FreeBSD git weekly: 2026-07-27 to 2026-08-02

Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293183
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58391

Add the ability to select source ip address of outgoing packets
even when the source ip address is configured on another interface.
Also add this new rtnetlink attribute to manual.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius, ziaee (manpages)
Tested by:      ivy, Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D58294

Register the 82576 and I350 VF PCI IDs under a separate igbv driver
while continuing to share the igb datapath implementation.

Follow the ixv driver split and give the VF context IFLIB_IS_VF so
iflib does not apply the PF SR-IOV detach guard to a child VF. Program
VTIVAR_MISC in the VF low byte so mailbox and reset notifications reach
the VF admin vector.

The split will become increasingly obvious as bug fixes land, trying to
bias everything with if (sc->vf_ifp) everywhere is error prone in two
directions.

This breaks existing naming/configurations and cannot be MFCed as-is.
I have no plans of adapting it to prior branches at the moment but it
may be possible.

Relnotes:       yes
Sponsored by:   BBOX.io

Add the PCI IOV schema and PF control plane for up to seven VFs with
one hardware queue per pool. Implement VF mailbox handling, MAC and
VLAN assignment, multicast filtering, promiscuity policy,
anti-spoofing, malicious-driver recovery, reset replay, and queue
lifecycle management.

The basic SR-IOV and VMDq PF implementation follows DPDK Intel e1000
code, including PF pool selection, one queue per pool, mailbox
dispatch, and VF enablement. Intel FreeBSD igb-2.5.31 supplies the
older driver baseline. Linux igb and the Intel SDMs clear up lifecycle,
isolation, reset, and family-specific details absent from DPDK.

Enabling IOV requires the PF to attach with one TX and RX queue.
Systems whose defaults select RSS queues must set the documented iflib
queue override tunables before attach.

Only 82576 and I350 support SR-IOV in silicon.  The series has been
extensively tested on I350, including thowing boundaries at the PCI BAR
that shipping drivers will never.  Still, think carefully before
reaching for this in critical environments.

Relnotes:       yes
Sponsored by:   BBOX.io

Document supported controllers, PF and VF naming, PCI_IOV and IOMMU
requirements, queue and lifecycle constraints, iovctl schema, filtering
and anti-spoof policy, mailbox and MDD recovery, shared hardware
limits, rate control, and statistics cadence.

Relnotes:       yes
Sponsored by:   BBOX.io

Borrow the e1000 VLAN filter table

Ambiguous presence of the feature by Intel was settled by DPDK and
emperical testing.

MFC after:      2 weeks
Relnotes:       yes

pwait: Optionally wait until process is reaped

If the new -r option is specified, wait until the target process not
only terminates but is reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58314

pwait: Add a SIGINFO handler

On SIGINFO, print a space-separated list or remaining processes to
standard error.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58386

rc.subr: Fix premature return from wait_for_pids

Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293183
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58391

Bump dates

Fixes:          https://cgit.freebsd.org/src/commit/?id=c8f5e6819d4d ("pwait: Optionally wait until process is reaped")
Fixes:          https://cgit.freebsd.org/src/commit/?id=eddd8aa99ca8 ("pwait: Add a SIGINFO handler")
Fixes:          https://cgit.freebsd.org/src/commit/?id=356d0b79cf6f ("rc.subr: Fix premature return from wait_for_pids")

Sponsored by: AFRL, DARPA

Several functions were using sprintf() to write RPC server-controlled
data to a stack buffer.  Adopt some minimal changes from NetBSD to avoid
the potential overflows.

Security:       CVE-2026-16277
Security:       CVE-2026-16461
Reviewed by:    khorben
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58441

Reviewed by:  emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58442

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks rpcgen during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

For mkfile_output(), the pointed-to value is never modified, so
fix this by making the pointer const as well.

For open_log_file(), the current code modifies the supposedly const
value in-place to remove the filename suffix, which happens to work
but is wrong even in older versions of C.  Change the code to use a
printf "%.*s" format specifier to strip the suffix instead.

MFC after:      1 week
Reviewed by:    brooks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58489

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks sort during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

As the returned pointer is never used to modify the value, fix this
by making the temporary variable const.

MFC after:      1 week
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58491

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks xinstall during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

As the returned pointer is never used to modify the value, fix this
by making the temporary variable const.

MFC after:      1 week
Reviewed by:    ray, markj, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58492

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks mkimg during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Make the existing 'sep' pointer const to fix the first case, and
for the second, introduce a new non-const pointer for strchr,
since we do modify the result in that case.

MFC after:      1 week
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58493

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks m4 during the
bootstrap build, since it assumes the return value is always a
mutable pointer.

Since the returned value is never modified, simply make the
temporary const.

MFC after:      1 week
Reviewed by:    bapt, dim
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58494

Add some minimal handling of category sources other than static kernel
sources.  We don't actually look up dynamic sources yet (that would
require extended trace records to add the file names to the trace file
since we can't assume the trace file is running on a kernel with the
same numbers.)

Make the decision to append a "src/" prefix to each file name
dependent on the category source.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58412

Reviewed by:  markc
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58458

mknod.2: update the man page

State that FIFOs can be created, document the requirement that
dev must be zero then.  Mention whiteouts.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297082
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D58478

mknod.2: properly document root requirements

Submitted by:   Martijn Dekker <mcdutchie@hotmail.com>
PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297082
Fixes:  https://cgit.freebsd.org/src/commit/?id=4090d103b0c3 ("mknod.2: update the man page")
MFC after:      3 days

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

There are expected to be additional improvements and this RELNOTES
entry will be updated accordingly.

Reviewed by:  des
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58483

Adjust the man page to what other LinuxKPI wlan man pages say and look
like as it has been a while since I wrote it.  The man page is not yet
hooked up to the build on purpose as the driver is not yet enabled in
the tree.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    ziaee (earlier version)
Differential Revision: https://reviews.freebsd.org/D58479

There are few warnings reported by mandoc -Tlint:

bhyve_config.5:255:31: WARNING: new sentence, new line
bhyve_config.5:257:43: WARNING: new sentence, new line
bhyve_config.5:422:2: WARNING: missing section argument: Xr nm_open
bhyve_config.5:469:24: WARNING: skipping no-space macro
bhyve_config.5:483:2: WARNING: wrong number of cells: 2 columns, 4 cells
bhyve_config.5:484:2: WARNING: wrong number of cells: 2 columns, 4 cells
bhyve_config.5:541:24: WARNING: skipping no-space macro

 - "new sentence, new line" is a trivial formatting fix.
 - "missing section": there is actually no nm_open() manual page,
    so use .Nm instead of .Xr for it.
 - "no-space macro": format without .Oc and .Ns, similarly to
    how it is already done in bhyve.8 for VNC addresses.
 - "wrong number of cells": also a trivial fix.

Reviewed by:    jhb
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58415

`nvmecontrol power -l ...` lists the available power modes.
Non-operational modes are marked with an asterisk. While here,
add <device-id | namespace-id> to the "nvmecontrol power" synopsis.

MFC after:              3 days
Reviewed by:            dab, imp, michaelo, ziaee
Differential Revision:  https://reviews.freebsd.org/D58480

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58264

Reviewed by:  emaste, mckusick
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D58592

The IPv6 socket options IPV6_JOIN_GROUP and IPV6_LEAVE_GROUP
socket options are being extended to accept IPv4 multicast group
addresses in the RFC 3493 IPv4-mapped address format as a convenience
to application developers.

Caveat this addition carefully in the newly added HISTORY section,
addressing all previous review comments.

Approved by:    ziaee
Reviewed by:    ziaee, glebius
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision:  https://reviews.freebsd.org/D55382

Previously, multiple frames of xfers are split into many tds. In the
refactor process, we forget to consider this. The td builder is already
allocate with enough numbers of tds. What we need to do is to fill the
normal trbs for muiltiple tds when building trbs.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297053
Tested by:      phk, oleglelchuk@gmail.com
Fixes:  https://cgit.freebsd.org/src/commit/?id=e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58465

It is better to propagate it to pcm_register(), and later to the device
drivers, than to simply ignore it and return ENXIO.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.

MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426

specialreg.h is the tree's MSR registry and already carries the Intel
RAPL group. Add the AMD RAPL package/core energy and unit MSRs here so
the hwpmc RAPL class can reference them without a private driver copy.
Use the names Linux's msr-index.h gives these registers.

Reviewed by:    mhorne, adrian, Ali Mashtizadeh <ali@mashtizadeh.com>
MFC after:      3 days
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58027

Add hwpmc_rapl.c/.h implementing PMC_CLASS_RAPL, a read-only
system-scope class modeled on TSC and wired into x86 AMD and Intel MD
init. A per-vendor MSR table covers AMD/Hygon and Intel; energy is
reported in microjoules, with the Intel server 2^-16 J DRAM unit
handled and 32-bit wraps recovered into a 64-bit accumulator.

The overflow guard follows the PMC lifetime: armed on the first
allocated PMC, callout_drain()d on the last release, and each tick only
rendezvouses CPUs holding one. Per-CPU spin locks guard the accumulator
against torn reads on i386. PMC_CAP_DOMWIDE lets pmcstat(8) allocate
one counter per NUMA domain instead of per CPU.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58028

Register PMC_CLASS_RAPL in libpmc: event table, allocator, class-table
descriptor, and the event-name/class-listing lookups, all x86-guarded
and modeled on the TSC class. Energy events are read-only and
unqualified. The class prefix (RAPL-) supplies the friendly spelling, so
pmcstat -S rapl-energy-pkg resolves to the canonical ENERGY_PKG event.

Add a pmc.rapl.3 manual page documenting the events, counter scope, the
microjoule unit and wrap handling, and the NUMA/package domain mapping;
link it from pmc.3.

Reviewed by:    mhorne
Discussed with: Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58029

Neither of these options are checked in the file and cdefs.h should not
be included explicitly. No functional change.

Sponsored by:   The FreeBSD Foundation

amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.

Reviewed by:    mhorne
Approved by:    mhorne
MFC after:      1 week
MFC to:         stable/14, stable/15
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58468

{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.

Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.

Reviewed by:    kbowling, gallatin
Approved by:    kbowling
MFC after:      1 week
MFC to:         stable/14, stable/15
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58513

Add a QUIRK_EMPTY_NAMESPACE_CHANGED_LOG quirk which indicates that the
nvme controller may not properly populate the namespace-changed log
page.  If we receive a NVME_LOG_CHANGED_NAMESPACE page for a device
with this quirk and the page is empty, probe all of the namespaces
rather than none of them.

Reviewed by:    imp
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58231

This controller exhibits QUIRK_EMPTY_NAMESPACE_CHANGED_LOG behaviour.

A bug report has been filed with the vendor.

Reviewed by:    imp
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58232

In particular, handle authentication errors due to bad MACs when
decrypting packets.

Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous.  Software sessions are always synchronous in practice, so
this should be a nop.

Approved by:    so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Intel Apollo Lake SDXC controller reports a Slot Type of
"Embedded Slot for One Device" in SDHCI_CAPABILITIES bits, even
when the slot is a removable card reader.
This caused 48 timeouts before the boot sequence resumed.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58467

Update the shared e1000 PF/VF mailbox interfaces for an in-tree igb
SR-IOV implementation.

Intel FreeBSD igb-2.5.31 and DPDK provide the older PF/VF mailbox
baseline.

The retained PF mailbox read and explicit unlock operation follow a
simple Linux igb parameter addition to make PF mailbox acquisition
nonblocking so the driver can retry outside the shared primitive.

Treating a CTS-less E1000_PF_CONTROL_MSG as a reset follows DPDK.

Sponsored by:   BBOX.io

Use each ring's physical queue index for initialization, MSI-X routing,
register dumps, sysctls, and debug output instead of assuming that its
logical array index is also its hardware index.

This is a no-op for the normal queue layout.  A later SR-IOV change
moves the PF ring to hardware queue num_vfs, so its hardware ID then
differs from logical queue zero.

