FreeBSD git weekly: 2026-08-10 to 2026-08-16

Add access and trunk VLAN policy to the SR-IOV schema.  Access VFs
use a hardware PVID and cannot alter their VLAN membership.  Trunk VFs
may register up to 16 VLANs, while VLAN 0 remains implicitly admitted
for untagged and priority-tagged traffic.

Enable hardware VLAN anti-spoofing and maintain the MAC-by-VLAN filter
cross-product used by DPDK.  Apply Linux's untrusted-VF limits of 18 MAC
addresses and 16 VLANs so one guest cannot consume the shared PF filter
table without bound.

Report the effective policy through the VF status interface and document
the iovctl schema.

MFC after:      2 weeks
Relnotes:       yes

10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber.  Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.

When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence.  Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.

MFC after:      2 weeks
Relnotes:       yes

The bhyve_config(5) variable `virtio_msix` is namescoped to
`virtio.msix`. Configurations that have the old variable will
automatically be mapped to the new one, with a warning message printed
out.

Relnotes:       yes
Reviewed by:    ziaee, markj
Differential Revision:  https://reviews.freebsd.org/D58390

Reviewed by:  manu, adrian
Differential Revision:  https://reviews.freebsd.org/D58798

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296234(exp-run)
Relnotes:       yes
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57772

E610 inherits the X550-family virtualization registers, anti-spoofing
controls, and malicious-driver operations, but the frontend does not
advertise SR-IOV and cannot negotiate the mailbox revision needed by
E610 VFs.

Initialize the X550-family PF/VF mailbox registers for E610 and use
PFVFLREC for its VF reset events, following DPDK shared ixgbe code.
Advertise the E610 SR-IOV capability, accept API 1.6 only on E610, carry
the existing xcast and queue operations forward to that revision, and
return the cached physical link speed and state with the three-dword
E610 operation.  Unsupported RSS and optional feature requests continue
to receive explicit failures.

SR-IOV activation also enables the existing X550-derived per-pool MDD
recovery path on E610.  Document the expanded protection and link-state
coverage.

Hardware validation created 63 VFs and rejected a 64th without flapping
the running PF.  Invalid TX and RX descriptor DMA independently asserted
the offender's WQBR bit, gated only that VF, preserved sibling traffic,
and recovered after the VF reset.  FreeBSD ixv, FreeBSD DPDK, Linux
ixgbevf, and Linux DPDK exercised the PF mailbox and data paths.

MFC after:      2 weeks
Relnotes:       yes
Sponsored by:   Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by:   BBOX.io

The current default has been unchanged for 14 years.  Increase it to
keep pace with modern hardware and software.  security/pinentry-gnome,
in particular, can sometimes need 112 kB.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297452
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    cye, emaste
Differential Revision: https://reviews.freebsd.org/D58811

The shared em(4) manual page lists only the em device-node name.
Document the /dev/led/igb* name as well.

MFC after:      2 weeks

Reviewed by:  emaste
Discussed with: imp
Fixes:  https://cgit.freebsd.org/src/commit/?id=802c6d5d61d1 ("cdefs.h: Introduce __nonstring attribute")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58804

Reviewed by:  fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2288

MFC after:    3 days
Sponsored by:   fme AG

Document a few options that are currently supported but
not covered in bhyve_config(5):

 - monitor
 - vcpu.N.cpuset
 - domains.N.{size,cpus,domain_policy}
 - console (for arm64 and riscv)

MFC after:              1 week
Reviewed by:            bnovkov, jhb
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58399

As far as I can tell, racct(2) has never existed, not even when
I added these references a decade ago.

Change them as commit e9e615c88a74 did in thr_new(2).

Reported by:    Karlo Miličević <karlo98.m@gmail.com>

Do not duplicate the documentation already available
through "sysctl -d", but tell the user where to find it.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257984
Suggested by:   Felix Johnson <felix.the.red@gmail.com>

The eXpat project has changed maintainers since this section was written
in 2002.  Update it to reflect reality.

Discussed with: Sebastian Pipping <sebastian@pipping.org>
Reviewed by:    bcr
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58835

A failed VF reset or mailbox API negotiation currently returns from
the void ifdi_init callback. Iflib then marks the interface running
even though ixv left its adapter stopped. Stopped media queries can
continue polling the PF, and no timer remains active to retry when the
PF returns.

Track mailbox readiness and report unsuccessful initialization to
iflib. Stopped admin and media-status passes now publish cached
link-down state without touching the mailbox. While the VF remains
administratively up, retry complete initialization after 250 ms, one
second, four seconds, and then at a capped eight-second interval.

Preserve the requested MAC across reset, then program it once after
mailbox API negotiation. The previous two pre-reset requests each
could wait a full mailbox timeout after an established PF disappeared,
holding the iflib context lock for about two seconds before the reset
handshake.

Avoid a redundant VF reset in the stop half of an immediate iflib
reinitialization. Also remove the stop-time RAR mailbox request: reset
has already discarded CTS at that point, and successful initialization
restores the current address. Retain a reset for an ordinary
administrative stop when the mailbox was established.

MFC after:      2 weeks

PSRTYPE is indexed by pool in VMDq+RSS mode, and its RQPL
field selects the number of receive queues available within the pool.
The PF occupies the last pool, but the driver programmed pool zero and
left the PF RQPL value at zero.  As a result, all PF receive traffic
was directed to its first queue while SR-IOV was enabled.

Program PSRTYPE for the PF pool and encode its allocated receive queue
count.

MFC after:      2 weeks

HWRM failures currently return from the void ifdi_init callback.
iflib then marks the interface running and enables interrupts despite an
incomplete ring or VNIC setup.

Move the hardware setup into an error-returning helper.  The ifdi_init
wrapper can report failure through iflib_init_failed(), while firmware
recovery can propagate the same error through bnxt_open().  Also clear
the initialized state after partial setup is torn down.

MFC after:      2 weeks

The primary and mirror-VSI ifdi_init callbacks can return early when
reset state or hardware queue and filter setup prevents initialization.
Iflib then marks the interface running and enables interrupts although
the driver did not finish bringing it up.

Report each non-detach failure through iflib_init_failed().  Keep the
existing ice reset and subinterface-reinitialization machinery
responsible for scheduling recovery.

MFC after:      2 weeks

The 82542-specific setup routine unconditionally reads the NVM
default, overwriting a flow-control mode selected by software.  It
also removes transmit PAUSE support from all 82542 revisions even
though the hardware restriction applies only to rev 2.0.

Resolve the NVM default only when requested, scope the transmit
restriction to rev 2.0, and replace integer bit masking of the enum
with explicit valid mode transitions.  This restores the behavior
from before the Intel shared-code split and resolves -Wassign-enum.

Reported by:    glebius
MFC after:      2 weeks

ufshci: fix data direction encoding for read commands

The data_direction field in the UTP Transfer Request Descriptor is only
2 bits wide ([26:25]). UFSHCI_DATA_DIRECTION_FROM_TGT_TO_SYS was defined
as 0x10, which truncates to 0b00 (No data transfer) when stored into the
2-bit field, so every read command was described to the controller as
having no data phase. Only writes (0b01) happened to be encoded
correctly.

Define all values as 2-bit binary literals, matching the existing
RESERVED = 0b11 entry, so read is encoded as 0b10 as required by the
specification.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58652

ufshci: abort submission when payload DMA mapping fails

When bus_dmamap_load_mem() failed, ufshci_req_queue_prepare_prdt()
manually completed and released the tracker, but its caller kept going:
it built the UTRD, set the slot back to SCHEDULED, and rang the
doorbell for a tracker whose request had already been freed. Return the
mapping error and stop the submission so the released tracker is not
resurrected.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58653

ufshci: fail attribute reads on a non-zero config result code

ufshci_uic_send_cmd() only logged the error code and returned success,
so a failed DME_GET gave its caller a stale value as if it were valid.
The gear and lane settings could then be programmed from that garbage.

Return ENXIO for reads instead. Writes keep logging and continuing,
because a device may reject an optional attribute and that must not
fail bring-up.

Sponsored by:           Samsung Electronics
Reviewed by             imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58654

ufshci: handle controller command submit failures

Return submission errors from the controller command helpers and
propagate them to polled callers before waiting for completion. Free
requests that never enter a hardware queue so failure paths do not leak
or panic after the poll timeout.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58655

ufshci: fix SCSI I/O request failure cleanup

ufshchi_sim_scsiio() did not check the M_NOWAIT request allocation
for NULL. The CDB validation and submit failure paths also returned
without freeing the request.

Fail the CCB when the allocation returns NULL. Free the request on
every failure path. Mark the CCB as queued right before the submit,
so the failure paths above do not need to touch that flag.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58656

ufshci: free the lookup path when the periph search times out

ufshci_sim_find_periph() freed the lookup path only when it found the
periph. The timeout path returned without freeing it and leaked the
path. Free the path at the single exit instead.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58657

ufshci: fix WLUN periph reference counting

The driver stored the WLUN periph pointer without holding a reference,
so the pointer went stale when the pass(4) device went away. In
addition, ufshci_sim_send_ssu() released a reference that it had never
acquired.

Define a simple ownership rule. ufshci_sim_find_periph() acquires the
periph and returns it. The cache owns one reference. The controller
destructor drops it with cam_periph_release() before taking the SIM
lock, since the release takes the CAM device lock by itself.
ufshci_sim_send_ssu() acquires its own reference and releases it when
done. Reuse the cached periph instead of searching again, so the old
reference is not leaked.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58658

ufshci: free the correct address when DMA load fails

The bus_dmamap_load() error paths passed hwq->utrd and req_queue->ucd
to bus_dmamem_free(), but both pointers are only assigned after a
successful load and are still NULL at that point. The freshly
allocated memory was leaked. Free the local buffer instead.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58659

ufshci: tolerate partially constructed queues in SDB teardown

When attach fails, ufshci_req_sdb_destroy() runs on a partially
constructed queue, and it runs twice: once from the construct error
path and once from the controller destructor.

Make that safe: NULL-check each resource before freeing it and clear
the pointer afterwards, so a second call finds nothing to do. The
construct error label no longer frees the command descriptors itself,
which fixes a double free of ucd_bus_addr. Also destroy the payload
DMA tag, which was previously leaked. Drop the mtx_initialized()
checks: the locks are always set up before any failure path can reach
the destroy.

Attach can also fail before the queues were constructed at all. The
destructor would then call a NULL qops.destroy pointer, so skip the
destroy when the queue was never set up.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58660

ufshci: check SDB queue allocations for failure

The hardware queue and ucd_bus_addr allocations use M_NOWAIT but were
used without a NULL check, and the payload bus_dmamap_create() return
value was ignored, so a failed allocation was only discovered by
faulting on it later. Fail the construction instead. The teardown
path handles the partially constructed queue.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58661

ufshci: do not free the devq twice on SIM attach failure

cam_sim_free() with free_devq set already frees the devq, so the
following cam_simq_free() call on the xpt_bus_register() and
xpt_create_path() failure paths was a double free. Also clear
ctrlr->ufshci_sim so a later ufshci_sim_detach() does not operate on
the freed SIM.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58662

ufshci: initialize alloc_units before the dedicated-buffer scan

If every unit descriptor read failed in the LU-dedicated WriteBooster
scan, alloc_units was used uninitialized. Start it at zero so that case
is treated as a zero-sized buffer and WriteBooster is disabled.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58663

ufshci: byte-swap big-endian UPIU fields

The UPIU wire fields are big-endian. The task management and query
builders wrote host-order values into them. The completion paths also
read the results back without conversion. On a little-endian host an
ABORT_TASK carried a swapped task tag and LUN, a query carried a
swapped length, and attribute reads returned swapped values. Tolerant
devices masked most of the damage.

Convert with htobe*/be*toh at the wire boundary, as ufshci_sim.c
already does for its fields.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58664

ufshci: initialize desc_size for non-descriptor query requests

The flag and attribute query builders left param.desc_size
uninitialized, so stack garbage was sent as the query UPIU length
field. Devices generally ignore the length for these opcodes, which
hid the bug. Zero it explicitly.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58665

ufshci: read UIC command results while holding the lock

The UIC result registers (UICCMDARG2/3) are only valid between a
command's completion and the next command's submission. They were read
after uic_cmd_lock was dropped, so a concurrent UIC submitter could
overwrite them in between. Read them into locals before releasing the
lock.

Also mask the generic error code to its [7:0] field when checking it,
so unrelated bits in UICCMDARG2 (such as the attribute set type echoed
for DME_SET) cannot be mistaken for an error.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58667

ufshci: check completions under the queue lock

The completion scan held only the recovery lock. The submit path sets
a slot to SCHEDULED and then rings the doorbell, both under the queue
lock. A scan running between those two steps saw a SCHEDULED slot with
a clear doorbell and completed a command the device had not started.
The command failed with OCS 0xf, and a reused slot could return wrong
read data.

Check the slot state and the doorbell under the queue lock. The submit
path holds it across both steps, so a half-submitted slot can no
longer be seen. Found with fio randrw verify on QEMU.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58668

ufshci: release the CCB after sending a start stop unit command

ufshci_sim_send_ssu() got a CCB from cam_periph_getccb() but never
returned it. Each call leaked the CCB and one slot of the device's
CCB allocation budget. When the budget runs out, the next
cam_periph_getccb() waits forever and the suspend path hangs.

Release the CCB while the periph lock is still held, as the other CAM
periph drivers do.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58669

ufshci: free the taskqueue on detach

ufshci_ctrlr_destruct() never freed the taskqueue. Every load and
unload cycle leaked the taskqueue and its kernel thread. A task that
was still queued could also run after the module was gone.

Free the taskqueue in destruct. Do it after the interrupt teardown
so nothing enqueues new work. A reset task that is still queued at
this point races the queue teardown. That race is older than this
change. The planned in-flight recovery rework will close it.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58670

ufshci: do not reset the device in the XPT_RESET_DEV handler

CAM calls the SIM action callback with the SIM lock and the CAM
device lock held. The XPT_RESET_DEV handler called
ufshci_dev_reset(), which sleeps on device commands. Sleeping there
panics when another thread contends for the lock: "panic: sleeping
thread holds CAM device lock".

Report success without touching the device, as nvme_sim(4) does.
A real device reset needs the controller reset path. That rework is
planned together with in-flight request recovery.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D58671

A PF reset or loss of virtchnl service can make visible interface
initialization wait up to ten seconds and then return from the void
ifdi_init callback.  Iflib consequently marks the interface running even
though its queues were not initialized, and no retry is scheduled when
the PF returns.

