The Enhanced SuperSpeed meaning of the slot context parent hub slot ID
and port number fields was introduced in xHCI 1.2. Controllers built to
an earlier revision define them only for a Low- or Full-speed device
behind a High-speed hub.
A SuperSpeed device behind a USB 3.2 hub on an Intel Alpine Ridge
controller, an xHCI 1.1 part, stops responding to Address Device and
loops in uhub_reattach_port until the port is disabled.
Fixes: 20b1998254 ("usb: support SSP and SSPx2 xHCI")
Reviewed by: aokblast, ngie, adrian
Differential Revision: https://reviews.freebsd.org/D61278
Nothing tells the SMC that a power off or restart was user requested, so
the T2 keeps rebooting the machine thinking the system is wedged.
Approved-by: ngie (co-mentor)
Reviewed by: ngie, adrian
Differential Revision: https://reviews.freebsd.org/D61260
The quirk's 8KB transfer clamp exposed raw character-device I/O to
the oversized-mapping stall fixed earlier, and its single tracker
turned a stranded request into a complete I/O stall. Without it an
S3X controller runs 128 trackers at its MDTS-derived transfer size
with no retries, failures, or timeouts, at about seven times the
serialized throughput.
Reviewed by: imp, adrian, ngie
Approved by: ngie (co-mentor)
Differential Revision: https://reviews.freebsd.org/D59156
The controller's Recommended Arbitration Burst was ignored; the
specification advises matching the Arbitration feature's burst to it
even under plain round robin. Some controllers report unusable
values: programming the Apple S3X with its reported RAB wedged
sustained I/O, so quirked controllers keep their default
configuration. The hw.nvme.arb_burst tunable overrides the
recommendation.
Reviewed by: imp
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59155
Prior to this change, `jail_get` when called with `JAIL_USE|JAIL_GET_DESC`
would fail to return a valid descriptor in the positive case because the
`JAIL_USE_DESC` block jumped to `found_prison` before the descriptor was
allocated. This resulted in the returned jail descriptor always being -1,
despite the call being successful.
This change fixes the logic so `jfd_out` is properly initialized in the
aforementioned scenario.
MFC after: 3 days
Reviewed by: jamie, ngie, adrian
Differential Revision: https://reviews.freebsd.org/D60984
The Intel Low Power Subsystem wraps its I2C, SPI and UART functions in a
block of private registers that control the functional clock and the
function and DMA resets.
Refactored to use a single header
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60859
Recognize Intel 8086:7e25 using 32-bit MMIO with a four-byte register
stride. Deassert the LPSS functional resets and program the 100 MHz
reference clock divider for a 44.2368 MHz UART clock before the UART
core claims the register window, and reprogram both on resume.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60858
The two mode values were spelled as bit flags, but a device is exactly
one of the two and the dispatch compared the field for equality.
Turned them into an enum, type the softc field with it, and dispatch with
a switch that lists every value
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D60793
The driver, module, kernel option and manual page are all named
acpi_apple, but the sources lived in sys/dev/apple_acpi/ with an
apple_ prefix. Every other vendor ACPI driver in the tree uses the
acpi_<vendor> form for both the directory and the file names.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D60792
handles wake-on-LAN arming and lid state on the PCH
PMC/GMUX platform instance, and panel backlight
control on the PNLF instance, registering with
backlight(9).
Reviewed by: ziaee, adrian
Differential Revision: https://reviews.freebsd.org/D58867
Lid state changes are only published to userland, via devd and evdev.
Drivers that need to react to the lid in the kernel have no hook, so
they end up installing a second ACPI_DEVICE_NOTIFY handler on the same
lid object and reimplementing the _LID evaluation.
Add acpi_lid_event, invoked from acpi_lid_status_update() alongside the
existing devd notification, carrying the new state (1 open, 0 closed).