Sponsored by:   BBOX.io

A non-zero VF device number does not always require ARI. The Intel
82576 and I350 [1] explicitly support a non-ARI layout that places VFs
on the next bus.

Check every requested VF RID and reject a non-zero device only when it
is on the PF bus. This retains the ARI guard for invalid same-bus
layouts while permitting the documented second-bus layout.

[1] Intel I350 Datasheet, sections 7.8.2.6.1.2, 9.6.4.6

Sponsored by:   BBOX.io

pci_iov_config() programs NumVFs before validating the final VF RID
layout and allocating all generic resources. A subsequent error ran the
driver uninit callback but left the hardware NumVFs register programmed
while the software VF count returned to zero.

Clear NumVFs in the error path after the driver uninit callback,
matching normal SR-IOV teardown ordering. This prevents stale hardware
state after a failed configuration and permits a clean retry.

MFC after:      1 week
Sponsored by:   BBOX.io

Register the 82576 and I350 VF PCI IDs under a separate igbv driver
while continuing to share the igb datapath implementation.

Follow the ixv driver split and give the VF context IFLIB_IS_VF so
iflib does not apply the PF SR-IOV detach guard to a child VF. Program
VTIVAR_MISC in the VF low byte so mailbox and reset notifications reach
the VF admin vector.

The split will become increasingly obvious as bug fixes land, trying to
bias everything with if (sc->vf_ifp) everywhere is error prone in two
directions.

This breaks existing naming/configurations and cannot be MFCed as-is.
I have no plans of adapting it to prior branches at the moment but it
may be possible.

Relnotes:       yes
Sponsored by:   BBOX.io

I350 loopback receive descriptors report VLAN tags byte-swapped for
both PFs and VFs. The receive path handled the PF device types but
omitted e1000_vfadapt_i350, causing an admitted VF VLAN packet to be
delivered untagged to the VF parent.

Include the I350 VF type in the existing correction. This matches the
dedicated IGB_RXQ_FLAG_LB_BSWAP_VLAN handling in DPDK igbvf.

MFC after:      1 week
Sponsored by:   BBOX.io

The register-dump sysctl is installed before iflib allocates the queue
arrays and remains visible while they are freed. Return ENXIO outside
the queue lifetime instead of dereferencing a NULL or stale array.

Sponsored by:   BBOX.io

Add the PCI IOV schema and PF control plane for up to seven VFs with
one hardware queue per pool. Implement VF mailbox handling, MAC and
VLAN assignment, multicast filtering, promiscuity policy,
anti-spoofing, malicious-driver recovery, reset replay, and queue
lifecycle management.

The basic SR-IOV and VMDq PF implementation follows DPDK Intel e1000
code, including PF pool selection, one queue per pool, mailbox
dispatch, and VF enablement. Intel FreeBSD igb-2.5.31 supplies the
older driver baseline. Linux igb and the Intel SDMs clear up lifecycle,
isolation, reset, and family-specific details absent from DPDK.

Enabling IOV requires the PF to attach with one TX and RX queue.
Systems whose defaults select RSS queues must set the documented iflib
queue override tunables before attach.

Only 82576 and I350 support SR-IOV in silicon.  The series has been
extensively tested on I350, including thowing boundaries at the PCI BAR
that shipping drivers will never.  Still, think carefully before
reaching for this in critical environments.

Relnotes:       yes
Sponsored by:   BBOX.io

Disable each igb-class transmit and receive queue and flush before
changing its descriptor-ring registers. Restore the head and tail
indices that Intel documents as surviving a VF reset.

Use the igb queue-enable control instead of programming legacy TXDCTL
granularity, low-water, and reserved bits that do not belong to the
82575 and later.

Sponsored by:   BBOX.io
MFC after:      1 week

igbv: Isolate VF policy and validate its registers

Give igb virtual functions a separate ifdi method table and move
VF-specific attach, reset, queue, interrupt, and diagnostic policy to
if_igbv.c. Keep shared descriptor-ring mechanisms in if_em.c.

Derive VF identity from IFLIB_IS_VF and assert that hardware
identification agrees. Under INVARIANTS, validate normal VF CSR
accesses against the sparse 82576 and I350 VF register maps.

Stop shared setup from accessing PF-only controls. Require MSI-X and
defer VF sysctls until attach succeeds so failed attachment cannot
leave handlers pointing at freed driver state.

Advertise only VF capabilities, run adaptive moderation without the
PF receive-buffer guard, enable SRRCTL.DROP_EN, and provide a VF-safe
diagnostic register view.

The moved implementation is the existing FreeBSD code. Register model
was cross-checked against the Intel datasheets and other Intel drivers.

Sponsored by:   BBOX.io

igbv: Improve VF mailbox and status behavior

Treat VF media as fixed 1000baseT full duplex and report PF not ready
and generated MAC fallback states during attach.

After a successful reset handshake, reconcile a PF rejected MAC back
into the ifnet. If the PF is unavailable, defer MAC, multicast, VLAN,
LPE, and promiscuity replay until CTS is restored. Track a rejected
VLAN removal separately so leaked traffic remains tagged until reset
proves that the stale hardware filter is gone.

Baseline VF counters at attach, collect the four loopback packet and
octet counters with rollover-safe deltas, and account software RX
checksum offload results. Preserve accumulated statistics across PF
resets by rebasing the raw hardware counters, and sample them while
physical link is down because VF loopback can remain active.

Retain the 82576 VFMPRC hardware statistic, but do not read it on I350
VFs because specification update errata 31 says it is unavailable.

Clear PF owned flow control state and reset a link down VF when queued
transmit descriptors must be flushed.

Sponsored by:   BBOX.io

igbv: Support secondary unicast filters

Support the Linux igbvf secondary-MAC mailbox subprotocol, used by
Linux guests running MacVTap.

Replay up to three non-primary unicast addresses after reset and
whenever the address list changes, subject to PF allow-set-mac policy.

Sponsored by:   BBOX.io

igb: Stop writing the legacy TADV register

TADV is an em-class interrupt delay register and is absent from the
82575 and later register model. The igb attach path does not expose or
initialize that control, but transmit initialization still wrote its
zero valued storage into a reserved queue-window offset.

Apply the same igb_mac_min boundary already used for TIDV and the
absolute-delay sysctls.

MFC after:      1 week
Sponsored by:   BBOX.io

igb: Update only changed IOV multicast hashes

Build the aggregate PF/VF multicast bitmap in software and compare it
with the e1000 MTA shadow. Write only registers whose desired value
changed, while forcing a complete write after PF reset invalidates the
hardware table.

This bounds alternating VF multicast updates without NACKing them.
Linux igbvf and DPDK ignore multicast reply status, so a command-rate
limiter could otherwise acknowledge configuration while leaving
hardware state stale.

Sponsored by:   BBOX.io

igb: Update only changed IOV VLAN filters

Keep the full VFTA/VLVF software recomputation and clear-map-set
ordering, but compare each phase against the authoritative old value.
Write only VFTA words and VLVF slots whose effective contents change.

I350 uses its software VFTA shadow because erratum 20 makes live reads
unreliable; an invalid shadow forces a complete clear before sparse
restoration. 82576 continues to diff against live VFTA reads.

Add SDT probes for every logical write phase and the final software
images so hardware tests can verify exact elision counts. On my I350
DUT, the old full table path averaged 819 us across 31 VLAN removals
versus about 79 us for the PF statistics sweep.

Sponsored by:   BBOX.io

igb: Rate-limit VF VLAN rebuild requests

Give each VF a burst of 64 VLAN additions and refill it at eight
additions per second. Removals remain unrestricted, idempotent requests
consume nothing, and trusted PF-wide initialization replenishes the
burst while guest resets do not.  Checks VLVF capacity before charging
a token.

Do not apply this policy to multicast requests because Linux igbvf and
DPDK ignore their reply status; aggregate MTA write elision bounds
those updates instead.

Sponsored by:   BBOX.io

Mailbox and link interrupts share iflib admin service with the periodic
timer. Mark timer-driven passes explicitly and run the hardware
statistics sweep only for those samples instead of repeating 66 PF MMIO
reads for every VF mailbox message.

DTrace on the I350 DUT measured the PF sweep at about 79 us on average.
The normal hz/2 timer continues to extend clear-on-read counters
safely; exported counters may trail hardware by up to 500 ms.

Sponsored by:   BBOX.io

A PF mailbox NACK does not distinguish the SR-IOV VLAN request rate
limit from permanent VLVF exhaustion. Preserve desired VLAN membership
and retry four additions per 500 ms timer tick, matching the PF
sustained allowance.

Bound the whole recovery batch to eight seconds from its first failure
and consolidate restore diagnostics, so a full table cannot create a
permanent mailbox poller or repeated per-VID log bursts.

Sponsored by:   BBOX.io

Pass the VF generation through the CSR accessors so the validator can
distinguish the sparse 82576 and I350 register maps.

Admit the queue-zero RXCTRL, TXCTRL, TDWBAL, TDWBAH, and
VFPSRTYPE registers exposed by both families.

82576 exposes VFMPRC at 0xf3c.  I350 erratum 31 makes its
corrected 0xf38 address inaccessible to a VF, so reject both I350
spellings while retaining read access on 82576.

Sponsored by:   BBOX.io

82576 and I350 VFLR leave the VF queue configuration unchanged.  A VF
can program transmit head write-back and leave its DMA destination for
a later VF owner; mainstream VF drivers do not overwrite TDWBAL/H.

Disable every receive and transmit queue assigned to the VF, wait for
the enable bits to clear, then clear SRRCTL, PSRTYPE, RXCTRL, TXCTRL,
and TDWBAL/H.  Spin briefly for the normal transition, then sleep at
100 microsecond intervals with an approximately 1 ms bound.  This
prevents a VF that keeps asserting QUEUE_ENABLE from busy-waiting the
PF context lock for 10 ms.

If a queue does not quiesce, leave the VF disabled and NACK its reset
rather than programming an active queue.  Rate-limit this diagnostic
independently from mailbox and malicious-driver notifications.

I350 maps pool n to queue n.  82576 assigns physical queues n and n+8
to VF n, so sanitize both queues while clearing per-pool PSRTYPE once.
An incoming VF initializes its active ring base, head, and tail while
enabling each queue.

This is also required by malicious-driver recovery, which deliberately
does not assert VTCTRL.RST because doing so would discard the VF's
admin-vector routing before the PF can notify it.

This implements Software Clarification 3 from the 82576 and I350
specification updates.

Sponsored by:   BBOX.io

82576 and I350 VFLR leave queue configuration unchanged.  A previous
VF owner can therefore leave a transmit head-writeback DMA destination
and other queue policy for the next guest.

After each reset attempt, disable all exposed VF queues and wait for
their enable bits to clear before clearing SRRCTL, VFPSRTYPE, RXCTRL,
TXCTRL, and TDWBAL/H.  Spin briefly and then sleep until the bounded
queue-disable deadline.

iflib cannot report initialization failure and marks an interface
running after its init callback returns.  On sanitation failure, keep
interrupts disabled and use the deferred admin task to clear RUNNING.
Retry after 100 and 500 ms; after three total failures, leave the
interface down until another administrative initialization starts a
new bounded attempt set.

igbv uses queue zero on both families, but 82576 exposes a second VF
queue whose retained state must also be cleared.  Extend the INVARIANTS
register validator for only those queue-one CSRs and only on 82576.

This implements the VF side of Software Clarification 3 from the 82576
and I350 specification updates.  It also means an igbv guest does not
depend on its PF to sanitize a previous VF owner's state.

Sponsored by:   BBOX.io

amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)

Also do not mask bits in the mxcsr_mask.  It is ignored by FRSTOR/XRSTOR.

Reported by:    markj
Reviewed by:    jhb, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58548

ptrace: Propagate errors from set_fpregs()

Otherwise ptrace(PT_SETREGSET) will not return errors to userspace.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cef05c5a62ba ("amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58577

Reported by:  jhb
Reviewed by:    jhb, jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58550

Some conventional PCI e1000 configurations hang when given DMA
addresses above 4 GB, particularly on systems using AMD
HyperTransport-to-PCI bridges.  Linux has restricted e1000 to DMA32 in
PCI mode since 2011 for the same failure class in commit
e508be174ad36b0cf9b324cd04978c2b13c21502.

