FreeBSD git weekly: 2026-08-17 to 2026-08-23

This is ABI-breaking change that could be considered as the bug fix.

Requested by:   David Timber <dxdt@dev.snart.me>
Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
Relnotes:       yes
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58942

Run the file-hierarchy traversal inside Capsicum capability mode
using the fts_openat(3) API.  This confines chflags to the directory
hierarchies named on the command line, so a malicious or buggy tree
cannot redirect it at files elsewhere via a crafted symbolic link.

Because AT_FDCWD is rejected in capability mode, a directory descriptor
for the parent directory of every argument with an absolute path or a
path containing ".." is opened once before cap_enter().  Once every
descriptor is open, cap_enter() is called and the traversal acts through
fd-relative operations: chflagsat(fts_parent->fts_dirfd, fts_name).

With -L chflags follows symbolic links, which may point outside the
named hierarchy; chflag now rejects such accesses.  The new
--dereference-links-unsafely option disables the sandbox to restore the
historical behavior for the rare callers that rely on it.  But if the
symbolic was link was named directly on the command line, chflags will
still follow it (unless -h was given).

Add functional tests covering relative, absolute, "..", recursive
and mixed path arguments, and the symlink handling in both the
default and --dereference-links-unsafely modes; they skip on
filesystems that do not support the uchg flag.

Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Relnotes:       yes (for the -L behavior change)
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2375

Our buffer is half a megabyte, but we are only initializing the first
two bytes.  Switching from static to dynamic initialization moves it
from .data to .bss, greatly reducing the size of the binary.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cf74b63d61b4 ("yes: Completely overengineer")
MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D58890

Run the file-hierarchy traversal inside Capsicum capability mode
using the fts_openat(3) API.  This confines chflags to the directory
hierarchies named on the command line, so a malicious or buggy tree
cannot redirect it at files elsewhere via a crafted symbolic link.

Because AT_FDCWD is rejected in capability mode, a directory descriptor
for the parent directory of every argument with an absolute path or a
path containing ".." is opened once before cap_enter().  Once every
descriptor is open, cap_enter() is called and the traversal acts through
fd-relative operations: chflagsat(fts_parent->fts_dirfd, fts_name).

With -L chflags follows symbolic links, which may point outside the
named hierarchy; chflag now rejects such accesses.  The new
--dereference-links-unsafely option disables the sandbox to restore the
historical behavior for the rare callers that rely on it.  But if the
symbolic was link was named directly on the command line, chflags will
still follow it (unless -h was given).

Add functional tests covering relative, absolute, "..", recursive
and mixed path arguments, and the symlink handling in both the
default and --dereference-links-unsafely modes; they skip on
filesystems that do not support the uchg flag.

Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Relnotes:       yes (for the -L behavior change)
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2375

Standardize driver manuals on the style used for 12 years in vt(4).
This brings SYNOPSIS across all FreeBSD manual sections into harmony
of meaning where where SYNOPSIS lists available options, and does not
contain prose. Adjust mdoc(7) to reflect the established convention.

Reviewed by:    jhb
Discussed with: arch@ (marc.info/?l=freebsd-arch&m=176782215606871)
Differential Revision:  https://reviews.freebsd.org/D54586

Point the identification LED documentation to led(4), which describes
how to control /dev/led device nodes.

MFC after:      2 weeks
Sponsored by:   BBOX.io

T2, T1, and some pre-T1 Macs advertise a legacy PIO
range in the SMC ACPI _CRS alongside a live MMIO window, but the
silicon behind the PIO range is bogus.

Try MMIO first, validate via LDKN >= 2, fall back to PIO if that
fails or no MMIO resource is present. Drop "(T2)" from the backend
message since MMIO isn't T2-exclusive.

MFC: 1 week
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D58839

The problem observed on X550 adapters with 2.5 and 5 Gbps speeds
negotiation on some switches is not affecting E610 adapters.
Remove workaround, which omitted those speeds in the list
of initially advertised speeds and advertise all speeds
supported by adapter.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    kbowling
Tested by:      Mateusz Moga <mateusz.moga@intel.com>
MFC after:      1 week
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D57339

Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.

Signed-off-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    erj
Tested by:      Mateusz Moga <mateusz.moga@intel.com>
MFC after:      1 week
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D57337

Cache PCM children and drain interrupt callbacks before detach.
Allocate the parent softc by its actual size.

Reviewed by:    br
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58370

Expose the firmware-controlled physical port identification LED
through /dev/led/ice*.  Use the AdminQ port-identification command to
select blinking mode and restore the netlist-selected original mode
before the interface is stopped.

MFC after:      2 weeks
Sponsored by:   BBOX.io

ufshci: return the real errno from SDB queue construction

ufshci_req_sdb_cmd_desc_construct() and ufshci_req_sdb_construct()
returned ENOMEM for every failure, so an EINVAL from bus_dma_tag_create()
was reported as a memory shortage. Capture and return the real errno,
and drop the cmd descriptor construct's now pointless out label.

No functional change: no caller inspects the value beyond propagating
it, so this only improves the diagnostics on an attach failure.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58815

ufshci: pass the queue being destroyed to the cmd descriptor teardown

ufshci_req_sdb_destroy() hardcoded &ctrlr->transfer_req_queue when
destroying command descriptors instead of using its req_queue argument.

No functional change: the branch only runs for the transfer queue, so
the two pointers are always the same today. Using the argument keeps
the function queue-agnostic for when more transfer queues exist (MCQ).

