HardenedBSD/src 408f8f7sys/dev/axgbe if_axgbe_pci.c, sys/dev/e1000 if_em.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+190-52sys/dev/e1000/if_em.c
+114-59sys/dev/ixgbe/if_ixv.c
+87-58sys/dev/ixgbe/if_ix.c
+68-62sys/dev/ixgbe/if_sriov.c
+31-44sys/dev/axgbe/if_axgbe_pci.c
+42-26sys/dev/enic/if_enic.c
+532-30122 files not shown
+665-38328 files

HardenedBSD/src 01fb274sys/dev/e1000 if_em.h if_em.c, sys/dev/igc igc_defines.h if_igc.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+189-29sys/dev/e1000/if_em.c
+65-29sys/dev/ixgbe/if_ixv.c
+32-9sys/dev/e1000/if_em.h
+7-12sys/dev/igc/if_igc.c
+8-8sys/dev/igc/igc_defines.h
+4-6sys/dev/ixgbe/if_ix.c
+305-931 files not shown
+313-937 files

HardenedBSD/src 679efdcsys/kern vfs_mountroot.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+6-1sys/kern/vfs_mountroot.c
+6-11 files

HardenedBSD/src 192a5eesys/kern vfs_mountroot.c

vfs_mountroot: unmute console in interactive prompt

If boot_mute is set the system appears to hang during the mountroot
prompt. Temporarily unmute the console so the prompt is visible.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58549

(cherry picked from commit e96f1cbd690e68594fc8812de634f43c6711aa97)
DeltaFile
+6-1sys/kern/vfs_mountroot.c
+6-11 files

HardenedBSD/src 018864brelease/pkg_repos release-dvd.conf, release/scripts pkg-stage.sh

HBSD: Resolve merge conflicts

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-9release/scripts/pkg-stage.sh
+0-4release/pkg_repos/release-dvd.conf
+1-132 files

HardenedBSD/src 9c169e1sys/dev/e1000 if_em.c, sys/dev/igc if_igc.c igc_base.c

Merge remote-tracking branch 'rad/freebsd/15-stable/main' into hardened/15-stable/main

Conflicts:
        release/pkg_repos/release-dvd.conf (unresolved)
        release/scripts/pkg-stage.sh (unresolved)
DeltaFile
+55-0sys/dev/igc/igc_base.c
+46-0sys/dev/igc/if_igc.c
+25-17sys/dev/ixgbe/if_sriov.c
+28-2sys/dev/ixgbe/ixgbe_mbx.c
+21-0sys/dev/e1000/if_em.c
+17-3sys/dev/ixgbe/ixgbe_phy.c
+192-2255 files not shown
+354-11561 files

HardenedBSD/src 98fad62sys/dev/ixgbe if_ixv.c

ixv: Negotiate VF queue-set limits

ixv uses one queue set on 82599 and X540 VFs and assumes two on
X550-family VFs.  The PF reports the queues assigned to each VF with
GET_QUEUES after mailbox API 1.1 negotiation.

Query the PF during attach.  Bound symmetric iflib queue sets by the PF
grant and available MSI-X data vectors.  Retain one queue set per data
vector: ixgbe VFs expose at most three vectors and one is reserved for
the mailbox.  The hardware permits each pool to use a subset of its RSS
queues, so a two-queue ceiling is valid when the PF assigns four.

This enables the second data vector on 82599 and X540 while avoiding an
assumed second queue when an X550-family VF is granted only one.  Keep
the existing family limits if the mailbox is unavailable or the PF uses
an older API.

MFC after:      2 weeks
DeltaFile
+61-9sys/dev/ixgbe/if_ixv.c
+61-91 files

HardenedBSD/src 0baf0fasys/dev/ixgbe if_ixv.c ixgbe.h

ix/ixv: Match Tx writeback thresholds to iflib

PTHRESH controls when the device prefetches transmit descriptors,
HTHRESH controls how many host descriptors must be ready, and WTHRESH
controls completion writeback batching.

iflib places RS on selected descriptors and reclaims through those
checkpoints.  The data sheets require WTHRESH to be zero when software
uses RS.  Clear WTHRESH while retaining the established PTHRESH 32 and
HTHRESH 1 fetch policy.