Set iflib's DMA width after determining the negotiated bus type.  This
covers descriptor and packet-buffer mappings while preserving 64-bit
DMA for PCI-X and PCIe devices and providing a conditional tunable.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297064
Reported by:    Alexander Leidinger <netchild@FreeBSD.org>
Tested by:      Alexander Leidinger <netchild@FreeBSD.org>
MFC after:      1 week

Add register/bit definitions for the L1 PM substates capability
(PCIZ_L1PM) to pcireg.h.

Signed-off-by: Michael Adler <madler@tapil.com>

MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.

Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.

Adapted from the Linux igc driver:

  0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
               performance issue
  1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
               on init

Signed-off-by: Michael Adler <madler@tapil.com>

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279245
Reviewed by:    Jim Thompson
MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

ixgbe: isolate VF reset state

IXGBE_VF_INDEX() selects a 32-VF register bank.  PFMBMEM() selects
one mailbox per VF, while ixgbe_toggle_txdctl() calculates queue
offsets from a VF number.  Passing the bank index aliases VF1-31 to
VF0 and VF32-63 to VF1.  Resetting one VF can therefore clear the peer
mailbox and leave its transmit queues disabled.

The VF raises its reset event before posting its mailbox request.  The
PF checks reset events before mailbox messages.  If both are pending,
clearing PFMBMEM during generic reset handling can erase the request
before ixgbe_read_mbx() consumes it.  Clear the mailbox only from the
reset-message handler after the request has been read.

Use the VF number for queue toggling and document that API contract.

MFC after:      1 week

ixgbe: respect peer mailbox ownership

A VF currently treats an existing VFU bit as a successful acquisition,
while the PF checks its own PFU bit before claiming the mailbox.  Check
both the local and peer ownership bits before setting local ownership.
This prevents same-side callers from sharing the mailbox and avoids an
acquisition attempt while the peer owns it.

VFLR does not clear VFMAILBOX.VFU.  Clear stale VF ownership and cached
mailbox status after the reset indication settles and before sending the
reset request, so the ownership check cannot strand a reinitialized VF.

Adapt only the live ownership checks from Intel ix 3.4.39.  Do not import
its upgraded-mailbox changes, which are not active in FreeBSD.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: fail fast on VF-held PF mailboxes

The active PF mailbox operations use the legacy helpers.  The mailbox API
import changed check_for_msg into a read-only probe and added up to 2,000
500-microsecond lock retries.  If a VF leaves VFU set, the PF cannot acquire
the lock, busy-waits for up to one second, and leaves VFREQ pending so the
delay can repeat.

Give the legacy checker its old consume-on-check behavior so a failed read
does not leave VFREQ asserted.  If VFU is already set, fail immediately
instead of retrying, while preserving retries for PF-side contention.  Do
not force RVFU, which would discard peer transaction state.

MFC after:      1 week

if_foreach_llmaddr() adds each callback return value to its running
count.  Returning the incremented count made the address indices grow
as 0, 1, 3, 7, and so on, eventually writing beyond the multicast
address array.

Return one address per callback and stop copying when the array is
full, matching the ixv-1.6.12 driver.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ff06a8dbb677 ("Mechanically convert ixgbe(4) to IfAPI")
MFC after:      1 week

DPDK commit message

net/ixgbe/base: add missing buffer copy for ACI

Add the missing buffer copy in ixgbe_aci_send_cmd().

The retry path saves the original descriptor and allocates storage for
the command buffer so both can be restored before another attempt.  It
did not copy the original command buffer into that storage.

Fixes:          https://cgit.freebsd.org/src/commit/?id=25b48e569f2f
Cc: stable@dpdk.org

Signed-off-by: Dan Nowlin <dan.nowlin@intel.com>
Signed-off-by: Yuan Wang <yuanx.wang@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (37239792b0)
MFC after:      1 week

DPDK commit message

net/ixgbe: fix flow control frame byte adjustment

LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and XOFF
packets.  Their deltas are summed and used to adjust the transmitted
packet and byte counters.

Perform the addition in 64 bits so it cannot wrap before the result is
used for the byte adjustment.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes:          https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (bdf8608559)
MFC after:      1 week

DPDK commit message

net/ixgbe/base: fix unchecked return value

Check the return value from ixgbe_read_eeprom() before using the
control word to configure link disable during D3.

Fixes:          https://cgit.freebsd.org/src/commit/?id=b7ad3713b958 ("ixgbe/base: allow to disable link on D3")
Cc: stable@dpdk.org

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (eb3684b191)
MFC after:      1 week

FreeBSD's I2C helper already retries failed transactions.  Limit this
new outer loop to successful reads with an invalid identifier so that
retry budget is not multiplied.

DPDK commit message

net/ixgbe: retry misbehaving SFP read

Some XGS-PON SFPs ACK I2C reads and return uninitialized data while
their microcontroller boots.  A bogus identifier can cause an otherwise
working module to be marked unsupported.

Retry the identifier read several times, checking for both successful
I2C completion and a valid SFP identifier.

Signed-off-by: Stephen Douthit <stephend@silicom-usa.com>
Signed-off-by: Jeff Daly <jeffd@silicom-usa.com>
Reviewed-by: Haiyue Wang <haiyue.wang@intel.com>

Obtained from:  DPDK (774263bb4e)
MFC after:      1 week

ixgbe: fix unaligned access in ixgbe_update_flash_X550()

ixgbe_host_interface_command() treats its buffer as a u32 array.  The
local union contained only byte-sized fields, giving it one-byte stack
alignment and allowing unaligned accesses on strict-align systems.

Add a u32 member to the union to provide the required alignment and
pass that member to ixgbe_host_interface_command().

No functional change is expected on x86.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: avoid signed overflow in pause time calculation

pause_time is promoted to signed int before multiplication.  Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.

Make the multiplier unsigned so the calculation has the intended u32
semantics.  Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction.  The 82598-specific flow
control operation contains the identical expression, so correct it as well.

MFC after:      1 week

ixgbe: reject VF requests before CTS

A VF that sends a non-reset request before completing reset negotiation
has not received CTS.  The PF ignores the request but currently reports
success, leaving the VF with a false view of the programmed state.

Return failure for the ignored request.  This restores the behavior lost
when the mailbox helpers were renamed.

Fixes:          https://cgit.freebsd.org/src/commit/?id=36c516b31136 ("ixgbe: update if_sriov to use the new mailbox apis")
MFC after:      1 week

ixgbe: check negotiated API for VF queue query

The GET_QUEUES handler switches on msg[0], which contains the mailbox
command rather than the negotiated API version.  It therefore cannot
reject API 1.0 or an unnegotiated VF as intended.

Switch on the API version stored for the VF.

MFC after:      1 week

Clear ROMPE for an empty list and enable it only for a nonempty list.
FreeBSD already clears ROMPE when resetting a VF, so that part of the
DPDK change is not needed.

DPDK commit message

net/ixgbe: fix over using multicast table for VF

VMOLR.ROMPE allows a VF to receive packets matching the shared multicast
table.  Leaving it enabled after the VF removes its last multicast
address lets PF or peer-VF table entries continue selecting that VF.

Signed-off-by: Wei Zhao <wei.zhao1@intel.com>
Acked-by: Qi Zhang <qi.z.zhang@intel.com>

Obtained from:  DPDK (dc5a6e7422)
MFC after:      1 week

ixgbe: fix host interface timeout detection

The host-interface polling loop was scaled from milliseconds to
microseconds, but its terminal test was left using the unscaled timeout.
Completion at that intermediate iteration can be reported as a timeout,
while actual expiry is not recognized and can accept stale status.

Test against the scaled loop bound used by the polling loop.

Fixes:          https://cgit.freebsd.org/src/commit/?id=f46d75c90f5f ("ixgbe: improve MDIO performance by reducing semaphore/IPC delays")
MFC after:      1 week

ixgbe: avoid signed shift when assembling ETrack ID

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: dispatch PBA string reads through EEPROM ops

E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation.  Dispatch through the EEPROM
operation table so device overrides are honored.

Initialize the generic operation for devices that use the ordinary
EEPROM representation.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: clear VF head write-back state on reset

VF reset and FLR do not clear the transmit head write-back address
registers.  A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.

After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF.  Derive the queue
count from the active IOV mode so peer queue state is not touched.

Linux commit dbf231af81a7 documents the hardware behavior.  The FreeBSD
implementation follows the local queue mapping and register interfaces.

MFC after:      1 week

Fixes:                https://cgit.freebsd.org/src/commit/?id=fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

acpi_probe_child() keeps PCI link devices, the RTC,
and docking stations enabled even when _STA reports them not present,
but skipped acpi_parse_resources() for them. With an empty resource
list, resource-based hint matching (BUS_HINT_DEVICE_UNIT) cannot wire
such a device to its hinted unit, and the hinted ISA device is then
created as a duplicate.

Modern AMI firmware reports the PNP0B00 RTC as not present while
handing timekeeping to the ACPI Time-and-Alarm device.

Reviewed by:    adrian, jhb
Differential Revision:  https://reviews.freebsd.org/D58047

Classify I226_LMVP and I226_BLANK_NVM as I226 silicon so they
receive the I226-specific ASPM L1.2 workaround.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279245
MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.

Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.

Fixes:          https://cgit.freebsd.org/src/commit/?id=7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
MFC after:      3 days

aq(4): observability controls and sysctl/header hygiene

Fold the driver's observability and infrastructure work.

Make aq_device.h self-contained: it declares struct aq_dev in terms of
iflib, bitstring, socket, and ethernet types but included none of the
headers that define them, compiling only because every includer happened
to pull those first.  Include what it uses.  No functional change.

Make the debug controls per-instance.  The debug and debug_categories
sysctls were registered per device but pointed at file-scope globals, so
writing dev.aq.1.debug also changed dev.aq.0.debug and a card could not
be traced in isolation.  Move the level and category mask into struct
aq_dev, reach them through the aq_dev back-pointer in struct aq_hw (wired
up in attach_pre before the first firmware trace and guarded against a
NULL deref), emit through device_printf() so each line carries its unit,
and seed initial values from per-unit device hints so attach can be
traced.

Expose the PHY die temperature as dev.aq.N.temperature through a new
firmware get_temp op: Atlantic 1 v2 reads it through the mailbox MPI
control/state toggle, Atlantic 2 from the phy_health_monitor block in the
OUT window (located at 0x13620 and confirmed by its ready bit).  Atlantic
1 v1 has no sensor and exposes no node.  Because this is the first
firmware accessor iflib does not serialise, add a per-instance mutex in
struct aq_hw and take it across the v2 read-modify-write in set_mode(),
get_stats(), get_mode(), and get_temp(); the v1 and Atlantic 2 paths do
not need it and say so.

Trace the Atlantic 2 firmware path, which previously emitted nothing at
any debug level (aq2_fw.c did not even include aq_dbg.h): the boot
handshake, reset policy, MAC address, and link mode set/read, using the
existing dbg_init and dbg_fw categories, with the per-poll mode read at
detail level.

Scope the driver sysctls to a context freed at detach.  They were
registered on the device newbus context, which newbus tears down only
after DEVICE_DETACH returns, yet iflib frees the rings and softc inside
DEVICE_DETACH -- a sysctl read racing detach could touch freed memory.
Give the driver its own sysctl_ctx_list and free it at the start of
aq_if_detach, draining in-flight readers first.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58434

aq(4): PHY thermal-shutdown handling and correctness fixes

Fold the thermal-protection work and the correctness fixes that landed
alongside it.

