This is a display of mostly-automatically-classified git commits from 2026-08-24 to 2026-08-30.
Table of contents and commits per category:
| (4) | Highlighted commits (these are copies, not in stats) | |
| 4 | 1.9% | Userland programs |
| 50 | 23.4% | Documentation |
| 52 | 24.3% | Hardware support |
| 12 | 5.6% | Networking |
| 16 | 7.5% | System administration |
| 8 | 3.7% | Libraries |
| 5 | 2.3% | Filesystems |
| 35 | 16.4% | Kernel |
| 4 | 1.9% | Build system |
| 3 | 1.4% | Internal organizational stuff |
| 11 | 5.1% | Testing |
| 3 | 1.4% | Style, typos, and comments |
| 9 | 4.2% | Contrib code |
| 2 | 0.9% | Reverted commits |
| 0 | 0.0% | Unclassified commits |
| 214 | 100% | total |
| Technical notes about this page |
For extra visibility, these are copies of commits found in
other sections. Most (if not all) come from the commit message
containing "Relnotes:", or commits modifying
UPDATING.
In VM and cloud environments it is often possible to enlarge virtual
disks; this can be useful, for example, if a system is launched with a
small root disk and it later becomes clear that more space is needed.
On kernels which support run-time resizing of disks (for NVMe, this was
added in November 2025; some other disk types have supported this for
longer) a SIZECHANGE notification is sent to userland via devd.
Add a "nostart" rc.d script (runnable manually but not automatically at
boot time) and a devd script which invokes it when a notification
arrives. The rc.d script enlarges the "final partition" on partitioned
geoms, or the UFS filesystem or zpool device when triggered on a disk
containing either of those.
Reviewed by: imp, ziaee
MFC after: 2 weeks
Relnotes: Disk partitions and filesystems can be enlarged
automatically when disks grow by setting
growfs_postboot_enable=YES in /etc/rc.conf.
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D58582
Enable the new growfs_postboot mechanism. Note that this also implies disabling automatic allocation of swap space on the root disk, since we cannot grow the root filesystem if swap space is allocated after it. This will not be MFCed since it is a significant behavioural change. Sponsored by: Amazon Relnotes: yes
Manually specified eui64 value gets converted to big endian twice: first using htobe64() and then using be64enc(). On little-endian hosts that results in a little-endian value instead of a big-endian. Fix by removing htobe64() for a user submitted value. Fixes: https://cgit.freebsd.org/src/commit/?id=409a80e5a434 ("bhyve: Create EUI64 for NVMe namespaces") Reviewed by: chuck Relnotes: yes Sponsored by: The FreeBSD Foundation MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D59080
In the world of containers, mounting a unix(4) socket is a common practice to allow communication between processes within containers. For example, both Podman and Docker can expose a unix(4) socket, and that same unix(4) socket can be mounted as a file accessible to a process inside a container, allowing that application to control Podman or Docker. Another example is PHP-FPM with NGINX, where, instead of using TCP/IP for communication between containers, a unix(4) socket is sufficient. However, nullfs(4) and all related components do not allow mounting a VSOCK on top of another. The current workaround involves creating the socket in a directory and mounting that directory. This is an option, though it does not provide a good user experience compared to directly mounting a VSOCK on top of another, since the application that creates the socket may create other sockets in that directory, and the user may not wish to share them, or, worse yet, applications that create unix(4) sockets may not provide any authentication at all, as they may assume that security at the file system level is sufficient. Reviewed by: dfr@ Approved by: dfr@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59158
Commits about commands found in man section 1 (other than networking).
Fix a documentation discrepancy, where the implementation was updated to use uncertainty propagation for the ratio of means, but the example output in the manual page was left unchanged. Update the manual page example from 70.7384% to 102.3% to reflect the actual output. While here, also update the example in the README. Reviewed by: ziaee Fixes: https://cgit.freebsd.org/src/commit/?id=a304ad90e9ae ("Reduce the bogosity of ministat's % difference calculations.") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59157
* Fix case where the source is - and the target exists. * Only call chflags() (to remove flags that might prevent us from replacing an existing target) in the exists case; otherwise, to_sb.st_flags is uninitialized. * Rename the source file in the stdin test case. * Extend null and stdin test cases to cover the case where the target already exists. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297681 MFC after: 1 week Fixes: https://cgit.freebsd.org/src/commit/?id=d34870708db9 ("install: Allow installing stdin") Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59144
This internet draft (which is close to being an RFC) specifies a new NFSv4.2 attribute which tells the NFSv4.2 client to not cache file data. (Similar to O_DIRECT, but triggered by this attribute set on the file on the NFSv4.2 server and not by the application's open(2).) https://datatracker.ietf.org/doc/draft-ietf-nfsv4-uncacheable-files/ This patch adds a new chflags(1) flag called UF_NOCACHE to implement this. Patches for NFS and ZFS will be done separately. This is a redo of the patch, with a requested name change and a #ifdef in strtofflags.c so that it doesn't break some Linux cross build. The name change was requested by fuz@. Reviewed by: kib (earlier version) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D58181
With no file argument, fortune looks for a database named fortunes in FORTDIR. The base system has not shipped that file since 0538d7bbe620 (FreeBSD 12), only freebsd-tips, so the default invocation failed even though a valid database remained. Callers such as xlockmore's marquee and nose modes (fortune -s) then displayed the error as the epigram. If the named fortunes file is absent, scan every database in the existing search path. /usr/local/share/games/fortune stays on that path so fortune-mod-* packages keep working; when fortune-mod-freebsd-classic restores the fortunes file, it is still preferred. fortune -f with no arguments lists the same files that would be searched. MFC after: 1 week Reviewed by: ziaee, fuz Differential Revision: https://reviews.freebsd.org/D59057
Man pages, release notes, etc.
MFC after: 3 days
Change the path for the shosts.equiv file to consistently reflect
/etc/ssh/shosts.equiv across all manual pages.
This change stems from 35d4ccfb5576 ("Document FreeBSD defaults and
paths.")
Reviewed by: bcr, emaste
Differential Revision: https://reviews.freebsd.org/D52203
Commit 290e563166b4 changed the flag's name from dontcache to nocache. This patch fixes the man page. This is a content change. Reviewed by: kib (earlier version) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D58181 Fixes: https://cgit.freebsd.org/src/commit/?id=4830670a3f94 ("chflags.1: Document the new UF_DONTCACHE flag")
Fix a typo, grammar, and generally rephrase for better clarity. Fixes: https://cgit.freebsd.org/src/commit/?id=3463f02706db ("UPDATING: add an entry for [gs]etgroups") MFC after: 1 day MFC to: stable/15 Sponsored by: The FreeBSD Foundation
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59113
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989
MFC after: 3 days
While here, fix markup on one of the items. MFC after: 3 days
While here, tag SPDX and remove Nd overquoting. MFC after: 3 days
While here, remove Nd overquoting. MFC after: 3 days
Move the prose about support that was here to the second sentence of DESCRIPTION. Remove the note about i386 since i386 is dead in 15.0. The rest of the manual still contains details about i386 and could use some TLC by a Xen user. MFC after: 3 days (to 15 only)
Improve style for consistency with the rest of the manual and add the tunables to the search database. MFC after: 3 days Reviewed by: seuros Differential Revision: https://reviews.freebsd.org/D59165
MFC after: 3 days
While here, tag SPDX. MFC after: 3 days
MFC after: 3 days
While here, tag SPDX. MFC after: 3 days Reviewed by: kbowling Differential Revision: https://reviews.freebsd.org/D59258
While here: + tag SPDX + remove superflouous Nd quotes + add the usual missing blank comment line preceeding file MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
+ tag SPDX + remove superflouous Nd quoting + fix AUTHORS email markup MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
While here, remove superflouous Nd quoting. MFC after: 3 days
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59132
This section will appear in the Hardware Release Note. MFC after: 3 days
MFC after: 3 days
+ Tag SPDX + Remove superflouous Nd quotes + Add "The" and "module" to introductory sentence + Remove a malformed "compact" specifier from a list + Add a missing list ending block MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
For inclusion in the hardware release notes. MFC after: 3 days
+ Tag SPDX + Canonicalize SYNOPSIS and HARDWARE + Canonicalize SYSCTL VARIABLES, adding the sysctl to apropos + Canonicalize AUTHORS and HISTORY, which were combined + Use more traditional and consistent %d instead of less clear X MFC after: 3 days
Also tag SPDX, and switch X to %d for consistency/clarity. MFC after: 3 days
While here, remove superflouous Nd quotes and canonicalize %unit to %d. MFC after: 3 days
MFC after: 3 days
Also tag SPDX. MFC after: 3 days
Also tag SPDX. MFC after: 3 days
MFC after: 3 days
Also tag SPDX MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
MFC after: 3 days
These do not belong here and can only serve to confuse search. MFC after: 3 days
MFC after: 3 days
Also tag SPDX. MFC after: 3 days
Also tag SPDX, and switch X to %d for clarity and consistency. MFC after: 3 days
+ tag SPDX + canonicalize SYNOPSIS, LOADER TUNABLES, and HARDWARE + switch X to %d for clarity and consistency MFC after: 3 days
Raising a process' priority is not permitted inside a jail, and nice(1) warns and executes the command anyway, so the service comes up at its login class priority. Not changing the date, as a commit a moment before this, one changed it already. MFC after: 1 week MFC to: stable/15
Hardware drivers and architecture-specific code.