This also follows DPDK in pairing sparse RS descriptors with
WTHRESH zero.  DPDK defaults to 32/0/0, while Linux ixgbevf uses
32/1/8.  The 32/1/0 setting preserves FreeBSD's prefetch policy and the
data-sheet requirement that HTHRESH be nonzero when PTHRESH is used.

MFC after:      2 weeks
DeltaFile
+4-6sys/dev/ixgbe/if_ix.c
+8-0sys/dev/ixgbe/ixgbe.h
+2-2sys/dev/ixgbe/if_ixv.c
+14-83 files

HardenedBSD/src e2aff50sys/dev/igc igc_defines.h if_igc.c

igc: Correct descriptor control programming

The transmit-ring setup was copied from the e1000 path.  On I225
and I226, bits 22 through 24 are reserved and bit 25 enables the
queue; it is not a legacy low-water threshold.  Correct the field
masks, remove the nonapplicable legacy definitions, and program only
defined fields.

Use PTHRESH=8 and HTHRESH=1.  Keep WTHRESH at zero so the hardware
honors sparse RS descriptors issued by iflib.  Linux and DPDK use a
writeback threshold of 16, but request status on every packet.  A
nonzero threshold makes hardware ignore individual RS bits and is
unsuitable for the iflib completion model.

The receive-ring setup likewise used a magic mask that left bit 20
of the five-bit WTHRESH field untouched.  Define the receive threshold
fields and replace them exactly before installing the established
PTHRESH=8, HTHRESH=8, WTHRESH=4 policy.

MFC after:      2 weeks
DeltaFile
+7-12sys/dev/igc/if_igc.c
+8-8sys/dev/igc/igc_defines.h
+15-202 files

HardenedBSD/src bd4182asys/dev/e1000 if_em.h if_em.c

igb: Program Rx descriptor thresholds by family

82576 specification-update erratum 26 says MSI-X EITR expiration can
fail to trigger receive descriptor writeback.  A WTHRESH above one can
therefore leave received packets invisible until the threshold fills.

The shared threshold macros selected policy by enum ordering, so an
82576 VF fell into the generic WTHRESH=4 case.  VFs always use MSI-X
and require the same WTHRESH=1 workaround as the PF.

Use PTHRESH=8 for 82575 and 82576 PFs and VFs, matching DPDK and the
current Linux PF driver.  The legacy FreeBSD PF and Linux igbvf value
of 16 thrashes limited descriptor cache; no specification or erratum
requires it.  Retain the i354 PTHRESH=12 exception.

Enumerate every supported igb PF and VF MAC type so each receives its
intended policy.  Also clear every threshold bit before installing the
new values.  The old mask retained the high WTHRESH bit, and 82575
uses six-bit fields while later controllers use five-bit fields.

    [2 lines not shown]
DeltaFile
+51-5sys/dev/e1000/if_em.c
+13-5sys/dev/e1000/if_em.h
+64-102 files

HardenedBSD/src fddc393sys/dev/e1000 if_em.h if_em.c

igb: Match Tx descriptor control to iflib

iflib requests transmit completion status only on selected descriptors.
Program a zero writeback threshold so igb hardware honors those sparse
RS bits instead of writing back every descriptor in threshold-sized
batches.

Use the existing family specific prefetch threshold: eight descriptors
on most controllers and 20 on I354, with a host threshold of one.  These
values match the Intel-derived Linux and DPDK drivers.  Their nonzero
writeback settings are not appropriate here because those drivers set
RS on every packet.

A zero writeback threshold also avoids depending on interrupt timer
flushes affected by 82576 specification update erratum 26.  Remove the
old IGB_TX_WTHRESH macro as well.  It has had no callers since the iflib
conversion, so its 82575 conditional no longer implements any policy.