Report and auto-recover from PHY thermal shutdown.  The Atlantic PHYs can
autonomously shut down on over-temperature, latching global fault 0x8007
and dropping the link; Atlantic 2 ships this armed, Atlantic 1 disabled.
Arm it on Atlantic 1 at interface init (1E.C478.A via the MAC's MDIO
controller), and recover from a trip automatically: the admin-status poll
detects the fault, logs the shutdown limit and measured temperature, and
holds the link down until the PHY cools, then restores it -- Atlantic 1
needs a PHY reset (1E.2681.0) with the MAC firmware running plus a full
re-init, Atlantic 2 recovers on the re-init alone.  New firmware ops
get_phy_fault, phy_reset, thermal_arm, and get_thermal_limit back the
state machine in aq_if_update_admin_status().

Make that Atlantic 1 thermal MDIO path address-correct and fail-safe.
The direct-MDIO helpers hardcoded the Clause-45 port address to 0, but it
is strap-selectable: on a board whose PHY answers elsewhere every thermal
op targeted nothing, so arming silently no-oped and the post-trip reset
never cleared the latch.  Discover the address by scanning ports 0..31
for a PMA/PMD identifier and form it as (phy_id << 5) | mmd, marking it
valid only when a PHY actually answers.  aq_fw2x_phy_read also returned 0
on a semaphore timeout, indistinguishable from a real 1E.C478 == 0, so
thermal_arm could zero live provisioning bits; give the read an error
return and gate thermal_arm and get_thermal_limit on it.

Bound the multicast filter slot index.  aq_mc_filter_apply() programmed
slot count + 1 and bailed only at count == AQ_HW_MAC_MAX (33), one
address too late, so a 33rd entry raced in between the if_llmaddr_count()
snapshot and the if_foreach_llmaddr() walk drove an out-of-bounds MMIO
write to slot 33.  Fire the guard at AQ_HW_MAC_MAX - 1, and also reject
index >= AQ_HW_MAC_MAX in aq_hw_mac_addr_set() where the slot becomes an
RPF register offset.

Correctness and safety fixes: initialize the sysctl context in
attach_pre so the iflib fail-path detach cannot sysctl_ctx_free() an
uninitialized list (a page fault when MSI/MSI-X is denied); range-check
the Atlantic 2 action-resolver table index, taken verbatim from a
firmware-supplied base, before writing the ART registers; and accumulate
statistics deltas as unsigned, since AQ_SDELTA discarded a forward delta
of 2^31 or more at 10G across a stretched admin poll.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58435

aq(4): clean up diagnostics and remove dead code

Non-functional cleanup, no change in behavior.

device_printf() already prefixes each line with the device name, so the
inline "atlantic:" token in the status and error messages produced a
doubled prefix and diverged from the trace macros; remove it so all
output carries one uniform "aqN:" prefix.  Compile the RX/TX descriptor
tracers only when AQ_CFG_DEBUG_LVL > 2 and make them no-op macros
otherwise, so the default build no longer pays a cross-TU call plus
argument evaluation per descriptor.

Drop enum aq_dev_state, struct aq_rx_filters, and struct aq_vlan_tag,
which have no remaining references now that VLAN state lives in a
bitstr_t.  Replace the four identical aq_sysctl_print_{tx,rx}_{head,tail}
handlers, each carrying a dead write path on a read-only oid, with one
aq_sysctl_print_ring_ptr that selects the accessor from arg2.  Reduce the
thermal and PHY-recovery comments to single terse lines that keep the
load-bearing register numbers and the A1-vs-A2 recovery difference.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58436

aq(4): mailbox, flow-control and firmware error-handling fixes

Fold the whole-driver-review correctness and hardening fixes for the
firmware and hardware layers.

Advance the firmware-mailbox address per word in aq_hw_fw_downld_dwords():
on B1 silicon each loop iteration waits for the mailbox address register
to differ from the expected address, but it was set once and never moved,
so after the first word every wait returned immediately and read stale
data.  Advance it four bytes per word.  B0 is unaffected (it polls the
busy bit).  The same function also left err set to ETIMEDOUT after
successfully force-recovering the RAM CPU semaphore; the transfer loop is
guarded by "--cnt && !err", so it ran zero iterations and returned a
timeout with an untouched buffer, making the recovery path dead code.

aq_hw_get_mac_permanent() ignored the get_mac_addr() error and then
examined a buffer the firmware op never wrote on failure.  A fresh softc
is zero, so the "invalid address" test fired, a random locally
administered MAC was substituted, and err was overwritten with 0 -- a
transient mailbox failure produced a card that attached with a different
MAC every boot.  Fail instead; the random-address fallback still covers a
genuinely blank or multicast burned-in address.  aq_fw1x_reset()
discarded the same download's return value and then read transaction_id
out of an uninitialized stack struct, so propagate that error too.

Encode RX-only flow control as PAUSE|ASYM_PAUSE rather than PAUSE alone:
firmware 2.x/3.x has no independent RX-only bit, so the old encoding
advertised symmetric pause when RX-only was requested.  The MPI_INIT path
also never cleared the pause bits before OR-ing in the requested ones, so
flow control could be enabled and never disabled; clear them first, as
the Atlantic 2 and Linux implementations do.

Reject single-vector MSI in aq_if_attach_post() the same way legacy INTx
is rejected: ift_legacy_intr is NULL, so no driver filter would
acknowledge the not-clear-on-read, auto-masked device interrupt status;
every supported Atlantic device provides MSI-X.

Propagate firmware and MDIO errors instead of discarding them.  The fw2x
MDIO primitive returned a data word with no way to report a controller
timeout; give aq_fw2x_mdio_op() a status return and a data out-parameter,
propagate it through phy_write/read/reset/thermal_arm, and stop advancing
the thermal recovery state machine when a PHY reset fails.  Use that
error to end the PHY address scan early: aq_fw2x_init_phy_id() probed all
32 MDIO ports even when the controller itself was timing out, spending up
to ten seconds under fw_mtx and the iflib context lock.  aq_fw2x_reset()
also drove the shared MIF mailbox without fw_mtx, unlike every other fw2x
mailbox user, so it could interleave with the temperature sysctl and load
the capability mask from the wrong window.

aq_hw_mpi_set() can return ETIMEDOUT when the Atlantic 2 shared firmware
buffer is not acknowledged; aq_hw_init() now aborts through its error
path rather than enabling rings with an unaccepted link state, and
aq_if_init() logs the later link-speed error.

Retry a failed initialization instead of leaving the link down.  ifdi_init
has no return value, so iflib marks the interface running once aq_if_init()
returns; a propagated firmware-ack failure would otherwise leave it running
with no initialized hardware and no recovery.  Record the failure and retry
from the admin task via iflib_request_reset(), paced by the once-per-second
timer, giving up after a bounded number of attempts.  Ring and queue start
failures are deliberately left to the existing diagnostic, since they leave
the remaining queues usable.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58437

aq(4): interface lifecycle and link-state fixes

aq_if_init() programmed the address captured at attach, so an address set
with "ifconfig ether" or by lagg(4) enslavement was never written to
unicast filter slot 0: the interface transmitted with the new address but
the MAC still filtered on the old one, so it received nothing.  Copy the
current if_getlladdr() the way the other iflib drivers do.

The link state could latch UP forever.  aq_if_stop() cleared linkup
before calling aq_if_update_admin_status(), which suppressed the
LINK_STATE_DOWN transition the "link was UP" branch would have made.
Announce the down transition directly from aq_if_stop() instead, and do
not poll the admin status there at all: the MAC has just been reset, so a
stale link reading would re-announce the link as up.

The admin task itself had to stop reporting a link on a stopped
interface.  iflib runs it while either IFF_DRV_RUNNING or IFF_DRV_OACTIVE
is set, and iflib_stop() sets OACTIVE, so the task kept polling after the
stop and re-announced LINK_STATE_UP behind the driver's back.  Treat a
non-running interface as having no link.  A lagg(4) parent otherwise
keeps hashing flows onto a port whose carrier is gone, because
LAGG_PORTACTIVE tests if_link_state together with IFF_UP.  Stop the rest
of the task there as well: the PHY thermal poll and the initialization
retry both end in iflib_request_reset(), and _task_fn_admin() acts on
that with no test of its own, so either could re-initialize an interface
the operator had just taken down.

aq_if_update_admin_status() also only reacted to transitions in and out
of zero speed, so an autoneg downshift that kept the link up left
if_baudrate, ifmedia, RX pause and interrupt moderation programmed for
the old speed.  Track the announced speed and re-run that work when it
changes.

aq_if_suspend() resets the MAC and stops the rings, but
iflib_device_suspend() only calls IFDI_SUSPEND and never stops the
interface, leaving IFF_DRV_RUNNING set over a suspended device.  Clear it.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58473

The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.

Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.

I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3.  Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.

Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=265714
MFC after:      4 days

igb: preserve coalesced 82576 MDD events

WVBR is read-clear, so reading it from the deferred admin pass loses
earlier queue bits when multiple VF malicious-driver events arrive
before that pass.

Snapshot WVBR in the interrupt filter, translate its staggered queue
bitmap to pool bits, and OR observations into software latches for
deferred notification and recovery.

Retain the one-queue VMDq policy used for mixed-driver safety (the
vswitch cannot handle a 2Q guest loopback to a 1Q guest per errata).

igb: drain stale MDD state before interrupt arm

IOV policy setup can leave MDDET and its read-clear diagnostic
registers populated while the admin vector is masked. Carrying that
state across the unmask can suppress the next spoof-event edge.

Mark initialization for a one-shot drain and consume LVMMC, WVBR when
applicable, and ICR immediately before EIMS/IMS arms the vector.
Preserve the synthetic link-status cause across the arm-time ICR read,
and clear the one-shot latch at reset preparation.

igb: recover retained i350 admin interrupts

I350 can retain EICR.OTHER with MDDET and LVMMC asserted while the
admin vector and legacy cause remain enabled. The anti-spoof filter
continues dropping packets, but no MSI-X is delivered and the spoof
diagnostic is lost.

Preserve the one-shot setup drain across iflib reset preparation,
clear ICR before LVMMC during i350 setup, and kick the enabled admin
vector from each admin pass. The synthetic no-cause interrupt stays
in the filter and also releases a retained MDDET cause.

Keep 82576 drain ordering and stop-time cleanup unchanged.

I225 v1 cannot receive the minimum inter-packet gap required at
2.5 Gb/s.  For affected back-to-back links, Intel recommends using a
15-byte transmit IPG instead of 12 bytes.

Program TIPG.IPGT to 0xb for pre-v2 I225 devices at 2.5 Gb/s and
restore the default at lower speeds.  Avoid penalizing fixed I225 and
I226 parts.

MFC after:      2 weeks

Track RERC separately instead of adding receive errors to the collision
count, and read the previously omitted RXERRC register.  Include RFC in
input errors because CRCERRS does not count bad-CRC runts, implementing
the I225 length-error accounting workaround alongside RUC and ROC.

Stop treating host transmit MAC discards as receive errors.  Expose both
RERC and HTDPMC as dedicated MAC statistics so their overlapping counts
remain available without corrupting aggregate interface counters.

MFC after:      2 weeks

Both these functions have non-static linkage for good reasons, however, their
naming may confuse folk when working with crypto(9) code at global scope.

Borrow the e1000 VLAN filter table

Ambiguous presence of the feature by Intel was settled by DPDK and
emperical testing.

MFC after:      2 weeks
Relnotes:       yes

X550-family malicious-driver detection validates the transmit
context selected by a data descriptor with Check Context set.  ixgbe
sets that bit on every transmit data descriptor, but ordinary PF
packets without a VLAN or checksum offload do not create a context
descriptor.  The empty context then reports an invalid MAC-header
length and blocks the PF queue as soon as MDD is enabled.

Create the existing context descriptor for every PF packet while
SR-IOV is active.  This supplies the required MAC-header length and
keeps MDD from mistaking normal PF traffic for a malicious-driver
event.

