CTSRD-CHERI · brooksdavis · Apr 2, 2025 · Mar 24, 2025 · Mar 27, 2025 · Nov 8, 2024
diff --git a/lib/csu/Makefile.inc b/lib/csu/Makefile.inc
@@ -36,7 +36,7 @@ CFLAGS+=	-I${.CURDIR:H}/common-cheri
 
 CFLAGS_CRTS+=	-DSHARED ${PICFLAG}
 
-FILES=		${OBJS}
+FILES=		${OBJS} crt.json
 FILESMODE=	${LIBMODE}
 FILESOWN=	${LIBOWN}
 FILESGRP=	${LIBGRP}

diff --git a/lib/csu/common/crt.json b/lib/csu/common/crt.json
@@ -0,0 +1,16 @@
+{
+    "compartments": {
+	"csu": {
+	    "files": [
+		"crt1.o",
+		"crtbegin.o",
+		"crtbeginS.o",
+		"crtbeginT.o",
+		"crtend.o",
+		"crtendS.o",
+		"crti.o",
+		"crtn.o"
+	    ]
+	}
+    }
+}
diff --git a/lib/libcompiler_rt/Makefile.inc b/lib/libcompiler_rt/Makefile.inc
@@ -252,7 +252,7 @@ CRT_COMMON_F16_ARCH=t
 # _Float16 support, only on some architectures, and with certain compiler
 # versions.
 #
-.if ((${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 150000) && \
+.if ((${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 150001) && \
      (defined(CRT_COMMON_F16_ARCH) || \
       ${MACHINE_CPUARCH} == "arm" || ${MACHINE_CPUARCH} == "riscv")) || \
     ((${COMPILER_TYPE} == "gcc" && ${COMPILER_VERSION} >= 120000) && \
@@ -264,7 +264,7 @@ CFLAGS+=	-DCOMPILER_RT_HAS_FLOAT16
 # __bf16 support, only on some architectures, and with certain compiler
 # versions.
 #
-.if ((${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 150000) && \
+.if ((${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 150001) && \
      (defined(CRT_COMMON_F16_ARCH)) && ${MACHINE_CPUARCH} != "aarch64") || \
     ((${COMPILER_TYPE} == "clang" && ${COMPILER_VERSION} >= 160000) && \
      ${MACHINE_CPUARCH} == "aarch64") || \

diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
@@ -299,6 +299,7 @@ LDFLAGS+=	-Wl,--undefined-version
 
 .if ${MK_COMPARTMENT_POLICY} != "no" && ${MACHINE_ABI:Mpurecap}
 .if !empty(COMPARTMENT_POLICY)
+COMPARTMENT_POLICY+=	${SYSROOT}/usr/lib/crt.json
 ${SHLIB_NAME_FULL}:	${COMPARTMENT_POLICY}
 LDFLAGS+=	${COMPARTMENT_POLICY:S/^/-Wl,--compartment-policy=/}
 .endif

diff --git a/share/mk/bsd.prog.mk b/share/mk/bsd.prog.mk
@@ -177,6 +177,7 @@ PROG_FULL=	${PROG}
 
 .if ${MK_COMPARTMENT_POLICY} != "no" && ${MACHINE_ABI:Mpurecap}
 .if !empty(COMPARTMENT_POLICY)
+COMPARTMENT_POLICY+=	${SYSROOT}/usr/lib/crt.json
 ${PROG_FULL}:	${COMPARTMENT_POLICY}
 LDFLAGS+=	${COMPARTMENT_POLICY:S/^/-Wl,--compartment-policy=/}
 .endif

diff --git a/sys/dev/rtwn/if_rtwn.c b/sys/dev/rtwn/if_rtwn.c
@@ -332,6 +332,11 @@ rtwn_sysctlattach(struct rtwn_softc *sc)
 	    sc->sc_ht40, "Enable 40 MHz mode support");
 #endif
 
