From phk at FreeBSD.org  Mon Aug  4 08:03:05 2025
From: phk at FreeBSD.org (Poul-Henning Kamp)
Date: Mon,  4 Aug 2025 08:03:05 +0000 (UTC)
Subject: [master] 9d39c5532 Make blob_b00011.vtc "feature 64bit" for now.
Message-ID: <20250804080305.6B7CF964E1@lists.varnish-cache.org>


commit 9d39c5532f9b62ec13bf54aeef91e5759de01d4f
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Aug 4 08:01:54 2025 +0000

    Make blob_b00011.vtc "feature 64bit" for now.

diff --git a/bin/varnishtest/vtest2 b/bin/varnishtest/vtest2
index 11ee91098..dc46782ef 160000
--- a/bin/varnishtest/vtest2
+++ b/bin/varnishtest/vtest2
@@ -1 +1 @@
-Subproject commit 11ee91098c7a1f0a1f8afab9a7356609bfd3cb2d
+Subproject commit dc46782efa2adb08e91968efbf154c73acdee67f
diff --git a/vmod/tests/blob_b00011.vtc b/vmod/tests/blob_b00011.vtc
index 0e97cbd0a..00d313e50 100644
--- a/vmod/tests/blob_b00011.vtc
+++ b/vmod/tests/blob_b00011.vtc
@@ -5,6 +5,8 @@ varnishtest "VMOD blob workspace overflow conditions"
 # Since not all of them may be called by all VCLs we also need to ensure this
 # will not result in a compilation failure.
 
+feature 64bit
+
 varnish v1 -cliok "param.set vcc_feature -err_unref"
 varnish v1 -cliok "param.set debug +syncvsl"
 

From nils.goroll at uplex.de  Mon Aug  4 09:36:04 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Mon,  4 Aug 2025 09:36:04 +0000 (UTC)
Subject: [master] cd3d9dcef adjust vrt_blob test to changed structure
 definition
Message-ID: <20250804093604.D75079CB3F@lists.varnish-cache.org>


commit cd3d9dcef22494131f758331f81c28abe7ce1142
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Mon Aug 4 11:33:59 2025 +0200

    adjust vrt_blob test to changed structure definition
    
    If this works on 32bit, "feature 64bit" can be removed again
    
    Ref 8282cff4b31dce12e100d4d6c78d30b1f4689dd3
    Ref #4374

diff --git a/bin/varnishtest/vtest2 b/bin/varnishtest/vtest2
index dc46782ef..11ee91098 160000
--- a/bin/varnishtest/vtest2
+++ b/bin/varnishtest/vtest2
@@ -1 +1 @@
-Subproject commit dc46782efa2adb08e91968efbf154c73acdee67f
+Subproject commit 11ee91098c7a1f0a1f8afab9a7356609bfd3cb2d
diff --git a/vmod/tests/blob_b00011.vtc b/vmod/tests/blob_b00011.vtc
index 00d313e50..29c393107 100644
--- a/vmod/tests/blob_b00011.vtc
+++ b/vmod/tests/blob_b00011.vtc
@@ -19,7 +19,7 @@ shell {
 	backend be none;
 
 	sub vcl_recv {
-		set req.http.vrt_blob = vtc.typesize("uzp");
+		set req.http.vrt_blob = vtc.typesize("uuzp");
 	}
 
 	sub shrink {

From phk at FreeBSD.org  Mon Aug  4 09:58:04 2025
From: phk at FreeBSD.org (Poul-Henning Kamp)
Date: Mon,  4 Aug 2025 09:58:04 +0000 (UTC)
Subject: [master] a1043abd7 Seems to work on 32bit again, remove feature 64bit
Message-ID: <20250804095804.A8611A09A7@lists.varnish-cache.org>


commit a1043abd741acfae04456a6f6b564e48d8f5b73a
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Aug 4 09:57:28 2025 +0000

    Seems to work on 32bit again, remove feature 64bit

diff --git a/vmod/tests/blob_b00011.vtc b/vmod/tests/blob_b00011.vtc
index 29c393107..84b1f4056 100644
--- a/vmod/tests/blob_b00011.vtc
+++ b/vmod/tests/blob_b00011.vtc
@@ -5,8 +5,6 @@ varnishtest "VMOD blob workspace overflow conditions"
 # Since not all of them may be called by all VCLs we also need to ensure this
 # will not result in a compilation failure.
 
-feature 64bit
-
 varnish v1 -cliok "param.set vcc_feature -err_unref"
 varnish v1 -cliok "param.set debug +syncvsl"
 

From nils.goroll at uplex.de  Mon Aug  4 10:56:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Mon,  4 Aug 2025 10:56:05 +0000 (UTC)
Subject: [master] 69f9ca40c cache_fetch: Clarify that we can only replace an
 object before streaming
Message-ID: <20250804105605.13C71A2D5E@lists.varnish-cache.org>


commit 69f9ca40ccfda482d10d877165e998c4511aa28d
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Mon Aug 4 12:40:40 2025 +0200

    cache_fetch: Clarify that we can only replace an object before streaming
    
    Motivated by #4371

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 0b3685e45..7cd779037 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -944,6 +944,8 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	VSLb_ts_busyobj(bo, "Error", now);
 
 	if (oc->stobj->stevedore != NULL) {
+		// replacing an already fetched object with a "synth" one
+		assert(oc->boc->state < BOS_STREAM);
 		oc->boc->fetched_so_far = 0;
 		ObjFreeObj(bo->wrk, oc);
 	}

From nils.goroll at uplex.de  Mon Aug  4 10:56:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Mon,  4 Aug 2025 10:56:05 +0000 (UTC)
Subject: [master] 5f93af1c6 vai: Consistency assertions
Message-ID: <20250804105605.2AFE3A2D61@lists.varnish-cache.org>


commit 5f93af1c618d0e4214cc7de967a0077efa8e4b5c
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Mon Aug 4 12:44:32 2025 +0200

    vai: Consistency assertions
    
    Assert that the oc/boc pair remains the same throughout iteration
    
    Motivated by #4371

diff --git a/bin/varnishd/storage/storage_simple.c b/bin/varnishd/storage/storage_simple.c
index 608533193..42ab4bf70 100644
--- a/bin/varnishd/storage/storage_simple.c
+++ b/bin/varnishd/storage/storage_simple.c
@@ -456,10 +456,13 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl, struct vscarab *scarab)
 
 	CAST_VAI_HDL_NOTNULL(hdl, vhdl, SML_HDL_MAGIC);
 	VSCARAB_CHECK_NOTNULL(scarab);
+	assert(hdl->boc == hdl->oc->boc);
+	assert(hdl->oc->stobj->priv == hdl->obj);
 
 	if (hdl->avail == hdl->returned) {
 		hdl->avail = ObjVAIGetExtend(wrk, hdl->oc, hdl->returned,
 		    &state, &hdl->qe);
+		assert(state >= BOS_STREAM);
 		if (state == BOS_FAILED) {
 			hdl->last = NULL;
 			return (-EPIPE);
@@ -497,6 +500,7 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl, struct vscarab *scarab)
 
 	while (hdl->avail > hdl->returned && (viov = VSCARAB_GET(scarab)) != NULL) {
 		CHECK_OBJ_NOTNULL(hdl->st, STORAGE_MAGIC); // ObjVAIGetExtend ensures
+		assert(hdl->boc == hdl->oc->boc);
 		assert(hdl->st_off <= hdl->st->space);
 		size_t av = hdl->avail - hdl->returned;
 		size_t l = hdl->st->space - hdl->st_off;

From nils.goroll at uplex.de  Mon Aug  4 13:50:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Mon,  4 Aug 2025 13:50:05 +0000 (UTC)
Subject: [master] e81775bc3 cache_panic: Add missing struct boc members
Message-ID: <20250804135005.41F1BA97FC@lists.varnish-cache.org>


commit e81775bc3bae8e5571cfe31929d38bd00350bbb8
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Mon Aug 4 15:47:53 2025 +0200

    cache_panic: Add missing struct boc members
    
    Motivated by #4371

diff --git a/bin/varnishd/cache/cache_panic.c b/bin/varnishd/cache/cache_panic.c
index eef6cb527..6d401f578 100644
--- a/bin/varnishd/cache/cache_panic.c
+++ b/bin/varnishd/cache/cache_panic.c
@@ -218,9 +218,13 @@ pan_boc(struct vsb *vsb, const struct boc *boc)
 	if (PAN_dump_struct(vsb, boc, BOC_MAGIC, "boc"))
 		return;
 	VSB_printf(vsb, "refcnt = %u,\n", boc->refcount);
+	VSB_printf(vsb, "stevedore_priv = %p,\n", boc->stevedore_priv);
 	VSB_printf(vsb, "state = %s,\n", boc_state_2str(boc->state));
 	VSB_printf(vsb, "vary = %p,\n", boc->vary);
-	VSB_printf(vsb, "stevedore_priv = %p,\n", boc->stevedore_priv);
+	VSB_printf(vsb, "fetched_so_far = %ju,\n", (uintmax_t)boc->fetched_so_far);
+	VSB_printf(vsb, "delivered_so_far = %ju,\n", (uintmax_t)boc->delivered_so_far);
+	VSB_printf(vsb, "transit_buffer = %ju,\n", (uintmax_t)boc->transit_buffer);
+	VSB_printf(vsb, "VSLIST_FIRST(vai_q_head) = %p,\n", VSLIST_FIRST(&boc->vai_q_head));
 	VSB_indent(vsb, -2);
 	VSB_cat(vsb, "},\n");
 }

From walid.boudebouda at varnish-software.com  Mon Aug  4 14:36:20 2025
From: walid.boudebouda at varnish-software.com (Walid Boudebouda)
Date: Mon, 4 Aug 2025 16:36:20 +0200
Subject: [master] 5f93af1c6 vai: Consistency assertions
In-Reply-To: <20250804105605.2AFE3A2D61@lists.varnish-cache.org>
References: <20250804105605.2AFE3A2D61@lists.varnish-cache.org>
Message-ID: <CABs7ENnejT2ohm_Dr=WCYYuBP8gJTmBenwE_MBKgvbnNa65fPw@mail.gmail.com>

FYI: The new assert triggers a panic in test p00000.vtc:

**** v1    CLI RX|Child (3894826) Panic at: Mon, 04 Aug 2025 14:35:13 GMT
> **** v1    CLI RX|Assert error in sml_ai_lease_boc(),
> storage/storage_simple.c line 460:
> **** v1    CLI RX|  Condition(hdl->oc->stobj->priv == hdl->obj) not true.
> **** v1    CLI RX|version = varnish-trunk revision
> 5f93af1c618d0e4214cc7de967a0077efa8e4b5c, vrt api = 21.0
> **** v1    CLI RX|ident =
> Linux,6.8.0-64-generic,x86_64,-jnone,-sdeprecated_persistent,-sdefault,-hcritbit,epoll
> **** v1    CLI RX|now = 156813.822665 (mono), 1754318112.863334 (real)
> **** v1    CLI RX|Backtrace:
> **** v1    CLI RX|  ip=0x55d5e7e7f415 sp=0x74e297ef8070 <VBT_format+0x35>
> **** v1    CLI RX|  ip=0x55d5e7dae4f3 sp=0x74e297ef8090
> <pan_backtrace+0x33>
> **** v1    CLI RX|  ip=0x55d5e7dae237 sp=0x74e297ef80b0 <pan_ic+0x377>
> **** v1    CLI RX|  ip=0x55d5e7e7e48b sp=0x74e297ef8230 <VAS_Fail+0x4b>
> **** v1    CLI RX|  ip=0x55d5e7e420a7 sp=0x74e297ef8270
> <sml_ai_lease_boc+0x277>
> **** v1    CLI RX|  ip=0x55d5e7daa4d9 sp=0x74e297ef82f0 <ObjVAIlease+0xf9>
> **** v1    CLI RX|  ip=0x55d5e7e3d6fe sp=0x74e297ef8320
> <sml_iterator+0x20e>
> **** v1    CLI RX|  ip=0x55d5e7daa161 sp=0x74e297ef8660 <ObjIterate+0x151>
> **** v1    CLI RX|  ip=0x55d5e7d7f5ff sp=0x74e297ef86a0
> <VDP_DeliverObj+0x27f>
> **** v1    CLI RX|  ip=0x55d5e7dfd6ff sp=0x74e297ef86d0 <V1D_Deliver+0x6bf>
> **** v1    CLI RX|  ip=0x55d5e7dba3d7 sp=0x74e297ef87e0
> <cnt_transmit+0x707>
> **** v1    CLI RX|  ip=0x55d5e7db8a7c sp=0x74e297ef8820 <CNT_Request+0x73c>
> **** v1    CLI RX|  ip=0x55d5e7e007de sp=0x74e297ef88e0
> <HTTP1_Session+0xa7e>
> **** v1    CLI RX|  ip=0x55d5e7dffd21 sp=0x74e297ef8960 <http1_req+0x181>
> **** v1    CLI RX|  ip=0x55d5e7df0887 sp=0x74e297ef8990
> <Pool_Work_Thread+0x7c7>
> **** v1    CLI RX|  ip=0x55d5e7deff83 sp=0x74e297ef8a20 <WRK_Thread+0x333>
> **** v1    CLI RX|  ip=0x55d5e7defc0b sp=0x74e297ef95b0 <pool_thread+0xcb>
> **** v1    CLI RX|  ip=0x74e298094ac3 sp=0x74e297ef95e0
> <pthread_condattr_setpshared+0x513>
> **** v1    CLI RX|  ip=0x74e298126850 sp=0x74e297ef9680 <__xmknodat+0x230>



On Mon, Aug 4, 2025 at 12:56?PM Nils Goroll <nils.goroll at uplex.de> wrote:

>
> commit 5f93af1c618d0e4214cc7de967a0077efa8e4b5c
> Author: Nils Goroll <nils.goroll at uplex.de>
> Date:   Mon Aug 4 12:44:32 2025 +0200
>
>     vai: Consistency assertions
>
>     Assert that the oc/boc pair remains the same throughout iteration
>
>     Motivated by #4371
>
> diff --git a/bin/varnishd/storage/storage_simple.c
> b/bin/varnishd/storage/storage_simple.c
> index 608533193..42ab4bf70 100644
> --- a/bin/varnishd/storage/storage_simple.c
> +++ b/bin/varnishd/storage/storage_simple.c
> @@ -456,10 +456,13 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl,
> struct vscarab *scarab)
>
>         CAST_VAI_HDL_NOTNULL(hdl, vhdl, SML_HDL_MAGIC);
>         VSCARAB_CHECK_NOTNULL(scarab);
> +       assert(hdl->boc == hdl->oc->boc);
> +       assert(hdl->oc->stobj->priv == hdl->obj);
>
>         if (hdl->avail == hdl->returned) {
>                 hdl->avail = ObjVAIGetExtend(wrk, hdl->oc, hdl->returned,
>                     &state, &hdl->qe);
> +               assert(state >= BOS_STREAM);
>                 if (state == BOS_FAILED) {
>                         hdl->last = NULL;
>                         return (-EPIPE);
> @@ -497,6 +500,7 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl,
> struct vscarab *scarab)
>
>         while (hdl->avail > hdl->returned && (viov = VSCARAB_GET(scarab))
> != NULL) {
>                 CHECK_OBJ_NOTNULL(hdl->st, STORAGE_MAGIC); //
> ObjVAIGetExtend ensures
> +               assert(hdl->boc == hdl->oc->boc);
>                 assert(hdl->st_off <= hdl->st->space);
>                 size_t av = hdl->avail - hdl->returned;
>                 size_t l = hdl->st->space - hdl->st_off;
> _______________________________________________
> varnish-commit mailing list
> varnish-commit at varnish-cache.org
> https://www.varnish-cache.org/lists/mailman/listinfo/varnish-commit
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-commit/attachments/20250804/43e960f7/attachment-0001.html>

From nils.goroll at uplex.de  Tue Aug  5 09:03:04 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Tue,  5 Aug 2025 09:03:04 +0000 (UTC)
Subject: [master] e3a92108e vai: Remove wrong assertion
Message-ID: <20250805090304.D8046A8CC7@lists.varnish-cache.org>


commit e3a92108e647c064647d91b3688e17ac6c3c5585
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Aug 5 11:00:35 2025 +0200

    vai: Remove wrong assertion
    
    I had temporarily built with plain ./configure to get default compiler flags, so
    I had not seen locally that for -sdeprecated_persistent, stobj->priv is not the
    struct object *

diff --git a/bin/varnishd/storage/storage_simple.c b/bin/varnishd/storage/storage_simple.c
index 42ab4bf70..ab5b03ad0 100644
--- a/bin/varnishd/storage/storage_simple.c
+++ b/bin/varnishd/storage/storage_simple.c
@@ -457,7 +457,6 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl, struct vscarab *scarab)
 	CAST_VAI_HDL_NOTNULL(hdl, vhdl, SML_HDL_MAGIC);
 	VSCARAB_CHECK_NOTNULL(scarab);
 	assert(hdl->boc == hdl->oc->boc);
-	assert(hdl->oc->stobj->priv == hdl->obj);
 
 	if (hdl->avail == hdl->returned) {
 		hdl->avail = ObjVAIGetExtend(wrk, hdl->oc, hdl->returned,

From nils.goroll at uplex.de  Tue Aug  5 10:33:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Tue,  5 Aug 2025 10:33:05 +0000 (UTC)
Subject: [master] 21316e4d0 vai: fix another glitch from
 84d1fc92f436e9c94d127ec45e779b36f0f7c2a7
Message-ID: <20250805103305.78286ABCA2@lists.varnish-cache.org>


commit 21316e4d05fe91c9722fc887d5146077b5d0c393
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Aug 5 12:31:01 2025 +0200

    vai: fix another glitch from 84d1fc92f436e9c94d127ec45e779b36f0f7c2a7
    
    We need to increment the return value to signify that we added a viov.
    
    Potentially related to #4371

diff --git a/bin/varnishd/storage/storage_simple.c b/bin/varnishd/storage/storage_simple.c
index ab5b03ad0..05f224cdf 100644
--- a/bin/varnishd/storage/storage_simple.c
+++ b/bin/varnishd/storage/storage_simple.c
@@ -487,6 +487,7 @@ sml_ai_lease_boc(struct worker *wrk, vai_hdl vhdl, struct vscarab *scarab)
 		viov->iov.iov_base = null_iov;
 		viov->iov.iov_len = 0;
 		viov->lease = ptr2lease(hdl->last);
+		r++;
 	}
 	if (hdl->last != NULL)
 		hdl->last = NULL;

From nils.goroll at uplex.de  Tue Aug  5 13:11:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Tue,  5 Aug 2025 13:11:05 +0000 (UTC)
Subject: [master] fc18d8a52 vai: Never access the object list unprotected for
 a busy object
Message-ID: <20250805131105.603D1B11D3@lists.varnish-cache.org>


commit fc18d8a52f19b089d4432f1d81a14f7bab9162d5
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Aug 5 14:51:28 2025 +0200

    vai: Never access the object list unprotected for a busy object
    
    For a busy object, we must never access the object list outside the boc mutex,
    otherwise we can see basically arbitrary pointer values (like a retired segment
    from sml_trimstore or just a random pointer).
    
    Fixes #4371

diff --git a/bin/varnishd/storage/storage_simple.c b/bin/varnishd/storage/storage_simple.c
index 05f224cdf..054b02881 100644
--- a/bin/varnishd/storage/storage_simple.c
+++ b/bin/varnishd/storage/storage_simple.c
@@ -666,8 +666,6 @@ sml_ai_init(struct worker *wrk, struct objcore *oc, struct ws *ws,
 	hdl->stv = oc->stobj->stevedore;
 	CHECK_OBJ_NOTNULL(hdl->stv, STEVEDORE_MAGIC);
 
-	hdl->st = VTAILQ_LAST(&hdl->obj->list, storagehead);
-	CHECK_OBJ_ORNULL(hdl->st, STORAGE_MAGIC);
 
 	hdl->qe.magic = VAI_Q_MAGIC;
 	hdl->qe.cb = notify;
@@ -675,8 +673,11 @@ sml_ai_init(struct worker *wrk, struct objcore *oc, struct ws *ws,
 	hdl->qe.priv = notify_priv;
 
 	hdl->boc = HSH_RefBoc(oc);
-	if (hdl->boc == NULL)
+	if (hdl->boc == NULL) {
+		hdl->st = VTAILQ_LAST(&hdl->obj->list, storagehead);
+		CHECK_OBJ_ORNULL(hdl->st, STORAGE_MAGIC);
 		return (hdl);
+	}
 	/* we only initialize notifications if we have a boc, so
 	 * any wrong attempt triggers magic checks.
 	 */

From nils.goroll at uplex.de  Tue Aug 12 09:21:06 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Tue, 12 Aug 2025 09:21:06 +0000 (UTC)
Subject: [master] 2a5345de1 vsl: Facilitate ESI_xmlerror processing
Message-ID: <20250812092106.C3FEA117D94@lists.varnish-cache.org>


commit 2a5345de14efee39838f87c57908fe10d02decc2
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Wed Aug 6 12:36:24 2025 +0200

    vsl: Facilitate ESI_xmlerror processing
    
    varnishncsa supports the %{VSL:tag:record-prefix[field]}x format variable to
    output records which "have this prefix as the first part of the record content
    followed by a colon".
    
    It would be convenient to be able to use this variable also for ESI_xmlerror as
    
            %{VSL:ESI_xmlerror:WARN}x
            %{VSL:ESI_xmlerror:ERR}x"
    
    yet the prefix was missing a colon.
    