MFC after:      2 weeks
DeltaFile
+33-8sys/dev/e1000/if_em.c
+3-4sys/dev/e1000/if_em.h
+36-122 files

HardenedBSD/src 9badfe1sys/dev/axgbe if_axgbe_pci.c, sys/kern kern_environment.c

HBSD: Resolve merge conflicts

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-8sys/dev/axgbe/if_axgbe_pci.c
+0-5sys/kern/kern_environment.c
+0-132 files

HardenedBSD/src 9fc1919sys/dev/axgbe if_axgbe_pci.c, sys/dev/e1000 if_em.c

Merge remote-tracking branch 'rad/freebsd/current/main' into hardened/current/master

Conflicts:
        sys/dev/axgbe/if_axgbe_pci.c (unresolved)
        sys/kern/kern_environment.c (unresolved)
DeltaFile
+83-52sys/dev/ixgbe/if_ix.c
+68-62sys/dev/ixgbe/if_sriov.c
+37-42sys/dev/axgbe/if_axgbe_pci.c
+49-30sys/dev/ixgbe/if_ixv.c
+42-26sys/dev/enic/if_enic.c
+1-23sys/dev/e1000/if_em.c
+280-23521 files not shown
+362-28727 files

HardenedBSD/src abe2238sys/dev/e1000 if_em.h if_em.c

e1000: Correct Rx descriptor threshold programming

Jumbo receive tuning on integrated controllers enabled PTHRESH without
a nonzero HTHRESH, contrary to the hardware programming requirements.
It also covered only the integrated MAC generations present when the
workaround was added.  Enumerate every jumbo-capable ICH and PCH type
and program PTHRESH=3 with HTHRESH=1.  Linux fixed the same HTHRESH
omission in b701cacdbcfb.

The 82574 path combined threshold values with the reset values using
bitwise OR.  Requesting WTHRESH=4 while the reset value was one thus
programmed five.  Clear the complete threshold fields before installing
the established PTHRESH=32, HTHRESH=4, WTHRESH=4 descriptor-granularity
policy.

MFC after:      2 weeks
DeltaFile
+36-14sys/dev/e1000/if_em.c
+13-0sys/dev/e1000/if_em.h
+49-142 files

HardenedBSD/src 66baeecsys/dev/e1000 if_em.h if_em.c

e1000: Program Tx descriptor control by family

TXDCTL programming is family dependent.  82543 erratum 35 and
82544 erratum 20 require WTHRESH to remain zero; a nonzero value
can corrupt descriptor writebacks and hang the controller.  Leave all
descriptor-control thresholds at their reset values on 82542, 82543,
and 82544.

On the remaining em controllers, retain the established PTHRESH=31,
HTHRESH=1, WTHRESH=1, and descriptor granularity policy.  Several
legacy specification updates identify full descriptor writeback as a
workaround for transmit descriptor-queue errata.

TXDCTL bit 22 is also family dependent.  It is COUNT_DESC on the
82571 family and 80003ES2LAN.  Intel shared initialization explicitly
sets raw bit 22 on both transmit queues of every supported ICH/PCH
generation, although the integrated public documentation marks it
reserved.  Preserve that required setting when iflib programs the
thresholds, as DPDK does.  Clearing it caused a persistent I219

    [12 lines not shown]
DeltaFile
+75-8sys/dev/e1000/if_em.c
+3-0sys/dev/e1000/if_em.h
+78-82 files

HardenedBSD/src 4a13b8asys/dev/ixgbe if_ixv.c

ixv: Advertise SCTP checksum offload

The shared ixgbe transmit path already creates SCTP context
descriptors, and the hardware exposes the same checksum capability to
VFs.  Advertise it through iflib as the PF driver does.

MFC after:      2 weeks
DeltaFile
+2-1sys/dev/ixgbe/if_ixv.c
+2-11 files

HardenedBSD/src 8eeb258sys/dev/ixgbe if_ixv.c

ixv: Remove unused loader tunables

The flow_control and hdr_split variables have never been read.  VF
flow control is controlled by the PF, while implementing header split
would require receive-path support that ixv does not provide.

MFC after:      2 weeks
DeltaFile
+0-17sys/dev/ixgbe/if_ixv.c
+0-171 files

HardenedBSD/src c017bceshare/man/man4 ix.4, sys/dev/ixgbe if_sriov.c

ixgbe: Reject Flow Director with SR-IOV

The iflib Flow Director path does not assign filters using the
absolute queue and pool identifiers required by SR-IOV.  Reject the
combination during preflight validation rather than allowing an
unsupported configuration to alter the PF receive path.

