FreeBSD git weekly: 2026-09-14 to 2026-09-20

Hardware support

Hardware drivers and architecture-specific code.

video(4): add missing V4L2_CAP_EXT_PIX_FORMAT feature

this fixes, 2 failed v4l2-compliances tests

bae084550c8caa5e13504fcb5b962256b68c29be Baptiste Daroussin 2026-09-12 05:56:06

video(4): wake the kqueue knote when a buffer completes

selwakeup() only wakes select/poll waiters; it does not notify the kqueue
knote registered on the device, so EVFILT_READ never fired when a frame
became available.

9315ab37fdc1ea7ffb0aeb7835ba1de937c047e4 Baptiste Daroussin 2026-09-12 07:01:56

powerpc/radix: acquire the pmap lock in mmu_radix_extract()

mmu_radix_extract() walks the page tables without holding the pmap lock,
unlike its hash MMU counterpart moea64_extract(). A concurrent unmap can
free and recycle the page table page being walked, so the read returns
whatever now occupies that memory and the caller gets a physical address
that never existed.

That is how mmu_radix_sync_icache() came to hand a bogus address to
__syncicache() and panic the machine. Commit 1574ca1955f5 worked around
it by taking the pmap lock in mmu_radix_sync_icache(), but the machine
independent callers of pmap_extract() - vm_sync_icache(), proc_rwmem()
and the vslock() paths - remain exposed to the same failure.

Rename the existing body to mmu_radix_extract_locked(), which asserts the
lock, and make mmu_radix_extract() a thin wrapper that acquires it.
mmu_radix_sync_icache() already holds the pmap lock, so it calls the
locked variant directly and neither recurses nor reacquires the lock once
per page.

Suggested by:   alc
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59320
Reviewed by:    markj, jhibbits

42c69445ca336b13e27e3e5960ace344c64ae0eb Piotr Kubaj 2026-09-14 13:13:51

tpm: crb: check the error bit only after taking locality

tpmcrb_transmit() read CRB_CTRL_STS before requesting locality 0.
An AMD Pluton fTPM (like FrameWork Desktop) using the plain CRB start method
reads the control area as all-ones until locality is assigned, so bit 0 looks
like a stuck tpmSts and every command failed with EIO.

With RANDOM_ENABLE_TPM the harvester retries every 10 seconds, so this printed
"Device has Error bit set" forever.

Reviewed by:    kbowling
Approved by:    kbowling
MFC after:      2 weeks
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D59661

7c375af72ef3f631e89431ae32a855d806e6ec98 Olivier Cochard 2026-09-14 14:21:11

Commit group #0: thunderbolt

thunderbolt: Support writing to router config space

Reviewed by:    adrian, ngie
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D49452

9c6e9bfb347428457d2061411cbfc8922dc5f7f2 Aymeric Wibo 2026-08-12 17:37:30

thunderbolt: Factor out router_prepare_cmd()

Common code between router_prepare_read() & router_prepare_write().
Eventually will be used by other commands (e.g. hotplugging) aswell.

Reviewed by:    ngie
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59668

808c82daab85c2c5576f37bcf371c3e1a51f71d9 Aymeric Wibo 2026-09-14 14:19:49

thunderbolt: Change len from int to size_t in router_prepare_{read,write}()

Suggested by:   ngie
Reviewed by:    ngie
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59668

44b73821d1c077bf899298cbebbb2f625598c8e9 Aymeric Wibo 2026-09-14 14:21:52

thunderbolt: Account for CRC in router config write message size

Fixes:          https://cgit.freebsd.org/src/commit/?id=9c6e9bfb3474 ("thunderbolt: Support writing to router config space")
Sponsored by:   The FreeBSD Foundation

f74d7fc4131d6aca081d10e92e7bc19584a20d77 Aymeric Wibo 2026-09-17 00:18:31

vtnet: offer VIRTIO_NET_F_GUEST_CSUM

Always offer the VIRTIO_NET_F_GUEST_CSUM feature to the host, and not
only if RXCSUM is enabled on vtnet. Instead of using RXCSUM to control
whether this feature will be negotiated with the host, just use it to
control whether the VIRTIO_NET_HDR_F_DATA_VALID flag on an incoming
packet is processed (i.e., translated to the corresponding mbuf flag
only if RXCSUM is enabled on the vtnet interface).
This has two benefits:
1. Enabling/disabling RXCSUM on vtnet does not require feature
   renegotiation.
2. The host is always allowed to send locally generated TCP or UDP
   packets to the guest without computing a full checksum (by setting
   the VIRTIO_NET_HDR_F_NEEDS_CSUM flag) and not only if the guest has
   enabled RXCSUM on vtnet. Since locally generated packets do not
   require a checksum, this saves otherwise unnecessarily wasted
   computing power.
If a user of a FreeBSD guest really does not want to negotiate the
VIRTIO_NET_F_GUEST_CSUM feature with the host, it still can disable
the loader tunable hw.vtnet.csum_disable.

Reviewed by:            kfv, tuexen
MFC after:              1 week
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D59052

c1fa70c6e9f652e79ef3ffaf366949744f11ce5c Timo Völker 2026-09-14 20:09:35

Commit group #1: ufshci

ufshci: tell the controller how long the EHS is

The transfer request descriptor has a field for the total Extra Header
Segment length. The driver left it at zero. A request that carried an
EHS went out as the bare command UPIU, and the device answered a request
it had only seen part of.

Fill the field from the request UPIU header, which already carries the
same length. Every other path sets it to zero, so nothing else changes.
An EHS is the first thing that makes a request vary in size, so assert
that the request and the response still fit in the command descriptor.

Reviewed by:    imp (mentor)
Sponsored by:   Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59557

d3e5082ce4dcb154cbf50cba05d8f1dbbd55a5fc Jaeyoon Choi 2026-09-15 01:37:30

ufshci: add a control device node

The driver only exposed a CAM SIM. Userland had no way to reach the
device for anything that is not a SCSI command, so reading a descriptor
or an attribute was impossible.

Add /dev/ufshci%d as a root only node and the ioctl ABI header for it.
The node answers no ioctl yet. The header pulls in ufshci.h, which
declares bool only under _KERNEL, so include stdbool.h for userland the
way nvme.h already does.

Reviewed by:    imp (mentor)
Sponsored by:   Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59558

28fefc441e3b701acc2888892a518774394255c7 Jaeyoon Choi 2026-09-15 01:39:41

ufshci: add a passthrough ioctl

This ioctl is for a port of ufs-utils:
https://github.com/SanDisk-Open-Source/ufs-utils

The driver only exposed a CAM SIM. Reading a descriptor, an attribute
or a flag needs a query request, and a UniPro attribute needs a DME
command. The driver built both only for its own setup, so userland
could reach neither.

Add two ioctls on the control node. UFSHCI_PASSTHROUGH_CMD sends a
UPIU the caller built, sizes the request from its transaction code,
and copies the response UPIU back. UFSHCI_PASSTHROUGH_UIC carries the
four attribute commands and refuses the rest, which can drop the link
or power the device off. It keeps the raw argument2 so the caller can
read the result code the device reported, not just a failure.

Validate the input and bound it by what the controller can map. The
descriptor has no request length, so the controller reads it from the
UPIU header, and a header that declares more than was copied in would
reach past the descriptor. The ioctl layer copies output back only on
a zero return. So a command that reached the device is a success even
when it was refused. The caller reads the reason from the response
header, and an answerless failure comes back as EIO. Clear the
response before use so no stale bytes read as a device answer.

Reviewed by:    imp (mentor)
Sponsored by:   Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59559

ae31f2928596f8c6efc8f136559562d864968dcc Jaeyoon Choi 2026-09-15 01:40:33

ufshci: build the ioctl file into the kernel

The passthrough ioctl went into the module build only. A kernel with
device ufshci then failed to link, because ufshci_ctrlr.c calls
ufshci_ioctl_construct() and ufshci_ioctl_destruct() and neither was
compiled in.

Add the file to sys/conf/files.

Fixes:          https://cgit.freebsd.org/src/commit/?id=28fefc441e3b ("ufshci: add a control device node")
Sponsored by:   Samsung Electronics

d435248a2196bc78f626850a7ae700aaeace1c13 Jaeyoon Choi 2026-09-15 03:02:38

hn: Refresh VF offloads after bringing it up

VF readiness can precede its first initialization.  In particular,
iflib populates if_hwassist during init, so copying it while the VF is
still down can leave hn advertising checksum and TSO capabilities with
no hardware-assist flags.  The stack then uses software segmentation
until a capability ioctl happens to refresh the copied state.

Synchronize enabled capabilities and hardware-assist flags after the VF
up ioctl succeeds, before switching the datapath and enabling transparent
VF transmit.  Use the existing helper in the common initialization path,
covering both normal bring-up and delayed VF initialization.

MFC after:      2 weeks
Sponsored by:   BBOX.io

7c43b915de433bf7a9988faccd6e638f02e47fea Kevin Bowling 2026-09-14 22:28:17

hyperv: Stop bus relations handling from falling through to eject

The PCI_BUS_RELATIONS2 case lacks a break after queuing the reported
devices.  It consequently processes the same packet as PCI_EJECT,
interpreting device_count as the slot number.  If that value matches an
existing child, the callback schedules an unintended device eject.

End the relations case after processing the device list, matching the
original PCI_BUS_RELATIONS handling.

Fixes:  https://cgit.freebsd.org/src/commit/?id=ea11861e434a ("arm64: Hyper-V: vPCI: Enabling v-PCI in FreeBSD in ARM64 Hyper-V")
MFC after:      2 weeks
Sponsored by:   BBOX.io

ddcf8be82b0f17c767d2edab026a4f5cfa3d217e Kevin Bowling 2026-09-14 22:31:58

hn: Track VF association and wait for datapath switch completion

Handle the host's VF association notifications instead of ignoring them.
Require an allocated association before switching to the MAC-matched VF,
and track notification generations so a withdrawal during initialization
cannot enable an obsolete handoff.  Defer association and address-event
work to the VF taskqueue; the receive channel must remain available to
deliver switch completions.

Request and wait for the empty VMBus completion for SET_DATAPATH, checking
submission and channel-revocation failures.  Enable transparent VF
transmit and select its link status only after the switch completes.
Use the existing transaction lifetime and revocation handling, without a
timeout that could leave a late completion referencing a freed request.

Restore synthetic capabilities, TSO limits and hardware-assist flags on
fallback, targeting hn rather than the departing VF.  Block transparent
transmit during handoff and after association withdrawal.  Separate the
attach delay from saved-setting readiness, permit delayed association to
trigger initialization, and require a fresh handoff after NVS reattach.
Stop and detach still close local VF access if returning to the synthetic
path fails; such failures are logged, not reported as a successful switch.

MFC after:      2 weeks
Sponsored by:   BBOX.io

a64205b1354d67c280670859c47a18e80f740803 Kevin Bowling 2026-09-14 23:06:15

hn: Serialize VF link events with datapath handoff

Hold hn_vf_lock across the VF identity/state check and link publication.
Otherwise an event can observe an enabled VF, pause during fallback, then
overwrite the freshly reported synthetic carrier with stale VF state.
Ignore events while switching or after the association generation changes.
The link notification only queues further work, so the callback does not
need the sleepable hn lock.

Document that association serial numbers are currently diagnostic:
hn_ismyvf() matches the VF by MAC, while notifications gate availability.

MFC after:      2 weeks
Sponsored by:   BBOX.io

6b3b1d6d4f43d1521e5e10b759e3542deaf23667 Kevin Bowling 2026-09-15 00:22:13

ixv: Add Hyper-V virtual function support

Hyper-V does not expose the normal Intel PF/VF mailbox.

Import the Hyper-V operation overrides from DPDK and complete its reset
callback with the configuration-space mechanism submitted by Microsoft.
Route ixv operations through the operation table, use mailbox API 1.0,
and limit this environment to one queue pair.

Claim the 82599, X540, X550, X550EM-X, and X550EM-A Hyper-V device IDs
listed by DPDK.  Select the same path for the E610 Hyper-V subdevice
identity defined there.

For E610/Linkville, read the emulated VFLINKS-format status from PCI
configuration space at offset 0x209.  Older families retain the MMIO
VFLINKS path.

Treat receive-mode changes as host-owned no-ops and do not retry VLAN
operations that Hyper-V permanently rejects.  Limit the Hyper-V 82599
MTU to 1504 because its VF does not implement the X540 RLPML field.

Use mailbox reset indications only to refresh cached Hyper-V link state.
Hyper-V does not provide the mailbox handshake required to treat that
indication as a request for an iflib reinitialization.

Tested on 82599 and E610 (with a followup commit) with Windows Server
2025 Hyper-V.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=232472, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239849
Obtained from:  DPDK (shared code)
Sponsored by:   BBOX.io
Co-authored-by: Wei Hu <weh@microsoft.com>

9ea7beb173b8b5c77663ee0f86b32cc76f20357f Kevin Bowling 2026-09-07 03:34:50

ixv: Recover E610 Hyper-V carrier without the PCI link query

Current Windows PF drivers do not emulate the E610 link-status query at
PCI configuration offset 0x209.  The installed Intel ixw 1.8.54.0 driver
returns zero even with the physical port connected, leaving the VF at
no carrier after an otherwise successful hn handoff.

When the query returns zero, use VFLINKS for carrier only.  Its speed
field is not the negotiated E610 line rate: the tested 1 Gb/s port
reports the default 10 Gb/s encoding.  Publish an unknown speed instead,
including in the verbose link-up diagnostic, and document this fallback.
Keep nonzero PCI results authoritative and reject all-ones reads.  Other
Hyper-V families and the native E610 mailbox path are unchanged.

A zero result cannot distinguish an unsupported query from a down link;
in either case this fallback relies on the legacy carrier indication.
The connected and disconnected ports reported VFLINKS.UP set and clear,
respectively, while both returned zero from the PCI query.

MFC after:      2 weeks
Sponsored by:   BBOX.io

f589d1fc36cebcc298eb708bf5eae57bd1d491d7 Kevin Bowling 2026-09-14 23:51:01

ixv: Use host granted RSS queues on Hyper-V

Discover the Hyper-V queue grant through PCI configuration space for
X550, X552, X553, and E610 VFs.  The X550 family exposes a byte at 0x207;
0x208 is a separate DCB flag.  E610 exposes a little-endian queue count
word at those offsets.  Accept grants of one, two, or four and use at most
two symmetric queue sets, subject to the existing MSI-X resource limit.
Keep one queue for invalid grants and for 82599/X540 Hyper-V VFs.

The family gates and queue limits are snooped from Windows Intel VF bus
traffic.

Update the shared code queue max so stop disables every usable queue.
Also program the receive length limit on every usable RX queue instead
of only queue zero and retain the 82599 exception for that register field.

MFC after:      2 weeks
Sponsored by:   BBOX.io

a54f83544eea2a9804ac7940d35b26ffcb34dfb3 Kevin Bowling 2026-09-15 05:57:18

snd_uaudio: Read the UAC2 sample rate back after setting it

Some devices only apply a new sample rate once it has been read back,
and produce no sound at all otherwise.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294803
Reported by:    tatsuki_makino@hotmail.com
Tested by:      tatsuki_makino@hotmail.com
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D59616

694923501f56a5d4519f548ee06db603f9486bc7 Christos Margiolis 2026-09-15 12:12:43

ntb_tool: Bound memory window option strings

parse_mw_buf() copies option names from privileged sysctl input into
eight-byte stack buffers.  Unbounded %s conversions permit option tokens
longer than seven bytes to write past those buffers before the parser
validates them.

Limit each conversion to seven characters, leaving space for the
terminating NUL.

Signed-off-by: Yudi Yang <yudi.yang@rice.edu>

Fixes:          https://cgit.freebsd.org/src/commit/?id=96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.")
Reviewed by:    markj
MFC after:      1 week

602d1b994a22949fff7e4a87cb6e54d6fbad13b6 Yudi Yang 2026-09-10 21:53:48

riscv: Preserve savectx return address with vector support

Calling vector_state_store_savectx() overwrites ra with the address of
the following ret instruction.  The ret consequently branches to itself
and prevents kernel dumps from progressing past dump_savectx().

Tail-call vector_state_store_savectx() so that it returns directly to
the original savectx() caller.

Reviewed by:    br, jrtc27
Approved by:    jrtc27
Fixes:          https://cgit.freebsd.org/src/commit/?id=d7a393095cfd ("riscv: Vector Extension (RVV) support.")
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59689

99ed9753a5c5c5262a0ed1464c701cde174b55fd Minsoo Choo 2026-09-15 01:13:31

iw_cxgbe/libcxgb4: Support 64B CQEs

The larger CQE exports the RSS header to userspace.  Note that this
changes the ABI between the driver and library, so the ABI version is
bumped.  A new user->kernel create_cq request message is defined to
disallow a CQE size mismatch between iw_cxgbe and libcxgb4.

Sponsored by:   Chelsio Communications
Co-authored-by: Steve Wise <swise@opengridcomputing.com>

c957af2c210aa3d7b72a886b663b9f425baa3186 John Baldwin 2026-09-14 15:37:08

cxgbe: Query the ability to use RDMA WRITE_WITH_IMMEDIATE requests

Sponsored by: Chelsio Communications

2a580b30cf26736e4921490276ffd3ebb20990de John Baldwin 2026-09-14 15:37:23

iw_cxgbe/libcxgb4: Support for RDMA WRITE_WITH_IMMEDIATE requests

Sponsored by: Chelsio Communications

6c858dab48d67c1de0a3827d7f13600de49f9edb Steve Wise 2017-06-23 20:41:08

cxgbe: Enable RDMA WRITE_CMPL work requests if the firmware supports them

This work request permits combining RDMA WRITE and SEND_INV commands
into a single work request.

Sponsored by:   Chelsio Communications

0d635085b8e7d70beaa7a0fe3a1c865c26da2d2f John Baldwin 2026-09-14 15:37:47

iw_cxgbe/libcxgb4: Support for RDMA WRITE_COMPL work requests

To optimize NVME-oF READ IOPs, use a specialized work request that
combines a RDMA WRITE and SEND_INV chain into a single request.

Sponsored by:   Chelsio Communications
Co-authored-by: Potnuri Bharat Teja <bharat@chelsio.com>

b78f8fac5bd3d3c44c1e3887eff01f230786ce15 Steve Wise 2017-10-30 20:23:45

iw_cxgbe: Fixes around work queue flushing and draining

- Only insert drain CQEs if a work queue is flushed

- Preserve the request opcode of the original request when flushing a
  request.  Use bit 10 of the CQE header word to indicate the CQE is a
  special drain completion, and save the original WR opcode in the cqe
  header opcode field.

- If a work request chain was posted and needed to be flushed, only
  the first request in the chain was completed with FLUSHED status.
  The rest were never completed.

- When a CQ is shared by multiple QPs, c4iw_flush_hw_cq() needs to
  acquire the corresponding QP lock before moving the CQEs into its
  corresponding SW queue and accessing the SQ contents for completing
  a WR.

- Once a user QP has been flushed, it cannot be flushed again.

Sponsored by:   Chelsio Communications
Co-authored-by: Steve Wise <swise@opengridcomputing.com>

f08d90e47d9227f81ff76c28fc754315b0c405d8 Potnuri Bharat Teja 2018-02-13 12:24:00

iw_cxgbe: Various fixes around waiting for replies to work requests

Allocate wait objects dynamically and add a refcount instead of
allocating them on the current thread's stack.  This permits
c4iw_wait_for_reply() to safely fail with an error and mark the device
as dead if a reply is not received after C4IW_WR_TO seconds.  Once a
device is marked dead, future requests fail immediately.

Sponsored by:   Chelsio Communications

6ee16b9fa6a1fb4de778ac03dbaa281ea2e276be Potnuri Bharat Teja 2018-02-15 07:32:53

iw_cxgbe: use __raw_write*() to allow write-combining

pio_copy() is suppose to be used for write-combining work requests.
However, for some architectures like powerpc and arm64, write[ql]()
include an explicit memory barrier which will flush the WC buffer and
render this path useless. To prevent that use the relaxed variant.

