snd_hdsp: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
This mirrors the corresponding snd_hdspe change.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58373
snd_hdsp: Use busdma for DMA buffers
Program DMA buffer registers with the bus addresses returned by busdma.
Require one full-size contiguous DMA segment per direction and validate
its alignment and 32-bit address range.
Synchronize buffer ownership around playback, capture, clearing, and
teardown. Disable channels before clearing their DMA buffers, and unwind
partially allocated resources on failure.
This mirrors snd_hdspe's DMA handling, adapted to HDSP's single base
address per direction.
MFC after: 3 days
Sponsored by: BBOX.io
pf: allows TCP RST packets in the backwards window if ACK matches
TCP reset packets are generated for the sequence numbers that have
been acknowledged. Our pf(4) is quite strict regarding sequence
numbers of reset packets to avoid evil connection drops. It expected
exact match and did not allow a sequence window for resets. As pf
tracks neither gaps in the sequence space nor the acknowledged data,
it does not know where exactly the reset is expected by the TCP
stack.
Problem was that legit reset packets before a gap but not at the
highest sequence numbers were blocked by pf. Solution is to fix
pf_tcp_track_full(). Now it allows sequence number windows if the
packet has ACK+RST flags set and the acknowlege number matches
perfectly. This still prevents reset number guessing by an attacker.
Curiously the TCP stack behaves correctly and accepts only resets
before the gap. pf only allowed resets after the final data. So
any reset was ignored by the system. When the other side processed
[9 lines not shown]
snd_hdspe: Use busdma for DMA buffers
Program DMA pages from busdma segments and synchronize buffer ownership.
Unwind partially allocated resources on failure.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58372
lacp: fix lacp for interfaces with unknown media
Fall back to if_baudrate if ifmedia_baudrate() returns 0 in
lacp_aggregator_bandwidth().
When lacp_aggregator_bandwidth() returns 0, lacp will
never come up, due to aggregator selection starting with a 0.
This is why its important for interfaces with unknown media
(meaning ifmedia_baudrate() returns 0) to fall back to
using if_baudrate in order to avoid this state.
Differential Revision: https://reviews.freebsd.org/D61084
Reviewed by: kbowling
Sponsored by: Netflix
snd_hdsp: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Keep the pointer reset and the HDSP 9632 frequency rewrite in the same
critical section as the latency update.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Preserve resize error handling so
that a failed resize leaves the hardware unchanged.
This mirrors the locking in snd_hdspe.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Keep the resize ahead of the latency
register update so that a failed resize leaves the hardware unchanged.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58371
netinet6: Fix ND link-layer address option layout for IPoIB (stable/15)
RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero octets,
then the 20-octet IPoIB link-layer address. The ND code assumed the Ethernet
layout (RFC 4861, section 4.6.1) everywhere and read/wrote the address directly
after the option header, i.e. two octets early. The option-length sanity check
computes 24 for both layouts for a 20-octet address, so the mismatch was silent.
Against a conformant peer (e.g. Linux) this broke IPv6 over IPoIB in both
directions: the address parsed from a received NS/NA option was shifted by two
bytes, so the cached link-layer address embedded a GID that does not exist on
the fabric and replies were sent nowhere, and the options we built carried our
address at the wrong offset for the peer. IPv4/ARP was unaffected. This blocked
everything IPv6 over IPoIB against Linux, including rdma_cm's IP-to-GID
resolution and therefore NFS-over-RDMA-over-InfiniBand with IPv6.
Add nd6_lladdr_opt_pad(), the analog of Linux's ndisc_addr_option_pad(): the
number of reserved octets between the option header and the address (2 for
[19 lines not shown]
nfs_nfsdstate.c: Partial revert of 64857418bb23
Dropping the cached reply that is too large causes
a correctness problem that is too difficult to fix,
so revert this and leave it the way it was.
Although there is an argument that not doing could
cause resource exhaustion, it has not been reported
in the field as a problem.
MFC after: 1 month
pfctl: err(3) family functions should not be used with trailing \n
Obtained from: OpenBSD, deraadt <deraadt at openbsd.org>, 3c04d8eee2
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling
- ensure the anchor name is always 0-terminated
strlcpy() won't overflow, but will walk off the end of the provided
buffer looking for a 0.
- don't overwrite the pf_begin()/... return value with the copyout()
return value
- stop on the first copyout() error
Fixes: 2636cc0414fd (pf: have DIOCXBEGIN/DIOCXROLLBACK/DIOCXCOMMIT use the new functions, 2026-10-27)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pfsync: improve underflow check
We checked the state's expiry time to make sure it was large enough to
not underflow if we subtracted the already expired time from the remote
end, but we failed to account for the state's expiry time being in
miliseconds and the pfsync time delta being in seconds.
