iflib: Do not pull up trailing IPv4 fragments to the L4 header
iflib_parse_header() pulls every IPv4 packet up to the end of the TCP or
UDP header, including fragments at a non-zero offset, which carry no L4
header at all. A trailing fragment shorter than that header (1-7 bytes
of UDP, 1-19 bytes of TCP) makes m_pullup() fail and the frame is freed
without a trace in the interface counters.
Only parse the L4 header on the first fragment. TSO never produces
fragments, so assert that.
With a 1500-byte MTU every UDP datagram of 1473-1479 bytes is lost
behind a forwarding host whose ingress NIC sets receive checksum flags,
or on any VLAN with hardware tagging. SIP over UDP is a common victim.
Reported by: Alex Roberts
Reviewed by: gallatin
Fixes: c224b2ce7de0 ("iflib: don't pullup UDP payloads to the TCP header size")
See also: https://redmine.pfsense.org/issues/17196
[2 lines not shown]
sockstat: improve consistency
Include the entries of the BBLOG STATE column in the computation
of the column width as done also for other columns.
Also set first to falso only when needed.
Sponsored by: Netflix, Inc.
(cherry picked from commit 732c8d2a1a0e169bad1c02b1e54a4306861bde4a)
sockstat: improve consistency
Include the entries of the BBLOG STATE column in the computation
of the column width as done also for other columns.
Also set first to falso only when needed.
Sponsored by: Netflix, Inc.
(cherry picked from commit 732c8d2a1a0e169bad1c02b1e54a4306861bde4a)
ice(4): Fix link bringup on driver load
Patch adding Total Port Shutdown support incorrectly
handled a case when this feature was not enabled in the NVM.
When TPS bit is not set driver should apply link configuration
according to user settings and update the status. Those steps
were mistakenly omitted, while the state flag was still set
to prevent link renegotation and status update on first
attempt to bring interface up with ifconfig.
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Reported by: kbowling
Reviewed by: kbowling
Fixes: 0011cd9f8863 ("ice(4): Support Total Port Shutdown on E830 devices")
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D59578
(cherry picked from commit dcb84ddcfe89d358a66cffb45196e6b45b45502c)
ice(4): Support Total Port Shutdown on E830 devices
When 'Permit Total Port Shutdown' feature in BIOS is enabled then Port
Disable bit is set in the Link Default Override Mask TLV PFA module
in the NVM. In this mode, the driver acts as if the link_active_on_if_down
flag is always disabled and disallow any change to that flag.
This feature applies for E830 and E835 NIC series.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D58149
(cherry picked from commit 0011cd9f8863fce3743bfd9920b7924162bb6410)
sctp: improve locking validation
Ensure that the TCB lock is hold in sctp_calc_rwnd().
Reviewed by: tuexen
(cherry picked from commit 38479a4832789c239eb1ff097ee51e93e8084315)
sctp: hold tcp lock when calling sctp_calc_rwnd()
This was done in all code paths except one. Fix this to avoid
race conditions.
Reported by: syzbot+2e2dc35c0e24a74663a7 at syzkaller.appspotmail.com
Reviewed by: tuexen
(cherry picked from commit 429f2fb48b92011d07798e681d96aa628fd8e387)
sysctl: don't loop when EAGAIN is returned
When userland_sysctl() experiences EAGAIN, don't loop internally but
leave retrying to the caller.
Looping was a problem in case of using tcpsso(8) to switch a TCP stack
where the acceptance check of the new TCP stack results in EAGAIN.
Reviewed by: kib, glebius
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D60444
(cherry picked from commit d39b12e9030b20410cecbcbb0c22847d7f8b5471)
ixl(4): Fix NVM update API
Driver provides an interface for tools operating on adapters'
Non-Volatile Memory using SIOC(G|S)DRVSPEC ioctls. It allows
tools to issue Admin Queue commands to the firmware, which
may return an error code encoded as a negative integer.
The driver passed this negative integer as the return value
of the ioctl handler. This was causing issues because the FreeBSD
kernel reserves negative error codes in system calls for special
purposes such as restarting the handler or detecting incorrect
behavior in VFS operations. Simple remapping of negative values
to positive integers caused currently available tools to misbehave
and could break the NVM update process. Introduce a new API version,
which allows new versions of tools to detect the fixed driver.
