net/if.c: Add fib-aware ifa_ifwithaddr()
Add FIB selection logic by introducing ifa_ifwithaddr_fib() to
support FIB-specific lookups. Then have ifa_ifwithaddr() wrap it
with RT_ALL_FIBS.
Also, do the same for ifa_ifwithaddr_check().
Reviewed by: glebius, bnovkov
Differential Revision: https://reviews.freebsd.org/D58305
(cherry picked from commit b00d30950cde27eda8f51523a40f2c05a38daac1)
bind(2): Lookup local address in current FIB if '*.bind_all_fibs' is active
When a protocol-specific 'bind_all_fibs' tunable is set to 0, a
listening socket will only receive traffic originating from the FIB
it was bound to. However, there are no checks to determine whether
an address exists in the target FIB when binding the socket, which can
lead to a situation where a socket and the address it was bound to
belong to different FIBs.
Prevent this footgun by looking up the requested address in the current
FIB if 'bind_all_fibs' is active and returning an error if the address
does not exist.
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D58281
Reviewed by: glebius, pouria, markj
MFC after: 2 weeks
(cherry picked from commit 948ad32ae1e0811f45e1d38f26636fefed5051f0)
in_mcast: Fix uninitialized variable usage in inm_merge()
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
ip_mroute: Don't assume that a multicast router is running
The SIOCGETSGCNT handler may be invoked in this scenario, and if no
router has initialized the lookup table, we'll have
mfct->mfchashtbl == NULL.
PR: 297148
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1c0d2f0b1a98526e4f1f5a051ce6904b4c3164e1)
tests/ip_mroute: Remove test timeouts
The configured timeout of 30s is a bit too low for a couple of tests
which create 4+ VNET jails when running tests in parallel and with
kernel sanitizers enabled. There's no reason to have custom timeouts,
just use the default.
MFC after: 1 week
(cherry picked from commit 3b16e96b005c723717aa6a4ebc48000354e64fa1)
ip_mroute: Fix a lock leak in X_ip_mforward()
If a FIB does not have a router configured, X_ip_mforward() would leak a
lock. Plug the leak.
The IPv6 counterpart did not have such a check. It wouldn't send an
upcall to a non-existent router anyway due to the router_ver check, but
we should verify that a router is present anyway.
Add regression test cases to exercise these code paths.
Reported by: Claude Opus 4.6
Fixes: 0bb9c2b665d9 ("ip6_mroute: FIBify")
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
(cherry picked from commit 18b7115cba2f698909a4801dc2cc1b04b1f4f210)
tests: Add some simple regression tests for ip_mroute
These use atf_python to create a number of hosts linked to a router.
The router runs pimd (for IPv4) or ip6_mrouter (simplistic IPv6
multicast router that I wrote since I couldn't find one in the ports
tree). The vnet_host*_handler() methods are invoked in different VNET
jails connected to the router; they register the connected epair with a
multicast group and verify that they can send messages to each other.
The tests are synchronized by sending messages over a unix domain
socket. The flow is something like:
1) test startup_method() is called, the unix socket is created,
2) the superclass creates jails and links them together using the
declared topology,
3) we wait for all child jails to start up and send a message on the
unix socket indicating that they are ready
4) we start the routing daemon in the main jail,
5) the test actually starts; starttest() kicks off the
vnet_host*_handlers(), which mostly just verify that they can send
[13 lines not shown]
ip6_mroute: VNETify counters
Commit a223d6c489c7 made most of the ip6_mroute state per-VNET, but
failed to do this for a couple of counter structures. Make them
per-VNET too.
Reported by: zlei
Reviewed by: pouria, zlei
Fixes: a223d6c489c7 ("ip6_mroute: Start putting global variables into a structure")
Differential Revision: https://reviews.freebsd.org/D56253
(cherry picked from commit 77df0240307ebbc606e17c9b83c0d940d33c2649)
ip6_mroute: Fix the type name in sysctl_mfctable()
No functional change since apparently it's fine to compute the size of
a pointer type when the base type is undefined.