Check reset readiness without polling during reinitialization, propagate
queue-message submission errors, and bound a silent enable or disable to
one mailbox timeout.  Report unsuccessful initialization to iflib and
publish link-down state without polling the stopped mailbox.

A VFLR also discards the Admin Queue and permits the PF to replace the
VF VSI.  Track when full virtchnl rediscovery is required, renegotiate the
API version, refresh and validate the VF resources before using a cached
VSI ID, and replay the MAC and VLAN filters cleared by reset.  Bound each
runtime discovery attempt while preserving the existing attach-time wait.

While the VF remains administratively up, retry complete
initialization after 250 ms, one second, four seconds, and then at a
capped eight-second interval.

MFC after:      2 weeks

ixl uses head writeback by default.  Hardware publishes the transmit
ring head through DMA only after completing a descriptor marked RS.
Marking every packet requested much more frequent head updates than
iflib needs to reclaim descriptors.

iflib marks selected packets with IPI_TX_INTR as completion
checkpoints.  It forces a checkpoint as deferred work or ring pressure
grows.  Retain EOP on every packet, but set RS only at those
checkpoints.  This batches head writebacks while preserving bounded
descriptor reclamation.

The optional descriptor writeback mode benefits as well.  ixl already
recorded only IPI_TX_INTR descriptors in its report-status queue, so
status written for every other packet was not inspected.

DPDK uses the same sparse RS design.  Let iflib choose the adaptive
interval for FreeBSD.  This is a PCIe/memory bandwidth savings.

MFC after:      2 weeks

iavf uses descriptor writeback by default.  Hardware writes completion
status into a transmit descriptor only when it completes a descriptor
marked RS.  iavf marked every packet RS even though its report-status
queue recorded and inspected only descriptors selected by iflib.  The
other completion writes could not help reclaim descriptors.

iflib marks selected packets with IPI_TX_INTR as completion
checkpoints.  It forces a checkpoint as deferred work or ring pressure
grows.  Retain EOP on every packet, but set RS only at those
checkpoints.

The deprecated head-writeback option on 700-series VFs gets the same
batching: each RS checkpoint permits hardware to publish the completed
ring head.

DPDK uses the same sparse RS design.  Let iflib choose the adaptive
interval for FreeBSD.  This is a PCIe/memory bandwidth savings.

MFC after:      2 weeks

The VF array is zeroed at allocation, but its sysctl contexts were
only populated after each VF was successfully added.  If VF setup
failed, IOV teardown still passed every requested VF context to
sysctl_ctx_free().  An untouched context is not an initialized empty
TAILQ and caused a page fault during teardown.

Initialize every VF context with the array so both successful setup
and partial-failure cleanup have a valid lifetime.

MFC after:      2 weeks

pci_iov_enumerate_vfs() logged a failed VF creation or driver
configuration but still reported the whole SR-IOV configuration as
successful.  The PF remained enabled with the requested NumVFs and
driver state even though one or more VF children were absent.

Make VF enumeration atomic.  Delete children created by the failed
attempt, invoke the PF driver cleanup, disable VF memory space and VF
Enable, release the IOV resources, and return the original error to
iovctl.  Also treat failure to create a VF child as an error instead
of silently accepting a partial configuration.

MFC after:      2 weeks

Bound variable-length virtchnl messages before computing their expected
length, following the newer Intel virtchnl implementation.

Validate VF ring sizes and alignments before programming HMC contexts.
DPDK uses 128-byte ring alignment and 64 through 8160 descriptors;
the virtchnl ABI further specifies TX multiples of 8 and RX multiples
of 32.  Preserve the 4096-descriptor limit on X722.

Validate queue bitmaps before changing any rings, validate all queue
and interrupt contexts before applying a request, and reject invalid
RSS table entries.  Also avoid sending an ACK after VLAN-strip setup
fails and reply to delete-VLAN errors with the correct opcode.

These checks prevent malformed or oversized requests from an untrusted
VF from partially programming resources outside its allocation.

MFC after:      2 weeks

ixl: Make VF reset resource reconstruction fallible

Treat each stage of VF reset and VSI reconstruction as fallible.  Keep
the VF out of VFACTIVE when PCIe drain, reset completion, VSI
release, or VSI allocation fails, following the DPDK PF reset model.
Propagate initial reset failures back through pci_iov_vf_add and unwind
the VF queue allocation.

Free the old software filter list before initializing a replacement VSI.
ixl_init_filters() previously replaced the list head without freeing its
entries, so every VF FLR leaked all MAC and VLAN filter objects.  Reset
the associated counters and VLAN bitmap with the list.

Avoid allocating an initial VSI only to destroy it during the required
initial VF reset, and remove redundant broadcast/filter programming from
VSI setup.  Also delete a partially created VSI when later Admin Queue
setup fails.

MFC after:      2 weeks

ixl: Enforce VF VLAN policy

Add access and trunk VLAN policy to the SR-IOV schema.  Access VFs
use a hardware PVID and cannot alter their VLAN membership.  Trunk VFs
may register up to 16 VLANs, while VLAN 0 remains implicitly admitted
for untagged and priority-tagged traffic.

Enable hardware VLAN anti-spoofing and maintain the MAC-by-VLAN filter
cross-product used by DPDK.  Apply Linux's untrusted-VF limits of 18 MAC
addresses and 16 VLANs so one guest cannot consume the shared PF filter
table without bound.

Report the effective policy through the VF status interface and document
the iovctl schema.

MFC after:      2 weeks
Relnotes:       yes

ixl: Rebuild VF resources after a PF reset

A PF or EMP reset destroys the firmware switch topology, including
every VF VSI.  The driver rebuilt only its PF VSI and left configured
VFs with stale switch element and VSI identifiers.

Notify VFs before a driver initiated reset, recreate the IOV VEB, and
rebuild each configured VF VSI and queue mapping after the PF switch
is restored.  Keep a VF out of VFACTIVE if its reconstruction fails
so one failure cannot expose incomplete resources or prevent the PF
and other VFs from recovering.

Invalidate cached VF firmware identifiers and runtime state before
recreating the VEB.  If VEB creation itself fails, teardown and mailbox
paths can no longer use pre-reset SEIDs or VSI data.

Factor the common VEB setup out of IOV initialization so initial
setup and post-reset reconstruction use the same topology and filter
sequence.

MFC after:      2 weeks

ixl: Report PF initialization failures to iflib

ixl_if_init() returned early after AdminQ reconstruction, LAA, or
VSI initialization failures.  Since IFDI_INIT has no return value,
iflib then marked the interface RUNNING and enabled its interrupts
and timers despite the incomplete hardware state.

Use iflib_init_failed() on each incomplete path.  Also stop at the
first ring-enable error and tear down any partially enabled rings
before reporting failure.  This keeps the interface stopped and
makes a later initialization attempt start from a bounded state.

MFC after:      2 weeks

ixl: Track and recover MDD-blocked VFs

The hardware identifies each VF with TX and RX malicious-driver
status latches, but the driver combined all events into one counter
and reported only the last VF found.  It also did not record that
hardware had blocked the VF, leaving the condition invisible to
management tools.

Consume every PF and VF latch, keep per-direction VF counters,
rate-limit per-VF diagnostics, and report the blocked and
traffic-enabled state via the VF status interface.  Clear the
software block only after a successful VF or PF reset reconstructs
its resources.

Match Linux i40e policy by leaving a detected VF blocked by default.
Add an opt-in hw.ixl.mdd_auto_reset_vf tunable that notifies and
resets the VF for installations that prefer availability.  DPDK
provides the register clear and per-VF attribution precedent; Linux
provides the recovery policy.

MFC after:      2 weeks

ixl: Quiesce VF DMA before a PF reset

A PF reset has a warning interval before the hardware reset begins.
Cooperative VF drivers respond to the reset event by stopping and
releasing their receive buffers, but notifying VFs did not stop the
hardware queues.  An active VF could therefore DMA through its old
rings into freed mbuf clusters during the warning interval.

Put every enabled VF in reset, drain its PCIe transactions, disable its
queues, wait for receive queue shutdown, and drain transactions again
before tearing down the PF HMC and AdminQ.

Hold VFs in reset again while rebuilding the firmware topology.  Release
VF reset before programming the replacement VSI and queue mappings,
since VF reset clears those registers, and publish VFACTIVE only after
reconstruction succeeds.  Leave a VF held in reset if rebuilding it
fails.

Fixes:          https://cgit.freebsd.org/src/commit/?id=983e628a0c47 ("ixl: Rebuild VF resources after a PF reset")
MFC after:      2 weeks

A PF link event remains cached while a VF is administratively down.
Media status queries called iavf_update_link_status() and published
that cached state as link-up, while the stopped admin path immediately
published link-down.  Consumers reacting to link events could turn
this into an unbounded notification loop and prevent interface detach
from draining its link-state task.

Keep the cached PF state, but only publish link-up after iflib has
marked the VF running.  A subsequent admin pass publishes the cached
state after a successful initialization.

MFC after:      2 weeks

A PF reset indication leaves IAVF_STATE_RESET_PENDING set while the
VF recreates its AdminQ and negotiates new resources.  The ordinary
AdminQ task refuses to consume messages while that state is set.
Consequently, the first DISABLE_QUEUES reply after successful mailbox
rediscovery remains in the receive queue and initialization times out.
Later retries and manual interface restarts repeat the same cycle.

Clear the stale reset indication once VERSION and GET_VF_RESOURCES have
succeeded, before enabling interrupts and resuming normal virtchnl
requests.

MFC after:      2 weeks

This change introduces a variant of `pmap_invalidate_range` that uses
the fine-grained TLB invalidation instructions introduced by the
Svinval extension. These instructions allow for more efficient TLB
flushing on certain implementations. Under this new scheme,
`pmap_invalidate_range` was converted to an ifunc that selects the
appropriate variant during boot.

Event:  BSDCan 2026
Reviewed by:    markj, mhorne
Differential Revision:  https://reviews.freebsd.org/D57624

ixgbe: Preserve VF jumbo frame size across PF resets

sc->max_frame_size represents the largest frame requested by the PF or
an active VF.  The MTU callback replaces it with the PF frame size, so
a subsequent reinitialization can program MHADD below an active VF's
jumbo-frame request.

Recompute the aggregate before hardware initialization and use it when
programming MHADD.  Recompute after each VF LPE request as well, so a
reduced request can lower the hardware limit when no other function
needs the previous value.

MFC after:      2 weeks

ixgbe: Restore missed packet accounting

missed_rx and total_missed_rx are never populated.  As a result, the
GPRC erratum workaround does not remove missed packets and iqdrops
always remains zero.  The rx_missed_packets sysctl and input-error total
also expose only MPC bank zero.

Read and accumulate all eight MPC banks.  Use the interval total to
correct GPRC and the cumulative total for iqdrops, input errors, and the
aggregate sysctl.  This matches DPDK's coverage of the hardware banks.

MFC after:      2 weeks

ixgbe: Validate EEPROM checksum section bounds

The generic checksum walker trusts NVM section pointers and lengths and
iterates with a 16-bit index.  A corrupt section that crosses the end of
the EEPROM can wrap the index and leave the driver in an effectively
unbounded read loop during attach.

Validate each non-empty section against the discovered EEPROM word size
before reading it, and use widened arithmetic for the inclusive end and
iterator.

MFC after:      2 weeks

ixgbe: Compare flow control against requested mode

The flow-control sysctl represents the configured policy, while
current_mode is the mode negotiated with the link partner.  Comparing a
new request with current_mode can needlessly reprogram an unchanged
policy or skip a requested policy change that happens to match the
current negotiation result.

Compare with requested_mode before deciding that no update is needed.

MFC after:      2 weeks

The VF link-status path can receive 2.5 and 5 Gb/s speed bits from
X550-family PFs, but media reporting has no cases for them.  The
bootverbose message also assumes every non-10-Gb/s link is 1 Gb/s.

Expose the corresponding ifmedia subtypes and derive the diagnostic
speed through the shared link-speed conversion helper.

MFC after:      2 weeks

X550-family devices provide clear-on-read counters for transmit and
receive Low Power Idle events.  Accumulate each register once in the
normal statistics poll and expose the monotonic totals below the eee
sysctl node.  Document the counters together with the existing EEE
control.

Obtained from:  Intel ix 3.4.39
MFC after:      2 weeks

10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber.  Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.

When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence.  Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.

MFC after:      2 weeks
Relnotes:       yes

The 82599 and X540 share the global RSS redirection table between the
PF and its VFs.  Programming that table from the PF queue count
prevents a VF from using queue indices absent from the PF layout.  A
one-queue PF consequently directs every flow for a two- or four-queue
VF to queue zero.

Program at least four queue indices while SR-IOV is active.  Each pool
PSRTYPE.RQPL field masks the shared table to the queue subset available
to that function, so the PF can continue using fewer queues.

MFC after:      2 weeks

These are already available and having them defined helps keep the KASAN
atomic(9) interceptors uniform.

Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58680

According to Linux 5f1c3589b0f0, the X550 PHY classifier still matches
an alpha silicon ID, while the shared definitions contain the two
production IDs.  This can leave production hardware on the generic
probing path and issue unnecessary PHY queries.

MFC after:      2 weeks

The management_pkts_drpd sysctl was wired to MNGPTC, making it an
alias of management_pkts_txd, instead of MNGPDC.

MFC after:      3 days

Found with:           clang -Werror=assign-enum
Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58710

Some devices take a little longer, and the spec doesn't really seem to
mandate a maximum.  The common path in usbd_req_set_address() has
already been bumped to 1s and I have a headset (Logitech H390) that does
need a little bit longer, so let's match it in xhci.

Reviewed by:    aokblast
Differential Revision:  https://reviews.freebsd.org/D58717

Added support for E835 adapters with post-quantum cryptographic (PQC)
algorithms in firmware/software signage and in SPDM attestation.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk@intel.com>

Reviewed by:    Miłosz Linkiewicz <milosz.linkiewicz@intel.com>
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57868

Add support for future client platform

MFC after:      1 week

Panther Point changed the reset value of CTRL_EXT.DPG_EN to enable
autonomous power gating. Clear it after hardware reset on Panther Point
and Nova Point controllers to prevent unexpected Tx/Rx hangs, packet
loss, or corruption.

