AMD 10GbE hardware is designed to have two buffers per receive descriptor to
support split header feature. For this purpose, the driver was designed to use
2 iflib freelists per receive queue. So, that buffers from 2 freelists are used
to refill an entry in the receive descriptor. The current design holds good
with regular data traffic.

But, when netmap comes into play, the current design will not fit in. The
current netmap interfaces and netmap implementation in iflib doesn't seem
to accomodate the design of 2 freelists per receive queue. So, exercising
Netmap capability with inbuilt tools like bridge, pkt-gen doesn't work with
the 2 freelists driver design.

So, the driver design is changed to accomodate the current netmap interfaces
and netmap implementation in iflib by using single freelist per receive queue
approach when Netmap capability is exercised without disturbing the current
2 freelists approach.
The dev.ax.sph_enable tunable can be set to 0 to configure the single
free list mode.

Thanks to Stephan Dewt for his Initial set of code changes for the stated
problem.

Submitted by:	rajesh1.kumar_amd.com
Approved by:	vmaffione
MFC after:	3 weeks
Differential Revision:	https://reviews.freebsd.org/D27797

This patch has the driver for 10Gigabit Ethernet controller in AMD
SoC. This driver is written compatible to the Iflib framework. The
existing driver is for the old version of hardware. The submitted
driver here is for the recent versions of the hardware where the Ethernet
controller is PCI-E based.

Submitted by:	Rajesh Kumar <rajesh1.kumar@amd.com>
MFC after:	1 month
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D25793

  In certain cases (probably not during normal operation but observed in
  the lab during development) ip6_ouput() could return without error
  and ifpp (&oifp) not updated.
  Given oifp was never initialized we would take the later branch
  as oifp was not NULL, and when calling icmp6_ifstat_inc() we would
  panic dereferencing a garbage pointer.
  For code stability initialize oifp to NULL before first use to always
  have a deterministic value and not rely on a called function to behave
  and always and for ever do the work for us as we hope for.

  Sponsored by:	Netflix

iflib: Free full mbuf chains when draining transmit queues

PR: https://github.com/opnsense/src/issues/90

pfctl: Remove unused variable

Submitted by:	Nick Rogers
MFC after:	1 week
Sponsored by:	RG Nets

Fix test cases after r358448 (r358870 in stable/12)

sbin.pfctl.pfctl_test.pf0087
sbin.pfctl.pfctl_test.selfpf0087

Sponsored by:	The FreeBSD Foundation

pf: Fix incorrect assertion

We never set PFRULE_RULESRCTRACK when calling pf_insert_src_node(). We do set
PFRULE_SRCTRACK, so update the assertion to match.

Remove an uneeded indentation introduced in r223637 to silence gcc warnging

Sponsored by:	The FreeBSD Foundation

PR:		Neel Chauhan <neel AT neelc DOT org>

Submitted by:	Neel Chauhan <neel AT neelc DOT org>

Don't print VNET pointer when initializing dummynet

When dummynet initializes it prints a debug message with the current VNET
pointer unnecessarily revealing kernel memory layout. This appears to be left
over from when the first pieces of vimage support were added.

PR:		238658
Submitted by:	huangfq.daxian@gmail.com
Reviewed by:	markj, bz, gnn, kp, melifaro
Approved by:	jtl (co-mentor), bz (co-mentor)
Event:		July 2020 Bugathon
Differential Revision:	https://reviews.freebsd.org/D25619

Approved by:	so
Security:	FreeBSD-SA-20:33.openssl
Security:	CVE-2020-1971

netmap: fix parsing of legacy nmr->nr_ringid

Code was checking for NETMAP_{SW,HW}_RING in req->nr_ringid which
had already been masked by NETMAP_RING_MASK. Therefore, the comparisons
always failed and set NR_REG_ALL_NIC. Check against the original nmr
structure.

Submitted by:   bpoole@packetforensics.com
Reported by:    bpoole@packetforensics.com
Reviewed by:    giuseppe.lettieri@unipi.it
Approved by:    vmaffione

netmap: fix mutex double unlock bug

https://github.com/luigirizzo/netmap/pull/733

Submitted by:    brian90013

netmap: minor misc improvements

 - use ring->head rather than ring->cur in lb(8)
 - use strlcat() rather than strncat()
 - fix bandwidth computation in pkt-gen(8)

netmap: improve netmap(4) and vale(4) man pages

Clean up obsolete sysctl descriptions and add missing ones.

