pf: fix crash on low memory
pfr_create_kentry() can return NULL. Don't dereference the pointer it
returns until after we've checked it.
Fixes: 08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink")
See also: https://redmine.netgate.com/issues/23622
Sponsored by: Rubicon Communications, LLC ("Netgate")
e1000: Serialize 82579 CSR writes with the Management Engine
The 82579 PCIm2PCI arbiter can acknowledge a host MAC CSR write while
the Management Engine is accessing another CSR. The host write can be
lost; subsequent target accesses may no longer be claimed by the MAC and
can hang the system.
For 82579 controllers with valid management firmware, wait for the ME
CSR access indication before every MAC CSR write. Keep the wait bounded
and use DELAY because writes occur in interrupt and datapath contexts.
Verify every transmit and receive tail write. If a tail does not hold
the requested value, disable its datapath direction and request a full
iflib reset.
Keep the ordinary register-write path as a direct MMIO write behind a
predicted per-device gate. Contain the wait and tail recovery in the
82579 slow path rather than adding tail-specific accessors and state to
the rest of the e1000 family.
[11 lines not shown]
ixl: Fix build after VF reset changes
VF_FLAG_INITIALIZED belongs to the SR-IOV status-reporting interface,
which was not merged to stable/15. The VF reset MFCs accidentally kept
two status-only clears without the flag definition or the corresponding
set operation.
Remove the clears rather than pulling the unrelated reporting interface
into stable/15. They do not participate in hardware reset sequencing.
Fixes: d252dd2a841c ("ixl: Rebuild VF resources after a PF reset")
Fixes: 1319574637fb ("ixl: Quiesce VF DMA before a PF reset")
tcp: cleanup whitespaces
Use tabs consistently in #defines
No functional change intended.
Reported by: Hannes Elfert
MFC after: 1 week
MFC to: stable/15
pfsync: handle large MTU pfsync interfaces
pfsync packets were allocated with m_get2(), which can't return packets
larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work.
Use m_get3(), which can allocate sufficiently large mbufs.
Extend the pfsync:bulk test case to provoke this problem.
PR: 297307
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit 7e2781fdcfdbe489cc07572d33dc36bca06a342d)
ipfilter: Fix checksum update for NAT_DIVERTOUT
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
(cherry picked from commit c08a97fa27b914988ef092352872b2f455abb7c3)
EC2: Enable autogrowing filesystems post-boot
Enable the new growfs_postboot mechanism. Note that this also implies
disabling automatic allocation of swap space on the root disk, since we
cannot grow the root filesystem if swap space is allocated after it.
This will not be MFCed since it is a significant behavioural change.
Sponsored by: Amazon
Relnotes: yes
rc+devd: Add growfs_postboot
In VM and cloud environments it is often possible to enlarge virtual
disks; this can be useful, for example, if a system is launched with a
small root disk and it later becomes clear that more space is needed.
On kernels which support run-time resizing of disks (for NVMe, this was
added in November 2025; some other disk types have supported this for
longer) a SIZECHANGE notification is sent to userland via devd.
Add a "nostart" rc.d script (runnable manually but not automatically at
boot time) and a devd script which invokes it when a notification
arrives. The rc.d script enlarges the "final partition" on partitioned
geoms, or the UFS filesystem or zpool device when triggered on a disk
containing either of those.
Reviewed by: imp, ziaee
MFC after: 2 weeks
Relnotes: Disk partitions and filesystems can be enlarged
[4 lines not shown]
dpaa: Add LRO and receive callback batching
Reduce the code executed in the DQRR dequeue loop, and move the
heavy-weight operations to post-dequeue loop.
* Batch if_input() after DQRR dispatch loop completes. Only do the
DQRR_CI_CINH write at the end of the loop, so only up to 16 entries
will be processed.
* Add software LRO per FQ. Each per-CPU RX FQ gets its own LRO tracking
structure.
Since LRO is configured at FQ initialization time, allocate the ifnet
earlier in attach to prevent a panic.
dpaa/fman: KeyGen (Parse-Classify-Distribute) driver
Add sys/dev/dpaa/fman_keygen.[ch]. Public API is four functions:
* fman_kg_init(sc) -- Initialize KeyGen subsystem, clear out any stale
config.
* fman_kg_fini(sc) -- Teardown KeyGen
* fman_kg_alloc_hash_scheme(sc, port, base_fqid, nfqs)
-- Allocate a scheme, program it for
RSS-over-IP-5-tuple hashing to nfqs FQs
starting at base_fqid, bind it to port.
* fman_kg_free_hash_scheme(sc, port)
-- Remove a scheme added by
fman_kg_alloc_hash_scheme().