Add plumbing for future FMan KeyGen-driven multi-queue RX. Pure infrastructure; no behavioural change for existing single-FQ consumers. qman: * New qman_percpu_channel(cpu) to get the per-CPU channel, needed for receive-side scaling. * New qman_alloc_fqid_range(count, *basep) / qman_free_fqid_range() reserve a contiguous FQID range so a later KeyGen-distribution caller can compute FQID = base + (hash & mask) and create each FQ individually with force_fqid=true (each landing on its own per-CPU channel). qman_fq_create: * Honor the force_fqid / fqid_or_align parameters: when force_fqid is set, use the caller-supplied FQID and skip the internal vmem_alloc. The fqids_num != 1 restriction is lifted; qman_fq_list[] now records the handle at every FQID slot in the range so DQRR dispatch works for the whole range. * Add fqid_count and force_fqid to struct qman_fq so qman_fq_free() can retire every FQ in the range.
Preparation for FMan KeyGen-driven multi-queue RX. Replace the single sc_rx_fq / sc_rx_fqid pair with a sc_rx_fqs[] array (currently one entry) and sc_rx_fqid_base. Each entry carries a back-pointer to the softc for use by the RX callback.
Add sys/dev/dpaa/fman_keygen.[ch]. Public API is four functions:
* fman_kg_init(sc) -- Initialize KeyGen subsystem, clear out any stale
config.
* fman_kg_fini(sc) -- Teardown KeyGen
* fman_kg_alloc_hash_scheme(sc, port, base_fqid, nfqs)
-- Allocate a scheme, program it for
RSS-over-IP-5-tuple hashing to nfqs FQs
starting at base_fqid, bind it to port.
* fman_kg_free_hash_scheme(sc, port)
-- Remove a scheme added by
fman_kg_alloc_hash_scheme().
KeyGen state (bitmap + port->scheme table) is added to the fman softc.
Future work may allow configuring the KG hash inputs, but what we have
now (5-tuple of src/src-port/dst/dst-port/IPSec SPI field) is
sufficient.
Grow sc_nrxfqs from 1 to the CPU total, and hash the RX 5-tuple across the range with the KG driver from the prior commit. Each FQ lands on its own per-CPU QMan channel, so a given core drains only its own share of RX work and gets frame annotation + data-head stashed into its cache. * Add alignment parameter to qman_alloc_fqid_range() to meet KeyGen requirements. * Initialize 1 frame queue (FQ) per CPU in dpaa_eth_fm_port_rx_init(), using a 5-tuple to spread the load across CPUs. * Channel ownership for TX confirms moved from rx_init/free to tx_init/free -- sc_rx_channel is now a TX-confirm-only per-port pool channel. Fallbacks/degradation: * If any per-CPU channel is -1 (no portal attached) the port fails to attach with a clear message. * If the FQID range can't be allocated aligned, the port fails attach. * If KG scheme allocation fails at port setup, the port keeps its N FQs but only FQ #0 sees traffic.
Reduce the code executed in the DQRR dequeue loop, and move the heavy-weight operations to post-dequeue loop. * Batch if_input() after DQRR dispatch loop completes. Only do the DQRR_CI_CINH write at the end of the loop, so only up to 16 entries will be processed. * Add software LRO per FQ. Each per-CPU RX FQ gets its own LRO tracking structure. Since LRO is configured at FQ initialization time, allocate the ifnet earlier in attach to prevent a panic.
The 82579 PCIm2PCI arbiter can acknowledge a host MAC CSR write while the Management Engine is accessing another CSR. The host write can be lost; subsequent target accesses may no longer be claimed by the MAC and can hang the system. For 82579 controllers with valid management firmware, wait for the ME CSR access indication before every MAC CSR write. Keep the wait bounded and use DELAY because writes occur in interrupt and datapath contexts. Verify every transmit and receive tail write. If a tail does not hold the requested value, disable its datapath direction and request a full iflib reset. Keep the ordinary register-write path as a direct MMIO write behind a predicted per-device gate. Contain the wait and tail recovery in the 82579 slow path rather than adding tail-specific accessors and state to the rest of the e1000 family. Documentation on the PCH NICs is scare so Intel's Linux e1000e fixes publicly document the hardware failure and required serialization as commits bdc125f73f3c and d601afcae2fe. This implementation is a bit cleaner. Tested on a Thinkpad T430 (82579LM) with a test kernel to simulate ME contention without incident as well as lost tail writes causing a succesful recovery. MFC after: 2 weeks Sponsored by: BBOX.io
When building struct arm64_bootparams to pass to initarm we store the boot_el field as a 64-bit value, however it is defined as an int which is 32-bits. Switch to store using the 'w' register as this will store a correctly sized value. Previously this would trash the trailing padding, so is only a correctness issue. Reviewed by: emaste Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D58988
Co-developed-by: Andrew Turner <andrew@FreeBSD.org> Sponsored by: Arm Ltd
Sponsored by: Arm Ltd
Fix the non-VHE register field definition of CNTHCTL_EL1PCTEN to use the correct non-VHE shift. Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com> Sponsored by: Arm Ltd Pull Request: https://github.com/freebsd/freebsd-src/pull/2378
Serialize S3X I/O and cap dtransfers while keeping namespace handling. Select 64/128-byte submission queue entries explicitly and set CC.IOSQES from the same value used for the software queue stride. When fatal status is set, wait for pending PCIe transactions and then force FLR so a wedged controller doesn't panic or timeout. MFC: 1 week PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296946 Fixes: https://cgit.freebsd.org/src/commit/?id=5e0ba47aa00e Reviewed by: ngie, imp Differential Revision: https://reviews.freebsd.org/D58821
The Apple S3X controller exposes internal namespaces beyond NSID 1 that aren't meant to be visible to the OS. Added QUIRK_APPLE_S3X_NS1_ONLY and nvme_ctrlr_num_namespaces()/nvme_ctrlr_nsid_visible() helpers, and route namespace construction, notification, and AER namespace-changed handling through them instead of a raw cdata.nn count. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D58844
There are several port functions that are only for one type or the other, so they don't make sense to be together. Splitting these up also simplifies adding support for the Offline/Host Command ports.
Bits [0:1] map to "B", the "Segment size selector", and are not part of the VSID. Correct this mask.
Using hex here breaks the instruction generated by MRS_REG_ALT_NAME. Switch to a decimal value. Sponsored by: Arm Ltd
Some ID_AA64ISAR2_EL1 fields values are incorrectly indented. Values have an extra space before the macro to make scanning for them easier. Add this extra space to the two fields that were missing it. Sponsored by: Arm Ltd
The C standard does not require diagnostic messages to be quoted, but some tools get confused by unbalanced quotes such as the apostrophe in “don't”. Wrap this message in double quotes to resolve the confusion. Sponsored by: Klara, Inc. Sponsored by: NetApp, Inc.
This function has a loop where it attempts to lock all channels in a group. If doing so would block, it releases all locks, sleeps for a bit, and tries again. However, once the syncgroup lock is dropped, nothing prevents the syncgroup structure from being freed. Fix the inner loop: after waking up, break out of it unconditionally and start everything again. I think the old code was also buggy and not well-exercised: after waking up we'd continue to try and continue locking channels. Then we'd try again from the beginning and fail to lock the channels we had already locked. Approved by: so Security: FreeBSD-SA-26:58.sound Security: CVE-2026-58091 Reported by: Hazley Samsudin of GovTech CSG Reviewed by: christos Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58912
Move vgic_v3 structures in preparation for vgic interface rework for GICv5 support. Reviewed by: Sarah Walker <sarah.walker2@arm.com> Sponsored by: Arm Ltd
Reviewed by: Sarah Walker <sarah.walker2@arm.com> Sponsored by: Arm Ltd
"1 << 31" is a signed int left shift 31 which is undefined as the shift is too large. Use an unsigned int to make the value defined. Sponsored by: Arm Ltd
The Logitech H390, for instance, has the following interface layout:
~~
7 INPUT 34 INPUT 10 INPUT
Mic (0x201) Mic (0x201) USB Stream (0x101)
| | |
v v |
19 FEATURE 35 FEATURE |
| | |
v v |
25 EXTENSION +------> 36 MIXER <---+
| |
v v
13 OUTPUT 22 FEATURE
USB Stream (0x101) |
v
16 OUTPUT
Speaker (0x301)
~~
The 7->13 path on the left is a typical microphone-in configuration,
while the right side is a little more complicated. The 34 -> 35 -> 36
leg is describing a hardware sidetone control, while the other is a
standard audio-out configuration.