MFC after:      1 week

inpcb: declare struct in_conninfo as a single declaration

This removes just one level of #define mess that is needed to reach into
an inpcbs IPv4 address.  And makes the declaration easier to read.  No
functional change.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58273

libdtrace: Fix up translators after struct in_conninfo changes

Fixes:  https://cgit.freebsd.org/src/commit/?id=698402f4f97c ("inpcb: declare struct in_conninfo as a single declaration")

libdtrace: Fix up one more translator

Fixes:  https://cgit.freebsd.org/src/commit/?id=d8bcb13b79b4 ("libdtrace: Fix up translators after struct in_conninfo changes")

in_ifprimaryaddr() exists only to support IPv4 multicast usage. Since the
adoption of epoch tracking, ifa_ref() is no longer required in its body;
that was originally introduced by rwatson in 2009.

We could not use __deprecated1() from <sys/cdefs.h> anyway, as
IFP_TO_IA() is a macro, not a function.

Approved by:    glebius (2026-02-26)
Reviewed by:    adrian, glebius, pouria
Differential Revision:  D55344

IPv4 multicast currently has the big caveat that it depends on the first
assigned IPv4 address on an interface (the so-called "primary address").

in_ifprimaryaddr() only needs to be used by the following:
 - the 0.0.0.0 booting node input workaround in IGMPv1;
 - filtering out the node's own reports in IGMPv2;
 - preserving the source IP where an IGMPv3 report has been looped back;
 - inferring the default upstream IPv4 interface address for the
   IP_MULTICAST_IF socket option;
 - and inferring the source address during ip_output() for a multicast
   datagram where an interface has been explicitly specified by that option.

All of these uses mandate the use of IPv4 source address selection, but
FreeBSD does not yet (fully) implement this functionality.

Approved by:    glebius (2026-02-26)
Reviewed by:    adrian, glebius, pouria
Differential Revision:  D55345

If we have source address specified, try to find it by enumerating
ifas on specified fib.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58444

Revert UseBlocklist from SSHCFG_ALL to SSHCFG_GLOBAL (with
SSHCFG_COPY_NONE), ensuring it can only be set globally in sshd_config
rather than within conditional Match blocks, matching historical
behavior.

Reviewed by:    emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision:  https://reviews.freebsd.org/D58520

This may plug minor leaks which no-one has reported. The default IPv6 source
address selection policy list in FreeBSD is usually limited to 9 entries,
and can be readily inspected with ip6addrctl(8). The policy table is
however instantiated for each VNET.

The leak of a pol instance in delete_addrsel_policyent() was already
plugged by @ae in commit-id ecc5c73, so that change has not been merged.

Do not tear down the sxlocks as glebius has requested, and move the
addrsel_policyent{} declarations further up to avoid redundant forward
declarations as glebius requested for stylistic reasons.

Reviewed by:    ae, pouria
Sponsored by:   Cisco Systems, Inc.
Differential Revision: https://reviews.freebsd.org/D55599

When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.

The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.

The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.

Reported by:            Lukas Book <lkbook@outlook.de>
Reviewed by:            glebius
Differential Revision:  https://reviews.freebsd.org/D58484

nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
uses that pointer afterwards to set nd_ra.

When m_pullup() relocates the chain it frees the original first mbuf and
returns a new one, leaving ip6 dangling; the subsequent access may be a
use-after-free read.

The fix writes ip6 from the returned mbuf after m_pullup() inside the
conditional if.

Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D58229

nd6_prefix_onlink will enter net_epoch when necessary.
Also, exit net_epoch earlier in nd6_prefix_onlink,
Because we acquired a reference to ifa, and we got our ifa
from the pr->ndpr_ifp, we don't need to stay under epoch.
While here, style it.

Reviewed by:    markj, glebius
Discussed with: zlei
Differential Revision: https://reviews.freebsd.org/D56129

Add the ability to select source ip address of outgoing packets
even when the source ip address is configured on another interface.
Also add this new rtnetlink attribute to manual.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius, ziaee (manpages)
Tested by:      ivy, Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D58294

    Restrict the scope of the struct hc_metrics_lite to the kernel only.
    Update the naming to align with other kernel structures and add a tcp_ prefix.

Reviewed by:            glebius
MFC after:              2 weeks
Sponsored by:           NetApp, Inc.
Differential Revision:  https://reviews.freebsd.org/D58440

    When configuring the expire timeout to something short, make sure that the
    prune time runs at least at that interval. Similarly, when adjusting the
    prune interval up, ensure the expire timeout reflect that expected minimum
    time also. Finally, restart the callout timer so that the next pruning
    happens after the new, expected interval.

Reviewed By:            glebius
MFC after:              2 weeks
Sponsored by:           NetApp, Inc.
Differential Revision:  https://reviews.freebsd.org/D58424

Prior to commit 90ea8e89d9b751e8b5ae90ef3397883b035788e5, this was
handled by calling in6_pcbladdr().

Reported by:    syzkaller
Reviewed by:    pouria, glebius
Fixes:          https://cgit.freebsd.org/src/commit/?id=90ea8e89d9b7 ("netinet6: refactor in6_pcbconnect()")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58518

Reported by:  Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by:    pouria, kp
Fixes:          https://cgit.freebsd.org/src/commit/?id=0361f165f219 ("ipsec: replace SECASVAR  mtx by rmlock")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58521

Some devices remap the PF queues when entering or leaving SR-IOV. Add
opt-in PCI IOV helpers that hold the iflib context lock across the
complete stop, driver callback, and restart transaction.

Existing drivers continue to use the non-restarting helpers.

Sponsored by:   BBOX.io

Remove unused rnh_multipath and rib_algo_fixed members.
While here, convert rib_dying and rib_algo_init from uint32_t to bool.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58537

Add validation for unused parameter values in the gap between
VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent
panics.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297151
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    markj
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58552

if_gre(4): Fix races by changing initialization order and locks

Treat if_gre like any other network drivers during module
initialization by using SI_SUB_PROTO_IF.
Also, destroy cloned interfaces via a prison removal callback for
gre over udp.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275474
Reviewed by:    markj
Discussed with: glebius
Differential Revision: https://reviews.freebsd.org/D57669

if_gre(4): Fix link state announcement in SIOCDIFPHYADDR

Since we unlock gre before if_detach() and use slock in gre_clone_modify_nl()
there is no need to split if_link_state_change() out of gre_delete_tunnel().

Reported by: markj
Fixes: https://cgit.freebsd.org/src/commit/?id=a0d2e5ebaa2e ("if_gre(4): Fix races by changing initialization order and locks")

Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666

A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.

The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.

For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.

When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,
check for both. Add this only to the base stack, since the RACK and
BBR stacks already do this.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296594
Reviewed by:            rscheff
MFC after:              3 days
MFC to:                 stable/14
MFC to:                 stable/15
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D58594

This change is intended to address @glebius comments from the original D55663.
ip6_hdr_pseudo{} is referenced by certain OpenBSD OCF related components. I am
using __aligned(4) and not __packed as urged by the late Hans-Petter Selasky.
Use C99 types and style. We must eat the churn now cross-BSD compatibility
is "Fade to Black".

Put _Static_assert under #ifdef INVARIANTS to not disrupt regular compilation,
as this resides in a commonly included header file.

This brings xform_tcp.c into line with possible future OCF related imports.

Add support for allowing IPv4 multicast groups to be joined on IPv6 sockets,
as a number of applications began to rely on this over the years, despite it
only ever having been a convenience which appeared in Solaris & Linux over
the course of the 00s decade. It is limited to any-source joins (ASM).

To avoid further quibbling over the meaning of the term "undocumented" as it
applies to this change, I have chosen to use the wording "non-IETF-ratified
extension" in comments, with reference to the updated ip6(4) man page.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246

Comment updated only. No functional change.

It is unrealistic to expect that this feature will ever be resurrected from
the legacy KAME tree, given historical divergence, and that applications
which really need to consume all group state (e.g. proxies) will either
join on a per-group basis, or use link-layer mechanisms anyway. It was also
very poorly documented to begin with.

1. EFAULT was happening because sooptcopyin() from inp_join_group() was
seeing the user-space thread descriptor in the faked-up sockopt. So, do
not attempt a user copyin(); defer to C99 initialization nulling sopt_td
for us to force a KVA memcpy().

2. It seems necessary to byte-swap ipv6mr_multiaddr.s6_addr32[3] on amd64
for similar reasons as to how the user-space initialization needed for
passing an IPv4-mapped group address also requires byte-swapping of the
0x0000FFFF field for s6_addr32[2]; it is a direct assignment to a integer
member of a struct, NOT a memcpy().

3. The assignment to imr_interface within in6_v6_mreq_to_v4() was obfuscated
by a cast back to its own type due to use of the IA_SIN() macro. Elided.

With this change, the feature gap seems to be closed; tested with a simple
link-scope IPv4 group under 224.0.0.0/24 with an mlx5(4) SR-IOV VF in bhyve.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision:  https://reviews.freebsd.org/D58590

cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296838
MFC after:      4 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58377

pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297220
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

The SIOCGETSGCNT handler may be invoked in this scenario, and if no
router has initialized the lookup table, we'll have
mfct->mfchashtbl == NULL.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297148
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

This should assist setups that connect a lot of nodes to ipfw: and then
distribute traffic with ipfw(4) tablearg feature.

Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D58547

Update fwget(8) to download wifi-firmware-mt76-kmod-mt7921, and
wifi-firmware-mt76-kmod-mt7925 firmware packages instead of the
no longer available mt792x version.
Add another PCI vendor to recognize ITTIM IDs for mt7921-based
MediaTek cards.

(bz reduced the license in the ittim file to an SPDX tag and updated
the commit message, given this is only half the work from the review)

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57242

pmc: console configuration and table rendering for new PMC tools

Initializes the terminal rendering code used by the new pmc tools.  Then
provides a table abstraction for collecting, sorting and rendering
tables.  It provides pretty printed results with typed fields that print
several types used throughout the new PMC tools.  By default the fields
are formatted in engineering notation.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57775

pmc: new pmc log processing framework

View is a class for building PMC log processing tools it is designed to
work with the new PMC record command that adds a header with additional
CPU information.  The new framework processes PMC logs about 2.5 times
faster and in about half the code as libpmcstat.

Sponsored by: Netflix
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57776

pmc: pmc record command

The record command is designed around the idea of predefined studies.
While you can still select individual counters, the predefined studies
are meant to enable the best hardware options for a given generation.
It implements all of the base studies that I have built so far.

Sponsored by: Netflix
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57777

pmc: pmc info command

Prints the log header including machine, cpu and kernel details along
with what counters were selected.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57778

pmc: pmc frontend stall analysis based on IBS

The frontend command uses AMD IBS frontend events to analyze the major
sources of frontend stalls.  It displays a table breakind down the major
causes of front end stalls.  This is a simple demonstration of the tools
as you can use the filtering tools to limit the analysis to a subset of
the samples including filtering by fetch latencies.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57779

pmc: enable the new pmc commands

This change hooks everything up to the pmc command and improves the
usage to document all functions.  There are a couple older commands that
are currently broken that I have hidden from the usage, but left in the
code for those using it.  I won't remove those until we have our
replacements upstreamed that depend on the AMD PMC multiplexing patches.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57780

route(8): Add prefsrc option in netlink

Add prefsrc option that is frequently used on unnumbered interfaces
or L3 multi-homed network hosts.
This option uses RTA_PREFSRC.
Now you can add a static route by specifying the prefsrc option
with the loopback IP.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius
Differential Revision: https://reviews.freebsd.org/D58294

route(8): Add null check for prefsrc option

Reported by:    Shawn Webb <shawn.webb@hardenedbsd.org>, bms
Fixes:  https://cgit.freebsd.org/src/commit/?id=dd235f097af4 ("route(8): Add prefsrc option in netlink")

Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.

This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.

Reviewed by:    imp, jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57310

The need for this step is fading, now is mostly used to allow the
selection of just the two code partitions in the boot0 boot manager,
instead of the default of allowing all four MBR slices (the other two
being cfg and data, which cannot boot).

Reviewed by:    imp
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57311

The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel.  The driver should then fail to
respond to the ping and increment the input error counter on the
interface.

