We checked the state's expiry time to make sure it was large enough to
not underflow if we subtracted the already expired time from the remote
end, but we failed to account for the state's expiry time being in
miliseconds and the pfsync time delta being in seconds.
Take that multiplication by 1000 into account.
Fixes: 78b620b781 (pfsync: avoid underflow on different timeouts, 2026-10-21)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
If nlmsg_reply() or nlmsg_end() in pf_handle_trans() failed we did not
call pf_trans_free(), leaking the pf_trans_e elements in it.
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
Make hastd remove its pidfile before exit after catching a signal or a
stop control message, not just on failure to start.
MFC after: 1 week
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D60192
When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60904
When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.
Reported by: n0ps1ed
Reported by: Franz Bettag <[email protected]>
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60903
When the SSL handshake cannot proceed because the server is slow to
respond, poll() with a timeout instead of spinning.
MFC after: 1 week
PR: 298962
Event: Oslo Hackathon 2026
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60975
Support for Incoming Message Signalling Interrupt Controller (IMSIC)
defined by the RISC-V Advanced Interrupt Architecture (AIA) specification.
This is based on early work of Himanshu Chauhan on IMSIC support for
IPI delivery. This change, however, does not include IPI delivery support,
instead it provides MSI support for peripheral devices.
IMSIC is a core-local interrupt controller with non-global interrupts,
which means that interrupt identity is effectively (hart, interrupt ID).
When IMSIC present on hart, APLIC does not trap the CPU directly,
instead it delivers the interrupt to the IMSIC instance associated with
the target hart. Upon reception of interrupt, IMSIC on hart invokes APLIC
for handling. Note that PCIe devices deliver interrupt directly to IMSIC.
Apart from IMSIC support, this includes APLIC changes:
- Obtain the interrupt trigger type from FDT and configure the interrupt
accordingly (e.g. level or edge-triggered);
- Per the AIA requirement, level-triggered MSI interrupts must be
retriggered manually after being handled. See the comment in
aplic_post_ithread();
- Reorganize APLIC register definitions to have some structure.
Reviewed by: mhorne
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D59695
Convert the RISC-V Interrupt Controller (INTC) device to a bus;
try to find and attach Incoming Message Signalling Interrupt Controller
(IMSIC) device.
This allows to establish parent-child relationships between two and
to propagate PIC_INIT_SECONDARY call from the INTC (parent) to the
IMSIC (child).
Reviewed by: mhorne, mmel
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D59813
Firmware controls the physical link state on E610 adapters, similarly to
X700 and E800 adapters. As a result, running "ifconfig down" does not
disable the physical link unless Total Port Shutdown is enabled.
Read the Link Default Override TLV from NVM to detect when Total
Port Shutdown was enabled for given port in system setup. In that
case, force the link down when the interface is stopped and restore
it during link configuration. Leave link state management unchanged
when the TLV is unavailable or the feature is not enabled.
Co-authored-by: Miłosz Linkiewicz <[email protected]>
Co-authored-by: Tomasz Lichwala <[email protected]>
Signed-off-by: Krzysztof Galazka <[email protected]>
Tested by: Mateusz Moga <[email protected]>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D60643
Older Thor2 firmware serves key context allocation requests very
slowly, about a second each. The driver allocates key contexts in
batches of 128, so setting up 500k sessions takes roughly 3900
requests and driver load appears to hang.
Enable hardware kTLS only when the firmware's HWRM interface version
is 1.10.3.99 or newer. Keep the full four-part version in
hwrm_spec_code_ext for the comparison.
Also add a disable_hw_ktls loader tunable that turns hardware kTLS off
for a device without unloading kTLS support, which helps isolate kTLS
problems in the field.
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60977
On RoCE-capable Thor2, attach fails with
HWRM_FUNC_BACKING_STORE_CFG_V2 returning INVALID_PARAMS, as MRAV is
sized the pre-V2 way and the firmware's AV split value is sent as is.
Size MRAV from the AV split entry, and move the legacy entry-count
packing into bnxt_hwrm_func_backing_store_cfg().