During feature unit evaluation, we need to pick up the scenario of node
35 above, which is directly wiring the microphone to the speaker. Right
now we'll likely tie it to the pcm/vol levels and this unit will emit
a very prompt feedback screech, but it's really shaped more like a
MONITOR control.
This avoids mishandling feature unit 22 because that's evaluated in one
of the other cases: one of the inputs is the USB stream, so it's
wired up as a PCM.
One note on this headset: the presence of mixer 36 currently breaks the
`vol` control, leaving only `pcm` to control the volume. Given that it
has both Mic and USB input, I suspect we get a 1:1 cluster configuration
for the Mic input but something more complicated for the USB input that
we end up ignoring. Thus, "vol" might technically control the monitor
volume but isn't wired up to the USB input cluster. I have not had a
chance to confirm this, yet.
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291424
Reviewed by: christos
Differential Revision: https://reviews.freebsd.org/D58779
intelspi: add Wildcat Lake SPI controller IDs Add PCI device IDs for Wildcat Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59011
intelspi: add Panther Lake SPI controller IDs Add PCI device IDs for Panther Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59012
intelspi: add Nova Lake SPI controller IDs Add PCI device IDs for Nova Lake-generation LPSS peripheral SPI controllers. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59013
The previous patch assumes that we don't want to reset toggle bit in STOPPED_STEP. However, a device can explicitly call usbd_clear_data_toggle if necessary. As a result, instead of not dropping the bit unconditionally, we added a field in xhci to specify that we want to drop it, so that usbd_clear_data_toggle can handle it correctly. Reported by: oh Reviewed by: kevans Tested by: oh Fixes: https://cgit.freebsd.org/src/commit/?id=28d85db46b48 ("xhci: Do not drop and add bits in xhci") MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D59186
SR-IOV VFs are instantiated dynamically from their PF rather than enumerated from ACPI. A VF's runtime slot and function can match an unrelated _ADR below the bridge. acpi_pci_save_handle() stores that handle in the VF's devinfo before acpi_pci_update_device() runs. If the handle is already bound to another device_t whose parent is not acpi0, acpi_pci_update_device() panics under INVARIANTS. Without INVARIANTS, the VF retains the unrelated handle, so subsequent ACPI lookups, including NUMA and power-management operations, can act on the wrong namespace node. Skip ACPI namespace matching for VFs. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59061
SR-IOV VFs are instantiated from their PF and intentionally do not receive an ACPI handle by matching their runtime BDF. Consequently, ACPI locality queries for a VF fall back to the upstream bus. This is usually sufficient, but loses a _PXM supplied specifically for the PF. Use the PCI core's owning-PF accessor for BUS_GET_DOMAIN and BUS_GET_CPUS requests made for a VF. This preserves the VF's lack of an ACPI handle while allowing its CPU and NUMA placement to follow the PF. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59062
ufshci: run the controller fail path only once Two threads could run ufshci_ctrlr_fail() at the same time. Each one walked the queues and completed the same trackers again, which caused a double free and a panic. Turn is_failed into an atomic gate, so only the first caller walks the queues. The reset task now returns early on a failed controller instead of re-enabling it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58944
ufshci: claim trackers before failing them ufshci_req_queue_fail() drops the queue lock to complete each tracker. In that window the completion path could complete the same tracker again. Claim the slot before dropping the lock, so the completion scan skips it. Reserved slots are left to their submit thread, which completes them itself. The manual request completion helper lost its only caller, so drop it. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58945
ufshci: build valid fake responses for manual completion The manual completion wrote the fake response to the wrong descriptor for task management slots. It also left the task tag at zero, which tripped the task tag check under INVARIANTS. Write the fake response where the completion path reads it. Copy the task tag from the request. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58946
ufshci: handle a recovery reset before the SIM attach When the first start attempt fails early, the recovery reset runs the start sequence again without a SIM. That pass still looked up the WLUN, so it dereferenced a NULL SIM and panicked. Attach the SIM whenever it does not exist yet. Also make the WLUN lookup return NULL when there is no SIM. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58947
ufshci: reject new requests on a failed controller A failed controller accepted new requests, but nothing ever completed them, so the caller waited forever. The admin retry path could also resubmit a request to a dead queue. Reject new submits and admin retries on a failed controller. The submit check runs under the queue lock, so it cannot race with the queue walk in the fail path. Reviewed by: imp (mentor) Sponsored by: Samsung Electronics Differential Revision: https://reviews.freebsd.org/D58948
w83793g_writereg is unused so silence it. Fixes: https://cgit.freebsd.org/src/commit/?id=cd3cc6e910c0f ("i2c/sensors: Add driver for W83793 hardware monitor")
This addresses a bug in the addition overflow check added in commit
319414a926af ("netmap: Handle overflow when computing ring sizes"): that
overflow wasn't actually caught by the check because "len" is promoted
to size_t.
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297300
Fixes: https://cgit.freebsd.org/src/commit/?id=319414a926af ("netmap: Handle overflow when computing ring sizes")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58896
acpi_pci: Preserve CPU locality queries for descendants bus_generic_get_cpus() preserves the original leaf device while forwarding a request through the bus hierarchy. Consequently, acpi_pci_get_cpus() may receive a descendant below a PCI function rather than one of the PCI bus's direct children. Only apply the SR-IOV PF-locality mapping to direct PCI children. Preserve the previous ACPI CPU-locality lookup for descendants so their unrelated bus ivars are not interpreted as PCI device information. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59206
acpi_pci: Cache PCI proximity domains A PCI function's _PXM is stable for the lifetime of its device instance, but CPU and DMA locality queries may evaluate it repeatedly. SR-IOV amplifies this because every VF resolves locality through the same PF. Cache successful mappings and the stable absence of _PXM on the locality source device, and share that result between CPU and domain queries. Continue to retry generic evaluation or mapping errors rather than making a potentially transient failure permanent. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59207
acpi_pci: Honor device proximity for DMA tags A PCI function with its own _PXM still inherits a DMA tag carrying the upstream bridge's proximity domain. Resolving an SR-IOV VF's locality through its PF therefore does not affect the domain used for DMA allocations. Create and cache a private child tag when the function, or a VF's owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU tag so its constraints remain intact, then apply the function's domain without mutating a shared tag. pci_get_dma_tag() already performs the IOMMU lookup, so remove the duplicated lookup in the ACPI subclass while here. Reviewed by: jhb MFC after: 2 weeks Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59063
rangelock: Fix format strings for 32-bit kernels Reported by: Jenkins Fixes: https://cgit.freebsd.org/src/commit/?id=f1f58bdf7b5f ("acpi_pci: Honor device proximity for DMA tags")
These helper function will not be needed anymore because the way that clocks are parsed from the DTS is reworked. Approved by: imp, manu(mentor) Tested by: Rick Richard Differential revision: https://reviews.freebsd.org/D46712
Due to upstream has changed to use clock-output-names we need to update the names in our code aswell. Approved by: imp(earlier revison), manu(mentor) Tested by: Rick Richard Differential revision: https://reviews.freebsd.org/D46713
The Atom C2000 integrated GbE programming reference documents the I354 internal memory error architecture. It shares the I350 PEIND and ICR.FER routing, DMA and packet-buffer status, LAN parity status, and required reset recovery. Extend the existing I350 recovery and corrected error accounting paths to I354. Keep the PCIe corrected error mask family-specific. C2000 PCIEECCSTS ends at the transmit write-data indication in bit 4 and does not implement the I350 retry buffer indication in bit 5. Do not expose the corresponding retry counter on I354. The PRM overview says a PCIe region failure requires a system reboot, while the individual PCIEERRSTS fields prescribe CTRL.RST followed by port reinitialization. Use the register specific recovery, matching the existing I350 path; failed reinitialization still leaves the port down. This follows sections 5.6 and 6.21 of the Intel Atom Processor C2000 Product Family Integrated GbE Controller Programmer's Reference Manual, document 537426 revision 1.5. MFC after: 2 weeks Sponsored by: BBOX.io
I350 and I354 report a corrected ECC error in the LAN transmit management FIFO through LANPERRSTS bit 16. Unlike the parity status in the same register, this condition neither interrupts nor stops traffic. Poll the latch with the other corrected error status, increment a dedicated counter, and clear only its RW1C bit. Expose it as dev.igb.N.memory_errors.corrected_lan_mng_fifo. Fatal error handling returns before the periodic statistics sweep and may reset the device. Drain all I350 and I354 corrected-error status in the admin task before recovery so the reset does not discard pending indications. This follows section 6.21.16 of the Intel Atom Processor C2000 Product Family Integrated GbE Controller Programmer's Reference Manual, document 537426 revision 1.5. MFC after: 2 weeks Sponsored by: BBOX.io
To date, pmap_update_entry() has unconditionally passed false as final_only to pmap_s1_invalidate_range(). Passing false means that we invalidate the intermediate "page walk cache" entries in the TLB as well as the leaf that is being replaced. However, invalidating intermediate entries is only necessary when doing a superpage promotion that replaces a pointer to a page table page by a large page mapping. Reviewed by: andrew, kib, markj MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D58917