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D60704
Controllers that report ONCS.TIMESTAMP keep a millisecond clock that the
host is expected to seed
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59997
An Abort completion with cdw0 bit 0 set means the controller did not
abort the command; the command can still complete later. The driver
treated this as aborted anyway: it completed the command itself and
freed the CID. When the controller completed the command later,
the CID may already belong to a new command, so the new command
finished with the old command's status, or the unknown-cid assertion
fired on INVARIANTS kernels. The watchdog also kept sending a new
Abort for the same command every half second while the first one was
still pending.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59634
A normal shutdown deletes all I/O submission and completion queues
before setting CC.SHN, as the suspend path already does. The
device_shutdown path went straight to the shutdown notification with
the queues live, which some drives take slowly or record as an
unclean stop. Skipped the deletion for failed, removed, or
never-initialized controllers.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59633
Bytes 102 through 110 of the I/O Command Set Independent Identify
Controller data structure were reserved padding. Name them: Boot
Partition Capabilities (byte 102), CXL HDM Support Information (byte
103), NVM Subsystem Shutdown Latency (bytes 107:104) and Power Loss
Signaling Information (byte 110). Bytes 109:108 stay reserved.
CXL HDM Support Information was added in NVM Express Base Specification
2.4, Figure 338; the others appear in 2.3, Figure 328.
Report the new fields from nvmecontrol identify.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60000
A single handler that takes the counter's offset
within struct nvme_qpair in arg2.
No functional change
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60020
The routine is entered with the namespace lock held and drops it before
completing the requests, which preserves the existing locking.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60019
The int_coal_time and int_coal_threshold handlers differed only in which
controller field they updated before reprogramming the feature.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D60018
CC.CSS was always writting zero, which is a reserved encoding on a
controller that does not support the NVM command set.
Select 111b on admin-only controllers and 110b when the
I/O command set mechanism is available.
Reviewed by: ngie, imp, adrian
Differential Revision: https://reviews.freebsd.org/D59628
Added nvme_ns_data_format_index() in the nvme, nda, and nvmf
host paths as well as nvmecontrol and camdd.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59627
The Get Log Page request for the error log is clamped to
NVME_MAX_AER_LOG_SIZE, but the byte-swap loop iterated ELPE + 1
entries. A controller reporting more than 63 entries makes the loop
overrun the 4 KiB log page buffer.
Reviewed by: ngie, imp, adrian
Differential Revision: https://reviews.freebsd.org/D59626
The single-vector MSI-X fallback installs the shared interrupt
handler, which masks interrupts through INTMS/INTMC around the
completion poll.
INTx and MSI are unaffected. Only MSI-X track the interrupt mode
and skip un/masking
Reviewed by: ngie, imp, adrian
Differential Revision: https://reviews.freebsd.org/D59637
Add the extended control interface
Values match the reference ABI; the new struct layouts are pinned
with static assertions.
Reported by: thierry
Reviewed by: adrian, thierry
Differential Revision: https://reviews.freebsd.org/D59496
Add an amd64-only, Intel-only diagnostic driver that reads ME Host
Firmware Status registers from PCI configuration space without mapping the messaging BAR.
Select the HFS register count per device generation, decode sparse
HFS1 state, mode, and error fields, and expose raw and summarized
status via sysctl. Register an ISA-side hfstsfd probe for supported
RCBA/FD2 generations so firmware-hidden HECI functions can be diagnosed.
Reviewed by: kbowling, adrian
Differential Revision: https://reviews.freebsd.org/D58863
Firmware expose a DSDT sized for the largest SKU of the platform,
so a verbose boot prints an "ignored" line for every vacant
processor slot. A vacant slot has no enabled MADT entry; a CPU that
failed to come online does.
Reviewed by: olce, adrian
Differential Revision: https://reviews.freebsd.org/D59551
Add driver for Intel Power Management Controller (PMC) found on Sunrise Point PCH chipsets.
This device exposes S0ix sleep state residency counters and power management status.
