Add a QUIRK_EMPTY_NAMESPACE_CHANGED_LOG quirk which indicates that the
nvme controller may not properly populate the namespace-changed log
page. If we receive a NVME_LOG_CHANGED_NAMESPACE page for a device
with this quirk and the page is empty, probe all of the namespaces
rather than none of them.
Reviewed by: imp
MFC after: 1 week
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D58231
We reach ndaasync with the CAM device lock held, so we must pass
M_NOWAIT to disk_* rather than M_WAITOK.
Reviewed by: imp
Fixes: 628d7a3270 ("nda: AC_GETDEV_CHANGED calls media chanaged for sectorsize change")
MFC after: 1 week
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D58230
When configuring the expire timeout to something short, make sure that the
prune time runs at least at that interval. Similarly, when adjusting the
prune interval up, ensure the expire timeout reflect that expected minimum
time also. Finally, restart the callout timer so that the next pruning
happens after the new, expected interval.
Reviewed By: glebius
MFC after: 2 weeks
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D58424
Restrict the scope of the struct hc_metrics_lite to the kernel only.
Update the naming to align with other kernel structures and add a tcp_ prefix.
Reviewed by: glebius
MFC after: 2 weeks
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D58440
Add tests for both IPv4 and IPv6 routes with the prefsrc attribute.
Also test IPv4 routes over IPv6 nexthops and borrow their IPv4
addresses from the loopback interface.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58326
Add prefsrc option that is frequently used on unnumbered interfaces
or L3 multi-homed network hosts.
This option uses RTA_PREFSRC.
Now you can add a static route by specifying the prefsrc option
with the loopback IP.
PR: 285422
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58294
Add the ability to select source ip address of outgoing packets
even when the source ip address is configured on another interface.
Also add this new rtnetlink attribute to manual.
PR: 285422
Reviewed by: glebius, ziaee (manpages)
Tested by: ivy, Marek Zarychta <[email protected]>
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D58294
nd6_prefix_onlink will enter net_epoch when necessary.
Also, exit net_epoch earlier in nd6_prefix_onlink,
Because we acquired a reference to ifa, and we got our ifa
from the pr->ndpr_ifp, we don't need to stay under epoch.
While here, style it.
Reviewed by: markj, glebius
Discussed with: zlei
Differential Revision: https://reviews.freebsd.org/D56129
nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
uses that pointer afterwards to set nd_ra.
When m_pullup() relocates the chain it frees the original first mbuf and
returns a new one, leaving ip6 dangling; the subsequent access may be a
use-after-free read.
The fix writes ip6 from the returned mbuf after m_pullup() inside the
conditional if.
Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D58229
When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.
The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.
The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.
Reported by: Lukas Book <[email protected]>
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58484
to avoid using uninitialized value in the KASSERT() statement on the first
iteration.
Also, do the assert under the proctree_lock, which is not critical but
satisfies the invariants.
Noted and reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58505
This change hooks everything up to the pmc command and improves the
usage to document all functions. There are a couple older commands that
are currently broken that I have hidden from the usage, but left in the
code for those using it. I won't remove those until we have our
replacements upstreamed that depend on the AMD PMC multiplexing patches.
Sponsored by: Netflix
Reviewed by: adrian, imp
Differential Revision: https://reviews.freebsd.org/D57780
The frontend command uses AMD IBS frontend events to analyze the major
sources of frontend stalls. It displays a table breakind down the major
causes of front end stalls. This is a simple demonstration of the tools
as you can use the filtering tools to limit the analysis to a subset of
the samples including filtering by fetch latencies.
Sponsored by: Netflix
Reviewed by: adrian, imp
Differential Revision: https://reviews.freebsd.org/D57779
Prints the log header including machine, cpu and kernel details along
with what counters were selected.
Sponsored by: Netflix
Reviewed by: adrian, imp
Differential Revision: https://reviews.freebsd.org/D57778
The record command is designed around the idea of predefined studies.
While you can still select individual counters, the predefined studies
are meant to enable the best hardware options for a given generation.
It implements all of the base studies that I have built so far.
Sponsored by: Netflix
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57777
View is a class for building PMC log processing tools it is designed to
work with the new PMC record command that adds a header with additional
CPU information. The new framework processes PMC logs about 2.5 times
faster and in about half the code as libpmcstat.