The disabled path wrote the complement of DMAC_EN to DMACR. That set every other field, including reserved bits, the one-shot EXIT_DC command, watchdog enables, receive threshold, and PCIe Lx selection. When DMA coalescing was enabled, the requested watchdog and Lx-delay values were ORed into their reset values rather than replacing the fields. PCIEMISC.LX_DECISION was also cleared, preventing DMACR.DMAC_Lx from controlling PCIe low-power entry. Disable coalescing by clearing only DMAC_EN and retaining the documented DMAC_Lx policy and watchdog fields. On enable, replace the variable fields under their masks, select DMA requirements for PCIe low-power entry, and program the loopback and BMC watchdog policies independently of prior state. Make igb_init_dmac() the sole owner of this policy, including when SR-IOV is active, so later IOV initialization cannot overwrite it. Apply this consistently to I350, I354, and I210 while preserving the I354-specific timer units. Leave I210 reserved fields at their required encodings and do not expose the ineffective control on I211. Validated on I210 and I350 hardware. Repeated I210 enable, disable, and reset cycles preserved the watchdog, Lx, TTLX, and LX_DECISION fields. On I350, dmac values of 250, 1000, and 10000 programmed DMACWT as 0x7, 0x1f, and 0x138, respectively, while retaining a four-tick TTLX and leaving the reserved and watchdog fields stable. A real reset initiated by a sibling function restored the enabled dmac=1000 tuple and a down interface path restored the disabled tuple. MFC after: 2 weeks Sponsored by: BBOX.io
led(4) invoked the led_t callback with its mutex held, including from the blink callout, so the callback must not sleep. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251032 MFC After: 1 week Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59263
CTRL.DEV_RST resets every port on an 82580 and newer igb device. Hardware reports the event to each affected function through ICR.DRSTA and requires software to reinitialize the port registers and descriptor rings. The driver neither enabled nor handled this cause, so a reset initiated by another function could leave a running interface using stale state. In FreeBSD, we do not currently send this, but other OSes including Linux do, so a PF passed through to such a guest or FreeBSD as a guest running with a passthrough PF on the same controller can be wedged. Enable DRSTA for 82580 and newer PFs in both MSI-X and shared MSI/legacy modes. Bit 30 is reserved on 82575 and is the TCP timer on 82576, so leave it masked on those parts. Latch the event without programming port registers from the interrupt filter. Defer the iflib reset request to admin-task context because the request takes STATE_LOCK. Use IAM to auto-mask shared interrupts on the first ICR read. Keep admin, queue-vector, and interrupt-rearm work quiesced until initialization succeeds. Follow the device reset handshake before the first CTX-owned register programming: wait for GCR to report that the device reset and pending PCIe transactions have completed, then acknowledge STATUS.DEV_RST_SET. Also verify EEPROM autoload and PF reset completion on I350 and newer parts. This follows the Intel 82580 Datasheet, section 4.3.2, and the Intel I350 Datasheet, section 4.3.4. Detect a completed reset from STATUS even when the interface was down. A bounded timeout falls back to the requested port reset. Retain staged reset state through the complete initialization. Check ICR.DRSTA, GCR, and STATUS.DEV_RST_SET after all registers and rings have been rebuilt. If another reset arrived while interrupts were masked, reject the incomplete initialization and repeat the handshake. If both MMIO and PCI configuration space have disappeared, leave the interface stopped rather than queueing an endless recovery loop. Validated on an I210 with INVARIANTS and WITNESS. Injecting CTRL.DEV_RST while igb0 was running recovered through a full iflib initialization in both MSI-X and MSI modes without a panic. STATUS.DEV_RST_SET and GCR.DEV_RST_IN_PROGRESS cleared, enabled DMA coalescing was restored. Injecting the reset while igb0 was down left DEV_RST_SET latched; the first ifconfig up consumed it. On a dual-port 82580, synthetic DRSTA injection produced one complete reinitialization in four-queue MSI-X and shared-MSI modes. Five repeated events produced five clean reinitializations without a panic or watchdog. A raw CTRL.DEV_RST test is not counted because Intel's shared code deliberately avoids that unreliable operation on 82580. On an I350, a real device-wide reset initiated by a sibling function produced one reinitialization while igb0 was running and restored its carrier and enabled state. With igb0 down, STATUS.DEV_RST_SET remained latched until the first up, which consumed it and restored the correct state. The host remained healthy in both cases. MFC after: 2 weeks Sponsored by: BBOX.io
Get rid of the powernv-specific AP callback and use the new-ish PIC_AP_INIT() PIC KPI instead.
The loop goes over the qman channel total (16), so if a port ID is not found in the list it could walk off the end of the list and return garbage. Not a problem in practice, as only valid ports are included in our device trees, but protect it anyway.
Instead of forcing an `mdio` pseudo-device to hang off the xmdio, rename xmdio to "mdio" and make it an ofw bus device, akin to the mii_fdt driver, so that children can get the device tree goodies.
The presence of the PCI power management capability does not imply that a function can signal PME# from every power state. Drivers which advertise wake based only on pci_has_pm() can consequently expose wake modes that cannot work. Add pci_has_pme() to query the PME_Support bitmap for a specific state. Use it to implement LinuxKPI pci_pme_capable(), removing its duplicate PME_Support decoder. Validated the helper against PCI PMC capability values from 82571EB, 82573L, 82579LM, I210, I225, and I226-V controllers. The 82571 and 82573 reported PMC 0xc822, while the I226-V reported 0xc823. In both values, bits 15, 14, and 11 advertise PME from D3cold, D3hot, and D0; the low-bit difference is only the PM capability version. MFC after: 2 weeks Sponsored by: BBOX.io
The attach path translated WUC.APME into a saved link-change filter, then advertised magic-packet wake. Suspend removed unselected magic, unicast, and multicast bits from that saved value, commonly leaving no hardware wake filter at all. The destructive masking also made later capability changes ineffective. Advertise the I225/I226 wake filters whenever PCI power management is available and enable magic-packet wake by default. Build a fresh WUFC mask for every suspend, and explicitly clear WUC, WUFC, and PCI PME when wake is disabled. Require the PCI power-management capability to report D3hot PME support before advertising or arming wake. A PM capability alone does not mean the function can signal PME from the state used during system sleep. Reconstruct RAR0, the multicast table, and the receive filter after the stop-time reset so unicast and multicast wake use the current interface state. Keep the PHY powered while wake is armed, drain pending PCIe transactions, and disable bus mastering before D3. Clear the sticky base and extended wake status before arming filters. On resume, report the saved hardware wake cause, clear the device wake source, and then clear PCI PME. Run the DMA-fencing sequence even when wake programming fails, while allowing shutdown to continue after logging the failure. Explicitly restore PCI bus mastering during initialization so an iflib-local resume after another child rejects suspend can restart the device. Restore the Intel shared code PHY power down test from DPDK. The FreeBSD split inverted the reset-block condition, so its dormant hook would power down only when firmware explicitly vetoed the operation. Do not copy the generic legacy management test verbatim. The I225 and I226 define MANC bits 0 and 1 as flow-control and NC-SI discard controls, not SMBus and ASF enable bits. Preserve the link when the documented TCO receive path is enabled; the shared reset-block test separately honors the firmware keep-link-up veto. This follows section 8.21.1 of the Foxville Software User Manual. Evaluate management pass-through at each suspend. When neither a host wake filter nor management requires the link, invoke the shared-code power-down hook before D3. Leave a management-owned link untouched and restore a link previously powered down by the driver without another PHY reset. This follows DPDK's stop/start pairing without changing ordinary ifconfig down behavior. The implementation was checked against the Intel I225/I226 programming model, the Intel Linux igc lifecycle, and DPDK. On an I225-LM, a device-only D3 test observed PME for a valid magic packet and no PME with every host wake filter disabled. Both cases resumed to D0 with the link and configured addresses operational. The I225 system also completed a full ACPI S3 cycle and resumed with link, configured addresses, and traffic operational. On an I226-V, a device-only D3 test changed PMCSR accordingly after a magic packet. With dev.igc.0.wake enabled, a full ACPI S3 cycle remained asleep until a delayed magic packet and resumed with link, addresses, and traffic operational. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282140 Obtained from: DPDK (shared-code power-down structure) MFC after: 2 weeks
Network-related commands, library, and kernel.
pfr_create_kentry() can return NULL. Don't dereference the pointer it returns until after we've checked it. Fixes: https://cgit.freebsd.org/src/commit/?id=08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink") See also: https://redmine.netgate.com/issues/23622 Sponsored by: Rubicon Communications, LLC ("Netgate")
Provide a convenient in-place sed edit command to update the FreeBSD VersionAddendum dates with today's date. Sponsored by: The FreeBSD Foundation
Several cleanups in tcp_input_with_port(): * Don't assign m twice. * Don't reassign pointers without having done pullup(). * While there, change the type of isipv6 to bool, since it is used that way. No functional change intended. Reported by: Hannes Elfert Reviewed by: pouria, Timo Völker, Nick Banks MFC after: 1 week MFC to: stable/15 Differential Revision: https://reviews.freebsd.org/D59142
pf states may be looked up using one of two keys: the stack key or the
wire key. For states involving address translation, these will be
distinct; the stack key describes the addresses seen by the local
network stack, and the wire key has the translated addresses.
