoon Choi2026-08-272-3/+8
| | | | | | | | | | | | | When the first start attempt fails early, the recovery reset runs the start sequence again without a SIM. That pass still looked up the WLUN, so it dereferenced a NULL SIM and panicked. Attach the SIM whenever it does not exist yet. Also make the WLUN lookup return NULL when there is no SIM. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58947
* ufshci: build valid fake responses for manual completionJaeyoon Choi2026-08-271-6/+20
| | | | | | | | | | | | | The manual completion wrote the fake response to the wrong descriptor for task management slots. It also left the task tag at zero, which tripped the task tag check under INVARIANTS. Write the fake response where the completion path reads it. Copy the task tag from the request. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58946
* ufshci: claim trackers before failing themJaeyoon Choi2026-08-271-40/+20
| | | | | | | | | | | | | | | ufshci_req_queue_fail() drops the queue lock to complete each tracker. In that window the completion path could complete the same tracker again. Claim the slot before dropping the lock, so the completion scan skips it. Reserved slots are left to their submit thread, which completes them itself. The manual request completion helper lost its only caller, so drop it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58945
* ufshci: run the controller fail path only onceJaeyoon Choi2026-08-272-2/+12
| | | | | | | | | | | | | | Two threads could run ufshci_ctrlr_fail() at the same time. Each one walked the queues and completed the same trackers again, which caused a double free and a panic. Turn is_failed into an atomic gate, so only the first caller walks the queues. The reset task now returns early on a failed controller instead of re-enabling it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58944
* acpi_pci: Inherit PF locality for SR-IOV VFsKevin Bowling2026-08-271-1/+24
| | | | | | | | | | | | | | | | | SR-IOV VFs are instantiated from their PF and intentionally do not receive an ACPI handle by matching their runtime BDF. Consequently, ACPI locality queries for a VF fall back to the upstream bus. This is usually sufficient, but loses a _PXM supplied specifically for the PF. Use the PCI core's owning-PF accessor for BUS_GET_DOMAIN and BUS_GET_CPUS requests made for a VF. This preserves the VF's lack of an ACPI handle while allowing its CPU and NUMA placement to follow the PF. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59062
* acpi_pci: Do not match SR-IOV VFs to ACPI devicesKevin Bowling2026-08-271-0/+12
| | | | | | | | | | | | | | | | | | | | SR-IOV VFs are instantiated dynamically from their PF rather than enumerated from ACPI. A VF's runtime slot and function can match an unrelated _ADR below the bridge. acpi_pci_save_handle() stores that handle in the VF's devinfo before acpi_pci_update_device() runs. If the handle is already bound to another device_t whose parent is not acpi0, acpi_pci_update_device() panics under INVARIANTS. Without INVARIANTS, the VF retains the unrelated handle, so subsequent ACPI lookups, including NUMA and power-management operations, can act on the wrong namespace node. Skip ACPI namespace matching for VFs. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59061
* xhci: Only reset the data toggle value when the USB stack asks for itShengYi Hung2026-08-262-5/+19
| | | | | | | | | | | | | | | | The previous patch assumes that we don't want to reset toggle bit in STOPPED_STEP. However, a device can explicitly call usbd_clear_data_toggle if necessary. As a result, instead of not dropping the bit unconditionally, we added a field in xhci to specify that we want to drop it, so that usbd_clear_data_toggle can handle it correctly. Reported by: oh Reviewed by: kevans Tested by: oh Fixes: 28d85db46b48 ("xhci: Do not drop and add bits in xhci") MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D59186
* intelspi: add Nova Lake SPI controller IDsAbdelkader Boudih2026-08-261-0/+6
| | | | | | | | Add PCI device IDs for Nova Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59013
* intelspi: add Panther Lake SPI controller IDsAbdelkader Boudih2026-08-261-0/+6
| | | | | | | | Add PCI device IDs for Panther Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59012
* intelspi: add Wildcat Lake SPI controller IDsAbdelkader Boudih2026-08-261-0/+3
| | | | | | | | Add PCI device IDs for Wildcat Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59011
* snd_uaudio: recognize hardware sidetone as a monitorKyle Evans2026-08-261-2/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Logitech H390, for instance, has the following interface layout: ~~ 7 INPUT 34 INPUT 10 INPUT Mic (0x201) Mic (0x201) USB Stream (0x101) | | | v v | 19 FEATURE 35 FEATURE | | | | v v | 25 EXTENSION +------> 36 MIXER <---+ | | v v 13 OUTPUT 22 FEATURE USB Stream (0x101) | v 16 OUTPUT Speaker (0x301) ~~ The 7->13 path on the left is a typical microphone-in configuration, while the right side is a little more complicated. The 34 -> 35 -> 36 leg is describing a hardware sidetone control, while the other is a standard audio-out configuration. During feature unit evaluation, we need to pick up the scenario of node 35 above, which is directly wiring the microphone to the speaker. Right now we'll likely tie it to the pcm/vol levels and this unit will emit a very prompt feedback screech, but it's really shaped more like a MONITOR control. This avoids mishandling feature unit 22 because that's evaluated in one of the other cases: one of the inputs is the USB stream, so it's wired up as a PCM. One note on this headset: the presence of mixer 36 currently breaks the `vol` control, leaving only `pcm` to control the volume. Given that it has both Mic and USB input, I suspect we get a 1:1 cluster configuration for the Mic input but something more complicated for the USB input that we end up ignoring. Thus, "vol" might technically control the monitor volume but isn't wired up to the USB input cluster. I have not had a chance to confirm this, yet. PR: 291424 Reviewed by: christos Differential Revision: https://reviews.freebsd.org/D58779