+	sc->sc_ena_tsf64 = 0;
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+	    "ena_tsf64", CTLFLAG_RWTUN, &sc->sc_ena_tsf64,
+	    sc->sc_ena_tsf64, "Enable/disable per-packet TSF64 reporting");
+
 #ifdef RTWN_DEBUG
 	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 	    "debug", CTLFLAG_RWTUN, &sc->sc_debug, sc->sc_debug,
@@ -1124,6 +1129,9 @@ rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 			/* Stop Rx of data frames. */
 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
 
+			/* Stop Rx of control frames. */
+			rtwn_write_2(sc, R92C_RXFLTMAP1, 0);
+
 			/* Reset EDCA parameters. */
 			rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
 			rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
@@ -1262,6 +1270,11 @@ rtwn_run(struct rtwn_softc *sc, struct ieee80211vap *vap)
 	rtwn_write_2(sc, R92C_BCN_INTERVAL(uvp->id), ni->ni_intval);
 
 	if (sc->vaps_running == sc->monvaps_running) {
+		/* Enable Rx of BAR control frames. */
+		rtwn_write_2(sc, R92C_RXFLTMAP1,
+		    1 << (IEEE80211_FC0_SUBTYPE_BAR >>
+		    IEEE80211_FC0_SUBTYPE_SHIFT));
+
 		/* Enable Rx of data frames. */
 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
 

diff --git a/sys/dev/rtwn/if_rtwn_rx.c b/sys/dev/rtwn/if_rtwn_rx.c
@@ -285,8 +285,18 @@ rtwn_rx_common(struct rtwn_softc *sc, struct mbuf *m, void *desc)
 		rxs.c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
 
 	rxs.r_flags |= IEEE80211_R_TSF_START;	/* XXX undocumented */
-	rxs.r_flags |= IEEE80211_R_TSF64;
-	rxs.c_rx_tsf = rtwn_extend_rx_tsf(sc, stat);
+
+	/*
+	 * Doing the TSF64 extension on USB is expensive, especially
+	 * if it's being done on every MPDU in an AMPDU burst.
+	 */
+	if (sc->sc_ena_tsf64) {
+		rxs.r_flags |= IEEE80211_R_TSF64;
+		rxs.c_rx_tsf = rtwn_extend_rx_tsf(sc, stat);
+	} else {
+		rxs.r_flags |= IEEE80211_R_TSF32;
+		rxs.c_rx_tsf = le32toh(stat->tsf_low);
+	}
 
 	/* Get RSSI from PHY status descriptor. */
 	is_cck = (rxs.c_pktflags & IEEE80211_RX_F_CCK) != 0;
@@ -318,6 +328,10 @@ rtwn_rx_common(struct rtwn_softc *sc, struct mbuf *m, void *desc)
 	/* Drop PHY descriptor. */
 	m_adj(m, infosz + shift);
 
+	/* If APPFCS, drop FCS */
+	if (sc->rcr & R92C_RCR_APPFCS)
+		m_adj(m, -IEEE80211_CRC_LEN);
+
 	return (ni);
 }
 
@@ -456,6 +470,15 @@ rtwn_rxfilter_init(struct rtwn_softc *sc)
 	    R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
 	    R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
 
+	/*
+	 * Add FCS, to work around occasional 4 byte truncation
+	 * with some frames.  This is more problematic on RTL8812/
+	 * RTL8821 because they're also doing L3/L4 checksum offload
+	 * and hardware encryption, so both are tagged as "passed"
+	 * before the frame is truncated.
+	 */
+	sc->rcr |= R92C_RCR_APPFCS;
+
 	/* Update dynamic Rx filter parts. */
 	rtwn_rxfilter_update(sc);
 }
@@ -506,5 +529,12 @@ rtwn_set_promisc(struct rtwn_softc *sc)
 		sc->rcr &= ~mask_min;
 		sc->rcr |= mask_all;
 	}
+
+	/*
+	 * Add FCS, to work around occasional 4 byte truncation.
+	 * See the previous comment above R92C_RCR_APPFCS.
+	 */
+	sc->rcr |= R92C_RCR_APPFCS;
+
 	rtwn_rxfilter_set(sc);
 }
diff --git a/sys/dev/rtwn/if_rtwn_tx.c b/sys/dev/rtwn/if_rtwn_tx.c
@@ -263,6 +263,11 @@ rtwn_start(struct rtwn_softc *sc)
 	struct mbuf *m;
 