The loader tunable is fixed before VFs can be created, so validation
also prevents the reverse ordering of this combination.

MFC after:      2 weeks
DeltaFile
+5-0sys/dev/ixgbe/if_sriov.c
+2-1share/man/man4/ix.4
+7-12 files

HardenedBSD/src 9f4df9fsys/x86/iommu amd_intrmap.c

amd_iommu: Honor disabled interrupt remapping

Do not instantiate an interrupt-remapping context for a unit whose IRTE
support is disabled. In that mode the caller must retain the ordinary
interrupt path.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58725
DeltaFile
+1-1sys/x86/iommu/amd_intrmap.c
+1-11 files

HardenedBSD/src d6f97c6share/man/man4 iflib.4, share/man/man9 iflibdi.9

iflib: Add sysctl stat for TX watchdog reset events

iflib counts resets initiated by its transmit watchdog in 69c3e0de01c1.

Export the counter in the per-device iflib sysctl tree so every
driver provides the diagnostic without a driver callback or duplicate
storage.

A watchdog reset does not establish how many packets failed.  It can
recover a hardware stall involving several queued packets or a missed
completion involving no packet loss.  Stop adding one output error per
watchdog event in em(4), igb(4), and igc(4).

Remove the redundant driver counters and move the diagnostic to
dev.<driver>.<unit>.iflib.tx_watchdog_events.

MFC after:      1 month
Relnotes:       yes
DeltaFile
+1-23sys/dev/e1000/if_em.c
+1-18sys/dev/igc/if_igc.c
+5-2sys/net/iflib.c
+6-1share/man/man4/iflib.4
+3-3share/man/man9/iflibdi.9
+0-2sys/dev/igc/if_igc.h
+16-494 files not shown
+16-5510 files

HardenedBSD/src 7e2781fsys/netpfil/pf if_pfsync.c, tests/sys/netpfil/pf pfsync.sh

pfsync: handle large MTU pfsync interfaces

pfsync packets were allocated with m_get2(), which can't return packets
larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work.

Use m_get3(), which can allocate sufficiently large mbufs.

Extend the pfsync:bulk test case to provoke this problem.

PR:             297307
MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+8-3tests/sys/netpfil/pf/pfsync.sh
+1-1sys/netpfil/pf/if_pfsync.c
+9-42 files

HardenedBSD/src 8ea4e92sys/net route.c

net: don't panic on ifconfig pfsync0 mtu 9000

pfsync interfaces do not have ifp->if_inet6 set, so when we update the
MTU for those interfaces we panicked.

Add an explicit check for this. This should be temporary, until pfsync
is no longer a struct ifnet (as we've already done for pflog).

Reviewed by:    glebius
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58701
DeltaFile
+3-1sys/net/route.c
+3-11 files

HardenedBSD/src 42d54a8sys/amd64/vmm/amd ivrs_drv.c, sys/amd64/vmm/io iommu.h iommu.c

vmm: Tear down the IOMMU before AMD-Vi detach

Register the vmm module handler after both the bundled device drivers
and SMP. On platforms without EARLY_AP_STARTUP, SI_SUB_SMP follows
SI_SUB_DRIVERS; using the later subsystem preserves the
smp_rendezvous() requirement.

The resulting reverse unload order performs IOMMU cleanup while every
IVHD softc remains valid. Refuse an independent IVHD detach while
translation state remains initialized.

MFC after:      2 weeks
DeltaFile
+9-5sys/amd64/vmm/amd/ivrs_drv.c
+10-2sys/amd64/vmm/io/iommu.c
+8-2sys/dev/vmm/vmm_dev.c
+1-0sys/amd64/vmm/io/iommu.h
+28-94 files

HardenedBSD/src 4174cc2release Makefile.gce

release/Makefile.gce: migrate gsutil usages to gcloud CLI

Google Cloud recommends migrating from gsutil to gcloud storage CLI.
Update gce-do-upload target to use `gcloud storage buckets create` and
`gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands.