    This patch adds it, plus it also adds a WARN: prefix to "No ESI processing"
    messages.
    
    Most of the diff was produced using
    
            sed -i '/ESI_xmlerror/ s:\(ERR\|WARN\):\0\::' $(git grep -l ESI_xml)

diff --git a/bin/varnishd/cache/cache_esi_parse.c b/bin/varnishd/cache/cache_esi_parse.c
index 5145b016c..0b183a35d 100644
--- a/bin/varnishd/cache/cache_esi_parse.c
+++ b/bin/varnishd/cache/cache_esi_parse.c
@@ -201,7 +201,7 @@ static void
 vep_error(const struct vep_state *vep, const char *p)
 {
 	VSC_C_main->esi_errors++;
-	VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror, "ERR after %zd %s",
+	VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror, "ERR: after %zd %s",
 	     vep->o_last, p);
 }
 
@@ -213,7 +213,7 @@ static void
 vep_warn(const struct vep_state *vep, const char *p)
 {
 	VSC_C_main->esi_warnings++;
-	VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror, "WARN after %zd %s",
+	VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror, "WARN: after %zd %s",
 	     vep->o_last, p);
 }
 
@@ -673,14 +673,14 @@ VEP_Parse(struct vep_state *vep, const char *p, size_t l)
 				vep->state = VEP_STARTTAG;
 			} else if (p < e && *p == (char)0xeb) {
 				VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror,
-				    "No ESI processing, "
+				    "WARN: No ESI processing, "
 				    "first char not '<' but BOM."
 				    " (See feature esi_remove_bom)"
 				);
 				vep->state = VEP_NOTXML;
 			} else if (p < e) {
 				VSLb(vep->vc->wrk->vsl, SLT_ESI_xmlerror,
-				    "No ESI processing, "
+				    "WARN: No ESI processing, "
 				    "first char not '<'."
 				    " (See feature esi_disable_xml_check)"
 				);
diff --git a/bin/varnishtest/tests/e00001.vtc b/bin/varnishtest/tests/e00001.vtc
index c903a0acb..9e4cf5286 100644
--- a/bin/varnishtest/tests/e00001.vtc
+++ b/bin/varnishtest/tests/e00001.vtc
@@ -23,8 +23,8 @@ varnish v1 -vcl+backend {
 } -start
 
 logexpect l1 -v v1 -g raw {
-	expect * * ESI_xmlerror {^ERR after 3 ESI 1.0 <esi:include> element nested in <esi:remove>}
-	expect 0 = ESI_xmlerror {^ERR after 3 ESI 1.0 Nested <!--esi element in <esi:remove>}
+	expect * * ESI_xmlerror {^ERR: after 3 ESI 1.0 <esi:include> element nested in <esi:remove>}
+	expect 0 = ESI_xmlerror {^ERR: after 3 ESI 1.0 Nested <!--esi element in <esi:remove>}
 } -start
 
 client c1 {
diff --git a/bin/varnishtest/tests/e00006.vtc b/bin/varnishtest/tests/e00006.vtc
index b6b511808..82cf5c9f3 100644
--- a/bin/varnishtest/tests/e00006.vtc
+++ b/bin/varnishtest/tests/e00006.vtc
@@ -69,9 +69,9 @@ varnish v1 -vcl+backend {
 varnish v1 -cliok "param.set feature +esi_ignore_https"
 
 logexpect l1 -v v1 -g raw {
-	expect * * ESI_xmlerror "ERR after 0 ESI 1.0 <esi:include> invalid src= URL"
-	expect * * ESI_xmlerror "WARN after 0 ESI 1.0 <esi:include> https:// treated as http://"
-	expect * * ESI_xmlerror "ERR after 0 ESI 1.0 <esi:include> invalid src= URL"
+	expect * * ESI_xmlerror "^ERR: after 0 ESI 1.0 <esi:include> invalid src= URL"
+	expect * * ESI_xmlerror "^WARN: after 0 ESI 1.0 <esi:include> https:// treated as http://"
+	expect * * ESI_xmlerror "^ERR: after 0 ESI 1.0 <esi:include> invalid src= URL"
 } -start
 
 client c1 {
diff --git a/bin/varnishtest/tests/e00008.vtc b/bin/varnishtest/tests/e00008.vtc
index 1264aea55..775e45f18 100644
--- a/bin/varnishtest/tests/e00008.vtc
+++ b/bin/varnishtest/tests/e00008.vtc
@@ -67,34 +67,34 @@ varnish v1 -vcl+backend {
 
 logexpect l1 -v v1 -g vxid {
 	expect * * BereqURL	{^/$}
-	expect * * ESI_xmlerror {^ERR after 134 ESI 1.0 <esi:bogus> element$}
-	expect 0 = ESI_xmlerror {^ERR after 157 ESI 1.0 <esi:comment> needs final '/'$}
-	expect 0 = ESI_xmlerror {^ERR after 192 ESI 1.0 </esi:comment> illegal end-tag$}
-	expect 0 = ESI_xmlerror {^ERR after 251 ESI 1.0 <esi:comment> element nested in <esi:remove>$}
-	expect 0 = ESI_xmlerror {^ERR after 330 ESI 1.0 <esi:remove> already open$}
-	expect 0 = ESI_xmlerror {^ERR after 407 ESI 1.0 <esi:remove> not open$}
-	expect 0 = ESI_xmlerror {^ERR after 442 ESI 1.0 <esi:remove/> not legal$}
-	expect 0 = ESI_xmlerror {^ERR after 474 XML 1.0 Illegal attribute start char$}
-	expect 0 = ESI_xmlerror {^ERR after 525 ESI 1.0 <esi:include> lacks src attr$}
-	expect 0 = ESI_xmlerror {^ERR after 553 XML 1.0 Illegal attr char$}
-	expect 0 = ESI_xmlerror {^ERR after 581 ESI 1.0 <esi:include> lacks src attr$}
-	expect 0 = ESI_xmlerror {^ERR after 608 XML 1.0 Missing end attribute delimiter$}
-	expect 0 = ESI_xmlerror {^ERR after 636 XML 1.0 Illegal attribute delimiter$}
-	expect 0 = ESI_xmlerror {^ERR after 665 ESI 1.0 </esi:include> illegal end-tag$}
-	expect 0 = ESI_xmlerror {^ERR after 767 XML 1.0 Missing end attribute delimiter$}
-	expect 0 = ESI_xmlerror {^ERR after 843 ESI 1.0 <esi:include> has whitespace in src= attribute$}
+	expect * * ESI_xmlerror {^ERR: after 134 ESI 1.0 <esi:bogus> element$}
+	expect 0 = ESI_xmlerror {^ERR: after 157 ESI 1.0 <esi:comment> needs final '/'$}
+	expect 0 = ESI_xmlerror {^ERR: after 192 ESI 1.0 </esi:comment> illegal end-tag$}
+	expect 0 = ESI_xmlerror {^ERR: after 251 ESI 1.0 <esi:comment> element nested in <esi:remove>$}
+	expect 0 = ESI_xmlerror {^ERR: after 330 ESI 1.0 <esi:remove> already open$}
+	expect 0 = ESI_xmlerror {^ERR: after 407 ESI 1.0 <esi:remove> not open$}
+	expect 0 = ESI_xmlerror {^ERR: after 442 ESI 1.0 <esi:remove/> not legal$}
+	expect 0 = ESI_xmlerror {^ERR: after 474 XML 1.0 Illegal attribute start char$}
+	expect 0 = ESI_xmlerror {^ERR: after 525 ESI 1.0 <esi:include> lacks src attr$}
+	expect 0 = ESI_xmlerror {^ERR: after 553 XML 1.0 Illegal attr char$}
+	expect 0 = ESI_xmlerror {^ERR: after 581 ESI 1.0 <esi:include> lacks src attr$}
+	expect 0 = ESI_xmlerror {^ERR: after 608 XML 1.0 Missing end attribute delimiter$}
+	expect 0 = ESI_xmlerror {^ERR: after 636 XML 1.0 Illegal attribute delimiter$}
+	expect 0 = ESI_xmlerror {^ERR: after 665 ESI 1.0 </esi:include> illegal end-tag$}
+	expect 0 = ESI_xmlerror {^ERR: after 767 XML 1.0 Missing end attribute delimiter$}
+	expect 0 = ESI_xmlerror {^ERR: after 843 ESI 1.0 <esi:include> has whitespace in src= attribute$}
 	expect 0 = BackendClose
 } -start
 
 logexpect l2 -v v1 -g vxid {
 	expect * * BereqURL	{^/body$}
-	expect * = ESI_xmlerror {^ERR after 30 VEP ended inside a tag$}
+	expect * = ESI_xmlerror {^ERR: after 30 VEP ended inside a tag$}
 	expect 0 = BackendClose
 } -start
 
 logexpect l3 -v v1 -g vxid {
 	expect * * BereqURL	{^/body2$}
-	expect * = ESI_xmlerror {^ERR after 39 VEP ended inside a tag$}
+	expect * = ESI_xmlerror {^ERR: after 39 VEP ended inside a tag$}
 	expect 0 = BackendClose
 } -start
 
diff --git a/bin/varnishtest/tests/e00019.vtc b/bin/varnishtest/tests/e00019.vtc
index b0b08b8df..1fb159ec0 100644
--- a/bin/varnishtest/tests/e00019.vtc
+++ b/bin/varnishtest/tests/e00019.vtc
@@ -57,12 +57,12 @@ varnish v1 -cliok "param.set debug +syncvsl"
 
 logexpect l1 -v v1 -g vxid -q "vxid == 1002" {
 	expect * * Fetch_Body
-	expect 0 = ESI_xmlerror {^ERR after 3 ESI 1.0 </esi:comment> illegal end-tag$}
-	expect 0 = ESI_xmlerror {^ERR after 27 XML 1.0 '>' does not follow '/' in tag$}
-	expect 0 = ESI_xmlerror {^ERR after 43 ESI 1.0 <esi:comment> needs final '/'$}
-	expect 0 = ESI_xmlerror {^WARN after 107 ESI 1.0 <esi:include> lacks final '/'$}
-	expect 0 = ESI_xmlerror {^ERR after 130 ESI 1.0 <esi:bogus> element$}
-	expect 0 = ESI_xmlerror {^ERR after 131837 VEP ended inside a tag$}
+	expect 0 = ESI_xmlerror {^ERR: after 3 ESI 1.0 </esi:comment> illegal end-tag$}
+	expect 0 = ESI_xmlerror {^ERR: after 27 XML 1.0 '>' does not follow '/' in tag$}
+	expect 0 = ESI_xmlerror {^ERR: after 43 ESI 1.0 <esi:comment> needs final '/'$}
+	expect 0 = ESI_xmlerror {^WARN: after 107 ESI 1.0 <esi:include> lacks final '/'$}
+	expect 0 = ESI_xmlerror {^ERR: after 130 ESI 1.0 <esi:bogus> element$}
+	expect 0 = ESI_xmlerror {^ERR: after 131837 VEP ended inside a tag$}
 	expect 0 = BackendClose
 } -start
 
diff --git a/bin/varnishtest/tests/e00020.vtc b/bin/varnishtest/tests/e00020.vtc
index 75210778f..45f8be539 100644
--- a/bin/varnishtest/tests/e00020.vtc
+++ b/bin/varnishtest/tests/e00020.vtc
@@ -24,8 +24,8 @@ varnish v1 -cliok "param.set http_gzip_support true"
 
 logexpect l1 -v v1 -g vxid {
 	expect * * Fetch_Body
-	expect 0 = ESI_xmlerror {^ERR after 3 ESI 1.0 <esi:include> element nested in <esi:remove>$}
-	expect 0 = ESI_xmlerror {^ERR after 3 ESI 1.0 Nested <!--esi element in <esi:remove>$}
+	expect 0 = ESI_xmlerror {^ERR: after 3 ESI 1.0 <esi:include> element nested in <esi:remove>$}
+	expect 0 = ESI_xmlerror {^ERR: after 3 ESI 1.0 Nested <!--esi element in <esi:remove>$}
 	expect 0 = Gzip         {^U}
 	expect 0 = BackendClose
 } -start
diff --git a/bin/varnishtest/tests/e00022.vtc b/bin/varnishtest/tests/e00022.vtc
index 2a99c8acd..e2caab769 100644
--- a/bin/varnishtest/tests/e00022.vtc
+++ b/bin/varnishtest/tests/e00022.vtc
@@ -29,8 +29,8 @@ varnish v1 -cliok "param.set gzip_memlevel 1"
 
 logexpect l1 -v v1 -g vxid {
 	expect * * Fetch_Body
-	expect 0 = ESI_xmlerror {^ERR after 24 ESI 1.0 <esi:include> element nested in <esi:remove>$}
-	expect 0 = ESI_xmlerror {^ERR after 24 ESI 1.0 Nested <!--esi element in <esi:remove>$}
+	expect 0 = ESI_xmlerror {^ERR: after 24 ESI 1.0 <esi:include> element nested in <esi:remove>$}
+	expect 0 = ESI_xmlerror {^ERR: after 24 ESI 1.0 Nested <!--esi element in <esi:remove>$}
 	expect 0 = Gzip         {^G}
 	expect 0 = Gzip         {^U}
 	expect 0 = BackendClose
diff --git a/bin/varnishtest/tests/r00894.vtc b/bin/varnishtest/tests/r00894.vtc
index 0cb094822..2f2aa9d2a 100644
--- a/bin/varnishtest/tests/r00894.vtc
+++ b/bin/varnishtest/tests/r00894.vtc
@@ -13,7 +13,7 @@ varnish v1 -vcl+backend {
 
 logexpect l1 -v v1 -g raw {
 	expect * * Fetch_Body
-	expect 0 = ESI_xmlerror {^ERR after 5 ESI 1.0 <esi:include> has multiple src= attributes$}
+	expect 0 = ESI_xmlerror {^ERR: after 5 ESI 1.0 <esi:include> has multiple src= attributes$}
 	expect 0 = BackendClose
 } -start
 
diff --git a/bin/varnishtest/tests/r01092.vtc b/bin/varnishtest/tests/r01092.vtc
index 468f6a591..1312d1c10 100644
--- a/bin/varnishtest/tests/r01092.vtc
+++ b/bin/varnishtest/tests/r01092.vtc
@@ -26,7 +26,7 @@ varnish v1 -vcl+backend {
 
 logexpect l1 -v v1 -g raw {
 	expect * * Fetch_Body
-	expect 0 * ESI_xmlerror {^ERR after 66 ESI 1.0 Nested <!--esi element in <esi:remove>$}
+	expect 0 * ESI_xmlerror {^ERR: after 66 ESI 1.0 Nested <!--esi element in <esi:remove>$}
 	expect 0 = BackendClose
 } -start
 
diff --git a/bin/varnishtest/tests/r01355.vtc b/bin/varnishtest/tests/r01355.vtc
index 5385b2a31..e20036116 100644
--- a/bin/varnishtest/tests/r01355.vtc
+++ b/bin/varnishtest/tests/r01355.vtc
@@ -23,11 +23,11 @@ varnish v1 -vcl+backend {
 
 logexpect l1 -v v1 -g raw {
 	expect * * Fetch_Body
-	expect 0 = ESI_xmlerror {^No ESI processing, first char not '<' but BOM. .See feature esi_remove_bom.$}
+	expect 0 = ESI_xmlerror {^WARN: No ESI processing, first char not '<' but BOM. .See feature esi_remove_bom.$}
 	expect 0 = BackendClose
 # XXX another logexpect weirdness - why can't we catch the second occurrence?
 #	expect * * Fetch_Body
-#	expect 0 = ESI_xmlerror {^No ESI processing, first char not '<' but BOM. .See feature esi_remove_bom.$}
+#	expect 0 = ESI_xmlerror {^WARN: No ESI processing, first char not '<' but BOM. .See feature esi_remove_bom.$}
 #	expect 0 = BackendClose
 } -start
 

From nils.goroll at uplex.de  Tue Aug 12 09:21:06 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Tue, 12 Aug 2025 09:21:06 +0000 (UTC)
Subject: [master] bc3f7515a cache_fetch: Fix bad assertion in vbf_objiterate()
Message-ID: <20250812092106.E0C49117D99@lists.varnish-cache.org>


commit bc3f7515a81aa3d85698816d295c1fee71fa1af7
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue Aug 12 11:17:14 2025 +0200

    cache_fetch: Fix bad assertion in vbf_objiterate()
    
    If we run into a storage error while copying the object body for a 304 response,
    the remaining length when seeing OBJ_ITER_END may be greater than zero.
    
    Fixes #4377

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 7cd779037..4ea54d9f9 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -819,7 +819,7 @@ vbf_objiterate(void *priv, unsigned flush, const void *ptr, ssize_t len)
 		len -= l;
 		vop->pl -= l;
 	}
-	if (flush)
+	if (flush && vop->bo->vfc->failed == 0)
 		AZ(vop->l);
 	return (0);
 }
diff --git a/bin/varnishtest/tests/r04377.vtc b/bin/varnishtest/tests/r04377.vtc
new file mode 100644
index 000000000..3847f7e21
--- /dev/null
+++ b/bin/varnishtest/tests/r04377.vtc
@@ -0,0 +1,39 @@
+varnishtest "storage failure with 304 response"
+
+server s1 {
+	rxreq
+	txresp -hdr {Etag: "abc"} -bodylen 2049
+
+	rxreq
+	txresp -status 304
+} -start
+
+varnish v1 \
+    -arg "-smalloc=malloc,1M" \
+    -arg "-scondfetch=debug,maxspace=1024B" \
+    -vcl+backend {
+	sub vcl_backend_response {
+		if (beresp.was_304) {
+			set beresp.storage = storage.condfetch;
+		}
+		set beresp.ttl = 0.001s;
+		set beresp.grace = 0s;
+		set beresp.keep = 1m;
+	}
+} -start
+
+varnish v1 -cliok "debug.fragfetch 2048"
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.bodylen == 2049
+
+	txreq
+	# we do not care that this is an error, the important point is not to
+	# panic
+	non_fatal
+	rxresp
+	expect resp.status == 200
+} -run

From walid.boudebouda at gmail.com  Tue Aug 12 15:25:05 2025
From: walid.boudebouda at gmail.com (Walid Boudebouda)
Date: Tue, 12 Aug 2025 15:25:05 +0000 (UTC)
Subject: [master] 548527df3 [varnishstat] use -1 is not outputting to a TTY
Message-ID: <20250812152505.5628C60805@lists.varnish-cache.org>


commit 548527df363c2487351e26dbb30e6de2cf2df158
Author: Guillaume Quintard <guillaume.quintard at varnish-software.com>
Date:   Fri Aug 1 15:35:37 2025 -0700

    [varnishstat] use -1 is not outputting to a TTY

diff --git a/bin/varnishstat/varnishstat.c b/bin/varnishstat/varnishstat.c
index 34c073947..080e31197 100644
--- a/bin/varnishstat/varnishstat.c
+++ b/bin/varnishstat/varnishstat.c
@@ -296,6 +296,9 @@ main(int argc, char * const *argv)
 		case '1':
 			once = 1;
 			break;
+		case 'c':
+			curses = 1;
+			break;
 		case 'h':
 			/* Usage help */
 			usage(0);
@@ -333,8 +336,10 @@ main(int argc, char * const *argv)
 	if (optind != argc)
 		usage(1);
 
-	if (!(xml || json || once || f_list))
-		curses = 1;
+	if (!(curses || xml || json || once || f_list)) {
+		curses = isatty(STDOUT_FILENO);
+		once = !curses;
+	}
 
 	if (VSM_Attach(vd, STDERR_FILENO))
 		VUT_Error(vut, 1, "%s", VSM_Error(vd));
diff --git a/bin/varnishstat/varnishstat_options.h b/bin/varnishstat/varnishstat_options.h
index 945bde425..72dddadc2 100644
--- a/bin/varnishstat/varnishstat_options.h
+++ b/bin/varnishstat/varnishstat_options.h
@@ -36,7 +36,14 @@
 #define STAT_OPT_1							\
 	VOPT("1", "[-1]", "Print the statistics to stdout",		\
 	    "Instead of presenting a continuously updated display,"	\
-	    " print the statistics to stdout."				\
+	    " print the statistics to stdout. This is the default when"	\
+	    "standard output is being redirected"			\
+	)
+#define STAT_OPT_c							\
+	VOPT("c", "[-c]", "Live (curses) mode",				\
+	    "Presents a continuously updated, interactive display."	\
+	    " This is the default when the standard output isn't"	\
+	    " redirected."						\
 	)
 #define STAT_OPT_j							\
 	VOPT("j", "[-j]", "Print statistics to stdout as JSON",		\
@@ -57,6 +64,7 @@
 	)
 
 STAT_OPT_1
+STAT_OPT_c
 VSC_OPT_f
 VUT_OPT_h
 VSC_OPT_I
diff --git a/doc/changes.rst b/doc/changes.rst
index a882f69ad..9c0f23f47 100644
--- a/doc/changes.rst
+++ b/doc/changes.rst
@@ -89,6 +89,10 @@ Varnish Cache NEXT (8.0, 2025-09-15)
   Developers should use ``make update`` to update the referenced vtest2 commit
   after changes to vtest2.
 