Sponsored by: Netflix
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57776
Initializes the terminal rendering code used by the new pmc tools. Then
provides a table abstraction for collecting, sorting and rendering
tables. It provides pretty printed results with typed fields that print
several types used throughout the new PMC tools. By default the fields
are formatted in engineering notation.
Sponsored by: Netflix
Reviewed by: adrian, imp
Differential Revision: https://reviews.freebsd.org/D57775
{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.
Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.
Reviewed by: kbowling, gallatin
Approved by: kbowling
MFC after: 1 week
MFC to: stable/14, stable/15
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58513
amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.
Reviewed by: mhorne
Approved by: mhorne
MFC after: 1 week
MFC to: stable/14, stable/15
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58468
This may plug minor leaks which no-one has reported. The default IPv6 source
address selection policy list in FreeBSD is usually limited to 9 entries,
and can be readily inspected with ip6addrctl(8). The policy table is
however instantiated for each VNET.
The leak of a pol instance in delete_addrsel_policyent() was already
plugged by @ae in commit-id ecc5c73, so that change has not been merged.
Do not tear down the sxlocks as glebius has requested, and move the
addrsel_policyent{} declarations further up to avoid redundant forward
declarations as glebius requested for stylistic reasons.
Reviewed by: ae, pouria
Sponsored by: Cisco Systems, Inc.
Differential Revision: https://reviews.freebsd.org/D55599
Revert UseBlocklist from SSHCFG_ALL to SSHCFG_GLOBAL (with
SSHCFG_COPY_NONE), ensuring it can only be set globally in sshd_config
rather than within conditional Match blocks, matching historical
behavior.
Reviewed by: emaste
Fixes: bb5c77e9d2 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D58520
Neither of these options are checked in the file and cdefs.h should not
be included explicitly. No functional change.
Sponsored by: The FreeBSD Foundation
Register PMC_CLASS_RAPL in libpmc: event table, allocator, class-table
descriptor, and the event-name/class-listing lookups, all x86-guarded
and modeled on the TSC class. Energy events are read-only and
unqualified. The class prefix (RAPL-) supplies the friendly spelling, so
pmcstat -S rapl-energy-pkg resolves to the canonical ENERGY_PKG event.
Add a pmc.rapl.3 manual page documenting the events, counter scope, the
microjoule unit and wrap handling, and the NUMA/package domain mapping;
link it from pmc.3.
Reviewed by: mhorne
Discussed with: Ali Mashtizadeh <[email protected]>
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D58029
Add hwpmc_rapl.c/.h implementing PMC_CLASS_RAPL, a read-only
system-scope class modeled on TSC and wired into x86 AMD and Intel MD
init. A per-vendor MSR table covers AMD/Hygon and Intel; energy is
reported in microjoules, with the Intel server 2^-16 J DRAM unit
handled and 32-bit wraps recovered into a 64-bit accumulator.
The overflow guard follows the PMC lifetime: armed on the first
allocated PMC, callout_drain()d on the last release, and each tick only
rendezvouses CPUs holding one. Per-CPU spin locks guard the accumulator
against torn reads on i386. PMC_CAP_DOMWIDE lets pmcstat(8) allocate
one counter per NUMA domain instead of per CPU.
Reviewed by: mhorne, Ali Mashtizadeh <[email protected]>
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D58028
specialreg.h is the tree's MSR registry and already carries the Intel
RAPL group. Add the AMD RAPL package/core energy and unit MSRs here so
the hwpmc RAPL class can reference them without a private driver copy.
Use the names Linux's msr-index.h gives these registers.
Reviewed by: mhorne, adrian, Ali Mashtizadeh <[email protected]>
MFC after: 3 days
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D58027
This module has several source files, with many conditional on the
platform architecture. Make it easier to read, and better for future
diffs against these lists.
- Convert to one SRC per line
- Simplify arm/armv7 condition
- Remove now-empty header comment
- Minor formatting
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Some NLM_F_ definitions contain multiple underscores in their name; this
should pick them up.
Reviewed by: kp, Ishan Agrawal <[email protected]>
Fixes: 4c932a4d45 ("netlink: decode netlink message flags symbolically")
Sponsored by: The FreeBSD Foundation
Pull Request: https://github.com/freebsd/freebsd-src/pull/2340
[libunwind][PPC64] Fix unw_getcontext corrupting callee-saved VSX registers on LE (#198371)
This is the first of two independent fixes for libunwind on ppc64le
(ELFv2 ABI, little-endian), where two separate bugs together cause
SIGSEGV during backtracing. This commit addresses the VSX register
corruption; the TOC-restore fault is handled in a follow-up. Both
were discovered while debugging lang/rust build failures with
RUST_BACKTRACE=1 on FreeBSD/powerpc64le (IBM POWER9).