Temporarily keep the old API, but issue a warning that tools need
to be updated.
Also refactor the code to use centralized cleanup and move the
debug message from the firmware earlier to make sure it is not masked
[9 lines not shown]
tcp md5: improve consistency
All other usages of SCF_SIGNATURE are protected by IPSEC_SUPPORT
or TCP_SIGNATURE.
No functional change intended.
Reported by: Hannes Elfert
(cherry picked from commit 74d330943b572a6f17f45b7c9c2035bde2956380)
tcp md5: fix accounting of ACK with bad signatures
When processing the ACK of the initial TCP handshake using the
SYN cookie, don't increment the counter for unexpected
signatures (tcps_sig_err_sigopt). The correct
counter (tcps_sig_rcvbadsig) for bad signatures is already
incremented in TCPMD5_INPUT().
Reported by: Hannes Elfert
Reviewed by: rscheff
Differential Revision: https://reviews.freebsd.org/D59302
(cherry picked from commit 2fb53436cd05f65164d166ef3ab33660fe451470)
tcp md5: fix accounting for SYN segments with unexpected signature
When receiving a SYN segment with an MD5 option on a listening socket,
which has not enabled TCP MD5 support, increment the counter for
unexpected signatures (tcps_sig_err_sigopt).
Reviewed by: rscheff
Differential Revision: https://reviews.freebsd.org/D59303
(cherry picked from commit 5d3e31df7c4fc0e53168bac717bed5f94dab7068)
tcp md5: improve handling of tcps_sig_err_sigopt counter
For non listening TCP endpoints, increment the tcps_sig_err_sigopt
counter when TCP MD5 is not enabled in the TCP connection, but a
segment containing a TCP MD5 option is received.
Also increment the counter when using the RACK or BBR stack.
Reported by: Hannes Elfert
Reviewed by: rrs
Differential Revision: https://reviews.freebsd.org/D59249
(cherry picked from commit c6ae11c1b0d96fd2ed0b55c655ff58a46b26ddcb)
inpcb: add single peer local port caching
A typical caching proxy problem is port allocation to backends. We
usually have a few of them, with thousands connections to each. Upon
creation of a new connection we need to find a new unique local port for
the peer:port. This is achieved by linear search in in_pcb_lport_dest().
The closer we get to the port exhaustion the more expensive this loop is.
It needs to be executed tens thousands of times to find a port or fail.
Address the problem by adding advisory negative cache that is lazily
allocated upon first conflict. Once the cache is in action we skip trying
those ports that are already marked in the cache. During the search we
may encounter a cache allocated by other lookup. In this case the caches
are merged into one. The expectation is that under a stable heavy load we
are going to stabilize at a very low number of allocated caches, ideally
one per peer:port. The cache is a bitset of IPPORT_MAX, which makes it 8k.
Unfortunately metadata pushes allocation size to 16k UMA bucket. However,
the expectation is that we are going to have a very few allocated, thus
current decision is to not create a separate UMA zone.
[2 lines not shown]
tcp: minor cleanup
Several cleanups in tcp_input_with_port():
* Don't assign m twice.
* Don't reassign pointers without having done pullup().
* While there, change the type of isipv6 to bool, since it is used
that way.
No functional change intended.
Reported by: Hannes Elfert
Reviewed by: pouria, Timo Völker, Nick Banks
Differential Revision: https://reviews.freebsd.org/D59142
(cherry picked from commit 191dad334c646457c012d0d0963505a2f2d73a98)
tcp: cleanup whitespaces
Use tabs consistently in #defines
No functional change intended.
Reported by: Hannes Elfert
(cherry picked from commit 74019bc3ea91f7a1dfd36acbc1627f3d00ca002f)
sockstat: improve consistency
Include the entries of the BBLOG STATE column in the computation
of the column width as done also for other columns.
Also set first to falso only when needed.
Sponsored by: Netflix, Inc.