MFC after:      1 week

pmc_capture_user_callchain() checks a PMC's runcount before walking
the user stack, but reads it without holding the spinlock that
protects it. hardclock() can run on the same CPU during the capture
and drop the runcount to zero in between, tripping the assertion and
panicking INVARIANTS kernels under load.

Move the check inside the existing spinlock, right where the code
already confirms the sample is still valid. No functional change on
kernels built without INVARIANTS.

Signed-off-by:  Andre Silva <andasilv@amd.com>
Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58571

pmc_capture_user_callchain() asserts that TDP_CALLCHAIN is set on the
current thread, but PMC_UR samples never set that flag -- only PMC_HR
and PMC_SR do. That makes the assertion always fail for PMC_UR,
panicking INVARIANTS kernels as soon as pmcstat -U is used.

Skip the assertion for PMC_UR. No functional change on kernels built
without INVARIANTS.

Signed-off-by:  Andre Silva <andasilv@amd.com>
Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58572

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

DPDK commit message

net/e1000/base: fix iterator type

Fix static analysis warning about comparison between types of
incompatible width, which might lead to an infinite loop due to
overflow.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Amir Avivi <amir.avivi@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (3d36053991)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix NVM data type in bit shift

There is a static analysis warning due to wrong data types being used
for NVM read data shifts. Fix it via explicit type cast.

Fixes: https://cgit.freebsd.org/src/commit/?id=38db3f7f50bd ("e1000: update base driver")
Cc: stable@dpdk.org

Signed-off-by: Przemyslaw Ciesielski <przemyslaw.ciesielski@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (b932270c66)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix possible variable overflow

Bits can be lost as temporary math is done on signed variables and the
result is assigned to an unsigned variable. Cast to u32 to force the
compiler to do operations on unsigned temporary variables.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (214cb0d7f1)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix NVM loop bounds and pointer access

Improve the NVM checksum routines by ensuring loop bounds are compared
at the correct integer width. Use array indexing instead of explicit
pointer arithmetic.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Menachem Fogel <menachem.fogel@intel.com>
Signed-off-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (39fba42d04)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: improve NVM checksum handling

When reading NVM checksum, we may encounter the following scenarios:

- Checksum may be invalid, and can be updated
- Checksum may be invalid but cannot be updated because NVM is read-only

For the latter case, we should just ignore invalid checksum and not
attempt to update it.

Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (5241c17f0d)
MFC after:      2 weeks

Some transitional Tiger Lake systems shipped with an uninitialized
checksum word.  Accept that state while continuing to validate newer
read-only NVM images.

MFC after:      2 weeks

The shared semaphore helper accesses both the 82571 retry counter and
the I210 one-time-clear flag.  Those fields occupy overlapping members
of the device-specific union.  On 82571, incrementing the counter thus
enables the I210 recovery and clears SMBI after the first timeout.

Give 82571, generic 80003/82575, and I210/I211 users distinct acquire
paths.  Preserve the legacy peer-driver policy on 82571 and one-time
recovery on I210.

The separation follows the Intel e1000 base code in DPDK.

MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix semaphore timeout value

According to datasheet, software ownership of SWSM.SWESMBI bit should
not exceed 100ms. Current implementation caused incorrect timeout
counter values, where each iteration equals 50us delay. Because of that
driver was allowed to wait for semaphore even for 1.5s. This might
trigger DPC timeout.

This implementation hardcodes value to 2000, which multiplied by 50us,
gives 100ms of possible wait time.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Pawel Malinowski <pawel.malinowski@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (c8bcaf0f2a)
MFC after:      2 weeks

e1000: Retry transient MDIC failures on modern PCH

Some Meteor Lake and newer systems sporadically fail an MDIC PHY
transaction while the MAC and PHY clocks synchronize.  Retry twice
before reporting the transaction failure.

Disable retries around PHY interface transitions where an MDI error
is expected.  Preserve and restore the configured retry count on every
exit from those flows.

This follows DPDK commit bdca22d62ff0, extended to the PTP and NVP PCH
types.

MFC after:      2 weeks

e1000: Reconfigure modern PCH K1 clock synchronization

Meteor Lake and newer PCH generations can lose packets while the MAC
and PHY clocks synchronize.  Move K1 power-down to P1 and extend the
PHY K1 exit timeout before PHY access and after reset.

Use the longer 1 Gb/s PLL clock-gate timeout added by Linux so K1 can
remain enabled without the power penalty of disabling it.  Apply the
workaround through the newer PTP and NVP generations.

This follows DPDK commits ba54bdc79d94 and d88ef2356ecc, with the
longer exit time observed in Linux 578294b8b60d.

MFC after:      2 weeks

e1000: Compare decoded PCH LTR latencies

The LTR encoding combines a value and a nonlinear scale, so encoded
values cannot be compared directly.  Decode both the device latency and
the platform maximum before deciding whether to clamp the request.

MFC after:      2 weeks

e1000: Allow more time for PCH ULP exit

Firmware may take up to one second to unconfigure ULP, and affected
Lenovo systems have required nearly two seconds.  Allow 2.5 seconds
before treating the transition as a PHY failure.

This extends DPDK commit 7aa4c34581a5 using the field-tested bound
from Linux commit 3cf31b1a9eff.

MFC after:      2 weeks

e1000: Check PHY control register reads

Do not modify a zero-initialized PHY control value when its preceding
read failed.

MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix unchecked return

Static analysis has detected a write that is not checked for errors,
leading to ignored error return value. Add a check.

Fixes: https://cgit.freebsd.org/src/commit/?id=edcdb3c5f71b ("e1000/base: fix link flap on 82579")
Cc: stable@dpdk.org

Signed-off-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (b0b6b50c20)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: add LPI counters

Add new fields in structure to indicate if EEE LPI entries have been
observed on Tx and Rx path.

Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (2e8078ee69)
MFC after:      2 weeks

Accumulate the clear-on-read transmit and receive LPI event counters
on EEE capable PCH and I350 family devices.  Expose the 64-bit totals
under the per-device eee sysctl node.

MFC after:      2 weeks

sndcard_func is used as an ivar which passes around device info to the
PCM and MIDI children in snd_csa(4) and snd_emu10kx(4). Simplify this
and retire the need for sndcard_func, by 1) making an ivar only what
used to be stored in sndcard_func->varinfo, 2) replacing
sndcard_func->func with a child comparison, where needed, for instance
in csa_detach().

sndcard_func is harmless in reality, but there is no reason to have the
additional complexity. This way we also avoid the structure allocations.

Sponsored by:   The FreeBSD Foundation
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix reset for 82580

Fix setting device reset status bit in e1000_reset_hw_82580() function
for 82580 by first reading the register value, and then setting the
device reset bit.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (88a1eb79ef)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix MAC address hash bit shift

In e1000_hash_mc_addr_generic() the expression:

"mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"

shift by more than 7 bits always yields zero, so hash becomes not so
different. Add initialization with bit_shift = 1, and add a loop
condition to ensure bit_shift will be always in [1..8] range.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (1749e662f6)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix data type in MAC hash

One of the bit shifts in MAC hash calculation triggers a static analysis
warning about a potential overflow. Fix the data type to avoid this.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (458734aaac)
MFC after:      2 weeks

The multicast hash bit can be 31.  Use an unsigned value so setting the
bit cannot shift a signed integer into its sign bit.

MFC after:      2 weeks

The i210 and i211 can occasionally fail to accept multicast table
writes, particularly while addresses are added and removed rapidly.
Read the table back and rewrite mismatches for up to three passes.

This prevents multicast reception from retaining stale filter state
while keeping the workaround limited to the affected controllers.

MFC after:      2 weeks

A reset NACK from a Linux PF means that the reset completed but no
permanent MAC address was assigned.  Treat that response as a
successful reset with a zero permanent address so attach can generate
a local address instead of retrying a live mailbox.

FreeBSD PFs also use a one-dword reset NACK while retained queues are
being sanitized.  Seed the otherwise unused request payload and accept
only the three-dword, zero-filled NACK used by Linux, preserving the
FreeBSD retry contract.

MFC after:      2 weeks

Return a PHY write failure immediately when disabling D0 low-power
link-up on 82571-family controllers.

MFC after:      2 weeks

The multicast hash bit can be 31.  Use an unsigned value so setting the
bit cannot shift a signed integer into its sign bit.

MFC after:      2 weeks

The multicast vector bit can be 31.  Use an unsigned value so setting
the bit cannot shift a signed integer into its sign bit.

MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix iterator type

Fix static analysis warning about comparison between types of
incompatible width, which might lead to an infinite loop due to
overflow.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Amir Avivi <amir.avivi@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (3d36053991)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix MAC address hash bit shift

In e1000_hash_mc_addr_generic() the expression:

"mc_addr[4] >> 8 - bit_shift", right shifting "mc_addr[4]"

shift by more than 7 bits always yields zero, so hash becomes not so
different. Add initialization with bit_shift = 1, and add a loop
condition to ensure bit_shift will be always in [1..8] range.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (1749e662f6)
MFC after:      2 weeks

DPDK commit message

net/e1000/base: fix data type in MAC hash

One of the bit shifts in MAC hash calculation triggers a static analysis
warning about a potential overflow. Fix the data type to avoid this.

Fixes: https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (458734aaac)
MFC after:      2 weeks

Do not modify a zero-initialized PHY control value when its preceding
read failed.  Leave the PHY unchanged when the void power helpers cannot
read its current state.

This follows the defensive checks added to the corresponding e1000
helpers.

MFC after:      2 weeks

ixgbe: Avoid a signed shift while assembling the PBA number

The EEPROM word is promoted to signed int before the left shift when
the cast is applied to the complete expression.  Cast the word first so
all 16-bit values are shifted as unsigned data.

This is the ixgbe counterpart of the e1000 correction imported from
DPDK commit b932270c66.

MFC after:      2 weeks

ixgbe: Avoid signed overflow in LED register masks

LED index three shifts the blink bit into bit 31.  Convert the base to
the register width before shifting so the operation is unsigned.

This is the ixgbe counterpart of the e1000 correction imported from
DPDK commit 214cb0d7f1.

MFC after:      2 weeks

ixgbe: Use unsigned register bitmap shifts

VLAN, VMDq, and VF reset bit indices can reach 31.  Use unsigned
values when constructing their 32-bit register masks so the shifts do
not operate on signed integers.

MFC after:      2 weeks

A manageability VLAN can select bit 31 of its VFTA register.  Use an
unsigned value when constructing the register mask.

MFC after:      2 weeks

The PHY capability display examines all 32 bits of the firmware bitmap.
Use an unsigned value so examining bit 31 does not shift a signed
integer into its sign bit.

MFC after:      2 weeks

The driver already accumulates the clear-on-read transmit and receive
LPI event counters.  Expose the 64-bit totals under the per-device eee
sysctl node.

MFC after:      2 weeks

PHY identifier words are promoted to signed int when the cast is applied
after the shift.  Cast each 16-bit register value first so identifiers
with their high bit set are assembled as unsigned data.

MFC after:      2 weeks

The PHY identifier word is promoted to signed int when the cast is
applied after the shift.  Cast the 16-bit register value first so
identifiers with their high bit set are assembled as unsigned data.

MFC after:      2 weeks

The PHY identifier word is promoted to signed int when the cast is
applied after the shift.  Cast the 16-bit register value first so
identifiers with their high bit set are assembled as unsigned data.

MFC after:      2 weeks

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      2 weeks

I225 and I226 expose three programmable LED outputs.  Use LED1 for
adapter identification, following the convention in DPDK.  Preserve the
OEM configuration across identification requests.

Restore the OEM configuration before a device reset so an active led(4)
pattern cannot leave the output overridden across stop or detach.

The LED mode values follow the Intel I225 Software User Manual.

MFC after:      2 weeks

The generic LED on and off operations do not handle internal SerDes
media, leaving the led(4) device ineffective on my I210 fiber port.

Use the hardware blink operation for the on phase on internal SerDes.
The off phase restores the saved OEM LED configuration as before.

MFC after:      2 weeks

The debug routine advanced ring pointers as if rings were contiguous.
They are embedded in queue structures, so rings beyond queue zero had
the wrong stride.  The bogus queue index could cause an invalid MMIO
read and panic the machine.

Index the queue arrays first and then select the embedded ring.

MFC after:      2 weeks

The debug routine reads queue registers by queue index.  It also
advanced unused pointers to rings embedded in queue structures.  Those
pointers had the wrong stride and could proceed beyond the ring object.

Remove the unused pointer arithmetic.

MFC after:      2 weeks

Expose the physical port identification LED through /dev/led/ix*.
Save and restore the NVM-selected LEDCTL value around each request.
The X550 operations also clear their PHY manual override before the
register is restored.

Use the dedicated firmware port-identification command on E610.  Its
interface selects between firmware blinking and the original mode
rather than directly controlling LEDCTL.

Restore the normal indication before a device stop or reset.

MFC after:      2 weeks

Expose each physical port identification LED through /dev/led/ixl*.
Use the existing GPIO LED helpers for most devices and the PHY
provisioning interface for X710 10GBASE-T adapters.

Preserve and restore the original GPIO or PHY indication mode,
including before the interface is stopped.

MFC after:      2 weeks

ixgbe: Defer ECC recovery to iflib

The link interrupt filter performed a full hardware reset in interrupt
context.  This bypassed iflib stop and initialization, including queue
quiescence and restoration of temporary LED state.

Record the ECC event in the administrative request mask and ask iflib
to perform the reset from its taskqueue.  Keep the ECC cause masked
until reset so the intermediate admin pass cannot re-enable a sticky
condition.  Handle ECC independently of Flow Director and in legacy
interrupt mode.

Remove the redundant EICR write; the filter has already cleared the
reported causes.  Also remove the accompanying complement-mask update
of mac.flags.  It set every flag except DOUBLE_RESET_REQUIRED and had
no place in ECC recovery.

MFC after:      2 weeks

ixgbe: Defer firmware recovery transitions to iflib

The firmware-mode callout invoked ixgbe_if_stop() directly.  This
performed a full device reset without the iflib context lock or the
iflib queue lifecycle.  It could also poll the E610 firmware command
interface from callout context while identification was active.

Request an iflib reset from the callout instead.  Reject initialization
while firmware recovery remains active.  This leaves the interface
stopped and lets iflib publish that state.  Request initialization when
firmware exits recovery so an administratively-up interface can recover
without operator intervention.

