udp6: make udp6_ctlinput() same as IPv4 version
Processing an incoming ICMPv6 we need to find just the matching inpcb and
call udp_notify() on it.
The call to in6_pcbnotify() at the first glance seems like a notifying
sweep across the entire database, but it is not. It finds just the
matching inpcb, but does that in the most inefficient way! The added test
case proves that ICMPv6 processing stays the same before and after the
change. This weird use of in6_pcbnotify() can be tracked down all the way
to the initial KAME code.
Reviewed by: tuexen, gallatin
Differential Revision: https://reviews.freebsd.org/D60967
tests/sys/file: add tests for the lowest fd after fork
fdcopy() skips plain kqueues and close-on-fork descriptors when it
copies the table into the child. Check that dup(2) in the child still
returns the lowest unused descriptor, both when the skipped descriptor
is the lowest free slot and when it sits above an existing hole.
Test cases:
kqueue_no_hole a plain kqueue is the lowest descriptor; the
child's dup() reuses its slot
kqueue_two two adjacent plain kqueues; the child's dup()
returns the lower one
kqueue_above_hole a plain kqueue sits above a closed descriptor;
the child's dup() returns the hole
kqueue_cponfork a KQUEUE_CPONFORK kqueue is copied; the child's
dup() returns the next slot
clofork_no_hole an O_CLOFORK descriptor is the lowest one; the
child's dup() reuses its slot
[12 lines not shown]
bhyve/riscv: correctly handle empty masks and broadcast in SBI IPI/RFNC
Bhyve treats an empty cpu set as an error which triggers MPASS panic in
the guest. As per the SBI spec, empty masks should return SBI_SUCCESS,
and a base of -1UL specifies a broadcast to all harts. Fix both in
vmm_sbi.c, clear a1 on return, and skip the SBI ecall in
sbi_ipi_pic_ipi_send() if the mask is empty. Also add a NULL check in
riscv_send_ipi().
Signed-off-by: Doongar Singh <doonbsd at gmail.com>
Reviewed by: br
Differential Revision: https://reviews.freebsd.org/D61126
vtnet: Accept VIRTIO_NET_F_CTRL_RX_EXTRA
Although the driver does not issue the extra receive-mode commands
accepting the feature is harmless and some devices, notably Apple's
Virtualization.framework, offer their control-queue features as a
group and refuse FEATURES_OK unless the whole set is acknowledged.
Signed-off-by: Faraz Vahedi <kfv at kfv.io>
Reviewed by: adrian
Pull Request: https://github.com/freebsd/freebsd-src/pull/2322
(cherry picked from commit d4ddf8eaee9371d1d20bfb753237f25505d6afee)
vtnet: Implement VIRTIO_NET_F_GUEST_ANNOUNCE
When the device sets VIRTIO_NET_S_ANNOUNCE in the config status
field, for example after a VM migrates to a new host, announce
the interface's presence on the network so peers and switches
learn the new attachment point, then acknowledge the request
with the VIRTIO_NET_CTRL_ANNOUNCE_ACK control command, as per
VirtIO v1.3, 5.1.6.5.4.
The announcement raises iflladdr_event: the stack sends gratuitous
ARPs and unsolicited neighbor advertisements for the interface's
addresses, and stacked interfaces such as vlan(4) propagate the
event and announce theirs as well. The event handlers may sleep,
so the work is deferred from the config change interrupt to a task
on taskqueue_thread; that context also allows the acknowledgement
to be skipped safely if the interface was stopped in the meantime,
in which case the device keeps the bit set and the request is
re-delivered with the next config change interrupt.
[5 lines not shown]
netinet6: Use memcpy/memset/memcmp for consistency
Convert the remaining bzero()/bcopy()/bcmp() calls in the neighbor
discovery handlers to memset()/memcpy()/memcmp().
No functional change intended.
Reviewed by: glebius, pouria
Sponsored by: VersatusHPC
Differential Revision: https://reviews.freebsd.org/D58177
jail: return a new descriptor from jail_get(JAIL_USE_DESC | JAIL_GET_DESC)
Prior to this change, `jail_get` when called with `JAIL_USE|JAIL_GET_DESC`
would fail to return a valid descriptor in the positive case because the
`JAIL_USE_DESC` block jumped to `found_prison` before the descriptor was
allocated. This resulted in the returned jail descriptor always being -1,
despite the call being successful.
This change fixes the logic so `jfd_out` is properly initialized in the
aforementioned scenario.
MFC after: 3 days
Reviewed by: jamie, ngie, adrian
Differential Revision: https://reviews.freebsd.org/D60984
ena: Fix RSS sysctl panic when the RSS table is destroyed
ena_set_io_queue_count() destroys the ena-com RSS state but left
ENA_FLAG_RSS_ACTIVE set. The RSS sysctl handlers gate on that flag, so
they ran against state that was gone.