Fixes: d5ce906da7 ("bnxt_en: Add backing store V2 support")
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60976
The ice_cfg_tx_topo function attempts to apply Tx scheduler topology
configuration based on NVM parameters, selecting either a 5 or 9 layer
topology. As part of this flow, the driver acquires the "Global Configuration Lock",
which is a hardware resource associated with programming the DDP package
to the device. This "lock" is implemented by firmware as a way to
guarantee that only one PF can program the DDP for a device. Unlike a
traditional lock, once a PF has acquired this lock, no other PF will be
able to acquire it again (including that PF) until a CORER of the device.
However, if configuration of the Tx topology fails, (i.e.
ice_get_set_tx_topo returns an error code), the driver exits
ice_cfg_tx_topo() immediately, and fails to trigger CORER.
While the global configuration lock is held, the firmware rejects most
AdminQ commands, as it is waiting for the DDP package download (or Tx
scheduler topology programming) to occur.
Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the
global lock, regardless of success or failure of the topology
configuration.
We need to re-initialize the HW structure when we trigger the CORER.
Previously, this was the responsibility of the core driver to cleanup after
the CORER. Instead, make it the responsibility of this function. This
avoids needless re-initialization for the cases where no reset occurred.
Authored-by: Jacob Keller <[email protected]>
Co-Authored-by: Pawel Sobczyk <[email protected]>
Signed-off-by: Sobczyk, Pawel <[email protected]>
Reviewed by: kbowling
Tested by: Mateusz Moga <[email protected]>
MFC after: 3 days
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D60168
Only the default PSI IDs are supported, other controllers fall back to
USB 3.0. Record the speed IDs the controller has: the root hub BOS
lists those, and a link without one uses the closest lower ID.
Per xHCI 6.2.2, take the parent hub slot ID and port number of SS and
SSP devices from the closest higher-rank hub.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52347
An SSP hub reports its sublink speeds in the BOS descriptor, and
Extended Port Status tells which one each port uses. Read it based on
bcdUSB, since the ports of a hub can be faster than its upstream link.
Without it, the ports are treated as SuperSpeed.
Read the speed again in usbd_req_re_enumerate(), since a link can come
back at another speed.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57204
Add the SuperSpeedPlus USB Device Capability descriptor and its field
macros.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57203
Get the header or the complete BOS descriptor of SS+ devices.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57202
usbd_req_get_ext_port_status() wraps the Get Extended Port Status
request.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57201
Extended Port Status reports the speed and lane count of SS and SSP
links.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57200
Handle the new speeds wherever USB_SPEED_SUPER was checked. Most
consumers treat them as SS.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57198
libusb has one speed for all SSP links, so print "SUPER+ (>=10Gbps)".
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57196
Report the new kernel speeds as LIBUSB20_SPEED_SUPER_PLUS.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57195
Add the USB 3.1 and 3.2 speeds and revisions. The speeds are in USB
3.2 rank order, so they can be compared directly.
Also, move USB_*_MAX into the enums.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57194
Enable the FreeBSD-base repository in all of the /etc/pkg/FreeBSD.conf
variants, and remove code from various install paths which enabled the
repository via /usr/local/etc/pkg/repos/FreeBSD.conf.
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D60946
Remove the "NODISTSETS" option and add a "DISTSETS" option. This
option will remain, disabled by default, for the duration of the
16.x branch but will be removed in 17.0.
With hat: re
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D60945
Distribution sets are going away, so we can't extract those into GCE
images for all-source-code-included compliance purposes.
Differential Revision: https://reviews.freebsd.org/D60944
Some PFs reject a redundant DISABLE_QUEUES request after queues have
already stopped. The historical driver retried the request but
continued. The mailbox recovery change instead treated this NACK as a
transport failure, tore down the Admin Queue without a VF reset, and
could not recover the interface during API rediscovery.
Track a PF's pre-reset warning separately from an observed reset and
from exclusive ownership of polled AdminQ replies. RESET_IMPENDING
leaves asynchronous AdminQ processing available so a concurrent stop
can consume its DISABLE_QUEUES reply. VC_POLLING protects VERSION and
GET_VF_RESOURCES rediscovery without blocking that reply. Record
completed resets so subsequent stop/init operations do not issue a
redundant queue-disable request.
