if_wg: Prefix crypto_init() & crypto_deinit() with wg_ for a cleaner namespace.
Both these functions have non-static linkage for good reasons, however, their
naming may confuse folk when working with crypto(9) code at global scope.
netinet6: Document IPv4-mapped extension to IPV6_JOIN_GROUP et al.
The IPv6 socket options IPV6_JOIN_GROUP and IPV6_LEAVE_GROUP
socket options are being extended to accept IPv4 multicast group
addresses in the RFC 3493 IPv4-mapped address format as a convenience
to application developers.
Caveat this addition carefully in the newly added HISTORY section,
addressing all previous review comments.
Approved by: ziaee
Reviewed by: ziaee, glebius
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision: https://reviews.freebsd.org/D55382
netinet6: We will never support the KAME :: feature to listen for all groups.
Comment updated only. No functional change.
It is unrealistic to expect that this feature will ever be resurrected from
the legacy KAME tree, given historical divergence, and that applications
which really need to consume all group state (e.g. proxies) will either
join on a per-group basis, or use link-layer mechanisms anyway. It was also
very poorly documented to begin with.
netinet6: Pass IPv4-mapped ASM multicast joins/leaves to netinet.
Add support for allowing IPv4 multicast groups to be joined on IPv6 sockets,
as a number of applications began to rely on this over the years, despite it
only ever having been a convenience which appeared in Solaris & Linux over
the course of the 00s decade. It is limited to any-source joins (ASM).
To avoid further quibbling over the meaning of the term "undocumented" as it
applies to this change, I have chosen to use the wording "non-IETF-ratified
extension" in comments, with reference to the updated ip6(4) man page.
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
netinet6: Add a definition of struct ip6_hdr_pseudo{} for OCF compatibility.
This change is intended to address @glebius comments from the original D55663.
ip6_hdr_pseudo{} is referenced by certain OpenBSD OCF related components. I am
using __aligned(4) and not __packed as urged by the late Hans-Petter Selasky.
Use C99 types and style. We must eat the churn now cross-BSD compatibility
is "Fade to Black".
Put _Static_assert under #ifdef INVARIANTS to not disrupt regular compilation,
as this resides in a commonly included header file.
tcp: improve SEG.SEQ validation for RST segments
A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.
The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.
For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.
When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,
[10 lines not shown]
igc: Correct hardware error statistics
Track RERC separately instead of adding receive errors to the collision
count, and read the previously omitted RXERRC register. Include RFC in
input errors because CRCERRS does not count bad-CRC runts, implementing
the I225 length-error accounting workaround alongside RUC and ROC.
Stop treating host transmit MAC discards as receive errors. Expose both
RERC and HTDPMC as dedicated MAC statistics so their overlapping counts
remain available without corrupting aggregate interface counters.
MFC after: 2 weeks
igc: Work around I225 v1 minimum IPG erratum
I225 v1 cannot receive the minimum inter-packet gap required at
2.5 Gb/s. For affected back-to-back links, Intel recommends using a
15-byte transmit IPG instead of 12 bytes.
Program TIPG.IPGT to 0xb for pre-v2 I225 devices at 2.5 Gb/s and
restore the default at lower speeds. Avoid penalizing fixed I225 and
I226 parts.
MFC after: 2 weeks
igb: recover retained i350 admin interrupts
I350 can retain EICR.OTHER with MDDET and LVMMC asserted while the
admin vector and legacy cause remain enabled. The anti-spoof filter
continues dropping packets, but no MSI-X is delivered and the spoof
diagnostic is lost.
Preserve the one-shot setup drain across iflib reset preparation,
clear ICR before LVMMC during i350 setup, and kick the enabled admin
vector from each admin pass. The synthetic no-cause interrupt stays
in the filter and also releases a retained MDDET cause.
Keep 82576 drain ordering and stop-time cleanup unchanged.
igb: drain stale MDD state before interrupt arm
IOV policy setup can leave MDDET and its read-clear diagnostic
registers populated while the admin vector is masked. Carrying that
state across the unmask can suppress the next spoof-event edge.
Mark initialization for a one-shot drain and consume LVMMC, WVBR when
applicable, and ICR immediately before EIMS/IMS arms the vector.
Preserve the synthetic link-status cause across the arm-time ICR read,
and clear the one-shot latch at reset preparation.
igb: preserve coalesced 82576 MDD events
WVBR is read-clear, so reading it from the deferred admin pass loses
earlier queue bits when multiple VF malicious-driver events arrive
before that pass.
Snapshot WVBR in the interrupt filter, translate its staggered queue
bitmap to pool bits, and OR observations into software latches for
deferred notification and recovery.
Retain the one-queue VMDq policy used for mixed-driver safety (the
vswitch cannot handle a 2Q guest loopback to a 1Q guest per errata).
igc: Disable PCIe L1.2 on I225
I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3. Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.
Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.
PR: 265714
MFC after: 4 days
e1000: clear VFTA when last VLAN is removed
The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.
Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.