This causes 2 types of issues:
1. Kernel panic when reading dev.ena.0.rss.key or writing to
dev.ena.0.rss.indir_table
2. Returning a stale cached RSS table when reading
dev.ena.0.rss.indir_table, or a bogus 1 when reading
dev.ena.0.rss.indir_table_size
ena_set_io_queue_count() is called in 2 cases:
1. The io_queues_nb sysctl.
2. Device restore when the device comes back with fewer MSI-X vectors
than before.
Clear ENA_FLAG_RSS_ACTIVE when the RSS table is destroyed. The handlers
[12 lines not shown]
ena: Update driver version to v2.8.6
Bug Fixes:
* Revert "Reinit RSS components during queue count change flow"
* Fix RSS sysctl panic when the RSS table is destroyed
* Set ENA_FLAG_RSS_ACTIVE only when RSS is really configured
Reviewed by: cperciva
MFC after: 3 days
Sponsored by: Amazon, Inc.
Differential Revision: https://reviews.freebsd.org/D61059
Revert "ena: Reinit RSS components during queue count change flow"
This reverts commit 2a27dd0076c5.
Changing the IO queue count destroys the RSS table, and if this is done
while the device is down a new table is not rebuilt until the next
ena_up(). That leaves 2 problems in the meantime:
1. A stale copy of the destroyed table is still returned via sysctl.
2. Reading the destroyed key, or writing the table, panics.
That commit addressed 1 by creating a new RSS table, so that sysctl
returns a fresh default table with the new number of queues. It did not
set out to fix 2, but the rebuild hid it by accident.
The rebuilt table is the default round-robin one, wired to no queues and
unusable: a write still fails, because programming the device needs the
IO queues that only exist after ena_up(). ena_up() builds that same
table anyway.
[10 lines not shown]
ena: Set ENA_FLAG_RSS_ACTIVE only when RSS is really configured
If the device does not report support for the RSS indirection table,
ena_rss_init_default() destroys the RSS state and returns EOPNOTSUPP.
ena_rss_configure() treats EOPNOTSUPP as success and returns 0, and
ena_up_complete() sets ENA_FLAG_RSS_ACTIVE on any 0 return.
Reading dev.ena.N.rss.key at this point causes kernel panic.
Every current device reports the indirection table, so reaching this
needs a device that is broken or misreporting.
The SYSINIT removed by a6205766b300 called ena_rss_init_default()
directly, saw the EOPNOTSUPP and cleared the flag. Routing the decision
through ena_rss_configure(), which hides EOPNOTSUPP, lost that.
Move the flag set into ena_rss_configure(), which can see whether a
table exists, and clear it when tbl_log_size is 0.
Reviewed by: cperciva
[4 lines not shown]
igc: Count packets dropped for want of a receive descriptor
When a receive ring is full the hardware drops the packet and counts it
in RQDPC, a per-queue register the driver never read. Such drops were
invisible: MPC counts packet buffer overflows, not descriptor
exhaustion, so an overloaded queue lost packets with nothing to show for
it. With several receive queues this is the common overload signature,
since RSS loads the queues unevenly and one saturated queue drops while
the others idle.
Read RQDPC for each queue with the other statistics and account the
drops per queue as dev.igc.N.queue_rx_M.rx_drops and in total as the
interface's input queue drop counter (netstat -d, Idrop), as ixgbe does
with QPRDC. Write the register back to zero after reading; the I210
documents it as read/write rather than read-to-clear.
Reviewed by: kbowling
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61004
vmm: Skip TMR rebuilds for edge-to-edge IOAPIC writes
IOAPIC redirection-table writes rendezvous all active vCPUs to
rebuild their vlapic trigger-mode registers when fields other than
mask or polarity change. Retargeting an edge-triggered pin incurs
this cost even though it does not contribute to the TMR.
vioapic_update_tmr() rebuilds the TMR from level-triggered entries
only. Skip the rendezvous when the modified entry is edge-triggered
both before and after the write. Check the old and new trigger modes
so that edge-to-level and level-to-edge transitions still rebuild
the TMR. Retain the existing all-vCPU rebuild path, mask/polarity
exclusions and remote-IRR handling.
Reported by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: Wanpeng Qian <wanpengqian at gmail.com>, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60721
vmm: Add a bulk TMR reset hook for Intel APICv
vioapic_update_tmr() resets all 256 vectors before rebuilding the
level-triggered vector set. With Intel virtual interrupt delivery,
each per-vector reset loads the VMCS, reads and writes an EOI-exit
bitmap, and clears the VMCS.
Add an optional bulk-reset hook so VMX can clear the four EOI-exit
bitmaps with one VMCS load/clear pair. Clear the software TMR banks
directly when using the hook, and retain the per-vector fallback
for backends without it.
Reviewed by: markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60692
snd_hdsp: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
This mirrors the corresponding snd_hdspe change.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Use saved resource IDs on detach
Release resources with the IDs used to allocate them.
Rename irqid to rid to reflect that it stores a resource ID.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58373
snd_hdsp: Use busdma for DMA buffers
Program DMA buffer registers with the bus addresses returned by busdma.