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58816

ufshci: validate the CDB before allocating a request

The CDB pointer and length checks depend only on the CCB, so perform
them before allocating and initializing the request. This avoids a
wasted allocation for invalid CCBs on the I/O path and removes one
request-free error path.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58817

ufshci: consolidate the device query submit/poll pattern

The six query helpers duplicated the same submit, error check, poll,
and status check sequence. Move it into ufshci_dev_send_query() so
future changes to the query flow are made in one place. This also
unifies the failure log message format.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58818

ufshci: correct the crypto/config register offsets and HCMID fields

The reserved array after CCAP must be 508, but it was 511.
This pushed the config, MCQ config, and ESI registers from 0x300 and
0x380 up to 0x900. None of these registers are used yet, so nothing
broke.

Also fix the HCMID bank index field. The spec places it at bits
[23:16], but it was defined on top of the manufacturer code at [15:0].

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58819

ufshci: report the highest LUN number in the path inquiry

cpi->max_lun is an inclusive upper bound, but the driver reported the
LUN count (8 or 32), so CAM probed one nonexistent LUN past the end.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D58820

At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable().  So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().

Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58859

Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk@intel.com>

Reviewed by:    kbowling, erj, milosz.linkiewicz_intel.com
Tested by:      Mateusz Moga <mateusz.moga@intel.com>
MFC after:      1 week
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D57642

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295453
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57500

bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.

In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.

vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297187
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58921

Add Gemini Lake LPSS SPI controller PCI IDs (0x31c2, 0x31c4, 0x31c6)
to intelspi_pci_devices[].

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58868

On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.

A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a94d it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher.  bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path.  x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim.  The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads.  Hosts whose maximum basic leaf is below
1Fh are unaffected, as the request is clamped to cpu_high before the
switch statement.

Leaf 1Fh uses the same level encoding as leaf 0Bh for the SMT and the
core level, so handle both leaves in the same case.  The module, tile
and die levels are not emulated and terminate the enumeration, exactly
as they already do for leaf 0Bh.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297475
MFC after:      1 week
Reported by:    Richard Straka <fntms@pryse.net>
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58885

Reviewed by:  bz
Sponsored by:   NVidia networking
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58941

The 82571 PBA_ECC register contains a 12-bit count of packet buffer ECC
detections.  The shared code enables single-bit correction, but neither
FreeBSD nor the DPDK base driver consumes the counter.

Sample it with the ordinary statistics timer, accumulate the value under
dev.em.N.memory_errors.detected_packet_buffer, and clear the hardware
counter while preserving correction and reserved register state.  Do not
enable its shared interrupt: the register does not distinguish corrected
from uncorrectable events and does not provide a safe fatal recovery
policy.

Validated on a dual port 82571EB.  Both functions reported zero after a
clean boot, and a controlled link down/up cycle left the counter at zero
while the management link recovered at 1 Gb/s without issue.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
attaching a matching USB WLAN device can drive writes past the absent array and
corrupt adjacent softc fields.

This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
endpoint queues the driver initializes and uses.

Fixes:          https://cgit.freebsd.org/src/commit/?id=c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")
Reviewed by:    bz
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58897

The rsu driver currently relies on a `KASSERT` to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without `INVARIANTS`, an oversized raw 802.11 frame can reach
`m_copydata()` and overwrite past that buffer, causing local kernel memory
corruption.

This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return `EMSGSIZE`, leaving the existing
caller cleanup paths responsible for freeing `m0`, `ni`, and the unused
transfer buffer.

Reachable via root / bpf access

Reviewed by:    bz, adrian
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58898

When 'Permit Total Port Shutdown' feature in BIOS is enabled then Port
Disable bit is set in the Link Default Override Mask TLV PFA module
in the NVM. In this mode, the driver acts as if the link_active_on_if_down
flag is always disabled and disallow any change to that flag.
This feature applies for E830 and E835 NIC series.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk@intel.com>

Tested by:      Mateusz Moga <mateusz.moga@intel.com>
MFC after:      2 weeks
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D58149

The `reg` value was never initialized, so the loop could potentially
abort without a single read of the register.  This was found by the
following warning from GCC:

sys/dev/thunderbolt/nhi.c: In function 'nhi_reset_v2':
sys/dev/thunderbolt/nhi.c:272:35: error: 'reg' is used uninitialized [-Werror=uninitialized]
  272 |         for (size_t i = 0; i < 10 && reg; i++) {
      |                                   ^~
sys/dev/thunderbolt/nhi.c:257:18: note: 'reg' was declared here
  257 |         uint32_t reg;
      |                  ^~~

Reported by:    GCC 15
Fixes:          https://cgit.freebsd.org/src/commit/?id=efdb82413963 ("thunderbolt: Reset controllers")

chn_trigger() calls bcmchan_trigger() with the channel lock held.
However, bcmchan_trigger() calls chn_intr(), which also tries to lock,
which results in a lock recursion panic. chn_intr() is meant to be
called by the interrupt handler and not inside CHANNEL_TRIGGER()
methods. Remove the call altogether, the bcm2835_worker_play_start()
call that comes after is enough.

Fixes:          https://cgit.freebsd.org/src/commit/?id=69cab2d1bfb5 ("Fix locking in bcm2835_audio driver")
Reported by:    Marco Devesas Campos <devesas.campos@gmail.com>
Tested by:      Marco Devesas Campos <devesas.campos@gmail.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59055

When the first page of a segment fits alignment, the second likely does
not, so the DMA infrastructure (must_bounce()) thinks it needs to bounce
the pages.  Fix this by passing the previous end (address of byte
following the previous segment) as a third argument to must_bounce(), so
that the alignment check is done against the start of a new segment if
and only if necessary, instead of the current page.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58627

Respect the `hw.sdhci.quirk_set` and `hw.sdhci.quirk_clear` tunables in
the QorIQ eSDHC driver.  This lets us tweak quirks for debugging or
platform specifics.