KeyGen state (bitmap + port->scheme table) is added to the fman softc.
Future work may allow configuring the KG hash inputs, but what we have
now (5-tuple of src/src-port/dst/dst-port/IPSec SPI field) is
sufficient.
dpaa/eth: distribute RX across per-CPU FQs via FMan KeyGen
Grow sc_nrxfqs from 1 to the CPU total, and hash the RX
5-tuple across the range with the KG driver from the prior commit.
Each FQ lands on its own per-CPU QMan channel, so a given core
drains only its own share of RX work and gets frame annotation +
data-head stashed into its cache.
* Add alignment parameter to qman_alloc_fqid_range() to meet KeyGen
requirements.
* Initialize 1 frame queue (FQ) per CPU in dpaa_eth_fm_port_rx_init(),
using a 5-tuple to spread the load across CPUs.
* Channel ownership for TX confirms moved from rx_init/free to
tx_init/free -- sc_rx_channel is now a TX-confirm-only per-port
pool channel.
Fallbacks/degradation:
* If any per-CPU channel is -1 (no portal attached)
the port fails to attach with a clear message.
[4 lines not shown]
dpaa/qman: per-CPU pool channel service + FQID range allocator
Add plumbing for future FMan KeyGen-driven multi-queue RX. Pure
infrastructure; no behavioural change for existing single-FQ
consumers.
qman:
* New qman_percpu_channel(cpu) to get the per-CPU channel, needed for
receive-side scaling.
* New qman_alloc_fqid_range(count, *basep) / qman_free_fqid_range()
reserve a contiguous FQID range so a later KeyGen-distribution
caller can compute FQID = base + (hash & mask) and create each FQ
individually with force_fqid=true (each landing on its own
per-CPU channel).
qman_fq_create:
* Honor the force_fqid / fqid_or_align parameters: when force_fqid is
set, use the caller-supplied FQID and skip the internal vmem_alloc.
The fqids_num != 1 restriction is lifted; qman_fq_list[] now records
[4 lines not shown]
dpaa_eth: refactor RX FQ state into an array (N=1)
Preparation for FMan KeyGen-driven multi-queue RX. Replace the
single sc_rx_fq / sc_rx_fqid pair with a sc_rx_fqs[] array (currently
one entry) and sc_rx_fqid_base. Each entry carries a back-pointer
to the softc for use by the RX callback.
libusb: Validate arguments before dereferencing the hotplug context
libusb_hotplug_register_callback() resolves its context with
GET_CONTEXT() and then immediately reads ctx->no_discovery and
ctx->usb_event_mode, but only checks "ctx == NULL" afterwards.
GET_CONTEXT() falls back to usbi_default_context, which is NULL before
libusb_init() and is reset to NULL by libusb_exit(). An application
that calls libusb_hotplug_register_callback(NULL, ...) without an
initialised default context therefore crashes on the ctx->no_discovery
read, instead of getting the LIBUSB_ERROR_INVALID_PARAM the existing
guard was clearly written to return.
Move the argument validation ahead of the first dereference. None of
the validated arguments depend on the context, so no other ordering
constraint is affected.
Signed-off-by: yuvrajnode <yuvrajsinghrock1221 at gmail.com>
Reviewed by: aokblast
[3 lines not shown]
libusb: Fix NULL dereference when a hotplug callback deregisters itself
libusb_hotplug_register_callback() runs the newly registered callback
over the already-enumerated device list when LIBUSB_HOTPLUG_ENUMERATE
is set. A hotplug callback returning non-zero means "deregister me",
and the enumerate loop honours that by freeing the handle and setting
it to NULL.
Since commit 6bda9f26d2ed changed libusb_hotplug_callback_handle from a
pointer to an int, the tail of the function unconditionally dereferences
that handle, so any caller that passes LIBUSB_HOTPLUG_ENUMERATE, a
non-NULL handle pointer, and a callback that returns non-zero on a
matching device crashes inside libusb. This is a normal usage pattern
and it was safe before the conversion, when the equivalent line simply
stored NULL.
Report the reserved id 0 instead. The allocator hands out ids starting
at 1, and libusb_hotplug_deregister_callback() already ignores 0, so
this restores the pre-conversion behaviour.
[6 lines not shown]
ixgbe: Recognize production X550 PHY IDs
According to Linux 5f1c3589b0f0, the X550 PHY classifier still matches
an alpha silicon ID, while the shared definitions contain the two
production IDs. This can leave production hardware on the generic
probing path and issue unnecessary PHY queries.