MFC after:      2 weeks

ixgbe: Defer E610 thermal shutdown to iflib

The E610 firmware event handler invoked ixgbe_if_stop() directly from
IFDI_UPDATE_ADMIN_STATUS().  This reset the device without the iflib
queue lifecycle and left the interface marked running after its hardware
was stopped.

Request an iflib reset instead.  Fail the automatic initialization once
so the reset transaction stops the interface and publishes that state.
A later operator-requested initialization remains possible, matching the
previous recovery policy without bypassing iflib.

MFC after:      2 weeks

I225 and I226 report uncorrectable internal memory errors through
ICR.FER and identify the affected region in PEIND.  Depending on the
region, hardware stops transmit or all PCIe and DMA traffic until the
port is reset and reinitialized.

Enable the fatal error interrupt and capture its read clear status in
the interrupt filter.  Mask the cause while an iflib reset is pending,
report the affected memory regions, and expose per region indication
counters.

PCIe region parity failures require a different recovery order from a
normal reset: assert DEV_RST, wait at least 3 ms, disable PCIe master
requests, clear PCIEERRSTS, and then reinitialize the port.  Follow that
sequence before entering the normal reset path and clear the remaining
LAN status afterward.

The I225/I226 PBECCSTS layout is unrelated to the PCH layout previously
copied into the igc headers.  Replace those unused definitions with the
I225/I226 memory error register definitions.

Hardware validation used an I225-IT revision 3 and a debug kernel that
wrote only the documented self-clearing injection bits.  It did not
synthesize interrupt or status state.

Coverage, notably DMA and Mgmt are not fully testable in my setup:
    Region  Observed hardware status          Result
    LAN     PEIND 0x1, LANPERRSTS 0x200       Reset and recovered
    PCIe    PEIND 0x4, PCIEERRSTS 0x8         Reset and recovered
    DMA     DRPARC injection read back zero   DFT-gated on test NIC
    Mgmt    Host debug strap unavailable      Not injectable

The repeated LAN and PCIe tests recovered without a panic or watchdog.
A PCIe-to-LAN sequence also verified that reset-time PEIND indications
are drained before FER is unmasked.

MFC after:      2 weeks
Sponsored by:   BBOX.io

I225 and I226 do not interrupt for corrected internal ECC errors.
Instead, the DMA packet buffer and PCIe memories expose sticky status
bits in PBECCSTS and PCIEECCSTS.

Sample these bits with the regular hardware statistics update, preserve
the PBECCSTS ECC enable state while clearing its RW1C indication, and
expose separate counters for the DMA packet buffer, PCIe transmit-data
memory, and PCIe retry buffer.

These counters represent observed indications rather than an exact error
count because multiple corrections between samples collapse into one
sticky status bit.

Hardware validation used an I225-IT (rev 3) and a debug kernel that
wrote only the documented self-clearing injection bits.  Each test
armed the injector, exercised the owning RAM with traffic, and compared
the corresponding counter before and after.

Coverage:
    Memory                Observed result
    DMA packet buffer     corrected_dma advanced once
    PCIe transmit data    corrected_pcie_tx_data advanced once
    PCIe retry buffer     No PCIe replay source; not exercised

The retry-buffer injector requires a real PCIe replay to read the
corrupted entry.  The test root port exposed AER and DPC reporting but
no protocol error injector, so ordinary traffic could not cover that
case.

MFC after:      2 weeks
Sponsored by:   BBOX.io

thunderbolt: Get NHI version number from caps

Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D49452

thunderbolt: Reset controllers

Reset routine for both v1.0 and v2.0 routes, chosen depending on version
reported in caps.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D49452

thunderbolt: Explicitly read NHI ISR0 register to clear it

This fixes and issue where Pink Sardine controllers were not receiving
interrupts for more than the first command sent on the ring.

Reviewed by:    emaste, imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D52862

Query the firmware for the LEDs on each physical port and expose
/dev/led/bnxt* only when alternate blinking is supported.  Configure
every LED in the advertised group for identification and restore its
default firmware state before a function reset.

This follows the DPDK and Linux bnxt HWRM identification paths.

Reviewed against: DPDK, Linux

Reviewed by:    Sumit Saxena <sumit.saxena@broadcom.com>
MFC after:      2 weeks
Sponsored by:   BBOX.io

Rewrite pmap_s1_invalidate_strided() to use range-based TLBI
instructions when they are when available.  This change can
significantly reduce the number of invalidation instructions
issued, leading to decreased system time.  (More details on the
decrease can be found in the review.)

Assisted-by:    Claude Code (Opus 5)
Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58708

While testing an unrelated pmap change, D58708, that dramatically
reduces the number of TLBI instructions performed, and likely the
timing of unrelated events, I started seeing "Storing an invalid VFP
state" panics in vfp_save_state_common().  However, the origin of this
panic is elsewhere, in the else branch of sve_restore_state().
Specifically, my pmap change seems to have increased the likelihood that
the thread executing the else branch would be preempted by another
thread between the critical_exit() inside the else branch's call to
vfp_restore_state_common() and its own call to critical_enter().  Prior
to expanding the scope of the else branch's critical section, the MPASS
added by this change would fire, catching the problem at its source,
rather than later in vfp_save_state_common().

Assisted-by:    Claude Code (Opus 5)
Reviewed by:    kib, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58723

A PCI function can provide a host bridge into a synthetic PCI domain.
Intel VMD does this: the host facing VMD function remains in its
original domain while the hidden Root Ports and endpoints appear in a
separate domain.  The VMD function's Device Control does not describe
an upstream link in that synthetic hierarchy.

The hierarchy wide cold pass incorrectly used the VMD function's MPS
to reprogram the hidden ports and their endpoints.  Stop both cold
reconciliation and runtime path walks at a PCI domain boundary.  The
real Root Ports within the VMD domain continue to reconcile their
endpoints normally.

Reviewed by:    imp
Tested by:      Michael Butler <imb@protected-networks.net>
Fixes:          https://cgit.freebsd.org/src/commit/?id=8e9fe9996a1f ("pci: Reconcile MPS before attaching PCIe devices")
MFC after:      6 days
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58837

Move the capability and quirk checks used by pcie_flr() into a public
side effect free helper.  This lets callers determine whether an FLR
can be attempted before quiescing a device or saving state.

The helper considers the advertised PCIe FLR capability and both the
enable and disable FLR quirks.

MFC after:      2 weeks
Sponsored by:   BBOX.io

E610 Hyper-V VFs use PCI configuration space communication instead of
the native PF/VF mailbox.  The generic E610 match currently attaches
native mailbox operations to those devices, and the imported Hyper-V
subdevice identifier is incorrect.

Correct the subdevice identifier to 0x00ff, as used by DPDK shared
ixgbe code, and reject that subtype until ixv has a complete Hyper-V
operations table.

MFC after:      1 week
Sponsored by:   BBOX.io

E610 VFs no longer report the actual PF link state and speed through
VFLINKS.  They can consequently report the default 10 Gb/s speed even
when the physical link uses another rate.

Negotiate mailbox API 1.6 on E610 and request the PF link state with its
three-dword operation.  Retain VFLINKS as the fallback when an older PF
rejects API 1.6.  Permit API 1.6 in the inherited xcast and queue
discovery helpers so negotiating the newer revision does not disable
existing operations.

Use GET_QUEUES to replace E610's one-queue fallback with the grant from
the PF.  The common path continues to use one iflib queue set per data
MSI-X vector and caps the result at two queue pairs.

Preserve mailbox transport errors so the driver can distinguish an
explicit PF NACK from a transient timeout.  A NACK means clear-to-send
state was lost and requires a VF reset.  Preserve the last confirmed
link state across brief transport failures and publish link down after
three consecutive failures.

Poll E610 link state every two seconds, matching Intel's ixgbevf service
timer, and phase VFs across the intervening iflib timer ticks.  This
avoids a mailbox polling herd when many VFs share a PF.  Media-status
queries return the cached state instead of starting another synchronous
exchange.  An admin interrupt caused by a mailbox reply only checks for
an unsolicited PF reset, preventing a request/reply interrupt loop.

Hardware validation on an E610 10GBASE-T PF exercised 63 VFs.  Each VF
negotiated API 1.6, two queue pairs, and three MSI-X vectors.  Phased
polling kept 31 active VFs idle, and all 63 recovered after a PF
down/up cycle without watchdogs.

Adapt the API 1.6 link-state operation from DPDK shared ixgbe code.  The
timeout and NACK distinction follows Intel ixgbevf 5.3.25.

MFC after:      2 weeks
Sponsored by:   Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by:   BBOX.io

E610 inherits the X550-family virtualization registers, anti-spoofing
controls, and malicious-driver operations, but the frontend does not
advertise SR-IOV and cannot negotiate the mailbox revision needed by
E610 VFs.

Initialize the X550-family PF/VF mailbox registers for E610 and use
PFVFLREC for its VF reset events, following DPDK shared ixgbe code.
Advertise the E610 SR-IOV capability, accept API 1.6 only on E610, carry
the existing xcast and queue operations forward to that revision, and
return the cached physical link speed and state with the three-dword
E610 operation.  Unsupported RSS and optional feature requests continue
to receive explicit failures.

SR-IOV activation also enables the existing X550-derived per-pool MDD
recovery path on E610.  Document the expanded protection and link-state
coverage.

Hardware validation created 63 VFs and rejected a 64th without flapping
the running PF.  Invalid TX and RX descriptor DMA independently asserted
the offender's WQBR bit, gated only that VF, preserved sibling traffic,
and recovered after the VF reset.  FreeBSD ixv, FreeBSD DPDK, Linux
ixgbevf, and Linux DPDK exercised the PF mailbox and data paths.

MFC after:      2 weeks
Relnotes:       yes
Sponsored by:   Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by:   BBOX.io

The VF statistics registers are free running and are not cleared on
read.  The existing code records attach time bases and pre-reset totals,
but never uses either when publishing counters.  It instead replaces
the low hardware bits directly, so counters can inherit pre-attach
traffic or jump backward after a reset.

Accumulate modular 32- and 36-bit deltas, following DPDK, while keeping
the software totals across planned resets.  Establish a fresh hardware
baseline after each successful reset and invalidate the sampling epoch
when mailbox state is lost.  Detect unsolicited PF resets explicitly so
a reset while link is down cannot be mistaken for counter wrap.

Remove the unused base and saved-reset bookkeeping.

On E610, packet and octet counters remained monotonic across a VF FLR
and a PF down/up cycle.  Traffic after each reset advanced both RX and
TX counters.

MFC after:      2 weeks
Sponsored by:   BBOX.io

X550 family devices provide a separate RSS key, redirection table,
and MRQC register for every VMDq pool.  With SR-IOV enabled, the
driver continued programming only the global RSS state and never
selected MRQC.MULTIPLE_RSS.  VF-local RSS programming was therefore
ineffective.

Enable multiple-RSS mode for X550, X552, X553, and E610.  Initialize
the PF pool's 64-entry key, redirection table, and RSS hash controls.
Leave each VF pool untouched so its driver retains ownership of its
RSS key and mapping.

E610 folds IPv6 extension-header traffic into its base RSS selectors
and reserves the legacy EX selector bits.  Translate those requested
hash types rather than programming reserved bits.

With two E610 VFs active and four PF queue sets, eight fixed TCP flows
distributed across all four PF receive queues.

E610 uses the same per-pool mode according to the E610 Datasheet,
sections 7.1.3.6.2 and 8.2.2.8.20-21.

MFC after:      2 weeks
Sponsored by:   Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by:   BBOX.io

PFVFRSSRK contains ten 32-bit RSS key words, numbered 0 through 9.
The previous inclusive range incorrectly ended at 10.

MFC after:      1 week
Sponsored by:   BBOX.io

e1000: Recover from PCH packet buffer ECC errors

PCH LAN controllers beginning with I217 report uncorrectable
packet buffer ECC errors through ICR.ECCER.  Descriptor memory errors
stop the MAC and require a reset before traffic can resume.

Enable the interrupt on the PCH generations whose shared code setup
enables packet buffer ECC.  Capture the read-clear PBECCSTS value in
the interrupt filter, mask ECCER while recovery is pending, and request
an iflib reset from the admin task.  Reenable the cause only after
hardware initialization succeeds.

Hardware validation used an I219-LM and the documented ICS.ECCER bit to
generate the fatal interrupt.  This synthesizes the interrupt cause but
does not corrupt packet buffer memory or alter its ECC byte counters.
Three injections in one boot each requested one reset and recovered
traffic without a panic or watchdog.  IMS.ECCER and PBECCSTS.ECC_ENABLE
remained set after every reset.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Report PCH packet buffer ECC statistics

PCH packet buffer ECC status contains read-clear byte counters for
corrected and uncorrected errors.  Sample them with the regular
hardware statistics update and account for the snapshot captured by
the fatal error interrupt path.

Expose the counters and the number of reset worthy interrupt
indications under dev.em.N.memory_errors.  Keeping the reset counter
separate also preserves evidence when another status reader wins the
read-clear race.

Hardware validation used an I219-LM.  Three documented ICS.ECCER
injections advanced fatal_resets from zero to three, exactly once per
reset.  corrected_packet_buffer and uncorrected_packet_buffer remained
zero, as expected because ICS does not inject a memory error or alter
PBECCSTS.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Recover from I210 and I211 memory errors

I210 and I211 report uncorrectable internal memory errors through
ICR.FER and identify the affected region in PEIND.  Depending on the
region, hardware stops transmit or all PCIe and DMA traffic until the
port is reset and reinitialized.

Enable FER and all regional indication masks.  Discard indication state
left by firmware before enabling reactions, capture the read-clear
status in the interrupt filter, and keep the cause masked while recovery
is pending.  Report the affected regions and expose per-region
indication counters.  Management-only errors remain under firmware
control.

PCIe region parity errors require a different recovery order from the
normal reset path.  Assert the port-local CTRL.RST bit, wait at least
3 ms, verify reset completion, disable master requests, clear
PCIEERRSTS, and then enter normal port reinitialization.  Do not use the
device-wide CTRL.DEV_RST sequence used by I225 and I226.