+* ``varnishstat`` will automatically switch to ``-1`` output if ``stdout``
+  isn't a terminal (allowing ``varnishstat | grep MAIN``). A new ``-c`` switch
+  has been added to force the live mode.
+
 ==============================
 Varnish-Cache 7.7 (2025-03-17)
 ==============================

From martin at varnish-software.com  Wed Aug 13 12:03:05 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Wed, 13 Aug 2025 12:03:05 +0000 (UTC)
Subject: [6.0] aecec9f91 H2: Add a H2_Send_GOAWAY method
Message-ID: <20250813120305.F10E66494A@lists.varnish-cache.org>


commit aecec9f9165241291a6179a41589778f9d72efac
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Tue Jul 1 14:57:56 2025 +0200

    H2: Add a H2_Send_GOAWAY method
    
    This method sends a goaway frame. Change h2_tx_goaway() so that it uses this method.

diff --git a/bin/varnishd/http2/cache_http2.h b/bin/varnishd/http2/cache_http2.h
index a157e9b29..30dd89171 100644
--- a/bin/varnishd/http2/cache_http2.h
+++ b/bin/varnishd/http2/cache_http2.h
@@ -257,6 +257,8 @@ void H2_Send_Frame(struct worker *, struct h2_sess *,
 
 void H2_Send_RST(struct worker *wrk, struct h2_sess *h2,
     const struct h2_req *r2, uint32_t stream, h2_error h2e);
+void H2_Send_GOAWAY(struct worker *wrk, struct h2_sess *h2,
+    const struct h2_req *r2, h2_error h2e);
 
 void H2_Send(struct worker *, struct h2_req *, h2_frame type, uint8_t flags,
     uint32_t len, const void *, uint64_t *acct);
diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index e736d7a36..dac8b3129 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -399,19 +399,14 @@ h2_rx_goaway(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 static void
 h2_tx_goaway(struct worker *wrk, struct h2_sess *h2, h2_error h2e)
 {
-	char b[8];
-
 	ASSERT_RXTHR(h2);
 	AN(h2e);
 
 	if (h2->goaway || !h2e->send_goaway)
 		return;
 
-	h2->goaway = 1;
-	vbe32enc(b, h2->highest_stream);
-	vbe32enc(b + 4, h2e->val);
 	H2_Send_Get(wrk, h2, h2->req0);
-	H2_Send_Frame(wrk, h2, H2_F_GOAWAY, 0, 8, 0, b);
+	H2_Send_GOAWAY(wrk, h2, h2->req0, h2e);
 	H2_Send_Rel(h2, h2->req0);
 }
 
diff --git a/bin/varnishd/http2/cache_http2_send.c b/bin/varnishd/http2/cache_http2_send.c
index 6ae45d136..eb8b17e3e 100644
--- a/bin/varnishd/http2/cache_http2_send.c
+++ b/bin/varnishd/http2/cache_http2_send.c
@@ -435,6 +435,26 @@ H2_Send_RST(struct worker *wrk, struct h2_sess *h2, const struct h2_req *r2,
 	H2_Send_Frame(wrk, h2, H2_F_RST_STREAM, 0, sizeof b, stream, b);
 }
 
+void
+H2_Send_GOAWAY(struct worker *wrk, struct h2_sess *h2, const struct h2_req *r2,
+    h2_error h2e)
+{
+	char b[8];
+
+	CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
+	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
+	AN(H2_SEND_HELD(h2, r2));
+	AN(h2e);
+
+	if (h2->goaway)
+		return;
+
+	vbe32enc(b, h2->highest_stream);
+	vbe32enc(b + 4, h2e->val);
+	H2_Send_Frame(wrk, h2, H2_F_GOAWAY, 0, 8, 0, b);
+	h2->goaway = 1;
+}
+
 void
 H2_Send(struct worker *wrk, struct h2_req *r2, h2_frame ftyp, uint8_t flags,
     uint32_t len, const void *ptr, uint64_t *counter)

From martin at varnish-software.com  Wed Aug 13 12:03:06 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Wed, 13 Aug 2025 12:03:06 +0000 (UTC)
Subject: [6.0] 6f5cf2073 H2: Make rapid reset handling be calleable from any
 context
Message-ID: <20250813120306.122C76494D@lists.varnish-cache.org>


commit 6f5cf20733883ad2d66587146909371a066b8a89
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Tue Jul 1 15:32:25 2025 +0200

    H2: Make rapid reset handling be calleable from any context
    
    This patch splits the rapid reset handling into a check and a charge
    step. The check determines if this was a benign reset, that is whether it
    should be charged against the budgest or not.
    
    The charge step subtracts from the budget, and handles raises an error
    when exceeded. On error it will send a GOAWAY frame on the session
    immediately. To allow an error to be sent from this function, and to give
    protection to the rapid reset state variables, it is required that the
    caller holds the send mutex when calling.

diff --git a/bin/varnishd/http2/cache_http2.h b/bin/varnishd/http2/cache_http2.h
index 30dd89171..fed24a7e5 100644
--- a/bin/varnishd/http2/cache_http2.h
+++ b/bin/varnishd/http2/cache_http2.h
@@ -248,6 +248,7 @@ h2_error h2h_decode_bytes(struct h2_sess *h2, const uint8_t *ptr,
     size_t len);
 
 /* cache_http2_send.c */
+#define H2_SEND_HELD(h2, r2) (VTAILQ_FIRST(&(h2)->txqueue) == (r2))
 void H2_Send_Get(struct worker *, struct h2_sess *, struct h2_req *);
 void H2_Send_Rel(struct h2_sess *, const struct h2_req *);
 
@@ -272,6 +273,10 @@ void h2_kill_req(struct worker *, struct h2_sess *, struct h2_req *, h2_error);
 int h2_rxframe(struct worker *, struct h2_sess *);
 h2_error h2_set_setting(struct h2_sess *, const uint8_t *);
 void h2_req_body(struct req*);
+int h2_rapid_reset_check(struct worker *wrk, struct h2_sess *h2,
+    const struct h2_req *r2);
+h2_error h2_rapid_reset_charge(struct worker *wrk, struct h2_sess *h2,
+    const struct h2_req *r2);
 task_func_t h2_do_req;
 #ifdef TRANSPORT_MAGIC
 vtr_req_fail_f h2_req_fail;
diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index dac8b3129..78a32a1cb 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -321,14 +321,14 @@ h2_rx_push_promise(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 /**********************************************************************
  */
 
-static h2_error
-h2_rapid_reset(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
+int
+h2_rapid_reset_check(struct worker *wrk, struct h2_sess *h2,
+    const struct h2_req *r2)
 {
 	vtim_real now;
-	vtim_dur d;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
-	ASSERT_RXTHR(h2);
+	CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
 	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
 
 	if (h2->rapid_reset_limit == 0)
@@ -340,6 +340,23 @@ h2_rapid_reset(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	if (now - r2->req->t_first > h2->rapid_reset)
 		return (0);
 
+	return (1);
+}
+
+h2_error
+h2_rapid_reset_charge(struct worker *wrk, struct h2_sess *h2,
+    const struct h2_req *r2)
+{
+	vtim_real now;
+	vtim_dur d;
+	h2_error h2e = NULL;
+
+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
+	AN(H2_SEND_HELD(h2, r2));
+	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
+
+	now = VTIM_real();
+
 	d = now - h2->last_rst;
 	h2->rst_budget += h2->rapid_reset_limit * d /
 	    h2->rapid_reset_period;
@@ -347,20 +364,23 @@ h2_rapid_reset(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	    h2->rapid_reset_limit);
 	h2->last_rst = now;
 
-	if (h2->rst_budget < 1.0) {
+	h2->rst_budget -= 1.0;
+
+	if (h2->rst_budget < 0) {
 		Lck_Lock(&h2->sess->mtx);
-		VSLb(h2->vsl, SLT_Error, "H2: Hit RST limit. Closing session.");
+		VSLb(h2->vsl, SLT_SessError, "H2: Hit RST limit. Closing session.");
 		Lck_Unlock(&h2->sess->mtx);
-		return (H2CE_RAPID_RESET);
+		h2e = H2CE_RAPID_RESET;
+		H2_Send_GOAWAY(wrk, h2, r2, h2e);
 	}
-	h2->rst_budget -= 1.0;
-	return (0);
+
+	return (h2e);
 }
 
 static h2_error v_matchproto_(h2_rxframe_f)
 h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 {
-	h2_error h2e;
+	h2_error h2e = NULL;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	ASSERT_RXTHR(h2);
@@ -370,7 +390,11 @@ h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 		return (H2CE_FRAME_SIZE_ERROR);
 	if (r2 == NULL)
 		return (0);
-	h2e = h2_rapid_reset(wrk, h2, r2);
+	if (h2_rapid_reset_check(wrk, h2, r2)) {
+		H2_Send_Get(wrk, h2, r2);
+		h2e = h2_rapid_reset_charge(wrk, h2, r2);
+		H2_Send_Rel(h2, r2);
+	}
 	h2_kill_req(wrk, h2, r2, h2_streamerror(vbe32dec(h2->rxf_data)));
 	return (h2e);
 }
diff --git a/bin/varnishd/http2/cache_http2_send.c b/bin/varnishd/http2/cache_http2_send.c
index eb8b17e3e..520f3e5eb 100644
--- a/bin/varnishd/http2/cache_http2_send.c
+++ b/bin/varnishd/http2/cache_http2_send.c
@@ -40,8 +40,6 @@
 #include "vend.h"
 #include "vtim.h"
 
-#define H2_SEND_HELD(h2, r2) (VTAILQ_FIRST(&(h2)->txqueue) == (r2))
-
 static h2_error
 h2_errcheck(const struct h2_req *r2, const struct h2_sess *h2)
 {

From martin at varnish-software.com  Wed Aug 13 12:03:06 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Wed, 13 Aug 2025 12:03:06 +0000 (UTC)
Subject: [6.0] 7c3fac93c H2: Check rapid reset whenever we send a RST frame
 for a stream
Message-ID: <20250813120306.3367964953@lists.varnish-cache.org>


commit 7c3fac93c39260873b87f69b6178e73abb42be6b
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Tue Jul 1 15:50:10 2025 +0200

    H2: Check rapid reset whenever we send a RST frame for a stream
    
    This checks and charges the rapid reset budget whenever we send a RST
    frame, causing a session error if the budget is exhausted.
    
    This fixes the reverse rapid reset vulnerability.

diff --git a/bin/varnishd/http2/cache_http2_send.c b/bin/varnishd/http2/cache_http2_send.c
index 520f3e5eb..51f5f0de8 100644
--- a/bin/varnishd/http2/cache_http2_send.c
+++ b/bin/varnishd/http2/cache_http2_send.c
@@ -419,6 +419,7 @@ H2_Send_RST(struct worker *wrk, struct h2_sess *h2, const struct h2_req *r2,
     uint32_t stream, h2_error h2e)
 {
 	char b[4];
+	h2_error h2e_rr = NULL;
 
 	CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
 	CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
@@ -431,6 +432,11 @@ H2_Send_RST(struct worker *wrk, struct h2_sess *h2, const struct h2_req *r2,
 	vbe32enc(b, h2e->val);
 
 	H2_Send_Frame(wrk, h2, H2_F_RST_STREAM, 0, sizeof b, stream, b);
+
+	if (h2_rapid_reset_check(wrk, h2, r2))
+		h2e_rr = h2_rapid_reset_charge(wrk, h2, r2);
+	if (h2e_rr != NULL)
+		h2->error = h2e_rr;
 }
 
 void
diff --git a/bin/varnishtest/tests/f00017.vtc b/bin/varnishtest/tests/f00017.vtc
new file mode 100644
index 000000000..6370652be
--- /dev/null
+++ b/bin/varnishtest/tests/f00017.vtc
@@ -0,0 +1,63 @@
+varnishtest "h2 reverse rapid reset"
+
+barrier b1 sock 2 -cyclic
+barrier b2 sock 5 -cyclic
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+varnish v1 -cliok "param.set feature +http2"
+varnish v1 -cliok "param.set debug +syncvsl"
+varnish v1 -cliok "param.set h2_rapid_reset_limit 3"
+varnish v1 -cliok "param.set h2_rapid_reset 5"
+
+varnish v1 -vcl+backend {
+	import vtc;
+
+	sub vcl_recv {
+		if (req.http.barrier) {
+			vtc.barrier_sync(req.http.barrier);
+		}
+		vtc.barrier_sync("${b2_sock}");
+	}
+
+} -start
+
+client c1 {
+	stream 0 {
+		rxgoaway
+		expect goaway.err == ENHANCE_YOUR_CALM
+	} -start
+
+	stream 1 {
+		txreq -hdr barrier ${b1_sock}
+		barrier b1 sync
+		txwinup -size 0
+		rxrst
+	} -run
+	stream 3 {
+		txreq -hdr barrier ${b1_sock}
+		barrier b1 sync
+		txwinup -size 0
+		rxrst
+	} -run
+	stream 5 {
+		txreq -hdr barrier ${b1_sock}
+		barrier b1 sync
+		txwinup -size 0
+		rxrst
+	} -run
+	stream 7 {
+		txreq -hdr barrier ${b1_sock}
+		barrier b1 sync
+		txwinup -size 0
+		rxrst
+	} -run
+
+	barrier b2 sync
+	stream 0 -wait
+} -run
+
+varnish v1 -expect sc_rapid_reset == 1

From martin at varnish-software.com  Wed Aug 13 12:03:06 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Wed, 13 Aug 2025 12:03:06 +0000 (UTC)
Subject: [6.0] eaf4dd5be Prepare for 6.0.15
Message-ID: <20250813120306.4CE1A6495C@lists.varnish-cache.org>


commit eaf4dd5be9deb39cb85360f1daaf3e586d1b0bf9
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Tue Aug 5 14:08:41 2025 +0200

    Prepare for 6.0.15

diff --git a/configure.ac b/configure.ac
index 1321aaf7d..c181770c9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ(2.59)
 AC_COPYRIGHT([Copyright (c) 2006 Verdens Gang AS
 Copyright (c) 2006-2025 Varnish Software])
 AC_REVISION([$Id$])
-AC_INIT([Varnish], [6.0.14], [varnish-dev at varnish-cache.org])
+AC_INIT([Varnish], [6.0.15], [varnish-dev at varnish-cache.org])
 AC_CONFIG_SRCDIR(include/miniobj.h)
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
diff --git a/doc/changes.rst b/doc/changes.rst
index 12170b4d2..5bd481780 100644
--- a/doc/changes.rst
+++ b/doc/changes.rst
@@ -26,6 +26,15 @@ http://varnish-cache.org/docs/trunk/whats-new/index.html and via
 individual releases. These documents are updated as part of the
 release process.
 
+=================================
+Varnish-Cache 6.0.15 (2025-08-05)
+=================================
+
+.. _VSV00017: https://varnish-cache.org/security/VSV00017.html
+
+* Check and carge the rapid reset budget whenever we reset an HTTP/2
+  stream. (VSV00017_)
+
 =================================
 Varnish-Cache 6.0.14 (2025-05-12)
 =================================

From phk at FreeBSD.org  Mon Aug 18 13:26:06 2025
From: phk at FreeBSD.org (Poul-Henning Kamp)
Date: Mon, 18 Aug 2025 13:26:06 +0000 (UTC)
Subject: [master] b3bec3804 Allocate more -sfile space so the test also runs
 on ppc64el
Message-ID: <20250818132606.6B5F81091B4@lists.varnish-cache.org>


commit b3bec38045f7f0bc7aab3a75024136d0d14a9bf5
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Aug 18 13:24:46 2025 +0000

    Allocate more -sfile space so the test also runs on ppc64el
    
    Fixes: #4379

diff --git a/bin/varnishtest/tests/r04036.vtc b/bin/varnishtest/tests/r04036.vtc
index babaac855..758ac0ea4 100644
--- a/bin/varnishtest/tests/r04036.vtc
+++ b/bin/varnishtest/tests/r04036.vtc
@@ -1,6 +1,6 @@
 varnishtest "Undefined storage properties"
 
-varnish v1 -arg "-s malloc=malloc -s file=file,${tmpdir}/file,2M" -vcl {
+varnish v1 -arg "-s malloc=malloc -s file=file,${tmpdir}/file,16M" -vcl {
 	backend be none;
 
 	sub vcl_recv {
@@ -11,5 +11,8 @@ varnish v1 -arg "-s malloc=malloc -s file=file,${tmpdir}/file,2M" -vcl {
 
 client c1 {
 	txreq
+
+	# The test-criteria is that varnishd does not panic.
 	rxresp
+	expect resp.status == 503
 } -run

From martin at varnish-software.com  Thu Aug 21 08:42:02 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Thu, 21 Aug 2025 08:42:02 +0000 (UTC)
Subject: [master] ed0b45dd2 H2: Add sanity assertions to h2_send_get_locked()
Message-ID: <20250821084202.ECC4C11C5DD@lists.varnish-cache.org>


commit ed0b45dd28ba8044f0c9e5af746124880062479c
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Wed Aug 20 13:21:34 2025 +0200

    H2: Add sanity assertions to h2_send_get_locked()
    
    These assertions guard against double-registering on the send queue.

diff --git a/bin/varnishd/http2/cache_http2_send.c b/bin/varnishd/http2/cache_http2_send.c
index 3461bdb38..620863385 100644
--- a/bin/varnishd/http2/cache_http2_send.c
+++ b/bin/varnishd/http2/cache_http2_send.c
@@ -107,6 +107,8 @@ h2_send_get_locked(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	Lck_AssertHeld(&h2->sess->mtx);
 	if (&wrk->cond == h2->cond)
 		ASSERT_RXTHR(h2);
+	AZ(H2_SEND_HELD(h2, r2));
+	AZ(r2->wrk);
 	r2->wrk = wrk;
 	VTAILQ_INSERT_TAIL(&h2->txqueue, r2, tx_list);
 	while (!H2_SEND_HELD(h2, r2))

From martin at varnish-software.com  Thu Aug 21 08:42:03 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Thu, 21 Aug 2025 08:42:03 +0000 (UTC)
Subject: [master] b82fd1eee H2: Use the correct queue context when sending
 rapid reset goaway
Message-ID: <20250821084203.101E311C5E0@lists.varnish-cache.org>


commit b82fd1eee320af32f16997e7e755f8f983ba42c8
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Wed Aug 20 13:22:15 2025 +0200

    H2: Use the correct queue context when sending rapid reset goaway
    
    When queing for send during rapid reset handling on incoming frame, it is
    `h2->req0` that should be used for queueing, not the `struct h2_req` of
    the stream for which we are handling the incoming frame. This error would
    lead to the queue structure becoming corrupted.
    
    Fixes: #4380

diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index fd10b34a8..2956516d6 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -408,9 +408,9 @@ h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	if (r2 == NULL)
 		return (0);
 	if (h2_rapid_reset_check(wrk, h2, r2)) {
-		H2_Send_Get(wrk, h2, r2);
-		h2e = h2_rapid_reset_charge(wrk, h2, r2);
-		H2_Send_Rel(h2, r2);
+		H2_Send_Get(wrk, h2, h2->req0);
+		h2e = h2_rapid_reset_charge(wrk, h2, h2->req0);
+		H2_Send_Rel(h2, h2->req0);
 	}
 	h2_kill_req(wrk, h2, r2, h2_streamerror(vbe32dec(h2->rxf_data)));
 	return (h2e);

From martin at varnish-software.com  Thu Aug 21 10:00:12 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Thu, 21 Aug 2025 10:00:12 +0000 (UTC)
Subject: [6.0] 617d138eb H2: Add sanity assertions to h2_send_get_locked()
Message-ID: <20250821100012.E2FF040A1@lists.varnish-cache.org>


commit 617d138eb30d0cb866547254b903702dabfe7ca9
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Wed Aug 20 13:21:34 2025 +0200

    H2: Add sanity assertions to h2_send_get_locked()
    
    These assertions guard against double-registering on the send queue.

diff --git a/bin/varnishd/http2/cache_http2_send.c b/bin/varnishd/http2/cache_http2_send.c
index 51f5f0de8..e6764fcbc 100644
--- a/bin/varnishd/http2/cache_http2_send.c
+++ b/bin/varnishd/http2/cache_http2_send.c
@@ -105,6 +105,8 @@ h2_send_get_locked(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	Lck_AssertHeld(&h2->sess->mtx);
 	if (&wrk->cond == h2->cond)
 		ASSERT_RXTHR(h2);
+	AZ(H2_SEND_HELD(h2, r2));
+	AZ(r2->wrk);
 	r2->wrk = wrk;
 	VTAILQ_INSERT_TAIL(&h2->txqueue, r2, tx_list);
 	while (!H2_SEND_HELD(h2, r2))

From martin at varnish-software.com  Thu Aug 21 10:00:12 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Thu, 21 Aug 2025 10:00:12 +0000 (UTC)
Subject: [6.0] 17eb4cfed H2: Use the correct queue context when sending rapid
 reset goaway
Message-ID: <20250821100013.043D340A5@lists.varnish-cache.org>


commit 17eb4cfed8a6c07317c29c05503c9ffc784349e1
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Wed Aug 20 13:22:15 2025 +0200

    H2: Use the correct queue context when sending rapid reset goaway
    
    When queing for send during rapid reset handling on incoming frame, it is
    `h2->req0` that should be used for queueing, not the `struct h2_req` of
    the stream for which we are handling the incoming frame. This error would
    lead to the queue structure becoming corrupted.
    