Sponsored by:   Chelsio Communications

96d9a91d6aafa862f6e0740bbaa6cbc936ad5e19 Steve Wise 2018-03-10 20:37:56

iw_cxgbe: Add ib_device->get_netdev support

Obtained from:        Linux commit f215a3d2448ae77253f0b93dcc37114779f51778

deb465a194b153dd408f508e911a7afb3b57440a Steve Wise 2018-03-22 19:53:35

iw_cxgbe: Use XArray instead of IDR

Obtained from:        Linux commit 52e124c27e7bfb78980189bdfec049594d7612be
Obtained from:  Linux commit 2f43129127e62b25f56ff82a37c40b42c0e6f883
Obtained from:  Linux commit 7a268a93973c07f93e952d96c2faa88df8ed38d8
Sponsored by:   Chelsio Communications
Co-authored-by: Potnuri Bharat Teja <bharat@chelsio.com>

f9076bdaa253c71e49caff9b8fc65bfcf52c5393 Matthew Wilcox 2019-02-21 00:20:52

iw_cxgbe: Cleanups to ucontext handling when creating queues

Obtained from:        Linux commit e00b64f7c54c4cbd88143bbd43e7c3d61a090e5c
Obtained from:  Linux commit 89944450547334aa6655e0cd4aec8df1897a205a

73151e4d92302c316dae126943e929c48a9df64e Shamir Rabinovitch 2019-02-07 16:44:49

iw_cxgbe: Use correct sizing on buffers holding page DMA addresses

Obtained from:        Linux commit 5f818d676ac455bbc812ffaaf5bf780be5465114

c1325c5516aa3809179abc407e150707d2d68546 Shiraz Saleem 2019-03-28 16:49:44

iw_cxgbe: Fix qpid leak

Add await in destroy_qp() so that all references to qp are dereferenced
and qp is freed in destroy_qp() itself.  This ensures freeing of all QPs
before invocation of dealloc_ucontext(), which prevents loss of in use
qpids stored in the ucontext.

Obtained from:  Linux commit f70baa7ee3d1b5a9e66ac7549e31641a656f23c1
Sponsored by:   Chelsio Communications

e29dccc64784bb572894c8b714ca212e38d8f8aa Nirranjan Kirubaharan 2019-05-23 07:05:39

iw_cxgbe: Remove unused return value from destroy_cq

Part of the original Linux commit was already applied during a prior
OFED update in commit b633e08c705fe43180567eae26923d6f6f98c8d9, but
this portion of the changes to the Linux iw_cxgb4 driver were not
included.

Obtained from:  Linux commit a52c8e2469c30cf7ac453d624aed9c168b23d1af

63786b0a06bb6bc20c73c96e21e25c5e46746e6f Leon Romanovsky 2019-05-28 11:37:28

iw_cxgbe: Remove unneeded memset

Obtained from:        Linux commit 4c44d4634b5c90993fccca9f155347221df6f877

9f2a288cbc5b3c7b101e92b80feca2ea664174fb Fuqian Huang 2019-06-28 02:47:19

iw_cxgbe: Do not dma memory off of the stack

Obtained from:        Linux commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb

a83be0b237bccff39301fbaa43353f2dbd34e719 Greg KH 2019-10-01 16:56:11

iw_cxgbe: Miscellaneous changes from the iw_cxgb4 driver

These include changes to use newer APIs, cosmetic changes to reduce
diffs between the two drivers, and other minor fixes.

Sponsored by:   Chelsio Communications
Co-authored-by: Arjun V <arjun@chelsio.com>
Co-authored-by: Krishnamraju Eraparaju <krishna2@chelsio.com>
Co-authored-by: Vishal Kulkarni <vishal@chelsio.com>

05057380ca392b29d33a4d362936e8af81101685 John Baldwin 2026-09-14 15:43:01

iw_cxgbe/libcxgb4: Pass ftid_base to libcxgb4 through status page

While here, fix incorrect frees in error paths in c4iw_alloc_context().

Sponsored by:   Chelsio Communications

3968a8759027b9bb225b439e47f077b3f5b1171f Potnuri Bharat Teja 2021-02-22 05:57:54

intel: add hfsts debug-probe driver for Intel ME/HECI firmware status

Add an amd64-only, Intel-only diagnostic driver that reads ME Host
Firmware Status registers from PCI configuration space without mapping the messaging BAR.

Select the HFS register count per device generation, decode sparse
HFS1 state, mode, and error fields, and expose raw and summarized
status via sysctl. Register an ISA-side hfstsfd probe for supported
RCBA/FD2 generations so firmware-hidden HECI functions can be diagnosed.

Reviewed by:    kbowling, adrian
Differential Revision:  https://reviews.freebsd.org/D58863

8e5e2c391059eaa0280a32b951e3ab1fac278364 Abdelkader Boudih 2026-09-13 22:05:01

iflib: Use the framework run-state accessor in drivers

Replace direct IFF_DRV_RUNNING reads in igbv, ixgbe, ixv, iavf, ixl,
ice, bnxt Ethernet, aq, enic and the axgbe PCI frontend with
iflib_is_running().  Keep each existing mailbox-ready, fault-state,
link-state and administrative-up condition: framework admission is not
a substitute for device specific readiness.

This covers interrupt admission, operational link publication, VF
mailbox and VLAN replay, and live-configuration decisions.  Remove
ifnet temporaries used only to read the driver flags.

Replace the em and igc debug dumps' RUNNING/OACTIVE text with one
framework admission snapshot.  OACTIVE does not mean that the interface
or hardware is inactive.  Label the result as software admission rather
than link state or proof that DMA has stopped, and retain the queue
head/tail dumps and separate RS diagnostics.  Keep the filter register
and requested interface flags in the axgbe PCI promiscuous-mode trace,
but remove its unrelated legacy driver flags.

Use the parent Ethernet PF context for the bnxt RDMA running check,
retaining the link-state check and the existing IB_PORT_ACTIVE policy.
Both current RDMA construction paths use the PF netdev, and Ethernet
detach synchronously removes the RDMA auxiliary child before iflib frees
that context.  Declare the direct iflib module dependency.  This does
not transfer ownership of RDMA queues to iflib.

Leave the independent, non-iflib axgbe ARM frontend unchanged.

Reviewed by:    iflib (gallatin)
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59601

d5ae08ff06240ca889010be9799e158efaa06322 Kevin Bowling 2026-09-11 19:04:15

e1000: Express TSO restart policy without OACTIVE

After a link speed change updates TSO capabilities, request a restart
when iflib is running or the interface is administratively up.  Leave
an administratively down, stopped interface to apply the change at its
next initialization.

Do not infer initialization from IFF_DRV_OACTIVE, which also remains
set after stop and failed initialization.  Use iflib_is_running() for
software admission and IFF_UP for intent; iflib retains responsibility
for quiescing any partially initialized queues before restarting.

This also permits a restart request for an administratively up
interface before its first initialization attempt.

Reviewed by:    iflib (gallatin)
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59599

ea71fa99827ad4b7099de87e41e7af39ee1c10f6 Kevin Bowling 2026-09-11 19:00:54

bcm2835_pwm: Fix dev.pwm.0.ratio2 register

A typo in the sysctl for RPI0 PWM channel 2 was causing it to
write to the wrong register, leaving it misconfigured if used.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298301
MFC after:              3 days (problem reported on 14.4)
Reviewed by:            adrian
Reported by:            Attila Kover <attila.kover@guardian.co.uk>
Differential Revision:  https://reviews.freebsd.org/D59644

32878e64e687a848fceb710ab9b45e396f27db3f Alexander Ziaee 2026-09-15 20:44:12

acpi: Increase length of time (1s -> 5s) for quirk

The ACPI quirk on Framework Laptop 12 firmware was previously clocked
at ~620 ms for a Notify 0x80 replayed on power-button press to wake.

However, when KMS is not loaded, that very same notification comes in
past the 1s we previously allowed.

Use the already-defined ACPI_MINIMUM_AWAKETIME (5) seconds as our new
boundary so that we can successfully come out of S3 on this hardware.

Introduce new tunable hw.acpi.button_replay_window

Reviewed by:    obiwac, olce
Differential Revision:  https://reviews.freebsd.org/D59583

d2ad1c3ffe67d7994a409956b6344dd458170d04 Devin Teske 2026-09-16 12:40:45

IB/mlx5: Enabled VLAN stripping capability

[PATCH 04/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Expose raw packet capabilities in the core layer to enable a device
to report it.
Two existing capabilities, scatter FCS and IP CSUM were added to this
field for a better user experience by exposing the raw packet caps
from one location.
This field will serve also for future capabilities for raw packet QP.

A new capability was introduced - cvlan stripping, which is the
device's ability to remove cvlan tag from an incoming packet and
report it in the matching work completion.

b) Check device's capabilities and report which raw packet capabilities
are supported.

c) Allow creating a WQ with cvlan stripping considering device's
capabilities. The default value was fixed to disable vlan stripping
till was asked explicitly.

In addition, allow modification of a WQ to turn on/off this property.

d) Enable creating a RAW Ethernet QP with cvlan stripping offload when
it's supported by the hardware.

e) Add support for creation of a WQ with scatter FCS capability, if
this capability is supported by the hardware.

Differential revision:  https://reviews.freebsd.org/D32178
MFC after:      1 month

e0ba9cfa99ff95d74a45017c28891b8c0c76e9ef Vag Singh 2025-08-12 02:56:02

fixup! IB/mlx5: Enabled VLAN stripping capability

Fix is based on upstream Linux commit 2978975ce7f1 ("RDMA/mlx5: Process
create QP flags in one place").

Add IB_QP_CREATE_SCATTER_FCS and IB_QP_CREATE_CVLAN_STRIPPING to the
create_kernel_qp() allowlist, so a kernel RAW_PACKET QP using these flags
is no longer rejected with -EINVAL even though create_qp_common() supports
them.  The flags arrived in 358e42ea66e2 and e4cc4fa7cca9, neither of
which updated this mask; upstream only fixed that later, as part of a much
larger refactor that is not worth importing, so the minimal equivalent is
done here.

Sponsored by:   NVidia networking
MFC after:      1 month

8ef9c7dbd706148bc38b820159c3a6c0324ec041 Ariel Ehrenberg 2026-07-28 12:02:37

mlx5en: allow userspace to enable/disable allmutli mode

[PATCH 05/31] FreeBSD OFED support for DPDK MLX5 PMD

FreeBSD doesn’t allow userspace to send ioctl call for
configuring allmulti mode. Added ALLMULTI flag in mlx5en.

In MLX5 PMD, allmulti mode will be enabled/disabled in DPDK
only if allmulti is supported by the mlx5en. it won't be changed
on network interface side.

Differential revision:  https://reviews.freebsd.org/D32179
MFC after:      1 month

c424e27b7418016ba5acaf430169f065f7891ec7 Vag Singh 2025-08-12 02:59:29

fixup! IB/mlx5: Add support for CQE compressing

Import Linux upstream commit 572f46bf947c ("IB/mlx5: Refactor CQE
compression response").

Report the CQE compression capabilities only when the device supports
compression, instead of always advertising supported_format = HASH|CSUM
next to a max_num of 0.

Sponsored by:   NVidia networking
MFC after:      1 month

f735a70da41ab548a794bc8ad7ed0c43e7b4d0cf Ariel Ehrenberg 2026-07-28 12:02:38

mlx5ib: Add drop flow steering rule support

[PATCH 07/31] FreeBSD OFED support for DPDK MLX5 PMD

A drop rule is described by an action drop and no destination.
If a user specified IB_FLOW_SPEC_ACTION_DROP then set the action
to MLX5_FLOW_CONTEXT_ACTION_DROP and clear the destination.

Differential revision:  https://reviews.freebsd.org/D32181
MFC after:      1 month

f8001dd9c873429dece0bbdda376b5cfe55a3873 Vag Singh 2025-08-14 05:35:44

fixup! mlx5ib: Add drop flow steering rule support

Fix is based on upstream Linux commit a22ed86cff36 ("IB/mlx5: Add drop
flow steering rule support").

Initialise is_drop to false so a non-DROP flow cannot inherit stack
garbage, and pass no destination to mlx5_add_flow_rules() for drop rules
instead of one with num_dest = 1, which the flow steering core
dereferences.  Both were lost in the original backport.

Derive the destination count from dst as well, so the dont-trap path,
which calls create_flow_rule() with a NULL destination, no longer asks the
core to walk a destination array that is not there.

Sponsored by:   NVidia networking
MFC after:      1 month

5aa5bfd3f99cde0da68c27da3e3be8506c829efe Ariel Ehrenberg 2026-07-28 12:02:39

mlx5/mlx5ib: Azure/HyperV OFED failing to create IB verbs device

[PATCH 08/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Refactor the netdev notifier registration into a small helper
function.
This is a pre-step towards having mlx5 IB device over an Ethernet port
which doesn't support RoCE. Also, renamed the de-registration helper
and the new helper as netdev notifier and not roce, to make it clear
this is not only used with roce.

b) Rename RoCE related helpers to reflect being Eth ones
This is a pre-step towards having mlx5 IB device also over Eth ports
where
RoCE is not supported. We change the roce enable/disable and roce_lag
init/fini function names to have _eth instead of _roce.

c) Support RAW Ethernet when RoCE is disabled
On some environments, such as certain SRIOV VF configurations, RoCE is
not supported for mlx5 Ethernet ports. Currently, the driver will not
open IB device on that port.
This is problematic, since we do want user-space RAW Ethernet
(RAW_PACKET QPs) functionality to remain in place. For that end,
enhance the relevant
driver flows such that we do create a device instance in that case.

Differential revision:  https://reviews.freebsd.org/D32182
MFC after:      1 month

c6b66002cbf30b78fcd37c5b017c30965cb213f6 Vag Singh 2025-08-14 05:37:58

fixup! mlx5/mlx5ib: Azure/HyperV OFED failing to create IB verbs device

Hold a reference on the netdev recorded in dev->roce.netdev and drop it
when the entry is replaced or torn down, and register the netdev notifier
before the initial interface scan.  Otherwise the stored pointer can
dangle, and an interface appearing during the scan can be missed.

Sponsored by:   NVidia networking
MFC after:      1 month

98f73f8ec35f598dfbe4a4acfe25cf4a350f5734 Ariel Ehrenberg 2026-07-28 10:38:55

mlx5en: Add sysctl variable mapping driver name to IF name

PATCH 09/31] FreeBSD OFED support for DPDK MLX5 PMD

HyperV is not enabling ROCE by default causing the OFED to
not create few SYSCTL variables that publish kernel interface
name. Due to this MLX5 PMD is not able to read kernel
interface name to get MAC address.

Added new sysctl variable in MLX5_EN driver to map the device
name to the interface name.

Differential revision:  https://reviews.freebsd.org/D32183
MFC after:      1 month

c31002454ea466d09071050d5467540727301fb0 Vag Singh 2025-08-14 05:40:56

fixup! mlx5en: Add sysctl variable mapping driver name to IF name

Mark the new "ifname" sysctl MPSAFE and use strlcpy() so the interface
name it returns is always NUL-terminated.

Sponsored by:   NVidia networking
MFC after:      1 month

b44da2b82bb6bbe93de507a96eb78bbc2b264620 Ariel Ehrenberg 2026-07-28 10:38:56

hvuio: Add HV_UIO driver

[PATCH 10/31] FreeBSD OFED support for DPDK MLX5 PMD

Adding UIO driver that exposes the synthetic network device
resources to userspace for application such as DPDK can drive it.

Added rescind CB capability to the VMBUS driver. Whenever the
hypervisor wants to close the device channel, VMBUS on receiving
this msg, calls the CB of the device driver (hv_uio in our case).

Differential revision:  https://reviews.freebsd.org/D32184
MFC after:      1 month

998acbc14051c357a8b0a8f52c7f16885bf74fc6 Vag Singh 2025-08-14 05:45:24

mlx5ib: Avoid system crash when enabling many VFs

[PATCH 12/31] FreeBSD OFED support for DPDK MLX5 PMD

a) When enabling many VFs, the total amount of DMA mappings increase
significantly. This causes DMA allocations to take a lot of time
since they are serialized in the kernel.

As a result the driver enters into fatal condition due to
timeout and the system hangs. To recover from this we disable
MR cache for VFs. This also resolves Rx-Error MLX5 PMD issue.

PFs will still have a full cache and VFs cache can be manipulated
as usual after driver load.

b) The fast_registration length is used to convey length for memory
registrations through UMR which can be of any size up to 2^64.
Change the length type to be u64.

Differential revision:  https://reviews.freebsd.org/D32186
MFC after:      1 month

cafc8b1c41b0898b8f9b01288736aaaa6dc5dddc Vag Singh 2025-08-14 06:07:53

fixup! IB/mlx5: Support Vxlan tunneling specification

Import Linux upstream commits 37da2a03c036 ("RDMA/mlx5: Use proper spec
flow label type") and 0f750966dca8 ("IB/mlx5: Add inner spec and IPv6
validation in user's flow attribute list").

The first widens set_flow_label()'s mask and value to u32, so the 20-bit
IPv6 flow label is no longer truncated to 8 bits.  The second validates
the ethertype of inner flow specs as well as outer ones, and adds the IPv6
ethertype checking this tree was missing.

Sponsored by:   NVidia networking
MFC after:      1 month

138873b604aeb5062813a85f60e1fbec7095e1c2 Ariel Ehrenberg 2026-07-28 12:02:44

fixup! IB/mlx5: Expose software parsing for Raw Ethernet QP

Report sw_parsing_caps using the same condition that enables software
parsing on the SQ (both eth_net_offloads and swp), so what we advertise
matches what the driver actually does.

Sponsored by:   NVidia networking
MFC after:      1 month

4025818a5a32150c551a46b6a08299288003c6b7 Ariel Ehrenberg 2026-07-28 10:39:01

fixup! IB/mlx5: Expose multi-packet RQ capabilities

Import Linux upstream commit ccc870879027 ("IB/mlx5: Allow creation of a
multi-packet RQ").

Only the create_rq() part was missing: the striding RQ parameters we
validate and store on the WQ never reached the firmware.  Program
two_byte_shift_en, single_stride_log_num_of_bytes and
single_wqe_log_num_of_strides, with the two log values encoded relative to
their MLX5_MIN_* bases so the 3-bit firmware fields do not truncate them.
Upstream renamed these WQ context fields later on, so the names used here
are the ones this tree's mlx5_ifc.h still carries.

Sponsored by:   NVidia networking
MFC after:      1 month

83b69b72facf89989e4d72b436fbbb08f091e07f Ariel Ehrenberg 2026-07-28 12:02:49

fixup! IB/mlx5: Add tunneling offloads support

Drop the unused MLX5_IB_QP_TUNNEL_OFFLOAD flag.  Tunnel offload is driven
by qp->tunnel_offload_en, so the enum bit was dead and misleading.

Also advertise MLX5_RX_HASH_INNER in query_device()'s
rss_caps.rx_hash_fields_mask, so user space can discover inner RSS.

Sponsored by:   NVidia networking
MFC after:      1 month

5c512b5a76e3dd6cb526c38d99a04d550759cfa4 Ariel Ehrenberg 2026-07-28 10:39:07

IB/mlx5: Expose GRE flow spec to user-kernel ABI header

[PATCH 29/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Add ib_uverbs_flow_spec_gre to define the rule to match GRE
encapsulation protocol.

The spec includes the generic specs header, type, size and reserved
fields while the filter itself is defined as ib_uverbs_flow_gre_filter
and includes:

- Checksum present bit, key present bit and version bits in a single
16bit field.
- Protocol type field - Indicates the ether protocol type of the
encapsulated payload.
- Key field - present if key bit is set and contains an application
specific key value.

b) IB/uverbs: Expose MPLS flow spec to user-kernel ABI header
Add ib_uverbs_flow_spec_mpls to define the rule to match MPLS
protocol.

The spec includes the generic specs header, type, size and reserved
fields while the filter itself is defined as ib_uverbs_flow_mpls_filter
and includes a single 32bit field named 'label' which consists of:
Bits 0:19 - The MPLS label.
Bits 20:22 - Traffic class field.
Bit 23 - Bottom of stack bit.
Bits 24:31 - Time to live (TTL) field.

c) IB/mlx5: Add support for GRE flow specification
This patch introduces support for the GRE flow spec and
allowing the creation of rules based on the protocol and
key fields that are part of GRE protocol header.

d) IB/mlx5: Expose MPLS related tunneling offloads
This patch reports the device's capbilities to offload
encapsulated MPLS tunnel protocols to user-space:
- Capability to offload MPLS over GRE.
- Capability to offload MPLS over UDP.