Require one full-size contiguous DMA segment per direction and validate
its alignment and 32-bit address range.
Synchronize buffer ownership around playback, capture, clearing, and
teardown. Disable channels before clearing their DMA buffers, and unwind
partially allocated resources on failure.
This mirrors snd_hdspe's DMA handling, adapted to HDSP's single base
address per direction.
MFC after: 3 days
Sponsored by: BBOX.io
pf: allows TCP RST packets in the backwards window if ACK matches
TCP reset packets are generated for the sequence numbers that have
been acknowledged. Our pf(4) is quite strict regarding sequence
numbers of reset packets to avoid evil connection drops. It expected
exact match and did not allow a sequence window for resets. As pf
tracks neither gaps in the sequence space nor the acknowledged data,
it does not know where exactly the reset is expected by the TCP
stack.
Problem was that legit reset packets before a gap but not at the
highest sequence numbers were blocked by pf. Solution is to fix
pf_tcp_track_full(). Now it allows sequence number windows if the
packet has ACK+RST flags set and the acknowlege number matches
perfectly. This still prevents reset number guessing by an attacker.
Curiously the TCP stack behaves correctly and accepts only resets
before the gap. pf only allowed resets after the final data. So
any reset was ignored by the system. When the other side processed
[9 lines not shown]
snd_hdspe: Use busdma for DMA buffers
Program DMA pages from busdma segments and synchronize buffer ownership.
Unwind partially allocated resources on failure.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58372
lacp: fix lacp for interfaces with unknown media
Fall back to if_baudrate if ifmedia_baudrate() returns 0 in
lacp_aggregator_bandwidth().
When lacp_aggregator_bandwidth() returns 0, lacp will
never come up, due to aggregator selection starting with a 0.
This is why its important for interfaces with unknown media
(meaning ifmedia_baudrate() returns 0) to fall back to
using if_baudrate in order to avoid this state.
Differential Revision: https://reviews.freebsd.org/D61084
Reviewed by: kbowling
Sponsored by: Netflix
snd_hdsp: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Keep the pointer reset and the HDSP 9632 frequency rewrite in the same
critical section as the latency update.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Preserve resize error handling so
that a failed resize leaves the hardware unchanged.
This mirrors the locking in snd_hdspe.
MFC after: 3 days
Sponsored by: BBOX.io
snd_hdspe: Serialize rate and latency updates
Protect running-state checks and register updates with the softc lock.
Drop the lock around sndbuf_resize(), which may sleep, and recheck the
running state after reacquiring it. Keep the resize ahead of the latency
register update so that a failed resize leaves the hardware unchanged.
Reviewed by: br
MFC after: 3 days
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58371
netinet6: Fix ND link-layer address option layout for IPoIB (stable/15)
RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero octets,
then the 20-octet IPoIB link-layer address. The ND code assumed the Ethernet
layout (RFC 4861, section 4.6.1) everywhere and read/wrote the address directly
after the option header, i.e. two octets early. The option-length sanity check
computes 24 for both layouts for a 20-octet address, so the mismatch was silent.
Against a conformant peer (e.g. Linux) this broke IPv6 over IPoIB in both
directions: the address parsed from a received NS/NA option was shifted by two
bytes, so the cached link-layer address embedded a GID that does not exist on
the fabric and replies were sent nowhere, and the options we built carried our
address at the wrong offset for the peer. IPv4/ARP was unaffected. This blocked
everything IPv6 over IPoIB against Linux, including rdma_cm's IP-to-GID
resolution and therefore NFS-over-RDMA-over-InfiniBand with IPv6.
Add nd6_lladdr_opt_pad(), the analog of Linux's ndisc_addr_option_pad(): the
number of reserved octets between the option header and the address (2 for
[19 lines not shown]
nfs_nfsdstate.c: Partial revert of 64857418bb23
Dropping the cached reply that is too large causes
a correctness problem that is too difficult to fix,
so revert this and leave it the way it was.
Although there is an argument that not doing could
cause resource exhaustion, it has not been reported
in the field as a problem.
MFC after: 1 month
pfctl: err(3) family functions should not be used with trailing \n
Obtained from: OpenBSD, deraadt <deraadt at openbsd.org>, 3c04d8eee2
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling
- ensure the anchor name is always 0-terminated
strlcpy() won't overflow, but will walk off the end of the provided
buffer looking for a 0.
- don't overwrite the pf_begin()/... return value with the copyout()
return value
- stop on the first copyout() error
Fixes: 2636cc0414fd (pf: have DIOCXBEGIN/DIOCXROLLBACK/DIOCXCOMMIT use the new functions, 2026-10-27)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pfsync: improve underflow check
We checked the state's expiry time to make sure it was large enough to
not underflow if we subtracted the already expired time from the remote
end, but we failed to account for the state's expiry time being in
miliseconds and the pfsync time delta being in seconds.
Take that multiplication by 1000 into account.
Fixes: 78b620b781b0 (pfsync: avoid underflow on different timeouts, 2026-10-21)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