    Fixes: #4380

diff --git a/bin/varnishd/http2/cache_http2_proto.c b/bin/varnishd/http2/cache_http2_proto.c
index 78a32a1cb..fa0a84757 100644
--- a/bin/varnishd/http2/cache_http2_proto.c
+++ b/bin/varnishd/http2/cache_http2_proto.c
@@ -391,9 +391,9 @@ h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
 	if (r2 == NULL)
 		return (0);
 	if (h2_rapid_reset_check(wrk, h2, r2)) {
-		H2_Send_Get(wrk, h2, r2);
-		h2e = h2_rapid_reset_charge(wrk, h2, r2);
-		H2_Send_Rel(h2, r2);
+		H2_Send_Get(wrk, h2, h2->req0);
+		h2e = h2_rapid_reset_charge(wrk, h2, h2->req0);
+		H2_Send_Rel(h2, h2->req0);
 	}
 	h2_kill_req(wrk, h2, r2, h2_streamerror(vbe32dec(h2->rxf_data)));
 	return (h2e);

From martin at varnish-software.com  Thu Aug 21 10:00:13 2025
From: martin at varnish-software.com (Martin Blix Grydeland)
Date: Thu, 21 Aug 2025 10:00:13 +0000 (UTC)
Subject: [6.0] cc9219098 Prepare for 6.0.16
Message-ID: <20250821100013.2BA0640AA@lists.varnish-cache.org>


commit cc9219098d5fb5804eaef60a4e39c3478503857e
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Wed Aug 20 14:31:37 2025 +0200

    Prepare for 6.0.16

diff --git a/configure.ac b/configure.ac
index c181770c9..90448a3f9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ(2.59)
 AC_COPYRIGHT([Copyright (c) 2006 Verdens Gang AS
 Copyright (c) 2006-2025 Varnish Software])
 AC_REVISION([$Id$])
-AC_INIT([Varnish], [6.0.15], [varnish-dev at varnish-cache.org])
+AC_INIT([Varnish], [6.0.16], [varnish-dev at varnish-cache.org])
 AC_CONFIG_SRCDIR(include/miniobj.h)
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
diff --git a/doc/changes.rst b/doc/changes.rst
index 5bd481780..0dd6d9b71 100644
--- a/doc/changes.rst
+++ b/doc/changes.rst
@@ -26,6 +26,15 @@ http://varnish-cache.org/docs/trunk/whats-new/index.html and via
 individual releases. These documents are updated as part of the
 release process.
 
+=================================
+Varnish-Cache 6.0.16 (2025-08-20)
+=================================
+
+* Fixed a regression in the previous release that would lead to the HTTP/2
+  send queue becoming corrupted (4380_).
+
+.. _4380: https://github.com/varnishcache/varnish-cache/issues/4380
+
 =================================
 Varnish-Cache 6.0.15 (2025-08-05)
 =================================

From nils.goroll at uplex.de  Wed Aug 27 15:05:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Wed, 27 Aug 2025 15:05:05 +0000 (UTC)
Subject: [master] c127b445c Add VCL_Shutdown to wait for VCL references to
 vanish
Message-ID: <20250827150505.BD12D116D11@lists.varnish-cache.org>


commit c127b445c2b9dff9d90edc2cb8ab67a92daaf3d6
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Thu Mar 7 20:55:28 2024 +0100

    Add VCL_Shutdown to wait for VCL references to vanish
    
    Before shutting down stevedores, we should wait for VCL references to go
    away to, indirectly, ensure that all worker threads potentially using
    storage functions are done.
    
    See https://gitlab.com/uplex/varnish/slash/-/issues/61

diff --git a/bin/varnishd/cache/cache_main.c b/bin/varnishd/cache/cache_main.c
index 31b94829f..ec3ad199f 100644
--- a/bin/varnishd/cache/cache_main.c
+++ b/bin/varnishd/cache/cache_main.c
@@ -387,6 +387,20 @@ cli_quit(int sig)
 	WRONG("It's time for the big quit");
 }
 
+/*=====================================================================
+ * XXX Generalize?
+ */
+
+static void
+bit_set(volatile uint8_t *p, unsigned no)
+{
+	uint8_t b;
+
+	p += (no >> 3);
+	b = (0x80 >> (no & 7));
+	*p |= b;
+}
+
 /*=====================================================================
  * Run the child process
  */
@@ -538,12 +552,15 @@ child_main(int sigmagic, size_t altstksz)
 
 	CLI_Run();
 
+	bit_set(cache_param->debug_bits, DBG_VCLREL);
+
 	if (shutdown_delay > 0)
 		VTIM_sleep(shutdown_delay);
 
 	VCA_Shutdown();
 	BAN_Shutdown();
 	EXP_Shutdown();
+	VCL_Shutdown();
 	STV_close();
 
 	printf("Child dies\n");
diff --git a/bin/varnishd/cache/cache_varnishd.h b/bin/varnishd/cache/cache_varnishd.h
index 2892ef188..0efa22a29 100644
--- a/bin/varnishd/cache/cache_varnishd.h
+++ b/bin/varnishd/cache/cache_varnishd.h
@@ -502,6 +502,7 @@ struct vsb *VCL_Rel_CliCtx(struct vrt_ctx **);
 void VCL_Panic(struct vsb *, const char *nm, const struct vcl *);
 void VCL_Poll(void);
 void VCL_Init(void);
+void VCL_Shutdown(void);
 
 #define VCL_MET_MAC(l,u,t,b) \
     void VCL_##l##_method(struct vcl *, struct worker *, struct req *, \
diff --git a/bin/varnishd/cache/cache_vcl.c b/bin/varnishd/cache/cache_vcl.c
index 944834b29..aa81c95f2 100644
--- a/bin/varnishd/cache/cache_vcl.c
+++ b/bin/varnishd/cache/cache_vcl.c
@@ -1270,3 +1270,26 @@ VCL_Init(void)
 	Lck_New(&vcl_mtx, lck_vcl);
 	VSL_Setup(&vsl_cli, NULL, 0);
 }
+
+void
+VCL_Shutdown(void)
+{
+	struct vcl *vcl;
+	unsigned c = 0;
+
+	while (1) {
+		Lck_Lock(&vcl_mtx);
+		VTAILQ_FOREACH(vcl, &vcl_head, list)
+			if (vcl->busy)
+				break;
+		Lck_Unlock(&vcl_mtx);
+		if (vcl == NULL)
+			return;
+		if (++c % 10 == 0) {
+			fprintf(stderr, "shutdown waiting for %u reference%s "
+			    "on %s\n", vcl->busy, vcl->busy > 1 ? "s" : "",
+			    vcl->loaded_name);
+		}
+		usleep(100 * 1000);
+	}
+}

From nils.goroll at uplex.de  Wed Aug 27 15:05:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Wed, 27 Aug 2025 15:05:05 +0000 (UTC)
Subject: [master] fa975cf22 Exercise the two-step stevedore closing
 before/after waiting for ...
Message-ID: <20250827150505.D17F5116D14@lists.varnish-cache.org>


commit fa975cf220dd19c8e2505db290d22b6700b0d3a2
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Thu Mar 7 21:09:10 2024 +0100

    Exercise the two-step stevedore closing before/after waiting for ...
    
    VCL references to vanish

diff --git a/bin/varnishd/cache/cache_main.c b/bin/varnishd/cache/cache_main.c
index ec3ad199f..3c90d3a44 100644
--- a/bin/varnishd/cache/cache_main.c
+++ b/bin/varnishd/cache/cache_main.c
@@ -560,6 +560,7 @@ child_main(int sigmagic, size_t altstksz)
 	VCA_Shutdown();
 	BAN_Shutdown();
 	EXP_Shutdown();
+	STV_warn();
 	VCL_Shutdown();
 	STV_close();
 
diff --git a/bin/varnishd/cache/cache_varnishd.h b/bin/varnishd/cache/cache_varnishd.h
index 0efa22a29..572ad2a0b 100644
--- a/bin/varnishd/cache/cache_varnishd.h
+++ b/bin/varnishd/cache/cache_varnishd.h
@@ -582,6 +582,7 @@ void V2D_Init(void);
 
 /* stevedore.c */
 void STV_open(void);
+void STV_warn(void);
 void STV_close(void);
 const struct stevedore *STV_next(void);
 int STV_BanInfoDrop(const uint8_t *ban, unsigned len);
diff --git a/bin/varnishd/storage/stevedore.c b/bin/varnishd/storage/stevedore.c
index 9ab3ba501..a99558e59 100644
--- a/bin/varnishd/storage/stevedore.c
+++ b/bin/varnishd/storage/stevedore.c
@@ -198,19 +198,26 @@ STV_open(void)
 	AN(stv_h2_rxbuf);
 }
 
+void
+STV_warn(void)
+{
+	struct stevedore *stv;
+
+	ASSERT_CLI();
+	STV_Foreach(stv)
+		if (stv->close != NULL)
+			stv->close(stv, 1);
+}
+
 void
 STV_close(void)
 {
 	struct stevedore *stv;
-	int i;
 
 	ASSERT_CLI();
-	for (i = 1; i >= 0; i--) {
-		/* First send close warning */
-		STV_Foreach(stv)
-			if (stv->close != NULL)
-				stv->close(stv, i);
-	}
+	STV_Foreach(stv)
+		if (stv->close != NULL)
+			stv->close(stv, 0);
 }
 
 /*-------------------------------------------------------------------

From nils.goroll at uplex.de  Wed Aug 27 15:05:05 2025
From: nils.goroll at uplex.de (Nils Goroll)
Date: Wed, 27 Aug 2025 15:05:05 +0000 (UTC)
Subject: [master] eef2c9fce r01506.vtc: stabilize
Message-ID: <20250827150505.EBFFB116D17@lists.varnish-cache.org>


commit eef2c9fce78cf1931918ac69e077f58d423b8f28
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Wed Aug 27 16:49:31 2025 +0200

    r01506.vtc: stabilize
    
    stop varnish before shutting down a server which it might still be using.
    
    See https://github.com/varnishcache/varnish-cache/pull/4078#issuecomment-3228317852

diff --git a/bin/varnishtest/tests/r01506.vtc b/bin/varnishtest/tests/r01506.vtc
index c2e3d481e..9074dab41 100644
--- a/bin/varnishtest/tests/r01506.vtc
+++ b/bin/varnishtest/tests/r01506.vtc
@@ -68,4 +68,5 @@ client c1 {
 } -run
 
 varnish v1 -expect sc_range_short == 0
+varnish v1 -stop
 server s1 -wait

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:05 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:05 +0000 (UTC)
Subject: [master] c81973fb8 hash: Skip the unbusy ceremony for private objects
Message-ID: <20250827152305.BFF49117ACB@lists.varnish-cache.org>


commit c81973fb8f470c614003dd3a8b18da3821e68bf3
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Jan 22 17:17:04 2024 +0100

    hash: Skip the unbusy ceremony for private objects
    
    This reduces a great deal of spurious activity on the private_oh waiting
    list and removes unncessary conditionals when dealing with cacheable (or
    at least searchable) objects.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 0c6c8d654..5d133a88f 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -907,24 +907,27 @@ HSH_Unbusy(struct worker *wrk, struct objcore *oc)
 
 	oh = oc->objhead;
 	CHECK_OBJ(oh, OBJHEAD_MAGIC);
-	INIT_OBJ(&rush, RUSH_MAGIC);
 
 	AN(oc->stobj->stevedore);
 	AN(oc->flags & OC_F_BUSY);
 	assert(oh->refcnt > 0);
 	assert(oc->refcnt > 0);
 
-	if (!(oc->flags & OC_F_PRIVATE)) {
-		BAN_NewObjCore(oc);
-		AN(oc->ban);
+	if (oc->flags & OC_F_PRIVATE) {
+		oc->flags &= ~OC_F_BUSY;
+		return;
 	}
 
+	INIT_OBJ(&rush, RUSH_MAGIC);
+
+	BAN_NewObjCore(oc);
+	AN(oc->ban);
+
 	/* XXX: pretouch neighbors on oh->objcs to prevent page-on under mtx */
 	Lck_Lock(&oh->mtx);
 	assert(oh->refcnt > 0);
 	assert(oc->refcnt > 0);
-	if (!(oc->flags & OC_F_PRIVATE))
-		EXP_RefNewObjcore(oc); /* Takes a ref for expiry */
+	EXP_RefNewObjcore(oc); /* Takes a ref for expiry */
 	/* XXX: strictly speaking, we should sort in Date: order. */
 	VTAILQ_REMOVE(&oh->objcs, oc, hsh_list);
 	VTAILQ_INSERT_HEAD(&oh->objcs, oc, hsh_list);
@@ -934,8 +937,7 @@ HSH_Unbusy(struct worker *wrk, struct objcore *oc)
 		hsh_rush1(wrk, oh, &rush, HSH_RUSH_POLICY);
 	}
 	Lck_Unlock(&oh->mtx);
-	EXP_Insert(wrk, oc); /* Does nothing unless EXP_RefNewObjcore was
-			      * called */
+	EXP_Insert(wrk, oc);
 	hsh_rush2(wrk, &rush);
 }
 

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:05 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:05 +0000 (UTC)
Subject: [master] 093c3ad55 hash: Only grant OC_F_BUSY to lookup-able objects
Message-ID: <20250827152305.DB915117ACE@lists.varnish-cache.org>


commit 093c3ad55a39a5674ab6850e29afbd4ebe95596e
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Mar 4 18:31:10 2024 +0100

    hash: Only grant OC_F_BUSY to lookup-able objects
    
    The OC_F_BUSY flag is used to decide whether to disembark a request into
    an objhead's waiting list. Therefore, it makes sense to only give this
    flag to objcores for which the outcome may be a shareable object.
    
    This excludes synthetic and private (req.body and passed req) objcores,
    and objects inserted with HSH_Insert(). Inserted objects are never busy
    since they come already ready to use.
    
    Pass transactions don't need this flag either. The OC_F_BUSY flag was
    somewhat conflated with struct busyobj in the fetch state machine. We
    don't need OC_F_BUSY to convey that a fetch task is coordinated with a
    req task, oc->boc is already doing that. The OC_F_BUSY|OC_F_PRIVATE bits
    should be considered an oxymoron since OC_F_BUSY drives waiting list
    activity and OC_F_PRIVATE is for objects that are not shareable by
    definition.

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 4ea54d9f9..c707a22b6 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -934,7 +934,8 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	CHECK_OBJ_NOTNULL(bo, BUSYOBJ_MAGIC);
 	oc = bo->fetch_objcore;
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
-	AN(oc->flags & OC_F_BUSY);
+	CHECK_OBJ_NOTNULL(oc->boc, BOC_MAGIC);
+	assert(oc->boc->state < BOS_STREAM);
 	assert(bo->director_state == DIR_S_NULL);
 
 	if (wrk->vpi->handling != VCL_RET_ERROR)
@@ -1168,7 +1169,6 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
-	AN(oc->flags & OC_F_BUSY);
 	CHECK_OBJ_ORNULL(oldoc, OBJCORE_MAGIC);
 
 	bo = VBO_GetBusyObj(wrk, req);
@@ -1177,6 +1177,7 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 
 	boc = HSH_RefBoc(oc);
 	CHECK_OBJ_NOTNULL(boc, BOC_MAGIC);
+	assert(boc->state < BOS_STREAM);
 	boc->transit_buffer = cache_param->transit_buffer;
 
 	switch (mode) {
diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 5d133a88f..cd7c85c74 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -316,7 +316,7 @@ HSH_Insert(struct worker *wrk, const void *digest, struct objcore *oc,
 	AN(digest);
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 	AN(ban);
-	AN(oc->flags & OC_F_BUSY);
+	AZ(oc->flags & OC_F_BUSY);
 	AZ(oc->flags & OC_F_PRIVATE);
 	assert(oc->refcnt == 1);
 	INIT_OBJ(&rush, RUSH_MAGIC);
@@ -344,7 +344,6 @@ HSH_Insert(struct worker *wrk, const void *digest, struct objcore *oc,
 	Lck_Lock(&oh->mtx);
 	VTAILQ_REMOVE(&oh->objcs, oc, hsh_list);
 	VTAILQ_INSERT_HEAD(&oh->objcs, oc, hsh_list);
-	oc->flags &= ~OC_F_BUSY;
 	if (!VTAILQ_EMPTY(&oh->waitinglist))
 		hsh_rush1(wrk, oh, &rush, HSH_RUSH_POLICY);
 	Lck_Unlock(&oh->mtx);
@@ -370,7 +369,8 @@ hsh_insert_busyobj(const struct worker *wrk, struct objhead *oh)
 	wrk->wpriv->nobjcore = NULL;
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 
-	AN(oc->flags & OC_F_BUSY);
+	AZ(oc->flags & OC_F_BUSY);
+	oc->flags |= OC_F_BUSY;
 	oc->refcnt = 1;		/* Owned by busyobj */
 	oc->objhead = oh;
 	VTAILQ_INSERT_TAIL(&oh->objcs, oc, hsh_list);
@@ -821,15 +821,24 @@ HSH_Fail(struct objcore *oc)
 	struct objhead *oh;
 
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
+	CHECK_OBJ_NOTNULL(oc->boc, BOC_MAGIC);
 	oh = oc->objhead;
 	CHECK_OBJ(oh, OBJHEAD_MAGIC);
 
 	/*
-	 * We have to have either a busy bit, so that HSH_Lookup
-	 * will not consider this oc, or an object hung of the oc
+	 * We either failed before the end of vcl_backend_response
+	 * and a cache miss has the busy bit, so that HSH_Lookup()
+	 * will not consider this oc, or an object hung off the oc
 	 * so that it can consider it.
+	 *
+	 * We can only fail an ongoing fetch in a backend context
+	 * so we can safely check the BOC state as it won't change
+	 * under our feet.
 	 */
-	assert((oc->flags & OC_F_BUSY) || (oc->stobj->stevedore != NULL));
+	if (oc->boc->state < BOS_STREAM)
+		assert(oc->flags & (OC_F_BUSY|OC_F_PRIVATE));
+	else
+		assert(oc->stobj->stevedore != NULL);
 
 	Lck_Lock(&oh->mtx);
 	oc->flags |= OC_F_FAILED;
@@ -909,15 +918,15 @@ HSH_Unbusy(struct worker *wrk, struct objcore *oc)
 	CHECK_OBJ(oh, OBJHEAD_MAGIC);
 
 	AN(oc->stobj->stevedore);
-	AN(oc->flags & OC_F_BUSY);
 	assert(oh->refcnt > 0);
 	assert(oc->refcnt > 0);
 
 	if (oc->flags & OC_F_PRIVATE) {
-		oc->flags &= ~OC_F_BUSY;
+		AZ(oc->flags & OC_F_BUSY);
 		return;
 	}
 
+	AN(oc->flags & OC_F_BUSY);
 	INIT_OBJ(&rush, RUSH_MAGIC);
 
 	BAN_NewObjCore(oc);
diff --git a/bin/varnishd/cache/cache_obj.c b/bin/varnishd/cache/cache_obj.c
index c85ecd618..4c40d3b8d 100644
--- a/bin/varnishd/cache/cache_obj.c
+++ b/bin/varnishd/cache/cache_obj.c
@@ -140,8 +140,6 @@ ObjNew(const struct worker *wrk)
 	AN(oc);
 	wrk->stats->n_objectcore++;
 	oc->last_lru = NAN;
-	oc->flags = OC_F_BUSY;
-
 	oc->boc = obj_newboc();
 
 	return (oc);

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:05 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:05 +0000 (UTC)
Subject: [master] ee303d875 hash: Make HSH_Fail() rush the waiting list
Message-ID: <20250827152306.0EDA1117AD3@lists.varnish-cache.org>


commit ee303d875257f9896369c889a3fddc2c8917f68a
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Jan 22 15:55:55 2024 +0100

    hash: Make HSH_Fail() rush the waiting list
    
    This is not a nice caching outcome. In fact, when a fetch fails we don't
    know the outcome. In that case we need to rush one request that will
    trigger a new fetch and hopefully complete with a proper outcome to rush
    other requests accordingly.
    
    As far as lookup is concerned there is no point in keeping the OC_F_BUSY
    flag so in the case where a failure happens before a proper HSH_Unbusy()
    it can be dropped before the rush. This would otherwise happen once the
    last objcore reference is dropped. One is held by the current fetch task
    and the other one by the client task that triggerred the fetch. It would
    amount to an unnecessary delay.
    
    The OC_F_FAILED flag will prevent it from being looked up, so there is
    no reason to delay the rush until the final objcore reference is dropped.
    
    This also means that once the client task that triggered the fetch task
    resumes it can only be operating on a non-busy object.