Differential revision:  https://reviews.freebsd.org/D32204
MFC after:      1 month

d58b41b0f28207521ddd916f5746b589bd1faf06 Vag Singh 2025-08-14 07:03:43

fixup! IB/mlx5: Expose GRE flow spec to user-kernel ABI header

Import Linux upstream commit a93b632c4531 ("IB/mlx5: Fix GRE flow
specification").

Honour the user-supplied GRE protocol mask instead of hard-coding 0xffff,
so wildcard and partial masks work.

Also give flow_spec_data[] 8-byte alignment, so this userspace copy of
struct ib_uverbs_flow_spec_hdr matches the kernel UAPI on 32-bit builds.
The kernel header has always used __aligned_u64 here and only our copy
diverged, so there is no upstream commit for that half.  The attribute is
spelled out instead of introducing an __aligned_u64 macro, which
<infiniband/types.h> does not provide and which libbnxtre already defines
for itself.

Sponsored by:   NVidia networking
MFC after:      1 month

966d4c21b186dfafda58d3d586fbe7f02299fb5e Ariel Ehrenberg 2026-07-28 12:02:55

Commit group #2: acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume

acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume

If amdsmu(4) is not loaded when entering suspend-to-idle and on an AMD
CPU, emit a warning.

FreeBSD currently only supports S0ix on AMD CPUs through the SMU. When
Intel support is completed, we should check the equivalent for Intel
(intelpmc).

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59672

5f68acc931a4814c4ee46124aaa5afff22402f61 Aymeric Wibo 2026-09-14 18:14:54

acpi: Don't compile CPU_VENDOR_{AMD,HYGON} cases on non-x86_64

Fixes build on aarch64.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5f68acc931a4 ("acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume")
Sponsored by:   The FreeBSD Foundation

9b4caca81de24e31fe06e9aecc656f7c6b30edb5 Aymeric Wibo 2026-09-16 18:28:22

acpi: Fix unused variable error

Fixes:          https://cgit.freebsd.org/src/commit/?id=9b4caca81de2 ("acpi: Don't compile CPU_VENDOR_{AMD,HYGON} cases on non-x86_64")
Sponsored by:   The FreeBSD Foundation

39b8430d25a1674092eae35d4af00d8e5d4d114f Aymeric Wibo 2026-09-16 19:27:20

acpi: Don't check suspend-to-idle if suspend failed

If we e.g. failed to suspend a device and suspend bounced because of
that, then we're not expected to have entered a deep sleep state in the
first place. In this situation, don't overload the user with irrelevant
information.

Reviewed by:    olce
Fixes:          https://cgit.freebsd.org/src/commit/?id=5f68acc931a4 ("acpi: Warn if no amdsmu(4) loaded after suspend-to-idle resume")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59731

c9bfc37b61d299f6de4b6b9799db95181b3bd1d0 Aymeric Wibo 2026-09-16 17:07:19

amdsmu: Add clarifying comment for the *sw_drips metrics

Sponsored by: The FreeBSD Foundation

3820d1e1a7e08c2c464aca0bdd063b1595dc9127 Aymeric Wibo 2026-09-16 18:45:37

igbv: Support Hyper-V virtual functions

Use the Hyper-V reset/MAC exchange for 82576 and I350 VFs instead of the
native posted mailbox protocol, which the Windows PF does not service.
Read the host assigned address through configuration bytes 0x201 through
0x206 only during reset, and use it to identify the matching synthetic
hn(4) interface.  The operations are local to the VF frontend.

Poll hardware link status rather than retaining a native mailbox link
handshake.  Leave MAC, multicast, promiscuous-mode, and VLAN membership
policy with the host.  Disable guest VLAN registration and native receive
limit requests, and limit the VF to an MTU of 1500 bytes.

Preserve accumulated statistics across host resets without counting a
counter clear as a wrap.  Reject inaccessible register samples and rebase
after a reset indication or a disabled transmit queue, including when the
PF blocks the queue for malicious driver detection.

Document single queue support and host assigned access VLANs.  Guest VLAN
trunks are not supported: tagged transmissions with the Windows I350 PF
driver 14.1.5.0 can disable VF queues even on a trunk-configured port, and
the limitation was also reproduced with Windows VF drivers.  Such trunks
must use the synthetic path with SR-IOV disabled for that virtual adapter.

Tested on Windows Server 2025 Hyper-V with both 82576 and I350 PFs.

Relnotes:       yes
Sponsored by:   BBOX.io

89ce1aa07241abbcea1703b5f2b85b88460d584f Kevin Bowling 2026-09-16 17:13:00

cxgbe: Use the correct GHASH offset for a GMAC from a full TLS record

If a TLS request transmits all but a part of the GMAC at the end of a
TLS record, the work request asks the crypto engine to return the
calculated GMAC to the driver so it can be sent in a simple TCP packet
when the rest of the TLS record is transmitted in the future.
However, the offset of the returned GHASH offset was calculated
incorrectly in this case causing the driver to not recognize the
cached GMAC and instead use a more wasteful work request in the future
that encrypted the entire TLS record discarding all but the needed
bytes of the trailer.

Note that this does not effect correctness, just efficiency.

Reviewed by:    np
Fixes:          https://cgit.freebsd.org/src/commit/?id=9e269eafebfc ("cxgbe: Use partial GCM mode for partial TLS records on T7")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D59711

ed5fc8066f98e639f624de9997b33727ed883c32 John Baldwin 2026-09-16 19:56:20

igbv: Recover disabled Hyper-V transmit queues

The Windows PF can disable a VF transmit queue while continuing to
report carrier up.  Link polling alone then leaves the VF operationally
up even though it cannot transmit.  The reproduced VLAN failure shows
this state with PF driver 14.1.5.0 and an MDD indication in the host trace.

Check queue zero from the admin path only while the Hyper-V VF is
running with sanitized queues and a completed host handshake.  Report
operational link down and invalidate the statistics baseline when the
queue is disabled.  Request recovery through the normal iflib stop/init
path only when a fresh, accessible STATUS read reports carrier up.
Rate limit requests if the host continues to hold the queue disabled,
and leave recovery pending while carrier is down.

Document the recovery behavior and clarify why the Hyper-V reset retains
the VF-local software reset before its host reset/MAC exchange.

Sponsored by:   BBOX.io

f308d6d4846a51c2d0839840d6eabbbe70309515 Kevin Bowling 2026-09-16 20:45:16

ice: Use sleepable locks in shared code

The Intel shared code can wait for firmware resources while holding its
OS abstraction locks.  FreeBSD mapped these locks to mutexes, which
cannot be held across a voluntary sleep.  Concurrent PF rebuilds
therefore trigger WITNESS when RSS profile updates contend for the
firmware change lock.

Map the shared-code lock abstraction to exclusive sx locks.  This also
covers tunnel and flow-profile operations which can reach the same
firmware wait while serialized.

Validated with WITNESS on a dual port Intel E835.  Sixteen CORE resets
rebuilt both PFs without lock warnings, reset failures, or watchdogs.
Ten interface down/up cycles and twenty promiscuous-filter cycles also
completed cleanly.

Reviewed by:    erj
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59339

b272b2a94d983900c94168c5f41256869b0371b1 Kevin Bowling 2026-09-03 11:31:42

hn: Relay VLAN membership to transparent VFs

VLANs configured on the synthetic interface do not otherwise reach the
accelerating VF's VLAN callbacks.  Those callbacks can be needed for
hardware filter membership or for interpreting stripped VLAN tags, even
though no vlan interface is attached directly to the VF.

Subscribe to VLAN events only in transparent mode and schedule the
existing VF task.  Snapshot the synthetic interface's VLAN topology under
network epoch, then leave epoch before invoking the VF callbacks, which
may sleep.  Do not acquire hn_lock or configure the VF from a VLAN event
handler; the worker applies membership outside the VLAN configuration
lock.

Keep an applied-VID bitmap under hn_lock and relay only changes.  Replay
VLANs configured before VF arrival, reconcile changes while acceleration
is active, and preserve membership across temporary datapath switches.
This relays guest intent; it does not configure host access VLAN policy
or overcome PF restrictions on tagged traffic.

Block initialization while either interface is detaching.  Deregister
VLAN handlers before draining work, remove registrations when hn leaves a
live VF, and discard the applied bitmap when the VF itself departs.

MFC after:      2 weeks
Sponsored by:   BBOX.io

83b308875d254a894e04dbe91d5fbdb637eafdf2 Kevin Bowling 2026-09-16 17:13:40

hn: Forward capability changes to transparent VFs

The transparent VF capability handler ignored the requested change and
only copied the VF's enabled capabilities.  Forward SIOCSIFCAP to the VF
and return its result.  Preserve VF capabilities which hn does not expose.

Limit advertised capabilities to those supported by the transparent
packet path and VLAN relay.  Do not inherit VF services such as send tags
or the extended capability ioctl when hn has no corresponding methods.
At handoff, adopt the VF's enabled offloads without reconfiguring it.

Mark the datapath as switching while the VF applies a capability change,
since its ioctl may reinitialize the device.  If the association is still
ready and unchanged afterwards, synchronize hn with the actual VF state
even on error and restrict checksum assistance to the forwarded offloads.
Republish link state suppressed during the transition when the VF is
still ready.  Refresh VLAN child capabilities after adoption and when
restoring the synthetic path.

Run the VF capability ioctl without hn_lock to avoid reversing the VLAN
configuration lock order.  Hold an ifnet reference, serialize capability
changes and VF initialization, and make detach wait with hn_lock released.
Revalidate the VF association before publishing the result.  Defer
VLAN-child capability notifications to the existing VF taskqueue so they
also run without hn_lock, and drain that work before ifnet teardown.

MFC after:      2 weeks
Sponsored by:   BBOX.io

31896115b5574944718cc4f5260efe47b622b55b Kevin Bowling 2026-09-16 17:13:40

iavf: Honor PF-negotiated RSS sizes

Use the key and lookup table lengths returned by GET_VF_RESOURCES when
configuring RSS through virtchnl, as DPDK does.  The Windows E835 PF
advertises a 40-byte key and rejects our fixed 52-byte CONFIG_RSS_KEY
request, leaving receive traffic on queue zero.

Validate the negotiated lengths before constructing AdminQ messages and
publish the lookup table size to iflib.  Preserve register-mode RSS
selection and its fixed hardware sizes.  Use aligned, zero initialized
key storage so an RSS kernel's 40-byte key does not leave an uninitialized
tail when the PF requests 52 bytes.

Validation: normal and RSS enabled iavf module builds passed.  On an E835
VF under Hyper-V Server 2025, repeated IPv4 and IPv6 receive tests used all
three configured guest RX queues in both transparent hn and non-transparent
lagg modes.  The RSS key rejection disappeared, IPv4 transmit tests passed,
and no TX watchdog fired.  Each traffic case used three runs of 16 streams.

Obtained from:  DPDK (negotiated RSS sizing)
MFC after:      2 weeks
Sponsored by:   BBOX.io

f908fbb9b2671cbc6cf366c8287899940e3c88b5 Kevin Bowling 2026-09-16 23:34:27

ice: Defer RDMA critical error notifications

ice_msix_admin() runs as an interrupt filter inside a critical section.
ice_rdma_notify_pe_intr() acquires the global RDMA sx and invokes the
client event handler, both of which require sleepable thread context.  A
PE or HMC critical error could therefore panic under WITNESS or sleep
from interrupt context.

Accumulate OICR causes atomically in the interrupt filter and mark them
pending in the driver state.  Deliver the notification from the iflib
admin task before processing reset events.  This preserves the existing
ordering, lets an iRDMA-requested reset run in the same admin pass, and
coalesces causes from multiple interrupts.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59340

aae5b168820a9c39e39c6dff2f31df0522f91901 Kevin Bowling 2026-09-03 12:01:18

ice: Honor iflib transmit completion batching

ice marked every transmitted packet RS and recorded every last
descriptor in its report-status queue.  Hardware therefore wrote
descriptor status for every packet, and the driver traversed every
packet while reclaiming completed descriptors.

iflib marks selected packets with IPI_TX_INTR as completion
checkpoints.  It forces a checkpoint as deferred work or ring pressure
grows.  Retain EOP on every packet, but set RS and record the descriptor
only at those checkpoints.

DPDK uses the same sparse-RS design and defaults tx_rs_thresh to 32.
Let iflib choose the adaptive interval for FreeBSD.  This reduces PCIe
and memory traffic while preserving bounded descriptor reclamation.

Validated on an E810-XXV in an A-B-A test with five matched
four-stream, TSO-disabled transmit runs per phase.  Median throughput
was 9.413, 9.413, and 9.414 Gbps.  Median whole-system CPU was 21.54%,
17.75%, and 21.62%, respectively.  The candidate used less system CPU
than both exact-baseline phases in every pair.  Interrupt rate was
unchanged, no transmit watchdog fired, and normal TSO traffic remained
line-rate.  DTrace confirmed that only iflib-selected packet-final
descriptors carried RS after the change.  The effect should be more
profound at 200Gbps but my DUT is network limited.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58910

99191ce8044dd82d317ec62efea35bf5369cd592 Kevin Bowling 2026-08-18 11:04:33

enic: Clean the completion ring matching each queue

The transmit stop loop cleaned the receive completion ring, and the
receive stop loop cleaned the transmit completion ring.  Use enic_cq_wq()
for transmit queues and enic_cq_rq() for receive queues, matching the
queue indices used by the remaining ring bookkeeping.

MFC after:      2 weeks
Sponsored by:   BBOX.io

be36ceea1b8f75f7f537e77dddb75666671fef8f Kevin Bowling 2026-09-17 02:30:01

enic: Report device enable failures to iflib

Do not publish a running interface after vnic_dev_enable_wait() fails.
Run the existing stop cleanup for the queues configured before the enable
request, then report initialization failure to iflib.

Mark those queues as needing cleanup before submitting the enable request
so the stopped-state shortcut cannot skip the unwind.

MFC after:      2 weeks
Sponsored by:   BBOX.io

24f8c4e852d69189a1de1ff51c351ae8ee603dfa Kevin Bowling 2026-09-07 11:13:26

ixgbe: Apply DMAC changes through an if-up reset request

Serialize cached DMA coalescing policy with initialization and schedule
its application through the admin task.  The old running check
preceded if_init() acquiring the context lock, so an intervening down
operation could be followed by an unconditional initialization.

Use the deferred if-up request so restart permission is checked when the
task runs.  Changes made while stopped or suspended remain cached for
the next initialization.  Do not schedule a reset for an unchanged value.

MFC after:      2 weeks
Sponsored by:   BBOX.io

f5dc44c045c6f03a0f1bb2e81b0172e0781faec4 Kevin Bowling 2026-09-11 21:48:43

ixgbe: Defer flow control programming while admission is closed

Cache a validated flow control setting without touching hardware when
iflib has closed admission.  The queues may still be live pending a
watchdog stop, or the device may already be stopped or suspended.  RX
initialization and link setup replay the cached flow control policy.

For live updates, decide once under the context lock whether to touch
hardware, then mask MDD around SRRCTL writes regardless of a concurrent
watchdog closing admission.  The context lock excludes actual stop and
reinitialization while these writes are in progress.

MFC after:      2 weeks
Sponsored by:   BBOX.io

5abfd8fe4d1adb74863231f27a9958cf176e3ded Kevin Bowling 2026-09-11 21:42:24

ixl: Tie statistics baselines to hardware resource epochs

Raw VSI statistics belong to the firmware-assigned counter index and are
reset when firmware recreates the VSI.  Reusing a baseline across either
event makes a counter decrease look like a full width rollover.

Reset the PF and main VSI baselines when rebuilding hardware resources.
Start a new baseline when firmware assigns a different PF counter index
and whenever it allocates a VF VSI.  Ordinary interface reinits which
retain the hardware resources continue to retain their statistics.

This follows the lifecycle used by ice without placing an unconditional
statistics reset in ixl_initialize_vsi(), which also runs during ordinary
iflib initialization.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59337

444168adbe5217ea9b73773e42c60bf75fb7a6fd Kevin Bowling 2026-09-03 10:58:30

ixgbe: Report hardware initialization failures to iflib

Check the result of ixgbe_init_hw() before configuring queues. Report
failure through iflib_init_failed() instead of publishing a working
datapath after shared-code initialization failed.

MFC after:      2 weeks
Sponsored by:   BBOX.io

6a903d9837645a9dbf990b699f50c67ad984c043 Kevin Bowling 2026-09-07 11:30:52

axgbe: Propagate hardware and PHY initialization failures

Check hardware initialization instead of discarding its result, and
preserve the original initialization error across cleanup. Report a failed
init to iflib rather than publishing a running datapath. Return normalized
FreeBSD errors from attach_post.  Reuse the existing native reset cleanup
on failure.

MFC after:      2 weeks
Sponsored by:   BBOX.io

b263545980f44c0318afcc26188046ad7e559ceb Kevin Bowling 2026-09-07 11:00:55

mgb: Propagate DMA setup errors and use the requested channel

Check the receive DMA and frame transfer setup results that were
previously discarded. Return EINVAL for invalid ring/writeback addresses
rather than reporting success, and stop initialization through
iflib_init_failed() when a ring could not be configured.

Use the transmit queue count for transmit initialization and the supplied
channel index for DMA operations. The driver currently allocates one
queue in each direction, so those index/count corrections are latent.

MFC after:      2 weeks
Sponsored by:   BBOX.io

3f6c1e731376ffaf8612e7e196119acabbf357e4 Kevin Bowling 2026-09-17 03:07:54

enetc: Correct transmit queue timeout detection

Test the producer and consumer indices after waiting for transmit
completion. The post-decrement loop leaves timeout at -1 on exhaustion,
so testing timeout == 0 missed the actual timeout and could report one
when the final poll completed successfully.

Leave the hardware shutdown sequence unchanged. This only corrects the
diagnostic; runtime FLR recovery and command-buffer lifetime handling
remain separate work.

MFC after:      2 weeks
Sponsored by:   BBOX.io

9a1756f831a77ee8292821c9efd38c2125bff88c Kevin Bowling 2026-09-07 13:44:59

ice: Quiesce queues after partial initialization

ice_if_init marks DRIVER_INITIALIZED only after all queue and filter
operations succeed, so ice_if_stop intentionally does nothing after an
initialization failure.  Each failure path must therefore unwind any
hardware queues it may have configured before iflib releases their DMA
mappings.

Tx setup enables firmware scheduler queues one at a time, and Rx enable
similarly processes queues incrementally.  Route failures from both
operations through cleanup paths for both the PF and mirror VSIs.  The
cleanup helpers tolerate queues which were not configured, so they also
cover failures on the first queue.

This leaves failed initialization stopped as required by the
iflib_init_failed contract.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59331

fc809d6a6191ef4e881119ec00ea752d1ed6cc37 Kevin Bowling 2026-09-03 06:05:23

ice: Rebuild VF VSIs after PF resets

PF and device resets discard all hardware VSI state.  ice_rebuild()
only recreated the main PF VSI before replaying configuration for every
VSI.  As a result, replay used stale VF VSI handles.  Firmware rejected
it with AQ_RC_EACCES and the failure aborted the entire PF rebuild.

Re-add each VF VSI before replaying its configuration, and do not
publish VFACTIVE until both operations succeed.  Clear the initialized
state so that the VF must negotiate again.  If a VF rebuild fails, leave
it inactive and continue so that one guest cannot prevent the PF or
sibling VFs from recovering.

Mark it initialized only after the resource response is submitted
successfully, so the state follows completion of the mailbox handshake.

Make that failed state authoritative in the mailbox path.  While the
firmware VSI is invalid, permit only VERSION and RESET_VF and reject
operations which require VSI state.  A VFR may complete the hardware
reset, but cannot make the PF-owned VSI valid or publish the VF active.

Preserve accumulated VF statistics while establishing a new raw
hardware sample after reconstruction.  This keeps the cumulative totals
returned to iavf monotonic across PF resets.  Return after rejecting a
GET_STATS request for the wrong VSI so that it cannot receive a second
success reply.