Sysctls provided:
dev.intelpmc.0.slp_s0_residency_us - Time in deepest sleep (us)
dev.intelpmc.0.ltr_ignore - LTR ignore mask
dev.intelpmc.0.pm_cfg - PM configuration register
dev.intelpmc.0.pm_sts - PM status register
dev.intelpmc.0.access_denied - Firmware lock status
Supported devices for now:
- Sunrise Point-LP (0x9D21)
- Sunrise Point-H (0xA121)
Note: Later PCH generations (Cannon Lake, Tiger Lake, ect.) have different PMC register layouts according to the datasheet and would need per-generation tables.
I avoided adding untested hardware in case they have a quirk.
Reviewed by: olce, adrian
Differential Revision: https://reviews.freebsd.org/D54881
The active LBA format's MS field was never examined. I/O to a
metadata-formatted namespace carries neither interleaved metadata
nor MPTR, so every command is malformed, yet the namespace attaches
as a disk with the wrong sector size.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59625
GPT+ZFS+UEFI boots fine, but the manual guided
wizard prevented it.
MFC after: 3 days
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59603
Replaced hardcoded jail parameter name strings in the base userland
consumers with the JAIL_PARAM_* constants.
No functional change.
Reviewed by: jamie, adrian
Differential Revision: https://reviews.freebsd.org/D59577
Userland jail managers hardcode jail parameter name strings; nothing
in the headers has ever named them, even when sys/jail.h already
has JAIL_META_PRIVATE/JAIL_META_SHARED for the metadata pair.
Added JAIL_PARAM_* string constants for the static parameters registered
by the base kernel.
No functional change.
MFC After: 1 week
Reviewed by: jamie, adrian
Differential Revision: https://reviews.freebsd.org/D59572
sbuf_new_auto() sleeps, and ng_hci_default_rcvmsg() can run under the
raw HCI socket pcb mutex held across NG_SEND_MSG_PATH().
Reported by: WITNESS
Fixes: ad91d47db3
Reviewed by: glebius, adrian
Differential Revision: https://reviews.freebsd.org/D59550
MAXCMD is the maximum number of commands the controller processes at
one time for a particular I/O queue. Allocating more trackers than
that only queues commands inside the controller. Controllers
reporting 0 are unaffected.
Approved by: ngie (co-mentor)
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D59154
The Create I/O queue commands carried magic 0x1/0x3 cdw11 values, and
the implicit QPRIO of zero classifies every I/O queue Urgent the
moment weighted round robin arbitration is enabled. No functional
change with the round robin default.
Approved by: ngie (co-mentor)
Reviewed by: ngie, imp, adrian
Differential Revision: https://reviews.freebsd.org/D59153
bce_vhci_endpoint_create() was registering both the IN and OUT
submission queues on every call, regardless of which direction
the endpoint actually needed.
The per-stage firmware registration failures weren't rate-limited,
so a stuck registration will spam the console.
Tested on:
MacBookPro15,2
Macmini8,1
MacBookPro15,3
MacBookPro16,2
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58831
For IN control transfers, the firmware does
not send TRANSFER_REQUEST for the data phase
the host must send BCE_VHCI_CMD_TRANSFER_REQUEST
with an IN DMA buffer once the setup phase completes.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58872
Only set the port change bit when the corresponding status bit
actually transitioned, instead of unconditionally flagging
C_CONNECT_STATUS on every port change event. Also clear any
flaky C_CONNECT_STATUS that the port change taskqueue may have
set while the bus lock was dropped during a successful port reset.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58875
Since the host initiates IN data transfers, the
firmware's own TRANSFER_REQUEST for the same phase arrives after
we've already moved to STATUS state. Ignoring instead of failing
the transfer with USB_ERR_IOERROR.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58873
Poll mailbox reply registers with DELAY() when the system is still
cold, falling back to the interrupt-driven
sema_timedwait path once timers are available.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58871
Call usb_needs_explore() after attach so the hub explore thread
enumerates all initially connected ports instead of only the first.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58870
Add dev.asmc.0.sil sysctl to control the SIL LED via SMC keys
MSLD (duty/brightness) and MSLS (state latch, must be set
before re-enabling).