(cherry picked from commit 732c8d2a1a0e169bad1c02b1e54a4306861bde4a)
epair: allow disabling receive checksum offloading
Allow disabling RXCSUM and RXCSUM6 on an epair interface. If disabled,
epair unsets the mbuf flags that indicate a valid checksum when
transferring a packet from one epair end to the other. This gives a
user in a jail the power to control whether the user wants to use the
result of a previous validation (by a physical interface) or not.
Reviewed by: kp, tuexen
Differential Revision: https://reviews.freebsd.org/D58786
(cherry picked from commit f343f036c780cfd8e7f243b7708d96b006a257d7)
kernel: Use external retpoline thunks
External retpoline thunks for amd64 and i386 were added in commit
74d971fe1561 ("x86: Add external retpoline thunk"). Use them when
WITH_KERNEL_RETPOLINE is set.
There should not be any material performance impact -- the call sites
are identical, and this just replaces (on amd64) compiler-generated
__llvm_retpoline_r11 functions in each object with our
__x86_indirect_thunk_r11.
After this change we could implement boot-time patching, replacing
__x86_indirect_thunk_r11 with just jmp %r11 when retpoline is not
required.
Note on i386: An i386 build WITH_KERNEL_RETPOLINE was successful, but
has not been extensively tested. Clang may use registers other than
just eax on i386 and so in the future additional thunks beyond the one
added in 74d971fe1561 could be required for i386. Patches are welcome
[4 lines not shown]
sctp: initialize inp to avoid uninitialized use
If we take an early goto out_unlocked inp is uninitialized and then
may be used in SCTP_LTRACE_ERR_RET(). Initialize inp to NULL
to avoid warnings.
Found with: gcc15 tinderbox build
Reviewed by: tuexen, pouria
Differential Revision: https://reviews.freebsd.org/D56503
(cherry picked from commit 4cdbcc2b6a2e551529f7133665ef406869b48bf7)
fdt: Support SCMI shared memory under reserved-memory nodes
Add a simplebus-based pseudo-bus that matches the "reserved-memory"
node in the device tree. Update the SCMI shared memory driver so that
it can attach either as a child of mmio_sram or directly under
simplebus (via the new reserved-memory bus). Make the mmio_sram memory
resource shareable so both attachment methods can coexist when required.
MFC after: 1 week
Reviewed by: manu
if_bnxt: add support for HW generic stats
HW generic stats provide information about PCIe transactions and
out-of-order doorbell writes, useful for debug. Allocate a DMA buffer
for them (disabling BNXT_FW_CAP_GENERIC_STATS if the allocation
fails), fetch them via HWRM_STAT_GENERIC_QSTATS once per admin-status
tick on P5+ chips, and expose them to userspace under
dev.bnxt.<unit>.hwstats.generic_stats.* via sysctl.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: Broadcom Inc.
Differential Revision: https://reviews.freebsd.org/D58614
(cherry picked from commit d1619865da1cd4c5b557158b4bbf666e0f7f040b)
if_bnxt: avoid FTQM/STQM pg_info alias on reset
Copying the STQM backing-store context to seed FTQM's also copied
STQM's pg_info pointer verbatim. On cold load STQM's pg_info is still
NULL so this is harmless, but on a firmware reset STQM's pg_info is
already non-NULL, making FTQM alias STQM's backing-store pages. The
allocator then skips FTQM since it looks already allocated, and FTQM
is later indexed as its own array, reading out of bounds into STQM's
buffer and dereferencing a bogus DMA address.
Clear ctxm->pg_info after the memcpy so FTQM always gets its own
backing store.
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: Broadcom Inc.
Differential Revision: https://reviews.freebsd.org/D58615
(cherry picked from commit f2ce672ade231a1e19f1238922a2c3b6fe696e22)
if_bnxt: add support for SIOCGI2CPB page/bank i2c requests
Advertise IFLIB_I2C_PAGE_BANK and forward the requested page/bank to
firmware, so CMIS optics can be read correctly instead of falling
back to bogus legacy SFF-8472 decoding. Also fix bnxt_i2c_req() to
return positive errno values.
Signed-off-by: gallatin
Reviewed by: gallatin
MFC after: 2 weeks
Sponsored by: Broadcom Inc.
Differential Revision: https://reviews.freebsd.org/D59573
(cherry picked from commit fdab50f6f8107c9d825a7e6d92d7a6b89c417bbb)
