bnxt: Report SR-IOV VF status
Expose the PF-known effective per-VF MAC, allocated transmit and receive
queue counts, and policy state through the iflib VF status method.
Snapshot the state under the SR-IOV lock so concurrent trust and
anti-spoof sysctl updates cannot produce a torn report. Mark known queue
allocations present even when their value is zero.
Cache a VF-selected MAC only after firmware accepts the forwarded
request. Prefer that address in status. Replay the accepted address,
trust state, and MAC anti-spoof policy after firmware recovery.
Record completion of the per-VF configuration callback separately from
firmware resource allocation.
Track successful PCI SR-IOV attachment independently of the active VF
count. This lets a supported but unconfigured PF return an empty status
while unsupported devices and failed attachments omit it.
[2 lines not shown]
mlx5en: Report the configured RSS tuple selections
Derive SIOCGIFRSSHASH's TCP and UDP selections from the same boot-time
hash configuration used by mlx5e_build_tir_ctx(). The query previously
advertised all six IPv4/IPv6 hash types even when the transport-specific
TIRs selected only the IP addresses. In particular, the default RSS
configuration disables UDP four-tuple hashing.
Continue reporting IPv4 and IPv6 two-tuple hashing unconditionally,
matching the driver's IP-only TIRs. Do not report IPv6 extension-header
variants which the query did not previously claim. Leave key selection,
TIR programming, and the receive datapath unchanged. This lets consumers
such as hn(4) match the VF's hash inputs instead of enabling incompatible
UDP four-tuple hashes on their own receive path.
Fixes: a00718e1dfcd ("Implement SIOCGIFRSSKEY and SIOCGIFRSSHASH and mlx5en(4).")
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59807
mlx5en: Report SR-IOV VF status
Query each enabled eswitch vport to report its effective MAC and VLAN
configuration and administrative link-state policy. Serialize the
query with vport enable and disable, and hold the interface state lock
so teardown joins an in-progress report.
Propagate firmware errors from MAC, administrative link-state, and
supported VLAN queries instead of returning a partially initialized
configuration. When the hardware lacks CVLAN enforcement, report the
remaining status with no imposed access VLAN.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D58740
tpm20: Preserve all harvested random bytes
The TPM requests 16 random bytes every ten seconds, but a random
harvest event retains at most eight bytes. random_harvest_queue()
reduces a larger input to one 32-bit Jenkins hash, so each successful
TPM request contributed only four bytes to the entropy accumulator.
Split the response into harvest event sized chunks. This preserves all
16 random bytes without increasing the TPM command rate or changing its
high quality source classification.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59246
tpm: Harvest entropy from TPM 1.2 devices
The TPM 2.0 driver periodically contributes TPM-generated random bytes
to the kernel entropy pool, but the TPM 1.2 driver does not.
Issue TPM_GetRandom every ten seconds and submit successful responses
as RANDOM_PURE_TPM. Keep each exchange under the TPM transaction lock.
Defer harvesting while the character device is open or a command is
pending so the task cannot consume a user response. Drain the task for
suspend and detach, rearming it after resume or a failed suspend.
Document the expanded scope of RANDOM_ENABLE_TPM and update the kernel
configuration comments that described it as TPM 2.0-only.
Validated on a STMicroelectronics TPM 1.2 TIS device. DTrace observed
periodic entropy submissions; a raw GetRandom response remained intact
while the device was held open across a harvest interval; and module
unload/reload deregistered and restored the entropy source cleanly.
[4 lines not shown]
tpm: crb: Improve ACPI control and buffer addresses
The TPM2 ControlAddress identifies the control area, not necessarily a
PTP locality block. Hyper-V exposes a start-method-7 control area at the
beginning of its ACPI memory resource, with command and response buffers
in separate reserved memory pages. Assuming control registers are at
resource + 0x40 instead writes CANCEL as LOC_CTRL and fails attach.
Map the control area using ControlAddress and map buffers using their
reported physical addresses. Reuse the resource mapping for contained
ranges and track ownership of independent mappings for cleanup. Request
locality only when the resource contains the preceding 64-byte PTP header.
Keep the existing Pluton notification callbacks and locality behavior for
that layout. Control, locality, and buffer accesses use their respective
mappings directly, without the tpm_bus accessor class.
