libpfctl: Return max_win and mss of state peers
The kernel sends PF_STP_MAX_WIN and PF_STP_MSS for both peers of a
state, but struct pfctl_state_peer has no fields for them and libpfctl
dropped them. Add the fields and parse the attributes.
Reviewed by: kp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60544
if_bnxt: fix powerpc build of the MPC ring code
powerpc has no 16-bit acquire/release atomics, so the
atomic_load_acq_16() and atomic_store_rel_16() calls on the MPC TX
ring indices fail to build there. Make the producer and consumer
indices 32 bits wide and use the 32-bit primitives.
Reviewed by: gallatin, chandrakanth.patil_broadcom.com
Sponsored by: Broadcom Inc
MFC after: 1 week
Fixes: 088a42c0ff76 ("if_bnxt: add MPC (Mid-Path Channel) ring infrastructure")
Differential Revision: https://reviews.freebsd.org/D60698
pf: Set the reassembly flags under the rules lock
DIOCSETREASS stored V_pf_status.reass twice with no lock, first the
flags it was given and then, if reassembly was not among them, zero.
pf_normalize_ip() and pf_normalize_ip6() read the flags with the rules
lock held for reading, so a packet could see the intermediate value.
Compute the flags first and store them once, with the rules lock held
for writing, as DIOCSETDEBUG and DIOCSETHOSTID do.
Reviewed by: kp
Fixes: 39282ef356db ("pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rules")
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60531
pf: first-match-wins for nat rules, even in anchors
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
tests/netinet6: Turn off stable addresses in ndp_prefix_len_mismatch
ndp_prefix_len_mismatch exercises the fallback in in6_ifadd() for an
interface whose link-local address does not have the advertised prefix
length (9e792f7ef729). Since a2eb0894b79b made stable addresses
(RFC 7217) the default, in6_ifadd() takes the interface identifier from
in6_get_stableifid() and never looks at the link-local address, so the
case passes without reaching the fallback. Turn stable addresses off
on the interface.
Sponsored by: Rubicon Communications, LLC ("Netgate")
hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class
The IRPERF MSR counter (0xc00000e9) exposes an instructions-retired count
when read. Its support is advertised through CPUID leaf 0x80000008 EBX bit 1.
If this bit is set, the CPU supports the IRPERF MSR. For it to be used
by the system, bit 30 of the HWCR MSR (0xC0010015) needs to be enabled.
This patch checks for availability of the feature and enables the bit. If
the feature is available, the hwpmc PERF class detects its presence and
registers a third PERF MSR counter that allows hwpmc users to measure
instructions retired using IRPERF. This is AMD-only, as Intel does not
support IRPERF.
Due to erratum #1054 affecting AMD Zen 1 before model 30h, IRPERF is only
enabled for AMD Zen 1 model 30h onwards and later microarchitectures. This
commit also implements a validation step to make sure the IRPERF counter
is actually incrementing; otherwise, the feature is not enabled. This
guarantees it is working as expected before being made available to the
system and users.
[20 lines not shown]
pfil: Avoid potential mbuf tag leak
In '398254f9999e mbuf: simplify m_free' we removed tag processing
on m_free() of M_NOFREE mbufs. It is possible that a packet filter
could attach a tag to this stack mbuf and call m_free()
on it, meaning that 398254f9999e may have introduced a tag leak.
However,if a tag is attached without anyone calling m_free(), then
this leak was pre-existing.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D60686
Fixes: 398254f9999e
Sponsored by: Netflix
hwpmc_amd: fix INVARIANTS build
The variable 'amd_npmcs' is not yet present in this branch.
This is a direct commit to stable/14.
Reported by: Jenkins
Sponsored by: The FreeBSD Foundation
benchmarks/kdiskmark: drop dependencies on barely used ECM/KDE bits
It used to require a minimal set of KDE dependencies (KF5Auth), but
for a while was only using some CMake helpers, easily rewritable in
plain out-of-the-box syntax.
PR: 299313