 	RTWN_ASSERT_LOCKED(sc);
+
+	/* Ensure no work is scheduled during reset/teardown */
+	if ((sc->sc_flags & RTWN_RUNNING) == 0)
+		return;
+
 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 		if (sc->qfullmsk != 0) {
 			mbufq_prepend(&sc->sc_snd, m);

diff --git a/sys/dev/rtwn/if_rtwnvar.h b/sys/dev/rtwn/if_rtwnvar.h
@@ -32,7 +32,7 @@
 #define RTWN_MACID_VALID 	0x8000
 #define RTWN_MACID_LIMIT	128
 
-#define RTWN_TX_TIMEOUT		5000	/* ms */
+#define RTWN_TX_TIMEOUT		1000	/* ms */
 #define RTWN_MAX_EPOUT		4
 #define RTWN_PORT_COUNT		2
 
@@ -96,7 +96,7 @@ struct rtwn_cmdq {
 #define RTWN_CMDQ_SIZE		16
 
 struct rtwn_node {
-	struct ieee80211_node	ni;	/* must be the first */
+	struct ieee80211_node	ni __subobject_member_used_for_c_inheritance;	/* must be the first */
 	int			id;
 
 	struct rtwn_tx_phystat	last_physt;
@@ -105,7 +105,7 @@ struct rtwn_node {
 #define RTWN_NODE(ni)		((struct rtwn_node *)(ni))
 
 struct rtwn_vap {
-	struct ieee80211vap	vap;
+	struct ieee80211vap	vap __subobject_member_used_for_c_inheritance;
 	int			id;
 #define RTWN_VAP_ID_INVALID	-1
 	int			curr_mode;
@@ -174,6 +174,7 @@ struct rtwn_softc {
 #if 1
 	int			sc_ht40;
 #endif
+	int			sc_ena_tsf64;
 	uint32_t		sc_debug;
 	int			sc_hwcrypto;
 	int			sc_ratectl_sysctl;

diff --git a/sys/dev/rtwn/rtl8812a/r12a_rx.c b/sys/dev/rtwn/rtl8812a/r12a_rx.c
@@ -178,6 +178,15 @@ r12a_handle_c2h_report(struct rtwn_softc *sc, uint8_t *buf, int len)
 int
 r12a_check_frame_checksum(struct rtwn_softc *sc, struct mbuf *m)
 {
+	/*
+	 * XXX: RTL8821AU seems to incorrectly handle at least UDP checksum
+	 * fields of 0, treating them as an error. Ignore the offloaded
+	 * checksumming result until this has been better characterised
+	 * (including whether all-ones is correctly handled).
+	 *
+	 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285837
+	 */
+#if 0
 	struct r12a_softc *rs = sc->sc_priv;
 	struct r92c_rx_stat *stat;
 	uint32_t rxdw1;
@@ -202,6 +211,7 @@ r12a_check_frame_checksum(struct rtwn_softc *sc, struct mbuf *m)
 			m->m_pkthdr.csum_data = 0xffff;
 		}
 	}
+#endif
 
 	return (0);
 }

diff --git a/sys/dev/rtwn/usb/rtwn_usb_attach.c b/sys/dev/rtwn/usb/rtwn_usb_attach.c
@@ -156,10 +156,12 @@ rtwn_usb_alloc_tx_list(struct rtwn_softc *sc)
 	if (error != 0)
 		return (error);
 
-	STAILQ_INIT(&uc->uc_tx_active);
-	STAILQ_INIT(&uc->uc_tx_inactive);
-	STAILQ_INIT(&uc->uc_tx_pending);
+	for (i = RTWN_BULK_TX_FIRST; i < RTWN_BULK_EP_COUNT; i++) {
+		STAILQ_INIT(&uc->uc_tx_active[i]);
+		STAILQ_INIT(&uc->uc_tx_pending[i]);
+	}
 