Approved by:    so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Reviewed by:  kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=561991144e42 ("Remove Obj_Entry textsize member.")
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D58522

 - When cached response is available, actually use xid from one
instead of using its byte-swapped value for BIOS and 1 for UEFI.
 - If cached response is not available, generate pseudo-random xid,
since use of a constant may cause conflicts if two systems are
booting same time, and server sends responses as broadcast.
 - When cached response is available, skip DHCP DISCOVER/OFFER
and just send REQUEST to the DHCP server from the cached response.
We could skip this phase too and just use the cached response, but
we don't know whether firmware requested all of DHCP options we'd
like to get.

Tested on amd64 Supermicro X11DPI-NT for both BIOS and EFI, with
and without cached response packet.

Implement netlink support for gre in ifconfig

Differential Revision: https://reviews.freebsd.org/D55366

Transaction ID should persist only between OFFER and the following
REQUEST.  In all other cases it should change.

This implementation does not cover tunnel addresses.

Differential Revision: https://reviews.freebsd.org/D57667

Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271910
Reported by:    Robert Morris
Reported by:    Décio Brandão (0xDBJ)
Reviewed by:    emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58554

Some drivers do this routinely, e.g., FreeBSD's tpm20 does this every
time it sends a command in tpmcrb_transmit().  This causes the console
to fill up with messages.  Instead, only print a warning if the cancel
bit is set to one.

Reviewed by:    corvink
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D52425

Commit 505222d35fea removed a batch of code that this goto used to skip
around.

Reviewed by:    olce, kib, markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=505222d35fea ("Implement the long-awaited module->file cache database.  A userland tool (kldxref(8)) keeps a cache of what modules and versions are inside what .ko files.  I have tested this on both Alpha and i386.")
Differential Revision:  https://reviews.freebsd.org/D58539

Previously all the 'goto out' statements after the image was loaded into
memory returned success rather than an error.  This is despite comments
indicating some of these conditions were in fact errors, and some of
these error conditions (such as missing PT_DYNAMIC) are treated as errors
in the kernel linker.

In addition, when failing to looking up the symbols for the linker
set, those cases returned failure leaking memory (though it's clear
from the original code from commit ca49b3342d1e that only the second
failure was intended to be an actual error).

To avoid more confusion, move the assignment of `ret` to just before
the `out` label so that `goto out` always returns an error.  This is a
more consistent pattern with other code in the tree that tends to use
labels for the error case.

Restructure some other code to avoid a few bogus errors.
Specifically, a symbol table is not required so don't treat lack of a
symbol table as an error.  Also, if the start symbol for the module
metadata linker set is not found, don't treat that as an error either.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58540

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.  The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58541

Reviewed by:  jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58543

Pass a single module name to load_kld for kbdmux and vkbd, allowing
bthidd_prestart to load both modules successfully.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cfe1962a1925 (rc: Fix improper use of load_kld)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Allowing nuageinit user scripts to run before these makes it possible to
customize official BASIC-CI and BASIC-CLOUDINIT FreeBSD images.

This was requested by KDE for their CI.

Approved by:    cperciva
Pull-Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/60

Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have.  Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.

Reported by:    Joshua Rogers <joshua@joshua.hu>
Tested by:      Décio Brandão (0xDBJ)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58555

This is in lieu of a full Kyua/ATF regression test, as this is an optional
feature that was beyond the scope of IETF's normative references for IPv6
multicast; support has been strictly on a best-effort basis.

Two new commands are added to mtest(8):
u mcast-addr ifname - join IPv4-mapped group on IPv6 socket
v mcast-addr ifname - leave IPv4-mapped group on IPv6 socket

Add an internal helper function __in6_v4_to_v4mapped() to perform the
converse of the IN6_IS_ADDR_V4MAPPED() check to support this use case.
Whilst __in6_v4_to_v4mapped() returns its first argument as a convenience,
avoid the temptation to dereference a pointer to that which we already hold.

Strictly the use of sockunion_t within mtest(8) more generally is a form
of controlled type punning (aliasing). Use a temporary as we overwrite
contents of su; the resultant write would overlap memory locations.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision: https://reviews.freebsd.org/D58589

Fixes:                https://cgit.freebsd.org/src/commit/?id=7e2f38311e62 ("rtld-elf/rtld.c: apply clang-format")
Sponsored by:   Innovate UK

Replace <sysdecode.h> with "sysdecode.h" so local builds use the in-tree header
in lib/libsysdecode instead of a stale installed copy in /usr/include, avoiding
build failures after updating sysdecode.h.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2338

Change sysdecode_nlm_flag() to decode Netlink message flags as a
bitmask instead of looking up a single flag value. This correctly
prints combinations of NLM_F_* flags while preserving any unknown
bits in hexadecimal.

Reported by:    androvonx95 <androvonx95@tutamail.com>
Reviewed by:    kp
Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

libfetch: Fix handling of connection failures

After commit 848f360c8f9a, if one tries to connect to a closed port,
fetch reports "Operation now in progress", which is rather confusing.
Return a more useful error message, restoring the old behaviour.

Fixes:          https://cgit.freebsd.org/src/commit/?id=848f360c8f9a ("libfetch: Apply timeout to connection attempts")
Reviewed by:    des
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58481

libfetch: Further improve connection polling

* Reorganize the connection loop to make it a little more readable

* Start the timeout clock earlier

* Correctly calculate the poll timeout before calling poll()

* Don't leak the socket on failure

Fixes:          https://cgit.freebsd.org/src/commit/?id=848f360c8f9a ("libfetch: Apply timeout to connection attempts")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b02e02958dad ("libfetch: Fix handling of connection failures")
MFC after:      3 days
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58512

Some NLM_F_ definitions contain multiple underscores in their name; this
should pick them up.

Reviewed by:    kp, Ishan Agrawal <iagrawal9990@gmail.com>
Fixes:  https://cgit.freebsd.org/src/commit/?id=4c932a4d45fb ("netlink: decode netlink message flags symbolically")
Sponsored by:   The FreeBSD Foundation
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2340

Reviewed by:  jrtc27
Differential Revision:  https://reviews.freebsd.org/D58558

stdio: *memstream: slightly streamline growth function

Inverting the condition after realloc*() is a minor cleanup, but makes
the success path a little cleaner to ease a future change.

Reviewed by:    des, jhb
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57353

stdio: *memstream: decouple the buffer size from the stream length

It's useful to be able to track both facts with a single variable, but
it also makes it more difficult to change how the buffer size scales.

As an example, Apple's implementation seems to scale the buffer size by
1.5x on growth, presumably in an attempt to reduce trips into realloc().
This might be questionable in the face of stdio buffering, but avoiding
serious churn in the line- or un-buffered case is a net positive if
doing so isn't incredibly invasive.

Reviewed by:    des, jhb, obiwac
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57354

stdio: *memstream: grow the buffer by 1.5x on write

This improves performance by reducing the number of allocations as we
write into the memstream, both in the fully buffered case with larger
memstreams and also more trivially in the line- and un-buffered case as
they flush back to the underlying buffer more often.

The inspiration for this was taken from Apple's implementation in
https://github.com/apple-oss-distributions/libc, but expanded to include
wmemstream for consistency.  I've added a test for the bug that I hit in
libder that caused me to notice this in the first place, and fixed that
bug in this version.

Reviewed by:    des, jhb (both slightly previous version)
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57355

stringf.cc uses errno and related macros without including <cerrno>.

Their availability is guaranteed only when the corresponding header
is included; transitive exposure is implementation-defined.

Modern libc++ has been progressively reducing incidental transitive
includes as part of its header removal policy (see LLVM libc++ Header
Removal Policy and D132284), making such dependencies brittle.

This change includes <cerrno> explicitly to make the dependency
well-defined. No functional or behavioural change intended.

Approved by:    fuz
Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2188

Currently mergesort() uses ICOPY_*() to copy data as four byte blocks
instead of one byte. However, this is only achievable when both size and
base arguments are aligned to four bytes.

Use of memcpy() is ideal as 1) it is cleaner and 2) the library will use
SIMD for copying when the hardware supports it. Compared to ICOPY_*(),
SIMD can support up to 64 bytes. When the SIMD-backed memcpy() find the
address is unaligned, it can first copy data up to the nearest aligned
address, and then use SIMD operations for faster transfer. Thus memcpy()
can give better performance than mergesort()'s own implementation.

This is benchmarked on amd64 where there isn't a SIMD-backed
implementation yet. However, the baseline implementation in assembly
already delivers better performance in unaligned cases although there is
some performance drops in aligned cases. The benchmark results and
script is available in the Phabricator review. Ideally, more performance
improvements will come when amd64 gets SIMD implementation of memcpy().

Signed-off-by:  Minsoo Choo <minsoochoo0122@proton.me>
Reviewed by:    fuz
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58002

This commit implements the inverse half-cycle
trigonometric functions:

   asinpi(x) = asin(x) / pi                        Eq. (1)
   acospi(x) = acos(x) / pi
   atanpi(x) = atan(x) / pi

Implemention details are contained in src/s_asinpi.c and
src/a_atanpi.c, where the details for acospi(x) appear in
the former.

*************

CAVEAT EMPTOR: The ld128 code has been only compiled.  It has
not been tested for correctness due to lack of hardware.

*************

Code compiled on AMD Ryzen 7 7700X system run FreeBSD 16.0-CURRENT
main-n284956-de9fe28ab847.

Exhaustive testing of acospif(x), asinpif(x), and atanpif(x)
on the indicated intervals yields

% ./tlibm acospi -fPE -x 0x1p-120 -X 1
Interval tested for acospif: [7.52316e-37,1]
      ulp <= 0.5: 99.627% 1002878299 |  99.627% 1002878299
0.5 < ulp <= 0.6:  0.277%    2789599 |  99.904% 1005667898
0.6 < ulp <= 0.7:  0.096%     965062 | 100.000% 1006632960
Max ulp: 0.63661975 at 5.96046412e-08 0x1.fffffep-25

% ./tlibm asinpi -fPED -x 0x1p-120f -X 1.f
Interval tested for asinpif: [7.52316e-37,1]
      ulp <= 0.5: 99.851% 1005129353 |  99.851% 1005129353
0.5 < ulp <= 0.6:  0.149%    1501097 | 100.000% 1006630450
0.6 < ulp <= 0.7:  0.000%       2510 | 100.000% 1006632960
Max ulp: 0.68957579 at 5.04878759e-01 0x1.027f78p-1

% ./tlibm atanpi -fPE -x 0x1p-120 -X max > zatanpif.txt &
Interval tested for atanpif: [7.52316e-37,3.40282e+38]
      ulp <= 0.5: 99.865% 2077574602 |  99.865% 2077574602
0.5 < ulp <= 0.6:  0.131%    2735011 |  99.997% 2080309613
0.6 < ulp <= 0.7:  0.003%      65170 | 100.000% 2080374783
Max ulp: 0.68433094 at 5.01186252e-01 0x1.009b7cp-1

Testing the double and long double version cannot be done
in an exhaustive manner.  For 300 M values, uniformily
distributed in the indicated interals, one finds the max ULP:

Interval tested for acospi: [9.31323e-10,0.25]
  xm =  2.4423788416892520e-01, /* 0x3fcf432f, 0xde79920f */
libm =  4.2146222480005391e-01, /* 0x3fdaf93c, 0xb201001c */
mpfr =  4.2146222480005396e-01, /* 0x3fdaf93c, 0xb201001d */
 ULP = 0.50499351466286857

Interval tested for acospi: [0.25,0.5]
  xm =  4.9689430915631438e-01, /* 0x3fdfcd1d, 0xc9d945c6 */
libm =  3.3447366122373884e-01, /* 0x3fd56804, 0x371513ef */
mpfr =  3.3447366122373889e-01, /* 0x3fd56804, 0x371513f0 */
 ULP = 0.57195275455053829

Interval tested for acospi: [0.5,0.75]
  xm =  5.0238623667462079e-01, /* 0x3fe0138c, 0x4d0f4be0 */
libm =  3.3245556599062825e-01, /* 0x3fd546f3, 0xb5d36303 */
mpfr =  3.3245556599062820e-01, /* 0x3fd546f3, 0xb5d36302 */
 ULP = 0.63427929243758807

