Proto commits in firedancer-io/firedancer

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-11-10

bundle: streamline txn delivery removes ugly logic that double-parsed and buffered bundle txns due to design flaws in nanopb and stem

The documentation is generated from this commit.

Support receiving VLAN packets in all providers. (#12725) This implements functionality to receive VLAN packets from the NIC in all providers. Tested with a scapy script sending traffic from one port to another on a cx6 for xdp and mlx5 then on a intel nic for iavf. scapy ``` from scapy.all import * b = Ether(src='98:b7:85:a8:10:e3', dst='98:b7:85:a8:10:e2') ip = IP(src='198.18.0.2', dst='198.18.0.1') / UDP(sport=12345, dport=5678) / Raw(b'x'*64) sendp(b/Dot1Q(vlan=100)/ip, iface='cx6port1', count=100) ``` iavf ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < iavf_pkt_rx_total{kind="iavf",kind_id="0"} 0 > iavf_pkt_rx_total{kind="iavf",kind_id="0"} 100 < iavf_pkt_rx_bytes_total{kind="iavf",kind_id="0"} 0 > iavf_pkt_rx_bytes_total{kind="iavf",kind_id="0"} 10600 < iavf_vlan_pkt_rx_total{kind="iavf",kind_id="0"} 0 > iavf_vlan_pkt_rx_total{kind="iavf",kind_id="0"} 100 ``` xdp w/ rx vlan offload disabled ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < net_pkt_rx_total{kind="net",kind_id="0"} 0 > net_pkt_rx_total{kind="net",kind_id="0"} 100 < net_pkt_rx_bytes_total{kind="net",kind_id="0"} 0 > net_pkt_rx_bytes_total{kind="net",kind_id="0"} 10600 < net_vlan_pkt_rx_total{kind="net",kind_id="0"} 0 > net_vlan_pkt_rx_total{kind="net",kind_id="0"} 100 ``` mlx5 ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < mlx5_pkt_rx_total{kind="mlx5",kind_id="0"} 0 > mlx5_pkt_rx_total{kind="mlx5",kind_id="0"} 100 < mlx5_pkt_rx_bytes_total{kind="mlx5",kind_id="0"} 0 > mlx5_pkt_rx_bytes_total{kind="mlx5",kind_id="0"} 10600 < mlx5_vlan_pkt_rx_total{kind="mlx5",kind_id="0"} 0 > mlx5_vlan_pkt_rx_total{kind="mlx5",kind_id="0"} 100 ```

stakes: add stake delegation disk spill metrics

Merge remote-tracking branch 'origin/main' into ripatel/jit

2026-11-09

bundle, grpc: switch to fd_pb Port the bundle client and auth to fd_pb and drop the nanopb based gRPC send API. Removes the bundle nanopb schemas.

upd parent sad path

2026-11-07

Merge remote-tracking branch 'origin/main' into ripatel/jit

further Tower and repair cleanups - remove documentation referencing Tower BFT components - remove unused [tiles.repair] slot_max config option - remove keyguard tower matcher

accdb: decouple rooting/purging requests from bg maintenance Replace the single T1->T2 command slot with a monotonic root/purge counter. T1 owns fork data structures (fork states, purge unlink, descends clearing on slot reuse) and publishes requests without waiting. T2 applies root levels in order, drains intrusive purge list, and reclaims retired forks on every pass. Replay only waits when no fork slot is free.

fix

jit machinery

runtime: execute transpiled programs

2026-11-06

gui: add timeline txn, tile state and revenue queries

further Tower and repair cleanups - remove documentation referencing Tower BFT components - remove unused [tiles.repair] slot_max config option - remove keyguard tower matcher

runtime: execute transpiled programs

net: Count neighbor failure in routing failures This adds a specific metric to count neighbor failures in routing failures instead of in drops. They are sent to the kernel.