Migrate all PowerPC QorIQ to the sdhci_fsl_fdt SDHC driver.  There are a
few differences that need to be accounted for:
* On PowerPC device trees, the `clock-frequency` property defines the
  clock rate, not a `clocks` reference property.
* On some older SoCs (P1022 only?) the BURST fields of the WML register
  are reserved, and must be 0x10, so add a FSL quirk (errata field) to
  account for this.
* The PowerPC eSDHC controllers must have the DMA SNOOP bit set for DMA
  to work properly and avoid corruption.

As part of this, make the fallback "fsl,esdhc" compat data work for
PowerPC.  If these fallbacks are not compatible with ARM SoCs, newer
compat strings could be added for those, but the conservative catch-all
should work for most SoCs, though perhaps less optimal.

Differential Revision:  https://reviews.freebsd.org/D58630

fman_qman_channel_id returns the QMan FMan channel for a given port.
If a port isn't found, the wrong channel number will be returned.

* Add interrupt coalescing for DQRR and MR, with thresholds and period
  as tunable sysctls under the `hw.qman` tree.
* Do lazy/sloppy buffer management to avoid constantly checking
  thresholds via QMan portal round-trips.
* Add cache stashing to prewarm caches, reducing latency.
* Fix the definition of Context_A in the init_fq MC command/result
  structures, they're 64-bit fields, not 32-bit.
* Reorder the dpaa_eth_frame_info as a bit of cleanup.
* Take advantage of the fact that UMA small allocations are returned in
  the DMAP, and avoid pmap_kextract().

These changes together improve throughput by ~1.5%
(925Mbps->935-940Mbps) consistently, and reduce CPU usage by a bit,
increasing idle CPU from 30%->35% minimum.

Set the verb correctly so the query works.  Also print out the
programmable FQID fields as well.

Apply 6464974 to dTSEC, since it supports the same offload capabilities
as mEMAC.

The DPAA_CSUM_TX_OFFLOAD macro moves from if_memac.c to the shared
dpaa_eth.h since both drivers now reference it.

uaudio20_set_speed() split the sample rate into bytes by hand. Use
uDWord and USETDW() instead.

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59066

Fixes: https://cgit.freebsd.org/src/commit/?id=550db3d6f502 ("sdhci: Initial support for the SpacemiT K1 sdhci controller")
Reviewed by:    bnovkov
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59083

Any failure within bus_alloc_resources() will call bus_release_resources();
thus the call is redundant here.

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Fix reporting of state and capabilities by the gpioctl command.

Support selection of pull-up and pull-down resistors.

Support second gpio device (AON - always on power domain) to allow
attaching gpioled device to visionfive2 status LED or querying boot
selection switches.

Reviewed by:    mhorne
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58693

intelspi: sort PCI ID table by device ID

Sort the existing LPSS peripheral SPI controller PCI ID table by
numeric device ID so new entries have an unambiguous insertion point.

Reviewed by:    wulf
Differential Revision:  https://reviews.freebsd.org/D58996

intelspi: add Broxton SPI controller IDs

Add PCI device IDs for Broxton-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58997

intelspi: add Apollo Lake SPI controller IDs

Add PCI device IDs for Apollo Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58998

intelspi: add Cannon Lake SPI controller IDs

Add PCI device IDs for Cannon Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58999

intelspi: add Comet Lake SPI controller IDs

Add PCI device IDs for Comet Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59000

ofw_pcibus: Inherit PF locality for SR-IOV VFs

PCI VFs are allocated dynamically and have no corresponding OFW node.
The zero-filled OFW PCI devinfo currently leaves obd_node as 0, which
is not the invalid-node sentinel and can send NUMA lookup through an
unrelated firmware node.

Initialize dynamically allocated devinfo with an invalid OFW node. For
VF locality queries, use the owning PF's node when it exists. Fall back
to the PCI bus when neither the VF nor PF has a firmware node.

This preserves existing CPU-locality behavior for ordinary PCI devices
while making VF domain and interrupt placement follow their PF.

Reviewed by:    PowerPC (jhibbits)
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59064

pci: Expose a VF's owning PF to bus subclasses

ofw_pcibus now uses pci_iov_get_pf() to inherit PF locality for
VFs, but the accessor was inadvertently left in an uncommited ACPI
change.  This breaks powerpc builds.

Expose the accessor from the PCI core and provide a stub when PCI_IOV
is omitted.  Record VF ownership before pci_add_child() so child added
callbacks can safely query it, and remove the later redundant
assignment.

Fixes:          https://cgit.freebsd.org/src/commit/?id=f003e86335c9 ofw_pcibus: Inherit PF locality for SR-IOV VFs
MFC after:      2 weeks
Sponsored by:   BBOX.io

BUS_GET_DOMAIN can report a PCI function's firmware locality, including
an SR-IOV VF's inherited PF locality, but ordinary OFW PCI functions
still use the shared bus DMA tag.  Consequently, busdma metadata and
coherent memory can be allocated from the bus's domain instead of the
function's domain.

Create and cache a child tag for each function that requests a DMA tag
and apply its reported domain without modifying the shared parent tag.
Apply the same domain to the private IOMMU tag already created by the
pSeries PCI bus.  Destroy cached tags when PCI children are removed so
VF create and destroy cycles do not leak them.

Reviewed by:    PowerPC (jhibbits)
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59065

Cache PCM children instead of calling device_get_children() from the
interrupt handler.  Drain callbacks before child detach so cached
pointers cannot outlive the PCM softc.  Allocate the parent softc by
its actual size.

This mirrors snd_hdspe's interrupt dispatch and detach lifecycle.

Reported by:    christos
MFC after:      1 week

The TSO workaround splits the final DMA segment to create a four byte
sentinel descriptor.  Intel documents the premature descriptor writeback
erratum and this workaround in the 82540EP and 82545GM specification
updates (erratum 3) and the 82546GB specification update (erratum 1).