Bound transfers by the mapped buffer sizes and TPM_BUFSIZE. Clamp an
overstated buffer that starts within the ACPI resource to its remaining
extent, while requiring room for a complete response header. Keep strict
[20 lines not shown]
tpm: Tie exclusive-open cleanup to the file lifetime
Use a cdevpriv destructor to abort an unfinished TPM 1.2 transaction and
release exclusive-open ownership. Register it before setting TPM_OPEN so
a failed registration leaves the device available. The last reference to
the successful open triggers cleanup, including after dup() or fork().
Suggested by: kevans
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59812
tpm: Validate firmware interrupt routes and fall back cleanly
A host IRQ resource is not necessarily an LPC SIRQ selector. Let the
frontend configure the route: ACPI uses the allocated _CRS interrupt and
_SRS when present, preserving the firmware selector, while ISA supplies a
separate, range-checked SIRQ. Match trigger and polarity to the host route
and TPM capabilities, including opaque INTRNG resource mappings.
Pass the firmware descriptor unchanged to _SRS; apply the x86 ISA polarity
override only when computing the TPM mode. ISA chips without rising-edge
support now poll instead of substituting a level mode for the host route.
For both FIFO drivers, require a complete GetRandom transport response and
a fresh DATA_AVAIL interrupt before selecting interrupt waits. Perform
the test with polling before publishing the device, and repeat it after
resume. During cold boot, defer the test and publication to an interrupt
configuration hook so the IRQ grace wait can sleep and the handler can run.
Drain the hook before teardown; failed deferred initialization remains
unpublished and can be detached safely. Missing or failed routes release
the handler and IRQ resource;
[33 lines not shown]
tpm: Validate TIS 1.2 IRQs and quiesce delivery before teardown
The TIS 1.2 driver uses the IRQ resource value directly as the four-bit
LPC SIRQ selector in TPM_INT_VECTOR, without validating it before
narrowing. Add the missing range check on the full resource value and use
polling for routes outside 1 through 15. This restriction reflects the
driver's current routing support: parent interrupt numbers need not equal
LPC SIRQ channels.
Attach also installs a handler when the chip's quirks select polling.
Release the IRQ resource when initialization selects polling. Retain an
interrupt cookie only after successful setup and require it for interrupt
waits.
Share verified interrupt masking across initialization, resume, and
detach. Quiesce after draining cdev methods and before removing a handler,
including polling devices whose failed resume left firmware delivery on.
Preserve an owned locality until the existing abort path discards any
pending response. Report quiesce failures while completing detach cleanup.
[17 lines not shown]
jailmeta: reject empty keys in metadata lookups
Reject empty keys in metadata lookups with EINVAL to prevent an infinite
loop while holding allprison_lock and pr_mtx. Add tests for empty-key
reads and writes with empty and populated meta/env buffers, trailing
newlines, and empty final values.
Reviewed by: igoro, jamie
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D61025
ure.4: Remove non-USB devices from HARDWARE
The RTL8168, RTL8169 and RTL8110 are PCI/PCIe Ethernet controllers
supported by re(4), and the RTL8211 is a standalone gigabit PHY. None
of these are supported by ure(4).
The list appears to come from rgephy(4), which drives the internal PHY
on some ure-supported devices.
Fixes: 76ed6f2db316 ("ure.4: add a HARDWARE section + add RTL8156BG as a compatible controller")
Reviewed by: Kenneth Raplee <kenrap at kennethraplee.com>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61061
fdcopy(): properly update fd_freefile when skipping non-copyable fd
fd_freefile is maintained to fulfill the POSIX guarantee that the lowest
possible file descriptor is allocated on open. If we skip copying an
fd, it is a possible candidate for the lowest index.
First, the file descriptor installed with a kqueue created
without KQUEUE_CPONFORK missed this handling [*].
Second, fd_freefile should be updated only when the current fd index is
below it. A skipped fd above fd_freefile could raise it past a free slot.
PR: 300234 [*]
Reported by: Andrea Venturoli <freebsd at netfence.it>
Reviewed by: markj
Fixes: 1265516c5c61 ("struct file: add DFLAG_FORK, indicate copying on fork")
Fixes: 809f3121be66 ("fd: assign fd_freefile early when copying")
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D61054
ure: Handle SIOCGIFXMEDIA
The SIOCGIFXMEDIA ioctl is uesd to report extended Ethernet media
subtypes.
ure(4)commit d4cf41a99b40 added support for some newer devices and
added a special case to call ifmedia_ioctl() instead of uether_ioctl()
for those devices, but only for SIOCGIFMEDIA and SIOCSIFXMEDIA.
Fixes: d4cf41a99b40 ("Add support for RTL8153B, RTL8156 and RTL8156B to if_ure(4).")