net: regenerate metrics for net tiles

dragon

bundle: add protocol config and protos

rebase fixes

sched: transaction redispatching

2026-11-05

stakes: add stake delegation disk spill metrics

make some updates for the config

repair: cleanup dead code and deprecate rotor name (#12713)

adding block protos

some bundle connecting logic

gui: txn states

accdb: store fork lists in chunks

Support receiving VLAN packets in all providers. This implements functionality to receive VLAN packets from the NIC in all providers. Each will attempt to configure the hardware to strip the VLAN tag if possible. It that's not possible, then Firedancer will fall back to parsing the packet in software. Tested with a scapy script sending traffic from one port to another on a cx6 for xdp and mlx5 then on a intel nic for iavf. scapy ``` from scapy.all import * b = Ether(src='98:b7:85:a8:10:e3', dst='98:b7:85:a8:10:e2') ip = IP(src='198.18.0.2', dst='198.18.0.1') / UDP(sport=12345, dport=5678) / Raw(b'x'*64) sendp(b/Dot1Q(vlan=100)/ip, iface='ens5f0np0', count=100) ``` iavf ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < iavf_pkt_rx_total{kind="iavf",kind_id="0"} 0 > iavf_pkt_rx_total{kind="iavf",kind_id="0"} 100 < iavf_pkt_rx_bytes_total{kind="iavf",kind_id="0"} 0 > iavf_pkt_rx_bytes_total{kind="iavf",kind_id="0"} 10600 < iavf_vlan_pkt_rx_total{kind="iavf",kind_id="0"} 0 > iavf_vlan_pkt_rx_total{kind="iavf",kind_id="0"} 100 ``` xdp w/ rx vlan offload disabled ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < net_pkt_rx_total{kind="net",kind_id="0"} 0 > net_pkt_rx_total{kind="net",kind_id="0"} 100 < net_pkt_rx_bytes_total{kind="net",kind_id="0"} 0 > net_pkt_rx_bytes_total{kind="net",kind_id="0"} 10600 < net_vlan_pkt_rx_total{kind="net",kind_id="0"} 0 > net_vlan_pkt_rx_total{kind="net",kind_id="0"} 100 ``` xdp w/ rx vlan offload enabled ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < net_pkt_rx_total{kind="net",kind_id="0"} 0 > net_pkt_rx_total{kind="net",kind_id="0"} 100 < net_pkt_rx_bytes_total{kind="net",kind_id="0"} 0 > net_pkt_rx_bytes_total{kind="net",kind_id="0"} 10600 ``` mlx5 ``` user@host:~$ diff /tmp/metrics_before /tmp/metrics_after | grep pkt_rx < mlx5_pkt_rx_total{kind="mlx5",kind_id="0"} 0 > mlx5_pkt_rx_total{kind="mlx5",kind_id="0"} 100 < mlx5_pkt_rx_bytes_total{kind="mlx5",kind_id="0"} 0 > mlx5_pkt_rx_bytes_total{kind="mlx5",kind_id="0"} 10600 ```

net: drop packets with IPv4 options Due to recent events, the Internet continued filtering IPv4 packets with IHL!=5 even more aggressively. We can take this opportunity to also reject such annoying packets.

shred: cache exact invalid signature equation verdicts Bound each resolver to256 negative entries keyed by all signature, derived Merkle root and leader public-key bytes. Populate only after ERR_MSG; preserve authentication-before-spill and expose cache hits separately. Native controls cover full-pool repeats, forced-key collisions, legitimate repair, fresh-S bypass and churn.

events: add runtime_account_lthash for per-account LtHash diffing Emit one runtime_account_lthash event each time replay computes an account's final-value LtHash, carrying the first 32 bytes of the hash, so a bank hash mismatch can be traced to an account against Agave. Rows are emitted only where the hash is already computed: out-of-band ADD jobs on exec tiles, in-band writes (fd_hashes, accdb_svm close_rw), footer vote rewards through fd_vote_queue, and in-band epoch stake rewards. A per-bank lthash_seq (in fd_bank_t padding) orders them; a recomputed hash is always dispatched later and takes a higher value, so the highest lthash_seq per (bank_seq, pubkey) is the final hash.

metrics: add empty failov tile schema (#12719)

repair: cleanup dead code and deprecate rotor name

replay: fast leader handover (#12618)

gossip: publish client_id to prometheus metrics (#12711)

2026-11-04

net: backport native iavf provider for Sunburst Integrate the seven upstream iavf commits through ed59b6642f with VFIO, LACP, multi-tile queues, efficient layout, and summary telemetry. Preserve the accepted private consensus/runtime/pack/repair trees and transaction timing opt-in. Adjust the JSON config layout assertion for the existing private telemetry field.

