ena: Fix RSS sysctl panic when the RSS table is destroyed
ena_set_io_queue_count() destroys the ena-com RSS state but left
ENA_FLAG_RSS_ACTIVE set. The RSS sysctl handlers gate on that flag, so
they ran against state that was gone.
This causes 2 types of issues:
1. Kernel panic when reading dev.ena.0.rss.key or writing to
dev.ena.0.rss.indir_table
2. Returning a stale cached RSS table when reading
dev.ena.0.rss.indir_table, or a bogus 1 when reading
dev.ena.0.rss.indir_table_size
ena_set_io_queue_count() is called in 2 cases:
1. The io_queues_nb sysctl.
2. Device restore when the device comes back with fewer MSI-X vectors
than before.
Clear ENA_FLAG_RSS_ACTIVE when the RSS table is destroyed. The handlers
[12 lines not shown]
ena: Update driver version to v2.8.6
Bug Fixes:
* Revert "Reinit RSS components during queue count change flow"
* Fix RSS sysctl panic when the RSS table is destroyed
* Set ENA_FLAG_RSS_ACTIVE only when RSS is really configured
Reviewed by: cperciva
MFC after: 3 days
Sponsored by: Amazon, Inc.
Differential Revision: https://reviews.freebsd.org/D61059
Revert "ena: Reinit RSS components during queue count change flow"
This reverts commit 2a27dd0076c5.
Changing the IO queue count destroys the RSS table, and if this is done
while the device is down a new table is not rebuilt until the next
ena_up(). That leaves 2 problems in the meantime:
1. A stale copy of the destroyed table is still returned via sysctl.
2. Reading the destroyed key, or writing the table, panics.
That commit addressed 1 by creating a new RSS table, so that sysctl
returns a fresh default table with the new number of queues. It did not
set out to fix 2, but the rebuild hid it by accident.
The rebuilt table is the default round-robin one, wired to no queues and
unusable: a write still fails, because programming the device needs the
IO queues that only exist after ena_up(). ena_up() builds that same
table anyway.
[10 lines not shown]
ena: Set ENA_FLAG_RSS_ACTIVE only when RSS is really configured
If the device does not report support for the RSS indirection table,
ena_rss_init_default() destroys the RSS state and returns EOPNOTSUPP.
ena_rss_configure() treats EOPNOTSUPP as success and returns 0, and
ena_up_complete() sets ENA_FLAG_RSS_ACTIVE on any 0 return.
Reading dev.ena.N.rss.key at this point causes kernel panic.
Every current device reports the indirection table, so reaching this
needs a device that is broken or misreporting.
The SYSINIT removed by a6205766b300 called ena_rss_init_default()
directly, saw the EOPNOTSUPP and cleared the flag. Routing the decision
through ena_rss_configure(), which hides EOPNOTSUPP, lost that.
Move the flag set into ena_rss_configure(), which can see whether a
table exists, and clear it when tbl_log_size is 0.
Reviewed by: cperciva
[4 lines not shown]
igc: Count packets dropped for want of a receive descriptor
When a receive ring is full the hardware drops the packet and counts it
in RQDPC, a per-queue register the driver never read. Such drops were
invisible: MPC counts packet buffer overflows, not descriptor
exhaustion, so an overloaded queue lost packets with nothing to show for
it. With several receive queues this is the common overload signature,
since RSS loads the queues unevenly and one saturated queue drops while
the others idle.
Read RQDPC for each queue with the other statistics and account the
drops per queue as dev.igc.N.queue_rx_M.rx_drops and in total as the
interface's input queue drop counter (netstat -d, Idrop), as ixgbe does
with QPRDC. Write the register back to zero after reading; the I210
documents it as read/write rather than read-to-clear.
Reviewed by: kbowling
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61004
vmm: Skip TMR rebuilds for edge-to-edge IOAPIC writes
IOAPIC redirection-table writes rendezvous all active vCPUs to
rebuild their vlapic trigger-mode registers when fields other than
mask or polarity change. Retargeting an edge-triggered pin incurs
this cost even though it does not contribute to the TMR.
vioapic_update_tmr() rebuilds the TMR from level-triggered entries
only. Skip the rendezvous when the modified entry is edge-triggered
both before and after the write. Check the old and new trigger modes
so that edge-to-level and level-to-edge transitions still rebuild
the TMR. Retain the existing all-vCPU rebuild path, mask/polarity
exclusions and remote-IRR handling.
Reported by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: Wanpeng Qian <wanpengqian at gmail.com>, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60721
vmm: Add a bulk TMR reset hook for Intel APICv
vioapic_update_tmr() resets all 256 vectors before rebuilding the
level-triggered vector set. With Intel virtual interrupt delivery,
each per-vector reset loads the VMCS, reads and writes an EOI-exit
bitmap, and clears the VMCS.
Add an optional bulk-reset hook so VMX can clear the four EOI-exit
bitmaps with one VMCS load/clear pair. Clear the software TMR banks
directly when using the hook, and retain the per-vector fallback
for backends without it.
Reviewed by: markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60692
snd_hdsp: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
This mirrors the corresponding snd_hdspe change.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58373
snd_hdsp: Use busdma for DMA buffers
Program DMA buffer registers with the bus addresses returned by busdma.
Require one full-size contiguous DMA segment per direction and validate
its alignment and 32-bit address range.
Synchronize buffer ownership around playback, capture, clearing, and
teardown. Disable channels before clearing their DMA buffers, and unwind
partially allocated resources on failure.