Interval tested for acospi: [0.75,1]
  xm =  7.5853651919512177e-01, /* 0x3fe845ee, 0x60d8789f */
libm =  2.2591472240382732e-01, /* 0x3fcceac6, 0x0c3465ce */
mpfr =  2.2591472240382729e-01, /* 0x3fcceac6, 0x0c3465cd */
 ULP = 0.56915750216472161

Interval tested for asinpi: [9.31323e-10,0.25]
  xm =  1.9502362835488171e-01, /* 0x3fc8f688, 0xc4dda0fb */
libm =  6.2478354989018887e-02, /* 0x3faffd29, 0xb6c57c61 */
mpfr =  6.2478354989018881e-02, /* 0x3faffd29, 0xb6c57c60 */
 ULP = 0.52347765415885006

Interval tested for asinpi: [0.25,0.5]
  xm =  4.9937103583123676e-01, /* 0x3fdff5b1, 0xeeddbf62 */
libm =  1.6643553767987129e-01, /* 0x3fc54dc2, 0x7b9d15a4 */
mpfr =  1.6643553767987126e-01, /* 0x3fc54dc2, 0x7b9d15a3 */
 ULP = 0.66214688371031072

Interval tested for asinpi: [0.5,0.75]
  xm =  5.0228515250761718e-01, /* 0x3fe012b8, 0x4fe92bbb */
libm =  1.6750722213679006e-01, /* 0x3fc570e0, 0x6c75edd5 */
mpfr =  1.6750722213679009e-01, /* 0x3fc570e0, 0x6c75edd6 */
 ULP = 0.78223048105528226

Interval tested for asinpi: [0.75,1]
  xm =  7.5425933001419776e-01, /* 0x3fe822e4, 0x7663a4aa */
libm =  2.7200385380185182e-01, /* 0x3fd16882, 0xda1dc13b */
mpfr =  2.7200385380185188e-01, /* 0x3fd16882, 0xda1dc13c */
 ULP = 0.53747973176773822

Interval tested for atanpi: [9.31323e-10,0.25]
  xm =  1.9666113418757322e-01, /* 0x3fc92c31, 0x29dd6d2f */
libm =  6.1810387818117797e-02, /* 0x3fafa59c, 0x7476baa5 */
mpfr =  6.1810387818117804e-02, /* 0x3fafa59c, 0x7476baa6 */
 ULP = 0.54674297446584263

Interval tested for atanpi: [0.25,0.5]
  xm =  4.1312119637707068e-01, /* 0x3fda7093, 0xe2ee5494 */
libm =  1.2470309560460152e-01, /* 0x3fbfec8a, 0xc554ebec */
mpfr =  1.2470309560460154e-01, /* 0x3fbfec8a, 0xc554ebed */
 ULP = 0.73116638175113347

Interval tested for atanpi: [0.5,0.75]
  xm =  5.0018949583396499e-01, /* 0x3fe0018d, 0x66cd1b82 */
libm =  1.4763186871058706e-01, /* 0x3fc2e599, 0xdffacb8f */
mpfr =  1.4763186871058709e-01, /* 0x3fc2e599, 0xdffacb90 */
 ULP = 0.69192753950764663

Interval tested for atanpi: [0.75,1]
  xm =  7.5007880583359599e-01, /* 0x3fe800a5, 0x448f4c03 */
libm =  2.0484881828445453e-01, /* 0x3fca387c, 0x6f93f71f */
mpfr =  2.0484881828445450e-01, /* 0x3fca387c, 0x6f93f71e */
 ULP = 0.65765471872064396

Interval tested for atanpi: [1,2]
  xm =  1.0103228000344093e+00, /* 0x3ff02a48, 0x3d88d0a2 */
libm =  2.5163447403817019e-01, /* 0x3fd01ac7, 0x7b229108 */
mpfr =  2.5163447403817013e-01, /* 0x3fd01ac7, 0x7b229107 */
 ULP = 0.67409519689166042

Interval tested for atanpi: [2,4]
  xm =  2.0231383267437946e+00, /* 0x40002f63, 0x25a530a9 */
libm =  3.5387589538123299e-01, /* 0x3fd6a5e7, 0x156053c6 */
mpfr =  3.5387589538123293e-01, /* 0x3fd6a5e7, 0x156053c5 */
 ULP = 0.69695587476021503

Interval tested for atanpi: [4,1.79769e+308]
  xm =  4.0000000000000000e+00, /* 0x40100000, 0x00000000 */
libm =  4.2202086962263069e-01, /* 0x3fdb0263, 0xd2508e31 */
mpfr =  4.2202086962263069e-01, /* 0x3fdb0263, 0xd2508e31 */
 ULP = 0.27709400511686716

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295884
MFC after:      1 month
Reviewed by:    fuz

strfromd(), strfromf(), and strfroml() are implemented directly
in terms of gdtoa.  If a non-conforming format string is passed,
the string "EDOOFUS" is returned and errno set to EDOOFUS as an
extension.

Reviewed by:    fuz
MFC after:      1 month
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2301
Signed-off-by:  Faraz Vahedi <kfv@kfv.io>

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks getopt during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Since the pointed-to value is never modified, fix this by making
the pointer const.

MFC after:      1 week
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58488

Add an uncached sysctl based implementation which retrieves individual
categories.  A cache would be an obvious extension should this optional
feature that can only be enabled by an environmental varible have a
noticable performance impact in a case that matters.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58238

Unlike RFC5661 (the original NFSv4.1 RFC), RFC8881 specifies
that a NFS4ERR_DELAY reply to the SEQUENCE operation requires
a reply using the same slot/sequence#.

This patch fixes handling of this case, so it conforms to
RFC8881.

Reported by:    J. David (j.david.lists@gmail.com)
Tested by:      J. David (j.david.lists@gmail.com)
MFC after:      1 week

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

This matches the documented prototype and avoids spurious
-Wincompatible-pointer-types-discards-qualifiers warnings when passing
a constant pathname.

Sponsored by:   AFRL, DARPA

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297062
Tested by:      Jordan Gordeev <jgopensource@proton.me>
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58472

p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization.  However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status.  This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.

Close the race: explicitly copy the field under the proctree lock during
fork.

Reported by:    syzkaller
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58482

kqueue: Add a helper macro for sleeping on in-flux knotes

Other in-flux operations are implemented by this set of macros, so we
should do the same for sleeping.

No functional change intended.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58443

kqueue: Associate marker knotes with a queue

Otherwise the assertion in KQ_FLUX_SLEEP_WMESG may fail.

kqueue_fork_copy() already handles this.

Fixes:          https://cgit.freebsd.org/src/commit/?id=1f4b0ea4f3eb ("kqueue: Add a helper macro for sleeping on in-flux knotes")
Reported by:    syzkaller
Reported by:    kbowling
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58516

Otherwise an assertion in umtx_thread_alloc()
(TAILQ_EMPTY(&uq->uq_pi_contested)) is violated.

This use of TDB_EXIT is hacky, but I cannot see another way to check for
an exiting thread without adding some more overhead to kern_thr_exit().

Fixes:          https://cgit.freebsd.org/src/commit/?id=2a339d9e3dc1
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58447

MFC after:    1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.

proc_realparent(): assert that an orphaned child has real parent != parent

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58504

proc_realparent(): do not mark the child as orphan when reparenting to p_opptr pid

Reported and reviewed by:       markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=8cef3c9b768a ("proc_realparent(): assert that an orphaned child has real parent != parent")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58566

to avoid using uninitialized value in the KASSERT() statement on the first
iteration.

Also, do the assert under the proctree_lock, which is not critical but
satisfies the invariants.

Noted and reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58505

We reach ndaasync with the CAM device lock held, so we must pass
M_NOWAIT to disk_* rather than M_WAITOK.

Reviewed by:    imp
Fixes:  https://cgit.freebsd.org/src/commit/?id=628d7a3270b6 ("nda: AC_GETDEV_CHANGED calls media chanaged for sectorsize change")
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58230

Reviewed by:  jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58477

There are probably more places which could benefit from allowing to
interrupt vfs_busy() calls at syscalls top level.

Requested by:   Peter Eriksson <pen@lysator.liu.se>
Reviewed by:    jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58477

Otherwise we'll print an error but carry on regardless, presumably
destined to walk off the end of the mapping.

Reported by:    thebugfixers@pm.me
MFC after:      1 week

knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished.  In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue().  Guard
against this.

Add a test case which triggers the race.

Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
  inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues.  They cannot be safely copied into the
  child without more work, as kqueues are inherently local to a process;
  on fork, we need to ensure that such knotes are patched to reference
  the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
  while copying.

Approved by:    so
Security:       FreeBSD-SA-26:50.kqueue
Security:       CVE-2026-58083
Reviewed by:    kib
Reported by:    Hazley Samsudin of GovTech CSG
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58223

Approved by:  so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them.  This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.

Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.

Approved by:    so
Security:       FreeBSD-SA-26:53.ktrace
Security:       CVE-2026-58086
Fixes:          https://cgit.freebsd.org/src/commit/?id=4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
Reviewed by:    markj
Assisted-by:    Claude Code (Fable 5)

These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock.  A comment explains why this is (probably) safe.  Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped.  This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.

Replace the assertions with runtime checks.

Approved by:    so
Security:       FreeBSD-SA-26:54.sysvsem
Security:       CVE-2026-58087
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58421

In an ELF coredump, each dumped vm_map_entry is represented by a
segment.  __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.

each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls.  If the map is shared with another
process, via rfork(), then the map can change.  cb_put_phdr() did not
account for this, and so could write out of bounds.

Add a check to prevent this; simply do not write out excess segments.

Approved by:    so
Security:       FreeBSD-SA-26:55.elf
Security:       CVE-2026-58088
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58416

Reviewed by:  kib
Obtained from:  Linux commit d41861942fc55c14b6280d9568a0d0112037f065
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D57952

Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296498
Fixes:          https://cgit.freebsd.org/src/commit/?id=3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by:    gallatin, jhb
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57557

Reported by:  Nick Price
Tested by:      pho
Reviewed by:    jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58506

Commit f2202ab5abda did not account for  KTLS mbufs.

m_unshare() tries to linearize the original mbuf chain and creates a
writable copy of it, converting unmapped mbufs.  Both of them are
unsafe for KTLS mbufs.

It is better to return NULL if the mbuf chain contains a KTLS mbuf.

Reported by:    jhb
Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D58466

Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab.  Try to overcome this by adjusting the allocation size to
include a redzone following the object.

With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic.  Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.

Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well.  It
might be worthwhile to provide a stronger guarantee here.

Add an assertion to item_ctor() that the returned item is properly
aligned.  I couldn't see any pre-existing checks which verify this.

Reviewed by:    rlibby
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58271

malloc: Refactor redzone and sanitizer handling

malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset().  Refactor the
implementations to reduce this a bit.

Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.

Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58272

uma: Fix KMSAN integration with malloc zones

In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
basis that UMA and kmem_malloc() would handle updates of the KMSAN
shadow map.  However, I missed that UMA explicitly does not handle this.

Modify UMA to only omit origin map updates for malloc zones.

Fixes:          https://cgit.freebsd.org/src/commit/?id=459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
Reviewed by:    rlibby
Differential Revision:  https://reviews.freebsd.org/D58574

We should of course pass the provided domainset rather than copying what
plain malloc() does.

Fixes:          https://cgit.freebsd.org/src/commit/?id=89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58316

kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.

A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58536
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296835
MFC after: 1 week

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.

Reported by:    Jane Smith <thebugfixers@pm.me> (via D57785)
Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58542

This just invokes xa_insert similar to other xa_*_irq wrappers.

Reviewed by:    bz
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D58576

If boot_mute is set the system appears to hang during the mountroot
prompt. Temporarily unmute the console so the prompt is visible.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58549

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58407

Instead of accessing the struct proc and gathering data from it,
memoize the data needed for pdwait() on exited process in struct
procdesc, at the time of process termination.

This allows unlimited number of calls to pdwait(2) on procdesc for
terminated process.