Historically, pf would avoid allocating separate keys if both are
identical. This changed in commit fcdb520c1b4e ("pf: nat64") to always
allocate separate state key structures. Incidentally, OpenBSD seems to
maintain the optimization, but also has an explicit reference count
embedded in state keys.
The change breaks another optimization: pf_state_key_attach() still uses
state key pointer equality to check whether the stack and wire keys are
equal, so those checks are always false after the aforementioned commit.
Thus we never skip the second key lookup, even when that's possible
(i.e., no address translation is involved).
So, for some rulesets we're consuming more memory than needed and
performing more state key lookups than needed. The behaviour of always
looking up the stack key also happens to break some existing rulesets
involving RDR and divert-to, which is how I noticed the problem. I
think those rulesets effectively worked by accident before, but it seems
worth restoring the optimization regardless.
Reviewed by: kp
MFC after: 2 weeks
Fixes: https://cgit.freebsd.org/src/commit/?id=fcdb520c1b4e ("pf: nat64")
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D58922
Use ifa_ifwithaddr_fib() to fix fib-specific ifa lookups with route. Differential Revision: https://reviews.freebsd.org/D59128
When using -b, provide in addition to the BBLog state also the number of entries stored at the endpoint, the corresponding upper limit and the next sequence number to be assigned. Reviewed by: rrs MFC after: 1 week MFC to: stable/15 MFC to: stable/14 Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D59131
Netlink IFLA_GROUP works with a single group id, in our implementation an interface can be joined to multiple groups and it works with group name. Store interface groups in IFLAF_GROUP attribute. Reviewed by: glebius, melifaro Discussed with: markj Differential Revision: https://reviews.freebsd.org/D58643
Commit 8572367b6814 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.
This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.
Fixes: https://cgit.freebsd.org/src/commit/?id=8572367b6814 ("pf: remove STATE_LOOKUP")
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D59015
Otherwise close() fails. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297977 Reviewed by: glebius Fixes: https://cgit.freebsd.org/src/commit/?id=ea7be1293b48 ("keysock: do not use raw socket code") MFC after: 1 week
pf sends outbound packets by offloading them to a single per-vnet SWI handler through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm that per-vnet queue with syncookie packets and cause contention in the SWI handler that negatively affects other pf operations. Fix this by sending the initial syncookie challenge from the context of the receiving thread. This avoids the syncookie-induced contention on the `pf_intr` mbuf queue. Sponsored by: Klara, Inc. Sponsored by: Entersekt MFC after: 3 weeks Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D59068
getifaddrs(3) may return AF_INET6 addresses even when netstat(1) is built without INET6 support. Avoid passing these addresses to process_ifa_addr(), which does not handle AF_INET6 in that case. This fixes corrupted column width calculations and runaway output from netstat -i, which could cause periodic daily check output to generate multi-gigabyte mail messages and exhaust disk space and memory. MFC after: 2 weeks
In bridge_input, sc is initialized to NULL and doesn't get resolved until after the Ethernet header pullup. So the pullup's failure path ends up dereferencing the NULL sc when bumping up IFCOUNTER_IERRORS. The m_freem call right under it is redundant as the failure path in m_pullup already freed the chain. Drop both lines, matching what we have in bridge_output. ether_input_internal() discards frames shorter than ETHER_HDR_LEN before the bridge hook, so it is unlikely that it will fire. We still keep the guard as lagg(4) and ng_ether(4) may replace the mbuf before the bridge hook. Signed-off-by: Aaron Espinoza <acesp25@freebsd.org> Reviewed by: pouria Pull Request: https://github.com/freebsd/freebsd-src/pull/2393
Stuff in man section 8 (other than networking).
Reported by: Reo Shiseki MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59054
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297839 MFC after: 1 week Obtained from: OpenBSD, henning <henning@openbsd.org>, 5b6657d4d8 Sponsored by: Rubicon Communications, LLC ("Netgate")
Manually specified eui64 value gets converted to big endian twice: first using htobe64() and then using be64enc(). On little-endian hosts that results in a little-endian value instead of a big-endian. Fix by removing htobe64() for a user submitted value. Fixes: https://cgit.freebsd.org/src/commit/?id=409a80e5a434 ("bhyve: Create EUI64 for NVMe namespaces") Reviewed by: chuck Relnotes: yes Sponsored by: The FreeBSD Foundation MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D59080
bhyve: Return void from pci_emul_alloc_bar This function never fails. Reviewed by: bnovkov, chuck, markj Differential Revision: https://reviews.freebsd.org/D58579
bhyve: Don't set the prefetch flag for large 64-bit memory BARs The only device model that can create a large 64-bit memory BAR is the passthru device model, and that device model reuses the lobits of the existing BAR explicitly. Fixes: https://cgit.freebsd.org/src/commit/?id=e87a6f3ef284 ("bhyve: use physical lobits for BARs of passthru devices")
bhyve: Refactor initial PCI BAR setup Fully initialize BARs with an address of 0 in pci_emul_alloc_bar() instead of deferring some of that initialization to pci_emul_assign_bar(). Now, the latter is only used to allocate an initial address range for PCI BARs. Note that this means that the pci_passthru model now overrides the initial lobits after they are set removing the need for a workaround in pci_emul_assign_bar(). Reviewed by: bnovkov Differential Revision: https://reviews.freebsd.org/D58893
bhyve: Tidy lobits handling in pci_passthru - The lobits field in the "physical" BAR settings is never used, so don't bother setting it. - Expand the comment explaining why the existing lobits are preserved (namely, to preserve the prefetch flag on memory BARs). Reviewed by: bnovkov Differential Revision: https://reviews.freebsd.org/D58894
Read interface groups from IFLAF_GROUP netlink attribute. Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D58644
Use better diagnostic messages when unit numbers are wrong. Reviewed by: arrowd@, christos@, kevans@ Approved by: christos@ Differential Revision: https://reviews.freebsd.org/D56845
A service running under ${name}_user was signalled from the host as that
user, which the parent of a jail may no longer do: since 8a5ceebece03 an
unprivileged process would need allow.unprivileged_parent_tampering.
Stop and reload therefore failed and left both the service and its jail
running.
MFC after: 1 week
MFC to: stable/15
rc.subr: svcj - let svcj_all_enable enable service jails Fix the logic for svcj_all_enable. Fixes: https://cgit.freebsd.org/src/commit/?id=2efbd480f1d3 rc: add service jails framework MFC after: 1 week MFC to: stable/15
rc.subr: svcj - remove the service jail when the service is not running
A service whose tracked process had died while another process of its own
kept the jail alive, therefore left svcj-${name} behind, and the next start
would fail.
Fixes: https://cgit.freebsd.org/src/commit/?id=2efbd480f1d3 rc: add service jails framework
MFC after: 1 week
MFC to: stable/15
Assisted-by: Claude Code (Opus 5)
rc.subr: svcj - run a service's own restart and status methods in its jail A script that defines non-default restart_cmd or status_cmd should execute them in the service jail. Where there is no jail to enter, restart starts the service instead of failing. Fixes: https://cgit.freebsd.org/src/commit/?id=2efbd480f1d3 rc: add service jails framework MFC after: 1 week MFC to: stable/15 Assisted-by: Claude Code (Opus 5)
rc.subr: svcj - add a setaudit option
setaudit(8) is prefixed to the command inside the jail when
${name}_audit_user is set, and needs allow.setaudit.
This is not added automatically when ${name}_audit_user is set, this
needs an administrative setting of the options on purpose.