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61049
e1000: Honor the common RSS hash-field policy
Use rss_gethashconfig() to select MRQC hash fields in both the em and
igb multiqueue paths, including kernels built without options RSS.
igb previously enabled UDP four-tuple hashing unconditionally, while
the stack defaults to hashing only the addresses unless
net.inet.rss.udp_4tuple is enabled. Honor that setting and include the
configured IPv6 extension-header address hash.
Limit the 82574 mapping to its supported fields. Its TCP/IPv6 selector
is bit 18, named IPV6_TCP_EX in the shared definitions; bit 21 and the
UDP selectors are reserved. Its default field selection is unchanged.
MFC after: 3 days
Sponsored by: BBOX.io
e1000: clear VFTA when last VLAN is removed
The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.
Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.
(cherry picked from commit a9305a6f50be89f22c7a469aeee4c3bea2086ace)
netgraph/ng_ksocket: Enter epoch on NG_SEND_DATA_ONLY
The work queued by ng_send_fn() is intentionally processed
outside of the epoch in ngthread().
It is ng_ksocket's responsibility to enter epoch if it decides
to send data from such work.
Reviewed by: glebius
Fixes: 104827151e2a ("ng_iface: don't recursively enter epoch ...")
Differential Revision: https://reviews.freebsd.org/D60589
(cherry picked from commit 67be955f6bd5d5b51fdee407969d1a7cde156f65)
ng_socket: plug node reference leak
There is no need to reference node in its constructor, the framework
already granted us a reference. This extraneous reference was later given
back on socket detach. However, if node is destroyed before the socket,
the node was leaked. This leak was harmless until VIMAGE, where
vnet_netgraph_uninit() would cycle through all nodes and shut them down
expecting them to not exist after the shutdown.
Fixes: 19284374970533e1aa04020d4f840e8877ed6266
(cherry picked from commit 4d3cbeb7b407e127a5364f86039745068fbfc61f)
ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type
Add etlv type validation to ipfw_nat64clat() and ipfw_nat64stl() to
verify that the retrieved instance is actually a nat64clat instance
before use.
All NAT64 instance types share the same srvstate[] array but have
different struct layouts.
Without type validation, using the wrong instance type with
a handler causes type confusion and kernel panic.
Signed-off-by: Teddy Engel <engel.teddy at gmail.com>
PR: 292023
Reviewed by: pouria
Pull Request: https://github.com/freebsd/freebsd-src/pull/2259
(cherry picked from commit 2e6b22abf44d99b84abf17fe25ca2e8f89716c04)
nat64lsn: Fix type confusion panic when using wrong NAT64 instance type
When an ipfw rule references a NAT64 instance by name using
'nat64lsn', the kernel looks up the instance in the shared
srvstate[] array without verifying the instance type.
If the named instance is actually a nat64clat or nat64stl
instance (created with 'nat64clat' or 'nat64stl'), the code
incorrectly casts the instance to nat64lsn_instance and
dereferences the ->cfg pointer, which causes a kernel panic.
The root cause is that all NAT64 instance types share the same
srvstate[] array but have different struct layouts.
For nat64lsn_instance, the field after 'no' is a pointer to nat64lsn_cfg.
For nat64clat_cfg, the same offset contains an embedded nat64_config struct.
Fix by adding a type check after NAT64_LOOKUP() to verify that the
instance's etlv matches IPFW_TLV_NAT64LSN_NAME before proceeding.
If the type doesn't match, return IP_FW_DENY to reject the packet
safely rather than crashing.
[8 lines not shown]
carp: fix global demotion counter to VRRP advertisements
When net.inet.carp.preempt=1 and a physical interface goes down, the global
V_carp_demotion counter is incremented. For CARP this was already reflected in
outgoing advertisements via DEMOTE_ADVSKEW(), but VRRP sent the raw
sc_vrrp_prio unchanged, so demotion had no effect.
Add DEMOTE_VRRP_PRIO(), a macro analogous to DEMOTE_ADVSKEW():
It subtracts V_carp_demotion from the configured priority and clamps the result
to [0, 254]. Priority 0 is VRRPv3's "resign" signal and causes backups to
preempt immediately. Priority 255 (IP address owner) is never demoted.
Reviewed by: kp
Approved by: kp
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D55558
(cherry picked from commit 9f71153aec0cb455cd49af6d4ca7e4c16fd45d7a)
pfil: Avoid potential mbuf tag leak
In '398254f9999e mbuf: simplify m_free' we removed tag processing
on m_free() of M_NOFREE mbufs. It is possible that a packet filter
could attach a tag to this stack mbuf and call m_free()
on it, meaning that 398254f9999e may have introduced a tag leak.