If queue disable is not confirmed, wait for an observed reset or request
a VF reset and wait for completion. Give queue shutdown a separate
60-second monotonic deadline to accommodate slow PF reset recovery.
Propagate reset submission failures and restore the previous RSTAT
value when no request was submitted. Clear the attach-time recovery
marker before the first runtime stop/init cycle, and suppress RSS
status reporting during reset recovery.
This implements the native recovery portion of D58904, with PCI
containment and permanent failure handling deferred. If native shutdown
cannot be confirmed, report the failure and leave recovery pending.
Shutdown remains best effort because IFDI_STOP cannot return an error
to prevent iflib from releasing queue resources.
Matched hardware testing against the parent on E810 with two four-queue
VFs covers 18 TCP smoke runs, 40 down/up cycles, three PF resets, and
three CORE resets per kernel. The change eliminates all 12 observed
"PF mailbox rediscovery failed: 60" messages and reduces the longest
UDP delivery gap per CORE reset from 3.43-3.57 seconds to 2.62-2.67
seconds.
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58904
When a CREATE_SESSION with the extant ClientID failed with
NFS4ERR_STALE_CLIENTID within nfsc_renew of the previous full recovery,
nfsrpc_setclient() returned EIO and the mount did no I/O until that window
expired (about 45s).
The server has discarded the ClientID, so waiting cannot help; RFC 8881
Section 8.4.2 requires a new ClientID (EXCHANGE_ID) and a state reclaim.
AWS EFS discards both the session and the ClientID of clients whose lease is
current whenever it resets a connection, which makes this path common there.
PR: 299221
Approved by: rmacklem@
Sponsored by: Netflix
The NFSv4.1/4.2 session negotiates a limit to the size
of an RPC reply message that can be cached for the session
slot.
This patch fixes the code so that it checks that limit and
does not cache replies larger than the limit, even if the
client requested that it be cached.
This patch is slightly different than what the author
submitted, but retains the check for reply cache size limit.
Reviewed by: rmacklem
MFC after: 1 month
sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE
control message holding only a cmsghdr, and sent that stale byte.
Approved by: markj
Fixes: b2e60773c6 ("Add kernel-side support for in-kernel TLS.")
Sponsored by: Netflix
The Add VSI AdminQ command requires an absolute hardware VF number, while
vsi->vf_num is relative to its PF. Add the PF's vf_base_id, as the VF Tx
queue context already does.
On an E810 PF with vf_base_id 128, relative VFs 0 and 1 were associated
with hardware VFs 0 and 1 instead of 128 and 129. Their receive queues
became blocked and both native iavf and DPDK receivers dropped traffic.
A PF whose VF base is zero hides the error.
Validated the VSI-to-function mapping and receive traffic on that PF,
including VF reset recovery and local PF/VF forwarding with VSI loopback
enabled.
Fixes: bc761988b7 ("ice: Add host SR-IOV support")
MFC after: 2 weeks
Sponsored by: BBOX.io
The embedded switch installs local forwarding rules with loopback enabled,
but their source VSI must also permit loopback. Without that permission,
traffic between host-attached VFs can trigger Tx data MDD events instead
of reaching the destination VSI.
Set ICE_AQ_VSI_SW_FLAG_ALLOW_LB when initializing a VSI in VEB mode, matching
the forwarding rules to the VSI permission. Keep MAC anti-spoof checking
enabled.
Validated on E810 with native iavf and DPDK VFs, together with the absolute
VF number correction. Local forwarding and queue/reset recovery passed;
spoofed source MACs were still rejected and isolated.
Fixes: bc761988b7 ("ice: Add host SR-IOV support")
MFC after: 2 weeks
Sponsored by: BBOX.io
When pmap_clear_modify() demotes a dirty L2 block mapping, it write
protects the L3 entry that maps "m", so that a subsequent write access
may repromote. However, since fd6cb031f5, the L3 entries created by
pmap_demote_l2_locked() may have ATTR_CONTIGUOUS set, and
pmap_clear_modify() was write protecting one L3 entry within an L3C page
while leaving the page's other L3 entries writeable with ATTR_CONTIGUOUS
still set. A TLB entry that a processor creates from any of those other
L3 entries may translate "m"'s virtual address and permit writes to "m"
without a fault. To fix this issue, as in pmap_remove_write(), demote
the L3C page before write protecting the L3 entry.