MFC after: 1 week
MFC to: stable/15
Twenty cases over where each rc option and each method executes for a jailed service, the jail's lifetime, and the svcj option handling. Each case drives the service inside a chroot built in its ATF work directory. MFC after: 1 week MFC to: stable/15 Assisted-by: Claude Code (Opus 5)
This patch adds a new nfs_client_rdma_enable variable to /etc/rc.d/nfsclient to enable the client side of NFS over RDMA. The client side of NFS over RDMA requires the nfsclrdma.ko module, which is still under test/review. I wanted to get the "glue" into main so that others could test the module more easily. Avaliability of the module will be announced on freebsd-current@ soon. It should not affect non-RDMA operation. I've specified a long MFC, since the module still requires extensive testing and, hopefully, a review. MFC after: 3 months
libusb_hotplug_register_callback() runs the newly registered callback over the already-enumerated device list when LIBUSB_HOTPLUG_ENUMERATE is set. A hotplug callback returning non-zero means "deregister me", and the enumerate loop honours that by freeing the handle and setting it to NULL. Since commit 6bda9f26d2ed changed libusb_hotplug_callback_handle from a pointer to an int, the tail of the function unconditionally dereferences that handle, so any caller that passes LIBUSB_HOTPLUG_ENUMERATE, a non-NULL handle pointer, and a callback that returns non-zero on a matching device crashes inside libusb. This is a normal usage pattern and it was safe before the conversion, when the equivalent line simply stored NULL. Report the reserved id 0 instead. The allocator hands out ids starting at 1, and libusb_hotplug_deregister_callback() already ignores 0, so this restores the pre-conversion behaviour. Signed-off-by: yuvrajnode <yuvrajsinghrock1221@gmail.com> Reviewed by: aokblast Fixes: https://cgit.freebsd.org/src/commit/?id=6bda9f26d2ed ("libusb: change callback register handler to int") Pull Request: https://github.com/freebsd/freebsd-src/pull/2383 Closes: https://github.com/freebsd/freebsd-src/pull/2383
libusb_hotplug_register_callback() resolves its context with GET_CONTEXT() and then immediately reads ctx->no_discovery and ctx->usb_event_mode, but only checks "ctx == NULL" afterwards. GET_CONTEXT() falls back to usbi_default_context, which is NULL before libusb_init() and is reset to NULL by libusb_exit(). An application that calls libusb_hotplug_register_callback(NULL, ...) without an initialised default context therefore crashes on the ctx->no_discovery read, instead of getting the LIBUSB_ERROR_INVALID_PARAM the existing guard was clearly written to return. Move the argument validation ahead of the first dereference. None of the validated arguments depend on the context, so no other ordering constraint is affected. Signed-off-by: yuvrajnode <yuvrajsinghrock1221@gmail.com> Reviewed by: aokblast MFC after: 2 weeks Pull Request: https://github.com/freebsd/freebsd-src/pull/2384 Closes: https://github.com/freebsd/freebsd-src/pull/2384
libc: Remove incorrectly defined __STDC_VERSION_STDBOOL_H__ C23 does not define __STDC_VERSION_STDBOOL_H__ for <stdbool.h>. Feature test macros of this form only apply to headers where the standard explicitly mandates one. Reviewed by: fuz Approved by: fuz (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D59136
libc: Add <time.h> C23 feature test macro Define the __STDC_VERSION_TIME_H__ feature test macro as the header fully conforms to C23. Reviewed by: fuz Approved by: fuz (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D59134
libc: Add <setjmp.h> C23 feature test macro Define the __STDC_VERSION_SETJMP_H__ feature test macro as the header fully conforms to C23. Reviewed by: fuz Approved by: fuz (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D59135
libc: Fix C23 version macro visibility In headers that existed prior to C23, these should be visible only in C23 or BSD mode. Fixes: https://cgit.freebsd.org/src/commit/?id=0fe73dcf7c32 ("libc: Add <assert.h> C23 feature test macro") Fixes: https://cgit.freebsd.org/src/commit/?id=1f09e354297c ("sys/limits.h: Add BOOL_MAX, BITINT_MAXWIDTH, and C23 feature test macro") Fixes: https://cgit.freebsd.org/src/commit/?id=cd0727ec709b ("libc: Add <stdio.h> C23 feature test macro") Fixes: https://cgit.freebsd.org/src/commit/?id=fc9d02cb29ed ("libc: Add <time.h> C23 feature test macro") Fixes: https://cgit.freebsd.org/src/commit/?id=4aeed6e9d213 ("libc: Add <setjmp.h> C23 feature test macro") Reviewed by: fuz, kfv, dteske Differential Revision: https://reviews.freebsd.org/D59272
Sponsored by: Rubicon Communications, LLC ("Netgate")
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
rc+devd: Add growfs_postboot
In VM and cloud environments it is often possible to enlarge virtual
disks; this can be useful, for example, if a system is launched with a
small root disk and it later becomes clear that more space is needed.
On kernels which support run-time resizing of disks (for NVMe, this was
added in November 2025; some other disk types have supported this for
longer) a SIZECHANGE notification is sent to userland via devd.
Add a "nostart" rc.d script (runnable manually but not automatically at
boot time) and a devd script which invokes it when a notification
arrives. The rc.d script enlarges the "final partition" on partitioned
geoms, or the UFS filesystem or zpool device when triggered on a disk
containing either of those.
Reviewed by: imp, ziaee
MFC after: 2 weeks
Relnotes: Disk partitions and filesystems can be enlarged
automatically when disks grow by setting
growfs_postboot_enable=YES in /etc/rc.conf.
Sponsored by: Amazon
Differential Revision: https://reviews.freebsd.org/D58582
growfs_postboot: Invoke via service(8) Use service(8) rather than invoking /etc/rc.d/growfs_postboot directly. Requested by: bapt Reviewed by: bapt MFC after: 2 weeks Fixes: https://cgit.freebsd.org/src/commit/?id=5a31987d4c39 ("rc+devd: Add growfs_postboot") Differential Revision: https://reviews.freebsd.org/D59145
Notable upstream pull request merges:
#16761 eb1738bcb FreeBSD: Enable Direct IO by default
#16747 -multiple On-demand log-spacemap flush
#18474 0d0eae2ab implement thorough scrub support (zpool scrub -t)
#18562 6721ab981 Calling thread IO
#18657 7ed1268d3 Fix race between device removal completion and pool export
#18707 0d1f3b1c6 RAIDZ: Fix parity regeneration/check condition
#18713 -multiple libzfs: fix key unload failure when unmounting an
encryption root
#18714 d902eec64 Disconnect metaslab tracing from default builds
#18716 e78fa488a zstream: multithreading
#18718 6acb99cb1 Do not return ESTALE for open-unlinked files
#18720 f607ef7e7 Fix insufficient locking in dedup verify
#18722 -multiple snapdir: misc cleanups
#18724 9bf75b4b1 Fix reads for blocks freed after being cloned
#18725 9b7642df9 Harden recv record validation
#18732 37f066e3c FreeBSD: Wire sha512 offload to the build
#18736 -multiple Remove idmap/userns concept from core & FreeBSD platform
code
#18742 d63f14057 libzutil: keep valid spare and l2cache paths on import
#18749 f217627d4 Fix receive of split large blocks with a short trailing
chunk
#18754 83bf40784 Use a single creation time for a recursive snapshot
#18755 ebd9e2765 zstream: add "drop records" chain module
#18763 7d565cdfa zfs bookmark: add recursive (-r) bookmark creation
#18765 50557cc80 zpool initialize: add -z to write zeroes
#18766 0467ba01c Add SECURITY.md policy filE
#18773 ffde77051 Fix deduce_nblkptr for large dnodes on receive
#18784 -multiple libzfs: clarify the raw incremental "IV set guid mismatch"
error
#18793 9a02e53ad libzfs: don't abort receiving a raw encrypted send that
carries holds
#18795 30426217b Rate limit Direct I/O verify zevents
#18798 73b202451 Bound explicit user prefetch to a fraction of the ARC
#18801 2a5331f8e Fix dmu_zfetch_prime() assuming a stream was created
#18802 fb5fdefd8 libzfs: fallback VDEV_UPATH to VDEV_PATH for non-DM
devices
#18809 bd2d87399 zdb: output refcounts from verify_spacemap_refcounts()
#18811 5d530b8be ABD: Validate borrowed buffer length
#18812 5d687a975 dbuf: use dirty record size for overridden writes
#18819 -multiple ddt: fix refcount bypass and gang member leak for dedup
gang blocks
#18821 87e2e4047 BRT: Implement partial bv_entcount writing
#18822 -multiple dnode_sync: Relax constraint on indirect freeing - #18822
#18827 d98fa72ca L2ARC: bound the rebuild by the write hand on a first
sweep
#18831 90cdd9aef Batch object reallocation syncs in zfs receive
#18833 466d90e15 zed: let autoexpand see capacity changes on partitioned
disks
#18835 1ac3f2786 mmp: skip non-writeable vdevs during activity check
#18838 a04c40138 DDT: Fix several bugs in pruning
#18841 0bb41751f zpool export: return EBUSY when zvol minors are in use
#18848 3020c18ca dmu_recv: Avoid potential null deref
#18855 8cdd9b2b7 mmp: do not require writes to mirror legs the config
marks absent
#18858 596c7a0ec Reduce dp_lock scope for MOS writes
#18859 3ebf3ffc4 Predict and throttle buffers dirtied by the sync context
#18860 -multiple Further parallelize block cloning
#18865 412b17a29 Fix DMU bonus hold leak on I/O error
#18867 b5bb1f816 Add missing checks to zfs_clone_range_replay()
#18868 3df5b2e7f libzfs: String trimming should not operate out of bounds
#18869 be62c5385 libzfs: Do not call munmap() when mmap() fails
#18871 74e76f2d8 libzfs: don't truncate a resolved vdev path in
zpool_vdev_name()
#18874 7312322b5 nvpair: Fix operator precedence
#18883 3bd8cefdc libzfs: don't read a dataset handle after closing it in
resume send
#18886 b4f70cb9e Fix negative time overflows in DDT pruning
#18888 674b1ae5c DDT: Make ddt_zap_walk() use cursor _by_dnode functions
#18889 fd1ae59c7 DDT: Skip DDT log lookups in ddt_prune_walk()
#18892 -multiple zhack: add "mmp reclaim" to recover a pool stranded by MMP
#18897 216de07d8 arc: fix race between arc_release() and arc_read_done()
#18899 28afe8b08 CodeQL: Flag implicit compare-then-assign in branch
conditions
#18917 0a79c039f arc: save on buf_hash_find() call at arc_read_done()
#18920 7026d3335 Fix race condition in raidz expansion startup
#18927 be55e01bc FreeBSD: Do not leak TSD zfs_geom_probe_vdev_key on errors
#18928 5bd7d4466 scan: count skipped blocks as examined
#18937 a5d678864 Allow pool import with corrupted spare/l2arc configs
#18960 -multiple vdev_open: use calling credential to check for device
access
#18961 acbcdd92c dmu_recv_begin_check: dsl_dataset_rele() should be called
on ds
#18962 df3ff37fc dmu_redact_snap: Do proper cleanup on ENAMETOOLONG
#18964 84aa7e7e0 libspl: consult ZFS_HOSTID on FreeBSD as well
Obtained from: OpenZFS
OpenZFS commit: 84aa7e7e09f6a4ddad9ec40dbe9498d50184ed07
In the world of containers, mounting a unix(4) socket is a common practice to allow communication between processes within containers. For example, both Podman and Docker can expose a unix(4) socket, and that same unix(4) socket can be mounted as a file accessible to a process inside a container, allowing that application to control Podman or Docker. Another example is PHP-FPM with NGINX, where, instead of using TCP/IP for communication between containers, a unix(4) socket is sufficient. However, nullfs(4) and all related components do not allow mounting a VSOCK on top of another. The current workaround involves creating the socket in a directory and mounting that directory. This is an option, though it does not provide a good user experience compared to directly mounting a VSOCK on top of another, since the application that creates the socket may create other sockets in that directory, and the user may not wish to share them, or, worse yet, applications that create unix(4) sockets may not provide any authentication at all, as they may assume that security at the file system level is sufficient. Reviewed by: dfr@ Approved by: dfr@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59158
This patch adds assorted bits needed by the nfsclrdma.ko module that implements client side NFS over RDMA. With this commit, the glue required by the nfsclrdma.ko module is complete and it should load ok. It should not affect non-RDMA operation. I've specified a long MFC, since the module still requires extensive testing and, hopefully, a review. MFC after: 3 months
Kernel stuff (other than networking, filesystems, and drivers).