Hardware validation used an I210 revision 3 and the self-clearing
LANPERRINJ retransmit-buffer bit 9.  It injected a real parity error
without synthesizing interrupt or status state.
Three injections in one boot produced the following result each time:

    Observed hardware status          Result
    PEIND 0x1, LANPERRSTS 0x200       Reset and recovered

fatal_lan advanced exactly once per injection.  All tests completed
without a panic or watchdog, and FER and the LAN parity masks remained
enabled after every recovery.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Report corrected I210 and I211 ECC errors

I210 and I211 do not interrupt for corrected internal ECC errors.
Instead, the DMA packet-buffer and PCIe memories expose sticky status
bits in PBECCSTS and PCIEECCSTS.

Sample these bits with the regular hardware statistics update, preserve
the I210/I211 PBECCSTS enable state while clearing its RW1C indication,
and expose separate counters for the DMA packet buffer, PCIe transmit
data, and PCIe retry buffer.

The counters represent observed indications rather than exact error
counts because multiple corrections between samples collapse into one
sticky status bit.

Hardware validation used an I210 revision 3.  Unlike I225 and I226, the
published I210/I211 register definitions do not expose self-clearing
injectors for these corrected ECC memories.  The three counter sysctls
were present and remained zero under line-rate traffic and three fatal
LAN parity recoveries.  PBECCSTS.ECC_ENABLE remained set after every
reset.  Actual corrected-error accounting was therefore not injected.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Recover from I350 memory errors

I350 reports uncorrectable internal memory errors through ICR.FER and
identifies the affected region in PEIND.  Depending on the region and
memory, hardware stops transmit, receive, or all PCIe and DMA traffic
until the port is reset and reinitialized.

Enable FER and all regional indication masks.  Capture the read-clear
status in the interrupt filter.
Record the fatal PCIe, DMA, and LAN status registers, keep FER masked
while recovery is pending, and expose per-region indication counters.

Use the datasheet required port reset before master disable order for
PCIe parity errors.  Reset for PCIe, DMA, and traffic-affecting LAN
errors.  Statistics and VF-mailbox parity errors only require their
status to be discarded and cleared; management-memory recovery remains
under firmware control.

Validated on an I350 (8086:1521 revision 1).  Three software-set FER
interrupts each advanced the unknown-region counter once, requested a
single reset, restored carrier and traffic, and left FER rearmed without
a watchdog.  The software-set cause has no subordinate error status, so
region attribution and region-specific clearing remain datasheet-based.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Report corrected I350 ECC errors

I350 does not interrupt for corrected internal ECC errors.  Instead,
the PCIe, DMA, packet buffer, loopback, and management memories expose
sticky status bits in their region-specific status registers.

Sample those bits with the regular hardware statistics update, preserve
the RX and TX packet buffer ECC enable state while clearing RW1C
indications, and expose counters grouped by memory region.  Each counter
records observed indication bits rather than exact error counts because
repeated corrections between samples collapse into one sticky bit.

On an I350 (8086:1521 revision 1), the ECC enables remained set.  All
corrected-error status registers remained clear across boot, interface
down/up, three FER recovery resets, and bidirectional line-rate traffic.
The device has no documented corrected error injector.  Therefore, the
per-region paths were validated against the register definitions rather
than an injected SRAM error.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Recover from 82576 memory errors

82576 reports fatal and non-fatal internal memory errors through
ICR.FER and ICR.NFER and identifies the affected memory in its
native PEIND layout.  Fatal errors can stop transmit, receive, or
both until software resets and reinitializes the port.

Enable the controller-wide parity detector and implemented PEINDM
reaction bits after hardware initialization, while preserving unrelated
register state and omitting the absent IPsec memories on 82576NS.
Enable both interrupt causes and capture the read-clear PEIND register
in the interrupt filter.

Keep the causes masked while the iflib admin task owns the event.
Acknowledge non-fatal packet data errors without disrupting the port.
Request normal port reinitialization for FER, a fatal PEIND source, or
the memory hang indication.  Do not apply the later I210/I350 register
layout or their special PCIe parity reset order.

Hardware validation used a dual-port 82576EB revision 1.  Firmware
left PEINDM at its 0x80000000 default; initialization explicitly
programmed the parity-enable bit and produced 0xffffff07 on both ports.
An NFER during two-stream TCP sustained line rate without a reset,
watchdog, or carrier event.  FER on the linked and disconnected ports
each requested exactly one reset.  The linked port resumed the existing
TCP sessions after autonegotiation.  PEINDM and both interrupt causes
were restored after every reset.

The injections set the ICR causes without corrupting SRAM, so their
empty PEIND values deliberately exercised the unknown source path.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Report 82576 memory ECC errors

82576 exposes clear-on-read corrected error counters for RX, TX,
switch, IPsec, descriptor-handler, PCIe retry, PCIe write, and
MSI-X memories.  The packet and descriptor memories also count
uncorrectable errors.

Sample each status register exactly once from the regular hardware
statistics update and immediately before handling a memory-error
interrupt.  Group the counters by packet buffer, descriptor handler,
and PCIe region.  Skip the absent IPsec block on 82576NS.

PRBESTS and PMSIXESTS are shared by both LAN ports.  Attribute an
indication to whichever attached port samples the clear-on-read
register first so it is not counted twice.

Hardware validation used an 82576EB revision 1.  All nine implemented
status registers reported their ECC-enable bit set.  The sysctl
counters remained clear across interface lifecycle, two-stream
line-rate traffic, and NFER and FER cause injections.  Each reset
preserved the ECC enables while the driver restored PEINDM reactions.

ICR cause injection does not corrupt SRAM, and the only documented
data injector is specific to the IPsec packet buffer.  Exact counter
increments for the other memories were therefore validated against
the register definitions rather than an injected ECC error.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Recover from 82575 memory errors

82575 protects its packet buffer and receive and transmit descriptor
handlers with ECC.  Correctable errors are repaired in hardware.
Packet data errors are contained to the affected packet, while the
native RX_PBUR, TX_PBUR, RX_DHER, and TX_DHER interrupt causes report
unrecoverable packet buffer or descriptor handler state.  The affected
traffic direction remains stopped until software resets the port.

Enable the three ECC blocks and hardware memory error reaction after
queue and filter initialization.  Capture the clear-on-read status
registers in the interrupt filter and keep all four native causes masked
while the iflib admin task owns the event.

Request port reinitialization for every native PBUR or DHER cause.
Packet data errors that do not raise a native cause remain count-only
and do not disrupt the port.  The captured status registers provide
diagnostics and accounting but do not independently initiate recovery.

Hardware validation used an 82575EB revision 2 and the documented PBEEI,
RDHEEI, and TDHEEI injectors.  Correctable TX/RX packet data and
descriptor fetch/writeback errors preserved traffic.  Uncorrectable
TX/RX packet buffer header and descriptor fetch/writeback errors each
requested one reset, restored traffic, and rearmed every ECC control.
Repeated recovery produced no watchdogs.

MFC after:      2 weeks
Sponsored by:   BBOX.io

e1000: Report 82575 memory ECC errors

82575 exposes clear-on-read, saturating counters for corrected and
uncorrected errors in the packet buffer and the receive and transmit
descriptor handlers.

Sample all three status registers together from the regular hardware
statistics update.  When an unrecoverable event interrupts first, count
the values captured by the interrupt filter so the clear-on-read status
is not lost before the admin task handles it.

Expose packet buffer and descriptor handler counters under the existing
memory_errors sysctl node.

Hardware validation used an 82575EB revision 2 and the documented PBEEI,
RDHEEI, and TDHEEI injectors.  Correctable and uncorrectable TX/RX
packet-buffer errors and receive/transmit descriptor-handler errors
advanced the corresponding counters.  The controls and accounting
survived repeated recovery resets and an ordinary interface down/up.

MFC after:      2 weeks
Sponsored by:   BBOX.io

A media change can require a complete controller reset.  Resetting the
controller directly from the admin task leaves iflib rings, filters, and
interface state programmed for the pre-reset controller.

Request an iflib reset for every media change.  This already was done
when SR-IOV was active; use the same lifecycle for the ordinary PF case.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The reset helper discards reset_hw and init_hw errors.  Runtime
initialization then continues programming rings and filters, and iflib
publishes the interface as running even though the controller did not
reach a usable state.  Initial attach similarly continues into NVM and
MAC setup after a failed reset.

Return errors from the reset helper.  Fail attach when the controller
cannot be reset or initialized, and report runtime failures through
iflib_init_failed() so iflib leaves the interface stopped.  Also stop
register accesses and report the error when a stop-path reset fails.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The reset helper discards igc_reset_hw and igc_init_hw errors.  Runtime
initialization then continues programming rings and filters, and iflib
publishes the interface as running even though the controller did not
reach a usable state.  Initial attach similarly continues into NVM and
MAC setup after a failed reset.

Return errors from the reset helper.  Fail attach when the controller
cannot be reset or initialized, and report runtime failures through
iflib_init_failed() so iflib leaves the interface stopped.  Also stop
register accesses and report the error when a stop path reset fails.  A
later successful initialization completes pending fatal error cleanup
and re-arms FER.

Cache a requested MAC address before reset, but let init_hw program RAR0
after reset succeeds.  Let iflib perform its normal attach-post failure
cleanup instead of releasing the same driver resources from both layers,
and make queue cleanup idempotent.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The shared code provides e1000_check_phy_82574() to recognize a PHY
hang from saturated receive error and idle error counters, but em(4)
never calls it.

Run the check from timer driven admin work.  Match Intel e1000e by
requiring two consecutive positive samples before requesting a full
iflib reset.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The D100 device ID was defined and handled by aq_hw_capabilities(), but
had no entry in aq_vendor_info_array[], so the driver never probed it and
the card was left unattached.  Add the missing entry; the table lists the
fibre variant last within each group, so it follows D109 rather than
sorting numerically.

Signed-off-by: Nick Price <nprice@FreeBSD.org>
Accepted-by: adrian
Approved-by: adrian
(cherry picked from commit 4976b1d24abd6ff660e60041d1990b22c0bc2e5b)

aq_fw2x_thermal_arm() reached for a copper PHY register that the fibre
parts do not implement, so arming failed on every init and printed a
warning for a capability the hardware cannot have.  Return ENOTSUP when
the firmware does not advertise a temperature sensor, matching
aq_fw2x_get_temp(), and warn only for a genuine failure.

Signed-off-by: Nick Price <nprice@FreeBSD.org>
Accepted-by: adrian
Approved-by: adrian
(cherry picked from commit 3c7f1aa3b831431193106f8610b2142131d774f5)

Reviewed by:  mhorne
Differential Revision: https://reviews.freebsd.org/D57175

This change implements the core clknode methods for the SpacemiT K1
clock control units. These methods were used to implement drivers
for the APMU and PLL CCUs. The initial driver for the APMU CCU
only contains clock definitions for the SDHCI controller for now.

Differential Revision:  https://reviews.freebsd.org/D57176
Reviewed by:    mmel, mhorne, manu

Reviewed by:  mhorne
Differential Revision:  https://reviews.freebsd.org/D57178

style(9): sys/param.h, then sys/systm.h, then the remaining kernel
headers alphabetically.  imgact.h belongs before proc.h.

Reported by:    jhibbits
MFC after:      1 month
Reviewed by:    jhibbits
Differential Revision:  https://reviews.freebsd.org/D58884

When crypto_dispatch() or crypto_dispatch_async() returns non-zero,
the registered callback is never invoked. In both ovpn_transmit_to_peer()
and ovpn_udp_input(), if_ovpn.c did not free the cryptop request, release
the peer/sc reference count, or free the mbuf on dispatch failure.

This results in three simultaneous leaks per failed dispatch:
- crp allocated via crypto_getreq() is never freed
- peer->refcount (encrypt) or sc->refcount (decrypt) incremented but
  never decremented
- mbuf passed to crypto_use_mbuf() is never freed

The leaks are reachable under memory pressure when the OCF scheduler
returns ENOMEM from crypto_dispatch(). The registered callbacks
(ovpn_encrypt_tx_cb, ovpn_decrypt_rx_cb) correctly handle crp_etype
for crypto operation failures; this fix addresses the separate
dispatch-level failure path where no callback is invoked.

Found during code review following FreeBSD-SA-26:52.if_wg.

Reviewed by:    kp
Differential Revision:  https://reviews.freebsd.org/D58754

10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber.  The optics must be paired so that
the transmit and receive wavelengths cross over.

MFC after:      2 weeks

Add missing TF_DISCONNECTED bit.

Reported by:    Hannes Elfert
Fixes:          https://cgit.freebsd.org/src/commit/?id=40dbb06fa73c ("inpcb: retire INP_DROPPED and in_pcbdrop()")

Initialize all three hashes (exact, wild, load balance group) with a per-
bucket lock.  Nothing changes for the packet lookup KPI - it still uses
SMR section for thread safety.  But connect(2) and bind(2) operations gain
parallelism now.

The main concept is that as we lookup inpcb database for editing, we are
accumulating bucket locks necessary to accomplish the operation.  Once all
lookups are complete and we are good to go, the inpcb is inserted (or
moved) and accumulated lock context is released.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58131

When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.

To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.

All of the above applies to the v6 case.

Reported by:    Daniel Birtwhistle
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

led(4) invokes driver callbacks while holding its mutex, including
from a callout.  iflib_led_func() cannot acquire the sleepable context
lock in those contexts without causing a lock-order reversal or sleeping
from the callout.

Record the latest requested state under the iflib state lock and
enqueue the existing per-device taskqueue.  The task can safely take
the context lock before invoking the driver.  Coalescing requests also
avoids accumulating stale blink transitions when hardware access is
slow.

Destroy the LED device before draining its task so no new callback can
race driver detach.

MFC after:      2 weeks

When a driver implements ifdi_led_func, have the framework create its
led(4) device after attach completes and the ifnet and context locks are
released.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246885
Reported by:    jlduran
Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D32389

A driver class may implement LED control even though the capability is
not available on every device or firmware version it supports.  Add an
optional capability method and consult it before creating the led(4)
device.  Default to supported so existing providers are unchanged.

This will be used by bnxt which blends PF and VF in the same driver.

MFC after:      2 weeks

Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one.  Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ddd850aa7720 ("sys/socket.h: Fix AF_MAX")
MFC after:      3 days
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    pouria, kevans, glebius
Differential Revision:  https://reviews.freebsd.org/D58826

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58646

for SADB_UPDATE op SADB_X_EXT_NEW_ADDRESS_SRC/DST extensions, by
checking the sa_len matching the address family requirements before
doing the copy.

Also convert KEY_SETSECASIDX() and KEY_SETSECSPIDX() to functions and
apply the sa_len clamping there.

