From nobody Wed Jul 30 12:29:37 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bsWkN3zqLz63YSJ; Wed, 30 Jul 2025 12:29:48 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bsWkN2y3Kz3R5k; Wed, 30 Jul 2025 12:29:48 +0000 (UTC) (envelope-from kp@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753878588; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=3i+giKXQlqAMj0jz4PA/ozbXDTP2flcoBpjLZbcNtjk=; b=ET9hsC0Whahj+AXDdFhfUjx6TRp/ar+ByO4yisBFUp5KWJpjnlKpKQplUYyiHizw/bOC3v KiQ0nH1UoeM+5w0jZ8gDTD2cGk2L7FrhJZxAOhyhqMD4l8YkX2d0WZ6vL1oNHxzzBuZWLA lmkvUQiNIglCZNVANWit9EbdpF3rordh8hcV89Zn/5w4CXWwCmvKoZjd142rPFrjfVoefI oIJg/sybSvkHDERiC5DCIJUVp89EjmoRoEBIIES0wY8z0GIEZDyAgRR3D8YujqIEw+u+ZI hK0RxO54IFaybspfeLjWnLZqjzK1VWXl1lBlO5SJEySBthgv58BcWPNOw+Kczw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753878588; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=3i+giKXQlqAMj0jz4PA/ozbXDTP2flcoBpjLZbcNtjk=; b=XJ0W5rx7SKfdxWN+mPrIwnWq7rtyOysmPjvJkgY14i0XrmlLdx8FROSa5koi4vDQMMUf2w pllpGCqMMgmnuRQwAKejzimrCZLxrJ81X3ylec5waNotvsm/2Ik0fE5IeIhZrNW3flMf0/ XpAMaKjPgsqDvp5enW13WvzytI1bDuCHvYy5pKLm9HKeyrKI9GHW/oA0rzp7eaqWGpJsYu PDFwZ66aFNOLqjo/ZWZet8XuMqJ5iHfxgly8Y2hhuWRBMF2WhDW9xdJCcvw92VByUMWKq/ X7zRIQMItEMBQjgrEz1dioLzqxrQO7gedNzJudp7oBSC5DKBfaKSOt3eRtSDNA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1753878588; a=rsa-sha256; cv=none; b=vAXBSpd2A0V5pWvX9xs/wN9P16gK2fy+3f+3lR0vtRDfuUTuqnnbEvFdfOxp8jt/n+31t9 QC3rDSrLIlf6r5wb65PLKIMHzTiKUyZ7nSTAEufBSpBMxywZM2zgJ+AkFKfQIvFLfJDYP9 9GKQX01YBFfijdclkn/KAwkZg8gr9Fs29FJCXnt/P3scHskLN8fea9cvW5S9JrgXEt2mOX /tzfVHfFkMptEiuHO+BhyW+Z6kqoQ8cEDyYNigjzOsTp6i5EOGrNGVJ8bqY111M+k+hxQv ogmORIaxm9vmb1egdKLtUlGulVsAcvHkYODTh0fyp7c1y+Gen/h+bNB6kJjTpw== Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mx1.codepro.be", Issuer "R10" (verified OK)) (Authenticated sender: kp) by smtp.freebsd.org (Postfix) with ESMTPSA id 4bsWkN13X9zyNF; Wed, 30 Jul 2025 12:29:48 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: by venus.codepro.be (Postfix, authenticated sender kp) id CA65949F2B; Wed, 30 Jul 2025 14:29:43 +0200 (CEST) From: Kristof Provost To: Mark Johnston , Hareshx Sankar Raj Cc: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: Re: git: ded037e65e52 - main - qat: driver updates to improve code and fix bugs Date: Wed, 30 Jul 2025 14:29:37 +0200 X-Mailer: MailMate (2.0r6272) Message-ID: <9DB885DF-8BDD-451F-B928-0C10E881C4CF@FreeBSD.org> In-Reply-To: <202506061357.556Dv9Zc084087@gitrepo.freebsd.org> References: <202506061357.556Dv9Zc084087@gitrepo.freebsd.org> List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_MailMate_B08AB6DB-7748-4F2A-B2B9-63ABCCFE9199_=" --=_MailMate_B08AB6DB-7748-4F2A-B2B9-63ABCCFE9199_= Content-Type: text/plain; charset=UTF-8; format=flowed; markup=markdown Content-Transfer-Encoding: quoted-printable On 6 Jun 2025, at 15:57, Mark Johnston wrote: > The branch main has been updated by markj: > > URL: = > https://cgit.FreeBSD.org/src/commit/?id=3Dded037e65e5239671b1292ec987a2= e0894b217b5 > > commit ded037e65e5239671b1292ec987a2e0894b217b5 > Author: Hareshx Sankar Raj > AuthorDate: 2025-05-07 09:38:21 +0000 > Commit: Mark Johnston > CommitDate: 2025-06-06 13:43:54 +0000 > > qat: driver updates to improve code and fix bugs > > Bug fixes and improvements are done for the qat code base > to improve code quality. > > Reviewed by: markj, ziaee > MFC after: 2 weeks > Sponsored by: Intel Corporation > Differential Revision: https://reviews.freebsd.org/D50379 > --- =E2=80=A6 > diff --git a/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h = > b/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h > index bfc5db1f5e5c..cddfc3f84853 100644 > --- a/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h > +++ b/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h > @@ -1,11 +1,11 @@ > /* SPDX-License-Identifier: BSD-3-Clause */ > -/* Copyright(c) 2007-2022 Intel Corporation */ > +/* Copyright(c) 2007-2025 Intel Corporation */ > #ifndef ADF_C3XXX_HW_DATA_H_ > #define ADF_C3XXX_HW_DATA_H_ > > /* PCIe configuration space */ > -#define ADF_C3XXX_PMISC_BAR 0 > -#define ADF_C3XXX_ETR_BAR 1 > +#define ADF_C3XXX_PMISC_BAR 1 > +#define ADF_C3XXX_ETR_BAR 2 > #define ADF_C3XXX_RX_RINGS_OFFSET 8 > #define ADF_C3XXX_TX_RINGS_MASK 0xFF > #define ADF_C3XXX_MAX_ACCELERATORS 3 We=E2=80=99re seeing panics loading the QAT driver on Atom Processor C300= 0 = (with pfSense). I believe this change is the trigger. This causes us to look for the ETR registers in the third BAR, but there = are only two on that hardware: # pciconf -l -b -vV pci0:1:0:0 none0@pci0:1:0:0: class=3D0x0b4000 rev=3D0x11 hdr=3D0x00 vendor=3D0x8086= = device=3D0x19e2 subvendor=3D0x8086 subdevice=3D0x19e2 vendor =3D 'Intel Corporation' device =3D 'Atom Processor C3000 Series QuickAssist Technology' class =3D processor bar [18] =3D type Memory, range 64, base 0x80700000, size 262144, = enabled bar [20] =3D type Memory, range 64, base 0x80740000, size 262144, = enabled That produces this backtrace: Fatal trap 12: page fault while in kernel mode cpuid =3D 1; apic id =3D 18 fault virtual address =3D 0x10 fault code =3D supervisor read data, page not present instruction pointer =3D 0x20:0xffffffff83c4c25a stack pointer =3D 0x28:0xfffffe00681c26b0 frame pointer =3D 0x28:0xfffffe00681c26b0 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags =3D interrupt enabled, resume, IOPL =3D 0 current process =3D 3075 (kldload) rdi: 0000000000000000 rsi: 0000000000000000 rdx: 0000000000000000 rcx: 0000000000000000 r8: fffffe00681c2715 r9: 000000000000000a rax: 00000000000001ff rbx: 0000000000000000 rbp: fffffe00681c26b0 r10: 0000000000000000 r11: 0000000000000001 r12: 0000000000000000 r13: fffff80003a1a000 r14: 0000000000000000 r15: 0000000000000008 trap number =3D 12 panic: page fault cpuid =3D 1 time =3D 1753859856 KDB: enter: panic [ thread pid 3075 tid 100160 ] Stopped at kdb_enter+0x33: movq $0,0x1b55532(%rip) db> bt Tracing pid 3075 tid 100160 td 0xfffff80100d4a780 kdb_enter() at kdb_enter+0x33/frame 0xfffffe00681c2530 panic() at panic+0x43/frame 0xfffffe00681c2590 trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe00681c25e0 calltrap() at calltrap+0x8/frame 0xfffffe00681c25e0 --- trap 0xc, rip =3D 0xffffffff83c4c25a, rsp =3D 0xfffffe00681c26b0, rb= p =3D = 0xfffffe00681c26b0 --- write_csr_ring_config() at write_csr_ring_config+0xa/frame = 0xfffffe00681c26b0 adf_init_etr_data() at adf_init_etr_data+0x36a/frame 0xfffffe00681c2840 adf_dev_init() at adf_dev_init+0xc1/frame 0xfffffe00681c28f0 adf_attach() at adf_attach+0x4e1/frame 0xfffffe00681c2950 device_attach() at device_attach+0x43d/frame 0xfffffe00681c29a0 pci_driver_added() at pci_driver_added+0xf2/frame 0xfffffe00681c29e0 devclass_driver_added() at devclass_driver_added+0x29/frame = 0xfffffe00681c2a10 devclass_add_driver() at devclass_add_driver+0x11e/frame = 0xfffffe00681c2a50 module_register_init() at module_register_init+0x85/frame = 0xfffffe00681c2a80 linker_load_module() at linker_load_module+0xc0f/frame = 0xfffffe00681c2d80 kern_kldload() at kern_kldload+0x165/frame 0xfffffe00681c2dd0 sys_kldload() at sys_kldload+0x59/frame 0xfffffe00681c2e00 amd64_syscall() at amd64_syscall+0x126/frame 0xfffffe00681c2f30 fast_syscall_common() at fast_syscall_common+0xf8/frame = 0xfffffe00681c2f30 --More-- Because we=E2=80=99ve tried to use a pci_bars[2] entry with virt_addr =3D= =3D 0 = (because it=E2=80=99s outside of the BARs we set up). Reverting just the above hunk of the patch fixes the panic for us. Best regards, Kristof --=_MailMate_B08AB6DB-7748-4F2A-B2B9-63ABCCFE9199_= Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On 6 Jun 2025, at 15:57, Mark Johnston wrote:

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/co= mmit/?id=3Dded037e65e5239671b1292ec987a2e0894b217b5

commit ded037e65e5239671b1292ec987a2e0894b217b5
Author: Hareshx Sankar Raj hareshx.sankar.raj@intel.com
AuthorDate: 2025-05-07 09:38:21 +0000
Commit: Mark Johnston markj@Free= BSD.org
CommitDate: 2025-06-06 13:43:54 +0000

qa=
t: driver updates to improve code and fix bugs

Bug fixes and improvements are done for the qat code base
to improve code quality.

Reviewed by:    markj, ziaee
MFC after:      2 weeks
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D50379

=E2=80=A6

diff --git a/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_da= ta.h b/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h
index bfc5db1f5e5c..cddfc3f84853 100644
--- a/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h
+++ b/sys/dev/qat/qat_hw/qat_c3xxx/adf_c3xxx_hw_data.h
@@ -1,11 +1,11 @@
/* SPDX-License-Identifier: BSD-3-Clause /
-/ Copyright(c) 2007-2022 Intel Corporation /
+/ Copyright(c) 2007-2025 Intel Corporation */
#ifndef ADF_C3XXX_HW_DATA_H_
#define ADF_C3XXX_HW_DATA_H_

/* PCIe configuration space */
-#define ADF_C3XXX_PMISC_BAR 0
-#define ADF_C3XXX_ETR_BAR 1
+#define ADF_C3XXX_PMISC_BAR 1
+#define ADF_C3XXX_ETR_BAR 2
#define ADF_C3XXX_RX_RINGS_OFFSET 8
#define ADF_C3XXX_TX_RINGS_MASK 0xFF
#define ADF_C3XXX_MAX_ACCELERATORS 3

We=E2=80=99re seeing panics loading the QAT driver on Ato= m Processor C3000 (with pfSense).