Limit the workaround and its preceding TSO state to the legacy PCI and
PCI-X controllers so PCIe controllers retain their natural descriptor
layout using one fewer descriptor per TSO packet, no split of the final
segment, and one less four byte DMA.

MFC after:      2 weeks
Sponsored by:   BBOX.io

intelspi: add Lakefield SPI controller IDs

Add PCI device IDs for Lakefield-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59001

intelspi: add Ice Lake SPI controller IDs

Add PCI device IDs for Ice Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59002

intelspi: add Jasper Lake SPI controller IDs

Add PCI device IDs for Jasper Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59003

intelspi: add Tiger Lake SPI controller IDs

Add PCI device IDs for Tiger Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59004

intelspi: add Elkhart Lake SPI controller IDs

Add PCI device IDs for Elkhart Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59005

intelspi: add Alder Lake SPI controller IDs

Add PCI device IDs for Alder Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59006

intelspi: add Raptor Lake SPI controller IDs

Add PCI device IDs for Raptor Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59007

intelspi: add Meteor Lake SPI controller IDs

Add PCI device IDs for Meteor Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59008

intelspi: add Arrow Lake SPI controller IDs

Add PCI device IDs for Arrow Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59009

intelspi: add Lunar Lake SPI controller IDs

Add PCI device IDs for Lunar Lake-generation LPSS peripheral SPI
controllers.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59010

Perform the allocations outside the lock section so that we can use
M_WAITOK. Holding the lock here is actually not really necessary and we
could just as well remove it, but keep it for consistency.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59079

The TX SG-build loop in dpaa_eth_if_start_locked() walked page
boundaries with PAGE_MASK arithmetic even for buffers that lived
entirely within one page -- the common case, since MCLBYTES
is smaller than PAGE_SIZE.  Add a fast path that emits a single SGT
entry for wholly-in-one-page segments and skips the inner while
entirely.

Fix the following bugs while we're here:

1. "if (m->m_len == 0) continue;" in the outer loop never
   advanced m -- any zero-length mbuf hung the TX path in an
   infinite loop.  Fix this by switching to a for loop, with the
   advancement in the post-clause.

2. In the inner (page-splitting) loop, the cap
   "if (m->m_len < ssize) ssize = m->m_len;" compared against
   the mbuf's original length, not the remaining bytes.  A single mbuf
   whose data started mid-page and ran into a second page would produce
   a second SGT entry with ssize > rem, over-reading past the buffer end
   into whatever followed in kernel memory.  Fixed by tracking a local
   rem and capping ssize against it.

3. If the whole mbuf chain consisted of zero-length segments,
   the final-flag store "fi_sgt[i - 1].final = 1" wrote to
   index -1.  Reject empty frames up front now instead.

As part of this, rename the inner counter from dsize to rem for clarity
instead of playing double-duty in both inner and outer loops.

* Set qman_channel_base after determining if QMan is v3, otherwise this
  global stays at 0x21, which messes up the shift in
  qman_portal_static_dequeue_channel().
* Fix the base shift in qman_portal_static_dequeue_channel(), there are
  only 15 channels available, not 16, so starting at a shift of 15
  yields shifting into the portal-specific channel.
* Correct vmem pool names for QMan resource pools.

82580 reports fatal parity and uncorrectable ECC errors through ICR.FER
and its four region PEIND hierarchy.  Region specific status registers
identify PCIe, DMA transmit, DMA receive, DMA host, and LAN port
memories that can leave traffic stopped.

Enable the documented DMA, PCIe, packet-buffer, and host-owned LAN
parity and ECC checks only after initializing queue and filter tables.
Leave the flexible filter parity controls under management firmware
ownership.  Capture read-clear and RW1C status in the interrupt filter
and keep FER masked until the admin task resolves the event.

Reset for a host-owned region or an unknown FER source.  Leave
management-only recovery to firmware.  Use CTRL.RST before master
disable because fatal 82580 memory errors can stop PCIe traffic.  Do not
use CTRL.DEV_RST: specification update item 9 declares that bit reserved
and says it must always be written as zero.  Wait for EEPROM auto read
completion; STATUS bit 21 is reserved on 82580, not PF_RST_DONE.

Validated on an Intel I340-T2 (82580, revision 1).  A one queue
port programmed LANPERRCTL as 0x6e00 while a four-queue port programmed
0x7e00, avoiding the RSS checker until RETA is initialized.  Both ports
programmed PEINDM 0xf, DTPARC 0x1555, DRPARC and DDPARC 0x55,
PCIEERRCTL 0x5555, and PCIEECCCTL 0x11.  Three down/up cycles left all
status and counters clear.

A synthetic ICS.FER event on each function caused exactly one
unknown source reset without advancing the sibling function counters.
Controls were restored, the linked port recovered carrier, and
bidirectional traffic after recovery.

Enabling flexible filter parity checkers before programming their
memories produced genuine LAN region faults with LANPERRSTS bits 0 and
1.  Each fault advanced fatal_lan and fatal_resets exactly once, left
the sibling function unchanged, and recovered the port proving hardware
events will trigger the intended recovery.

MFC after:      2 weeks
Sponsored by:   BBOX.io

82580 exposes clear-on-read, saturating corrected error counters for
the receive and transmit packet buffers.  Its two PCIe command memories
expose RW1C indications for uncorrectable ECC errors.

Sample the packet buffer counters and PCIe indications from the regular
hardware statistics update.  Fatal recovery samples the PCIe indications
from the serialized admin path rather than the interrupt filter.  Thus,
either the regular statistics pass or recovery reads and clears each
indication, but they cannot both account it.  Also preserve indications
observed while initialization is completing.