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index c707a22b6..79798847d 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -1060,9 +1060,8 @@ vbf_stp_fail(struct worker *wrk, struct busyobj *bo)
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 
 	assert(oc->boc->state < BOS_FINISHED);
-	HSH_Fail(oc);
-	if (!(oc->flags & OC_F_BUSY))
-		HSH_Kill(oc);
+	HSH_Fail(wrk, oc);
+	HSH_Kill(oc);
 	ObjSetState(wrk, oc, BOS_FAILED);
 	return (F_STP_DONE);
 }
@@ -1250,11 +1249,9 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 			(void)VRB_Ignore(req);
 		} else {
 			ObjWaitState(oc, BOS_STREAM);
-			if (oc->boc->state == BOS_FAILED) {
-				AN((oc->flags & OC_F_FAILED));
-			} else {
-				AZ(oc->flags & OC_F_BUSY);
-			}
+			AZ(oc->flags & OC_F_BUSY);
+			if (oc->boc->state == BOS_FAILED)
+				AN(oc->flags & OC_F_FAILED);
 		}
 	}
 	AZ(bo);
diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index cd7c85c74..ed8244f2a 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -816,14 +816,17 @@ HSH_Purge(struct worker *wrk, struct objhead *oh, vtim_real ttl_now,
  */
 
 void
-HSH_Fail(struct objcore *oc)
+HSH_Fail(struct worker *wrk, struct objcore *oc)
 {
 	struct objhead *oh;
+	struct rush rush;
 
+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 	CHECK_OBJ_NOTNULL(oc->boc, BOC_MAGIC);
 	oh = oc->objhead;
 	CHECK_OBJ(oh, OBJHEAD_MAGIC);
+	INIT_OBJ(&rush, RUSH_MAGIC);
 
 	/*
 	 * We either failed before the end of vcl_backend_response
@@ -842,7 +845,12 @@ HSH_Fail(struct objcore *oc)
 
 	Lck_Lock(&oh->mtx);
 	oc->flags |= OC_F_FAILED;
+	if (oc->flags & OC_F_BUSY) {
+		oc->flags &= ~OC_F_BUSY;
+		hsh_rush1(wrk, oh, &rush, 1);
+	}
 	Lck_Unlock(&oh->mtx);
+	hsh_rush2(wrk, &rush);
 }
 
 /*---------------------------------------------------------------------
diff --git a/bin/varnishd/cache/cache_objhead.h b/bin/varnishd/cache/cache_objhead.h
index 2edfb5a88..866dbc4a2 100644
--- a/bin/varnishd/cache/cache_objhead.h
+++ b/bin/varnishd/cache/cache_objhead.h
@@ -65,11 +65,11 @@ enum lookup_e {
 	HSH_BUSY,
 };
 
-void HSH_Fail(struct objcore *);
 void HSH_Kill(struct objcore *);
 void HSH_Replace(struct objcore *, const struct objcore *);
 void HSH_Insert(struct worker *, const void *hash, struct objcore *,
     struct ban *);
+void HSH_Fail(struct worker *, struct objcore *);
 void HSH_Unbusy(struct worker *, struct objcore *);
 int HSH_Snipe(const struct worker *, struct objcore *);
 struct boc *HSH_RefBoc(const struct objcore *);

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] a63b4a53b obj: Rush objcores based on BOC state changes
Message-ID: <20250827152306.3D130117ADD@lists.varnish-cache.org>


commit a63b4a53b40d5b7365e3cdcdbe851c2542532c90
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Jan 22 14:58:27 2024 +0100

    obj: Rush objcores based on BOC state changes
    
    The BOS_PREP_STREAM state is retired. It was used as a stop-gap to
    "unbusy" objects before waking up the client task for good. Instead,
    the HSH_Unbusy() and HSH_Fail() functions are called once the gap is
    closed, depending on the outcome.
    
    This removes one unnecessary signal and consolidates multiple call
    sites, ensuring that objects always drop the OC_F_BUSY flag from a
    central location, for fetch tasks.

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 79798847d..f00516812 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -712,11 +712,8 @@ vbf_stp_fetch(struct worker *wrk, struct busyobj *bo)
 
 	assert(oc->boc->state == BOS_REQ_DONE);
 
-	if (bo->do_stream) {
-		ObjSetState(wrk, oc, BOS_PREP_STREAM);
-		HSH_Unbusy(wrk, oc);
+	if (bo->do_stream)
 		ObjSetState(wrk, oc, BOS_STREAM);
-	}
 
 	VSLb(bo->vsl, SLT_Fetch_Body, "%u %s %s",
 	    bo->htc->body_status->nbr, bo->htc->body_status->name,
@@ -751,11 +748,8 @@ vbf_stp_fetchend(struct worker *wrk, struct busyobj *bo)
 
 	if (bo->do_stream)
 		assert(oc->boc->state == BOS_STREAM);
-	else {
+	else
 		assert(oc->boc->state == BOS_REQ_DONE);
-		ObjSetState(wrk, oc, BOS_PREP_STREAM);
-		HSH_Unbusy(wrk, oc);
-	}
 
 	ObjSetState(wrk, oc, BOS_FINISHED);
 	VSLb_ts_busyobj(bo, "BerespBody", W_TIM_real(wrk));
@@ -884,11 +878,8 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 		ObjSetFlag(bo->wrk, oc, OF_IMSCAND, 0);
 	AZ(ObjCopyAttr(bo->wrk, oc, stale_oc, OA_GZIPBITS));
 
-	if (bo->do_stream) {
-		ObjSetState(wrk, oc, BOS_PREP_STREAM);
-		HSH_Unbusy(wrk, oc);
+	if (bo->do_stream)
 		ObjSetState(wrk, oc, BOS_STREAM);
-	}
 
 	INIT_OBJ(vop, VBF_OBITER_PRIV_MAGIC);
 	vop->bo = bo;
@@ -1038,8 +1029,6 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	assert(o == VSB_len(synth_body));
 	AZ(ObjSetU64(wrk, oc, OA_LEN, o));
 	VSB_destroy(&synth_body);
-	ObjSetState(wrk, oc, BOS_PREP_STREAM);
-	HSH_Unbusy(wrk, oc);
 	if (stale != NULL && oc->ttl > 0)
 		HSH_Kill(stale);
 	ObjSetState(wrk, oc, BOS_FINISHED);
@@ -1060,9 +1049,8 @@ vbf_stp_fail(struct worker *wrk, struct busyobj *bo)
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 
 	assert(oc->boc->state < BOS_FINISHED);
-	HSH_Fail(wrk, oc);
-	HSH_Kill(oc);
 	ObjSetState(wrk, oc, BOS_FAILED);
+	HSH_Kill(oc);
 	return (F_STP_DONE);
 }
 
diff --git a/bin/varnishd/cache/cache_obj.c b/bin/varnishd/cache/cache_obj.c
index 4c40d3b8d..172e29a8b 100644
--- a/bin/varnishd/cache/cache_obj.c
+++ b/bin/varnishd/cache/cache_obj.c
@@ -86,6 +86,7 @@
 
 #include "cache_varnishd.h"
 #include "cache_obj.h"
+#include "cache_objhead.h"
 #include "vend.h"
 #include "storage/storage.h"
 
@@ -490,8 +491,7 @@ ObjVAICancel(struct worker *wrk, struct boc *boc, struct vai_qe *qe)
  */
 
 void
-ObjSetState(struct worker *wrk, const struct objcore *oc,
-    enum boc_state_e next)
+ObjSetState(struct worker *wrk, struct objcore *oc, enum boc_state_e next)
 {
 	const struct obj_methods *om;
 
@@ -500,7 +500,6 @@ ObjSetState(struct worker *wrk, const struct objcore *oc,
 	assert(next > oc->boc->state);
 
 	CHECK_OBJ_ORNULL(oc->stobj->stevedore, STEVEDORE_MAGIC);
-	assert(next != BOS_STREAM || oc->boc->state == BOS_PREP_STREAM);
 	assert(next != BOS_FINISHED || (oc->oa_present & (1 << OA_LEN)));
 
 	if (oc->stobj->stevedore != NULL) {
@@ -509,6 +508,11 @@ ObjSetState(struct worker *wrk, const struct objcore *oc,
 			om->objsetstate(wrk, oc, next);
 	}
 
+	if (next == BOS_FAILED)
+		HSH_Fail(wrk, oc);
+	else if (oc->boc->state < BOS_STREAM && next >= BOS_STREAM)
+		HSH_Unbusy(wrk, oc);
+
 	Lck_Lock(&oc->boc->mtx);
 	oc->boc->state = next;
 	obj_boc_notify(oc->boc);
diff --git a/bin/varnishd/cache/cache_varnishd.h b/bin/varnishd/cache/cache_varnishd.h
index 572ad2a0b..1e00b4004 100644
--- a/bin/varnishd/cache/cache_varnishd.h
+++ b/bin/varnishd/cache/cache_varnishd.h
@@ -342,8 +342,7 @@ int ObjGetSpace(struct worker *, struct objcore *, ssize_t *sz, uint8_t **ptr);
 void ObjExtend(struct worker *, struct objcore *, ssize_t l, int final);
 uint64_t ObjWaitExtend(const struct worker *, const struct objcore *,
     uint64_t l, enum boc_state_e *statep);
-void ObjSetState(struct worker *, const struct objcore *,
-    enum boc_state_e next);
+void ObjSetState(struct worker *, struct objcore *, enum boc_state_e next);
 void ObjWaitState(const struct objcore *, enum boc_state_e want);
 void ObjTouch(struct worker *, struct objcore *, vtim_real now);
 void ObjFreeObj(struct worker *, struct objcore *);
diff --git a/include/tbl/boc_state.h b/include/tbl/boc_state.h
index 44984de81..2e0413660 100644
--- a/include/tbl/boc_state.h
+++ b/include/tbl/boc_state.h
@@ -32,7 +32,6 @@
 
 BOC_STATE(INVALID,	invalid)	/* don't touch (yet) */
 BOC_STATE(REQ_DONE,	req_done)	/* bereq.* can be examined */
-BOC_STATE(PREP_STREAM,	prep_stream)	/* Prepare for streaming */
 BOC_STATE(STREAM,	stream)		/* beresp.* can be examined */
 BOC_STATE(FINISHED,	finished)	/* object is complete */
 BOC_STATE(FAILED,	failed)		/* something went wrong */

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] 419001b6d hash: Trigger a rush when an objcore is withdrawn
Message-ID: <20250827152306.5CC0B117AE4@lists.varnish-cache.org>


commit 419001b6dec288f3e5e722465e05aa2508fb0f24
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Tue Dec 19 15:18:02 2023 +0100

    hash: Trigger a rush when an objcore is withdrawn
    
    This is the counterpart of HSH_Unbusy() for the cases where the req task
    will not schedule a fetch task, at which point we know we can already
    wake up a request, if there is one on the waiting list.
    
    This encapsulates the "wake up only one request" semantic using a new
    OC_F_WITHDRAWN flag. Although this flag is not being used yet, it will
    when the state of the objcore determines the rush policy instead of the
    call site.
    
    When a bgfetch is withdrawn, the extra rush becomes redundant with the
    policy rush on the hit objcore. There will eventually be no more rush
    for the hit objcore, which will remove the redundancy just introduced.
    
    In order to withdraw objcores in a single critical section, a function
    HSH_DerefObjCoreUnlock() is added.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index ed8244f2a..69c7da8fd 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -908,6 +908,37 @@ HSH_Cancel(struct worker *wrk, struct objcore *oc, struct boc *boc)
 	ObjSlim(wrk, oc);
 }
 
+/*---------------------------------------------------------------------
+ * Withdraw an objcore that will not proceed with a fetch.
+ */
+
+void
+HSH_Withdraw(struct worker *wrk, struct objcore **ocp)
+{
+	struct objhead *oh;
+	struct objcore *oc;
+	struct rush rush;
+
+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
+	TAKE_OBJ_NOTNULL(oc, ocp, OBJCORE_MAGIC);
+	INIT_OBJ(&rush, RUSH_MAGIC);
+
+	oh = oc->objhead;
+	CHECK_OBJ(oh, OBJHEAD_MAGIC);
+
+	Lck_Lock(&oh->mtx);
+	AZ(oc->stobj->stevedore);
+	AN(oc->flags & OC_F_BUSY);
+	assert(oc->refcnt == 1);
+	assert(oh->refcnt > 0);
+	oc->flags &= ~OC_F_BUSY;
+	oc->flags |= OC_F_WITHDRAWN;
+	hsh_rush1(wrk, oh, &rush, 1);
+	AZ(HSH_DerefObjCoreUnlock(wrk, &oc, 0));
+
+	hsh_rush2(wrk, &rush);
+}
+
 /*---------------------------------------------------------------------
  * Unbusy an objcore when the object is completely fetched.
  */
@@ -1094,6 +1125,23 @@ HSH_DerefBoc(struct worker *wrk, struct objcore *oc)
 
 int
 HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp, int rushmax)
+{
+	struct objcore *oc;
+	struct objhead *oh;
+
+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
+	TAKE_OBJ_NOTNULL(oc, ocp, OBJCORE_MAGIC);
+	assert(oc->refcnt > 0);
+
+	oh = oc->objhead;
+	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
+
+	Lck_Lock(&oh->mtx);
+	return (HSH_DerefObjCoreUnlock(wrk, &oc, rushmax));
+}
+
+int
+HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
 {
 	struct objcore *oc;
 	struct objhead *oh;
@@ -1108,7 +1156,7 @@ HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp, int rushmax)
 	oh = oc->objhead;
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 
-	Lck_Lock(&oh->mtx);
+	Lck_AssertHeld(&oh->mtx);
 	assert(oh->refcnt > 0);
 	r = --oc->refcnt;
 	if (!r)
diff --git a/bin/varnishd/cache/cache_objhead.h b/bin/varnishd/cache/cache_objhead.h
index 866dbc4a2..8d598d7b1 100644
--- a/bin/varnishd/cache/cache_objhead.h
+++ b/bin/varnishd/cache/cache_objhead.h
@@ -69,6 +69,7 @@ void HSH_Kill(struct objcore *);
 void HSH_Replace(struct objcore *, const struct objcore *);
 void HSH_Insert(struct worker *, const void *hash, struct objcore *,
     struct ban *);
+void HSH_Withdraw(struct worker *, struct objcore **);
 void HSH_Fail(struct worker *, struct objcore *);
 void HSH_Unbusy(struct worker *, struct objcore *);
 int HSH_Snipe(const struct worker *, struct objcore *);
@@ -79,6 +80,7 @@ void HSH_DeleteObjHead(const struct worker *, struct objhead *);
 int HSH_DerefObjCore(struct worker *, struct objcore **, int rushmax);
 #define HSH_RUSH_POLICY -1
 
+int HSH_DerefObjCoreUnlock(struct worker *, struct objcore **, int rushmax);
 enum lookup_e HSH_Lookup(struct req *, struct objcore **, struct objcore **);
 void HSH_Ref(struct objcore *o);
 void HSH_AddString(struct req *, void *ctx, const char *str);
diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index a8fa68be9..fa00acfdb 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -688,7 +688,7 @@ cnt_lookup(struct worker *wrk, struct req *req)
 	(void)HSH_DerefObjCore(wrk, &req->objcore, HSH_RUSH_POLICY);
 
 	if (busy != NULL) {
-		(void)HSH_DerefObjCore(wrk, &busy, 0);
+		HSH_Withdraw(wrk, &busy);
 		VRY_Clear(req);
 	}
 
@@ -736,7 +736,7 @@ cnt_miss(struct worker *wrk, struct req *req)
 	VRY_Clear(req);
 	if (req->stale_oc != NULL)
 		(void)HSH_DerefObjCore(wrk, &req->stale_oc, 0);
-	AZ(HSH_DerefObjCore(wrk, &req->objcore, 1));
+	HSH_Withdraw(wrk, &req->objcore);
 	return (REQ_FSM_MORE);
 }
 
@@ -1111,7 +1111,7 @@ cnt_purge(struct worker *wrk, struct req *req)
 
 	(void)HSH_Purge(wrk, boc->objhead, req->t_req, 0, 0, 0);
 
-	AZ(HSH_DerefObjCore(wrk, &boc, 1));
+	HSH_Withdraw(wrk, &boc);
 
 	VCL_purge_method(req->vcl, wrk, req, NULL, NULL);
 	switch (wrk->vpi->handling) {
diff --git a/include/tbl/oc_flags.h b/include/tbl/oc_flags.h
index 768962fda..0866cc38f 100644
--- a/include/tbl/oc_flags.h
+++ b/include/tbl/oc_flags.h
@@ -30,7 +30,8 @@
 
 /*lint -save -e525 -e539 */
 
-OC_FLAG(BUSY,		busy,		(1<<1))		//lint !e835
+OC_FLAG(WITHDRAWN,	withdrawn,	(1<<0))		//lint !e835
+OC_FLAG(BUSY,		busy,		(1<<1))
 OC_FLAG(HFM,		hfm,		(1<<2))
 OC_FLAG(HFP,		hfp,		(1<<3))
 OC_FLAG(CANCEL,		cancel,		(1<<4))

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] 94ec75e83 hash: Dropping an objcore does not rush the
 waiting list
Message-ID: <20250827152306.73E7D117AF7@lists.varnish-cache.org>


commit 94ec75e83998f9edcc79282cd4194c2e5dfda087
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Tue Dec 19 15:24:14 2023 +0100

    hash: Dropping an objcore does not rush the waiting list
    
    Rushing the waiting list because an objcore was dropped was a source
    of spurious wakeups, including the case where the dropped objcore is not
    even relevant to the objhead waiting list. It is now guaranteed that an
    object either dropped its OC_F_BUSY flag once ready (otherwise failed or
    withdrawn) or never had this flag to begin with for objcores that can't
    be looked up.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 69c7da8fd..ad7063976 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -1145,13 +1145,13 @@ HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
 {
 	struct objcore *oc;
 	struct objhead *oh;
-	struct rush rush;
 	int r;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	TAKE_OBJ_NOTNULL(oc, ocp, OBJCORE_MAGIC);
 	assert(oc->refcnt > 0);
-	INIT_OBJ(&rush, RUSH_MAGIC);
+
+	(void)rushmax;
 
 	oh = oc->objhead;
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
@@ -1161,15 +1161,11 @@ HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
 	r = --oc->refcnt;
 	if (!r)
 		VTAILQ_REMOVE(&oh->objcs, oc, hsh_list);
-	if (!VTAILQ_EMPTY(&oh->waitinglist)) {
-		assert(oh->refcnt > 1);
-		hsh_rush1(wrk, oh, &rush, rushmax);
-	}
 	Lck_Unlock(&oh->mtx);
-	hsh_rush2(wrk, &rush);
 	if (r != 0)
 		return (r);
 
+	AZ(oc->flags & OC_F_BUSY);
 	AZ(oc->exp_flags);
 
 	BAN_DestroyObj(oc);

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] cd7a442d1 hash: Operate waiting list rush on objcores
Message-ID: <20250827152306.8AFAE117AFB@lists.varnish-cache.org>


commit cd7a442d1532e5fbe0f79dd34a5c554b08c7afd8
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Jan 22 17:01:56 2024 +0100

    hash: Operate waiting list rush on objcores
    
    Operating on an objcore allows to preserve the different rush strategies
    that existed so far:
    
    - rush one request for failed fetch tasks
    - rush one request for withdrawn objects
    - rush rush_exponent requests otherwise
    
    For the cases where no rush is expected, a null objcore is passed.
    
    For cacheable objects, all waiters are temporarily woken up at once,
    until waiting list matches are handled separately.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index ad7063976..5f8d99fad 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -76,12 +76,12 @@ static const struct hash_slinger *hash;
 #define PRIVATE_OH_EXP 7
 static struct objhead private_ohs[1 << PRIVATE_OH_EXP];
 
-static void hsh_rush1(const struct worker *, struct objhead *,
-    struct rush *, int);
+static void hsh_rush1(const struct worker *, struct objcore *,
+    struct rush *);
 static void hsh_rush2(struct worker *, struct rush *);
 static int hsh_deref_objhead(struct worker *wrk, struct objhead **poh);
 static int hsh_deref_objhead_unlock(struct worker *wrk, struct objhead **poh,
-    int);
+    struct objcore *oc);
 
 /*---------------------------------------------------------------------*/
 
@@ -345,7 +345,7 @@ HSH_Insert(struct worker *wrk, const void *digest, struct objcore *oc,
 	VTAILQ_REMOVE(&oh->objcs, oc, hsh_list);
 	VTAILQ_INSERT_HEAD(&oh->objcs, oc, hsh_list);
 	if (!VTAILQ_EMPTY(&oh->waitinglist))
-		hsh_rush1(wrk, oh, &rush, HSH_RUSH_POLICY);
+		hsh_rush1(wrk, oc, &rush);
 	Lck_Unlock(&oh->mtx);
 	hsh_rush2(wrk, &rush);
 