PR:             243838
Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D23546

Approved by:	so

Approved by:	so
Security:	FreeBSD-SA-20:32.rtsold
Security:	CVE-2020-25577

Approved by:	so
Security:	FreeBSD-SA-20:31.icmp6
Security:	CVE-2020-7469

Approved by:	so
Security:	FreeBSD-EN-20:22.callout

Approved by:	so
Security:	FreeBSD-EN-20:21.ipfw

Approved by:	so
Security:	FreeBSD-EN-20:20.tzdata

Approved by:	so
Security:	FreeBSD-EN-20:19.audit

Some variables weren't properly initialized, causing hash table misses.

Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
Submitted-by:	Airbus CyberSecurity Engineering Team
MFC-to:		12-STABLE
(cherry picked from commit 94eadb648ceb514e5e4406dd868778c4c195d7a1)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
(cherry picked from commit e4ee6863901818d4cbac95ca3b5e67442a94b5bf)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>

  IPV6_PKTINFO support for v4-mapped IPv6 sockets

  When using v4-mapped IPv6 sockets with IPV6_PKTINFO we do not
  respect the given v4-mapped src address on the IPv4 socket.
  Implement the needed functionality. This allows single-socket
  UDP applications (such as OpenVPN) to work better on FreeBSD.

  Requested by:	Gert Doering (gert greenie.net), pfsense
  Tested by:	Gert Doering (gert greenie.net)

Now that the security.bsd.unprivileged_proc_debug is set on a per-jail
basis, we need to modify how we're disabling it by default.

Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
Sponsored-by:	G2, Inc
MFC-to:		12-STABLE
MFC-to:		11-STABLE
(cherry picked from commit 5584574a90044fe976cbf2210f2f8bfb5722ea08)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
(cherry picked from commit 58bbb3e9433204270f8d1135a95d475ea4f65755)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
(cherry picked from commit cf37e458bbf5ffba37a3e74f2bd560d29541ac5b)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>
(cherry picked from commit 8f81f74fc53b3f7ce55f275dbd94d3d1b966d3e1)
Signed-off-by: Shawn Webb <shawn.webb@hardenedbsd.org>

iflib: netmap: improve rxsync to support IFLIB_HAS_RXCQ

For drivers with IFLIB_HAS_RXCQ set, there is a separate completion
queue. In this case, the netmap rxsync routine needs to update
rxq->ifr_cq_cidx in the same way it is updated by iflib_rxeof().
This improves the situation for vmx(4) and bnxt(4) drivers, which
use iflib and have the IFLIB_HAS_RXCQ bit set.

PR:     248494

iflib: refactor netmap_fl_refill and fix off-by-one issue

First, fix the initialization of the fl->ifl_rxd_idxs array,
which was affected by an off-by-one bug.
Once there, refactor the function to use better names for
local variables, optimize the variable assignments, and
merge the bus_dmamap_sync() inner loop with the outer one.

PR:     248494

iflib: netmap: drop redundant check

The validity of head is already checked by nm_rxsync_prologue().

iflib: netmap: don't increment ifl_cidx on the wrong free list

Netmap only uses free list 0 to keep it consistent with its
one-to-one mapping between each netmap ring and a device RX
(or TX) queue.
However, the current iflib_netmap_rxsync() routine was
mistakenly updating the ifl_cidx field of both free lists.

PR:           248494

netmap: disable passthrough with no hypervisor support

The netmap passthrough subsystem requires proper support in the
hypervisor. In particular, two PCI device ids (from the Red Hat
PCI vendor id 0x1b36) need to be assigned to the two netmap
virtual devices. We then disable these devices until the ids have
not been assigned, in order to avoid conflicts with other
virtual devices emulated by upstream QEMU.

PR:     241774

PR:		240818
Sponsored by:	Intel Corporation

These commits introduce a new iflib device-dependent method and
implements that method in the Intel ethernet network drivers;
this method tells iflib if the network interface needs to be
restarted when certain events happen.

This fixes several issues that occur when VLANs are registered
or unregistered with the network interface.

PR:		240818, 241785
Sponsored by:	Intel Corporation

This MFC includes: r353656, r353657, r353658, and r353661

Sponsored by:	Intel Corporation