Expose the exact packet buffer error total and observed PCIe command
memory indications under the memory_errors sysctl node.  Multiple PCIe
errors between samples can collapse into one indication per memory.

Validated on an Intel I340-T2 (82580, revision 1).  A clean boot and
three down/up cycles left the packet-buffer, PCIe, and region-specific
counters at zero.  Synthetic ICS.FER events advanced fatal_unknown and
fatal_resets exactly once on the targeted function without changing the
sibling or ECC counters.

The 82580 datasheet exposes no ECC or parity error injection register,
so corrected packet buffer and PCIe ECC accounting could not be forced
independently.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The shared base code already selects and configures the 82598 BX,
82599 KR, 82599 SFP Express Module, X552 XFI, X553 QSFP, and X553 N
QSFP device IDs, but the FreeBSD probe table omits them while DPDK lists
them.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The RAPL probe read MSR_RAPL_POWER_UNIT with a bare rdmsr().  RAPL is not
enumerated by CPUID on either vendor and the register is absent on older
Intel and AMD parts and under a hypervisor that does not emulate it, so
the read raises #GP and loading hwpmc panics the machine.

Read it with rdmsr_safe() and return ENXIO when it is not there, as this
function already does for the energy MSRs.  Both callers already drop the
class when the probe fails.

Fixes:          https://cgit.freebsd.org/src/commit/?id=a99d04f39dab ("hwpmc: add RAPL energy-counter class (AMD + Intel)")
Assisted-by:    Claude Code (Opus 5)

An energy status unit of zero means one joule per raw tick, which no part
reports; it is what a hypervisor returns for an MSR it does not implement.
Both energy rows are scaled by that field, so the class would be
registered with counters that read zero forever.

Refuse it, as the class is already refused when no energy MSR responds.

Assisted-by:    Claude Code (Opus 5)

Validate the IVRS table and every subtable length before using either
to form iterator bounds. Reject truncated typed IVHD blocks instead of
passing them to a type-specific callback.

Within each IVHD payload, correct the lower-bound comparison for
extended range entries and validate fixed-size entries, paired range
terminators, the fixed HID body, and the variable HID UID before
dereferencing or advancing. Malformed firmware can no longer drive
either iterator beyond its enclosing object.

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58724

This would be used to switch to the "WiFi bank" before reading the rom.
The 8723bu will need this, currently a nop on all chips.

Differential Revision:  https://reviews.freebsd.org/D59106

The endpoints we want won't always be on interface 0. Instead, allow the
interface index to be specified in driver_info when probing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59107

When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296944
MFC after:      3 days

net80211: fix WEP transmit

This was broken in 2022 with a security fix (61605e0ae5d8f) which
disallowed defaulting to the default TX key if there's no unicast
key.  Unfortunately this path was also used by WEP transmit.

To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.

Fixes: https://cgit.freebsd.org/src/commit/?id=61605e0ae5d8f

Locally tested:

* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured

Differential Revision:  https://reviews.freebsd.org/D58854

net80211: add key get/set methods

Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.

Differential Revision:  https://reviews.freebsd.org/D58705

net80211: migrate the ioctl API to a 128 bit specific API + use key API

* Begin migrating the ioctl code to use the key management APIs.
  Not all of it has been migrated (notably the WEP API hasn't.)

* Take special care to copy the TKIP MIC in and out correctly.

* Note that some of the defines used as sizes are actually the ioctl
  sizes, they'll need to be fixed before I push this into a review.

* Document this current API as a specific 128 bit key + 128 bit
  TKIP MIC API.

The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.

Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP
stuff in the /end/ of the key buffer.  They happen to be equivalent
when ioctl key buffer size == net80211 key buffer size, but as I learnt
the last couple times I tried this, they're not always going to be
equivalent.

Differential Revision:  https://reviews.freebsd.org/D58384

Add another HE define needed by the upcoming espwl(4).

MFC after:      3 days

Add support nexthop statistics and update its manual.
While here, fix manual of other nexthop related options.

Reviewed by: kfv
Differential Revision:  https://reviews.freebsd.org/D58538

radix_lockless algorithm creates its own radix tree and
allocates its own radix_masks by directly calling rnh_addaddr().
However, during destruction, it only frees the radix_tree without
freeing its allocated radix_masks.
Fix the leak by calling rn_delete() during radix_destroy().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297339
Reviewed by:    melifaro
MFC after:      2 weeks
Differential Revision: https://reviews.freebsd.org/D59112

Include the entries of the BBLOG STATE column in the computation
of the column width as done also for other columns.
Also set first to falso only when needed.

MFC after:      3 days
MFC to:         stable/15
MFC to:         stable/14
Sponsored by:   Netflix, Inc.

No functional change intended.

Submitted by: Pedro Giffuni <pfg@freebsd.org>
MFC-after:    1 week

The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.

Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:

- st_dev = the dataset's ds_fsid_guid (as the kernel does via
  dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
  zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
  through struct file (the loader's equivalent of the kernel's z_id).

dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
with no hashing. A memset() at the top of zfs_dnode_stat() zeroes the
remaining fields so they no longer hold stack garbage.

Tested on 16.0-CURRENT (amd64), ZFS-on-GELI root: rebuilt and re-signed
the EFI loader; the system boots under UEFI Secure Boot with
mac_veriexec active.