@@ -535,7 +535,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	if (oc != NULL && oc->flags & OC_F_HFP) {
 		xid = VXID(ObjGetXID(wrk, oc));
 		dttl = EXP_Dttl(req, oc);
-		AN(hsh_deref_objhead_unlock(wrk, &oh, HSH_RUSH_POLICY));
+		AN(hsh_deref_objhead_unlock(wrk, &oh, oc));
 		wrk->stats->cache_hitpass++;
 		VSLb(req->vsl, SLT_HitPass, "%u %.6f", xid, dttl);
 		return (HSH_HITPASS);
@@ -555,7 +555,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 		}
 		oc->hits++;
 		boc_progress = oc->boc == NULL ? -1 : oc->boc->fetched_so_far;
-		AN(hsh_deref_objhead_unlock(wrk, &oh, HSH_RUSH_POLICY));
+		AN(hsh_deref_objhead_unlock(wrk, &oh, oc));
 		Req_LogHit(wrk, req, oc, boc_progress);
 		return (HSH_HIT);
 	}
@@ -604,7 +604,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 		exp_oc->refcnt++;
 		*ocp = exp_oc;
 		exp_oc->hits++;
-		AN(hsh_deref_objhead_unlock(wrk, &oh, 0));
+		AN(hsh_deref_objhead_unlock(wrk, &oh, NULL));
 		Req_LogHit(wrk, req, exp_oc, boc_progress);
 		return (HSH_GRACE);
 	}
@@ -637,22 +637,34 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
  */
 
 static void
-hsh_rush1(const struct worker *wrk, struct objhead *oh, struct rush *r, int max)
+hsh_rush1(const struct worker *wrk, struct objcore *oc, struct rush *r)
 {
-	int i;
+	struct objhead *oh;
 	struct req *req;
-
-	if (max == 0)
-		return;
-	if (max == HSH_RUSH_POLICY)
-		max = cache_param->rush_exponent;
-	assert(max > 0);
+	int i, max;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
-	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
+	CHECK_OBJ_ORNULL(oc, OBJCORE_MAGIC);
 	CHECK_OBJ_NOTNULL(r, RUSH_MAGIC);
 	VTAILQ_INIT(&r->reqs);
+
+	if (oc == NULL)
+		return;
+
+	oh = oc->objhead;
+	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 	Lck_AssertHeld(&oh->mtx);
+
+	AZ(oc->flags & OC_F_BUSY);
+	AZ(oc->flags & OC_F_PRIVATE);
+	if (oc->flags & (OC_F_WITHDRAWN|OC_F_FAILED))
+		max = 1;
+	else if (oc->flags & (OC_F_HFM|OC_F_HFP|OC_F_CANCEL|OC_F_DYING))
+		max = cache_param->rush_exponent;
+	else
+		max = INT_MAX; /* XXX: temp */
+	assert(max > 0);
+
 	for (i = 0; i < max; i++) {
 		req = VTAILQ_FIRST(&oh->waitinglist);
 		if (req == NULL)
@@ -847,7 +859,7 @@ HSH_Fail(struct worker *wrk, struct objcore *oc)
 	oc->flags |= OC_F_FAILED;
 	if (oc->flags & OC_F_BUSY) {
 		oc->flags &= ~OC_F_BUSY;
-		hsh_rush1(wrk, oh, &rush, 1);
+		hsh_rush1(wrk, oc, &rush);
 	}
 	Lck_Unlock(&oh->mtx);
 	hsh_rush2(wrk, &rush);
@@ -933,7 +945,7 @@ HSH_Withdraw(struct worker *wrk, struct objcore **ocp)
 	assert(oh->refcnt > 0);
 	oc->flags &= ~OC_F_BUSY;
 	oc->flags |= OC_F_WITHDRAWN;
-	hsh_rush1(wrk, oh, &rush, 1);
+	hsh_rush1(wrk, oc, &rush);
 	AZ(HSH_DerefObjCoreUnlock(wrk, &oc, 0));
 
 	hsh_rush2(wrk, &rush);
@@ -982,7 +994,7 @@ HSH_Unbusy(struct worker *wrk, struct objcore *oc)
 	oc->flags &= ~OC_F_BUSY;
 	if (!VTAILQ_EMPTY(&oh->waitinglist)) {
 		assert(oh->refcnt > 1);
-		hsh_rush1(wrk, oh, &rush, HSH_RUSH_POLICY);
+		hsh_rush1(wrk, oc, &rush);
 	}
 	Lck_Unlock(&oh->mtx);
 	EXP_Insert(wrk, oc);
@@ -1182,7 +1194,8 @@ HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
 }
 
 static int
-hsh_deref_objhead_unlock(struct worker *wrk, struct objhead **poh, int max)
+hsh_deref_objhead_unlock(struct worker *wrk, struct objhead **poh,
+    struct objcore *oc)
 {
 	struct objhead *oh;
 	struct rush rush;
@@ -1211,7 +1224,7 @@ hsh_deref_objhead_unlock(struct worker *wrk, struct objhead **poh, int max)
 	INIT_OBJ(&rush, RUSH_MAGIC);
 	if (!VTAILQ_EMPTY(&oh->waitinglist)) {
 		assert(oh->refcnt > 1);
-		hsh_rush1(wrk, oh, &rush, max);
+		hsh_rush1(wrk, oc, &rush);
 	}
 
 	if (oh->refcnt == 1)
@@ -1232,7 +1245,7 @@ hsh_deref_objhead(struct worker *wrk, struct objhead **poh)
 	TAKE_OBJ_NOTNULL(oh, poh, OBJHEAD_MAGIC);
 
 	Lck_Lock(&oh->mtx);
-	return (hsh_deref_objhead_unlock(wrk, &oh, 0));
+	return (hsh_deref_objhead_unlock(wrk, &oh, NULL));
 }
 
 void

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] 8697de332 hash: Retire HSH_RUSH_POLICY
Message-ID: <20250827152306.A71BC117AFF@lists.varnish-cache.org>


commit 8697de3329d1ac51c25082d33751fe49bbd2fb1b
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Tue Dec 19 10:35:23 2023 +0100

    hash: Retire HSH_RUSH_POLICY
    
    From now on, the policy will be derived from the objcore.

diff --git a/bin/varnishd/cache/cache_ban_lurker.c b/bin/varnishd/cache/cache_ban_lurker.c
index 3057312c0..a36bc32b2 100644
--- a/bin/varnishd/cache/cache_ban_lurker.c
+++ b/bin/varnishd/cache/cache_ban_lurker.c
@@ -333,7 +333,7 @@ ban_lurker_test_ban(struct worker *wrk, struct ban *bt,
 			if (i)
 				ObjSendEvent(wrk, oc, OEV_BANCHG);
 		}
-		(void)HSH_DerefObjCore(wrk, &oc, 0);
+		(void)HSH_DerefObjCore(wrk, &oc);
 	}
 }
 
diff --git a/bin/varnishd/cache/cache_busyobj.c b/bin/varnishd/cache/cache_busyobj.c
index 42332ecd7..c8814a7bb 100644
--- a/bin/varnishd/cache/cache_busyobj.c
+++ b/bin/varnishd/cache/cache_busyobj.c
@@ -157,8 +157,7 @@ VBO_ReleaseBusyObj(struct worker *wrk, struct busyobj **pbo)
 		wrk->stats->ws_backend_overflow++;
 
 	if (bo->fetch_objcore != NULL) {
-		(void)HSH_DerefObjCore(wrk, &bo->fetch_objcore,
-		    HSH_RUSH_POLICY);
+		(void)HSH_DerefObjCore(wrk, &bo->fetch_objcore);
 	}
 
 	VRT_Assign_Backend(&bo->director_req, NULL);
diff --git a/bin/varnishd/cache/cache_expire.c b/bin/varnishd/cache/cache_expire.c
index 8e459140b..75a45bc5a 100644
--- a/bin/varnishd/cache/cache_expire.c
+++ b/bin/varnishd/cache/cache_expire.c
@@ -213,7 +213,7 @@ EXP_Insert(struct worker *wrk, struct objcore *oc)
 		ObjSendEvent(wrk, oc, OEV_EXPIRE);
 		tmpoc = oc;
 		assert(oc->refcnt >= 2); /* Silence coverity */
-		(void)HSH_DerefObjCore(wrk, &oc, 0);
+		(void)HSH_DerefObjCore(wrk, &oc);
 		AZ(oc);
 		assert(tmpoc->refcnt >= 1); /* Silence coverity */
 	}
@@ -309,7 +309,7 @@ exp_inbox(struct exp_priv *ep, struct objcore *oc, unsigned flags, vtim_real now
 		    VXID(ObjGetXID(ep->wrk, oc)), EXP_Ttl(NULL, oc) - now,
 		    (intmax_t)oc->hits);
 		ObjSendEvent(ep->wrk, oc, OEV_EXPIRE);
-		(void)HSH_DerefObjCore(ep->wrk, &oc, 0);
+		(void)HSH_DerefObjCore(ep->wrk, &oc);
 		return;
 	}
 
@@ -387,7 +387,7 @@ exp_expire(struct exp_priv *ep, vtim_real now)
 		    VXID(ObjGetXID(ep->wrk, oc)), EXP_Ttl(NULL, oc) - now,
 		    (intmax_t)oc->hits);
 		ObjSendEvent(ep->wrk, oc, OEV_EXPIRE);
-		(void)HSH_DerefObjCore(ep->wrk, &oc, 0);
+		(void)HSH_DerefObjCore(ep->wrk, &oc);
 	}
 	return (0);
 }
diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index f00516812..8af011fb7 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -1122,7 +1122,7 @@ vbf_fetch_thread(struct worker *wrk, void *priv)
 	http_Teardown(bo->beresp);
 	// cannot make assumptions about the number of references here #3434
 	if (bo->bereq_body != NULL)
-		(void) HSH_DerefObjCore(bo->wrk, &bo->bereq_body, 0);
+		(void)HSH_DerefObjCore(bo->wrk, &bo->bereq_body);
 
 	if (oc->boc->state == BOS_FINISHED) {
 		AZ(oc->flags & OC_F_FAILED);
@@ -1132,7 +1132,7 @@ vbf_fetch_thread(struct worker *wrk, void *priv)
 	// AZ(oc->boc);	// XXX
 
 	if (bo->stale_oc != NULL)
-		(void)HSH_DerefObjCore(wrk, &bo->stale_oc, 0);
+		(void)HSH_DerefObjCore(wrk, &bo->stale_oc);
 
 	wrk->vsl = NULL;
 	HSH_DerefBoc(wrk, oc);
@@ -1224,7 +1224,7 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 		    "No thread available for bgfetch");
 		(void)vbf_stp_fail(req->wrk, bo);
 		if (bo->stale_oc != NULL)
-			(void)HSH_DerefObjCore(wrk, &bo->stale_oc, 0);
+			(void)HSH_DerefObjCore(wrk, &bo->stale_oc);
 		HSH_DerefBoc(wrk, oc);
 		SES_Rel(bo->sp);
 		THR_SetBusyobj(NULL);
@@ -1247,5 +1247,5 @@ VBF_Fetch(struct worker *wrk, struct req *req, struct objcore *oc,
 	assert(oc->boc == boc);
 	HSH_DerefBoc(wrk, oc);
 	if (mode == VBF_BACKGROUND)
-		(void)HSH_DerefObjCore(wrk, &oc, HSH_RUSH_POLICY);
+		(void)HSH_DerefObjCore(wrk, &oc);
 }
diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 5f8d99fad..14259fa5d 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -794,7 +794,7 @@ HSH_Purge(struct worker *wrk, struct objhead *oh, vtim_real ttl_now,
 				EXP_Remove(ocp[i], NULL);
 			else
 				EXP_Reduce(ocp[i], ttl_now, ttl, grace, keep);
-			(void)HSH_DerefObjCore(wrk, &ocp[i], 0);
+			(void)HSH_DerefObjCore(wrk, &ocp[i]);
 			AZ(ocp[i]);
 			total++;
 		}
@@ -946,7 +946,7 @@ HSH_Withdraw(struct worker *wrk, struct objcore **ocp)
 	oc->flags &= ~OC_F_BUSY;
 	oc->flags |= OC_F_WITHDRAWN;
 	hsh_rush1(wrk, oc, &rush);
-	AZ(HSH_DerefObjCoreUnlock(wrk, &oc, 0));
+	AZ(HSH_DerefObjCoreUnlock(wrk, &oc));
 
 	hsh_rush2(wrk, &rush);
 }
@@ -1136,7 +1136,7 @@ HSH_DerefBoc(struct worker *wrk, struct objcore *oc)
  */
 
 int
-HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp, int rushmax)
+HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp)
 {
 	struct objcore *oc;
 	struct objhead *oh;
@@ -1149,11 +1149,11 @@ HSH_DerefObjCore(struct worker *wrk, struct objcore **ocp, int rushmax)
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 
 	Lck_Lock(&oh->mtx);
-	return (HSH_DerefObjCoreUnlock(wrk, &oc, rushmax));
+	return (HSH_DerefObjCoreUnlock(wrk, &oc));
 }
 
 int
-HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
+HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp)
 {
 	struct objcore *oc;
 	struct objhead *oh;
@@ -1163,8 +1163,6 @@ HSH_DerefObjCoreUnlock(struct worker *wrk, struct objcore **ocp, int rushmax)
 	TAKE_OBJ_NOTNULL(oc, ocp, OBJCORE_MAGIC);
 	assert(oc->refcnt > 0);
 
-	(void)rushmax;
-
 	oh = oc->objhead;
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 
diff --git a/bin/varnishd/cache/cache_objhead.h b/bin/varnishd/cache/cache_objhead.h
index 8d598d7b1..94ef81db5 100644
--- a/bin/varnishd/cache/cache_objhead.h
+++ b/bin/varnishd/cache/cache_objhead.h
@@ -76,11 +76,8 @@ int HSH_Snipe(const struct worker *, struct objcore *);
 struct boc *HSH_RefBoc(const struct objcore *);
 void HSH_DerefBoc(struct worker *wrk, struct objcore *);
 void HSH_DeleteObjHead(const struct worker *, struct objhead *);
-
-int HSH_DerefObjCore(struct worker *, struct objcore **, int rushmax);
-#define HSH_RUSH_POLICY -1
-
-int HSH_DerefObjCoreUnlock(struct worker *, struct objcore **, int rushmax);
+int HSH_DerefObjCore(struct worker *, struct objcore **);
+int HSH_DerefObjCoreUnlock(struct worker *, struct objcore **);
 enum lookup_e HSH_Lookup(struct req *, struct objcore **, struct objcore **);
 void HSH_Ref(struct objcore *o);
 void HSH_AddString(struct req *, void *ctx, const char *str);
diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
index 9a4cd54d7..cd1942163 100644
--- a/bin/varnishd/cache/cache_req_body.c
+++ b/bin/varnishd/cache/cache_req_body.c
@@ -80,7 +80,7 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 	if (STV_NewObject(req->wrk, req->body_oc, stv, 0) == 0) {
 		req->req_body_status = BS_ERROR;
 		HSH_DerefBoc(req->wrk, req->body_oc);
-		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc));
 		(void)VFP_Error(vfc, "Object allocation failed:"
 		    " Ran out of space in %s", stv->vclname);
 		return (-1);
@@ -96,7 +96,7 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 		(void)VFP_Error(vfc, "req.body filters failed");
 		req->req_body_status = BS_ERROR;
 		HSH_DerefBoc(req->wrk, req->body_oc);
-		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc));
 		return (-1);
 	}
 
@@ -104,7 +104,7 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 	if (VFP_Open(ctx, vfc) < 0) {
 		req->req_body_status = BS_ERROR;
 		HSH_DerefBoc(req->wrk, req->body_oc);
-		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc));
 		return (-1);
 	}
 
@@ -152,7 +152,7 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 	VSLb_ts_req(req, "ReqBody", VTIM_real());
 	if (func != NULL) {
 		HSH_DerefBoc(req->wrk, req->body_oc);
-		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc));
 		if (vfps == VFP_END && r == 0 && (flush & OBJ_ITER_END) == 0)
 			r = func(priv, flush | OBJ_ITER_END, NULL, 0);
 		if (vfps != VFP_END) {
@@ -168,7 +168,7 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 
 	if (vfps != VFP_END) {
 		req->req_body_status = BS_ERROR;
-		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc));
 		return (-1);
 	}
 
@@ -289,7 +289,7 @@ VRB_Free(struct req *req)
 	if (req->body_oc == NULL)
 		return;
 
-	r = HSH_DerefObjCore(req->wrk, &req->body_oc, 0);
+	r = HSH_DerefObjCore(req->wrk, &req->body_oc);
 
 	// each busyobj may have gained a reference
 	assert (r >= 0);
diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index fa00acfdb..77481a41d 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -222,7 +222,7 @@ cnt_deliver(struct worker *wrk, struct req *req)
 	ObjTouch(req->wrk, req->objcore, req->t_prev);
 
 	if (Resp_Setup_Deliver(req)) {
-		(void)HSH_DerefObjCore(wrk, &req->objcore, HSH_RUSH_POLICY);
+		(void)HSH_DerefObjCore(wrk, &req->objcore);
 		req->err_code = 500;
 		req->req_step = R_STP_SYNTH;
 		return (REQ_FSM_MORE);
@@ -240,7 +240,7 @@ cnt_deliver(struct worker *wrk, struct req *req)
 
 	if (wrk->vpi->handling != VCL_RET_DELIVER) {
 		HSH_Cancel(wrk, req->objcore, NULL);
-		(void)HSH_DerefObjCore(wrk, &req->objcore, HSH_RUSH_POLICY);
+		(void)HSH_DerefObjCore(wrk, &req->objcore);
 		http_Teardown(req->resp);
 
 		switch (wrk->vpi->handling) {
@@ -413,7 +413,7 @@ cnt_synth(struct worker *wrk, struct req *req)
 		VSLb(req->vsl, SLT_Error, "Could not get storage");
 		req->doclose = SC_OVERLOAD;
 		VSLb_ts_req(req, "Resp", W_TIM_real(wrk));
-		(void)HSH_DerefObjCore(wrk, &req->objcore, 1);
+		(void)HSH_DerefObjCore(wrk, &req->objcore);
 		http_Teardown(req->resp);
 		return (REQ_FSM_DONE);
 	}
@@ -529,7 +529,7 @@ cnt_finish(struct worker *wrk, struct req *req)
 		req->boc = NULL;
 	}
 
-	(void)HSH_DerefObjCore(wrk, &req->objcore, HSH_RUSH_POLICY);
+	(void)HSH_DerefObjCore(wrk, &req->objcore);
 	http_Teardown(req->resp);
 
 	req->vdp_filter_list = NULL;
@@ -557,7 +557,7 @@ cnt_fetch(struct worker *wrk, struct req *req)
 	if (req->objcore->flags & OC_F_FAILED) {
 		req->err_code = 503;
 		req->req_step = R_STP_SYNTH;
-		(void)HSH_DerefObjCore(wrk, &req->objcore, 1);
+		(void)HSH_DerefObjCore(wrk, &req->objcore);
 		AZ(req->objcore);
 		return (REQ_FSM_MORE);
 	}
@@ -685,7 +685,7 @@ cnt_lookup(struct worker *wrk, struct req *req)
 	}
 
 	/* Drop our object, we won't need it */
-	(void)HSH_DerefObjCore(wrk, &req->objcore, HSH_RUSH_POLICY);
+	(void)HSH_DerefObjCore(wrk, &req->objcore);
 
 	if (busy != NULL) {
 		HSH_Withdraw(wrk, &busy);
@@ -715,7 +715,7 @@ cnt_miss(struct worker *wrk, struct req *req)
 		wrk->stats->cache_miss++;
 		VBF_Fetch(wrk, req, req->objcore, req->stale_oc, VBF_NORMAL);
 		if (req->stale_oc != NULL)
-			(void)HSH_DerefObjCore(wrk, &req->stale_oc, 0);
+			(void)HSH_DerefObjCore(wrk, &req->stale_oc);
 		req->req_step = R_STP_FETCH;
 		return (REQ_FSM_MORE);
 	case VCL_RET_FAIL:
@@ -735,7 +735,7 @@ cnt_miss(struct worker *wrk, struct req *req)
 	}
 	VRY_Clear(req);
 	if (req->stale_oc != NULL)
-		(void)HSH_DerefObjCore(wrk, &req->stale_oc, 0);
+		(void)HSH_DerefObjCore(wrk, &req->stale_oc);
 	HSH_Withdraw(wrk, &req->objcore);
 	return (REQ_FSM_MORE);
 }
diff --git a/bin/varnishd/cache/cache_vrt_var.c b/bin/varnishd/cache/cache_vrt_var.c
index b01b97460..4fcdf52c6 100644
--- a/bin/varnishd/cache/cache_vrt_var.c
+++ b/bin/varnishd/cache/cache_vrt_var.c
@@ -644,7 +644,7 @@ VRT_u_bereq_body(VRT_CTX)
 	http_Unset(ctx->bo->bereq, H_Content_Length);
 
 	if (ctx->bo->bereq_body != NULL)
-		(void)HSH_DerefObjCore(ctx->bo->wrk, &ctx->bo->bereq_body, 0);
+		(void)HSH_DerefObjCore(ctx->bo->wrk, &ctx->bo->bereq_body);
 
 	if (ctx->bo->req != NULL) {
 		CHECK_OBJ(ctx->bo->req, REQ_MAGIC);
diff --git a/bin/varnishd/storage/storage_lru.c b/bin/varnishd/storage/storage_lru.c
index 5e046e794..ec0369c81 100644
--- a/bin/varnishd/storage/storage_lru.c
+++ b/bin/varnishd/storage/storage_lru.c
@@ -205,6 +205,6 @@ LRU_NukeOne(struct worker *wrk, struct lru *lru)
 	ObjSlim(wrk, oc);
 
 	VSLb(wrk->vsl, SLT_ExpKill, "LRU xid=%ju", VXID(ObjGetXID(wrk, oc)));
-	(void)HSH_DerefObjCore(wrk, &oc, 0);	// Ref from HSH_Snipe
+	(void)HSH_DerefObjCore(wrk, &oc);	// Ref from HSH_Snipe
 	return (1);
 }
diff --git a/bin/varnishd/storage/storage_persistent_silo.c b/bin/varnishd/storage/storage_persistent_silo.c
index 81c24b436..eb96acd3a 100644
--- a/bin/varnishd/storage/storage_persistent_silo.c
+++ b/bin/varnishd/storage/storage_persistent_silo.c
@@ -178,7 +178,7 @@ smp_load_seg(struct worker *wrk, const struct smp_sc *sc,
 		HSH_Insert(wrk, so->hash, oc, ban);
 		AN(oc->ban);
 		HSH_DerefBoc(wrk, oc);	// XXX Keep it an stream resurrection?
-		(void)HSH_DerefObjCore(wrk, &oc, HSH_RUSH_POLICY);
+		(void)HSH_DerefObjCore(wrk, &oc);
 		wrk->stats->n_vampireobject++;
 	}
 	Pool_Sumstat(wrk);

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] 11c036735 hash: Treat a waiting list match as a revalidation
Message-ID: <20250827152306.C47EC117B0B@lists.varnish-cache.org>


commit 11c03673583397cb1b0cbec87b7ebbd025d38904
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Jan 22 23:17:44 2024 +0100

    hash: Treat a waiting list match as a revalidation
    
    A rush used to be indiscriminate, and it is now operated based on the
    state of an objcore, by inspecting its flags. That change of behavior
    freed call sites from having to know what kind of rush to operate, and
    more importantly removed the need to attempt a rush whenever an objcore
    reference was released. It ensured that an objcore would only get the
    OC_F_BUSY flag if it was created for the purpose of a fetch, with the
    guarantee that a rush would be triggered as soon as the fetch got an
    outcome:
    
    - withdrawn (fetch not even attempted)
    - failed
    - ready (either for streaming, or complete)
    
    All these prior changes built up to this change, allowing the effective
    implementation of the unqualified form for the cache-control no-cache
    directive.
    