Take that multiplication by 1000 into account.
Fixes: 78b620b781b0 (pfsync: avoid underflow on different timeouts, 2026-10-21)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
if_pfsync: fix mbuf leaks on errors
Some of the pfsync input handlers freed the mbuf on errors, others did
not. Unify this by having the caller free the mbuf on error.
Fixes: c6a520af95b2 (pfsync: improve handling of large packets, 2026-10-30)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: don't leak transaction elements on error
If nlmsg_reply() or nlmsg_end() in pf_handle_trans() failed we did not
call pf_trans_free(), leaking the pf_trans_e elements in it.
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
hastd: Remove pidfile on exit
Make hastd remove its pidfile before exit after catching a signal or a
stop control message, not just on failure to start.
MFC after: 1 week
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D60192
tarfs: Fix length calculation for file read
When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60904
tarfs: Limit file name length
When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.
Reported by: n0ps1ed
Reported by: Franz Bettag <franz at bett.ag>
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60903
libfetch: Apply timeout to SSL handshake
When the SSL handshake cannot proceed because the server is slow to
respond, poll() with a timeout instead of spinning.
MFC after: 1 week
PR: 298962
Event: Oslo Hackathon 2026
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60975
riscv: Incoming MSI Controller support.
Support for Incoming Message Signalling Interrupt Controller (IMSIC)
defined by the RISC-V Advanced Interrupt Architecture (AIA) specification.
This is based on early work of Himanshu Chauhan on IMSIC support for
IPI delivery. This change, however, does not include IPI delivery support,
instead it provides MSI support for peripheral devices.
IMSIC is a core-local interrupt controller with non-global interrupts,
which means that interrupt identity is effectively (hart, interrupt ID).
When IMSIC present on hart, APLIC does not trap the CPU directly,
instead it delivers the interrupt to the IMSIC instance associated with
the target hart. Upon reception of interrupt, IMSIC on hart invokes APLIC
for handling. Note that PCIe devices deliver interrupt directly to IMSIC.
Apart from IMSIC support, this includes APLIC changes:
- Obtain the interrupt trigger type from FDT and configure the interrupt
[9 lines not shown]
riscv intc: convert to a bus.
Convert the RISC-V Interrupt Controller (INTC) device to a bus;
try to find and attach Incoming Message Signalling Interrupt Controller
(IMSIC) device.
This allows to establish parent-child relationships between two and
to propagate PIC_INIT_SECONDARY call from the INTC (parent) to the
IMSIC (child).
Reviewed by: mhorne, mmel
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D59813
Revert "snd_hda: Identify AMD Audio Coprocessor"
Apparently this device might need a separate driver altogether.
This reverts commit 8dac0bdb4df0815e14db219e9a7fb5d0be5737b8.
ix(4): Support Total Port Shutdown on E610
Firmware controls the physical link state on E610 adapters, similarly to
X700 and E800 adapters. As a result, running "ifconfig down" does not
disable the physical link unless Total Port Shutdown is enabled.
Read the Link Default Override TLV from NVM to detect when Total
Port Shutdown was enabled for given port in system setup. In that
case, force the link down when the interface is stopped and restore
it during link configuration. Leave link state management unchanged
when the TLV is unavailable or the feature is not enabled.
Co-authored-by: Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Co-authored-by: Tomasz Lichwala <tomasz.lichwala at intel.com>
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Tested by: Mateusz Moga <mateusz.moga at intel.com>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D60643
if_bnxt: skip HW kTLS on old firmware and add a tunable to disable it
Older Thor2 firmware serves key context allocation requests very
slowly, about a second each. The driver allocates key contexts in
batches of 128, so setting up 500k sessions takes roughly 3900
requests and driver load appears to hang.
Enable hardware kTLS only when the firmware's HWRM interface version
is 1.10.3.99 or newer. Keep the full four-part version in
hwrm_spec_code_ext for the comparison.
Also add a disable_hw_ktls loader tunable that turns hardware kTLS off
for a device without unloading kTLS support, which helps isolate kTLS
problems in the field.
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60977
if_bnxt: size MRAV from the AV split entry for backing store V2
On RoCE-capable Thor2, attach fails with
HWRM_FUNC_BACKING_STORE_CFG_V2 returning INVALID_PARAMS, as MRAV is
sized the pre-V2 way and the firmware's AV split value is sent as is.
Size MRAV from the AV split entry, and move the legacy entry-count
packing into bnxt_hwrm_func_backing_store_cfg().
Fixes: d5ce906da7c5 ("bnxt_en: Add backing store V2 support")
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60976