MFC After: 1 week
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58865
The camera control IDs in videoio.h changed numeric values; ports
consuming V4L2 camera controls need to be rebuilt.
Reviewed by: thierry
Differential Revision: https://reviews.freebsd.org/D59460
Renumbered the camera class to match the reference ABI and added the
constants ported applications expect:
Reviewed by: thierry
Differential Revision: https://reviews.freebsd.org/D59459
The namespace character device does not initialize si_iosize_max, so
physio falls back to DFLTPHYS and can produce a bio larger than the
qpair payload DMA tag on a controller whose maximum transfer size is
below 64KB. Such a bio fails DMA mapping and is never submitted.
Approved by: ngie (co-mentor)
MFC after: 1 week
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D59152
bus_dmamap_load_mem() reports most mapping failures, including EFBIG,
only through its callback and then returns zero. nvme_payload_map()
logged the error without telling the submission path, so the tracker
stayed on the outstanding list with no command submitted and no
timeout armed, stalling all later I/O on the queue behind it.
Approved by: ngie (co-mentor)
MFC after: 1 week
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D59151
In a WITHOUT_INET6 build the only assignment to netid2 is compiled out and
the non-INET6 arm returns early, so netid2 is unconditionally NULL and the
rpcb_set() call guarded by it is dead code. clang does not prove it dead
and reports nbuf2 as uninitialized where it is passed as a const pointer,
No functional change.
MFC after: 1 week
Reported by: clang (-Wuninitialized-const-pointer)
Suggested by: dim
Approved by: ngie (co-mentor)
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D59277
led(4) invoked the led_t callback with its mutex held, including from the
blink callout, so the callback must not sleep.
PR: 251032
MFC After: 1 week
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59263
Adds missing structs symbols for V4L2.
video(4) capture devices do not crop, expose menu controls or support
overlay, and return ENOTTY for the new ioctls.
Applications enumerate these unconditionally and degrade gracefully
at run time, but fail to build when the declarations are missing.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59203
The Apple S3X controller exposes internal namespaces beyond NSID 1
that aren't meant to be visible to the OS. Added QUIRK_APPLE_S3X_NS1_ONLY
and nvme_ctrlr_num_namespaces()/nvme_ctrlr_nsid_visible() helpers, and
route namespace construction, notification, and AER namespace-changed
handling through them instead of a raw cdata.nn count.
MFC after: 1 week
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D58844
Serialize S3X I/O and cap dtransfers while keeping namespace handling.
Select 64/128-byte submission queue entries explicitly and set
CC.IOSQES from the same value used for the software queue stride.
When fatal status is set, wait for pending PCIe transactions and then
force FLR so a wedged controller doesn't panic or timeout.
MFC: 1 week
PR: 296946
Fixes: 5e0ba47aa0
Reviewed by: ngie, imp
Differential Revision: https://reviews.freebsd.org/D58821
On Panasonic FZ-Y1 and similar models, the EC latches RF_KILL on
shutdown and suspend when battery is at certain level, causing wireless
to boot with hard block.
Call WLSW.SHRF during attach and resume to clear the block.
Tested on Panasonic FZ-Y1 with Intel Wireless 7265.
Reviewed by: adrian, obiwac
Approved by: adrian, obiwac
Differential Revision: https://reviews.freebsd.org/D55265
Light Ridge and earlier Thunderbolt controllers reuse the same device ID
(0x1513) for both the NHI (class 0x088000) and PCI bridges (class
0x060400).
Without checking the PCI class, tb_pcib would incorrectly match NHI
devices, causing a panic when trying to attach bridge code to non-bridge
hardware.
Add PCI class check to tb_pcib_find_ident() to only match actual PCI-PCI
bridges (PCIC_BRIDGE/PCIS_BRIDGE_PCI).
Reviewed by: obiwac, jhb
Approved by: obiwac, jhb
Fixes: 2ed9833791 (thunderbolt: Import USB4 code)
Differential Revision: https://reviews.freebsd.org/D55102
Abdelkader Boudih