    RFC9112 describe the server-side no-cache directive like this:
    
    > The no-cache response directive, in its unqualified form (without an
    > argument), indicates that the response MUST NOT be used to satisfy any
    > other request without forwarding it for validation and receiving a
    > successful response; see Section 4.3.
    
    This can translate in VCL as beresp.ttl == 0 and beresp.grace == 0, but
    still allowing to serve from cache.
    
    Doing this naively leads to an infamous "waiting list serialization"
    phenomenon that tends to take time to diagnose and depending on the
    setup may be easy to remediate.
    
    One way to solve this from a Varnish perspective is to assimilate the
    waiting list as a collection of requests waiting for a response to be
    validated or revalidated. In the event of a no-cache directive (or VCL
    override to zero beresp.ttl and beresp.grace) and in the absence of
    any other criterion preventing an object to be cached, all the requests
    can consume the just-validated response.
    
    To make this possible, a few things needed to change. A happens-before
    relationship between entering the waiting list and taking part in the
    rush is needed, and the time reference for this relationship is the
    insertion of a new objcore in the cache. Let's call this time t_insert.
    
    When a rush begins there are two scenarios for requests.
    
    Requests that entered the waiting list before t_insert should evaluate
    the objcore, and when applicable, propagate the rush exponentially.
    
    Requests that entered the waiting list after t_insert already evaluated
    the objcore because by the time a rush begins, the OC_F_BUSY flag got
    cleared already. They should not evaluate the objcore again, and another
    incoming fetch outcome will eventually wake them up.
    
    What guarantees the happens-before relationship is that t_insert happens
    under the objhead lock.
    
    The relationship is effectively implemented with a generation counter
    for the objhead. Requests inherit the generation when they enter the
    waiting list. Objcores inherit the generation when they begin the rush.
    
    This allows the exponential rush propagation to know when to stop, and
    the objcore can be evaluated outside of the lookup critical section.
    Only incompatible variants should force requests to reenter the waiting
    list, reducing the scope for the serialization problem to a profusion
    of variants (like the classic 'Vary: User-Agent' pitfall).
    
    Since most spurious rushes at every corner of objhead activity are gone,
    this change puts all the spurious activity on the incompatible variants
    alone instead of all objects on more occasions.
    
    If a cacheable object was inserted in the cache, but already expired,
    this behavior enables cache hits. This can be common with multi-tier
    Varnish setups where one Varnish server may serve a graced object to
    another, but true of any origin server that may serve stale-yet-valid
    responses.
    
    The waiting list enables a proper response-wide no-cache behavior from
    now on, but the built-in VCL prevents it by default. This is also the
    first step towards implementing no-cache and private support at the
    header field granularity.

diff --git a/bin/varnishd/cache/cache.h b/bin/varnishd/cache/cache.h
index fd6cdfab8..fc5b9cf93 100644
--- a/bin/varnishd/cache/cache.h
+++ b/bin/varnishd/cache/cache.h
@@ -358,6 +358,7 @@ struct objcore {
 	uint16_t		oa_present;
 
 	unsigned		timer_idx;	// XXX 4Gobj limit
+	unsigned		waitinglist_gen;
 	vtim_real		last_lru;
 	VTAILQ_ENTRY(objcore)	hsh_list;
 	VTAILQ_ENTRY(objcore)	lru_list;
@@ -474,6 +475,7 @@ struct req {
 	stream_close_t		doclose;
 	unsigned		restarts;
 	unsigned		max_restarts;
+	unsigned		waitinglist_gen;
 
 	const struct req_step	*req_step;
 	struct reqtop		*top;	/* esi_level == 0 request */
@@ -495,9 +497,6 @@ struct req {
 
 	struct objcore		*body_oc;
 
-	/* The busy objhead we sleep on */
-	struct objhead		*hash_objhead;
-
 	/* Built Vary string == workspace reservation */
 	uint8_t			*vary_b;
 	uint8_t			*vary_e;
diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 14259fa5d..4d3b5e290 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -101,6 +101,7 @@ hsh_initobjhead(struct objhead *oh)
 	XXXAN(oh);
 	INIT_OBJ(oh, OBJHEAD_MAGIC);
 	oh->refcnt = 1;
+	oh->waitinglist_gen = 1;
 	VTAILQ_INIT(&oh->objcs);
 	VTAILQ_INIT(&oh->waitinglist);
 	Lck_New(&oh->mtx, lck_objhdr);
@@ -377,6 +378,42 @@ hsh_insert_busyobj(const struct worker *wrk, struct objhead *oh)
 	return (oc);
 }
 
+/*---------------------------------------------------------------------
+ */
+
+static unsigned
+hsh_rush_match(struct req *req)
+{
+	struct objhead *oh;
+	struct objcore *oc;
+	const uint8_t *vary;
+
+	oc = req->objcore;
+	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
+	assert(oc->refcnt > 0);
+
+	AZ(oc->flags & OC_F_BUSY);
+	AZ(oc->flags & OC_F_PRIVATE);
+	if (oc->flags & (OC_F_WITHDRAWN|OC_F_HFM|OC_F_HFP|OC_F_CANCEL|
+	    OC_F_FAILED))
+		return (0);
+
+	if (req->vcf != NULL) /* NB: must operate under oh lock. */
+		return (0);
+
+	oh = oc->objhead;
+	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
+
+	if (req->hash_ignore_vary)
+		return (1);
+	if (!ObjHasAttr(req->wrk, oc, OA_VARY))
+		return (1);
+
+	vary = ObjGetAttr(req->wrk, oc, OA_VARY, NULL);
+	AN(vary);
+	return (VRY_Match(req, vary));
+}
+
 /*---------------------------------------------------------------------
  */
 
@@ -407,6 +444,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CHECK_OBJ_NOTNULL(wrk->wpriv, WORKER_PRIV_MAGIC);
 	CHECK_OBJ_NOTNULL(req->http, HTTP_MAGIC);
+	CHECK_OBJ_ORNULL(req->objcore, OBJCORE_MAGIC);
 	CHECK_OBJ_ORNULL(req->vcf, VCF_MAGIC);
 	AN(hash);
 
@@ -414,15 +452,33 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	if (DO_DEBUG(DBG_HASHEDGE))
 		hsh_testmagic(req->digest);
 
-	if (req->hash_objhead != NULL) {
-		/*
-		 * This req came off the waiting list, and brings an
-		 * oh refcnt with it.
+	/*
+	 * When a req rushes off the waiting list, it brings an implicit
+	 * oh refcnt acquired at disembark time and an oc ref (with its
+	 * own distinct oh ref) acquired during rush hour.
+	 */
+
+	if (req->objcore != NULL && hsh_rush_match(req)) {
+		TAKE_OBJ_NOTNULL(oc, &req->objcore, OBJCORE_MAGIC);
+		*ocp = oc;
+		oh = oc->objhead;
+		Lck_Lock(&oh->mtx);
+		oc->hits++;
+		boc_progress = oc->boc == NULL ? -1 : oc->boc->fetched_so_far;
+		AN(hsh_deref_objhead_unlock(wrk, &oh, oc));
+		Req_LogHit(wrk, req, oc, boc_progress);
+		/* NB: since this hit comes from the waiting list instead of
+		 * a regular lookup, grace is not considered. The object is
+		 * fresh in the context of the waiting list, even expired: it
+		 * was successfully just [re]validated by a fetch task.
 		 */
-		CHECK_OBJ_NOTNULL(req->hash_objhead, OBJHEAD_MAGIC);
-		oh = req->hash_objhead;
+		return (HSH_HIT);
+	}
+
+	if (req->objcore != NULL) {
+		oh = req->objcore->objhead;
+		(void)HSH_DerefObjCore(wrk, &req->objcore);
 		Lck_Lock(&oh->mtx);
-		req->hash_objhead = NULL;
 	} else {
 		AN(wrk->wpriv->nobjhead);
 		oh = hash->lookup(wrk, req->digest, &wrk->wpriv->nobjhead);
@@ -615,13 +671,14 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	AZ(req->hash_ignore_busy);
 
 	/*
-	 * The objhead reference transfers to the sess, we get it
-	 * back when the sess comes off the waiting list and
-	 * calls us again
+	 * The objhead reference is held by req while it is parked on the
+	 * waiting list. The oh pointer is taken back from the objcore that
+	 * triggers a rush of req off the waiting list.
 	 */
-	req->hash_objhead = oh;
+	assert(oh->refcnt > 1);
+
 	req->wrk = NULL;
-	req->waitinglist = 1;
+	req->waitinglist_gen = oh->waitinglist_gen;
 
 	if (DO_DEBUG(DBG_WAITINGLIST))
 		VSLb(req->vsl, SLT_Debug, "on waiting list <%p>", oh);
@@ -657,24 +714,44 @@ hsh_rush1(const struct worker *wrk, struct objcore *oc, struct rush *r)
 
 	AZ(oc->flags & OC_F_BUSY);
 	AZ(oc->flags & OC_F_PRIVATE);
+	max = cache_param->rush_exponent;
 	if (oc->flags & (OC_F_WITHDRAWN|OC_F_FAILED))
 		max = 1;
-	else if (oc->flags & (OC_F_HFM|OC_F_HFP|OC_F_CANCEL|OC_F_DYING))
-		max = cache_param->rush_exponent;
-	else
-		max = INT_MAX; /* XXX: temp */
 	assert(max > 0);
 
+	if (oc->waitinglist_gen == 0) {
+		oc->waitinglist_gen = oh->waitinglist_gen;
+		oh->waitinglist_gen++;
+	}
+
 	for (i = 0; i < max; i++) {
 		req = VTAILQ_FIRST(&oh->waitinglist);
 		if (req == NULL)
 			break;
-		CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
-		wrk->stats->busy_wakeup++;
+
+		CHECK_OBJ(req, REQ_MAGIC);
+
+		/* NB: The waiting list is naturally sorted by generation.
+		 *
+		 * Because of the exponential nature of the rush, it is
+		 * possible that new requests enter the waiting list before
+		 * the rush for this oc completes. Because the OC_F_BUSY flag
+		 * was cleared before the beginning of the rush, requests
+		 * from a newer generation already got a chance to evaluate
+		 * oc during a lookup and it didn't match their criteria.
+		 *
+		 * Therefore there's no point propagating the exponential
+		 * rush of this oc when we see a newer generation.
+		 */
+		if (req->waitinglist_gen > oc->waitinglist_gen)
+			break;
+
 		AZ(req->wrk);
 		VTAILQ_REMOVE(&oh->waitinglist, req, w_list);
 		VTAILQ_INSERT_TAIL(&r->reqs, req, w_list);
-		req->waitinglist = 0;
+		req->objcore = oc;
+		oc->refcnt++;
+		wrk->stats->busy_wakeup++;
 	}
 }
 
@@ -945,8 +1022,8 @@ HSH_Withdraw(struct worker *wrk, struct objcore **ocp)
 	assert(oh->refcnt > 0);
 	oc->flags &= ~OC_F_BUSY;
 	oc->flags |= OC_F_WITHDRAWN;
-	hsh_rush1(wrk, oc, &rush);
-	AZ(HSH_DerefObjCoreUnlock(wrk, &oc));
+	hsh_rush1(wrk, oc, &rush); /* grabs up to 1 oc ref */
+	assert(HSH_DerefObjCoreUnlock(wrk, &oc) <= 1);
 
 	hsh_rush2(wrk, &rush);
 }
diff --git a/bin/varnishd/cache/cache_objhead.h b/bin/varnishd/cache/cache_objhead.h
index 94ef81db5..162aaeb7f 100644
--- a/bin/varnishd/cache/cache_objhead.h
+++ b/bin/varnishd/cache/cache_objhead.h
@@ -40,6 +40,7 @@ struct objhead {
 	struct lock		mtx;
 	VTAILQ_HEAD(,objcore)	objcs;
 	uint8_t			digest[DIGEST_LEN];
+	unsigned		waitinglist_gen;
 	VTAILQ_HEAD(, req)	waitinglist;
 
 	/*----------------------------------------------------
diff --git a/bin/varnishd/cache/cache_req_fsm.c b/bin/varnishd/cache/cache_req_fsm.c
index 77481a41d..43cb18006 100644
--- a/bin/varnishd/cache/cache_req_fsm.c
+++ b/bin/varnishd/cache/cache_req_fsm.c
@@ -576,20 +576,23 @@ cnt_lookup(struct worker *wrk, struct req *req)
 {
 	struct objcore *oc, *busy;
 	enum lookup_e lr;
-	int had_objhead = 0;
+	int waitinglist_gen;
 
 	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
 	CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
-	AZ(req->objcore);
 	AZ(req->stale_oc);
 
 	AN(req->vcl);
 
 	VRY_Prep(req);
+	waitinglist_gen = req->waitinglist_gen;
+
+	if (req->waitinglist_gen) {
+		CHECK_OBJ_NOTNULL(req->objcore, OBJCORE_MAGIC);
+		req->waitinglist_gen = 0;
+	} else
+		AZ(req->objcore);
 
-	AZ(req->objcore);
-	if (req->hash_objhead)
-		had_objhead = 1;
 	wrk->strangelove = 0;
 	lr = HSH_Lookup(req, &oc, &busy);
 	if (lr == HSH_BUSY) {
@@ -605,7 +608,7 @@ cnt_lookup(struct worker *wrk, struct req *req)
 	if ((unsigned)wrk->strangelove >= cache_param->vary_notice)
 		VSLb(req->vsl, SLT_Notice, "vsl: High number of variants (%d)",
 		    wrk->strangelove);
-	if (had_objhead)
+	if (waitinglist_gen)
 		VSLb_ts_req(req, "Waitinglist", W_TIM_real(wrk));
 
 	if (req->vcf != NULL) {
diff --git a/bin/varnishd/cache/cache_vary.c b/bin/varnishd/cache/cache_vary.c
index c9c46231b..672a5b598 100644
--- a/bin/varnishd/cache/cache_vary.c
+++ b/bin/varnishd/cache/cache_vary.c
@@ -226,8 +226,7 @@ vry_cmp(const uint8_t *v1, const uint8_t *v2)
 void
 VRY_Prep(struct req *req)
 {
-	if (req->hash_objhead == NULL) {
-		/* Not a waiting list return */
+	if (req->waitinglist_gen == 0) {
 		AZ(req->vary_b);
 		AZ(req->vary_e);
 		(void)WS_ReserveAll(req->ws);
diff --git a/bin/varnishtest/tests/c00125.vtc b/bin/varnishtest/tests/c00125.vtc
new file mode 100644
index 000000000..8fbca4f46
--- /dev/null
+++ b/bin/varnishtest/tests/c00125.vtc
@@ -0,0 +1,156 @@
+varnishtest "successful expired waiting list hit"
+
+barrier b1 cond 2
+barrier b2 cond 2
+barrier b3 cond 2
+barrier b4 cond 2
+
+
+server s1 {
+	rxreq
+	expect req.http.user-agent == c1
+	expect req.http.bgfetch == false
+	barrier b1 sync
+	barrier b2 sync
+	txresp -hdr "Cache-Control: max-age=60" -hdr "Age: 120"
+
+	rxreq
+	expect req.http.user-agent == c3
+	expect req.http.bgfetch == true
+	txresp
+
+	# The no-cache case only works with a complicit VCL, for now.
+	rxreq
+	expect req.http.user-agent == c4
+	expect req.http.bgfetch == false
+	barrier b3 sync
+	barrier b4 sync
+	txresp -hdr "Cache-Control: no-cache"
+
+	rxreq
+	expect req.http.user-agent == c6
+	expect req.http.bgfetch == false
+	txresp -hdr "Cache-Control: no-cache"
+} -start
+
+varnish v1 -cliok "param.set default_grace 1h"
+varnish v1 -cliok "param.set thread_pools 1"
+varnish v1 -cliok "param.set debug +syncvsl,+waitinglist"
+varnish v1 -vcl+backend {
+	sub vcl_backend_fetch {
+		set bereq.http.bgfetch = bereq.is_bgfetch;
+	}
+	sub vcl_beresp_stale {
+		# We just validated a stale object, do not mark it as
+		# uncacheable. The object remains available for grace
+		# hits and background fetches.
+		return;
+	}
+	sub vcl_beresp_control {
+		if (beresp.http.cache-control == "no-cache") {
+			# Keep beresp.uncacheable clear.
+			return;
+		}
+	}
+	sub vcl_deliver {
+		set resp.http.obj-hits = obj.hits;
+		set resp.http.obj-ttl = obj.ttl;
+	}
+} -start
+
+client c1 {
+	txreq -url "/stale-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == 1001
+	expect resp.http.obj-hits == 0
+	expect resp.http.obj-ttl < 0
+} -start
+
+barrier b1 sync
+
+client c2 {
+	txreq -url "/stale-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == "1004 1002"
+	expect resp.http.obj-hits == 1
+	expect resp.http.obj-ttl < 0
+} -start
+
+varnish v1 -expect busy_sleep == 1
+barrier b2 sync
+
+client c1 -wait
+client c2 -wait
+
+varnish v1 -vsl_catchup
+
+varnish v1 -expect cache_miss == 1
+varnish v1 -expect cache_hit == 1
+varnish v1 -expect cache_hit_grace == 0
+varnish v1 -expect s_bgfetch == 0
+
+client c3 {
+	txreq -url "/stale-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == "1006 1002"
+	expect resp.http.obj-hits == 2
+	expect resp.http.obj-ttl < 0
+} -run
+
+varnish v1 -vsl_catchup
+
+varnish v1 -expect cache_miss == 1
+varnish v1 -expect cache_hit == 2
+varnish v1 -expect cache_hit_grace == 1
+varnish v1 -expect s_bgfetch == 1
+
+# The only way for a plain no-cache to be hit is to have a non-zero keep.
+varnish v1 -cliok "param.set default_ttl 0"
+varnish v1 -cliok "param.set default_grace 0"
+varnish v1 -cliok "param.set default_keep 1h"
+
+client c4 {
+	txreq -url "/no-cache-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == 1009
+	expect resp.http.obj-hits == 0
+	expect resp.http.obj-ttl <= 0
+} -start
+
+barrier b3 sync
+
+client c5 {
+	txreq -url "/no-cache-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == "1012 1010"
+	expect resp.http.obj-hits == 1
+	expect resp.http.obj-ttl <= 0
+} -start
+
+varnish v1 -expect busy_sleep == 2
+barrier b4 sync
+
+client c4 -wait
+client c5 -wait
+
+varnish v1 -vsl_catchup
+
+varnish v1 -expect cache_miss == 2
+varnish v1 -expect cache_hit == 3
+varnish v1 -expect cache_hit_grace == 1
+varnish v1 -expect s_bgfetch == 1
+
+# No hit when not on the waiting list
+client c6 {
+	txreq -url "/no-cache-hit"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-varnish == 1014
+	expect resp.http.obj-hits == 0
+	expect resp.http.obj-ttl <= 0
+} -run
diff --git a/include/tbl/req_flags.h b/include/tbl/req_flags.h
index dde208d16..8d73e620e 100644
--- a/include/tbl/req_flags.h
+++ b/include/tbl/req_flags.h
@@ -37,7 +37,6 @@ REQ_FLAG(hash_ignore_busy,	1, 1, "")
 REQ_FLAG(hash_ignore_vary,	1, 1, "")
 REQ_FLAG(hash_always_miss,	1, 1, "")
 REQ_FLAG(is_hit,		0, 0, "")
-REQ_FLAG(waitinglist,		0, 0, "")
 REQ_FLAG(want100cont,		0, 0, "")
 REQ_FLAG(late100cont,		0, 0, "")
 REQ_FLAG(req_reset,		0, 0, "")

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] e12fa0aea fetch: Retire waiting list safety net
Message-ID: <20250827152306.DD002117B0F@lists.varnish-cache.org>


commit e12fa0aea4cea9ec00556b5ecf6424142cd926f0
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Tue Mar 19 11:43:17 2024 +0100

    fetch: Retire waiting list safety net
    
    If a synthetic beresp is inserted into the cache with no TTL, grace or
    keep at all, it is now considered validated (although not in the best
    circumstances) and will be passed to all requests in the waiting list.

diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 8af011fb7..f4f9ee4a1 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -900,9 +900,7 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
  *
  * replaces a stale object unless
  * - abandoning the bereq or
- * - leaving vcl_backend_error with return (deliver) and beresp.ttl == 0s or
- * - there is a waitinglist on this object because in this case the default ttl
- *   would be 1s, so we might be looking at the same case as the previous
+ * - leaving vcl_backend_error with return (deliver)
  *
  * We do want the stale replacement to avoid an object pileup with short ttl and
  * long grace/keep, yet there could exist cases where a cache object is
@@ -960,23 +958,9 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 
 	stale = bo->stale_oc;
 	oc->t_origin = now;
-	if (!VTAILQ_EMPTY(&oc->objhead->waitinglist)) {
-		/*
-		 * If there is a waitinglist, it means that there is no
-		 * grace-able object, so cache the error return for a
-		 * short time, so the waiting list can drain, rather than
-		 * each objcore on the waiting list sequentially attempt
-		 * to fetch from the backend.
-		 */
-		oc->ttl = 1;
-		oc->grace = 5;
-		oc->keep = 5;
-		stale = NULL;
-	} else {
-		oc->ttl = 0;
-		oc->grace = 0;
-		oc->keep = 0;
-	}
+	oc->ttl = 0;
+	oc->grace = 0;
+	oc->keep = 0;
 
 	synth_body = VSB_new_auto();
 	AN(synth_body);
diff --git a/bin/varnishtest/tests/c00131.vtc b/bin/varnishtest/tests/c00131.vtc
new file mode 100644
index 000000000..c9ce19bd5
--- /dev/null
+++ b/bin/varnishtest/tests/c00131.vtc
@@ -0,0 +1,71 @@
+varnishtest "waiting list rush from vcl_backend_error"
+
+barrier b1 sock 2
+barrier b2 sock 2
+
+server s1 {
+	rxreq
+	send garbage
+} -start
+
+varnish v1 -cliok "param.set debug +syncvsl,+waitinglist"
+varnish v1 -vcl+backend {
+	import vtc;
+	sub vcl_backend_fetch {
+		vtc.barrier_sync("${b1_sock}");
+		vtc.barrier_sync("${b2_sock}");
+	}
+	sub vcl_backend_error {
+		set beresp.http.error-vxid = bereq.xid;
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.http.error-vxid == 1002
+} -start
+
+barrier b1 sync
+
+logexpect l1 -v v1 -q Debug -g raw {
+	loop 4 {
+		expect * * Debug "on waiting list"
+	}
+} -start
+
+client c2 {
+	txreq
+	rxresp
+	expect resp.http.error-vxid == 1002
+} -start
+
+client c3 {
+	txreq
+	rxresp
+	expect resp.http.error-vxid == 1002
+} -start
+
+client c4 {
+	txreq
+	rxresp
+	expect resp.http.error-vxid == 1002
+} -start
+
+client c5 {
+	txreq
+	rxresp
+	expect resp.http.error-vxid == 1002
+} -start
+
+logexpect l1 -wait
+
+barrier b2 sync
+
+client c1 -wait
+client c2 -wait
+client c3 -wait
+client c4 -wait
+client c5 -wait
+
+varnish v1 -expect n_expired == 1
diff --git a/doc/sphinx/reference/vcl_step.rst b/doc/sphinx/reference/vcl_step.rst
index 67ddf0818..81bb7b4e0 100644
--- a/doc/sphinx/reference/vcl_step.rst
+++ b/doc/sphinx/reference/vcl_step.rst
@@ -380,19 +380,14 @@ This subroutine is called if we fail the backend fetch or if
 
 Returning with :ref:`abandon` does not leave a cache object.
 