PR:             conf/297016
Reviewed by:    lwhsu
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58464
DeltaFile
+2-2release/Makefile.gce
+2-21 files

HardenedBSD/src 5017a24sys/dev/ixgbe if_sriov.c

ixgbe: Drain events for inactive VFs

The aggregate VF mailbox poll includes only VFs whose driver
configuration completed. A configured VF slot whose vf_add callback
failed can nevertheless report reset, request, or acknowledgement
events. Because the mailbox handler skips inactive entries, such an
event remains latched and can retrigger administrative work
indefinitely.

Build the poll masks from every configured VF index and consume reset,
message, and acknowledgement events for inactive entries without
treating them as usable VFs. Use the index rather than the pool because
early vf_add errors precede pool initialization. Also include E610
PFVFLREC in aggregate reset sampling.

MFC after:      2 weeks
DeltaFile
+63-62sys/dev/ixgbe/if_sriov.c
+63-621 files

HardenedBSD/src 2b763a8sys/dev/ixgbe if_ix.c

ixgbe: Handle deferred link-status requests

The iflib conversion records link-status interrupts in the
administrative request mask, but the administrative task did not
consume them.  Timer polling usually hid the omission; frequent mailbox
interrupts could continually rearm that timer and leave cached link
state down after hardware recovered.

Claim request batches atomically, process link-setup dependencies, and
sample hardware before publishing link state.  Bound each invocation to
eight batches and requeue residual work so a continuous producer cannot
monopolize the admin taskqueue.

Queue every link-related request from the legacy interrupt path.
Unlike MSI-X, its threaded continuation services RX and does not enqueue
the admin task.  This restores the event-driven behavior of ix-3.4.39.

Fixes:  b2c1e8e62049 ("ix(4): Run {mod,msf,mbx,fdir,phy}_task in if_update_admin_status")
MFC after:      2 weeks
DeltaFile
+83-50sys/dev/ixgbe/if_ix.c
+83-501 files

HardenedBSD/src 26e3a80sys/dev/ixgbe if_ixv.c

ixv: Tolerate temporary PF mailbox unavailability

A PF can be resetting, handling a slow link event, or deliberately
withholding mailbox CTS while its VFs enumerate. Keep the VF attached
when the reset handshake is temporarily unavailable so a later if_init
can retry.

Never leave VF hardware running without a negotiated mailbox API: start
hardware only after reset succeeds, stop it when negotiation fails in
attach or init, and defer later recovery through iflib. This prevents a
tight reset loop while preserving recovery when the PF returns.

MFC after:      2 weeks
DeltaFile
+49-28sys/dev/ixgbe/if_ixv.c
+49-281 files

HardenedBSD/src c521b16share/man/man4 route.4

route.4: Add RTV_METRIC flag to rt_metrics

Reviewed by:    ziaee
Differential Revision: https://reviews.freebsd.org/D58565
DeltaFile
+2-1share/man/man4/route.4
+2-11 files

HardenedBSD/src a97e1c2sys/dev/enic if_enic.c

enic: Correct queue and attach resource ownership

Completion queues are allocated by attach_pre but released by
queues_free. An iflib failure between those stages leaks the allocation,
while the original size expression also underallocates the array.

Move completion queue allocation into the TX queue callback, correct its
size, and unwind it with TX state if RX allocation fails. Make interrupt
cleanup tolerate an unavailable array and reuse the array allocated
during device initialization instead of replacing and leaking it.

Release the DMA, multicast, and lock resources owned by a successful
attach_pre during detach. Avoid allocating the statistics DMA area a
second time near the end of attach_pre.

MFC after:      2 weeks
DeltaFile
+42-26sys/dev/enic/if_enic.c
+42-261 files

HardenedBSD/src 65228a8sys/dev/axgbe if_axgbe_pci.c

axgbe: Align channel lifetime with queue allocation

DMA channels are allocated by attach_pre but released by queues_free.
When iflib fails after attach_pre and before queue allocation, neither
the old detach nor queues_free path releases them.

Allocate channels with the TX queue state and make queues_free tolerate
partially allocated rings. Use it to unwind allocation failures so TX
rings are also released when RX allocation fails.

An early detach can also precede PHY initialization and interrupt
assignment. Skip absent PHY and channel state, and release the locks
owned by attach_pre on both failure and detach.

MFC after:      2 weeks
DeltaFile
+37-42sys/dev/axgbe/if_axgbe_pci.c
+37-421 files