When a process execve()s, pmc_process_exec() is supposed to evaluate whether the new image is setuid/setgid and if so, whether to detach PMCs. This was handled by pmc_can_attach(), which is effectively an open-coded copy of cr_xids_subset(). Unfortunately, the test of the result of this function was inverted, with the result that we'd detach PMCs only if the predicate said it was okay to do so. It appears the bug has always been there; it seems the intent was to return 0 on "success", i.e., it is okay to attach the PMCs, much like p_candebug(). Commits 1c3c698ba4c4 and 1c40b15971f0 obscured this a bit. I think this check is trying to be too clever. Let's make it simpler: simply do not attach PMCs unless the owner is privileged. This is how, e.g., ktrace works. I do not think it's worth trying to be more sophisticated than this unless we can generalize the policy in a way that's applicable to other subsystems. Also fix a bug at the end of pmc_process_exec(): pmc_detach_one_process() will call pmc_remove_process_descriptor() for us. Approved by: so Security: FreeBSD-SA-26:56.hwpmc Security: CVE-2026-58089 Reported by: netchild Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59102
This helper wasn't updated in commit be1f7435ef21, so in reality it was testing whether "gid" is the first supplemental group. If a user doesn't belong to a supplementary group, then it's testing an uninitialized slot; since ucreds are allocated with M_ZERO, this typically means that we're testing gid == 0. group_is_primary() has exactly one use, in mac_do. There, it's used to determine whether the requested primary GID can be used in a setcred(2) call when the ruleset does not explicitly specify a target primary GID. I believe this is mostly exploitable by daemons which have explicitly dropped privileges and called setgroups(0, NULL); logged in users will have a non-empty supplementary group list by virtue of having gone through initgroups(3). Fix group_is_primary(), and add a regression test. Approved by: so Security: FreeBSD-SA-26:59.mac_do Security: CVE-2026-58092 Reported by: Hazley Samsudin of GovTech CSG Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef21 ("kern: start tracking cr_gid outside of cr_groups[]") Reviewed by: olce, kevans Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59051
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the proctree relock. After relocking the tty, it did not revalidate the tty state, and it could end up linking a doomed tty to the calling process' session. This race can be exploited to escalate privileges. TIOCSPGRP has a similar race, fix that too. Approved by: so Security: FreeBSD-SA-26:62.tty Security: CVE-2026-58093 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59126
The check for whether shm_lp_psind was assigned was unlocked. This race can be exploited to create an object with psind==2 but with only pagesizes[1] worth of pages populated. This in turn can be used to escalate privileges. Fix this by acquiring the rangelock earlier. In shm_mmap_large(), assert that we hold the rangelock. In shm_write(), annotate an unlocked load of shm_lp_psind. Approved by: so Security: FreeBSD-SA-26:63.posixshm Security: CVE-2026-58094 Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59104
Define it everywhere that wants COMPAT_FREEBSD14. Reviewed by: imp, kib, emaste Sponsored by: OPNsense Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D59017
Python scripts which use divert sockets no longer work after commit e967a2a03677; even if one patches socket() calls, getaddrlen() doesn't work on divert sockets, needed to use recvfrom(). Restore compatibility when COMPAT_FREEBSD15 is defined. Reviewed by: kib Sponsored by: OPNsense Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D59018
If all member devices report the same rotation rate, pass it up.
Commit 08063e9f98 renamed cs_cpu to csr_cpu.
Finish reviewing all callers for lkpi_80211_mo_link_info_changed() and lkpi_80211_mo_bss_info_changed(), which are called from lkpi_bss_info_change() only. Add the lockdep_assert_wiphy() to lkpi_bss_info_change() and make sure all callers are holding the wiphy lock. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297228 Sponsored by: The FreeBSD Foundation MFC after: 3 days
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the subfunctions they call from if_vtnet.c to virtio_net.h. This allows us to call these functions from if_tuntap.c and if_ptnet.c. virtio_net.h already contained a copy of these functions, but a copy of an outdated version. The functions evolved in if_vtnet.c. In if_vtnet.c, the copy has never been used because it increments counters in their own functions. This patch removes the outdated copy from virtio_net.h and moves the new version of the functions from if_vtnet.c to virtio_net.h. if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions, and if_vtnet.c increments its counters depending on the return value. Reviewed by: tuexen MFC after: 1 month MFC to: stable/15 Differential Revision: https://reviews.freebsd.org/D57299
Adds missing structs symbols for V4L2. video(4) capture devices do not crop, expose menu controls or support overlay, and return ENOTTY for the new ioctls. Applications enumerate these unconditionally and degrade gracefully at run time, but fail to build when the declarations are missing. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59203
Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D59208
After rangelocks were reimplemented, _rangelock_cookie_assert() became a stub. Re-provide an implementation. Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59222
When connecting a unix domain stream socket, we 1. look up the peer (listening) socket, 2. allocate a new socket 3. add the new socket to the listening socket's queue Prior to commit 26147c51546e, this sequence of operations was synchronized by a pool mutex, also acquired in uipc_close(). After commit 26147c51546e, we drop the vnode pool lock immediately after finding the peer socket via a filesystem lookup. This creates a window where it's possible for a connection to add a new socket to the listening queue after the listening queue has been aborted. Fix the race by restoring the old behaviour of holding the pool lock across the solisten_enqueue() call. This is a bit ugly since we need to pass a mutex lock and a vnode through a couple of layers, but it seems like a low-risk solution. Alternately we could add some flag to the listening socket which indicates that no new connections are to be accepted, but I think this will require some changes to the generic socket code. Reported by: pho Fixes: https://cgit.freebsd.org/src/commit/?id=26147c51546e ("unix: pin the pathname peer by reference across the connect") Reviewed by: olce, kib, John Ericson <John.Ericson@Obsidian.Systems> Differential Revision: https://reviews.freebsd.org/D59201
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58094
The capability will allow the ptrace(2) on the procdesc. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
If the flag is not specified, the process descriptor returned by either pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
The code to handle copyin and copyout of the structured parameters is moved into the helpers. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59113
The function defines the policy for allowing to open a pid. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid(2) syscall is allowed in capability mode. Add the chicken switch security.bsd.ptrace_in_cap_mode, which disables it without reboot, if needed. The descriptor passed to pdptrace(2) must have the CAP_PTRACE capability enabled. This capability is not enabled by default by pdfork()/pdopenpid(), and the calls do not return a procdesc suitable for debugging. The opening code must prepare for debugging in advance by passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid(). For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current thread and process in cap mode as well. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid() syscall is allowed to open processes which are either direct children of the caller, or are debuggees already attached to the calling process. This is reasonable because we could have controlled the child on fork anyway. The procdesc-less debuggee can legitimately appear due to ptrace FOLLOW-FORK mode. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989
Originally gstripe created a separate child I/O for every accessed stripe, making it very inefficient for small stripe sizes. Later introduced "fast" mode reduced that count for read/write requests by copying the data to/from temporary contiguous buffers, wasting memory bandwidth and CPU time. This commit implements alternative method, utilizing unmapped I/O mechanism to assemble children I/Os from pages of the original I/O, avoiding any copying. This method though has some limitations, such as stripe size can not be smaller than CPU page size, or buffer and offset page phases should match (may be page aligned, but not necessarily). But those limitations are not an issue in many cases, since ZFS, for example, can often align its buffers (BTW, dd doesn't). Plus, unlike "fast" method, this one can receive (and even prefers) unmapped I/Os. While there, re-implement also BIO_DELETE. Since they don't have any data, there is no any reason to create more than one child I/O per disk. It also dramatically improves performance there. And for dessert, add rotation rate attribute support, reporting one if all the children report the same. ZFS is using it more and more.
Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59132
tty: add tty_wait_proctree(9) Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59132
tty: make tty_wait_background() aware of proctree_lock ownership Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59132
tty: gracefully handle proctree_lock locking Instead of relocking tty to get the proctree_lock and experiencing the race due to the relock, take the proctree_lock in advance for ioctl commands that need it. The affected commands, TIOCNOTTY, TIOCSCTTY, and TIOCSPGRP, must not be overridden by the specific tty drivers, so the common handling is cleaner. Reviewed by: kevans (previous version), markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D59132
If all member devices report the same rotation rate, pass it up.
If all member devices report the same rotation rate, pass it up.
This patch adds assorted bits needed by the nfsclrdma.ko module that implements client side NFS over RDMA. It should not affect non-RDMA operation. Some additional glue is needed for the nfsclrdma.ko module within the NFS code. That will be added as a separate commit. I've specified a long MFC, since the module still requires extensive testing and, hopefully, a review. MFC after: 3 months
Enable the new growfs_postboot mechanism. Note that this also implies disabling automatic allocation of swap space on the root disk, since we cannot grow the root filesystem if swap space is allocated after it. This will not be MFCed since it is a significant behavioural change. Sponsored by: Amazon Relnotes: yes
A recent commit started to use _uid and _gid in <bsd.dirs.mk> to mangle the user and group for newly installed directories when MK_INSTALL_AS_USER is set. However, _gid was previously only set when _uid was not 0, causing the group to be set to the empty string. Set _uid and _gid together to avoid this problem. Fixes: https://cgit.freebsd.org/src/commit/?id=541e6e2d516b6c9d3681b24464e9ef53c1f2579a PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297841 Reviewed by: emaste, imp Reported by: Ralph Zitz <ralph@zitz.dk> Differential Revision: https://reviews.freebsd.org/D59150
This mirrors the changes applied to kernel debug symbol sets in commit 9a354a41be9a40c3c0a16cc20f4009d3b31679cc. Reviewed by: emaste Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D59058
MFC after: 1 month MFC to: stable/15 MFC to: stable/14
Add -t tag[,...] so a review can be tagged at creation instead of needing the web UI. Spaces in tag names are written as underscores; a leading # is optional. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59019
git-sh-setup treats -h as help against an empty USAGE, so "git arc create -h" prints "usage: git arc". Handle -h before sourcing it so every subcommand prints the real synopsis. The create, stage, and update synopses showed optional commit-refs while git-arc(1) and the code require them. Advertise -p parent on create; the option was already implemented and documented. Sort create sub-command option-arguments alphabetically in three places: (1) synopsis from tool, (2) man-page synopsis, and (3) man-page description. Check for jq(1) / arc after checking for usage so -h always works. While here, fix missing "local o" in gitarc__stage(). Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59129
Suggested by: asomers
This generalizes the divapp logic and makes it usable for other test scenarios such as diverted TCP connections. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59067
This tests what FreeBSD-SA-26:56.hwpmc fixed. exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away when its target execs a set-gid program its owner is not entitled to trace. exec_setuid_no_double_unlink lets the target exec a set-uid program; the teardown must unlink the process descriptor exactly once, and completing at all is the assertion. Both need an unprivileged owner and must not drop privileges themselves, since p_candebug() would then refuse the target to its own owner; they ask for require.user instead. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 5)
A pmc_id_t is a packed integer that the driver hands to userland and accepts back on eleven operations, and nothing tested what happens when one comes back forged, stale, or belonging to another process. Neither was there a test that an unprivileged caller is refused the operations that need a privilege. The cases use a SOFT-class PMC wherever the counter itself does not matter, so they run on a machine with no PMU. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 5)
Seven ATF cases covering process-attachment teardown orderings: a target that exits before it is detached, the owner that exits before its target (hwpmc's other unlink path), releasing a still-running attached PMC, row exhaustion with out-of-order release, and PMC_F_DESCENDANTS inheritance including a fork storm. All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 5)
The companion to pmc_exec_test.c, which covers only the drop side of a credential-changing exec. Three cases cover what the drop must not overreach into: an exec that changes no credentials keeps the PMC, a set-id exec whose credential change the kernel suppresses for a traced target keeps it too, and a set-id fexecve(2) drops it. They exercise the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect it fixed. All three pass on a debug (INVARIANTS+WITNESS) kernel. The two keep-cases were each observed to fail on a kernel mutated to detach unconditionally. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 4.8)
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less log operations: which descriptors are accepted, when a log is required in the first place, and what the log operations do without one. MFC after: 1 month MFC to: stable/15 MFC to: stable/14 Assisted-by: Claude Code (Opus 5)
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58586
Adjust test to check for ECAPMODE using grandchild instead of child. Childrens can be opened even in cap mode. Add test for the later. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58989
Do not assign `b` in the `ATF_REQUIRE` macro. Set and test `b` separately to avoid the issue cited by clang++/g++ after implementing the change referenced in [1]. MFC after: 2 weeks Reported by: clang (-Wparenthesis) Reference: https://github.com/freebsd/atf/pull/72
kqueue returns a value != -1 on error. Test for that instead of any non-zero value to confirm that success was achieved when calling `kqueue`. This issue exists with ATF 0.22+ [1]. MFC after: 2 weeks Reported by: clang (-Wparenthesis) [1]: https://github.com/freebsd/atf/pull/72
These could go in other categories, but it's more clear if they're here instead.
Use tabs consistently in #defines No functional change intended. Reported by: Hannes Elfert MFC after: 1 week MFC to: stable/15
Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D59161
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298044 MFC after: 3 days
This is a rollup commit from upstream to fix: Handle signature_algorithms_cert extension in key-only context Avoid double free of qrx in port_default_packet_handler() Avoid full read buffer allocation when buffering DTLS next-epoch records ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit ssl/record: remove dead DTLS processed_rcds record queue Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap CMP unexpected sender DN used as format string in ERR_raise_data() Add test for CVE-2026-63073 Add a test for restricting growth in cmp cert cache Fix unbounded cert cache growth in cmp Don't store ACK-only frames in TX history for QUIC. Add test for CVE-2026-63076 Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg Approved by: so Obtained from: OpenSSL Security: FreeBSD-SA-26:61.openssl Security: CVE-2026-14457 Security: CVE-2026-18798 Security: CVE-2026-54874 Security: CVE-2026-63072 Security: CVE-2026-63073 Security: CVE-2026-63074 Security: CVE-2026-63076
Suggested by: cy, emaste Reviewed by: cy Differential Revision: https://reviews.freebsd.org/D55929
This is a security bugfix release. Please see the related merge commit
for more details.
Maintainer note: `quic_ackm.h`'s conflict was resolved by taking
the upstream version of the file verbatim.
Conflicts:
crypto/openssl/include/internal/quic_ackm.h
MFC after: 3 days
Merge commit '248da023ae5ea7292930ac5d715d88b87e2e6f46'
crypto/openssl: update generated content to match 3.5.8 release This contains 2 new manpages as well as some minor manpage content changes. MFC with: 78e936b2d
crypto/openssl: add manpages missed in related commit MFC with: 78e936b2d Fixes: https://cgit.freebsd.org/src/commit/?id=0d4d0f3a9 ("crypto/openssl: update generated content ...") Reported by: Jenkins CI
whereis(1): Respect PORTSDIR variable PORTSDIR is a very common variable that points to the location of a ports directory. Make whereis(1) respect this variable too. Reviewed by: arrowd@, christos@ Approved by: christos@ Differential Revision: https://reviews.freebsd.org/D56845
Revert "whereis(1): Respect PORTSDIR variable" This reverts commit edadc3f9051595a9c2e693d8ab666a50b9e7a21a.
Not classified automatically, and waiting for manual attention.
-- no commits in this category this week --
Dates:
cgit.freebsd.org/src. Git accurately records the
order of commits, but not their dates.Automatic grouping:
This reverts commit \\b([0-9a-fA-F]{40})\\b
and the hash was found in this week's commits.
Automatic categories:
Source code:
Generated with commits-periodical 0.21 at (time removed for reproducibility).
This work is supported by Tarsnap Backup Inc.
Alternate version: 2026-08-24 (debug) (contains info about the classification)