I believe this change is the trigger.
This causes us to look for the ETR registers in the third BAR, but there = are only two on that hardware:

# =
pciconf -l -b -vV pci0:1:0:0
none0@pci0:1:0:0:	class=3D0x0b4000 rev=3D0x11 hdr=3D0x00 vendor=3D0x8086 =
device=3D0x19e2 subvendor=3D0x8086 subdevice=3D0x19e2
    vendor     =3D 'Intel Corporation'
    device     =3D 'Atom Processor C3000 Series QuickAssist Technology'
    class      =3D processor
    bar   [18] =3D type Memory, range 64, base 0x80700000, size 262144, e=
nabled
    bar   [20] =3D type Memory, range 64, base 0x80740000, size 262144, e=
nabled

That produces this backtrace:

Fa=
tal trap 12: page fault while in kernel mode
cpuid =3D 1; apic id =3D 18
fault virtual address	=3D 0x10
fault code		=3D supervisor read data, page not present
instruction pointer	=3D 0x20:0xffffffff83c4c25a
stack pointer	        =3D 0x28:0xfffffe00681c26b0
frame pointer	        =3D 0x28:0xfffffe00681c26b0
code segment		=3D base 0x0, limit 0xfffff, type 0x1b
			=3D DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	=3D interrupt enabled, resume, IOPL =3D 0
current process		=3D 3075 (kldload)
rdi: 0000000000000000 rsi: 0000000000000000 rdx: 0000000000000000
rcx: 0000000000000000  r8: fffffe00681c2715  r9: 000000000000000a
rax: 00000000000001ff rbx: 0000000000000000 rbp: fffffe00681c26b0
r10: 0000000000000000 r11: 0000000000000001 r12: 0000000000000000
r13: fffff80003a1a000 r14: 0000000000000000 r15: 0000000000000008
trap number		=3D 12
panic: page fault
cpuid =3D 1
time =3D 1753859856
KDB: enter: panic
[ thread pid 3075 tid 100160 ]
Stopped at      kdb_enter+0x33: movq    $0,0x1b55532(%rip)
db> bt
Tracing pid 3075 tid 100160 td 0xfffff80100d4a780
kdb_enter() at kdb_enter+0x33/frame 0xfffffe00681c2530
panic() at panic+0x43/frame 0xfffffe00681c2590
trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe00681c25e0
calltrap() at calltrap+0x8/frame 0xfffffe00681c25e0
--- trap 0xc, rip =3D 0xffffffff83c4c25a, rsp =3D 0xfffffe00681c26b0, rbp=
 =3D 0xfffffe00681c26b0 ---
write_csr_ring_config() at write_csr_ring_config+0xa/frame 0xfffffe00681c=
26b0
adf_init_etr_data() at adf_init_etr_data+0x36a/frame 0xfffffe00681c2840
adf_dev_init() at adf_dev_init+0xc1/frame 0xfffffe00681c28f0
adf_attach() at adf_attach+0x4e1/frame 0xfffffe00681c2950
device_attach() at device_attach+0x43d/frame 0xfffffe00681c29a0
pci_driver_added() at pci_driver_added+0xf2/frame 0xfffffe00681c29e0
devclass_driver_added() at devclass_driver_added+0x29/frame 0xfffffe00681=
c2a10
devclass_add_driver() at devclass_add_driver+0x11e/frame 0xfffffe00681c2a=
50
module_register_init() at module_register_init+0x85/frame 0xfffffe00681c2=
a80
linker_load_module() at linker_load_module+0xc0f/frame 0xfffffe00681c2d80=

kern_kldload() at kern_kldload+0x165/frame 0xfffffe00681c2dd0
sys_kldload() at sys_kldload+0x59/frame 0xfffffe00681c2e00
amd64_syscall() at amd64_syscall+0x126/frame 0xfffffe00681c2f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00681c2f3=
0
--More--

Because we=E2=80=99ve tried to use a pci_bars[2] entry wi= th virt_addr =3D=3D 0 (because it=E2=80=99s outside of the BARs we set up= ).

Reverting just the above hunk of the patch fixes the pani= c for us.

Best regards,
Kristof

--=_MailMate_B08AB6DB-7748-4F2A-B2B9-63ABCCFE9199_=--