(boot1 segment was modified by kevans)

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295935
Sponsored by:   Defenso

Reviewed-by: kevans
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2271

This pacifies shadow warnings from GCC:

usr.sbin/pmc/cmd_pmc_record.cc: In constructor 'pmc_config::pmc_config(const std::__1::string&, uint64_t, cpuset_t)':
usr.sbin/pmc/cmd_pmc_record.cc:96:71: error: declaration of 'cpumask' shadows a member of 'pmc_config' [-Werror=shadow]
   96 |         pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
      |                                                              ~~~~~~~~~^~~~~~~
usr.sbin/pmc/cmd_pmc_record.cc:90:25: note: shadowed declaration is here
   90 |         cpuset_t        cpumask;
      |                         ^~~~~~~
usr.sbin/pmc/cmd_pmc_record.cc:96:55: error: declaration of 'count' shadows a member of 'pmc_config' [-Werror=shadow]
   96 |         pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
      |                                              ~~~~~~~~~^~~~~
usr.sbin/pmc/cmd_pmc_record.cc:89:25: note: shadowed declaration is here
   89 |         uint64_t        count;
      |                         ^~~~~
usr.sbin/pmc/cmd_pmc_record.cc:96:39: error: declaration of 'event' shadows a member of 'pmc_config' [-Werror=shadow]
   96 |         pmc_config(const std::string &event, uint64_t count, cpuset_t cpumask)
      |                    ~~~~~~~~~~~~~~~~~~~^~~~~
usr.sbin/pmc/cmd_pmc_record.cc:88:25: note: shadowed declaration is here
   88 |         std::string     event;
      |                         ^~~~~

Reported by:    GCC 15
Fixes:          https://cgit.freebsd.org/src/commit/?id=a79a051e7d16 ("pmc: pmc record command")

The passthrough Command register is emulated, but PMCSR writes were
sent directly to the physical function.  A guest D3hot-to-D0 transition
can perform an internal reset and clear physical Command while its
emulated copy remains enabled.

Cache the Power Management capability and keep the physical D-state
host-owned.  Emulate the guest D-state and advertise No_Soft_Reset so
the guest is not promised a function reset by a virtual power cycle.
Restore the assignment-time virtual state after a managed FLR.

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   BBOX.io

This allows specifying custom vdev paths (such as GPT labels like
/dev/gpt/...) when creating ZFS filesystem images via makefs(8), rather
than defaulting to /dev/null.

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59031

The previous check did not work on architectures where `char` is
unsigned as noted by GCC on aarch64:

usr.sbin/pmc/view.cc: In member function 'void pmcview::loadsymboltable(image*, Elf*, Elf_Scn*, GElf_Shdr*)':
usr.sbin/pmc/view.cc:627:38: error: comparison is always false due to limited range of data type [-Werror=type-limits]
  627 |                         if (fname[i] < 0) {
      |                             ~~~~~~~~~^~~

Reported by:    GCC 15

Before the preamble script is sourced, initialize BSDINSTALL_LOG with the
file in $debugFile, if it is not already set.

Without this change, the bsdinstall script would assume the preamble set
BSDINSTALL_LOG to empty and the comparison with $debugFile will fail,
causing the log to be re-initialized to /dev/null.

Reviewed by:    dteske
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D25343

PermitRootLogin is "no" by default and that stopped root from logging in
even though disable_root was set to false during initialization.

Reviewed by:    bapt
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D59101

The emulated HDA controller passed values taken from guest registers and
from guest memory straight into assert(), so a guest could abort bhyve
with values the emulation did not expect. Reject them instead.

In case the guest asked to start something and it failed, clear the
corresponding run/enable bit.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256379, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256381, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256382, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256383, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256384, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256385, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256386, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256498
Sponsored by:   The FreeBSD Foundation
MFC after:      2 weeks
Reviewed by:    bnovkov, jhb
Differential Revision:  https://reviews.freebsd.org/D59082

Move the code for the snapshotting IPC thread into a separate file
and define macros for adding new IPC commands.
No functional change intended.

Reviewed by:    rew
Differential Revision:  https://reviews.freebsd.org/D54650

Move the nvlist-based bhyve IPC code into a separate function.
No functional change intended.

Reviewed by:    rew
Differential Revision:  https://reviews.freebsd.org/D54652

fts_build() stores a dup'd file descriptor in each directory
entry's fts_dirfd.  When a traversal is abandoned before
completion and fts_close() is called, the cleanup loop freed
each pending entry with free() without first closing its
fts_dirfd, leaking one descriptor per pending directory.

Close fts_dirfd before freeing each entry in the cleanup loop,
matching the handling already applied to the dummy parent entry
after the loop.

Add a regression test that descends a couple of levels, abandons
the traversal, closes, and asserts the open descriptor count is
unchanged.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297557
Reported by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=4bd01d6ae016
Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2373

To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them.  This is to close off whole class of possible breakage,
rather than patching it case by case.

Reported by:    dim
Reviewed by:    dim, dteske, fuz
Approved by:    dim, dteske (mentor), fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58911

exterr: relax format restrictions

Rather than passing the format string to printf and forcing the
arguments to be (u)intmax_t, partially parse format strings and cast
p1 and p2 to the correct type before running the individual format
though printf.  This restructure has a couple motivatations:
 - We can skip formats that make no sense (floating point, %n, etc.).
 - It is possible to special case the printing of pointers in the
   CHERI case.

The first case is motivated by a suggestion from the audiance at
one of Kirk's BSDCan talks on exterr to allow userspace to set exterr
status.  Allowing arbitrary format strings including %n creates a
write-what-where gadget so we need to not do that.

The second case is motivated by our experinces with CHERI and debugging
mmap issues using a different textual error reporting framework.  With
CHERI, pointers are more than integer addresses and it's useful to
include more details.  Doing so will follow in a future commit.

When the new code encounters an inappropriate format it includes
a diagnostic and in most cases prints the format untouched.