Before a locally initiated reset, notify initialized VFs with
RESET_IMPENDING while the mailbox control queue is still alive.  Ignore
individual send failures so one VF cannot prevent notification of its
siblings or the reset itself.  Send the event from the common reset
preparation path and before directly triggering CORE and GLOBAL resets.

Preserve the inactive state across later VF resets.  The zero-queue
Disable LAN Tx AQ remains mandatory to complete every VFR, but do not
clear VFSWR or publish VFACTIVE while the PF-owned VSI remains invalid.

Linux ice uses the same separation: generic rebuild excludes VF VSIs,
the VF reset path rebuilds them separately, and reset preparation
notifies initialized VFs before tearing down the control queues.

Validated on an E810-XXV with one and eight host-attached iavf VFs.
Repeated PF and CORE resets recovered every VF under traffic without
watchdog, MDD, or persistent data-path errors.  An additional one-VF
test kept traffic active across PF and CORE resets; carrier and traffic
recovered automatically and both PF and VF watchdog counters stayed at
zero.

Two four-queue VFs passed through to a Linux 7.0 iavf guest also
recovered carrier and traffic automatically after PF and CORE resets.
Simultaneous traffic on both VFs resumed without intervention and the PF
watchdog counter remained zero.

DPDK 25.11 testpmd, using vfio no-IOMMU and two queues per VF, sustained
about 4.55 Mpps per VF before reset.  It received reset events for both
VFs after PF and CORE resets.  The documented ethdev stop, reset,
reconfigure, and start sequence restored traffic after each reset.
Physical bus mastering remained enabled and the PF watchdog counter
remained zero.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58905

8404c535d9bc75287f56e353cc7bff9d9ccd85b8 Kevin Bowling 2026-08-18 03:25:11

ice: Make VF queue transitions idempotent

The VF mailbox handler unconditionally submitted queue-disable
commands, including when a VF repeated a request or negotiated after a
PF reset had already destroyed its queues.  Firmware can reject stale
Tx queue metadata, causing a NACK and unnecessary VF recovery.

Track queue configuration and enable state across virtchnl operations,
and clear it at VF and PF reset.  Apply only hardware transitions that
are not already complete while preserving progress after a partial
failure.  Validate queue configurations before mutating hardware so the
state maps remain trustworthy.

FreeBSD configures Tx hardware in CONFIG_VSI_QUEUES rather than
ENABLE_QUEUES, so track Tx configuration separately from Rx
configuration and enable state.  Linux ice similarly tracks per-VF Tx
and Rx queue state and skips redundant transitions.

On an E810-XXV, the prior code emitted AQ_RC_EINVAL while configuring a
fresh four-queue VF because it disabled never-configured Tx queues.
With this change, two VFs completed 20 stop/start cycles each, and
recovered across PF and CORE resets with no watchdog, MDD, or AQ errors.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58909

a8c60dd5eb8f158c9488db5aa92aafd38d756348 Kevin Bowling 2026-08-18 05:22:39

ice: Report VF queue enable failures as hardware errors

The ENABLE_QUEUES handler has already validated the queue selection
before attempting to enable Rx hardware.  A timeout or unexpected queue
state is an operation failure, not an invalid virtchnl parameter.

Return VIRTCHNL_STATUS_ERR_ADMIN_QUEUE_ERROR for these failures, matching
the disable path.  Keep ERR_PARAM for invalid requests and attempts to
enable unconfigured queues.  Preserve the recorded state of queues which
were enabled before a later queue failed.

MFC after:      2 weeks
Sponsored by:   BBOX.io

d38e0889d20eed3885a020993b72dc9855148ba3 Kevin Bowling 2026-09-17 06:53:41

powerpc/pmap: Use dcbz to zero pages in the radix pmap

pagezero() was a plain store loop (bzero), which under the kernel build
flags (-mno-vsx -msoft-float) compiles to byte stores.  dcbz
establishes a zeroed cache line directly in the cache without a
read-for-ownership fetch from memory, roughly halving the memory
transactions of page zeroing.

Measured on POWER9 (Raptor Blackbird, DD2.3, bare metal), zeroing a
cold 256 MB buffer with 128-byte scalar loops:

  byte stores (current libkern memset)     8.6 GB/s
  doubleword (std) stores                  26.8 GB/s
  dcbz                                     34.6 GB/s

dcbz raises an alignment interrupt on caching-inhibited mappings, and
the kernel does not emulate it, so mmu_radix_zero_page() falls back to
bzero() for any page whose memattr is not the write-back default.  The
internal pagezero() callers only touch freshly allocated page-table
pages, which are always write-back.

Note: dcbz helps only zeroing, where there is no source to read.  For
page copying it is a pessimization (it adds a redundant zeroing pass on
top of the mandatory source read), so mmu_radix_copy_page() is left as a
plain bcopy().

Differential Revision:  https://reviews.freebsd.org/D59507
Reviewed by:    jhibbits

1d4a00d455617e150da5a7c3076579a7e612d33d Piotr Kubaj 2026-09-08 11:22:58

ice: Fix SR-IOV VF resource cleanup

ice_iov_uninit() freed each VF interrupt-map array without returning the
reserved indices to the device interrupt resource manager.  Repeated VF
create and destroy cycles therefore exhausted the PF interrupt map even
though no VFs remained.

Return the interrupt allocation before freeing its map.  Also split
software-only VSI release from hardware teardown so failures before
ice_initialize_vsi() do not issue invalid RSS, scheduler, and Free VSI
commands for an object firmware has never seen.

Keep a VF disabled until all of its resources and hardware state have
been created successfully.  Clear the enabled state before teardown and
after any failed add so asynchronous mailbox processing cannot use a
partial or freed VSI.  Consume VFLR status for inactive VF slots without
trying to reset a nonexistent VSI.

Track whether firmware currently owns each VSI and clear that ownership
after resets.  Teardown can then skip AdminQ commands for VSIs which
were not rebuilt.  Remove every VSI switch filter before firmware
teardown, matching Linux and preventing filter-list leaks across
create and destroy cycles.  This also applies to the PF VSI detach path.

Validated on an E810-XXV with two consecutive create and destroy cycles
of 128 four-queue VFs.  A 16-queue VF could then be created.  Two
oversized configurations each failed, cleaned back to zero VFs without
invalid firmware teardown commands, and were each followed by a
successful 16-queue VF creation.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58908

468384c8bd1130a880fd87ac5c2d182123f9f6ec Kevin Bowling 2026-08-18 08:48:36

ice: Make VF VLAN requests idempotent

VF drivers replay their VLAN filters after a reset and may retry a
request whose reply was lost.  The PF tracked only a count and sent
every requested ID back to the switch.  After PF reset replay had
already restored the filters, duplicate VID 0 failed with
ICE_ERR_ALREADY_EXISTS and NACKed the entire VF batch.

Track exact VLAN membership for each VF.  Compact requests to unique
IDs whose membership changes, enforce the configured limit against
those IDs, and update membership after each hardware operation so
partial failures cannot undercount filters.  Treat already-present
adds and already-absent deletes as successful reconciliation and
suppress their misleading low-level error dump.

Validated on an E810-XXV with a host-attached iavf VF.  A three-filter
limit was filled with VIDs 0, 1, and 4094.  PF and CORE resets replayed
all three without a duplicate warning or ADD_VLAN NACK, and DTrace
confirmed a three-VID replay reached the PF.  A fourth unique VID was
rejected without changing the count; deleting an absent VID was a
no-op; deleting and replacing a present VID updated the count exactly.
A 128 four-queue VF create/destroy cycle also completed cleanly, and a
newly recreated VF started with an empty membership map.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58909

2231e505d1d40441b80cfacb5a92111d1408a935 Kevin Bowling 2026-08-18 10:44:24

ig4(4): fix attach of ACPI-enumerated LPSS controllers

Intel LPSS I2C controllers enumerated through ACPI rather than PCI never
attach on Haswell and Broadwell, so every device behind those buses is
lost. On a Dell XPS 13 9343 that hides the I2C HID touchpad and leaves
only the PS/2 fallback, which the firmware does not restore after S3.

Three causes, all on the ACPI path:

Firmware may leave an LPSS function in D3, where its registers read as
all-ones and set_controller() fails with "controller error during
attach-1". Run _PS0 before mapping them. The PCI path does not need
this, which is why the gap went unnoticed.

INT33C2, INT33C3, INT3432 and INT3433 are Lynx Point-LP and Wildcat
Point-LP, which ig4_pci.c already classifies as IG4_HASWELL; the ACPI
path called everything but APMC0D0F an Atom SoC.

The functional clock stays gated until bit 0 of IG4_REG_CLK_PARMS is
set. Until then the controller accepts writes into the TX FIFO, never
drives the bus, raises no interrupts, and every transfer ends in
IIC_ETIMEOUT. Linux ungates the same bit in acpi_lpss.c. Doing it in
ig4iic_set_config() covers resume as well as attach.

With all three in place the touchpad attaches as iichid0/hmt1 with
multi-touch and survives suspend and resume.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298558
Tested by:      Please (XPS 13 9343, Broadwell-U, 15.1-RELEASE-p3)
Reviewed by:    wulf
MFC after:      1 week

e75f61962ca47f0b0ae4aed89c8416e6544d9845 Please 2026-09-17 09:08:43

dev: acpica: Add PCI device methods for aarch64

Add pci_get_id() and pci_alloc_msi() device methods for aarch64 platforms.

Reviewed by:    markj (earlier version), andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59169

9f24c7d5422285d2a89c50253c54aa1502f26dd7 Sarah Walker 2026-08-04 12:35:08

arm64: Add ACPI support to GICv5 driver

Add ACPI support to the GICv5 IRS, ITS and IWB drivers. Device parameters are
derived from the MADT and IORT tables.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59171

9556306213e1230fc3bef2598129f91e344bd49d Sarah Walker 2026-08-04 12:38:52

arm64/vmm: vtimer: Read CNTPCT_EL0 through a dedicated macro

CNTPCT_EL0 needs to be read after an ISB in order to ensure a consistent
value irrespective of speculative execution.

Make existing reads of CNTPCT_EL0 use a new dedicated accessor macro
that expands to the correct instruction sequence.

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2423

67242cc4284e44936068945d9960c8f1fef136c1 Kajetan Puchalski 2026-05-12 16:12:04

arm64: Fix definition of CCSIDR_EL1_op0

Fix incorrect opcode on CCSIDR_EL1.

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2433

43347e8c55f808f1e9faca2f118d4eab4bcd0228 Kajetan Puchalski 2026-09-15 15:50:45

acpi: Set status to AE_ERROR if device suspend failed

Previously, we would be returning AE_OK from acpi_EnterSleepState().

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59735

2c59dd4cfdd6b95f0aa05a6bd886be672a39f105 Aymeric Wibo 2026-09-16 17:43:34

Commit group #3: ice

ice: Validate VF virtchnl configuration

Virtchnl requests originate in guest-controlled VFs.  The existing PF
implementation checked message shape but allowed several hardware-facing
values through without complete semantic validation.

Require the exact RSS key and LUT sizes advertised to the VF, validate
every LUT entry, and pass only the validated LUT length to firmware.  A
short LUT previously caused the AdminQ command to read beyond the
received request.

Validate queue ring bases, descriptor counts, receive buffer units,
maximum frame sizes, and per-VSI consistency before disabling or
changing any queue.  This also prevents the 32-bit receive ring length
from being truncated through a 16-bit validation helper.

Advertise the PF frame-size limit in VF resources.  Leaving max_mtu
zero causes Linux iavf to request a 16382-byte frame, beyond the
9728-byte limit enforced by this driver.

Some Linux iavf releases use the advertised maximum as max_pkt_size
even when their receive buffers cover fewer bytes within the E810
five-buffer hardware limit.  Accept this advisory mismatch for
compatibility.  ice_setup_rx_ctx() retains the mandatory hardware
clamp of RXMAX to five data buffers, as Linux ice does.  DPDK sizes
its request to the same limit.

Preflight the complete interrupt map before changing queue state.
Reject invalid ITR indices, traffic on vector zero, duplicate
vectors, and queues assigned to multiple vectors.  This prevents
hostile input from reaching an MPASS or leaving a partially updated
mapping.

The limits follow the ICE queue context units and the validation policy
used by the Intel ICE and FreeBSD ixl PF drivers.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59020

d44390fa3c72699436449fd15ce9b71f1473c03f Kevin Bowling 2026-08-19 03:18:19

ice: Add malformed virtchnl injection points

Extend the optional ice(4) failure injection facility with semantic
corruption points for queue configuration, RSS keys and tables, and
interrupt mappings.

Each point mutates an otherwise valid request after the common
virtchnl length check.  This exercises the PF semantic validators with a
real VF while preserving the normal wire format and mailbox path.

The queue point selects unaligned Tx or Rx bases, an unaligned or
unrepresentable receive buffer, an invalid frame size, duplicate queue
IDs, or a bad VSI.  The RSS points select short advertised data or an
out-of-range LUT entry.  The interrupt point selects an invalid ITR,
traffic on vector zero, duplicate vectors, or a bad VSI.

The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59021

e70ff92d243104834ad40581c3562a55d7525cc8 Kevin Bowling 2026-08-19 03:18:53

ice: Enforce VF MAC anti-spoof policy

The SR-IOV schema enables MAC anti-spoofing by default, but the driver
never programs the VSI security section.  A VF can therefore transmit
with an arbitrary source address despite the configured policy.

Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset.  Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.

Validated on E810 hardware with host-attached and Linux passthrough
VFs.  Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped.  After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.

An injected MAC anti-spoof update failure left the VF inactive.
Destroying and recreating the SR-IOV configuration restored the policy
and traffic.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59022

3bdc281f5df0003d745b4e911f5d583bf5938317 Kevin Bowling 2026-08-19 03:28:59

ice: Fail closed when VF reset does not complete

ice_reset_vf() logs failures to drain PCIe transactions, issue the
mandatory zero-queue command, or observe VFR completion, but still
publishes VFACTIVE.  A VF can resume against reset state which the PF
knows is incomplete.

Return an error from the reset operation and retain a reset-failed flag
when any mandatory stage fails.  Reject ordinary virtchnl requests while
the failure persists.  Publish VFACTIVE only after every stage succeeds.
A later VFLR or PF rebuild can recover the VF and clear the failure.

Remove tracked queue leaves before clearing their software state.  The
reset-only AdminQ command drains hardware queues but does not update the
shared scheduler database; losing that bookkeeping can strand queue
resources across VF teardown and recreation.

After a successful VF reset, discard software switch filter state whose
hardware rules were reset and clear guest-owned MAC and VLAN tracking.
Restore PF-owned anti-spoof policy, the broadcast filter, and the
assigned MAC before publishing VFACTIVE.  The guest can then replay its
own filter state without stale software entries suppressing the firmware
requests.

Tested on an E810-XXV with a host-attached iavf.  Repeated VFLRs rebuilt
the base filters with new firmware rule IDs and restored traffic.
Forced reset-stage and policy-replay failures remained inactive until
recovery, and a PF reset rebuilt the VF and restored live traffic
automatically.

This follows the conservative reset policy used by ixl(4).

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59023

66d271178feb4a07c774204352228db517c596dc Kevin Bowling 2026-08-19 03:31:43

mthca: apply upstream changes to convert to timer_setup() LinuxKPI

Apply upstream changes b9eaf18722221 init_timer() -> setup_timer(),
and 86cb30ec07cdc7 setup_timer() -> timer_setup() to get us out of
Linux version 4.15 (and earlier) KPIs.
Also apply 41cb08555c416 from_timer -> timer_container_of.

MFC after:      3 days
Reviewed by:    jhb, emaste
Differential Revision: https://reviews.freebsd.org/D59677

9d467dfa31922b3b2fbb145f202200bf66ca550a Bjoern A. Zeeb 2026-09-14 22:27:26

mlx4: apply upstream changes to convert to timer_setup() Linux KPI

Apply Linux change 55c0fcc3de460 "Convert timers to use timer_setup()"
to get us out of Linux version 4.15 (and earlier) KPIs.
Also apply 41cb08555c416 from_timer -> timer_container_of.

MFC after:      3 days
Reviewed by:    kib
Differential Revision: https://reviews.freebsd.org/D59679

272138c279dd1954f3fb88d9e0b2874db74597a3 Bjoern A. Zeeb 2026-09-14 22:39:03

mlx4: convert to timer_setup() Linux KPI

The Linux driver switched away from using this timer in e22979d96a55d.
Locally adjust the code to use timer_setup/from_timer in order to get
us out of Linux version 4.15 (and earlier) KPIs.
Also, right away, apply 41cb08555c416 from_timer -> timer_container_of.

MFC after:      3 days
Reviewed by:    kib
Differential Revision: https://reviews.freebsd.org/D59680

871c09c9b47eb0ef0f17a5a1fc2299dba7693516 Bjoern A. Zeeb 2026-09-14 22:51:09

mlx5: remove init_timer()

The init_timer() was there from day one in (dc7e38ac4da50).  It was
never needed as the setup_timer() below already did more than just
that part of the job.
This is part of trying to clear up the Linux pre-4.15 timer KPI
from LinuxKPI.

MFC after:      3 days
Reviewed by:    kib
Differential Revision: https://reviews.freebsd.org/D59681

3769ee9bc4167d4f508ba4f14cf544dedf7c520e Bjoern A. Zeeb 2026-09-15 00:28:58

Commit group #4: ice

ice: Quiesce VFs before device reset

Reset preparation notifies cooperative VFs, then immediately releases
queue maps and firmware topology.  A VF which ignores the notification
can continue DMA while the PF tears down the resources which describe
it.

Assert VFSWR for each configured VF before teardown.  Run the mandatory
firmware drain serially, disable active receive queues, verify that PCIe
transactions have drained, and leave the VF held until its VSI rebuild
succeeds.  Block ordinary mailbox requests as soon as quiesce begins so
a hostile VF cannot re-enable queues in the warning interval.

Also clear VFLR status only after VFRD and perform the final Transaction
Pending check before publishing VFACTIVE.  This follows the VF reset
flow in section 4.1.3.3.3 of the Intel E810 Datasheet.  Serializing VFs
stays below the documented limit of four concurrent VM/VF reset flows.

Validated on an E810-XXV with active host VFs and a Linux passthrough
VF.  Two active VFs recovered together after a PF reset and eight after
a CORE reset; every VF returned initialized and traffic resumed.  A
128-VF configured passthrough topology also survived a PF reset.

With the bhyve process paused while ingress targeted an active Linux
VF, the PF completed quiesce, topology teardown, and VSI rebuild without
guest mailbox cooperation.  The VF remained configured but uninitialized
until the guest resumed, then re-handshook and restored traffic.

The companion failure-injection commit forced each mandatory drain
stage to fail.  Every affected VF remained inactive with bus mastering
disabled and recovered after SR-IOV recreation.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59024

bcf6be6deea7b390fc332d3adb0437b4e540d073 Kevin Bowling 2026-08-19 03:39:11

ice: Add VF reset and policy failure injection

Extend the optional ICE failure-injection facility with points for the
MAC anti-spoof firmware update and each mandatory VF reset stage.

The reset points report a failed Tx drain command, VFR timeout, receive
queue disable, or final PCIe transaction drain after the corresponding
hardware operation.  This permits fail-closed state and recovery tests
without deliberately leaving live DMA during teardown.

The points remain absent unless the kernel is built with
options DRIVER_FAILPOINTS and retain the existing PF and VF selectors.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59025

31fb4efd211cbb2ea79463c6e8522bb362e29129 Kevin Bowling 2026-08-19 03:41:02

ice: Make VF MAC filter requests idempotent

VF drivers replay their address filters after reset and may retry a
request whose reply was lost.  The PF tracked only a count and
incremented it after an idempotent hardware add, so duplicate replays
eventually exhausted the quota.  It then rejected an entire address
batch, including the administrator-assigned address.

Track exact non-primary MAC filter membership within each VF quota.
Validate a complete batch before changing hardware, charge only unique
absent addresses, and update ownership after each successful operation.
Preserve an administrator-assigned address when the VF is not permitted
to change it.