(cherry picked from commit 392f0af6685a06e89fecdc38cc2e910d2b84d738)
ixgbe: Preserve the full VF RSS domain in the shared RETA
The 82599 and X540 share the global RSS redirection table between the
PF and its VFs. Programming that table from the PF queue count
prevents a VF from using queue indices absent from the PF layout. A
one-queue PF consequently directs every flow for a two- or four-queue
VF to queue zero.
Program at least four queue indices while SR-IOV is active. Each pool
PSRTYPE.RQPL field masks the shared table to the queue subset available
to that function, so the PF can continue using fewer queues.
(cherry picked from commit 8b668bc7e7c8b0a1bcb018360a4aafa445ff554f)
ixgbe: Add 10GBase-BX BiDi SFP+ module support
10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber. Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.
When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence. Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.
Relnotes: yes
(cherry picked from commit f9ce33b0d8ef233063bd6c27bdba2580f97d9094)
net: Add ifmedia support for 10GBase-BX BiDi
10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber. The optics must be paired so that
the transmit and receive wavelengths cross over.
(cherry picked from commit 4220b52453c9701922955dcc1c1e1554d6a9f3ae)
ixgbe: Expose EEE LPI event counters
X550-family devices provide clear-on-read counters for transmit and
receive Low Power Idle events. Accumulate each register once in the
normal statistics poll and expose the monotonic totals below the eee
sysctl node. Document the counters together with the existing EEE
control.
Obtained from: Intel ix 3.4.39
(cherry picked from commit ff86fd4f36618dacf1628180034c312c70294276)
ixv: Report multigigabit link speeds
The VF link-status path can receive 2.5 and 5 Gb/s speed bits from
X550-family PFs, but media reporting has no cases for them. The
bootverbose message also assumes every non-10-Gb/s link is 1 Gb/s.
Expose the corresponding ifmedia subtypes and derive the diagnostic
speed through the shared link-speed conversion helper.
(cherry picked from commit a884921abbaf52ff862a32ff6806bf071974faa6)
ixgbe: Compare flow control against requested mode
The flow-control sysctl represents the configured policy, while
current_mode is the mode negotiated with the link partner. Comparing a
new request with current_mode can needlessly reprogram an unchanged
policy or skip a requested policy change that happens to match the
current negotiation result.
Compare with requested_mode before deciding that no update is needed.
(cherry picked from commit c410551b9feadf9b65f920fd25714fcda8299a56)
ixgbe: Validate EEPROM checksum section bounds
The generic checksum walker trusts NVM section pointers and lengths and
iterates with a 16-bit index. A corrupt section that crosses the end of
the EEPROM can wrap the index and leave the driver in an effectively
unbounded read loop during attach.
Validate each non-empty section against the discovered EEPROM word size
before reading it, and use widened arithmetic for the inclusive end and
iterator.
(cherry picked from commit be3e1068ea8699fb719691453899ca20a601fe1d)
ixgbe: Restore missed packet accounting
missed_rx and total_missed_rx are never populated. As a result, the
GPRC erratum workaround does not remove missed packets and iqdrops
always remains zero. The rx_missed_packets sysctl and input-error total
also expose only MPC bank zero.
Read and accumulate all eight MPC banks. Use the interval total to
correct GPRC and the cumulative total for iqdrops, input errors, and the
aggregate sysctl. This matches DPDK's coverage of the hardware banks.
(cherry picked from commit 660099c985e8bfc931b01398715441c90cf0d4db)
ixgbe: Preserve VF jumbo frame size across PF resets
sc->max_frame_size represents the largest frame requested by the PF or
an active VF. The MTU callback replaces it with the PF frame size, so
a subsequent reinitialization can program MHADD below an active VF's
jumbo-frame request.
Recompute the aggregate before hardware initialization and use it when
programming MHADD. Recompute after each VF LPE request as well, so a
reduced request can lower the hardware limit when no other function
needs the previous value.
(cherry picked from commit 877f0ee40c2af801c5ca758a37b3ebddc560dad2)
ixl: Quiesce VF DMA before a PF reset
A PF reset has a warning interval before the hardware reset begins.
Cooperative VF drivers respond to the reset event by stopping and
releasing their receive buffers, but notifying VFs did not stop the
hardware queues. An active VF could therefore DMA through its old
rings into freed mbuf clusters during the warning interval.
Put every enabled VF in reset, drain its PCIe transactions, disable its
queues, wait for receive queue shutdown, and drain transactions again
before tearing down the PF HMC and AdminQ.
Hold VFs in reset again while rebuilding the firmware topology. Release
VF reset before programming the replacement VSI and queue mappings,
since VF reset clears those registers, and publish VFACTIVE only after
reconstruction succeeds. Leave a VF held in reset if rebuilding it
fails.
Fixes: 983e628a0c47 ("ixl: Rebuild VF resources after a PF reset")
[2 lines not shown]