-If returning with ``deliver`` and a ``beresp.ttl > 0s``, a synthetic
-cache object is generated in VCL, whose body may be constructed using
-the ``synthetic()`` function.
-
-When there is a waiting list on the object, the default ``ttl`` will
-be positive (currently one second), set before entering
-``vcl_backend_error``. This is to avoid request serialization and
-hammering on a potentially failing backend.
-
-Since these synthetic objects are cached in these special
-circumstances, be cautious with putting private information there. If
-you really must, then you need to explicitly set ``beresp.ttl`` to
-zero in ``vcl_backend_error``.
+If returning with ``deliver`` and ``beresp.uncacheable == false``, a
+synthetic cache object is generated in VCL, whose body may be constructed
+using the ``synthetic()`` function.
+
+Since these synthetic objects are cached in these special circumstances,
+be cautious with putting private information there. If you really must,
+then you need to explicitly set ``beresp.uncacheable`` to ``true`` in
+``vcl_backend_error``.
 
 The `vcl_backend_error` subroutine may terminate with calling ``return()``
 with one of the following keywords:

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:06 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:06 +0000 (UTC)
Subject: [master] 90c221829 fetch: Operate BOC state changes on busyobj
Message-ID: <20250827152307.1B9A2117B1F@lists.varnish-cache.org>


commit 90c2218299df075648d8b9dc5117f45cff05ec24
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Tue Oct 22 15:33:23 2024 +0200

    fetch: Operate BOC state changes on busyobj
    
    This centralizes the rules regarding BOC state changes and whether to
    inform clients of those changes. For example, BOS_REQ_DONE is only
    needed by grace hits, saving one broadcast on the BOC condvar on misses
    and straight passes.
    
    It also formalizes when a busyobj will release its client request.

diff --git a/bin/varnishd/cache/cache_busyobj.c b/bin/varnishd/cache/cache_busyobj.c
index c8814a7bb..9bda40bd5 100644
--- a/bin/varnishd/cache/cache_busyobj.c
+++ b/bin/varnishd/cache/cache_busyobj.c
@@ -169,3 +169,42 @@ VBO_ReleaseBusyObj(struct worker *wrk, struct busyobj **pbo)
 
 	MPL_Free(vbopool, bo);
 }
+
+void
+VBO_SetState(struct worker *wrk, struct busyobj *bo, enum boc_state_e next)
+{
+	unsigned broadcast;
+
+	CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
+	CHECK_OBJ_NOTNULL(bo, BUSYOBJ_MAGIC);
+
+	switch (next) {
+	case BOS_REQ_DONE:
+		AN(bo->req);
+		bo->req = NULL;
+		broadcast = bo->is_bgfetch;
+		break;
+	case BOS_STREAM:
+		AN(bo->do_stream);
+		AZ(bo->req);
+		broadcast = 1;
+		break;
+	case BOS_FINISHED:
+	case BOS_FAILED:
+		/* We can't assert that either state already released its
+		 * request because a fetch may fail before reaching the
+		 * BOS_REQ_DONE state. Failing can also mean executing
+		 * vcl_backend_error and reaching BOS_FINISHED from there.
+		 * One can legitemately return(retry) from there and proceed
+		 * again with a usable req if a return(error) transition led
+		 * to vcl_backend_error instead of a failed fetch attempt.
+		 */
+		bo->req = NULL;
+		broadcast = 1;
+		break;
+	default:
+		WRONG("unexpected BOC state");
+	}
+
+	ObjSetState(wrk, bo->fetch_objcore, next, broadcast);
+}
diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index f4f9ee4a1..fe957f64b 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -292,14 +292,12 @@ vbf_stp_mkbereq(struct worker *wrk, struct busyobj *bo)
 	HTTP_Clone(bo->bereq, bo->bereq0);
 
 	if (bo->req->req_body_status->avail == 0) {
-		bo->req = NULL;
-		ObjSetState(bo->wrk, oc, BOS_REQ_DONE);
+		VBO_SetState(bo->wrk, bo, BOS_REQ_DONE);
 	} else if (bo->req->req_body_status == BS_CACHED) {
 		AN(bo->req->body_oc);
 		bo->bereq_body = bo->req->body_oc;
 		HSH_Ref(bo->bereq_body);
-		bo->req = NULL;
-		ObjSetState(bo->wrk, oc, BOS_REQ_DONE);
+		VBO_SetState(bo->wrk, bo, BOS_REQ_DONE);
 	}
 	return (F_STP_STARTFETCH);
 }
@@ -544,10 +542,8 @@ vbf_stp_startfetch(struct worker *wrk, struct busyobj *bo)
 
 	VSLb_ts_busyobj(bo, "Process", W_TIM_real(wrk));
 	assert(oc->boc->state <= BOS_REQ_DONE);
-	if (oc->boc->state != BOS_REQ_DONE) {
-		bo->req = NULL;
-		ObjSetState(wrk, oc, BOS_REQ_DONE);
-	}
+	if (oc->boc->state != BOS_REQ_DONE)
+		VBO_SetState(wrk, bo, BOS_REQ_DONE);
 
 	if (bo->do_esi)
 		bo->do_stream = 0;
@@ -713,7 +709,7 @@ vbf_stp_fetch(struct worker *wrk, struct busyobj *bo)
 	assert(oc->boc->state == BOS_REQ_DONE);
 
 	if (bo->do_stream)
-		ObjSetState(wrk, oc, BOS_STREAM);
+		VBO_SetState(wrk, bo, BOS_STREAM);
 
 	VSLb(bo->vsl, SLT_Fetch_Body, "%u %s %s",
 	    bo->htc->body_status->nbr, bo->htc->body_status->name,
@@ -751,7 +747,7 @@ vbf_stp_fetchend(struct worker *wrk, struct busyobj *bo)
 	else
 		assert(oc->boc->state == BOS_REQ_DONE);
 
-	ObjSetState(wrk, oc, BOS_FINISHED);
+	VBO_SetState(wrk, bo, BOS_FINISHED);
 	VSLb_ts_busyobj(bo, "BerespBody", W_TIM_real(wrk));
 	if (bo->stale_oc != NULL) {
 		VSL(SLT_ExpKill, NO_VXID, "VBF_Superseded x=%ju n=%ju",
@@ -879,7 +875,7 @@ vbf_stp_condfetch(struct worker *wrk, struct busyobj *bo)
 	AZ(ObjCopyAttr(bo->wrk, oc, stale_oc, OA_GZIPBITS));
 
 	if (bo->do_stream)
-		ObjSetState(wrk, oc, BOS_STREAM);
+		VBO_SetState(wrk, bo, BOS_STREAM);
 
 	INIT_OBJ(vop, VBF_OBITER_PRIV_MAGIC);
 	vop->bo = bo;
@@ -1015,7 +1011,7 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	VSB_destroy(&synth_body);
 	if (stale != NULL && oc->ttl > 0)
 		HSH_Kill(stale);
-	ObjSetState(wrk, oc, BOS_FINISHED);
+	VBO_SetState(wrk, bo, BOS_FINISHED);
 	return (F_STP_DONE);
 }
 
@@ -1033,7 +1029,7 @@ vbf_stp_fail(struct worker *wrk, struct busyobj *bo)
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 
 	assert(oc->boc->state < BOS_FINISHED);
-	ObjSetState(wrk, oc, BOS_FAILED);
+	VBO_SetState(wrk, bo, BOS_FAILED);
 	HSH_Kill(oc);
 	return (F_STP_DONE);
 }
diff --git a/bin/varnishd/cache/cache_obj.c b/bin/varnishd/cache/cache_obj.c
index 172e29a8b..804c226aa 100644
--- a/bin/varnishd/cache/cache_obj.c
+++ b/bin/varnishd/cache/cache_obj.c
@@ -491,7 +491,8 @@ ObjVAICancel(struct worker *wrk, struct boc *boc, struct vai_qe *qe)
  */
 
 void
-ObjSetState(struct worker *wrk, struct objcore *oc, enum boc_state_e next)
+ObjSetState(struct worker *wrk, struct objcore *oc, enum boc_state_e next,
+    unsigned broadcast)
 {
 	const struct obj_methods *om;
 
@@ -515,7 +516,8 @@ ObjSetState(struct worker *wrk, struct objcore *oc, enum boc_state_e next)
 
 	Lck_Lock(&oc->boc->mtx);
 	oc->boc->state = next;
-	obj_boc_notify(oc->boc);
+	if (broadcast)
+		obj_boc_notify(oc->boc);
 	Lck_Unlock(&oc->boc->mtx);
 }
 
diff --git a/bin/varnishd/cache/cache_varnishd.h b/bin/varnishd/cache/cache_varnishd.h
index 1e00b4004..56ce1c14b 100644
--- a/bin/varnishd/cache/cache_varnishd.h
+++ b/bin/varnishd/cache/cache_varnishd.h
@@ -175,6 +175,8 @@ vtim_real BAN_Time(const struct ban *ban);
 /* cache_busyobj.c */
 struct busyobj *VBO_GetBusyObj(const struct worker *, const struct req *);
 void VBO_ReleaseBusyObj(struct worker *wrk, struct busyobj **busyobj);
+void VBO_SetState(struct worker *wrk, struct busyobj *bo,
+    enum boc_state_e next);
 
 /* cache_director.c */
 int VDI_GetHdr(struct busyobj *);
@@ -342,7 +344,8 @@ int ObjGetSpace(struct worker *, struct objcore *, ssize_t *sz, uint8_t **ptr);
 void ObjExtend(struct worker *, struct objcore *, ssize_t l, int final);
 uint64_t ObjWaitExtend(const struct worker *, const struct objcore *,
     uint64_t l, enum boc_state_e *statep);
-void ObjSetState(struct worker *, struct objcore *, enum boc_state_e next);
+void ObjSetState(struct worker *, struct objcore *, enum boc_state_e next,
+    unsigned broadcast);
 void ObjWaitState(const struct objcore *, enum boc_state_e want);
 void ObjTouch(struct worker *, struct objcore *, vtim_real now);
 void ObjFreeObj(struct worker *, struct objcore *);
diff --git a/bin/varnishd/cache/cache_vrt_var.c b/bin/varnishd/cache/cache_vrt_var.c
index 4fcdf52c6..3415ff83c 100644
--- a/bin/varnishd/cache/cache_vrt_var.c
+++ b/bin/varnishd/cache/cache_vrt_var.c
@@ -648,9 +648,8 @@ VRT_u_bereq_body(VRT_CTX)
 
 	if (ctx->bo->req != NULL) {
 		CHECK_OBJ(ctx->bo->req, REQ_MAGIC);
-		ctx->bo->req = NULL;
-		ObjSetState(ctx->bo->wrk,
-		    ctx->bo->fetch_objcore, BOS_REQ_DONE);
+		VBO_SetState(ctx->bo->wrk, ctx->bo, BOS_REQ_DONE);
+		AZ(ctx->bo->req);
 	}
 }
 

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:07 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:07 +0000 (UTC)
Subject: [master] e635f1c84 param: Lower rush_exponent minimum value
Message-ID: <20250827152307.38B05117B24@lists.varnish-cache.org>


commit e635f1c846f78e04f2e23f3ae666ac6ba51670e8
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Dec 9 10:11:21 2024 +0100

    param: Lower rush_exponent minimum value
    
    To ease test coverage for waitling list operations, requiring less
    disembarked requests for specific cases. Added is a test case showing
    that a rush miss propagates further wake ups.

diff --git a/bin/varnishtest/tests/c00138.vtc b/bin/varnishtest/tests/c00138.vtc
new file mode 100644
index 000000000..cf0cb8c19
--- /dev/null
+++ b/bin/varnishtest/tests/c00138.vtc
@@ -0,0 +1,64 @@
+varnishtest "subsequent rush on rush miss"
+
+barrier b1 cond 2
+barrier b2 cond 2
+barrier b3 cond 2
+barrier b4 cond 2
+
+server s1 {
+	rxreq
+	expect req.http.user-agent == c1
+	barrier b1 sync
+	barrier b2 sync
+	txresp -hdr "Vary: accept"
+
+	rxreq
+	expect req.http.user-agent == c2
+	txresp -hdr "Vary: accept"
+} -start
+
+varnish v1 -cliok "param.set thread_pools 1"
+varnish v1 -cliok "param.set rush_exponent 1"
+varnish v1 -cliok "param.set debug +syncvsl,+waitinglist"
+varnish v1 -vcl+backend "" -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.http.x-varnish == 1001
+} -start
+
+barrier b1 sync
+
+logexpect l1 -v v1 -q Debug -g raw {
+	expect * * Debug "on waiting list"
+} -start
+
+client c2 {
+	txreq -hdr "accept: nothing"
+	rxresp
+	expect resp.http.x-varnish == 1004
+} -start
+
+logexpect l1 -wait -start
+
+client c3 {
+	txreq
+	rxresp
+	expect resp.http.x-varnish == "1006 1002"
+} -start
+
+logexpect l1 -wait
+
+barrier b2 sync
+
+client c1 -wait
+client c2 -wait
+client c3 -wait
+
+varnish v1 -expect cache_miss == 2
+varnish v1 -expect cache_hit == 1
+varnish v1 -expect cache_hit_grace == 0
+varnish v1 -expect s_bgfetch == 0
+varnish v1 -expect busy_sleep == 2
+varnish v1 -expect busy_wakeup == 2
diff --git a/include/tbl/params.h b/include/tbl/params.h
index df7415536..e66a653cb 100644
--- a/include/tbl/params.h
+++ b/include/tbl/params.h
@@ -910,7 +910,7 @@ PARAM_SIMPLE(
 PARAM_SIMPLE(
 	/* name */	rush_exponent,
 	/* type */	uint,
-	/* min */	"2",
+	/* min */	"1",
 	/* max */	NULL,
 	/* def */	"3",
 	/* units */	"requests per request",
@@ -918,7 +918,9 @@ PARAM_SIMPLE(
 	"How many parked request we start for each completed request on "
 	"the object.\n"
 	"NB: Even with the implicit delay of delivery, this parameter "
-	"controls an exponential increase in number of worker threads.",
+	"controls an exponential increase in number of worker threads. "
+	"A value of 1 will instead serialize requests resumption and is "
+	"only useful for testing purposes.",
 	/* flags */	EXPERIMENTAL
 )
 

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:07 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:07 +0000 (UTC)
Subject: [master] 857844765 hash: Centralize vary match
Message-ID: <20250827152307.4E920117B41@lists.varnish-cache.org>


commit 857844765ac14bddbc5c452b88ac0f53dba5ee01
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Tue May 20 15:14:50 2025 +0200

    hash: Centralize vary match
    
    Better diff with the --ignore-all-space option.

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index 4d3b5e290..a49a1f76a 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -381,12 +381,26 @@ hsh_insert_busyobj(const struct worker *wrk, struct objhead *oh)
 /*---------------------------------------------------------------------
  */
 
+static int
+hsh_vry_match(struct req *req, struct objcore *oc, const uint8_t *vary)
+{
+
+	if (req->hash_ignore_vary)
+		return (1);
+	if (vary == NULL) {
+		if (! ObjHasAttr(req->wrk, oc, OA_VARY))
+			return (1);
+		vary = ObjGetAttr(req->wrk, oc, OA_VARY, NULL);
+		AN(vary);
+	}
+	return (VRY_Match(req, vary));
+}
+
 static unsigned
 hsh_rush_match(struct req *req)
 {
 	struct objhead *oh;
 	struct objcore *oc;
-	const uint8_t *vary;
 
 	oc = req->objcore;
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
@@ -404,14 +418,7 @@ hsh_rush_match(struct req *req)
 	oh = oc->objhead;
 	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 
-	if (req->hash_ignore_vary)
-		return (1);
-	if (!ObjHasAttr(req->wrk, oc, OA_VARY))
-		return (1);
-
-	vary = ObjGetAttr(req->wrk, oc, OA_VARY, NULL);
-	AN(vary);
-	return (VRY_Match(req, vary));
+	return (hsh_vry_match(req, oc, NULL));
 }
 
 /*---------------------------------------------------------------------
@@ -427,7 +434,6 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 	const struct vcf_return *vr;
 	vtim_real exp_t_origin;
 	int busy_found;
-	const uint8_t *vary;
 	intmax_t boc_progress;
 	unsigned xid = 0;
 	unsigned ban_checks;
@@ -520,8 +526,7 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 				continue;
 
 			if (oc->boc && oc->boc->vary != NULL &&
-			    !req->hash_ignore_vary &&
-			    !VRY_Match(req, oc->boc->vary)) {
+			    !hsh_vry_match(req, oc, oc->boc->vary)) {
 				wrk->strangelove++;
 				continue;
 			}
@@ -540,13 +545,9 @@ HSH_Lookup(struct req *req, struct objcore **ocp, struct objcore **bocp)
 			continue;
 		}
 
-		if (!req->hash_ignore_vary && ObjHasAttr(wrk, oc, OA_VARY)) {
-			vary = ObjGetAttr(wrk, oc, OA_VARY, NULL);
-			AN(vary);
-			if (!VRY_Match(req, vary)) {
-				wrk->strangelove++;
-				continue;
-			}
+		if (!hsh_vry_match(req, oc, NULL)) {
+			wrk->strangelove++;
+			continue;
 		}
 
 		if (ban_checks >= ban_any_variant

From dridi.boukelmoune at gmail.com  Wed Aug 27 15:23:07 2025
From: dridi.boukelmoune at gmail.com (Dridi Boukelmoune)
Date: Wed, 27 Aug 2025 15:23:07 +0000 (UTC)
Subject: [master] 66b17b78d hash: Missing oh null check in HSH_Fail()
Message-ID: <20250827152307.69C8E117B4C@lists.varnish-cache.org>


commit 66b17b78dc469e0e946a4bfa95aec59fa2f9392d
Author: Dridi Boukelmoune <dridi.boukelmoune at gmail.com>
Date:   Mon Aug 25 15:25:59 2025 +0200

    hash: Missing oh null check in HSH_Fail()

diff --git a/bin/varnishd/cache/cache_hash.c b/bin/varnishd/cache/cache_hash.c
index a49a1f76a..551e4ab46 100644
--- a/bin/varnishd/cache/cache_hash.c
+++ b/bin/varnishd/cache/cache_hash.c
@@ -915,7 +915,7 @@ HSH_Fail(struct worker *wrk, struct objcore *oc)
 	CHECK_OBJ_NOTNULL(oc, OBJCORE_MAGIC);
 	CHECK_OBJ_NOTNULL(oc->boc, BOC_MAGIC);
 	oh = oc->objhead;
-	CHECK_OBJ(oh, OBJHEAD_MAGIC);
+	CHECK_OBJ_NOTNULL(oh, OBJHEAD_MAGIC);
 	INIT_OBJ(&rush, RUSH_MAGIC);
 
 	/*