Validated on an E810-XXV with a host-attached iavf VF.  The configured
filter quota was filled, then the complete set was replayed across VFR
and PF reset without a duplicate warning or ADD_ETH_ADDR NACK.  Deleting
an absent address was a no-op.  With allow-set-mac disabled, the guest
could not remove its administrator-assigned filter, while multicast
filter additions continued to succeed.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59026

3faea48e117939ae41f92c8738784d8e38a78612 Kevin Bowling 2026-08-19 05:52:43

Commit group #5: ice

ice: Isolate VFs after malicious-driver detection

Consume the per-function MDD latches to attribute transmit and receive
events to the offending VF.  Treat the global debug registers only as
the last-cause diagnostic, add the missing Tx data-protection cause, and
select the E830 TCLAN register addresses when required.

Block every virtchnl request from an offending VF, reset it, and leave
its queues and interrupt mappings unconfigured.  Most MDD classes stop a
queue, but Tx data protection only drops the offending packet; the reset
makes the reported blocked state an actual DMA fence for every class.
Complete VFR without restoring resources so a later physical FLR can
create a new reset edge and recover the function.

Complete VFR before restoring queue and interrupt mappings.  E810 does
not retain mapping writes while VFSWR remains asserted; retaining the
original hardware order prevents an immediate post-attach VFR from
leaving queue-map enable clear.

E810 also sets a parent PF_MDET latch for an event attributed by a
VP_MDET latch to one of its VFs.  Do not reinitialize the PF for those
event classes.  This prevents a hostile VF from flapping PF and sibling
traffic while retaining recovery for an unattributed PF queue event.

Provide an opt-in auto-reset policy for operators who prefer
availability to persistent isolation.  Clear reset induced anti-spoof
latches before releasing a rebuilt VF.

This follows the MDD attribution and reset semantics in section
9.2.2.2.1 of the Intel E810 Datasheet.  The per-VF register coverage and
E830 TCLAN selection match the Intel ICE driver, while the default
fail-closed policy follows ixl(4).

Validated on E810 with four four-queue FreeBSD iavf VFs.  An invalid
tail write blocked only the offender, incremented its Tx MDD counter,
caused no PF reinitialization, and left a sibling at 50/50 successful
pings.  Physical FLR restored the offender and a PF reset rebuilt it
without a spurious anti-spoof block.  With auto-reset enabled, the
offender resumed after the reset while its sibling completed 60/60
pings; all queue-map enable bits remained set after the second VFR.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59028

923b9a80c21ff178ceb4ffb23374e9ef924adb66 Kevin Bowling 2026-08-19 10:49:34

ice: Protect the PF mailbox from flooding VFs

Wire the shared code mailbox-overflow detector into the VF lifecycle and
virtchnl dispatcher.  E830 controllers use their per-VF hardware
in-flight-message watermark.  On older controllers, attribute a
congested mailbox snapshot to its sender, reset it with its queues
disabled, and discard its subsequent requests.  Advance snapshot
accounting even for discarded requests.  A physical VFLR, PF reset, or
IOV recreation releases the VF.  A blocked VF can still submit mailbox
messages after reset, so discarding requests does not stop it from
replenishing the shared queue.

Process at most one initially full mailbox immediately.  If producers
keep it nonempty, mask only the mailbox interrupt cause and let the
periodic admin timer schedule bounded drain work.  Keep the shared admin
vector enabled so that OICR and other control-queue events can still be
serviced.  Re-enable the mailbox cause after draining and recheck the
queue head for arrivals while the cause was masked.  Retry failed reads
through the same deferred path instead of treating them as an empty queue.

Document both protection models and add failure-injection points for the
isolation and scheduling paths.

E810-XXV tests with two host-attached iavf VFs injected overflow on VF 0,
disabling only that VF while VF 1 completed 60 of 60 pings.  A physical
VFLR and a PF reset each released VF 0; IOV recreation also reset its
cumulative count.  Forced persistent mailbox-pending state produced 20
admin and control-queue passes in five seconds, remained timer-paced,
and did not interrupt sibling traffic.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59029

cef57e81ce906bcceb0bd3097021be4110f192c5 Kevin Bowling 2026-08-19 11:51:42

ice: Report SR-IOV VF status

Report the VF MAC, allocated transmit and receive queues, exact trunk
VLAN-filter count and capacity, negotiated virtchnl API, configured MAC,
VLAN, spoof-check, and promiscuous-mode policy, automatic link-state
policy, PF traffic permission, and fault containment through iflib.

Expose mirror configuration and active hardware rules, precise
malicious-driver isolation and counters, software mailbox-overflow
isolation and counters, VF-owned MAC-filter count and limit, and reset
diagnostics through a versioned driver.ice extension.  Distinguish a
failed VF reset from a required VSI rebuild, which may still be pending
rather than failed.  Keep the namespace schema local to the driver so
future extensions need no changes to common network headers or the
formatter.

Invalidate cached VF handshakes during preparation for an externally
initiated device reset, before releasing the context lock to wait for
hardware.  Mark the VFs as requiring rebuild even if an early PF rebuild
failure prevents reaching their VSIs.  Software-initiated resets retain
their advance notification before invalidating the handshake.

The iflib context lock protects VF state and VSI lifetime while
constructing the snapshot.  The query uses only cached state and does
not issue AdminQ commands or read device registers.

Validation on E810 with host-attached iavf VFs used ifconfig -v and
direct Netlink queries to check handshake, queue, VLAN, policy, MDD,
and mailbox state across VF and PF resets.

Reviewed by:    Pawel Sobczyk <pawel.sobczyk@intel.com>, ziaee
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58739

31a77c113507d5e7689996976679a972a11ff5f7 Kevin Bowling 2026-09-06 16:17:40

acpi: Invoke power_resume_check eventhandler

Reviewed by:  olce
Sponsored by: The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59741

7ff26d59e7386bb92e4384ae8d1f9d2280acf511 Aymeric Wibo 2026-09-18 10:48:32

amdsmu: Diagnose S0i3 entry after resume

Print out diagnostic information after resuming from suspend-to-idle if
we failed to enter S0i3, i.e. the IP blocks that were blocking entry to
S0i3.

Don't give detailed IP block info for other SMUs than for Phoenix, as I
have not had a chance to test these yet and the SMU seems to be very
quirky.

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59673

a23fa3fe1c0aa4e529b26bbec17d17571f8708fd Aymeric Wibo 2026-09-18 10:50:22

amdsmu: Hints on what to do if IP block blocking S0i3

Reviewed by:  olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59674

758578370f6b726299c19f0e87355b91af1b90e5 Aymeric Wibo 2026-09-18 10:52:03

iavf: Reschedule pending virtchnl replies after the processing budget

The VC worker ignores the pending count returned by iavf_process_adminq.
If a pass exhausts its message budget, replies can remain in the receive
ring without another interrupt to schedule the worker.  During init,
the iflib admin task cannot provide a backstop because init holds the
context lock while waiting for ENABLE_QUEUES to complete.

Reschedule the VC worker after a successful pass with messages remaining.
Keep the per-pass budget and do not retry AdminQ errors.  Stop
self-rescheduling once detach clears INITIALIZED; the existing polling
and reset-recovery gates continue to exclude asynchronous processing.

Validation: reproduced the timeout on a three queue E835 VF under
Hyper-V.  Temporary tracing showed a successful ENABLE_QUEUES reply
already in the guest receive ring after a three-message pass left two
messages pending.  With the fix and no tracing, a GENERIC kernel with
WITNESS and INVARIANTS passed three batches of 30 down/up and MTU
1500/9000 cycles without enable/disable timeouts.

MFC after:      2 weeks
Sponsored by:   BBOX.io

3c52d24acb422f5d80f50612bd990ce760a19de8 Kevin Bowling 2026-09-18 11:51:55

hn: Refresh VF RSS configuration after link recovery

A VF can finish initialization or reset recovery after hn's handoff-time
RSS query returned ENXIO.  In that case hn suppresses synthetic receive
hash metadata, but previously left it disabled even after the VF could
answer the queries again.

Queue an RSS refresh on a VF link-up notification, using the existing VF
worker in both transparent and non-transparent modes.  Revalidate the
association, active VF path, administrative state, and carrier under
hn_lock before querying and reconfiguring synthetic RSS.  Coalesce the
requests with an atomic flag and retain a request while capability
forwarding temporarily excludes the worker.  Keep the existing query
validity checks and unsupported-query fallback unchanged.

This is a one-shot refresh, not a readiness poll.  Recovery without a
link-up notification, or a query that still fails during the refresh,
does not trigger another retry by itself.  A later link-up or normal
handoff can query again.  Consuming the request while the VF path is
inactive is intentional: the next handoff queries RSS unconditionally.

Continue to reprogram RSS after a successful query even when the cached
key and types match.  They are updated before host reconfiguration and
do not prove that the previous programming succeeded.

The event callback only records and schedules work; RSS queries and host
reconfiguration remain in sleepable context.  No packet-path changes or
new timer are needed.

With an E835 iavf VF, reproduced an ENABLE_QUEUES timeout and an ENXIO
RSS query in both transparent and non-transparent modes.  In each mode
hn restored mbuf_hash after VF recovery, without another interface
reconfiguration.

MFC after:      2 weeks
Sponsored by:   BBOX.io

1568e6bb3c9d4007492d0297c0dfa3834a2ba751 Kevin Bowling 2026-09-18 11:25:44

dpaa: Add ContextA and ContextB to qman_fq_create

The SEC QMan interface stores context in context_a and context_b, so add
them to the frame queue creation.

823466bd56479d54ae482c77c311b2fa0855df2f Justin Hibbits 2026-09-10 22:27:55

dpaa: Add QorIQ Security Engine (SEC) driver

The QorIQ Security Engine (SEC) generally fits into the Data Path
Acceleration Architecture, accelerating cryptographic operations.

Currently this driver does not use the QMan interface, instead relying
on the job rings, as Linux also does, to reduce complexity until needed
for network protocol acceleration, like IPSec and OpenVPN.

Initial testing via `openssl speed -engine devcrpto -evp aes-128-cbc`
yields a ~200x throughput improvement, from 105MB/s to more than 20GB/s
for 16k block sizes.

Differential Revision:  https://reviews.freebsd.org/D59581

73bb247927470cb2f96cb06fc00a24019cca2607 Justin Hibbits 2026-07-30 02:19:52

powerpc/conf: Add some crypto options to QORIQ64

With the DPAA Security Engine (SEC) KERN_TLS should provide some
enhancement over userland software TLS.  Also, add IPSEC_SUPPORT, so
that ipsec can be loaded if needed.

e6454ec1e7d711b3ef51db86c6172cbc43705716 Justin Hibbits 2026-09-18 03:28:19

amdsmu: Fix CPU-model-specific matching

For Krackan Point, CPU-model-specific matching would not work because
amdsmu_match() browses amdsmu_products[] in order and returns the first
match, and the Krackan Point's 'struct amdsmu_product' object variant
with a 'model' field of 0, indicating that any model matches, is listed
before the variant with model 0x70 in amdsmu_products[].

In practice, this means that reporting of IP blocks for Krackan Point
model 0x70 only was broken.  Specifically, not all the existing blocks
were reported and most statistics were not attributed to the right
blocks.

Fix this by making amdsmu_match() parse amdsmu_products[] in reverse, so
CPU-model-generic entries can continue to appear first and new specific
ones can be added after them, which is the expected chronological order
of additions.

While here, since the CPU model is between 0 and 255, change the type
used for CPU models to an 'int' and use the special value -1 to skip
model match, as there exist CPUs reporting 0 as the model (even if, to
our knowledge, only old CPUs seem to be doing that).

While here, fix alignement and whitespace in amdsmu_products[]'s
initializers.

Reviewed by:    obiwac
Fixes:          https://cgit.freebsd.org/src/commit/?id=9c77fb6aaa36 ("amdsmu: Add Krackan Point support")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59788

8aab12ca1898e3fe62a85c39aa1921950d739284 Olivier Certner 2026-09-17 13:38:57

vt: Reprogram display controller on KDSETMODE KD_TEXT for active window

When a graphical application (X.Org display server, Wayland compositor)
calls KDSETMODE to set the active VT back to KD_TEXT, vt(4) does not
reset the CRTC to point to its framebuffer, leaving the last image of
the graphical application visible instead of the text console until the
next VT switch.

Add a call to vd_postswitch to reset the CRTC, set VDF_INVALID to force
a redraw and schedule the flush timer, like vt(4) does in
vt_window_switch().

Sponsored by: Defenso

Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>

Reviewed by:    vexeduxr
Pull request: https://github.com/freebsd/freebsd-src/pull/2308

1181ac708936d054e07089de7c5b3c1de11a4367 Quentin Thébault 2026-07-02 14:27:10

Commit group #6: sound

sound: Standardize mixer_init() call order

Device drivers call mixer_init() in a non-standard order - some before
pcm_init(), and some after pcm_register(). However, both approaches are
potentially risky, and logically weak, since pcm_register() is supposed
to be the function that finalizes sound(4) attach.

Standardize the call ordering by moving all mixer_init() calls after
pcm_init(). This is also necessary for a follow-up patch, which expects
pcm_init() to have run first and initialized the PCM lock.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59069

13fcc9caaf968083254b92546e21dedb322a920b Christos Margiolis 2026-09-18 18:12:42

sound: Simplify how snd_mixer is fetched and how the cdev is created

The primary snd_mixer was reached by accessing the mixer cdev's si_drv1.
This is tedious and ugly, so store the mixer in snddev_info->mixer and
access it directly.

Additionally, create the cdev in a new mixer_make_dev() function (in
similar fashion to dsp_make_dev()) in pcm_register(), when everything is
initialized, instead of risking potential races because mixer_init()
(called before pcm_register()) used to create the cdev.

Also add some NULL checks in pcm_register(), to avoid creating a mixer
cdev when the driver (e.g., fdt/audio_soc.c) does not create a mixer in
the first place, and similarly in pcm_unregister().

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59070

221babdf9feb7e1c1c001a4be735400ca6fb12cb Christos Margiolis 2026-09-18 18:12:55

sound: Embed mixer cdev in snd_mixer

The mixer cdev belongs to the mixer, not to the PCM device, so move it
from snddev_info->mixer_dev into a new snd_mixer->cdev field. snd_mixer
itself is now included in snddev_info.

Also add a MIXER_REGISTERED() macro similar to PCM_REGISTERED().

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59071

a614c07ad4520c072f58aebee54d16d9b72837f5 Christos Margiolis 2026-09-18 18:13:32

sound: Defer macio codec volume writes to a task

tumbler(4), snapper(4) and onyx(4) write the volume over I2C, and
iicbus_transfer() sleeps. This is why mixer_set() drops the mixer lock
around MIXER_SET() for non-MPSAFE drivers, relying on Giant to keep them
serialized.

Store the volume in the softc and let a task do the I2C write with no
lock held, so that the mixer method does not sleep at all. The lock
dropping for non-MPSAFE drivers will be removed in a follow-up patch.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59073

b9761547077fb94e12c0bfa81f3b8b2b2df3c0bb Christos Margiolis 2026-09-18 18:14:29

sound: Use snddev_info->lock in place of snd_mixer->lock

snd_mixer and snddev_info have a 1:1 relationship. Now that snd_mixer is
embedded into snddev_info, it makes even more sense for both to share
the PCM lock. The only exceptions to this are MIXER_TYPE_SECONDARY
mixers, which still retain a private lock (snd_mixer->priv_lock),
because they are attached to the device driver, and not snddev_info.
Only snd_emu10kx(4) uses a secondary mixer.

A side-effect of this is that the MIXER_SET_LOCK()/MIXER_SET_UNLOCK()
mess goes away. These macros were used in the mixer_set*() functions to
drop the mixer lock if the driver is Giant-locked and the function can
sleep inside MIXER_SET*() methods, and to avoid an LOR before locking
PCM to guard channel list traversal.

Since mixers now use the PCM lock, drop the channel lock in
chn_syncstate() before calling mix_get(), to avoid an LOR. These lines
were actually already commented out for years.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59074

1a31ab15e8b342b660175e48b21f1c5d0b82ac50 Christos Margiolis 2026-09-18 18:15:50

sound: Retire mixer_hwvol locked variants

Prior to 9a00e0b8ca56 ("snd_uaudio: Do not use snd_mixer->lock as
mixer_lock"), there was a need for mixer_hwvol_mute_locked() and
mixer_hwvol_step_locked(), because the unlocked variants would acquire
the lock, but uaudio_hid_rx_callback() would also hold the lock, so this
was a measure to avoid recursion on snd_mixer->lock. Now that
snd_uaudio(4) has a private mixer lock, the locked variants are not only
unnecessary, but wrong, because we now lock the private lock and not the
snd_mixer one, which is what mixer_hwvol_mute_locked() and
mixer_hwvol_step_locked() expect. Retire the locked variants and call
the regular functions instead.

The unlocked variants take the mixer lock, which is now the PCM lock,
and reach uaudio_mixer_ctl_set(), which takes mixer_lock. Calling them
straight from uaudio_hid_rx_callback() would therefore take mixer_lock
and the PCM lock in the opposite order to the mixer ioctl path, so
record what the HID report asked for and perform the volume change at
the end of the callback, with mixer_lock dropped. The USB stack allows a
callback to drop its transfer mutex (see usbdi.9).

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59075

9548bfa342a71f1ca0ad953bf323086e84a395c3 Christos Margiolis 2026-09-18 18:16:03

sound: Do not set a recording source in mixer_uninit()

We currently set the recording source to SOUND_MIXER_MIC during mixer
deletion. Apart from the fact that this control might not be present on
all devices, it is unnecessary to do that, plus we already set all the
volumes to 0 in the mixer_set() call above.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59076

03b59d2e7df263ea5a8904e5593d14f6e3e0fbd8 Christos Margiolis 2026-09-18 18:16:40

sound: Reuse mixer_delete() in mixer_uninit()

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59077

6c735475aeefc626962818c0ab8749aaeb6de9a4 Christos Margiolis 2026-09-18 18:18:01

sound: Improve some mixer return values and their handling

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59078

db62d784f02a913c7fca612b04585c633ba8277c Christos Margiolis 2026-09-18 18:18:10

sound: Remove unncessary locking in sysctl_hw_snd_hwvol_mixer()

The locking around strlcpy() was because of m->hwvol_mixer, but this is
just an int, so we don't need to lock in this case. Instead lock only
when m->hwvol_mixer is written.

While here, add parentheses around the returns.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59109

044ef293a8bbd057de3fb13ec97d3d0ee16462e4 Christos Margiolis 2026-09-18 18:18:13

sound: Lock around mixer_set*() in mixer_init() for consistency

Sponsored by:   The FreeBSD Foundation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59110

47cf9dc7861371edcfdb85a38e2c240f430ccb28 Christos Margiolis 2026-09-18 18:18:20

hn: Handle unavailable VF RSS configuration

Treat unsupported RSS queries and RSS_FUNC_NONE as normal reasons to
suppress synthetic receive hash metadata.  Keep diagnostics for other
errors and invalid configurations.  Also suppress hash metadata when
reconfiguring synthetic RSS fails, since the VF and synthetic settings
cannot then be assumed to agree.  Correct the hash-query diagnostic name.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59691

001332bdc11e2d72408bb5b815dcc9ffe8b6f5d3 Kevin Bowling 2026-09-15 00:15:12

ixgbe: Use the common RSS key without options RSS

Use rss_getkey() for PF and VF RSS programming even when options RSS is
not configured.  The common key is available independently of RSS queue
placement and is also used by software hashing.  Generating a private key
on each initialization defeats that agreement and changes receive hashes
across resets.

Leave hash-field selection and indirection-table placement unchanged.
82599 and X540 VFs retain their PF-owned RSS configuration.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59789

709d7cf3039f648e23260a35c1094b15b4d4593b Kevin Bowling 2026-09-18 07:43:37

ixv: Report the programmed VF RSS configuration

Provide the iflib RSS query methods for X550 and newer VFs, whose RSS key
and hash types are programmed by the VF.  Cache those values and answer
queries under the context lock, without register reads or mailbox
transactions.  Invalidate the snapshot at init, stop, and when an admin
check requests recovery after losing the PF mailbox or detecting reset.
Reject queries while the snapshot or mailbox is unavailable.

Program the common RSS key and cache the values written to the registers.
The key remains stable across resets, including live MTU and capability
changes for which hn(4) can retain its copy without another VF handoff.