This mirrors snd_hdspe's DMA handling, adapted to HDSP's single base
address per direction.
MFC after: 3 days
Sponsored by: BBOX.io
pf: allows TCP RST packets in the backwards window if ACK matches
TCP reset packets are generated for the sequence numbers that have
been acknowledged. Our pf(4) is quite strict regarding sequence
numbers of reset packets to avoid evil connection drops. It expected
exact match and did not allow a sequence window for resets. As pf
tracks neither gaps in the sequence space nor the acknowledged data,
it does not know where exactly the reset is expected by the TCP
stack.
Problem was that legit reset packets before a gap but not at the
highest sequence numbers were blocked by pf. Solution is to fix
pf_tcp_track_full(). Now it allows sequence number windows if the
packet has ACK+RST flags set and the acknowlege number matches
perfectly. This still prevents reset number guessing by an attacker.
Curiously the TCP stack behaves correctly and accepts only resets
before the gap. pf only allowed resets after the final data. So
any reset was ignored by the system. When the other side processed
[9 lines not shown]
snd_hdspe: Use busdma for DMA buffers
Program DMA pages from busdma segments and synchronize buffer ownership.
Unwind partially allocated resources on failure.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58372
lacp: fix lacp for interfaces with unknown media
Fall back to if_baudrate if ifmedia_baudrate() returns 0 in
lacp_aggregator_bandwidth().
When lacp_aggregator_bandwidth() returns 0, lacp will
never come up, due to aggregator selection starting with a 0.
This is why its important for interfaces with unknown media
(meaning ifmedia_baudrate() returns 0) to fall back to
using if_baudrate in order to avoid this state.
Differential Revision: https://reviews.freebsd.org/D61084
Reviewed by: kbowling
Sponsored by: Netflix
snd_hdsp: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Keep the pointer reset and the HDSP 9632 frequency rewrite in the same
critical section as the latency update.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Preserve resize error handling so
that a failed resize leaves the hardware unchanged.
This mirrors the locking in snd_hdspe.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Keep the resize ahead of the latency
register update so that a failed resize leaves the hardware unchanged.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58371
netinet6: Fix ND link-layer address option layout for IPoIB (stable/15)
RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero octets,
then the 20-octet IPoIB link-layer address. The ND code assumed the Ethernet
layout (RFC 4861, section 4.6.1) everywhere and read/wrote the address directly
after the option header, i.e. two octets early. The option-length sanity check
computes 24 for both layouts for a 20-octet address, so the mismatch was silent.
Against a conformant peer (e.g. Linux) this broke IPv6 over IPoIB in both
directions: the address parsed from a received NS/NA option was shifted by two
bytes, so the cached link-layer address embedded a GID that does not exist on
the fabric and replies were sent nowhere, and the options we built carried our
address at the wrong offset for the peer. IPv4/ARP was unaffected. This blocked
everything IPv6 over IPoIB against Linux, including rdma_cm's IP-to-GID
resolution and therefore NFS-over-RDMA-over-InfiniBand with IPv6.
Add nd6_lladdr_opt_pad(), the analog of Linux's ndisc_addr_option_pad(): the
number of reserved octets between the option header and the address (2 for
[19 lines not shown]
nfs_nfsdstate.c: Partial revert of 64857418bb23
Dropping the cached reply that is too large causes
a correctness problem that is too difficult to fix,
so revert this and leave it the way it was.
Although there is an argument that not doing could
cause resource exhaustion, it has not been reported
in the field as a problem.
MFC after: 1 month
pfctl: err(3) family functions should not be used with trailing \n
Obtained from: OpenBSD, deraadt <deraadt at openbsd.org>, 3c04d8eee2
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling
- ensure the anchor name is always 0-terminated
strlcpy() won't overflow, but will walk off the end of the provided
buffer looking for a 0.
- don't overwrite the pf_begin()/... return value with the copyout()
return value
- stop on the first copyout() error
Fixes: 2636cc0414fd (pf: have DIOCXBEGIN/DIOCXROLLBACK/DIOCXCOMMIT use the new functions, 2026-10-27)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pfsync: improve underflow check
We checked the state's expiry time to make sure it was large enough to
not underflow if we subtracted the already expired time from the remote
end, but we failed to account for the state's expiry time being in
miliseconds and the pfsync time delta being in seconds.
Take that multiplication by 1000 into account.
Fixes: 78b620b781b0 (pfsync: avoid underflow on different timeouts, 2026-10-21)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
if_pfsync: fix mbuf leaks on errors
Some of the pfsync input handlers freed the mbuf on errors, others did
not. Unify this by having the caller free the mbuf on error.
Fixes: c6a520af95b2 (pfsync: improve handling of large packets, 2026-10-30)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: don't leak transaction elements on error
If nlmsg_reply() or nlmsg_end() in pf_handle_trans() failed we did not
call pf_trans_free(), leaking the pf_trans_e elements in it.
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
hastd: Remove pidfile on exit
Make hastd remove its pidfile before exit after catching a signal or a
stop control message, not just on failure to start.
MFC after: 1 week
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D60192
tarfs: Fix length calculation for file read
When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60904
tarfs: Limit file name length
When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.
Reported by: n0ps1ed
Reported by: Franz Bettag <franz at bett.ag>
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60903
libfetch: Apply timeout to SSL handshake
When the SSL handshake cannot proceed because the server is slow to
respond, poll() with a timeout instead of spinning.
MFC after: 1 week
PR: 298962
Event: Oslo Hackathon 2026
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60975