Change the locking requirements for pd_flags to proctree_lock. This does
not modify the pre-patch locking regime, but the change requires it.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58407

Add the p_zombieref bitmask into struct proc, which enumerates all
legitimate waiters on the process exit status. Among them are parent
for PZOMBIEREF_PARENT, and the holder of the process descriptor for
PZOMBIEREF_PROCDESC, if the process was created by pdfork().

Require all zombie refs to be cleared to reap zombie. This prevents
stealing the exit status from the parent by pdwait()ing on a procdesc
obtained by pdopenpid(), or by waitpid() by debugger from the real
parent.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58264

Reimplement atomic_{set,clear}_16 using atomic_set_32.

Remove emulation of these operations from vm_page.c.

Reviewed by:    alc, kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58580

sbuf reserves a byte of its buffer for the terminator, so the sbuf
created with maxlen held one byte less than the sizing pass had
computed.  The last record overflowed it, sbuf_bcat() failed, and the
error == 0 guard skipped the copy into the caller's sbuf, so the note
has been emitted at full size but zero filled since 5e7c43ff02dc.

Fixes: https://cgit.freebsd.org/src/commit/?id=5e7c43ff02dc

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58583
MFC after: 1 week

kern_proc_kqueues_out() sized its intermediate sbuf from the preceding
sizing pass, so dumping core for a process with many knotes wired a
buffer as large as the entire report.

Shrank the intermediate to one page and added a drain that copied into
the caller's sbuf up to maxlen, stopping the walk once it was reached.
Truncation stayed byte exact.
A dump of 384k knotes peaked at 20 KB of M_SBUF instead of 445 MB.

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58584
MFC after: 1 week

The "add missing GIDs" loop uses rdma_find_gid_by_port() to test whether
a GID already exists, but forgets to drop the reference it returns. So
every rescan that finds an existing GID leaks one, which pins the entry
and prevents its slot from ever being freed on delete.
Just release the reference once the GID is found, like the "remove stale
GIDs" loop already does.

Reported by:  Wafa Hamzah <wafah@nvidia.com>
Reviewed by:  kib, jhb
Sponsored by: Nvidia networking
Fixes:        https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential revision: https://reviews.freebsd.org/D58511

When cleaning up stale GIDs the scan stopped as soon as
rdma_get_gid_attr() failed. But that can also happen for empty entries
in the middle of the table, so a single gap left everything after it
behind and the GID entries could eventually run out.

Now the whole table is scanned and the empty slots are simply skipped.

Reviewed by:  kib, jhb
Sponsored by: Nvidia networking
Fixes:        https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential revision: https://reviews.freebsd.org/D58510

Make it possible to define categories without compiling their
paths into libc (important for third-party modules).  The
EXTERR_CATEGORY_DYNAMIC macro can be defined to a string describing the
compilation unit (generally the path relative to src/sys) which takes
the place of EXTERR_CATEGORY.

These strings are assembled in linker sets with category numbers
assigned at system startup or module load time.  The strings can be
retrieved from the kern.exterr.categories.<category> sysctl.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58237

Commit 1876de606eb8 exposed missing symbols that the port security/krb5
installed that the base system did not install. Part of the solution
was to make libprofile.so private (not libprofile.a) just as the port
does, Red Hat Enterprise Linux does, and as installing MIT KRB5 by hand
does. The actual fix for this was to put symbols and their corresponding
functions into the correct librarires, i.e. libkrb5.so and othes, just
as the port, Red Hat, and manually installed via tarball do.

Unfortunately INTERNALLIB disables the include of bsd.incs.mk and the
install of header files. This is still needed to install profile.h into
/usr/include (just as the port installs it into ${LOCALBASE}/include
and RHEL installs it in /usr/include). This commit fixes this by
installing profile.h into /usr/include from the krb5/include Makfile.

Reported by:    fluffy
Tested by:      fluffy
Reviewed by:    fluffy
Fixes:          https://cgit.freebsd.org/src/commit/?id=1876de606eb8
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58286

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

We used to pass CONFIGURE_ARGS to the make command which builds pkg,
but ports/ports-mgmt/pkg/Makefile has its own CONFIGURE_ARGS and the
version we were providing at the command line didn't contain the
--mandir setting which was added to the port with pkg 2.8.0.  This
broke release builds.

Instead of passing --prefix=${LOCALBASE} via CONFIGURE_ARGS, pass
PREFIX=${LOCALBASE}; the port Makefile passes that value through to
its configure script.  We also used to pass a --host parameter, but
that seems to have become unnecessary at some point in the past decade.

MFC after:      1 day
Sponsored by:   Amazon

This module has several source files, with many conditional on the
platform architecture. Make it easier to read, and better for future
diffs against these lists.

- Convert to one SRC per line
- Simplify arm/armv7 condition
- Remove now-empty header comment
- Minor formatting

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D58531

Document supported controllers, PF and VF naming, PCI_IOV and IOMMU
requirements, queue and lifecycle constraints, iovctl schema, filtering
and anti-spoof policy, mailbox and MDD recovery, shared hardware
limits, rate control, and statistics cadence.

Relnotes:       yes
Sponsored by:   BBOX.io

- Make it work even when git arc isn't run from the root of the repo.
- If the patch fails to apply, let git partially apply the patch and
  generate rej files for inspection.

While here, remove the return value from apply_rev(), it's never
actually used.

Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D58532

Reviewed by:  markj
Differential Revision: https://reviews.freebsd.org/D58515

Somehow a few commits ended up with "null" appended to Nick's name and
email address.

Reviewed by:    Nick Price <nick@spun.io>
Differential Revision: https://reviews.freebsd.org/D58517

Instead of making the user run the underlying git-cherry-pick command
after a conflict.

Requested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58514

Completed steps 5-6 and 10 in the committer's guide.

Reviewed by:    jhb
Approved by:    jhb (mentor)
Differential Revision:  https://reviews.freebsd.org/D58507

pwait: Test the new -r option

Test that pwait without -r reports a process as soon as it terminates,
while pwait with -r does not report it until it has been reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58385

pwait: Fix pwait_normal test case

Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=e115066370dc ("pwait: Test the new -r option")

Add tests for both IPv4 and IPv6 routes with the prefsrc attribute.
Also test IPv4 routes over IPv6 nexthops and borrow their IPv4
addresses from the loopback interface.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58326

The child exited immediately after pdfork(), so the parent's pdopenpid() could
catch it mid-exit (P_WEXIT) and fail with EBUSY.
Block the child on a pipe until the parent has opened the second descriptor,
then release it

Approved by:    markj
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58546

Add a regression test for gre(4)
to make sure all of the gre capabilities and options are
working as intended.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D55363

Some of the preadv() and readv() tests were not initializing the iovecs
they pass to the system call.  When the system call is expected to fail,
that's fine since the FORTIFY_SOURCE checks cause the process to be
aborted.  However, in the rest of the test cases, the (p)readv() call
could cause spurious test failures, e.g., when an uninitialized iov
entry points to the current stack frame and the canary gets overwritten.

Modify the tests to explicitly initialize iov entries to avoid this.
The "iov" variants don't have this problem, so leave them alone.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58289

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58530

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58569

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Also use bool for the 'cancel' argument for cond_wait_common().

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Show nhop flags like invalid nexthop to debug cases like
the PR below.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296883
Reviewed by:    glebius
Differential Revision: https://reviews.freebsd.org/D58347

Update the mt76/zzz_fw_ports_fwget.sh script to set fwget to download
mt7921 and mt7925 rather than the these days non-existent mt792x flavor.

Sponsored by:   The FreeBSD Foundation
MFC after:      30 days
Differential Revision: https://reviews.freebsd.org/D57242

Reviewed by:  markj, ngie
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58458

  [NFC][ELF][PPC64] Pass address not offset to writePPC64LoadAndBranch (#212275)

  Every caller currently subtracts the TOC base in its argument, so move
  that into common code inside writePPC64LoadAndBranch. This will also
  allow a different computation to be used in some cases in a future
  commit.

  Note that offset is now unsigned not signed; even previously, all
  arguments were uint64_t, and all uses are unsigned, so making it signed
  doesn't make much sense.

MFC after:      1 week

  [ELF][PowerPC] Don't assume TOC pointer is valid in IPLT entries (#207555)

  Unlike normal PLT entries, IPLT entries can be called indirectly even
  when in PIEs/DSOs, and so there's no guarantee on what's in the TOC
  pointer register at that time. Therefore we must emit variants of the
  existing code that work without it, whether r12-relative (playing the
  same role as MIPS's $25) in the same number of instructions, or first
  retrieving PC in an i386-like manner, being careful not to clobber LR.
  On 32-bit PowerPC even direct calls to IPLT entries face the same issue,
  since we'd use the TOC base of the resolver, which may not be the same
  as the caller, even within the same object.

  Normal canonical PLTs still look broken on 64-bit PowerPC as they use
  the TOC pointer register too, and similarly on 32-bit PowerPC for PIEs.
  We should probably treat these cases the same as PIE on i386 (except
  including PDEs for 64-bit PowerPC), where it's an error due to the use
  of %ebx in PLT entries.

Bump LLD_FREEBSD_VERSION for this fix as otherwise an existing system
linker will be deemed new enough to use and produce broken kernels for
TARGET=powerpc (regardless of TARGET_ARCH/MACHINE/MACHINE_ARCH) builds.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294369
MFC after:      1 week

  [libunwind][PPC64] Fix unw_getcontext corrupting callee-saved VSX registers on LE (#198371)

  This is the first of two independent fixes for libunwind on ppc64le
  (ELFv2 ABI, little-endian), where two separate bugs together cause
  SIGSEGV during backtracing. This commit addresses the VSX register
  corruption; the TOC-restore fault is handled in a follow-up. Both
  were discovered while debugging lang/rust build failures with
  RUST_BACKTRACE=1 on FreeBSD/powerpc64le (IBM POWER9).

  On ppc64le, `unw_getcontext` saves each VS register with an in-place
  `xxswapd n, n` followed by `stxvd2x`. The swap is needed because
  `stxvd2x` stores doublewords in the wrong order on LE. However, the
  macro never applies a second `xxswapd` to restore the register after
  the store, so all 64 VS registers are permanently corrupted on return
  from `unw_getcontext`.

  This affects every callee-saved VSX register: f14-f31 (VSR14-VSR31)
  and VR20-VR31 (VSR52-VSR63). After `_Unwind_Backtrace` returns, any
  code that uses these registers sees wrong values. In practice this
  manifests as SIGSEGV inside hashbrown's `reserve_rehash`: VR20-VR31
  are corrupted before a SIMD comparison loop runs, producing an
  out-of-bounds access.

  Fix: add a second `xxswapd n, n` after the `stxvd2x` store. Since
  `xxswapd` is its own inverse, the pair is a no-op on the architectural
  register while still writing the correctly byte-swapped value to memory.

MFC after:      1 week

libarchive 3.8.9

ChangeLog:
https://github.com/libarchive/libarchive/compare/v3.8.7...v3.8.9

Obtained from:  libarchive
Vendor commit:  27cbc7827172698143e440801fc0ba39ccb4f1f5
MFC after:      2 weeks

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks libucl during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Instead of assigning directly to params->prefix (which is const),
use a non-const temporary variable and assign the result after
we've done the modification.

MFC after:      1 week
Reviewed by:    bofh, bapt
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58490

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks mandoc during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

In read.c, make the existing temporary pointer const, and for the
mandoc_asprintf() call, add a new mutable local.

In mdoc.c and out.c, since the data is mutable and is mutated here,
remove const from the temporary pointers.

MFC after:      1 week
Reviewed by:    fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58495

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks libelftc during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Since the returned pointer is never modified in either case, make
it const.

MFC after:      1 week
Reviewed by:    jkoshy, markj, dim, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58497

tests/ktls: merge two sysctl checking helpers into one

No functional change.

Revert "tests/ktls: merge two sysctl checking helpers into one"

With certain sysctl configuration the test will fail.

This reverts commit 801c0f383c0a719165c21ff5c29f231fb7b920c4.