Serialize the key in register byte order and report the six supported
IPv4/IPv6 TCP/UDP hash selections from the programmed MRQC, rather than
claiming that every globally requested hash type is enabled.  A single
receive queue still performs Toeplitz hashing.  Older VFs retain
EOPNOTSUPP because their PF-owned RSS settings are not available here.
This allows hn(4) to synchronize synthetic RSS with the actual VF
settings instead of suppressing otherwise usable receive hash metadata.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59692

32b8381d711cb668791ff307de1df1ca333b39ba Kevin Bowling 2026-09-15 00:15:12

iavf: Use the common RSS key without options RSS

Use rss_getkey() when programming the RSS key through virtchnl regardless
of options RSS, matching the register-programming path.  The common key
is available independently of RSS queue placement; the driver-specific
default otherwise makes the chosen key depend on the PF's configuration
interface.

Remove the unused default-key helper and its declarations.  Preserve the
negotiated key length, zero padding, hash selections, and indirection-table
policy.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59790

7f1e93b1e57fedc10e149d606c64a8610245acb4 Kevin Bowling 2026-09-18 08:09:59

ixl: Initialize the extended RSS key

Zero the complete 52-byte RSS key buffer before fetching the common
40-byte key.  Both the X722 AdminQ path and the register path consume all
52 bytes; the trailing extended-key bytes must not come from uninitialized
stack storage.  This matches the zero padding already used by iavf and ice.

Remove the unused driver-default key helper and its declaration.  Keep
the standard key, hash selections, and indirection policy unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59791

0f7bdeadaf9d8101993dd39abee3a6a2ef4e2950 Kevin Bowling 2026-09-18 08:29:16

e1000: Use the common RSS key for 82574

Use rss_getkey() in the older em multi-queue RSS path, which is reached
by 82574 with two receive queues.  This replaces a private key generated
on each initialization and matches the common-key policy already used
by the igb path.

Decode each register word with le32dec() and remove the private assembly
macro, avoiding signed integer shifts while preserving the register byte
order.  Leave the redirection table and hash fields unchanged.  This does
not change single-queue em devices or PF-owned igb VF RSS settings.

Reviewed by:    erj, gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59792

a666f1564501734d3d7ec05ab516e40309e81454 Kevin Bowling 2026-09-18 08:29:16

aq: Use the common RSS key without options RSS

Fetch the common RSS key independently of options RSS instead of
generating a private key in non-RSS kernels.  Keep the existing
software-RSS or round-robin indirection policy and hardware key
serialization unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59793

772994d7748287be70fe850ec9e1117d4e7b1747 Kevin Bowling 2026-09-18 08:29:17

axgbe: Use the common RSS key without options RSS

Fetch the common key in the PCI iflib frontend regardless of options RSS
and make the key API declaration available in both configurations.
Retain the existing hash-field selection and queue-placement branches.
The independent ARM frontend is unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59794

e94de94f8d14ede98d38c9fc506ddf5c77ee9788 Kevin Bowling 2026-09-18 08:29:17

bxe: Program the common RSS key in searcher byte order

Use the common RSS key instead of generating private random words.
Reverse the bytes before passing the key to the shared code, which copies
the supplied bytes directly into the firmware request.  The searcher
consumes this array in reverse order; a raw copy of the common key would
not produce matching Toeplitz hashes.

The hardware ordering is documented by Linux commit
d682d2bdc30650a5c7ce9908ab83ab674b658744 ("bnx2x: byte swap rss_key to
comply to Toeplitz specs").  Keep the conversion in the FreeBSD caller
rather than changing the shared-code interface.

Preserve the config_hash gate, including the PMF-only key programming
on 57710/57711, and leave hash types and indirection policy unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59796

9b374ad2b3f3b0f4e6c9d4e78859a429b6b282d6 Kevin Bowling 2026-09-18 08:29:18

oce: Use the common RSS key

Fill the RSS configuration request with the common 40-byte key instead
of fresh random bytes.  Preserve the mailbox representation, hash
selection, and indirection table.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59797

fd74d1e83e18b8f014d8fcc7b61f2e9461512dca Kevin Bowling 2026-09-18 08:29:19

mlx4en: Use the common RSS key for programming and queries

Replace the private fixed key with rss_getkey().  Copy the common byte
stream directly into the RSS queue-pair context and use the same helper
for SIOCGIFRSSKEY, so hardware programming and hn's query agree.

Change the helper to fill caller-owned storage instead of returning a
pointer to a static key.  Check the fixed hardware and ioctl buffer sizes
at compile time.  Leave RSS masks and queue steering unchanged.

MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59798

1ad999a1c7e0efd4fd65df634a4c108d593d4027 Kevin Bowling 2026-09-18 08:29:19

mana: Initialize ports with the common RSS key

Use rss_getkey() for each port's initial key instead of a lazily generated
driver-global random key.  Remove the obsolete helper and its unsynchronized
initialization flag.  Make the common-key declaration available without
options RSS.

The port still retains the key used for hardware programming and the
existing SIOCGIFRSSKEY response.  Leave hash types and queue placement
unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59799

aef4c3eb31d9c29c6aeb08023b1c9d2457d817e3 Kevin Bowling 2026-09-18 08:29:20

qlnx: Derive the hardware RSS key from the common key

Replace the embedded default key with rss_getkey().  Decode each group
of four key bytes as a big-endian word; the shared code then serializes
those host-order words as little-endian firmware fields.  This preserves
the existing hardware representation for the common default and allows
a configured common key to take effect.

Keep the existing multi-queue gate, RSS hash selections, and indirection
policy unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59800

ce68b58217ed8a9bf45b1622d3d32ec26e9025d0 Kevin Bowling 2026-09-18 08:29:20

qlxgbe: Derive the mailbox RSS key from the common key

Replace the embedded key with rss_getkey(), retaining the firmware's
reversed 64-bit word-pair order and low-word-first layout within each
pair.  The common default produces the same mailbox key as the existing
constants, while configured common keys no longer get ignored.

Leave the RSS enable flags, hash types, and indirection policy unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59801

30fdef26de87516dbdd1dd5e3031a57ba8759437 Kevin Bowling 2026-09-18 08:29:21

qlxge: Derive both RSS keys from the common key

Replace the embedded default with rss_getkey().  Preserve the ICB's
little-endian representation of each big-endian key word, then copy
the initial 16 bytes of the serialized IPv6 key into the IPv4 key.

This retains the old default-key bytes and allows a configured common
key to take effect.  Leave RSS flags and queue mapping unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59802

a5e3c38531cd94d245372147f6f6e1d6d2f82a39 Kevin Bowling 2026-09-18 08:29:21

qlxgb: Derive the firmware RSS key from the common key

Replace the embedded key with rss_getkey().  Retain the reversed 64-bit
word-pair order and low-word-first layout used by the existing firmware
request, matching the qlxgbe conversion.

The common default produces the same five firmware words as the old
constants.  Leave hash selections, RSS enablement, and the indirection
mask unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59803

4ad740ad48e2b461637c85cad675202874e182e2 Kevin Bowling 2026-09-18 08:55:59

al_eth: Use the common RSS key

Fetch the common Toeplitz key instead of filling it with random bytes
during receive-forwarding setup.  Check the key size at compile time and
retain the existing host-to-network conversion for each hardware word.

Leave forwarding, hash selection, and queue mapping unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59804

fbe4eefbb6ca29e1f88d122619f7311896b81b1f Kevin Bowling 2026-09-18 08:55:59

enetc: Use the common RSS key

Replace the random register words with rss_getkey() and decode each
four-byte chunk with le32dec() before writing the port's key registers.

Keep the RSS capability check and existing queue-count and indirection
table programming unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59805

449fc84f370b079619eaa0d70008391ac07718f5 Kevin Bowling 2026-09-18 08:56:00

vnic nicvf: Program the common RSS key in network word order

Replace the repeated hardware-reset key with rss_getkey().  Decode each
eight-byte chunk with be64dec() into the register-word array before
programming the five key registers.

This matches the key serialization in DPDK's nicvf_rss_set_key(), added
by commit 7694fab264ac666d62a4cae04f2979991ce64259
("net/thunderx/base: add RSS and RETA configuration").  A raw copy into
the word array on little-endian hosts would reverse bytes within each
register relative to that convention.

Preserve the CPI-algorithm gate, enabled hash fields, and round-robin
indirection table.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59806

8c25b70120e8838135cb356c94d350105f45ff7c Kevin Bowling 2026-09-18 08:56:00

qlnx: Report the programmed RSS key and hash types

Implement SIOCGIFRSSKEY and SIOCGIFRSSHASH for qlnxe and qlnxev using
the cached vport RSS configuration.  This lets hn(4) synchronize its
synthetic RSS configuration with the VF without assuming that every
driver programs all of the common RSS hash selections.

Serialize the queries with the device lock and reject them while the
interface is not running.  Convert the firmware request's key words back
into network byte order and translate the six representable IPv4/IPv6
TCP/UDP hash selections.  Report no hashing when RSS is disabled, including
the driver's single-queue configuration.

For VFs, require a successful RSS extension response from every hardware
function.  The overall vport-update reply can succeed while its RSS TLV
is missing or rejected; recording that result prevents reporting an
unconfirmed configuration.  Invalidate the confirmation before each RSS
request.  Leave existing vport-update return semantics, queue setup, and
the receive datapath unchanged.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59810

9d48fd452ed20746e468dd986fa6b54ca20350a6 Kevin Bowling 2026-09-18 10:11:36

bnxt: Initialize RSS with the common key

Use rss_getkey() for the initial VNIC key instead of generating a
per-attachment private key.  Preserve the writable rss_key sysctl,
its override lifetime, the hardware DMA representation, and all hash
and indirection settings.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59795

62c80d76f7dc960f430cb34f88c2a549612e3e93 Kevin Bowling 2026-09-18 08:29:18

ARMADA 8040: Adapt ICU driver to updated device tree.

4680109c6bc425b0a3b76fad57888c239e918615 Michal Meloun 2026-09-15 08:18:44

vt: Move VWF_GRAPHICS clearing under VT_LOCK

Reviewed by:  vexeduxr, Quentin Thébault <quentin.thebault@defenso.fr>
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59814

82dcd3ab12f0e86269bfb02fff4f216bab5e01a0 Ed Maste 2026-09-17 14:28:17

Kernel

Kernel stuff (other than networking, filesystems, and drivers).

nfscl: Yet more fixes for the NFS over RDMA client glue

Yet again.  I was trying to make the svc_vc_backchannel()
operations do double duty and be used by the clnt_rdma.c code
as well.  It got too messy, so this reverts svc_vc.c back to
its pre-glue form and adds the small changes needed to support
a separate set of svc_rdma_backchannel_xxx() functions.

This commit should not affect non-RDMA behaviour.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

77535f91f623ec5bda9d45de878165cb6b3cdba1 Rick Macklem 2026-09-14 00:12:46

rangelock: Enable rl_q_owner tracking under INVARIANT_SUPPORT

This fixes the build for kernels with INVARIANT_SUPPORT but without
INVARIANTS.

Fixes:          https://cgit.freebsd.org/src/commit/?id=2e376cca379b ("rangelock: Reimplement _rangelock_cookie_assert()")

bcd1e7a8caac9129cc08995f8ff81a0eef0529bc John Baldwin 2026-09-14 15:33:12

Commit group #10: LinuxKPI

LinuxKPI: rcu: add optional condition to list_for_each_entry_rcu()

list_for_each_entry_rcu() can take an optional condition.  Add the
macro argument so code remains compiling but do not do anything with
it just yet.

Leave comments as list_for_each_entry_rcu() likely should have a
different implementation.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D59292

e975ce86ff11a330128f5b21c7cd11c28d3aff87 Bjoern A. Zeeb 2026-08-27 08:04:08

LinuxKPI: add #include of rculist.h to ethtool.h for Linux conformance

Add #include rculist.h to ethtool.h to fullfill expectations of
Linux drivers without having to modify them.

MFC after:      3 days
Reviewed by:    dumbbell, emaste
Differential Revision: https://reviews.freebsd.org/D58874

4570a1bf760a3cd63eb7dd9e3ebbc3cf103bda4d Bjoern A. Zeeb 2026-08-12 14:01:19

LinuxKPI: add typedef for clockid_t

Needed by a wireless driver (not really using it) to compile.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58877

401d0922a4bfcf40d3ae1866a0d90f955264def0 Bjoern A. Zeeb 2026-08-16 21:30:43

LinuxKPI: pci: add pci_select_bars() and pci_msix_vec_count()

For pci_select_bars() we use the LinuxKPI internal information, while
for pci_select_bars() we fall back to the native PCI stack.

Needed by a wifi driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58878

55c07af60172b211116be47010fc0831aafc99e8 Bjoern A. Zeeb 2026-08-16 21:32:31

LinuxKPI: fix argument type to lkpi_pci_msi_desc_alloc()

lkpi_pci_msi_desc_alloc() takes an unsigned int, not an int.
While here make sure the prototype is visibile in interrupt.h as
well before use to avoid -Wimplicit-function-declaration errors.

Discovered while working on a wireless driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58879

cfb23b01e269e8a0a84066637b82b746f01b46b4 Bjoern A. Zeeb 2026-08-16 21:37:08

LinuxKPI: implement dma_{alloc,free}_{noncoherent,attrs}

We use one to implement the other given direction stays unused.

This is needed by an upcoming wifi driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58880

c3fa17a6a331db8aad03e9cb89ba97e1811ab381 Bjoern A. Zeeb 2026-08-16 21:54:36

LinuxKPI: add PCI_IRQ_AFFINITY #define

Add the #define for PCI_IRQ_AFFINITY and leave a pr_debug note in
pci_alloc_irq_vectors() that it is unimplemented.

The flag is needed by an upcoming WiFi driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58881

b589e403a2c3bd2a94fb2ab88cd23255c68a9f05 Bjoern A. Zeeb 2026-08-16 22:01:44

LinuxKPI: pci: add reset_{prepare,done} to pci_error_handlers

Needed by an upcoming wireless driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58882

c40219c572df8b4b0c2392ee341d93bc82e6076b Bjoern A. Zeeb 2026-08-16 22:03:56

LinuxKPI: add can_wakeup option and accessor functions

We can implement device_set_wakeup_capable() in the !CONFIG_PM_SLEEP
case;  we do not have the infrastructure in place for the CONFIG_PM_SLEEP
case so leave a pr_debug TODO.

Needed by an upcoming wireless driver.

MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D58883

a424fb3519ebf8fb972e7ba45ba19df322992b00 Bjoern A. Zeeb 2026-08-16 22:05:42

LinuxKPI: 802.11: Always lock around lkpi_80211_mo_{remove_interface,stop}()

Add the missing locking to another two MO driver downcalls, as drivers
always expect it (e.g. rtw89 by assertion).

Add the lock and might_sleep assertions to the respective lkpi_80211_mo_*
downcalls.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298417
Reviewed by:    bz
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D59608

73166d21bd831db264509cbdce1ab3b63ab5b189 Artem Bunichev 2026-09-13 21:21:40

UPDATING: bump __FreeBSD_version to 1600026 for LinuxKPI changes

The size of multiple embedded structs have changed and may lead to
problems (pci_error_handlers in pci_driver, dev_pm_info in struct device).
Allow these changes to be detected by bumping __FreeBSD_version.

MFC after:      3 days

e1ad124136deb4f270d4cef759bf9e9debdb17d3 Bjoern A. Zeeb 2026-09-14 19:01:12

linuxkpi: Add x86 CPU ID matching functions and macros

There are two parts that go together:
* `X86_MATCH_VFM()` to declare a matching pattern
* `x86_match_cpu()` to check if the current CPU matches one of the
  patterns in an array.

The i915 DRM driver started to use this in Linux 6.14.

Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57700

5fb3aea2d8c436afa87605d8d7798ae8b09d558c Jean-Sébastien Pédron 2026-06-17 14:01:05

hn: Invoke the owned VF's transmit queue flush callback

The generic if_qflush() only clears if_snd.  Calling it directly for a
transparent VF bypasses the driver's callback and its private software
transmit queues.  Add if_getqflushfn(), matching the existing callback
accessors, and invoke the registered callback while hn_vf_lock protects
the VF pointer.

Flush an attached VF whenever transparent mode owns it, not only while
the VF datapath is enabled.  Disabling transmit during handoff does not
discard packets already queued to the VF.  This also covers the inactive
interval after fallback.  Non-transparent VFs remain independently owned
and are not flushed by hn.  Synthetic queue flushing is unchanged.

MFC after:      2 weeks
Sponsored by:   BBOX.io

8e816fc2e98c8c0bf0b6fef3bd5f52bc03c843ce Kevin Bowling 2026-09-15 00:26:14

linuxkpi: Compile `x86_match_cpu()` on amd64 and i386 only

This fixes the build on other architectures where `struct x86_cpu_id` is
unavailable.

Sponsored by:   The FreeBSD Foundation

5407f767db14a76bb63b5a8b3f77da6085d149c5 Jean-Sébastien Pédron 2026-09-14 20:37:55

video(4): add extended controls and remaining V4L2 compat symbols

Add the extended control interface

Values match the reference ABI; the new struct layouts are pinned
with static assertions.

Reported by:    thierry

Reviewed by:    adrian, thierry
Differential Revision:  https://reviews.freebsd.org/D59496

6ac71529b285049a4939d7d17b3564c5f4f0519e Abdelkader Boudih 2026-09-15 17:30:49

Implement vmemdup_{array}_user

This is what FreeBSD now does for memdup_user and memdup_array_user
(which is wrong for memdup, but correct for vmemdup).

The amdgpu DRM driver started this in Linux ~6.12.86+

Reviewed by:    wulf
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57444

302c6d25da6907ec762ff8937fa86d380743b000 David Heidelberg 2026-09-15 20:17:52

IB/mlx5: Add support for CQE compressing

[PATCH 06/31] FreeBSD OFED support for DPDK MLX5 PMD

CQE compressing reduces PCI overhead by coalescing and compressing
multiple CQEs into a single merged CQE. Successful compressing
improves message rate especially for small packet traffic.

CQE compressing is supported for all 64B CQE formats (with certain
limitations) generated by RQ/Responder or by SQ/Requestor.

IB/mlx5: Report mlx5 CQE compression capabilities when querying device
The capabilities include:
 - Max number of compressed and aggregated CQEs in a single session,
   while zero means unsupported.
 - For Responder, there are two formats of mini CQE: mini CQE with Rx
   hash and mini CQE with checksum. They're mutual exclusive.

Differential revision:  https://reviews.freebsd.org/D32180
MFC after:      1 month

5096c87b4435657c471b6d5ba86b4c4ee15f252b Vag Singh 2025-08-12 03:07:38

mlx5/linuxkpi: Add MLX5_PCI_DEV_IS_VF to mlx5_core_pci_table

[PATCH 11/31] FreeBSD OFED support for DPDK MLX5 PMD

The MLX5 core driver recognizes a VF device as a PF device
in FreeBSD VM, because mlx5_core_pci_table was not having VF
flag MLX5_PCI_DEV_IS_VF. Added MLX5_PCI_DEV_IS_VF flag in
mlx5_core_pci_table.

Updated PCI_VDEVICE macro in LinuxKPI for class and class_mask,
same as linux.

Differential revision:  https://reviews.freebsd.org/D32185
MFC after:      1 month

d86bdbbb92cae35f37fd33ba163b65f5d50c867c Vag Singh 2025-08-14 05:50:08

fixup! mlx5/linuxkpi: Add MLX5_PCI_DEV_IS_VF to mlx5_core_pci_table

Use designated initializers for .class and .class_mask in PCI_VDEVICE(),
and set .driver_data explicitly on the VF entries, rather than relying on
positional initializers.

Sponsored by:   NVidia networking
MFC after:      1 month

7b9dbfc95e09c9174178f41404f02bbb76399421 Ariel Ehrenberg 2026-07-28 10:38:58

IB/mlx5: Report mlx5 multi packet WQE capabilities when querying device

PATCH 13/31] FreeBSD OFED support for DPDK MLX5 PMD

The capabilities whether hardware support multi packet WQE or not is
exposed to user space through query_device by uhw.