net: drop packets with IPv4 options Due to recent events, the Internet continued filtering IPv4 packets with IHL!=5 even more aggressively. We can take this opportunity to also reject such annoying packets.

votor: reject non-G2 vote signatures instead of reporting success ag_pool_add_vote returned AG_POOL_SUCCESS for a vote it dropped for failing the deferred G2 subgroup check. The tile then counted the vote as accepted and could mark the reward cert dirty. Return AG_POOL_ERR_VOTE_VERIFY, and have the tile ban the peer and count it under SignatureFailed. Mostly cosmetic, metrics and events stop counting dropped votes as accepted. A sender can no longer force reward-cert republish with bad signatures. It also matches how certs already fail (AG_POOL_ERR_CERT_VERIFY)

Support receiving VLAN packets in all providers. This implements functionality to receive VLAN packets from the NIC in all providers. Each will attempt to configure the hardware to strip the VLAN tag if possible. It that's not possible, then Firedancer will fall back to parsing the packet in software.

gui: add remaining timeline queries

replay: remove bank eviction

accdb: store fork lists in chunks

sched: transaction redispatching

disco, pack: auction scheduler strategy (#12619) Credit to Hervé Guillemet (Puffin Validator)!

events: fix runtime diff reporting and add runtime_vote_write

2026-11-03

failover: on-demand operator promotion (#11769) * votor: add Alpenglow vote history export and adoption * failover: add the HELLO message and the session state machine * failover: frame the protocol messages on the wire * failover: add the [failover] config and derive the junk identity path * failover: generate the junk identity and boot every tile under it * failover: preload both identities and sign the member cert and pair TLS * failover: add the handoff messages and validate the final Tower * failover: add the authenticated on-demand pair channel * failover: add identity switching and failover commands to the admin bus * failover: add the on-demand handoff controller * failover: add the promote, demote and status commands * failover: document the controller, channel and protocol states * failover: make set-identity restart failover on the new identity and remove demote * Harden failover authentication and bound public listener work * Generate failover junk identities in memory * failover: make handoffs Alpenglow-only * failover: add operator guidance to the duplicate instance abort * failover: adapt admin and config tests to Tower removal * failover: remove obsolete Alpenglow activation guidance * failover: keep validators that do not use failover unchanged * votor: fence the boot identity's windows on every adoption * failover: boot under [paths.identity_key] and take the target from failover promote * votor: persist the adopted signing constraints at a failover switch * votor: drop the engage latch, export without changing consensus state * failover: add [failover.boot_to_standby] to boot as a standby under an in-memory junk key * failover: reuse fd_tlsrec_sock, fd_token_bucket and fd_keepalive and simplify the channel * failover: make the junk key a plain spare and authenticate the channel as the identity * Apply batched suggestions from code review * failover: ration TLS sessions separately from admission to resist DoS * failover: make promote wait for the outcome and remove status * failover: pair on the identity alone and make the bus links reliable * failover: count a promotion as voting for the preflight * failover: refuse a retarget on a voting holder, dial per run, name the duplicate instance * failover: exit with a code for the state the machines are in * book: add the failover guide and shorten the failover promote reference * book: list the failover promote exit codes in order * book: tighten two sentences in the failover guide * book: fix typos in the failover pages * failover: make --force try the handoff first and add --adopt * failover: shorten the handoff wait and tighten the liveness check for --adopt and --force * failover: give failover promote one exit code per outcome and keep result strings in the CLI * failover: review fixes for the handoff CLI, the --adopt liveness rule and the channel * failover: tighten the result table in the guide * failover: split promote and takeover, add --standby, make [failover.enabled] gate only the listener

gui: add remaining timeline queries

event schema update abandon prefix bank

2026-11-02

update metric description

gui: add query_shreds fec granularity, query_agg_shreds (#12601)

gui: add remaining timeline queries

gui: add query_shreds fec granularity, query_agg_shreds

disco, pack: auction scheduler strategy Credit to Puffin Validator (https://puffin-validator.xyz/pebble)

pack: only keep the 16 highest-tipping early bundles (#12589) * pack: only keep the 16 highest-tipping early bundles * add comments

net: implement fd_iavf_tile.c and integrate the iavf config stage/metrics etc into rest of FD

gui: add remaining timeline queries

accdb: store fork lists in chunks

replay: move lthash off the transaction critical path Also switch to a policy of one block per rdisp lane for better performance.

gui: add query_shreds fec granularity, query_agg_shreds

disco, pack: auction scheduler strategy Credit to Puffin Validator (https://puffin-validator.xyz/pebble)

pack: only keep the 16 highest-tipping early bundles

net: drop packets with IPv4 options Due to recent events, the Internet continued filtering IPv4 packets with IHL!=5 even more aggressively. We can take this opportunity to also reject such annoying packets.