Fixes: 0bb9c2b665d9 ("ip6_mroute: FIBify")
(cherry picked from commit 0dbbed21a643f6c95bebe23008a332ff68adb203)
ip6_mroute: Handle interface detach events
When an interface goes away we need to make sure the v6 multicast
routing tables don't carry any dangling references to the ifnet. The v4
code handles this already. Copy the approach there and use an
eventhandler to purge the corresponding MIF, if one exists, and further
go through all routes in the FIB and remove references to the interface.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55246
(cherry picked from commit a1c042a9641c9df08010e87d0928703849ff9853)
ip6_mroute: Pass the multicast interface number directly to del_m6if()
There's no need to pass a pointer to the interface number. No
functional change intended.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55245
(cherry picked from commit 82272cbf56aa5646611c6f1049501cc345fcf6ec)
ip6_mroute: FIBify
Modify the control plane (ioctl and socket option handlers) to use the
routing socket FIB to index into the mfctable array. Modify the
forwarding plane to use the mbuf's FIB to determine which routing table
to use.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55242
(cherry picked from commit 0bb9c2b665d90934ae16eee152b6b4f4f4be0dd5)
Fix nooptions VIMAGE build
The recent FIBify commits deref struct thread without including
sys/proc.h, which can result in a compiler error. This becomes
apparent when building with LINT-NOVIMAGE, as net/vnet.h includes
sys/proc.h. Fix this by directly including sys/proc.h
Fixes: 4c486fe40267 ("ip_mroute: FIBify"), 0bb9c2b665d9 ("ip6_mroute: FIBify")
(cherry picked from commit 3f79bc9ca336f634e1afa262ccf5155882550a8a)
ip_mroute: FIBify
Modify the control plane (ioctl and socket option handlers) to use the
routing socket FIB to index into the mfctable array. Modify the
forwarding plane to use the mbuf's FIB to determine which routing table
to use.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55241
(cherry picked from commit 4c486fe402673c49443293cfb70ad4da61d39916)
ip(6)_mroute: Grow the routing tables when the number of FIBs changes
Use the new rtnumfibs_change event to expand the mfctable array when the
number of FIBs increases.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55240
(cherry picked from commit 97a4bc9a0da7cd63c660ce59a9dd7c87efe1f218)
ip_mroute: Start moving globals into a structure
I would like to support per-FIB multicast routing tables, such that one
can run a routing daemon per-FIB, with each daemon oblivious to the
existence of others. Currently the multicast routing code is completely
unaware of FIBs.
To that end, start collecting various global variables in ip_mroute.c
into a per-VNET struct mfctable. In a future patch this will be
expanded into an array of mfctable structures, one per FIB. For now,
all of the state is collected into V_mfctables[0].
Each mfctable contains, among other things:
- a pointer to the routing socket, if routing is enabled,
- a hash table of routing cache entries,
- an table of network interfaces participating in the routing
configuration
This change has no functional effect, it is just factoring out these
[8 lines not shown]
ip6_mroute: Start putting global variables into a structure
As in the IPv4 version of this change, I added a struct mf6ctable
structure which holds all global routing table state, soon to become
per-FIB state.
Note that much of the v6 multicast routing code was not VNETified; this
change fixes that too.
MFC after: 2 weeks
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D55238
(cherry picked from commit a223d6c489c7ea9a384f3d2bbda1b05b00d4502d)
ath10k: remove some early FreeBSD-specific debugging
The extra DELAY seems to no longer be needed and the dump_stack()
is definitively a problem now. Remove all this.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 523c3992cf9e50dce7948372ef703f0057e22561)
qat: driver updates to enhance qat infrastructure
- Updated QAT infrastructure FW version/AE mask/num_banks fields
to facilitate integration of future QAT products.
- Exposed service as sym;asym instead of cy for gen4
- Enhanced cpaGetInstances() for accurate instance retrieval
- Added 57-bit virtual address support to lac_lock_free_stack
- Minor bug fixes and improvements
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj at intel.com>
Reviewed by: markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D57746
(cherry picked from commit 682f135f5de39cfc24cfd529ea8a161e94c76c8e)
if_vxlan(4): Fix panic by validating unused drvspec values
Add validation for unused parameter values in the gap between
VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent
panics.