Differential revision:  https://reviews.freebsd.org/D32187
MFC after:      1 month

c0019f294ceb8fe9c4aa8f83de7bacfc41b1d598 Vag Singh 2025-08-14 06:14:42

IB/mlx5: Support Vxlan tunneling specification

[PATCH 14/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Add support to receive specific Vxlan packet in ConnectX-4.

b) Add support to match packet fields which are tunneled,
i.e. support matching the header of the inner packet which is the result of
or bit operation of the original header and the IB_FLOW_SPEC_INNER type.

The combination of IB_FLOW_SPEC_INNER | IB_FLOW_SPEC_VXLAN_TUNNEL is not
needed to be checked, because the IB core has this check already.

Dfiferential revision:  https://reviews.freebsd.org/D32188
MFC after:      1 month

b32a207fa3bf633a8cc3031401c64ca12422c5a0 Vag Singh 2025-08-14 06:27:17

IB/mlx5: Report mlx5 packet pacing capabilities when querying device

[PATCH 15/31] FreeBSD OFED support for DPDK MLX5 PMD

Enable mlx5 based hardware to report packet pacing capabilities
from kernel to user space. Packet pacing allows to limit the rate to any
number between the maximum and minimum, based on user settings.

The capabilities are exposed to user space through query_device by uhw.
The following capabilities are reported:

- The maximum and minimum rate limit in kbps supported by packet pacing.
- Bitmap showing which QP types are supported by packet pacing operation.

Differential revision:  https://reviews.freebsd.org/D32189
MFC after:      1 month

18e57db978d6a13afe316523210d3e8091efe1f9 Vag Singh 2025-08-14 06:29:02

IB/mlx5: Expose software parsing for Raw Ethernet QP

[PATCH 17/31] FreeBSD OFED support for DPDK MLX5 PMD

Software parsing (SWP) is a feature that can be used to instruct the
device to stop using its internal parser and to parse packets on the
transmit path according to offsets set for each packets.

Through this feature, the device allows the handling of checksum and
LSO by the hardware according to the location of IP and TCP/UDP
headers.

Enable SW parsing on Raw Ethernet send queue by default if firmware
supports it and report these capabilities to user space.

Differential revision:  https://reviews.freebsd.org/D32191
MFC after:      1 month

ebfe0400185fdcd7a512333afa7cb54d2d6ba6f6 Vag Singh 2025-08-14 06:33:23

IB/mlx5: Expose multi-packet RQ capabilities

[PATCH 21/31] FreeBSD OFED support for DPDK MLX5 PMD

a) This patch reports the device's striding RQ capabilities to
the user-space:
- min/max_single_stride_log_num_of_bytes: Log of min/max number of
bytes in a single stride.
- min/max_single_wqe_log_num_of_strides: Log of min/max number of
strides in a single WQE.
- supported_qpts: A bit mask to know which QP types support multi-
packet RQ, for now only Raw Packet QPs.

b) Allow creation of a multi-packet receive queue.
In order to create a multi-packet RQ, the following fields in
the mlx5_ib_rwq should be set:
- log_num_strides: Log of number of strides per WQE
- single_stride_log_num_of_bytes: Log of a single stride size
- two_byte_shift_en: When enabled, hardware pads 2 bytes of zeros
before writing the message to memory (e.g. for the IP alignment).

Differential revision:  https://reviews.freebsd.org/D32195
MFC after:      1 month

fba8d61550edb8d158398db23e1610aa62e5cd55 Vag Singh 2025-08-14 06:44:55

IB/mlx5: Add tunneling offloads support

[PATCH 22/31] FreeBSD OFED support for DPDK MLX5 PMD

a) The device can support receive Stateless Offloads for the inner
packet's fields only when the packet is processed by TIR which is
enabled to support tunneling. Otherwise, the device treats the
packet as an ordinary non-tunneling packet and receive offloads
can be done only for the outer packet's field.
In order to enable receive Stateless Offloading support for incoming
tunneling traffic the TIR should be created with tunneled_offload_en.
Tunneling offloads is supported only be raw ethernet QP.

This patch includes:
- New QP creation flag for tunneling offloads.
- Reports device capabilities.

b) IB/mlx5: Add support for RSS on the inner packet
Some user space application would like to do RSS on the inner
packet fields instead on the outer.
When MLX5_RX_HASH_INNER is set with one or more of the other
hash fields, then the RSS will be done using the inner packet.

Differential revision:  https://reviews.freebsd.org/D32196
MFC after:      1 month

a5a8f98eb7a4494e03b0052e60d1010fd433af44 Vag Singh 2025-08-14 06:47:04

fixup! IB/mlx5: Add tunneling offloads support

Import Linux upstream commit 4e2b53a5cb5a ("IB/mlx5: Report inner RSS
capability").

Define MLX5_RX_HASH_INNER as (1UL << 31).  Shifting 1 into the sign bit of
a plain int is undefined behaviour, and user space compiles this header
too.  The main.c half of that commit is already carried by the preceding
fixup.

Sponsored by:   NVidia networking
MFC after:      1 month

0bf5db3ac9b176cb8d229a888f39714603f2c626 Ariel Ehrenberg 2026-07-28 12:02:51

IB/mlx5: Fix ABI alignment to 64 bit

[PATCH 25/31] FreeBSD OFED support for DPDK MLX5 PMD

Struct mlx5_ib_striding_rq_caps was not aligned to 64 bit as
it should have been. Add a 32 bit reserved field.

Differential revision:  https://reviews.freebsd.org/D32200
MFC after:      1 month

8938742100512a71899c2ab46da29fa44a7c04b8 Vag Singh 2025-08-14 06:52:57

mac_bsdextended: reject negative rule indices in sysctl_rule()

The security.mac.bsdextended.rules.<N> node handler takes N as
`index = name[0]` (a signed int) and only checks
`index >= MAC_BSDEXTENDED_MAXRULES`.  A negative index is caught on
the read branch, but the write-only add and delete
branches proceed to `rules[index]` unconditionally.

Reject `index < 0` alongside the existing upper-bound check.

Submitted by calif.io for the OpenAI Patch The Planet program

Signed-off-by: Andrew Griffiths <andrew@calif.io>

Reviewed by:    markj
MFC after:      2 weeks

5d0b87669a91244e330a35fc973e6c60f92f6d1f Andrew Griffiths 2026-09-16 13:04:46

proc: free kstack buffers when debug permission changes

The kern.proc.kstack handler allocates its output and stack buffers
before deliberately checking p_candebug again under the process lock.
If trace-control state changes between authorization checks, the failure
path balances the process and exec state but leaks both buffers.

Submitted by calif.io for the OpenAI Patch The Planet program

Signed-off-by: Andrew Griffiths <andrew@calif.io>

Fixes:          https://cgit.freebsd.org/src/commit/?id=8b5abd9027b8 ("kern_proc.c: disallow execve around sysctl kern.proc.kstacks")
Reviewed by:    markj
MFC after:      1 week

3484217cc47c1f77d2be2ed0e012b870d1cd3dca Andrew Griffiths 2026-09-14 07:55:01

LinuxKPI: implement __UNIQUE_ID() macro

Requred by drm-kmod v6.12.103

Obtained from:  OpenBSD

Reviewed by:    bz, emaste
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59733

8b05d84be9e288d201e8631750ae180b07311ba7 Vladimir Kondratyev 2026-09-17 07:42:12

LinuxKPI: Add PCI_EXP_TYPE_UPSTREAM and PCI_VENDOR_ID_AMD defines

Required by drm-kmod v6.12.105

Reviewed by:    bz, emaste
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59734

52d1a0c62be1b4bd8e78ee57c86288246d948046 Vladimir Kondratyev 2026-09-17 07:42:48

ice: Add a failure injection facility

Add compile-time optional, non-sleeping fail points around every VF
creation resource boundary, before VF VSI reconstruction, and in the
GET_STATS validation path.

Provide an ICE-wide wrapper and device selector so other driver
subsystems can add scoped points without duplicating the failpoint
plumbing.  Keep the current SR-IOV points and VF selector in an iov
child namespace.

Compile the facility only with options DRIVER_FAILPOINTS.  This shared
option avoids a separate kernel option for every driver that provides
test-only injection hooks.  Ordinary kernels contain no ICE failpoint
objects or sysctl nodes.  Require an exact PF device name and
optionally a VF index before any point can fire.  This prevents a stale
test setting from affecting another PF.

The hooks exposed two reset-lifetime defects while validating the
existing SR-IOV review series.  A PF reset could discard a firmware VSI
before teardown, and a rebuilt sibling could leave stale switch-filter
state after IOV destroy.

Tested on an E810-XXV with INVARIANTS and WITNESS.  All twelve creation
checkpoints rolled back and permitted immediate resource reuse.  Forced
reconstruction and malformed GET_STATS failures also preserved sibling
operation and reply cardinality.

Reviewed by:    gallatin, nprice, ziaee
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58940

b9cee186b83ecb531a6d4b4421230acfd5314c16 Kevin Bowling 2026-08-19 00:33:33

kern.mk: make clang 23 -Wunused-but-set-global non-fatal

This warning triggers in a few places in contributed code, and would
therefore be annoying to fix. Use -Wno-error= to at least show the
warnings so there is some incentive to submit them upstream.

MFC after:      3 days

bcd0d76d4882dd8d19a49c050411b5c58a0deb74 Dimitry Andric 2026-09-17 19:36:25

LinuxKPI: remove timer KPI from Linux version before 4.15

Now that semi-native drivers in main are clean of using any
pre-4.15 Linux timer KPI, remove the macros from LinuxKPI as well.

Supported versions of drm-kmod and the oldest nvidia port seem fine
based on my checks.  If anything else surfaces we can deal with the
fallout; the changes to the newer KPI were mechanical in Linux and
can be applied easily.

This change can be detected by #if !defined(init_timer)
at compile time so no need for a __FreeBSD_version bump.

MFC after:      3 days
Reviewed by:    emaste
Differential Revision: https://reviews.freebsd.org/D59688

9d18e2c12629eba4229564a17c1fa3adf15bb5ac Bjoern A. Zeeb 2026-09-15 00:32:33

LinuxKPI: Add devm_memremap and devm_ioremap_wc functions

Required by drm-kmod 6.12.101.

Reviewed by:    bz, dumbbell
Differential Revision:  https://reviews.freebsd.org/D59732

54b5d177aa988207a4ca68763ac8e20c8145c17f Vladimir Kondratyev 2026-09-18 06:49:36

power: Move power-related eventhandler decls to sys/power.h

Reviewed by:  olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59739

4afc2d5ac333f884049b0c1b06458d8387643131 Aymeric Wibo 2026-09-18 10:46:55

power: Add power_resume_check eventhandler

This is intended to be used on resuming to check that everything that
happened during suspend was expected.

It is not meant to check for errors we should hard-fail from, rather it
should be used as an opportunity for drivers such as amdsmu(4) to check
e.g. whether the previous suspend-to-idle actually entered a deep sleep
state (S0i3).

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59740

708dde6988b0dc5458e933066ca37f08e810ab19 Aymeric Wibo 2026-09-18 10:47:37

Commit group #11: sched_4bsd

sched_4bsd: remove kern.sched.4bsd.followon

kern.sched.4bsd.followon was enabled only for KSE. It was never compiled
since ad1e7d285ab1 and KSE was removed years ago. Now it's time to
remove this tunable.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59394

d29c9f5aca3463e3c7f2fa2263795a78c6430d2d Minsoo Choo 2026-08-24 02:25:30

sched_4bsd: remove dumping from maybe_preempt()

'dumping' is true only when kernel is dumping after crash (see
minidumpsys()) so KERNEL_PANICKED() will catch this.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59395

1dfefffcbdc652ee88a3baa284182f96e20faf17 Minsoo Choo 2026-08-24 02:25:31

sched_4bsd: add static assertion for nice weight

When NICE_WEIGHT * (PRIO_MAX - PRIO_MIN) exceeds the timeshare range,
two CPU-bound threads with different nice values can have the same
priority as their nice values are clamped to the timeshare range limit.
Add static assertion on NICE_WEIGHT to ensure that there is always
enough room for nice values in the both end of the timeshare priority
range.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59396

e90be6fdf08526624f407923d003b66efa23d304 Minsoo Choo 2026-08-24 02:25:32

sched_4bsd: update function name in comment

In b43179fbe815 ("Create a new scheduler api..."), schedclock() was
renamed to sched_clock() but the function name in the comment remained
still. Update the comment to reflect up-to-date name for schedclock().

Reviewed by:    olce
Approved by:    olce (mentor)
Fixes: https://cgit.freebsd.org/src/commit/?id=b43179fbe815 ("Create a new scheduler api...")
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59397

5d67118d2c7388bdc065e640719553ff4d9eea89 Minsoo Choo 2026-08-24 02:25:32

sched_4bsd: remove obsolete comment

In old Unix, the whole process address space including scheduler-related
data was paged out to disk. We now allocate thread-related data with UMA
on wired memory which never page out. Thus this comment is now obsolete.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59398

46416a57eb7b6d74fda13cc6e40a43bdfa6b7da9 Minsoo Choo 2026-08-24 02:25:33

sched_ule: remove unused KTR_ULE

Commit 62fa74d95a16 ("Add support for the new cpu...") removed all uses
of KTR_ULE, leaving the macro unused.

Reviewed by:    olce
Approved by:    olce (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=62fa74d95a16 ("Add support for the new cpu...")
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59399

7997d2a18150a449b563c87490e8d440bb1023f3 Minsoo Choo 2026-08-24 02:25:34

sched: fix kern.sched.{4bsd,ule}.slice

Fix three problems with kern.sched.{4bsd,ule}.slice:

 * Guarantee minimum slice is 1.
 * Recalculate hogticks on sysctl write.
 * For ULE, recalculate sched_slice_min on sysctl write.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59401

179f5b2bfedccc762352f06057f4e389bfabb2ea Minsoo Choo 2026-08-24 02:25:35

Commit group #12: sched_4bsd

sched_4bsd: fix comment in maybe_preempt()

The comment says the new thread's priority is not a realtime priority
while the code states pri > PRI_MAX_ITHD which is interrupt priorities
not realtime.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59402

351f6733180cebdc83585f9a00677f4998f6c6f1 Minsoo Choo 2026-08-24 02:25:36

sched_4bsd: move comment to correct location

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59403

039498c2735ee0697da24b9c60c9e67680f91f31 Minsoo Choo 2026-08-24 02:25:36

sched_4bsd: remove obsolete comment

'awake' checks if a thread, not a process, is awake.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59404

6c0c77e190b27d768595ef5b38d798430fb03a8b Minsoo Choo 2026-08-24 02:25:37

sched_4bsd: fix vague comment

The comment "was incremented in schedcpu()" doesn't give enough
background for decrementing ts_slptime by 1 (thus ignoring decay_cpu()
for 1 ts_slptime). More accurately, ts_slptime is decremented by 1
because decay_cpu() has already executed once in schedcpu() when
ts_slptime was 1.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59406

cd33abbce5a5c3b454f00ca3d0ecd71c2234106c Minsoo Choo 2026-08-24 02:25:37

sched_ule: fix comment on ts_slice

In ULE ts_slice stores the number of ticks of slice passed not
remaining.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59407

872074c50e99ab8858c2defe255d716f8f75f15b Minsoo Choo 2026-08-24 02:25:38

sched_ule: fix invalid tdq_slice() and sched_slice_min

sched_slice_min should always to be greater than zero. When modifying
sched_slice through sysctl, if the new value is less than
SCHED_SLICE_MIN_DIVISOR, sched_slice_min is computed to zero. Add
imax(1, ...) to prevent this.

tdq_slice() should not return a value less than sched_slice_min since
that will cause integer underflow of ts2->ts_slice in
sched_ule_fork_thread. SCHED_SLICE_MIN_DIVISOR is currently set to 6 so
when load is 5 and sched_slice is 4, the two if conditions in
tdq_slice() will pass and the function will return zero. Thus use imax()
so tdq_slice returns sched_slice_min at minimum.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59408

477d2ea79252054596c73fa5f485bd224c028fd9 Minsoo Choo 2026-08-24 23:35:27

sched: factor out hogticks calculation into sched_update_hogticks()

Suggested by: olce
Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59471

5a879394ba2eac14f65b466a46dae39326df00db Minsoo Choo 2026-09-06 22:49:02

sched: rename sched_schedcpu() to sched_sysinit()

sched_schedcpu() is called only during SYSINIT to start kthread that
calls schedcpu() every second in 4BSD, but its name implies it's doing
what 4BSD's schedcpu() does. Rename this function to sched_sysinit() to
mark that schedulers can use it for its own SYSINIT routine. Note that
their SYSINIT routine does not necessarily need to be similar to 4BSD's
decay in schedcpu().

The scheduler.9 man page is planned to be rewritten from scratch, so no
change to it for now.

Reviewed by:    olce
Approved by:    olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59437

962125aef24b55b4bb8808dcab335abc4b3f0d4e Minsoo Choo 2026-09-05 01:02:07

locks: provide a macro to extract lock_object from various lock types

To be used in _Generic() KPIs that accept different lock types.

Reviewed by:            kib
Differential Revision:  https://reviews.freebsd.org/D59455

0e7c7cfd11275ac70e1f9ba10ced67a286c89bef Gleb Smirnoff 2026-09-18 21:13:27

callout: provide callout_init_lock()

This is type agnostic locked callout initializer.  The callout_init_mtx()
and etc remain for compatibility.

Reviewed by:            kib, markj
Differential Revision:  https://reviews.freebsd.org/D59456

11d26e3c7e8e6261190c4475520f5330619d974a Gleb Smirnoff 2026-09-18 21:15:12

buf_ring: support different lock classes

And enable locking assertions for INVARIANTS kernel.

Reviewed by:            gallatin, kib, markj
Differential Revision:  https://reviews.freebsd.org/D59457

3b498d515faf2221798a64dc15ec0ff1f371de5d Gleb Smirnoff 2026-09-18 21:18:16

buf_ring: use counter(9) for drops

If a buffer ring experiences drops, then system is definitely starving in
CPU resources.  Having an extra cache miss on a racy shared variable
increment doesn't help.

Reviewed by:            gallatin
Differential Revision:  https://reviews.freebsd.org/D59495

8a37f8c325b65abd889b31b394bebaca7ad42026 Gleb Smirnoff 2026-09-18 21:53:39

clnt_bck.c: Fix the "glue" for the nfsrdma.ko module

Without this patch, the code failed to acquire the error
return for clnt_bck_rdma_send() and could use "error" uninitialized.

No semantics change for non-RDMA NFS service.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=7144a1d58c5c ("nfsd: Add glue for the nfsrdma.ko module")

ef98d080404f8dacb0a96799f92df6285fbc895c Rick Macklem 2026-09-19 00:39:27

clntrdma.h: Add a field to rpcrdma_xprt

Add a maxsegs field to rpcrdma_xprt, which is used to set
the number of segments allowed for a chunk based on device
attributes.

This commit should not affect non-RDMA behaviour.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

b87b15d43ea3732c5c67ac0b8c342b88d6398168 Rick Macklem 2026-09-19 00:44:11

Fix statement with no effect in linuxkpi's xarray.h

When compiling the kernel with gcc 14, errors similar to the following
are emitted:

  sys/dev/cxgbe/iw_cxgbe/ev.c: In function 'c4iw_ev_handler':
  sys/compat/linuxkpi/common/include/linux/xarray.h:132:23: error: statement with no effect [-Werror=unused-value]
    132 |                 flags == 0; \
  sys/dev/cxgbe/iw_cxgbe/ev.c:274:17: note: in expansion of macro 'xa_unlock_irqrestore'
    274 |                 xa_unlock_irqrestore(&dev->cqs, flag);
        |                 ^~~~~~~~~~~~~~~~~~~~
  sys/compat/linuxkpi/common/include/linux/xarray.h:132:23: error: statement with no effect [-Werror=unused-value]
    132 |                 flags == 0; \
  sys/dev/cxgbe/iw_cxgbe/ev.c:283:17: note: in expansion of macro 'xa_unlock_irqrestore'
    283 |                 xa_unlock_irqrestore(&dev->cqs, flag);
        |                 ^~~~~~~~~~~~~~~~~~~~

It looks like the intent of the "flags == 0" statement was to make the
'flags' macro argument not unused, but it still results in a warning.
Use the construct "(void)flags" instead.

Reviewed by:    bz
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D59787

aca53fc2a6879f45dcbe1a60f91f14a5f6d48448 Dimitry Andric 2026-09-18 07:07:46

Contrib code

MFV: xz 5.8.4.