2026-11-01

replay: move lthash off the transaction critical path Also switch to a policy of one block per rdisp lane for better performance. (cherry picked from commit 701e14eeb3ca6b02425554b97a6cef89a105fc92)

2026-10-30

accdb: store fork lists in chunks

replay: move lthash off the transaction critical path Also switch to a policy of one block per rdisp lane for better performance.

store: fix generated metrics & gcc test build

review comments

Merge remote-tracking branch 'origin/main' into king/store-fec-spill

txncache: spill to disk

failover: make promote wait for the outcome and remove status

failover: boot under [paths.identity_key] and take the target from failover promote

failover: make set-identity restart failover on the new identity and remove demote

failover: add identity switching and failover commands to the admin bus

2026-10-29

disco, pack: auction scheduler strategy Credit to Puffin Validator (https://puffin-validator.xyz/pebble)

pack: only keep the 16 highest-tipping early bundles

assign field numbers to the new replay metric

rotor, replay: stop replaying blocks consensus ruled out

txncache: spill to disk

replay: move lthash off the transaction critical path Also switch to a policy of one block per rdisp lane for better performance.

votor: defer long header QUIC packets Implement QoS via a deferral queue: Immediately process 1-RTT packets (established conns) and defer anything else.

bundle, grpc: switch to fd_pb Port the bundle client and auth to fd_pb and drop the nanopb based gRPC send API. Removes the bundle nanopb schemas.

gui: per-ring store bases and per-tile CPU timeline (#12534)

net: implement fd_iavf_tile.c and integrate the iavf config stage/metrics etc into rest of FD

backup: add disk read and write latency histograms

accdb: prefix tile histograms with AccountsDisk

accdb: add disk read and write latency histograms

snapin: account failed flushes, simplify flush timing

snapin: export pwrite latency and flush phase times

progcache: use accdb fork graph

diag: export accounts disk usage counters (#12547)

mlx5: Add VLAN Tx support to the mlx5 provider. This is similar to the XDP implementation that will build the packet as usual and then pass the packet buffer from the L3 header on to the send call. Adds several new metrics for VLAN Tx.

net: Support VLAN Rx in the XDP and mlx5 providers. Accept VLAN packets on the Rx path. They're combined because mlx5 required few changes beyond the shared parser. The XDP program now redirects frames that carry a single VLAN tag with an IPv4 inner Ethertype. The shared Rx parser in fd_net_rx_pkt strips the tag in software by moving the ethernet header up to the IP header. A new VlanPktRx counter on the net and mlx5 tiles counts these packets. The mlx5 provider creates its Rx work queues with IB_UVERBS_WQ_FLAGS_CVLAN_STRIPPING so the NIC removes the tag before software sees the packet. With XDP, most NICs also strip the tag when rx-vlan-offload is on. The software path covers NICs and configurations that don't. Also regenerates the metrics event schemas and events.proto so the new net and mlx5 metric fields get real field numbers in place of the provisional ones.

replay: move lthash off the critical path Also switch to a model of one block per rdisp lane for better performance.

pack: only keep the 16 highest-tipping early bundles

2026-10-28

runtime: per-tile sysvar cache Remove the sysvar cache from banks and instead have one sysvar cache per exec tile, to reduce memory usage. The sysvar cache is invalidated whenever an exec tile switches banks and is keyed by bank_seq. The existing sched logic is locality-friendly, so invalidations should be relatively infrequent.

failover: make set-identity restart failover on the new identity and remove demote

failover: add identity switching and failover commands to the admin bus

failover: boot under [paths.identity_key] and take the target from failover promote

mlx5: Add VLAN Tx support to the mlx5 provider. This is similar to the XDP implementation that will build the packet as usual and then pass the packet buffer from the L3 header on to the send call. Adds several new metrics for VLAN Tx.