See https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297264
Tested by:      Wafa Hamzah <wafah@nvidia.com> (previous version)
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58646

Noted and reviewed by:        markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58646

- Fixed memory leaks around m_dup() not freeing the original chain on
  failure. If we return ENOMEM, we are expected to have freed the
  chain, else the mbuf would be leaked. Also updated iflib_ether_pad()
  to follow the same structure.

- In iflib_parse_header()
    o Fixed a bug where the ip/ip6 and th pointers may point into a
      freed chain after m_pullup.  Those pointers must be reset to
      point into the new chain.

    o Eliminate ENXIO returns for non-TCP TSO sends (which would violate
      the mbuf ownership contract if they could happen). Since they
      cannot happen, I made them assertions instead.

- in iflib_ether_pad(), return ENOMEM after freeing mbuf, so that
  mp_ring knows it is free. An ENOBUFS error will cause the mp_ring
  path to retain the mbuf and retry

- in iflib_encap():
     o Fix a leak when bus_dmamap_load_mbuf_sg() returns ENOMEM
     o Fix a use-after-free in the mp_ring path when a driver using
       ktls frees an mbuf and returns ENOBUFS via iflib_encap()

After this change the expection from iflib_encap is that:

mp_ring: ENOBUFS can be returned only when we run out of descriptors
         (ENOBUFS causes mp_ring to retain the mbuf).

simple_tx: iflib_encap() always consumes the mbuf, regardless of the
           return

Note that iflib_debugnet_transmit(), like simple_tx, expects that
iflib_encap() always consumes mbufs.  This will be true after mp_ring
is removed, and its such a rare special case (overrunning the ring
during panic dumps) that I don't think its worth fixing in the
meantime.

Sponsored by: Netflix
Reviewed by: kbowling, sumit.saxena_broadcom.com
Differential Revision: https://reviews.freebsd.org/D58843
Fixes: https://cgit.freebsd.org/src/commit/?id=074ff8746388

lookup_route is only called for outgoing traffic, therefore
check nh_ifp index instead of nh_aifp as specified by RFC3542 sec 6.

Differential Revision: https://reviews.freebsd.org/D58544

Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.

Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58722

iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change.  This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.

Drain the entire private taskqueue before ether_ifdetach().  Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.

MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58452

Co-authored-by: Andrew Gallatin <gallatin@FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling@FreeBSD.org>

Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.

Use a bounded delay to keep the task active while detach enters the
taskqueue drain.  Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().

Reviewed by:    gallatin, kgalazka
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58720

The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths.  ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task.  Even with MSI-X, the admin
interrupt was established before the task was initialized.

Initialize it alongside the other private tasks.  The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.

MFC after:      2 weeks
Sponsored by:   BBOX.io

When getting some baseline ALTQ numbers, I noticed that
if simlple_tx is enabled in kenv, we wind up re-setting the transmit
routine, but I neglected to actually clear ctx->ifc_sysctl_simple_tx.
That leads to many different panics as we run a mixture of mp_ring
and simple_tx.

Pointy-hat to: gallatin
Sponsored by: Netflix

Allow disabling RXCSUM and RXCSUM6 on an epair interface. If disabled,
epair unsets the mbuf flags that indicate a valid checksum when
transferring a packet from one epair end to the other. This gives a
user in a jail the power to control whether the user wants to use the
result of a previous validation (by a physical interface) or not.

Reviewed by:            kp, tuexen
MFC after:              1 month
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D58786

I need to do more work before references can be accepted in other
sections of the code. This was an unnecessary drive-by change that was
not tested in `make universe`.

Reported by:    CI
Fixes:  https://cgit.freebsd.org/src/commit/?id=fd809148 ("pmc(8): resolve -Wshadow issues")

nuageinit: adopt cloud-init disable_root semantics

disable_root now restricts root's authorized_keys instead of setting
PermitRootLogin.

Reported by:    np@

nuageinit: fix ssh_pwauth string handling

Treat "no"/"unchanged" correctly instead of any non-nil value as yes.

nuageinit: accept lock_passwd for users

Alias cloud-init lock_passwd key alongside locked.

nuageinit: support allow_public_ssh_keys

Skip importing datasource public keys when set to false.

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D58636

bhyve: namescope virtio_msix to virtio.msix

The bhyve_config(5) variable `virtio_msix` is namescoped to
`virtio.msix`. Configurations that have the old variable will
automatically be mapped to the new one, with a warning message printed
out.

Relnotes:       yes
Reviewed by:    ziaee, markj
Differential Revision:  https://reviews.freebsd.org/D58390

fbsdrun_virtio_msix(): update virtio_msix to virtio.msix

Fixes:          https://cgit.freebsd.org/src/commit/?id=2d985d577d79 ("bhyve: namescope virtio_msix to virtio.msix")
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58787

Allow "legacy" alongside "none" as a valid value for the ZFS mountpoint
property, matching zfsprops(7).

Reviewed by:    imp, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58781

nuageinit_user_data_script references 'firstboot_freebsd_update'
and 'firstboot_pkg_upgrade', which are from Ports. In a default
base system test without sysutils/firstboot-freebsd-update and
sysutils/firstboot-pkg-upgrade, rcorder will warn on "unknown
provisions" to stderr, but is otherwise harmless.

Reviewed by:    arrowd
Fixes:          https://cgit.freebsd.org/src/commit/?id=16e47f317c4ce2be5fed530bf8a9af9f9bf55364
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Co-authored-by:       Michael Osipov <michaelo@FreeBSD.org>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280487
Reviewed by:    kevans, michaelo
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D46313

rtld has always been built PIC since commit
7ca8e6a67068e8357e251bd3ea86253c8a751d59.  The stale #ifdef might
confuse a reader by thinking rtld can be built as non-PIC.

Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D58623

The name of the script and the name used internally for rc.conf differ,
as such the hardcoded disabling of service jails for the didn't work.
Fix by using the correct name.
Fixes:          https://cgit.freebsd.org/src/commit/?id=f99f0ee14e3af rc.d: add a service jails config to all base system services

We have ports and basesystem services, where the internal name and the
filename differ. While the documentation recommends to keep them in
sync, the reality is different. For service jails use the basename of
the service filename.
Fixes:          https://cgit.freebsd.org/src/commit/?id=2efbd48 rc: add service jails framework
Suggested by:   joneum
MFC after:      1 week
MFC to:         stable/15

nfsd: Update the rc.d script for RDMA for the nfsd service

Commit 7144a1d58c5c added the hooks for the nfsrdma.ko module.
Once loaded, this module adds RDMA support to the nfsd.

This patch adds a few lines to /etc/rc.d/nfsd, so that
nfs_server_rdma_enable="YES"
in your /etc/rc.conf will load nfsrdma.ko, so that RDMA
service is enabled.
It also supports
nfs_server_rdma_listen="port#"
so that the default of 20490 can be overridden in /etc/rc.conf.

At this available as time, the nfsrdma.ko module is an unofficial port,
since it was developed by Vinicius Ferrao <ferrao@versatushpc.com.br>
using generative AI.
As soon as it is available, it will be announced on
freebsd-current@freebsd.org.

Suggested by:   Vinicius Ferrao <versatushpc.com.br>
MFC after:      1 month

rc.conf: Fix the default NFS-over-RDMA port number

The default for nfs_server_rdma_listen transposed two digits: 20490
instead of 20049, the IANA-assigned port for NFS-over-RDMA.

Fixes:  https://cgit.freebsd.org/src/commit/?id=471e14267bea ("nfsd: Update the rc.d script for RDMA for the nfsd service")
MFC after:      1 month
Sponsored by:   VersatusHPC
Pull Request:   #2371
Signed-off-by:  Vinícius Ferrão <ferrao@versatushpc.com.br>

Currently, sending SIGTERM to the bhyve process triggers ACPI poweroff
for a VM. However, when running bhyve in monitor mode (-M), there are
two processes: the monitor process and the actual VM process. Sending
SIGTERM to the VM process works as before -- it powers off the VM.
But sending SIGTERM to the monitor process just kills the monitor
process, leaving the stale VM process running.

Fix that by creating a pipe between these two processes. The child
process uses the pipe to detect when the monitor goes away, and exits
automatically.

MFC after:              2 weeks
Reviewed by:            markj
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58788

bsdconfig: add datetime module for live system clock

Provide bsdconfig datetime (menu), date, and time to set the running
system clock via dialog(1)/bsddialog(1) --calendar and --timebox with
mustberoot.  Unlike bsdinstall's time helper, this operates on the live
system rather than a CHROOT-staged install target, and calls
adjkerntz(8) after a successful change so the CMOS stays in sync.

Reviewed by:    bcr
Differential Revision:  https://reviews.freebsd.org/D58487

mtree: usr: add missing bsdconfig datetime directories

8cfe06ee4415 installs into 085.datetime and share/bsdconfig/datetime,
but those paths were not in BSD.usr.dist. In-place installworld then
fails when install(1) cannot create the destination.

Fixes:  https://cgit.freebsd.org/src/commit/?id=8cfe06ee4415 ("bsdconfig: add datetime module for live system clock")

Merge implementation of "traceroute -e" to traceroute6 for TCP/UDP/SCTP.

MFC-after:      2 weeks

On ZAC drives, conventional zones conventionally report a write pointer
LBA of 0xffffffffffff. This field is 48 bits wide, unlike ZBC's 64 bits.

Recognize both ZAC and ZBC all-ones behaviour in the WRITE POINTER LBA
field to indicate non-valid information.

Tested by:      fuz
Discussed with: fuz, asomers, ken
Fixes:          https://cgit.freebsd.org/src/commit/?id=4735ef6196bc ("zonectl: display conventional zones better")
MFC after:      2 weeks
Sponsored by:   Google Summer Of Code 2026
Reviewed by:    asomers
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2345

Signed-off-by:        Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

Signed-off-by:        Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

libsysdecode: add attribute parsing for PFNL_CMD_GETRULES

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

libsysdecode: use decoder table for PF netlink commands

Introduce a PF netlink command decoder table mapping PFNL commands to
their attribute decoder sets. This replaces the existing switch-based
dispatch and makes it easier to add support for additional PF netlink
commands.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

libsysdecode: avoid extra commas for undecoded netlink attributes

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

libsysdecode: verify decoder tables are sorted

Add assertions to validate decoder table ordering required by
binary search.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp

We already verified that the attribute parser tables were correctly
sorted. Now also verify that the command decoders are too.

While here move the assertions into a constructor so we only run them once.

libusb: versioning symbols

Reviewed by:    bapt, kevans
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D55686

libusb: Mark defualt smybol tag as latest stable version

As we might change the libusb ABI in 16, we should mark thje first
version as FBSD_1.8 instead of 1.9. Since versioning patch has not
landed for a long time, it makes sense to change it directly.

Discussed with: kib
Fixes: https://cgit.freebsd.org/src/commit/?id=527a82474cb3 ("libusb: versioning symbols")
Sponsored by:   The FreeBSD Foundation

Several standard library functions are specified to return an unqualified
pointer while accepting a pointer to a potentially const-qualified object.
N3020 addresses this behaviour, discarding qualifiers due to incompatible
pointer types, by introducing qualifier-preserving macros for the affected
set of standard library functions.

Add `__qualsel()` helper to `<sys/cdefs.h>`, implemented using the generic
selection, and define qualifier-preserving macros for that set of functions
in `<string.h>`, `<wchar.h>`, and `<stdlib.h>`.

Macros are gated on `_STDC_VERSION__ >= 202311L && !__cplusplus`, therefore
there is no behavioural change for earlier C modes or C++ translation units.
The kernel is likewise unaffected, as it does not include userland headers.

As function-like macros, they are transparent except at a call site where
the address-of operator is applied, the macro is suppressed via `#undef`,
or the identifier appears in parenthesised form; all of which cause the
underlying function designator to be used instead.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2288

In Linux these are maintained in separate places so a separate copy is
needed, but in FreeBSD take advantage of the shared tree to avoid
having a duplicate copy that can be stale.

Reviewed by:    np
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D58575

Tables that have one element per protocol or address family were
previously sized by AF_MAX + 1 since AF_MAX was off by one.  Now that
AF_MAX has been corrected, we need to apply the opposite correction to
these tables.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ddd850aa7720 ("sys/socket.h: Fix AF_MAX")
MFC after:      3 days
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D58827

FreeBSD's libusb has three components: libusb01, libusb10, and libusb20.

libusb20 handles communication with character devices. We now requires a
backend context for libusb20. The backend context contains contains the
capsicumized usbctrl fd and usb directory (/dev/usb) fd so that the
library user can enter the capiblity mode safely while using libusb.

libusb10 is updated to support capabilities via a context option. Since
libusb allows general read/write access, we preserve all possible
capabilities when passing backend context to libusb20. It is the
responsibility of the libusb user to call cap_enter() at an appropriate
time.

All base system tools using libusb and libusb20 have been updated to
support Capsicum.

Reviewed by:    adrian, markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D51865

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296234(exp-run)
Relnotes:       yes
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57772

Reviewed by:  fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58842

Define the __STDC_VERSION_STDIO_H__ feature test macro now that
the header fully conforms to C23.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58842

When fts_read() descends into a directory whose children were
already prefetched by fts_children() (as ls -R does), it changed
directory using p->fts_name instead of p->fts_accpath.

With a trailing slash on a relative root path (e.g. 'dir/'),
the bare name was resolved relative to the wrong directory, so
every sibling directory after the first failed with ENOENT and
was reported as FTS_DNR.  This manifested as 'ls -lR dir/'
skipping the contents of all but the first subdirectory.

Restore the use of p->fts_accpath, matching the behavior prior
to 4bd01d6ae016.

Add a regression test that reproduces the exact conditions:
fts_children() on each directory, FTS_PHYSICAL without
FTS_NOCHDIR, and a trailing slash on the root path.

Reported by:    Michael Butler <imb@protected-networks.net>
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=4bd01d6ae016
Sponsored by:   Google LLC (GSoC 2026)
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2372

This change adds wrappers for the new fine-grained TLB invalidation
instructions and extends the capability detection logic to include
the Svinval extension, which is mandatory in the RVA23S64 profile.

Event:  BSDCan 2026
Differential Revision:  https://reviews.freebsd.org/D57623
Reviewed by:    mhorne, markj

unix: Fix a missing initialization in uipc_sosend_stream_or_seqpacket()

This could be triggered by an in-kernel sender, of which I can't find
any examples.