Found by: Claude Code (Opus 5.5)
Fixes: fd6cb031f5 "arm64 pmap: Add ATTR_CONTIGUOUS support [Part 1]"
MFC after: 1 week
DPDK iavf's per-queue stop/start operations send DISABLE_QUEUES followed
by ENABLE_QUEUES without another CONFIG_VSI_QUEUES. Disabling an ice Tx
queue removes its hardware scheduler leaf, so acknowledging ENABLE alone
cannot restart it. Clearing the configured bitmap also prevents the VF
from requesting this sequence.
Track saved configuration separately from active Tx queues. Retain ring
parameters and queue handles on disable, and recreate only the selected
inactive queues on enable. Share the existing Tx context builder between
initial VSI configuration and per-queue restart. Keep the initial
Tx-at-CONFIG behavior and the existing dense-prefix CONFIG validation.
Track cleanup progress per queue and publish valid configuration only
after both Tx and Rx configuration succeed. If an enable fails, undo its
partial setup before permitting a retry. Retain hardware ownership when
cleanup fails and reject another enable of that queue rather than
silently acknowledging it. A failed post-add rollback without a software
scheduler node requires VF reset, not a successful no-op disable.
After a verified VF reset and DMA drain, remove any remaining software
scheduler leaves and invalidate the queue contexts. Treat the initial
queue disable as best effort so a failed rollback cannot permanently
prevent reset recovery. Retain unresolved state if the reset or drain
fails.
Fixes: bc761988b7 ("ice: Add host SR-IOV support")
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59851
In vn_io_fault1(), the read / write length can easily exceed INT_MAX.
Passing it directly to uiomove(), which expects an int, results in a
negative uio_resid, which to the caller looks like we read more than
was requested.
PR: 298159
MFC after: 1 week
Reviewed by: olce, kib
Differential Revision: https://reviews.freebsd.org/D59412
update_ip6() left the UDP checksum stale for most packets. Unlike
update_ip(), it computed the incremental checksum delta only after the
source-address wrap, so every earlier "break" (port increment, address
increment, and both random paths) returned with udp_sum still 0 and no
correction applied. The trailing delta block also re-read oaddr/naddr
after they had been reassigned, so the source and destination deltas
could not both be accounted for.
Fold each delta in with new_udp_sum() before the corresponding break,
mirroring the structure update_ip() already uses, and drop the stale
trailing block. IPv4 was not affected.
Verified by driving update_addresses() directly and recomputing every
checksum from scratch over the real pseudo-header: 128 packets across
six range configurations, 12 mismatches before, 0 after. IPv4 passes
both before and after.
Submitted by: Olivier Cochard-Labbé <[email protected]>
COMPAT_FREEBSD8 does not exist as a kernel option, so this is dead code.
No functional change intended.
Fixes: e256f71389 ("kernel: add missed FEATUREs compat_freebsd 8-14")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: kib
Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/80
The calls to rpc_free_rdma_reduction() were removed, but I forgot
that newnfs_request() removes the reduction mbuf from the list
upon success, so it has to be free'd separately.
This patch does that.
The patch also disables reduction after the first loop interation.
This is necessary until nfsm_build_rdma_reduction() is patched
to handle an offset within the page array.
Reported by: markj
MFC after: 1 month
Fixes: 884ee8d6c9 ("nfscl: Add some glue for client side NFS over RDMA")
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
A previous iteration of this commit included the ISO from the PR. The
current iteration creates an ISO with makefs then corrupts it with a
small helper written in C that is a condensed version of the CD 9660
code. It checks the input ISO for a a Rock Ridge extension reference
then corrupts the length byte. This triggers the early failure in
cd9660_rrip_offset.
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296853
Signed-off-by: Josh Megnauth <[email protected]>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2462
Kristof Provost