Reviewed by:    kib
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58058

exterr: Fix build with GCC on 32-bit architectures

Use an intermediate uintptr_t cast to avoid casting a uint64_t value
directly to void * on 32-bit platforms (including lib32 builds).

lib/libc/gen/uexterr_format.c: In function 'uexterr_format_msg':
lib/libc/gen/uexterr_format.c:248:35: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
  248 |                         PFMT(fmt, (void *)ARG(nextarg));
      |                                   ^
lib/libc/gen/uexterr_format.c:144:47: note: in definition of macro 'PFMT'
  144 |                 psz = snprintf(buf, bufsz, f, a);                       \
      |                                               ^

Reported by:    GCC 15
Fixes:          https://cgit.freebsd.org/src/commit/?id=2f024a7cfddd ("exterr: relax format restrictions")

libusb upstream uses int for register handler. This causes some library
user (like pyusb) to assume that we have int in all implementations and
therefore provides a 4 byte storage only. This causes Segmentation
fault as we will right the pointer.

Reviewed by:    adrian
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54211

(cherry picked from commit ce9ced951a0b9d004a3b007d4ac6e9087a1301a2)

If next_callback_id wraps we could end up with two callbacks with the
same ID.  I recommitted the original change despite this issue in order
to fix the libusb API as soon as possible after SHLIB_MAJOR was bumped
in commit 527a82474cb3 (libusb: versioning symbols).

It's very unlikely in practice that software will register and
deregister a sufficient number of callbacks to trigger this, but it is
a real issue to be fixed in a subsequent commit.

Sponsored by:   The FreeBSD Foundation

Instead, just reset next_callback_id to 1 at INT_MAX.  The potential for
duplicate callback IDs remains.

Sponsored by:   The FreeBSD Foundation

- Implement bsearch_s() as per §K.3.6.3.2 in C23, first specified
  in C11.  It behaves identically to bsearch(), except the callback
  is called with a third argument, context, which is passed through
  from the caller, and it also performs runtime constraint checking
  on its arguments.
- Document bsearch_b(), bsearch_s(), and add history section
- Add rudimentary unit tests for bsearch(), bsearch_b(), and bsearch_s()

Reviewed by:    dteske, fuz
Approved by:    dteske (mentor), fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58876

The backing file is already opened successfully, so there is
no need to override the permissions.

Reviewed by:    des
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58832

Reviewed by:  des
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58833

As of commit 9f5c4ef328 ("dounmount(9): temporarily enable recursion
for the covered vnode lock"), the unmount path handles recursion
automatically, so there's no longer a need to handle this case
in unionfs-specific code.

Reviewed by:    kib, markj
Tested by:      pho
Differential Revision:  https://reviews.freebsd.org/D58858

sys: Add sys/ckdint.h

We have a C23 stdckdint.h header for userspace, which provides checked
addition, subtraction and multiplication.  We lack similar helpers in
the kernel, where they are regularly needed.

Let's just adopt the C23 macros.  For bonus points, I added a wrapper to
ensure that ignored an return value is raised as an error by the
compiler.

Reviewed by:    kib, emaste
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58773

tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts

37bd69d43c7 gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>.  Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS.  Both headers are self-contained; stage them alongside
stdckdint.h.

Fixes:          https://cgit.freebsd.org/src/commit/?id=37bd69d43c7 ("sys: Add sys/ckdint.h")
Reviewed by:    rpaulo, markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58943

This serves to demonstrate some usage of the ckdint.h helpers.  The new
version also generates better machine code on amd64 and arm64.

Reviewed by:    kib, emaste
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation

Since the kernel environment has its own dependencies, lurking at the end
of the SI_SUB_KMEM sequence appeared to be fragile.  Provide own subsystem
for it.  The init_dynamic_kenv() goes SI_ORDER_FIRST, and two modules that
depend on it go SI_ORDER_ANY.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297492
Reviewed by:            imp, markj, emaste
Differential Revision:  https://reviews.freebsd.org/D58836

Fixes:        https://cgit.freebsd.org/src/commit/?id=6563dcb6b1f57e51db63854f3774b52e672232ed

drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback().  Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.

Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <nprice@FreeBSD.org>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)

shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks

This is ABI-breaking change that could be considered as the bug fix.

Requested by:   David Timber <dxdt@dev.snart.me>
Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
Relnotes:       yes
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58942

tests/sys/posixshm/posixshm_test.c::accounting fix after st_size changes

st_blksize is defined by POSIX as the 'preferred I/O block size for this
object.' It is wrong to use st_blksize as the unit for st_blocks and
expect it to be equal to the object size regardless of the change of
st_blksize.

Fixes:  https://cgit.freebsd.org/src/commit/?id=3a1bf59d195c ("shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks")
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59014

Add more defines, structures, sort struct field types, add inline
functions (partially implemented) all needed for the upcoming
espwl(4) wireless driver.

MFC after:      3 days

Fill in more (lvif) wdev details and add it to the list under the wiphy
struct so that iterators at least work and find the (one) device.
This is needed for the upcoming espwl(4) driver.

misc: add WPI-SMS4 to the list of cipher suits (we won't support it but
at least print the name).

MFC after:      3 days

Convert IFT_BRIDGE and IFT_L2VLAN to ARPHRD_ETHER, and IFT_LOOP
to ARPHRD_LOOPBACK in linux netlink.
Also, add ARPHRD_SIT and convert IFT_STF to it.

Reviewed by:    kfv
Differential Revision:  https://reviews.freebsd.org/D58573

Noticed by:   mckusick
Fixes:          https://cgit.freebsd.org/src/commit/?id=6563dcb6b1f57e51db63854f3774b52e672232ed

Reviewed by:  bz
Sponsored by:   NVidia networking
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58941

The scheduler selection interface uses names that are reserved words in
C++, causing problems for downstream projects that use C++ in the
kernel.  Work around this by hiding the interface from C++ compilers
until we can come up with a better solution.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ce38acee8d0b ("Add kern/sched_shim.c")
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    siderop1_netapp.com, imp, kib
Differential Revision:  https://reviews.freebsd.org/D58991

6e474d8e3981 ("staging: vchiq_shim: avoid code duplication") refactors
some code which makes applying the subsequent patch easier.