Fixes:          https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by:    glebius
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58673

unix: Simplify uipc_detach()

uipc_close() handles detaching a unix socket from the vnode to which
it's bound, if any, so doing the same in uipc_detach() is redundant.
Moreover, it's conceptually wrong that uipc_detach() might need to
handle this: detach happens when there are no remaining references to
the socket, and that should include the vnode's reference, even though
it's not explicitly counted.

No functional change intended.

Reviewed by:    John Ericson <inquire@JohnEricson.me>, glebius
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58675

unix: Fix some bugs in the SOCK_STREAM receive path

The main problem is with the handling of errors from unp_externalize().
It turns out that this was quite broken, and unfortunately it's easy to
trigger such errors (e.g., by setting a low per-process fd limit with
setrlimit()).

In non-peek mode, uipc_soreceive_stream_or_seqpacket() cuts a bunch of
mbufs from the head of the socket buffer,  to be consumed by userspace.
When unp_externalize() returns an error, we splice the removed mbuf
chain back onto the head of the socket buffer.  This is expensive, but
that's ok since such errors are rare.

The problem is that this cutting is not correctly implemented: it does
not clear the "next" pointer for the last mbuf in the chain, so it
still points to the first mbuf still resident in the socket buffer.
This means that mc_init_m() creates a chain that still includes the rest
of the socket buffer, so splicing the chain back into the socket buffer
does not work properly.

Fix this: fully detach the control chain from the socket buffer so that
we can safely use mc_init_m().  Then, incrementally add data mbufs,
taking care to handle "part".

Fix some related bugs while here:
- Don't swallow the error if unp_externalize() fails and there's nothing
  left in the socket buffer (i.e., control->m_next == NULL).
- Roll back changes to the partially read mbuf.

Reviewed by:    glebius
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58695

unix: split unp_connectat() in two

Factor the second half — connecting to an already-resolved peer PCB —
out into a new `unp_connect_peer()`, leaving `unp_connectat()` with the
connection state machine and pathname resolution.  No functional change.

The helper's contract: the caller guarantees stability of the peer PCB
(vnode lock plus `unp_vp_mtxpool` lock for peers found via
`VOP_UNP_CONNECT()`), has set `UNP_CONNECTING` on the connecting socket,
and clears it again on error; the helper clears it on success.

This prepares for connecting to a peer named by something other than a
pathname.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58404

unix: factor unp_sun_path() out of bind and connect

Extract the AF_UNIX validation plus sun_path/length lookup shared by
`uipc_bindat()`, `unp_connect()`, and `unp_connectat()` into a helper that
hands back the path pointer and its length.  Each caller keeps its own
empty-path policy and, where needed, its own copy of the path.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58459

unix: pin the pathname peer by reference across the connect

In the pathname path of `unp_connectat()`, take a reference on the peer
socket under the per-vnode `unp_vp_mtxpool` lock, drop that lock, and
`vput()` the vnode *before* calling `unp_connect_peer()`, rather than
holding the vnode lock across the connect.

`unp_connect_peer()` already accepts "a reference on the peer socket" as
a stability guarantee (it is exactly what the descriptor path relies on),
so this is behaviour-preserving.  The payoff is that no vnode lock is held
across the connect, which removes the delicate `MPASS(!(return_locked &&
connreq))` "vput() must not sleep while the peer is locked" invariant on
the datagram fast path.

That reference then has to be released, and for the reasons described in
the code, this can only safely happen *after* the PCB is unlocked. The
boolean flag is replaced with a nullable out pointer to return the
reference to the caller so that it can carry out this responsibility.

No functional change intended.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58460

unix: factor unp_vnode_peer() out of unp_connectat()

Move the "resolve a locked vnode to the referenced peer socket it names"
block into a helper.  Pure code motion: the caller now calls
`unp_vnode_peer()` and keeps the `vput()`/connect/`sorele()` sequence.

No functional change intended.

Note: This refactor isn't really necessary as `unp_vnode_peer()` will
only be called once throughout this entire patch series. I am just
including it out of my personal preferences for decomposing tasks into
smaller functions --- we can skip this patch if the reviewers don't like
this.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58461

unix: factor unp_connectat_peer() out of unp_connectat()

Move the "resolve a connectat(2) target to a referenced peer socket"
half of `unp_connectat()` -- the `namei()` lookup and `unp_vnode_peer()`
call -- into a helper, leaving `unp_connectat()` with the connection state
machine plus a single `unp_connect_peer()`.

This is where the next change grows the ways a peer can be named; keeping
it a helper up front keeps that change focused on the new resolution
logic.

No functional change intended.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58462

unix: allow connectat(2) to name the peer socket by descriptor

Accept an empty `sun_path` when `fd` is not `AT_FDCWD`: the descriptor
then names the peer unix socket directly, instead of being the starting
directory for a pathname lookup.  The held file reference keeps the peer
PCB stable, playing the role `unp_vp_mtxpool` plays in the pathname
path.

The descriptor must carry `CAP_CONNECTAT` and refer to an `AF_UNIX`
socket (`EPROTOTYPE` otherwise, `ENOTSOCK` for non-sockets).  As with a
pathname, a stream/seqpacket peer must be listening.  No filesystem
permission or MAC vnode check applies on this path: possession of the
descriptor is the authorization, as with descriptor passing.

Note this makes it possible to connect a datagram socket to an unbound
peer, which no pathname could previously name.

`connect(2)` and the implicit-connect send path pass `AT_FDCWD` and
still reject an empty path with `EINVAL`.

The `unp_sun_path()` call is hoisted out of `unp_connectat()` because the
early exit conditions for the two system calls (`connect(2)` and
`connectat(2)`) are slightly different.

Additionally, support `/dev/fd/<N>`. In a world with `connectat(2)`,
this is largely overkill, but this also allows me to add support for
direct peer connections with plain `connect(2)`. I think that is a wise
choice because this will allow me to propose this functionality for
Linux too without a new system call (saving that conversation for
later). Ultimately, I want to see multiple operating systems support
this to foster broader userland adoption, which should benefit everyone
including FreeBSD --- it's nicer if more 3rd party in addition to 1st
party software uses the new kernel functionality. Therefore, I hope this
additional feature is also acceptable.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 months
Differential Revision:  https://reviews.freebsd.org/D58405

unix: only treat an empty sun_path as a peer descriptor for connectat(2)

connect(2) passes AT_FDCWD to unp_connectat(), so the empty-path
descriptor branch added in 6563dcb6b1f5 turned any sockaddr whose
sun_path begins with a NUL byte into getsock(AT_FDCWD), failing with
EBADF where the pathname lookup historically failed with ENOENT.

Linux abstract namespace names are exactly that: the linuxulator
passes them through with the leading NUL intact, and libxcb tries the
abstract socket first, falling back to the pathname socket only on
ENOENT or ECONNREFUSED. The EBADF made every Linux X11 client fail
at startup with "Missing X server or $DISPLAY".

Restrict the descriptor interpretation to fd != AT_FDCWD, matching
the contract stated in 6563dcb6b1f5's commit message ("Accept an
empty sun_path when fd is not AT_FDCWD"): connect(2) again reaches
the pathname lookup and fails with ENOENT as it always did.

Add a regression test: a NUL-leading, nonzero-length sun_path through
connect(2) or connectat(2) with AT_FDCWD must fail the pathname
lookup with ENOENT, not EBADF.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6563dcb6b1f5 ("unix: allow connectat(2) to name the peer socket by descriptor")

Reviewed by:    John Ericson <John.Ericson@Obsidian.Systems>, markj
Differential Revision:  https://reviews.freebsd.org/D58792

`uipc_listen()` refused a socket that had not been bound, with
`EDESTADDRREQ`.  That made sense while a pathname was the only way to
name a peer: an unbound listener could never be reached, so allowing it
would only have created sockets nothing could connect to.  Now that
`connectat(2)` can name a peer socket by descriptor, an unbound listener
*is* reachable, and the restriction only stands in the way.  It also left
stream sockets oddly stricter than datagram ones, which could already
reach an unbound peer.

Dropping the check additionally permits `bind(2)` after `listen(2)`:
`uipc_bindat()` already allows this, as it only rejects re-binding a
socket that has a name.  That ordering closes a window listeners
otherwise have to leave open.  Today the socket file must exist before
the socket may listen, so a client connecting in between is refused;
binding afterwards publishes the name only once the socket is ready to
accept.

`unix_seqpacket_test:listen_unbound` asserted the old behaviour, and is
inverted accordingly.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    glebius, markj
MFC after:      2 months
Differential Revision:  https://reviews.freebsd.org/D58683

taskqueue KPI require wakeup() to be called for each completed
task.  With everything else there heavily optimized over the years,
even when doing nothing this wakeup()'s lock/unlock is significant.
Since no external taskqueue consumer can depend on the tq_mutex,
we can move the wakeup() out of it.  It creates some complications
for internal waiters, but those should be much more rare, and can
be handled with separate locked wakeups on demand.

My tests of taskqueue-intensive ZFS RAIDZ writes on 64-core system
show performance improvement from this change ~4%, while same time
reducing CPU usage by several percent due to lower lock contention,
confirmed by CPU profiler.

Reviewed by:          markj
Differential Revision:  https://reviews.freebsd.org/D58711

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296348
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58785

In some private discussion it was pointed out that vm_object_split()'s
pattern of dropping the source object lock looks dangerous in that the
initial assumption that OBJ_ONEMAPPING is set may become false.  In
practice I believe that the map lock holds this flag stable, but let's
assert that.

Reviewed by:    alc, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58766

SYSINIT: add explicit SI_ORDER_LAST

Working on cleansing use of (SI_SUB_FOO + 1) construct through the kernel
I found a repeating pattern.  Often a developer adds a module that depends
on certain subsystem to be fully instantiated and they want to put their
module SYSINIT right at the end of the SI_SUB_FOO.  Such module usually
expects that nothing else within this subsystem shall depend on the
module.

The problem with SI_ORDER_ANY which practically was "the last" until this
change is that it is used very widely and people treat it literally as
"any", well, because this is what the name says.  This lead to many parts
that could have dependencies later to be added as SI_ORDER_ANY.

So, our developer with the new subsystem that depends on SI_SUB_FOO has
three options:

1) Use SI_ORDER_ANY, but grep around ther kernel for other SI_SUB_FOO
entries to make sure that no dependencies are set to SI_ORDER_ANY.  And in
case they are, shift them up and recheck if dependencies of those
dependencies are met.

2) Take next subsystem in sysinit list.  However, the next one can be
SI_SUB_BAR, that is completely irrelevant from SI_SUB_FOO, and our
developer doesn't want to put his module's SYSINIT into SI_SUB_BAR, cause
it is ugly.

3) Use the (SI_SUB_FOO + 1) construct that violates -Werror=assign-enum.

The SI_ORDER_LAST solves this hard choice.  If you know that nothing is
going to depend on your module within SI_SUB_FOO, but you depend on
SI_SUB_FOO, just use SI_ORDER_LAST.

Reviewed by:            markj, emaste
Differential Revision:  https://reviews.freebsd.org/D58709

SYSINIT: add SI_SUB_FIRST

This allows to initialize mp_maxid, mp_ncpus and register APICs at the
most early stage, guaranteeing that those values will already be available
at SI_SUB_TUNABLES.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58712

SYSINIT: add SI_SUB_NUMA

This allows to parse ACPI tables and initialize VM domains before
SI_SUB_VM w/o a hack.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58713

rtnl_if_flags_to_linux() translated the usual IFF_* bits but dropped
FreeBSD's IFF_LOWER_UP (IFF_NETLINK_1).  Chromium's AddressTrackerLinux
only treats a link as online when ifi_flags has UP|LOWER_UP|RUNNING; with
LOWER_UP missing, online_links stays empty, ConnectionType is
CONNECTION_NONE, and navigator.onLine is false even though TCP/HTTPS
work.  Linux Chromium under the Linuxulator (e.g. www/linux-brave) then
shows a spurious Offline UI; sites that ignore navigator.onLine do not.
Native www/chromium is on a different notifier path.

Map IFF_LOWER_UP to Linux's IFF_LOWER_UP (1<<16) and define
LINUX_IFF_LOWER_UP alongside the existing LINUX_IFF_* constants.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297424

Reviewed by:    pouria, adrian (previous revision)
Differential Revision:  https://reviews.freebsd.org/D58774

video: fix v4l2_buffer size assert on non-i386 32-bit ports

Split the #else branch into an explicit __i386__ case (68) and a
generic ILP32-with-64-bit-time_t case (80) covering arm and powerpc.

Fixes: https://cgit.freebsd.org/src/commit/?id=0343ab8a6afa

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58790

video: add V4L2 compat symbols for ffmpeg/opencv

Adds v4l2_std_id, struct v4l2_standard/v4l2_plane, VIDIOC_G_STD/S_STD/
ENUMSTD, V4L2_STD_NTSC*, the MPLANE capability flag, multiplanar types
(VIDEO_MAX_PLANES, v4l2_plane_pix_format, v4l2_pix_format_mplane,
V4L2_TYPE_IS_MULTIPLANAR), V4L2_PIX_FMT_JPEG/YUV411P/SN9C10X, and the
MPEG control class (V4L2_CID_MPEG_BASE, V4L2_CID_MPEG_VIDEO_B_FRAMES).

video(4) capture devices are digital-only and never expose these, but
ffmpeg's libavdevice/v4l2.c and opencv's cap_v4l.cpp both reference
them unconditionally. Fixes their build against sys/videoio.h.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297454

Reviewed by:    manu, adrian
Differential Revision:  https://reviews.freebsd.org/D58793

video: bump __FreeBSD_version for video(4) refactor

Reviewed by:    manu, adrian
Differential Revision:  https://reviews.freebsd.org/D58798

Empty mchains cannot be copied with simple assignment.

I think this bug is mostly harmless: if mcnext is empty, then it won't
be accessed again before it is reinitialized in the next loop iteration.
So the bug only trips an assertion in INVARIANTS kernels and won't be
visible otherwise.

Add a regression test which triggers this corner case.

Reported by:    Jan Bramkamp
Fixes:          https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by:    glebius
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58791

Fixes:                https://cgit.freebsd.org/src/commit/?id=35164034e390 ("arm64/vmm: Make remaining registers use hypctx_*_sys_reg")
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58690

When the terminal cdev is closed due to revoke, ttydev_close() destroys
t_inpoll and t_outpoll selinfos.  Since corresponding knotes reference
files pointing to the same tty cdev, it fdrop()s them.  But then the
VOP_CLOSE() call would recurse into the ttydev_close() for the same tty.
More, because the devfs vnode is already doomed, each close call gets
the FREVOKE flag set.