PR: 297151
Reported by: Robert Morris <rtm at lcs.mit.edu>
Reviewed by: markj
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58552
(cherry picked from commit c4d7745cd90fc99af3cbccfda7e11798ea7d187b)
ice(4): Add two more 4-part IDs for E835 adapters
Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Reviewed by: erj
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57337
(cherry picked from commit f370d9e4d5844daa06d77e57236e03bd7c5f4ba1)
ice(4): Add support for E835 CNSA 2.0 adapters
Added support for E835 adapters with post-quantum cryptographic (PQC)
algorithms in firmware/software signage and in SPDM attestation.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Reviewed by: Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Differential Revision: https://reviews.freebsd.org/D57868
(cherry picked from commit 8194c32827e9c3867d4b295edca9842b71608526)
ice: Report initialization failures to iflib
The primary and mirror-VSI ifdi_init callbacks can return early when
reset state or hardware queue and filter setup prevents initialization.
Iflib then marks the interface running and enables interrupts although
the driver did not finish bringing it up.
Report each non-detach failure through iflib_init_failed(). Keep the
existing ice reset and subinterface-reinitialization machinery
responsible for scheduling recovery.
(cherry picked from commit dcdc00a41d3e4be0e75eb625cd3a23d5a927ed15)
ice: Add led(4) identification support
Expose the firmware-controlled physical port identification LED
through /dev/led/ice*. Use the AdminQ port-identification command to
select blinking mode and restore the netlist-selected original mode
before the interface is stopped.
Sponsored by: BBOX.io
(cherry picked from commit a781965b91ea390f9576ae42c35c842db74aab86)
e1000: Report corrected LAN management FIFO ECC errors
I350 and I354 report a corrected ECC error in the LAN transmit
management FIFO through LANPERRSTS bit 16. Unlike the parity status in
the same register, this condition neither interrupts nor stops traffic.
Poll the latch with the other corrected error status, increment a
dedicated counter, and clear only its RW1C bit. Expose it as
dev.igb.N.memory_errors.corrected_lan_mng_fifo.
Fatal error handling returns before the periodic statistics sweep and
may reset the device. Drain all I350 and I354 corrected-error status in
the admin task before recovery so the reset does not discard pending
indications.
This follows section 6.21.16 of the Intel Atom Processor C2000 Product
Family Integrated GbE Controller Programmer's Reference Manual,
document 537426 revision 1.5.
[3 lines not shown]
e1000: Handle I354 internal memory errors
The Atom C2000 integrated GbE programming reference documents the I354
internal memory error architecture. It shares the I350 PEIND and
ICR.FER routing, DMA and packet-buffer status, LAN parity status, and
required reset recovery.
Extend the existing I350 recovery and corrected error accounting paths
to I354. Keep the PCIe corrected error mask family-specific. C2000
PCIEECCSTS ends at the transmit write-data indication in bit 4 and does
not implement the I350 retry buffer indication in bit 5. Do not expose
the corresponding retry counter on I354.
The PRM overview says a PCIe region failure requires a system reboot,
while the individual PCIEERRSTS fields prescribe CTRL.RST followed by
port reinitialization. Use the register specific recovery, matching the
existing I350 path; failed reinitialization still leaves the port down.
This follows sections 5.6 and 6.21 of the Intel Atom Processor C2000
[6 lines not shown]
net: Add ifmedia support for 10GBase-BX BiDi
10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber. The optics must be paired so that
the transmit and receive wavelengths cross over.
(cherry picked from commit 4220b52453c9701922955dcc1c1e1554d6a9f3ae)
iflib: Remove an unused field from struct iflib_rxq
Reported by: Alexander Sideropoulos <Alexander.Sideropoulos at netapp.com>
MFC after: 1 week
(cherry picked from commit fc09c7fee23b3cf3ddc95105ef6ef41d7956232f)