49bec49fd7f2 ("staging: vc04_services: remove vchiq_copy_from_user")
addresses a user-triggerable integer overflow via the
VCHIQ_IOC_QUEUE_MESSAGE ioctl on /dev/vchiq (which has mode 0600 by
default).  It also addresses insufficient validation of user-controlled
addresses in vchiq_copy_from_user().

Update the bcm2835_audio driver to follow the change to
vchi_msg_queue().

Reported by:    Vicki Pfau
Reviewed by:    Abdelkader Boudih <freebsd@seuros.com>
Tested by:      Abdelkader Boudih <freebsd@seuros.com>
Tested by:      Marco Devesas Campos <devesas.campos@gmail.com>
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58889

The final consumer of this was OpenZFS, fixed in ffaea0831973 (thanks
mav@). That change has been present in all active OpenZFS release
branches for at least 6 months. These can finally be retired.

Reviewed by:    mav
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D55201

The need for recursion applies (in somewhat different form) to both
nullfs and unionfs, and would likely apply to any other hypothetical
stacked filesystem as well.

Reviewed by:            kib, markj
Differential Revision:  https://reviews.freebsd.org/D58858

Parts of rtentry.9 information such as information related to
the nexthop is outdated.
Remove those relics and add the new design into separate
manual instead.

Reviewed by:    bcr
Discussed with: ziaee
Differential Revision: https://reviews.freebsd.org/D58564

Reported by:  Herbert J. Skuhra

The module's i386 source list compiles the files that call
pmc_rapl_initialize() and pmc_rapl_finalize() but not the one that defines
them, so the i386 hwpmc.ko has both undefined and cannot be loaded.

Fixes:          https://cgit.freebsd.org/src/commit/?id=a99d04f39dab ("hwpmc: add RAPL energy-counter class (AMD + Intel)")
Assisted-by:    Claude Code (Opus 5)

And clean up luacheck warnings.

Sponsored by:   Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D48950

The header files for dialog, figpar, dpv were never listed.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297612
Fixes:          https://cgit.freebsd.org/src/commit/?id=af202a5052b6 ("Retire dialog")

Add three test cases verifying fts(3) Capsicum capability mode:

- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
  entries and openat(fts_dirfd, fts_name) identifies the same
  inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
  Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
  at all directory depths (7 non-root entries)

Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2332

This is enough to show that the idea works (and to exercise
uexterr_set()), but isn't complete by any means.

Reviewed by:    kib
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58060

Verify that unsupported, unterminated, and overly long formats output
expected messages.

Reviewed by:    kib
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58413

On FAT file systems, access time has a resolution of 1 day, so it is
really the access date.

Strip the time component from the epoch timestamp in order to check the
access time.

Reference: https://learn.microsoft.com/en-us/windows/win32/sysinfo/file-times

Reviewed by:    ngie
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54584

The bash-ism here results in an "ambiguous output redirect"
error when run under tcsh.  Similar unionfs stress2 tests don't
do this, and unionfs7 doesn't seem to generate spurious output
when run locally, so just delete it.

Reviewed by:            pho
Differential Revision:  https://reviews.freebsd.org/D58856

- s/uneccessarily/unnecessarily/

Obtained from:  NetBSD
MFC after:      3 days

- s/modifing/modifying/

MFC after:      3 days

- s/errornous/erroneous/

MFC after:      3 days

- s/predifined/predefined/

MFC after:      3 days

- s/modifing/modifying/

MFC after:      3 days

- s/modifing/modifying/

MFC after:      3 days

- s/varaiables/variables/

MFC after:      3 days

- s/staring/starting/

MFC after:      5 days

SpacemiT has only one T.

Fixes: https://cgit.freebsd.org/src/commit/?id=dcb10e3add17 ("clk: Initial support for the SpacemiT K1 clock control units")

Sponsored by:   The FreeBSD Foundation

- Fix whitespace
- Replace JH7110_GPIO_READ with RD4 (and WR4)
- Trim headers
- Explicit conditional checks
- Use correct method typedefs

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Reviewed by:          kib, markj
Differential Revision:  https://reviews.freebsd.org/D58858

Several lines in the flags-parsing block used spaces instead of
tabs for indentation.  Convert them to tabs to match style(9).
No functional change.

Sponsored by:   Google LLC (GSoC 2026)

Release notes at https://www.sqlite.org/releaselog/3_53_3.html.

Obtained from:  https://www.sqlite.org/2026/sqlite-autoconf-3530300.tar.gz

MFC after:      2 weeks

Merge commit 'e698feec080925c6cffa9ec31be884daa5cea536'

This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
  with ATF 0.22+ [1].
- Brings in some new test coverage.

Obtained from:  NetBSD (date tag: `20260818UTC`)
MFC after:      2 weeks
1. https://github.com/freebsd/atf/pull/72

This reverts commit 45645518ea19ccb4761aee3a525aab2f323d37d4.

Although this changed looks like it should just be a harmless change to
bookkeeping, it turns out that it changes the termination condition of
the initial device scan, resulting in it never finishing. This causes
the boot to hang forever coming up. Since I don't have good access to
hardware, I'm reverting until the exact details can be sorted out.

Reported by: Edward Scroop
Sponsored by: Netflix
MFC After: 1 week

vtnet: move offload functions to virtio_net.h to share them

Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.

Reviewed by:            tuexen
MFC after:              1 month
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D57299

Revert "vtnet: move offload functions to virtio_net.h to share them"

This reverts commit 44cddaa99dee0a634cf2713f71e799eb41397355.
It breaks the LINT-NOIP config.