+	STAILQ_INIT(&uc->uc_tx_inactive);
 	for (i = 0; i < RTWN_USB_TX_LIST_COUNT; i++)
 		STAILQ_INSERT_HEAD(&uc->uc_tx_inactive, &uc->uc_tx[i], next);
 
@@ -207,23 +209,29 @@ static void
 rtwn_usb_free_tx_list(struct rtwn_softc *sc)
 {
 	struct rtwn_usb_softc *uc = RTWN_USB_SOFTC(sc);
+	int i;
 
 	rtwn_usb_free_list(sc, uc->uc_tx, RTWN_USB_TX_LIST_COUNT);
 
-	STAILQ_INIT(&uc->uc_tx_active);
+	for (i = RTWN_BULK_TX_FIRST; i < RTWN_BULK_EP_COUNT; i++) {
+		STAILQ_INIT(&uc->uc_tx_active[i]);
+		STAILQ_INIT(&uc->uc_tx_pending[i]);
+	}
 	STAILQ_INIT(&uc->uc_tx_inactive);
-	STAILQ_INIT(&uc->uc_tx_pending);
 }
 
 static void
 rtwn_usb_reset_lists(struct rtwn_softc *sc, struct ieee80211vap *vap)
 {
 	struct rtwn_usb_softc *uc = RTWN_USB_SOFTC(sc);
+	int i;
 
 	RTWN_ASSERT_LOCKED(sc);
 
-	rtwn_usb_reset_tx_list(uc, &uc->uc_tx_active, vap);
-	rtwn_usb_reset_tx_list(uc, &uc->uc_tx_pending, vap);
+	for (i = RTWN_BULK_TX_FIRST; i < RTWN_BULK_EP_COUNT; i++) {
+		rtwn_usb_reset_tx_list(uc, &uc->uc_tx_active[i], vap);
+		rtwn_usb_reset_tx_list(uc, &uc->uc_tx_pending[i], vap);
+	}
 	if (vap == NULL) {
 		rtwn_usb_reset_rx_list(uc);
 		sc->qfullmsk = 0;
@@ -295,7 +303,7 @@ rtwn_usb_abort_xfers(struct rtwn_softc *sc)
 
 	/* abort any pending transfers */
 	RTWN_UNLOCK(sc);
-	for (i = 0; i < RTWN_N_TRANSFER; i++)
+	for (i = 0; i < RTWN_BULK_EP_COUNT; i++)
 		usbd_transfer_drain(uc->uc_xfer[i]);
 	RTWN_LOCK(sc);
 }
@@ -432,7 +440,7 @@ rtwn_usb_detach(device_t self)
 	rtwn_usb_free_rx_list(sc);
 
 	/* Detach all USB transfers. */
-	usbd_transfer_unsetup(uc->uc_xfer, RTWN_N_TRANSFER);
+	usbd_transfer_unsetup(uc->uc_xfer, RTWN_BULK_EP_COUNT);
 
 	rtwn_detach_private(sc);
 	mtx_destroy(&sc->sc_mtx);

diff --git a/sys/dev/rtwn/usb/rtwn_usb_ep.c b/sys/dev/rtwn/usb/rtwn_usb_ep.c
@@ -55,7 +55,7 @@
 
