mbuf: Match TCP RSS hash types exactly
RSS hash types are encoded values, not independent flags. The bitmask
check in M_HASHTYPE_ISHASH_TCP() also accepts UDP, address-only and opaque
hash types, causing the syncache to retain them instead of falling back
to a software TCP hash.
Compare against the three TCP four-tuple hash types after masking the
inner-header flag. Keep the existing macro interface and use an inline
helper to preserve single evaluation of its argument.
Add ATF coverage for all 256 hash-type byte values, including inner-header
hashes, and verify single evaluation of the mbuf argument.
Reviewed by: cc, gallatin
Fixes: a485399f8834 ("tcp: restrict flowtype copying to specific RSS TCP types")
Sponsored by: BBOX.io
atf: refer to `common.mk` using `SRCTOP`
This helps make the dependent Makefile (and the values contained within)
easier to catch when upgrading atf in the future.
MFC after: 1 week
Change invalid reference LE_Set_Scan_Parameters to LE_Set_Scan_Param
hccontrol(8) lists "LE_Set_Scan_Parameters" as a subcommand, but it does
not work on recent releases. Use the LE_Set_Scan_Param instead as that
seems to be the new name according to the source file. Update the man
page accordingly.
PR: 300178
Event: Oslo Hackathon 2026
libthr: Robust tryjoin test
We cannot actually rely on a status (finish) before thr_exit. The
thread needs the kernel signal status=1 to userspace. Before that,
any tryjoin fails. The previous one works as we sleep 1 and should be
enough for normal case.
Reviewed by: kib, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60832
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[6 lines not shown]
Revert "bind_all_fibs: Disable bind_all_fibs by default"
This reverts commit 714433a6772b346723341735ef9547f672d9d2a3.
There were issues reported by markj
I will hold this commit until those are fixed.
rk_pinctrl: Fix the drive strength of the pins on the older SoCs
rk_pinctrl_parse_drive(), used for every Rockchip SoC but the RK3568, could
never succeed and so the drive-strength of the pins was never programmed:
- OF_getencprop() returns the size of the property, but the result was
tested against 0. A present property made the function return an error.
- The register offset of the matching table entry was never returned, so
the caller used whatever was left in reg (the pull register or an
uninitialized value). Fixing only the first problem would have written
the drive value in the wrong register.
- The table lookup skipped an entry only if both the bank and the subbank
differed, so an entry matching only one of them could be used.
Test the size of the property, skip an entry if either the bank or the
subbank differs and return the offset of the entry.
Tested on a Rock64 (RK3328) by clearing the drive strength of the gmac pins
in U-Boot: without this change they stay at 2mA, with it they get the 4mA
[8 lines not shown]
rk_pinctrl: Fix the drive strength of the RK3568 pins
The drive strength of the RK3568 pins was never programmed. The drive-strength
property was tested with OF_getencprop() == 0 but that function returns the
size of the property on success, so the branch was dead code and the pins kept
whatever the previous stage of the boot left in the registers.
The register layout was also wrong: each pin has an 8 bits wide drive field
and a register holds two pins, but the value was shifted by pin % 2 bits
instead of (pin % 2) * 8 and the mask only covered six bits. An odd pin would
have overwritten part of the field of the even pin next to it.
Test the size of the property, put the field at (pin % 2) * 8 and write the
whole 8 bits, like Linux does.
Tested on a Quartz64 Model A and on a NanoPi R5S.
Reviewed by: mmel
rtld: free heap donelists abandoned by the lookup restart
A symbol lookup done under the read-locked rtld_bind_lock is restarted
with the write lock when it needs to load filtees. The restart is done
by siglongjmp() from lock_restart_for_upgrade(), which skips
donelist_free() for the heap donelists of the unwound frames. Only
do_dlsym() freed one such donelist, tracked by SymLook.donelist_mem.
The donelist of symlook_default() called from _rtld_bind(), the
donelist of get_program_var_addr() called for dlopen(RTLD_TRACE), and
the donelists of nested symlook_obj_load_filtees() calls were leaked.
Link the heap donelists allocated under the read lock into the list
owned by RtldLockState, which also owns the sigjmp_buf, instead of the
symlook request.
Fixes: 1e370f038778 ("rtld: stop using unbound alloca()")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
bind_all_fibs: Disable bind_all_fibs by default
net.inet.{tcp,udp,raw}.bind_all_fibs was set to 1 for backward
compatibility. Set to 0 by default to drop them all unless an inpcb
bound to the same FIB exists.
While here, Add an UPDATING entry for behaviour change.
Relnotes: yes
Reviewed by: markj
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/73
memset.3: Fix .Fn usage and too many commas
Fix wrong usage of .Fn macro in paragraph for `memset_explicit' that
caused too many commas improperly emitted into rendered manual page.
Approved by: des
MFC after: 1 week
Makefile.inc1: Make bootstrap mandoc's bootstrap libz dependency conditional
We bootstrap libz unconditionally on macOS and Linux, and conditionally
on FreeBSD if pre-1600029 or DISK_IMAGE_TOOLS_BOOTSTRAP is enabled, but
if building on new enough -CURRENT without DISK_IMAGE_TOOLS_BOOTSTRAP
then libz is not bootstrapped and so this libz dependency does not
exist. Add the dependency whenever we are bootstrapping libz but not
otherwise, and do so without duplicating the condition.
