From nobody Thu Apr 16 15:04:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fxLrn2gm0z6Zp7Z for ; Thu, 16 Apr 2026 15:04:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fxLrm71WDz4Hmn for ; Thu, 16 Apr 2026 15:04:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776351865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Gq5maO1pMQxxjja6Uy8hTh2xafzXpjKXfQhkLsyjo3M=; b=ThD1evht3/qO37WKrEBkbZuH9rNFjYL4leU5VY094OvKc6Jz56D0y6jC7uTs/3tYt86V0M nsLBQU6Z6V00XXX0Xoeh4+w4sTrgg04q3uHAOnqAuNBKYG/4qFOuUPxfGgPbGAccUanNAl PIrXkXqLqT/OFLbNx78qEqpcvvr/b/Xuqcm90xBjxlWkkwhwhQeieWstTwMscS/P40hDFi NXyhlPH3WCwvUNoCI4tqemtumUjl5Xmbk66j9UGSw+x5FmK+u8vnFpNp6fXAHG4YJF5uZt EjvrAx88GoalJjT9JQCZdRGOoM1QSwcNe6SaAISTO8qAXNaELSt6+rhiJuBglw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1776351865; a=rsa-sha256; cv=none; b=KduMiIxQX9vpxK9Y2JowuOnOeTJ1EWH73XBZNUklg3XOPBVuNEEGpZnFEU9QP7FYBZCSXq kAIbwvHuRDGh+fJg2CGlCyFxWA8h/xQXSoagkkTeNmPRQllUGaasZzUcXDZ4TZ7MBk3ykO EtXf7ejC9K4LaqXVv7rzWBjnzEsOE+2fQh4thyzmXYLBDPc35JyyESQn6NoEtf8X/N4uK4 jwiEmig7HyZN9JwT6uzKPc+KdrBREly1O/fQLHe2jzmIorGS+JFf/XlWBY8m37naNP0RY/ SVO+SmuQYbx90BfQ1R55xj45WcyColaXVs4uwCx+XIjZSnidWM8qy04mU9j4OQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776351865; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Gq5maO1pMQxxjja6Uy8hTh2xafzXpjKXfQhkLsyjo3M=; b=PwUsj7eKnqMmzx19krtI8ftDtyRMNqhLNsTr2/+mkXL0SyBwGRLmxV07V4poFHv/8pRjnD RK4ERFHL8bqsre5XdFDK7kA/zL1hxwwH5QCmmX9v/bS3gjvWaXdtnVAIJfcrj4VzAa4DGr 2tP5qGwEW+c3Rfta7Q0aPaMgTHgu9e0Gdh1ZJPmGI5eCL4nHsfueOjvdks0/N8lCWhthQs +VyMqmZ51cSSXT7aqHYF+lWdl0uP3gIUQlqp8MykN+OPfibGyRRoLGv4Lzlu8THmsyaNTZ 8FGQgpsrJM4BQZaQeNoUbJn08vVH6QpFtwyh++iOAooVphIadV95e50qG2v4Iw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fxLrm65Bnz1BxQ for ; Thu, 16 Apr 2026 15:04:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e1cb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 16 Apr 2026 15:04:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Colin Percival Subject: git: b55fd9cdc25b - stable/15 - io_apic: Don't route to APIC ID > 255 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b55fd9cdc25ba0cfe41380c4aaf583938637b805 Auto-Submitted: auto-generated Date: Thu, 16 Apr 2026 15:04:24 +0000 Message-Id: <69e0fa78.1e1cb.62daa6cf@gitrepo.freebsd.org> The branch stable/15 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=b55fd9cdc25ba0cfe41380c4aaf583938637b805 commit b55fd9cdc25ba0cfe41380c4aaf583938637b805 Author: Colin Percival AuthorDate: 2026-03-14 05:51:04 +0000 Commit: Colin Percival CommitDate: 2026-04-16 15:03:58 +0000 io_apic: Don't route to APIC ID > 255 I/O APIC Redirection Table Entries use 8 bits to encode the Destination ID. Attempting to route an IRQ to a higher APIC ID would result in it being silently routed to the value reduced modulo 256, causing a panic if the IRQ fired since the receiving CPU would not expect that IRQ. Instead, print a warning and mark the interrupt as invalid, resulting in it being forcibly masked. Reviewed by: kib Tested on: EC2 r8i.96xlarge MFC after: 3 weeks Sponsored by: Amazon Differential Revision: https://reviews.freebsd.org/D55857 (cherry picked from commit 5809c9a77b2d3b83c056ba3ac5ba4e261c0af595) --- sys/x86/x86/io_apic.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/sys/x86/x86/io_apic.c b/sys/x86/x86/io_apic.c index 03d85acabb1a..5d28b7e8c611 100644 --- a/sys/x86/x86/io_apic.c +++ b/sys/x86/x86/io_apic.c @@ -364,10 +364,20 @@ ioapic_program_intpin(struct ioapic_intsrc *intpin) /* * Set the destination. Note that with Intel interrupt remapping, * the previously reserved bits 55:48 now have a purpose so ensure - * these are zero. + * these are zero. If the CPU number (in fact, APIC ID) is too + * large, mark the interrupt as invalid, and target CPU #0. */ - low = IOART_DESTPHY; - high = intpin->io_cpu << APIC_ID_SHIFT; + if (intpin->io_cpu <= IOAPIC_MAX_ID) { + low = IOART_DESTPHY; + high = intpin->io_cpu << APIC_ID_SHIFT; + intpin->io_valid = 1; + } else { + printf("%s: unsupported destination APIC ID %u for pin %u\n", + __func__, intpin->io_cpu, intpin->io_intpin); + low = IOART_DESTPHY; + high = 0 << APIC_ID_SHIFT; + intpin->io_valid = 0; + } /* Program the rest of the low word. */ if (intpin->io_edgetrigger)