* dsp: Fix a potential use-after-free in dsp_oss_syncstart()Mark Johnston2026-08-252-15/+11
| | | | | | | | | | | | | | | | | | | | | This function has a loop where it attempts to lock all channels in a group. If doing so would block, it releases all locks, sleeps for a bit, and tries again. However, once the syncgroup lock is dropped, nothing prevents the syncgroup structure from being freed. Fix the inner loop: after waking up, break out of it unconditionally and start everything again. I think the old code was also buggy and not well-exercised: after waking up we'd continue to try and continue locking channels. Then we'd try again from the beginning and fail to lock the channels we had already locked. Approved by: so Security: FreeBSD-SA-26:58.sound Security: CVE-2026-58091 Reported by: Hazley Samsudin of GovTech CSG Reviewed by: christos Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58912
* hwpmc: Fix the execve handlerMark Johnston2026-08-251-60/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a process execve()s, pmc_process_exec() is supposed to evaluate whether the new image is setuid/setgid and if so, whether to detach PMCs. This was handled by pmc_can_attach(), which is effectively an open-coded copy of cr_xids_subset(). Unfortunately, the test of the result of this function was inverted, with the result that we'd detach PMCs only if the predicate said it was okay to do so. It appears the bug has always been there; it seems the intent was to return 0 on "success", i.e., it is okay to attach the PMCs, much like p_candebug(). Commits 1c3c698ba4c4 and 1c40b15971f0 obscured this a bit. I think this check is trying to be too clever. Let's make it simpler: simply do not attach PMCs unless the owner is privileged. This is how, e.g., ktrace works. I do not think it's worth trying to be more sophisticated than this unless we can generalize the policy in a way that's applicable to other subsystems. Also fix a bug at the end of pmc_process_exec(): pmc_detach_one_process() will call pmc_remove_process_descriptor() for us. Approved by: so Security: FreeBSD-SA-26:56.hwpmc Security: CVE-2026-58089 Reported by: netchild Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59102
* dpaa: Split FMan port driver into distinct TX/RXJustin Hibbits2026-08-254-630/+848
| | | | | | There are several port functions that are only for one type or the other, so they don't make sense to be together. Splitting these up also simplifies adding support for the Offline/Host Command ports.
* nvme: limit visible namespaces on Apple S3XAbdelkader Boudih2026-08-244-8/+34
| | | | | | | | | | | | | The Apple S3X controller exposes internal namespaces beyond NSID 1 that aren't meant to be visible to the OS. Added QUIRK_APPLE_S3X_NS1_ONLY and nvme_ctrlr_num_namespaces()/nvme_ctrlr_nsid_visible() helpers, and route namespace construction, notification, and AER namespace-changed handling through them instead of a raw cdata.nn count. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D58844
* nvme: fix Apple S3X controller panicAbdelkader Boudih2026-08-244-13/+60
| | | | | | | | | | | | | | | | Serialize S3X I/O and cap dtransfers while keeping namespace handling. Select 64/128-byte submission queue entries explicitly and set CC.IOSQES from the same value used for the software queue stride. When fatal status is set, wait for pending PCIe transactions and then force FLR so a wedged controller doesn't panic or timeout. MFC: 1 week PR: 296946 Fixes: 5e0ba47aa00e Reviewed by: ngie, imp Differential Revision: https://reviews.freebsd.org/D58821
* e1000: Serialize 82579 CSR writes with the Management EngineKevin Bowling2026-08-243-7/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 82579 PCIm2PCI arbiter can acknowledge a host MAC CSR write while the Management Engine is accessing another CSR. The host write can be lost; subsequent target accesses may no longer be claimed by the MAC and can hang the system. For 82579 controllers with valid management firmware, wait for the ME CSR access indication before every MAC CSR write. Keep the wait bounded and use DELAY because writes occur in interrupt and datapath contexts. Verify every transmit and receive tail write. If a tail does not hold the requested value, disable its datapath direction and request a full iflib reset. Keep the ordinary register-write path as a direct MMIO write behind a predicted per-device gate. Contain the wait and tail recovery in the 82579 slow path rather than adding tail-specific accessors and state to the rest of the e1000 family. Documentation on the PCH NICs is scare so Intel's Linux e1000e fixes publicly document the hardware failure and required serialization as commits bdc125f73f3c and d601afcae2fe. This implementation is a bit cleaner. Tested on a Thinkpad T430 (82579LM) with a test kernel to simulate ME contention without incident as well as lost tail writes causing a succesful recovery. MFC after: 2 weeks Sponsored by: BBOX.io
* dpaa: Add LRO and receive callback batchingJustin Hibbits2026-08-248-15/+142
| | | | | | | | | | | | | | Reduce the code executed in the DQRR dequeue loop, and move the heavy-weight operations to post-dequeue loop. * Batch if_input() after DQRR dispatch loop completes. Only do the DQRR_CI_CINH write at the end of the loop, so only up to 16 entries will be processed. * Add software LRO per FQ. Each per-CPU RX FQ gets its own LRO tracking structure. Since LRO is configured at FQ initialization time, allocate the ifnet earlier in attach to prevent a panic.
generated by cgit v1.3 (git 2.53.0) at 2026-10-22 23:59:24 +0000