However,if a tag is attached without anyone calling m_free(), then
this leak was pre-existing.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D60686
Fixes: 398254f9999e
Sponsored by: Netflix
(cherry picked from commit f4ff995e361fa72cea240c4dbac2d0931965c80f)
mbuf: simplify m_free
The check for (M_PKTHDR|M_NOFREE) was added by np@ in
"91d1b03d3617 Merge r254736 from user/np/cxl_tuning."
in order to support a clever rx mode optimization used
by cxgbe at the time. That optimization was removed in
46e1e307edb6 several years ago. This check is otherwise
unneeded and adds an extraneous test to every mbuf free,
so let's remove it.
Reviewed by: glebius, np
Differential Revision: https://reviews.freebsd.org/D60686
Sponsored by: Netflix
(cherry picked from commit 398254f9999eb1af5f0842570111d584aaf8d01a)
pf: fix a crash on sendfile()
The network layer must not pass unmapped (M_EXTPG) mbufs to if_output()
of network interfaces without IFCAP_MEXTPG. pf should convert these
mbufs by mb_unmapped_to_ext() for such interfaces but it didn't.
The problem had occurred on sendfile because sendfile system call
uses unmapped mbufs for the file data.
Reported by: feld
Reviewed by: kp, glebius
Differential Revision: https://reviews.freebsd.org/D58021
(cherry picked from commit 8a14fcd23a201944f3eb5086403d10cfe1fc128f)
netinet6: Fix check for pktinfo outgoing ifindex in route cache
lookup_route is only called for outgoing traffic, therefore
check nh_ifp index instead of nh_aifp as specified by RFC3542 sec 6.
Differential Revision: https://reviews.freebsd.org/D58544
(cherry picked from commit 7753a59fdf196fcbd8bb5706ad44bfc590bce0a9)
ktls: Fix capability checks in ktls_reset_receive_tag()
IFCAP2_RXTLS4 and IFCAP2_RXTLS6 are bit numbers, not masks, so
ktls_reset_receive_tag() tested if_capenable2 against 0 for IPv4 and against the
RXTLS4 bit for IPv6. An IPv4 connection with NIC receive TLS offload thus never
got a new receive tag after its packets moved to another interface, and fell
back to software decryption for good.
c721694 fixed the same checks in ktls_alloc_rcv_tag(); use IFCAP2_BIT() here
as well.
Fixes: fe8c78f ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin, kib
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60757
(cherry picked from commit 32a981471c0147ea494745477434807cf8b6dadb)
ktls: Take the receiving interface of each packet in sbappend_ktls_rx()
sbappend_ktls_rx() read the receiving interface of each packet header it
demotes from the chain's first mbuf, whose header it had zeroed on the first
pass. A chain of two packets or more thus had no interface, and a change of
input interface went unnoticed: the TLS receive tag stayed on the old interface
until a later append of one packet.
Read it from the packet being demoted, as the decrypted mark is.
Fixes: fe8c78f0d202 ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60758
(cherry picked from commit c9599b80015a50e66c907dc667334a53bc234dab)
sendfile: Fix bug when using headers with SW KTLS offload
When using SW KTLS, we must account for the headers in sf_iodone()
in terms of either freeing or enqueuing them for TLS work.
Not doing so can lead to a situation where we enqueue only
the payload, and not the header, for encryption. Rather than
leaking the header, the socket is left "hung" with the header marked
M_NOTREADY.
Sponsored by: Netflix
Reviewed by: glebius, kib
Differential Revision: https://reviews.freebsd.org/D57134
(cherry picked from commit fd9af1e7084c550358d9598407f9ee7583e6a53f)
iwn: fix TX QoS AC -> TID mapping for A-MPDU selection
Map the packet QoS value to a TID before looking it up in the
per node + TID AMPDU state array.
The TX A-MPDU state used to be per-AC, but I changed it to be
per-TID because it /is/ negotiated per-TID. However this is
not aligned correctly and A-MPDU on eg the voice queue would
cause a mismatch and thus packets to get dropped.
(TIDs 8..15 are special and session based, not traffic QoS based.)
I noticed this because "ssh host" failed after a while, but
"telnet host 22" succeeded. It turned out that frames weren't
making it to the driver transmit path and I traced it
back to being dropped here. Traffic worked for a while until
A-MPDU TX was negotiated, and then all traffic on a TID
would fail until the 802.11 association was re-established.
[7 lines not shown]