On ppc64le, `unw_getcontext` saves each VS register with an in-place
`xxswapd n, n` followed by `stxvd2x`. The swap is needed because
`stxvd2x` stores doublewords in the wrong order on LE. However, the
macro never applies a second `xxswapd` to restore the register after
the store, so all 64 VS registers are permanently corrupted on return
from `unw_getcontext`.
This affects every callee-saved VSX register: f14-f31 (VSR14-VSR31)
and VR20-VR31 (VSR52-VSR63). After `_Unwind_Backtrace` returns, any
code that uses these registers sees wrong values. In practice this
manifests as SIGSEGV inside hashbrown's `reserve_rehash`: VR20-VR31
are corrupted before a SIMD comparison loop runs, producing an
out-of-bounds access.
Fix: add a second `xxswapd n, n` after the `stxvd2x` store. Since
`xxswapd` is its own inverse, the pair is a no-op on the architectural
register while still writing the correctly byte-swapped value to memory.
MFC after: 1 week
In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.
MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426
Show nhop flags like invalid nexthop to debug cases like
the PR below.
PR: 296883
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58347
If we have source address specified, try to find it by enumerating
ifas on specified fib.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58444
We used to pass CONFIGURE_ARGS to the make command which builds pkg,
but ports/ports-mgmt/pkg/Makefile has its own CONFIGURE_ARGS and the
version we were providing at the command line didn't contain the
--mandir setting which was added to the port with pkg 2.8.0. This
broke release builds.
Instead of passing --prefix=${LOCALBASE} via CONFIGURE_ARGS, pass
PREFIX=${LOCALBASE}; the port Makefile passes that value through to
its configure script. We also used to pass a --host parameter, but
that seems to have become unnecessary at some point in the past decade.
MFC after: 1 day
Sponsored by: Amazon
Otherwise an assertion in umtx_thread_alloc()
(TAILQ_EMPTY(&uq->uq_pi_contested)) is violated.
This use of TDB_EXIT is hacky, but I cannot see another way to check for
an exiting thread without adding some more overhead to kern_thr_exit().
Fixes: 2a339d9e3d
Reported by: Maik Muench of Secfault Security
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58447
Other in-flux operations are implemented by this set of macros, so we
should do the same for sleeping.
No functional change intended.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58443
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
Several functions were using sprintf() to write RPC server-controlled
data to a stack buffer. Adopt some minimal changes from NetBSD to avoid
the potential overflows.
Security: CVE-2026-16277
Security: CVE-2026-16461
Reviewed by: khorben
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58441
After commit 848f360c8f, if one tries to connect to a closed port,
fetch reports "Operation now in progress", which is rather confusing.
Return a more useful error message, restoring the old behaviour.
Fixes: 848f360c8f ("libfetch: Apply timeout to connection attempts")
Reviewed by: des
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58481
IPv4 multicast currently has the big caveat that it depends on the first
assigned IPv4 address on an interface (the so-called "primary address").
in_ifprimaryaddr() only needs to be used by the following:
- the 0.0.0.0 booting node input workaround in IGMPv1;
- filtering out the node's own reports in IGMPv2;
- preserving the source IP where an IGMPv3 report has been looped back;
- inferring the default upstream IPv4 interface address for the
IP_MULTICAST_IF socket option;
- and inferring the source address during ip_output() for a multicast
datagram where an interface has been explicitly specified by that option.
All of these uses mandate the use of IPv4 source address selection, but
FreeBSD does not yet (fully) implement this functionality.
Approved by: glebius (2026-02-26)
Reviewed by: adrian, glebius, pouria
Differential Revision: D55345
in_ifprimaryaddr() exists only to support IPv4 multicast usage. Since the
adoption of epoch tracking, ifa_ref() is no longer required in its body;
that was originally introduced by rwatson in 2009.
We could not use __deprecated1() from <sys/cdefs.h> anyway, as
IFP_TO_IA() is a macro, not a function.
Approved by: glebius (2026-02-26)
Reviewed by: adrian, glebius, pouria
Differential Revision: D55344
This removes just one level of #define mess that is needed to reach into
an inpcbs IPv4 address. And makes the declaration easier to read. No
functional change.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58273
Colin Percival