As result, the kernel is recursing as deep into the ttydev_close() as
there are opened files referencing the same tty, which have the knotes
installed.  Basically, the recursion level is controlled by userspace.

Prevent it by marking the tty that is handled by ttydev_close(), with
the TF_INDEVCLOSE flag.  Do nothing in ttydev_close() when the flag is
already set, avoiding recursion.

Fixes:  https://cgit.freebsd.org/src/commit/?id=acd5638e268a ("tty: delete knotes when TTY is revoked")
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58706

This should provide much higher resistence against struct thread layout
changes for out-of-tree modules depending on linuxkpi.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58733

Since vmspace_iop()/proc_readmem() might return -1 on error from
vmspace_rwmem(), account for this and stop reading but return already
accumulated data if any, instead of returning an error.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297512
Reported and tested by: Stéphane D'Alu <sdalu@sdalu.com>
Reviewed by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=e1b0d051bbf7 ("proc: Allow to make proc_rwmem() operate on a consistent address space")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58838

In particular, if there were any bytes moved, and then vm_fault()
faulted, do not return an error, but report the short io instead.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297512
Reviewed by:    markj
Tested by:      Stéphane D'Alu <sdalu@sdalu.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58838

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297516
Reported by:    asomers
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Thanks to Vinicius Ferrao <versatushpc.com.br>, there
is now a module that implements the server side of RDMA
for the FreeBSD NFS server.

At least for now, it will be maintained as an "unofficial
port" for FreeBSD, since it was built with generative AI
and FreeBSD is working on a policy related to these submissions.

This patch puts the "glue" needed by Vinicius's nfsrdma.ko
module in the system.  This "glue" was written by me without
the use of AI.

The "unofficial port" of nfsrdma.ko will be advertised on
freebsd-current@ as soon as it is available.
(Vinicius's work was sponsored by VersatupHPC.)

Since newnfs_numnfsd is now declared extern in nfs.h,
the extern declaration can be removed from assorted files.
I'll do that as a separate commit.

Suggested by:   Vinicius Ferrao <versatushpc.com.br>
MFC after:      1 month

Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.

Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.

Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.

A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and
driver, matching normal deregistration, so a failed attach cannot leave
a stale /dev/iov node or make the next attach report EBUSY.

A successful attach_pre can now be followed by detach before driver
queue allocation. Make the remaining queue-backed interrupt cleanup
paths tolerate absent queue arrays.

Mark a failed registration as detaching before draining the entire
private taskqueue. Drivers can register configuration tasks there, and
taskqueue_drain_all() does not wait for work queued during its drain.
Make every current non-admin callback reject detaching contexts so late
work cannot touch driver state.

Drain tasks and call ether_ifdetach() with neither the ifnet nor context
lock held. A callback already running may need either lock, while
ether_ifdetach() acquires ifnet_detach_sx. Reacquire IFNET_WLOCK before
the context lock to preserve the established lock order.

The shared automatic core-offset allocator also lacked acquisition
state. Late registration failures leaked its reference, while normal
detach could decrement a reference belonging to another device when a
configured offset or allocation failure meant that this context never
acquired one. Record acquisition explicitly and release only references
held.

MFC after:      2 weeks
Reviewed by:    gallatin
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58721

static, not static inline, so TUs that don't call it warn.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58823

static inline, and powerpc's own must_bounce() never
calls it.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58825

linuxkpi: Include <linux/notifier.h> and <linux/device.h> from <linux/pm_qos.h>

The i915 DRM driver started to depend on the `bool` type implicitly
imported through these headers in Linux 6.13.

The previous fix committed in 67df313015906d84d90df8e37795885e81cf8da5
did not reproduce the same includes as Linux. This may have led to other
missing implicit definitions later.

To prevent another missing include in the future, we already include
<linux/plist.h> from <linux/pm_qos.h> and add it as a dummy header. This
will be easier to add a proper implementation in the future once we
actually need it.

Reviewed by:    bz, emaste
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57570

linuxkpi: Define `__GFP_HIGH` in <linux/gfp.h>

The DRM drivers TTM memory manager started to use it in Linux 6.15.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58760

linuxkpi: Add `kunit_fail_current_test()`

This is part of some unit testing framework.

The DRM drivers generic code started to use it in Linux 6.15.

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58249

linuxkpi: Define `PCI_CLASS_BRIDGE_HOST`

The i915 DRM driver started to use it in Linux 6.15.

Sponsored by:   The FreeBSD Foundation
Differential Revision: reviews.freebsd.org/D58250

linuxkpi: Fix return type of `kobject_uevent_env()`

The function returns an int on Linux. Let's return 0 (success).

Sponsored by:   The FreeBSD Foundation
Differential Revision: reviews.freebsd.org/D58252

linuxkpi: Create empty <linux/sprintf.h>

The DRM drivers generic code started to include this header in Linux
6.15, though nothing from it is used apparently.

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58253

linuxkpi: Include <linux/page-flags.h> from <linux/mm.h>

This reproduces the same namespace pollution as Linux.

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58761

linux: implement pkey_alloc, pkey_free and pkey_mprotect

Bridge the Linux memory protection key syscalls to FreeBSD's native
MPK support instead of returning ENOSYS. Modern Linux software
probes these at startup: Chromium-based browsers (found via
www/linux-brave) use protection keys for V8's heap and JIT
sandboxing, and glibc >= 2.27 exposes the full API.

pkey_alloc() allocates from a per-process bitmap kept in the process
emuldata (key 0 implicitly allocated, matching Linux's
mm_pkey_allocation_map; ENOSPC once keys 1..15 are exhausted or when
PKU is absent, as Linux returns on such hardware) and applies the
requested initial access rights to the calling thread's PKRU, located
in the XSAVE area via xsave_area_offset(). pkey_free() is
bookkeeping only: as on Linux, freeing neither untags pages nor
updates PKRU. pkey_mprotect() performs the protection change and
tags the range through amd64_pkru_update(), factored out of
sysarch(2)'s AMD64_SET_PKRU/AMD64_CLEAR_PKRU implementation so that
both share the same argument checking and map read lock
synchronization with a parallel pmap_vmspace_copy() on fork; tags die
with the mapping, matching Linux VMA semantics. A pkey of -1
degrades to plain mprotect.

The allocation map is inherited on fork and reset on exec. At exec
the Linux sysvecs initialize PKRU to 0x55555554, Linux's init_pkru
default (access disabled for keys 1..15), so memory tagged with a
not yet allocated key is inaccessible to threads that were never
granted rights -- the property V8's thread isolation relies on.
Setting PKRU at exec initializes the user FPU state slightly earlier
than the lazy first-use path; the state would be initialized moments
later in rtld/libc startup regardless. Protection key faults
already deliver SEGV_PKUERR through the existing siginfo
translation.

The common code carries no architecture ifdefs. Machine-dependent
state lives in struct linux_pemuldata_md, embedded in the process
emuldata in the manner of struct mdthread, and common code calls
per-arch lifecycle hooks (linux_pemuldata_init_md/_exec_md) and pkey
back ends after performing the parameter validation Linux applies
regardless of hardware support. On amd64 the implementation lives
in sys/amd64/linux/linux_pkru.c, compiled into linux_common and
serving both the 64-bit and 32-bit Linux ABIs. Elsewhere (arm64,
i386) linux_emul_md.c provides stubs returning what Linux returns on
hardware without protection keys (ENOSPC from pkey_alloc;
pkey_mprotect with a pkey of -1 acts as plain mprotect), so
applications take their normal no-PKU fallback instead of the ENOSYS
path.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297427
MFC after:      1 month
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58782

linux: unbreak arm64 linux_emul_md.c after pkey syscalls

linux_emul.h uses struct image_args without a file-scope forward
declaration.  The new arm64 (and i386) stubs include that header
without imgact.h first, which fails the build under -Werror.
Include it the same way linux_pkru.c already does, and declare the
type next to struct image_params so the header is self-contained.

Reported by:    tuexen
Fixes:          https://cgit.freebsd.org/src/commit/?id=bdb561843e86
MFC after:      1 month

The K1 user manual lists three separate SDHCI devices but the
upstream DTS file only defines the eMMC device.

Create a temporary overlay to allow the BananaPi-F3 to boot from the
SD card until this is addressed upstream.

Differential Revision:  https://reviews.freebsd.org/D57177
Reviewed by:    mhorne

If one of the source files we copy is non-writeable, cp will create a
non-writeable copy.  If the original is later modified, cp will fail to
overwrite the copy since it is not writeable.  Using cp -f ensures the
copy always succeeds, as long as the object directory is writeable.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.

Increase EFI partition size to begin rootfs at 64mb. I believe this was
my original intention. I have a microSD card with 8mb block size which
emits an advisory in verbose dmesg about the misaligned partition.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

uart(4), unix(4), veriexec(4), video(4) and the gzero(4) MLINK are
not USB things, but they were in the .if ${MK_USB} != "no" block.
So if we build with WITHOUT_USB, these man pages are lost.  Move
them out of the block.

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Document supported virtual-function families, driver features, queue
negotiation, PF-controlled policy, and media limitations.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Phabricator user names are not useful identifiers outside of
phabricator, don't use them if we can avoid it.

Reviewed by:  dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700

Reviewed by:  dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700

Reviewed by:  dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
Differential Revision: https://reviews.freebsd.org/D58700

There is no timeout period for merging from stable to releng branches,
so we should ignore "MFC after" tags.

While here, lift some uses of re.compile() out of loops.

Reported by:    des

In my repos the remote "freebsd" is git@gitrepo.freebsd.org:src.git.
In particular, the last component is delimited by a colon, not a slash.

Sponsored by:   Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D48951

Show the differences between local commits and their associated
Phabricator reviews, i.e., what "git arc update" would upload.  For
each commit, the review's current raw diff is applied to the commit's
parent in a temporary index and the resulting tree is compared against
the commit itself.  An empty diff means the commit and the review are
in sync.

This makes it easy to check whether local amendments have diverged
from the posted review before updating it, or to confirm that a
review is current before landing.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58789

Cover the new fd-direct connect path: stream connect and data passing,
the peer address reported by `getpeername(2)`, datagram to an unbound
peer, the `EINVAL`/`ENOTSOCK`/`EPROTOTYPE`/`ECONNREFUSED` error matrix,
and the Capsicum token semantics — a descriptor limited to
`CAP_CONNECTAT` can be connected to but not listened on, accepted from,
or read, and one lacking `CAP_CONNECTAT` cannot be a connect target.

Stream listeners are always bound: `uipc_listen()` refuses unbound
sockets with `EDESTADDRREQ`, so an unbound fd-direct listener is not
reachable even with this feature.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)

Reviewed by:    markj
MFC after:      2 months
Differential Revision:  https://reviews.freebsd.org/D58406

This test was already marked as always skipped.

Fixes:  https://cgit.freebsd.org/src/commit/?id=069a67374ed9641ff1ada2aecaac1cc61a560649
Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D58114

tests/netinet/socket_afinet: unroll multibind test into a table

The test has 6 dimensions: address family, socket type, socket option on
the first socket, socket option on the second socket, is first socket
bound to specific address or wildcard and is the second socket priveleged
or not.  Before the change 3 dimensions are implemented as 3 nested for()
loops, 2 dimensions are implemented as repetitions in the test body and
one dimension as two actions in the innermost loop.

I'm about to add one more dimension: whether the second socket is bound to
a specific address or wildcard instead of using first socket's
getsockopt(2) result.  Also, there is a change under discussion that would
make SOCK_STREAM sockets behave different to SOCK_DGRAM.  That would break
result consistency in the dimensions of socket type.

We expect that consistency in the dimension of address families shall
never break, thus this one remains a for() loop.  The priveleged & non-
privileged bind(2) attempts also remain as two actions, but expected
results are in the table.  The rest of dimensions are unrolled into a
table, which at the moment has quite a lot of lines with identical
results. However, as more tests are added and SOCK_STREAM behavior
changes, the table will get more mixed results.  Also, reading a test that
is written in a declarative manner a table is much easier and modifying it
is more resistent to accidential breakage.

Differential Revision:  https://reviews.freebsd.org/D58085

tests/netinet/socket_afinet: multibind second socket can be different

Allows to add tests to the table where the second socket doesn't take
address from the first.  No functional change yet, all tests test the same
conditions.

Differential Revision:  https://reviews.freebsd.org/D58087

tests/netinet/socket_afinet: add more tests to multibind

Add tests where first socket and second socket are bound to different
addresses, e.g. first specific and second wildcard and vice versa.

Mark success with SO_REUSEPORT on the second socket as a bug suspect.

Mark failure to bind to INADDR_ANY in presence of other UID's specific
bound socket to the same port as probably too strict.

Differential Revision:  https://reviews.freebsd.org/D58088

Fix a typo in the ZFS multi_dataset_4 test, where a path separator was
missing.

Reported by:    markj
MFC after:      1 week

Reviewed by:  fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2352

We created so many states that our bulk-sync occasionally caused epair
to drop packets, which in turn caused the test to fail. That's not what
we're testing here, make it more robust by creating fewer states.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297307
Sponsored by:   Rubicon Communications, LLC ("Netgate")

- s/pointr/pointer/

Obtained from:  NetBSD
MFC after:      3 days

Reviewed by:  fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2352

One is the parameter name.

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes

Security:       CVE-2026-72522
MFC after:      1 week

MFC after:    3 days

A native route Netlink interface will replace this stack.

Requested by:   glebius

This reverts commit 1ccf543b21eff6e0828142e5c1d09519247143f4.

This reverts commit 2c04cfa148ec4dd5cef7e228aaea6a05957fcb15.

This reverts commit 2d6114f6d26bf7dfa5ad94e1db9b09ee7108dc7a.

This reverts commit d15f2551b25f79ddcbe289faa95e655100b952da.

This reverts commit ceb282bbd62eed5e84df9abaede0dd183f66997a.

This reverts commit c30021fe0df9e045a17292dbe50dfc054b69871f.

This reverts commit fb1820d23a04856a6d3047b4c088cc8df8f76da1.

This reverts commit 8696cc600f44767e7988a92c8e6fb943e97d4cc7.