 #include <dev/rtwn/rtl8192c/usb/r92cu_reg.h>
 
-static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = {
+static const struct usb_config rtwn_config_common[RTWN_BULK_EP_COUNT] = {
 	[RTWN_BULK_RX] = {
 		.type = UE_BULK,
 		.endpoint = UE_ADDR_ANY,
@@ -76,7 +76,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = {
 			.pipe_bof = 1,
 			.force_short_xfer = 1,
 		},
-		.callback = rtwn_bulk_tx_callback,
+		.callback = rtwn_bulk_tx_callback_be,
 		.timeout = RTWN_TX_TIMEOUT,	/* ms */
 	},
 	[RTWN_BULK_TX_BK] = {
@@ -89,7 +89,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = {
 			.pipe_bof = 1,
 			.force_short_xfer = 1,
 		},
-		.callback = rtwn_bulk_tx_callback,
+		.callback = rtwn_bulk_tx_callback_bk,
 		.timeout = RTWN_TX_TIMEOUT,	/* ms */
 	},
 	[RTWN_BULK_TX_VI] = {
@@ -102,7 +102,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = {
 			.pipe_bof = 1,
 			.force_short_xfer = 1
 		},
-		.callback = rtwn_bulk_tx_callback,
+		.callback = rtwn_bulk_tx_callback_vi,
 		.timeout = RTWN_TX_TIMEOUT,	/* ms */
 	},
 	[RTWN_BULK_TX_VO] = {
@@ -115,7 +115,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = {
 			.pipe_bof = 1,
 			.force_short_xfer = 1
 		},
-		.callback = rtwn_bulk_tx_callback,
+		.callback = rtwn_bulk_tx_callback_vo,
 		.timeout = RTWN_TX_TIMEOUT,	/* ms */
 	},
 };
@@ -200,22 +200,33 @@ rtwn_usb_setup_endpoints(struct rtwn_usb_softc *uc)
 
 	/* NB: keep in sync with rtwn_dma_init(). */
 	rtwn_config[RTWN_BULK_TX_VO].endpoint = addr[0];
+	uc->wme2qid[WME_AC_VO] = RTWN_BULK_TX_VO;
 	switch (uc->ntx) {
 	case 4:
 	case 3:
 		rtwn_config[RTWN_BULK_TX_BE].endpoint = addr[2];
 		rtwn_config[RTWN_BULK_TX_BK].endpoint = addr[2];
 		rtwn_config[RTWN_BULK_TX_VI].endpoint = addr[1];
+		uc->wme2qid[WME_AC_BE] = RTWN_BULK_TX_BE;
+		uc->wme2qid[WME_AC_BK] = RTWN_BULK_TX_BE;
+		uc->wme2qid[WME_AC_VI] = RTWN_BULK_TX_VI;
 		break;
 	case 2:
 		rtwn_config[RTWN_BULK_TX_BE].endpoint = addr[1];
 		rtwn_config[RTWN_BULK_TX_BK].endpoint = addr[1];
 		rtwn_config[RTWN_BULK_TX_VI].endpoint = addr[0];
+		uc->wme2qid[WME_AC_BE] = RTWN_BULK_TX_VI;
+		uc->wme2qid[WME_AC_BK] = RTWN_BULK_TX_VI;
+		uc->wme2qid[WME_AC_VI] = RTWN_BULK_TX_VO;
 		break;
 	case 1:
 		rtwn_config[RTWN_BULK_TX_BE].endpoint = addr[0];
 		rtwn_config[RTWN_BULK_TX_BK].endpoint = addr[0];
 		rtwn_config[RTWN_BULK_TX_VI].endpoint = addr[0];
+
+		uc->wme2qid[WME_AC_BE] = RTWN_BULK_TX_VO;
+		uc->wme2qid[WME_AC_BK] = RTWN_BULK_TX_VO;
+		uc->wme2qid[WME_AC_VI] = RTWN_BULK_TX_VO;
 		break;
 	default:
 		KASSERT(0, ("unhandled number of endpoints %d\n", uc->ntx));
@@ -225,7 +236,7 @@ rtwn_usb_setup_endpoints(struct rtwn_usb_softc *uc)
 	rtwn_config[RTWN_BULK_RX].bufsize =
 	    uc->uc_rx_buf_size * RTWN_USB_RXBUFSZ_UNIT;
 	error = usbd_transfer_setup(uc->uc_udev, &iface_index,
-	    uc->uc_xfer, rtwn_config, RTWN_N_TRANSFER, uc, &sc->sc_mtx);
+	    uc->uc_xfer, rtwn_config, RTWN_BULK_EP_COUNT, uc, &sc->sc_mtx);
 	free(rtwn_config, M_TEMP);
 
 	if (error) {