Fixes: 1dbcc7ee92c4 ("Makefile.inc1: Make sure mandoc bootstrap tool depends on libz")
MFC after: 1 week
libc: Fix stack buffer overflow in cgetnext()
`cgetnext()` copies a capability record's name field into a fixed
1024 byte on-stack buffer (`nbuf[BSIZE]`) one character at a time,
but never checks that the write pointer stays within the buffer.
Therefore, a record name that is longer than `BSIZE` (either on a
single line, or accumulated across several `\`-continued lines as
the pointer is not reset amidst continuation) writes past the end
of `nbuf` and smashes the stack.
The name field is read directly from the capability file, so any
consumer of `cgetnext()`/`cgetfirst()` that processes an untrusted
`termcap(5)`- or `printcap(5)`-style database (e.g. `cap_mkdb(1)`,
`lpr(1)`, or any third-party caller) can be exposed and hence made
to corrupt the stack.
Reviewed by: fuz, dteske
Approved by: fuz (mentor), dteske (mentor)
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2309
pci: Reserve bus numbers required by SR-IOV VFs
Some firmware assigns only one bus number to each PCI-PCI bridge. This
prevents later SR-IOV VF enumeration when a VF routing ID falls on a bus
number already allocated to a sibling bridge.
Reserve only the additional bus numbers required by SR-IOV PFs.
Enumerate all directly attached functions before child drivers and
bridges attach, inspect their device_t objects for SR-IOV, and grow the
PCI bus resource through the highest possible VF routing ID.
First VF Offset and VF Stride may change when NumVFs changes. Probe
every valid NumVFs value and preserve the original setting. When the
upstream hierarchy uses ARI, temporarily enable the SR-IOV ARI Hierarchy
control in the lowest-numbered PF while sizing, then restore it. Scope
active-VF detection to each conventional PCI slot; an ARI bus remains
one slot-0 hierarchy. If firmware left VFs enabled on a device, do not
modify it and reserve only its active layout.
[21 lines not shown]
pci_iov: Reuse downstream bridge bus window if it already covers VF bus
If the parent bridge's [secondary, subordinate] window already covers
the VF bus (e.g., programmed by BIOS or a prior PF), skip allocating
PCI_RES_BUS. This avoids a duplicate rman allocation in the multi-PF
case while still allocating when growth is actually needed.
Reviewed by: ssaxena
Differential Revision: https://reviews.freebsd.org/D52163
(cherry picked from commit feb0a7e19f3c2e4c7eb90668b1e3dc34b5bb6dd6)
ixl(4): Fix NVM update API
Driver provides an interface for tools operating on adapters'
Non-Volatile Memory using SIOC(G|S)DRVSPEC ioctls. It allows
tools to issue Admin Queue commands to the firmware, which
may return an error code encoded as a negative integer.
The driver passed this negative integer as the return value
of the ioctl handler. This was causing issues because the FreeBSD
kernel reserves negative error codes in system calls for special
purposes such as restarting the handler or detecting incorrect
behavior in VFS operations. Simple remapping of negative values
to positive integers caused currently available tools to misbehave
and could break the NVM update process. Introduce a new API version,
which allows new versions of tools to detect the fixed driver.
Temporarily keep the old API, but issue a warning that tools need
to be updated.
Also refactor the code to use centralized cleanup and move the
debug message from the firmware earlier to make sure it is not masked
[10 lines not shown]
cxgbe(4): Fix netmap rx behavior with nm_split_rss
The driver should look for active queues and one potential default-queue
in both halves of the split instead of stopping at the first valid
default-queue.
Fixes: a9f476580eb0cxgbe(4): fixes for netmap operation with only some queues active
Sponsored by: Chelsio Communications
(cherry picked from commit 77d71f5f36cc01e7fc2ca0828af00a4478bbf53c)
em(4): fix capability bounds needed to access checksum context.
Ensure the offp capability bounds cover entire struct with checksum fields.
This is needed for CHERI systems to avoid bounds violation trap, as
otherwise offp allowed to dereference 4 bytes of csum_flags field only
so bzero failed.
Tested on ARM Morello.
Reviewed by: kbowling
Discussed with: jrtc27
Sponsored by: CHERI Research Centre
Differential Revision: https://reviews.freebsd.org/D53903
(cherry picked from commit 64ee9c166ce5e807e575d205ac2e15cc5cf6581b)
vtnet: remove M_HASHTYPE when there is only one pair of rx/tx queue
Summary:
Doing so will let the upper layer know how to deal with software hash,
with benefits like inp_flowid can be set and m_pkthdr.flowid can be set
in output path.
Reviewed by: tuexen
Differential Revision: https://reviews.freebsd.org/D54929
(cherry picked from commit 20285cad7a55ecd0020f51f3daee74db8b1ea5a0)