MFC after:    3 days

7ffc4ec4860d01414b493cdf43738878a9ede538 Xin LI 2026-09-14 01:08:22

hyperv: Bound IPv4 address removal when configuring VF failover

The VF-up script repeatedly deletes the first IPv4 address from hn until
ifconfig fails.  Netlink-based ifconfig returns success when no address
remains, so the script can loop forever and block subsequent devd work.

Use ipv4_down() from the already-sourced network.subr to enumerate the
addresses and delete each explicitly.  This also handles multiple
addresses without relying on the exit status of an empty deletion.  The
behavior depends on ifconfig, not the VF hardware, so no device-specific
fallback is needed.

Fixes:  https://cgit.freebsd.org/src/commit/?id=c68595695679 ("hyperv: Add VF bringup scripts and devd rules.")
MFC after:      2 weeks
Sponsored by:   BBOX.io

90f7956ff61f537def0d0aeb6ee03605a671d57e Kevin Bowling 2026-09-15 01:07:27

hyperv: Configure IPv6 when setting up VF failover

The default VF-up script moves IPv4 configuration from the synthetic
interface to a failover lagg, but leaves IPv6 unconfigured on the lagg.
Adding the synthetic interface as a member can remove its IPv6 addresses,
so deleting the remaining member addresses is not sufficient.

Stop accepting router advertisements on the synthetic interface before
adding it to the lagg.  Leave its link-local address and IPv6 enable state
in place for lagg's address, prefix and default-router cleanup, then disable
IPv6 and explicitly remove any remaining addresses.  This also covers
members without a link-local address or with IPv6 already disabled.

Replay the synthetic interface's IPv6 rc.conf configuration on the lagg,
including aliases, prefix-derived addresses and legacy configuration names.
Remap the variables in a subshell and reuse network.subr's IPv6 helpers.
For SLAAC, solicit fresh router advertisements rather than copying learned
addresses as permanent ones.  Configure IPv6 independently of the IPv4
DHCP/static choice, and leave existing laggs alone on repeated invocation.
Custom DHCPv6 clients and interface-scoped static routes still require the
per-interface setup hook.

Fixes: https://cgit.freebsd.org/src/commit/?id=c68595695679 ("hyperv: Add VF bringup scripts and devd rules.")
MFC after:      2 weeks
Sponsored by:   BBOX.io

b5519c449337fea1d5cbaf2f0ba11cafa36338ee Kevin Bowling 2026-09-15 01:48:25

libcxgb4: Support for RDMA SEND_WITH_INV requests

Sponsored by: Chelsio Communications

054db357a1a5282f205cd0d1827fb4cd19833d55 Potnuri Bharat Teja 2018-11-16 10:17:52

libcxgb4: Support send/recv drain work requests

This change allows libcxgb4 to post send/recv drain work requests
after a QP is flushed and schedules a CQE on the software CQ for the
application to note the drain's completion.

Sponsored by:   Chelsio Communications

6262cbed3c37aff6ee9ff4dad7b14147bb40ac7e Potnuri Bharat Teja 2018-12-17 18:09:41

libcxgb4: remove update_qp_state()

Remove it because it is not needed. If we're flushing the qp, it is
because we've had a fatal error, so just set the user qp state to ERR
and continue on.

Sponsored by:   Chelsio Communications

e03c2c0f6c1a90e2d0797ad433c0269a0a775c52 Steve Wise 2019-02-05 17:19:17

libmlx5: Extend mlx5dv_get_qp() to return UAR mapping info

[PATCH 02/31] FreeBSD OFED support for DPDK MLX5 PMD

Extend mlx5dv_get_qp() to return UAR mapping info. This can allow a
process to share its doorbell access with secondary process by re-mmap
the UAR address on the device and make it accessible as a user space
address.

Differential revision:  https://reviews.freebsd.org/D32176
MFC after:      1 month

112ca55eefe8462c86f7507bff52ae4eb6488c71 Vag Singh 2025-08-12 01:30:33

fixup! libmlx5: Extend mlx5dv_get_qp() to return UAR mapping info

Import rdma-core upstream commit d2389b34ccc5 ("mlx5: Add missing include
file in mlx5dv.h").

Including <sys/types.h> keeps mlx5dv.h self-contained: off_t, used by the
new uar_mmap_offset field, is now always defined.  The man page gains the
uar_mmap_offset line upstream documents in 5dd3ead7b5f5.

Sponsored by:   NVidia networking
MFC after:      1 month

a5a3daf88af5e4d30952a7fc8b4d27d83458f484 Ariel Ehrenberg 2026-07-28 12:02:36

verbs/mlx5: Annotate ibv_wc and ibv_send_wr with endian

PATCH 16/31] FreeBSD OFED support for DPDK MLX5 PMD

a) verbs: Annotate ibv_wc helpers with endian
This follows the scheme as used in the wc by introducing a
ibv_wc_read_invalidated_rkey to access the host endian
invalidated_rkey value with proper annotations.
This is just an inline wrapper to allow sparse to work sensibly,
not really a good reason to add another driver entry point.

b) verbs: Annotate ibv_send_wr with endian
This follows the scheme as used in the wc by introducing a
transparent union in ibv_send_wr to indicate the invalidate_rkey
is in host endian.

c) mlx5: Add sparse annotations.

Differential revision:  https://reviews.freebsd.org/D32190
MFC after:      1 month

99d683a32f5122465215e47479b9bedab0b0db8b Vag Singh 2025-08-14 06:31:33

fixup! verbs/mlx5: Annotate ibv_wc and ibv_send_wr with endian

Fix is based on upstream rdma-core commit 14a0fc824f16 ("rdma-core/irdma:
Implement device supported verb APIs").

Use ib_wr->invalidate_rkey instead of ib_wr->imm_data for
IBV_WR_SEND_WITH_INV and IBV_WR_LOCAL_INV.  The two share a union, but
imm_data is __be32 while the rkey to invalidate is host order, so with the
new endian annotations this path reads the wrong member.  Upstream irdma
has always used invalidate_rkey here.

Sponsored by:   NVidia networking
MFC after:      1 month

4aed4f191c4953d4704973432fea93514a37fa45 Ariel Ehrenberg 2026-07-28 12:02:45

libmlx5: Fix ABI break from revising the UAR pointer

[PATCH 18/31] FreeBSD OFED support for DPDK MLX5 PMD

Provide two implementations of mlx5dv_init_obj, one that has the
historical behaviour that has existed until now of returning the
void **uar and a new version that returns the 'void *' version
renamed to cq_uar.

Differential revision:  https://reviews.freebsd.org/D32192
MFC after:      1 month

06690c34624c37998283ad87e24f50c97105ebbd Vag Singh 2025-08-14 06:36:45

fixup! libmlx5: Fix ABI break from revising the UAR pointer

Actually provide the two ABI versions this commit describes: export
mlx5dv_init_obj@@MLX5_1.2 with the current behaviour and a compat
mlx5dv_init_obj@MLX5_1.0 that restores the historical 'void **' value, and
list the symbol under both versions in libmlx5.map.  Binaries linked
against the old version keep resolving.

Sponsored by:   NVidia networking
MFC after:      1 month

43767135124c9f4c2c0308aaa787135c699a8370 Ariel Ehrenberg 2026-07-28 10:39:02

libmlx5: External memory binding for HW resources

[PATCH 19/31] FreeBSD OFED support for DPDK MLX5 PMD

Add a new DV API mlx5dv_set_context_attr() to enable setting an external
memory allocator. This API will allow the application to use specific
decisions about the memory allocation of HW resources (e.g. DV objects).
Some examples are managing numa pinning per object, managing a
hugepages resource pool, shared memory regions.

Also extend mlx5dv_get_qp() to return UAR mapping info. This can allow a
process to share its doorbell access with secondary process by re-mmap
the UAR address on the device and make it accessible as a user space
address.

Differential revision:  https://reviews.freebsd.org/D32193
MFC after:      1 month

9bec868253c26055b58448db9ea8157f6d251079 Vag Singh 2025-08-14 06:40:16

fixup! libmlx5: External memory binding for HW resources

Match a doorbell to its page with a range check instead of a page-boundary
mask, so mlx5_free_db() also works for external allocations that are not
page aligned and no longer leaks the doorbell page.

Sponsored by:   NVidia networking
MFC after:      1 month

a2fb16e3c7881556b84de969f423420ca7c1177a Ariel Ehrenberg 2026-07-28 10:39:04

libmlx5: Report if kernel allows using MPW in SQ

PATCH 20/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Use flag MLX5DV_CONTEXT_FLAGS_MPW_ALLOWED to indicate hardware
supports multi packet WQE and it's enabled in SQ context.
Flag MLX5DV_CONTEXT_FLAGS_MPW is deprecated, shall not be used
in new applications.

b) Report if enhanced multi packet send WQE is supported through mlx5
direct verbs.

Differential revision:  https://reviews.freebsd.org/D32194
MFC after:      1 month

0d63d42ad70dd5f6e5acd8eac466c8e9fe584204 Vag Singh 2025-08-14 06:43:08

fixup! libmlx5: Report if kernel allows using MPW in SQ

Interpret the kernel's raw multi_pkt_send_wqe value (0, 1 or 3) instead of
masking it against a bitmask the kernel never emits, which silently
disabled MPW.

Sponsored by:   NVidia networking
MFC after:      1 month

e4bdc092db2f318a80772a7f18d3055dd5170a88 Ariel Ehrenberg 2026-07-28 10:39:05

verbs/mlx5: Expose tag matching capabilities

[PATCH 23/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Expose tag matching capabilities and show them in ibv_devinfo.

b) verbs: Introduce tag matching SRQ
Introducing tag matching SRQ (TM-SRQ), which retains basic semantic of
regular SRQ, reports completions to own CQ, and has additional tag
based message receiving mechanism.
Detailed description for the TM-SRQ usage was added into
Documentation/tag_matching.md

c) mlx5: Add support to tag matching SRQ type
Create command QP for a tag-matching SRQ. Command QP used for
inserting/removing entries from the tag matching list. This command QP
is hidden from the users in the mlx5_srq structure.
New verb ibv_post_srq_ops() will be added in next patch to use it.

Differential revision:  https://reviews.freebsd.org/D32198
MFC after:      1 month

4601cb62953866e94bac791b5baf10125507038c Vag Singh 2025-08-14 06:49:20

fixup! verbs/mlx5: Expose tag matching capabilities

Reject TM-SRQ creation when tm_cap.max_ops is 0, so the internal command
QP's send queue is not sized to zero work-queue entries.

Sponsored by:   NVidia networking
MFC after:      1 month

3c4338089e3893d340e7c9bd08f03c2b1ac86f5b Ariel Ehrenberg 2026-07-28 10:39:08

libmlx5: Report SW parsing capabilities through mlx5 direct verbs

[PATCH 24/31] FreeBSD OFED support for DPDK MLX5 PMD

Software parsing (SWP) is a feature that can be used to instruct the
device to stop using its internal parser and to parse packets on the
transmit path according to offsets set for each packet.

Through this feature, the device allows the handling of checksum and LSO
by the hardware according to the location of IP and TCP/UDP headers.

Report various SW parsing capabilities and supported QP types through
mlx5 direct verbs interface.

Differential revision:  https://reviews.freebsd.org/D32199
MFC after:      1 month

5189261cd0ec0ddfc1fc684b4d8d27e7a6048115 Vag Singh 2025-08-14 06:51:22

libmlx5: Report Multi-Packet RQ capabilities through mlx5 direct verbs

[PATCH 26/31] FreeBSD OFED support for DPDK MLX5 PMD

A Multi-Packet RQ is a receive queue where multiple packets are
written to the same WQE. Each message starts in the beginning of a
stride. The total size of the scatter elements of each WQE is
determined upon RQ creation and all the posted WQEs should meet the
determined size.

A Multi-Packet RQ reduces the number of needed post-recv operations
thus increasing performance.

It reduces memory footprint by allowing each packet to consume a
different number of strides instead of the whole WR.

Differential revision:  https://reviews.freebsd.org/D32201
MFC after:      1 month

35763e9689a19d0febe7a4b13b1e5b15c62a5b02 Vag Singh 2025-08-14 06:54:32

verbs/mlx5: Allow creation of a Multi-Packet RQ using direct verbs

[PATCH 27/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Add needed definitions to allow creation of a Multi-Packet RQ
using the mlx5 direct verbs interface.

In order to create a Multi-Packet RQ, one needs to provide a
mlx5dv_wq_init_attr containing the following information in its
striding_rq_attrs struct:
- single_stride_log_num_of_bytes: log of size of each stride
- single_wqe_log_num_of_strides: log of number of strides per WQE
- two_byte_shift_en: When enabled, hardware pads 2 bytes of zeros
before writing the message to memory (e.g. for IP alignment).

b) Add a helper function to verify 64 bit comp mask
The common check for a mask is as follows:
if (comp_mask & ~COMP_MASK_SUPPORTED_VALUES)
      return EINVAL;

This can cause an issue when using 64 bit mask if the supported variable
is signed 32 bit: It will be bitwise inverted and then zeroed to 64
bits. Hence, wrong bits in the mask that exceed 32 bits will not raise
an error but would be ignored.

To fix this, a helper function is added in driver.h to be used by providers
code and fix wrong mask checks where the above was found to be applicable.

Differential revision:  https://reviews.freebsd.org/D32202
MFC after:      1 month

2b42072b237ea3d72befe2183e64c933dd9ae399 Vag Singh 2025-08-14 06:56:00

verbs/mlxs: mlx5: Add tunnel offloads support in direct verbs

[PATCH 28/31] FreeBSD OFED support for DPDK MLX5 PMD

a) In order to enable offloading such as checksum and LRO for incoming
tunneling traffic, the QP should be created with tunnel offloads flag -
MLX5DV_QP_CREATE_TUNNEL_OFFLOAD.

b) Reports capability of which tunneling type supports
the tunneling offloads.

c) verbs: Add support in RSS of the inner packet
Some user space application would like to do RSS on the inner packet
fields instead of the outer. When user will set the IBV_RX_HASH_INNER
bit with one of the other hash fields, then the RSS will be on the inner
packet.

Differential revision:  https://reviews.freebsd.org/D32203
MFC after:      1 month

4b32c67bbfdbbd8ae557f18324a7c115668ca01a Vag Singh 2025-08-14 07:02:06

fixup! verbs/mlxs: mlx5: Add tunnel offloads support in direct verbs

Fix is based on upstream rdma-core commit ee54f9d5348f ("mlx5: Add
loopback flags to QP creation").

Validate create_flags against a supported-flags mask instead of rejecting
anything that is not MLX5DV_QP_CREATE_TUNNEL_OFFLOADS.  A create_flags of
0 is now accepted, unknown bits are rejected, and the vendor flag is OR-ed
in rather than assigned.  The loopback flags that commit also adds do not
exist in this tree, so only the validation is taken.

Sponsored by:   NVidia networking
MFC after:      1 month

a2703fef5cbe66be3bff971bcbdd9d328b3029ef Ariel Ehrenberg 2026-07-28 12:02:54

verbs/mlx5: Add GRE and MPLS flow specification filter

[PATCH 30/31] FreeBSD OFED support for DPDK MLX5 PMD

a) Allow verbs applications packet steering of GRE tunneled traffic.
Adding GRE flow specification based on RFC 2890.
GRE consists of flags, protocol and key fields.
IPv4 protocol 47 (IPPROTO_GRE) can be used when GRE packets are
encapsulated in IPv4.

b) verbs: Add MPLS flow specification filter
Add MPLS flow specification based on RFC 3032.
MPLS spec defined with label field which includes the
label value and additional parameters such as: BoS, TC and TTL.
MPLS allows stacking multiple labels in sequence.
In addition, the MPLS header can be encapsulated on top of different
layers, e.g.: ETH, IP (rfc4023), UDP (rfc7510), GRE (rfc4023).

Therefore, when using the flow creation verb, the application should
organize the spec filters list in the command in an ordered manner, such
that reflects the actual protocol stack of the packet, to determine the
exact position of the MPLS headers in the protocol stack.

c) mlx5: Report MPLS tunnel offload capabilities through mlx5 direct
verbs
This patch exposes the mlx5 device's capability to offload MPLS based
tunnel protocols via DV API.
The possible protocols are:
- Control word + MPLS over GRE.
- Control word + MPLS over UDP.

Differential revision:  https://reviews.freebsd.org/D32205
MFC after:      1 month

644f8990e2c2203de649b80c82a2a56bacbd98a9 Vag Singh 2025-08-14 07:06:01

fixup! verbs/mlx5: Add GRE and MPLS flow specification filter

Import rdma-core upstream commit ff01da2c5ac2 ("verbs: Fix typo in copying
IBV_FLOW_SPEC_UDP/TCP 'val'").

The TCP/UDP filter value was copied using the size of the IPv4 filter,
overrunning the destination subobject.

Also accept inner MPLS flow specs, matching 6d6f29721eea ("verbs: Allow
creation of inner MPLS flow spec").  Upstream deliberately has no inner
case for GRE - it is a tunnel header, matched only in the outer stack - so
that part of the review comment is not applied.

Sponsored by:   NVidia networking
MFC after:      1 month

6ff2d2d5d47e53028bbfb48150c32cb0d128e58f Ariel Ehrenberg 2026-07-28 12:02:56

unbound: Update to 1.26.1

Release notes at
    https://community.nlnetlabs.nl/t/unbound-1-26-1-released

Merge commit '120aa088f4807126af42a652a07c5090e7294fcf'

Security:       CVE-2026-77860
Security:       CVE-2026-77955
Security:       CVE-2026-78227
Security:       CVE-2026-80225
Security:       CVE-2026-81634
Security:       CVE-2026-81642
Security:       CVE-2026-82717
Security:       CVE-2026-82720
Security:       CVE-2026-85501

1fb9c5ffe25fcba0857c4fdf6ed19ca5bf6bc858 Dag-Erling Smørgrav 2026-09-16 14:22:09

Merge commit 1f332ae4f1b3 from llvm-project (by Alexander Kornienko):

  Fix -Wformat diagnostic after #190965 (#193704)

  Fixes libunwind compiler diagnostic when building with clang after
  034d4dcad6396d1241e8262e69871b8d61da7e4f:
  ```
  In file included from libunwind/src/libunwind.cpp:31:
  In file included from libunwind/src/UnwindCursor.hpp:52:
  libunwind/src/CompactUnwinder.hpp:339:46: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
    338 |                            "function starting at 0x%llX",
        |                                                    ~~~~
        |                                                    %lX
    339 |                             compactEncoding, functionStart);
        |                                              ^~~~~~~~~~~~~
  libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
    215 |   #define _LIBUNWIND_DEBUG_LOG(msg, ...)  _LIBUNWIND_LOG(msg, __VA_ARGS__)
        |                                                          ~~~  ^~~~~~~~~~~
  libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
    181 |     fprintf(stderr, "libunwind: " msg "\n", __VA_ARGS__);                      \
        |                                   ~~~       ^~~~~~~~~~~
  In file included from libunwind/src/libunwind.cpp:31:
  In file included from libunwind/src/UnwindCursor.hpp:52:
  libunwind/src/CompactUnwinder.hpp:458:39: error: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Werror,-Wformat]
    457 |                            "function starting at 0x%llX",
        |                                                    ~~~~
        |                                                    %lX
    458 |                             encoding, functionStart);
        |                                       ^~~~~~~~~~~~~
  libunwind/src/config.h:215:63: note: expanded from macro '_LIBUNWIND_DEBUG_LOG'
    215 |   #define _LIBUNWIND_DEBUG_LOG(msg, ...)  _LIBUNWIND_LOG(msg, __VA_ARGS__)
        |                                                          ~~~  ^~~~~~~~~~~
  libunwind/src/config.h:181:45: note: expanded from macro '_LIBUNWIND_LOG'
    181 |     fprintf(stderr, "libunwind: " msg "\n", __VA_ARGS__);                      \
        |                                   ~~~       ^~~~~~~~~~~
  ```

This avoids a -Werror failure with clang >= 23.

MFC after:      3 days

8a8c14464dd372495c9bf4b87c9b88d73f78d587 Dimitry Andric 2026-09-17 19:32:45

MFV: less v710.

MFC after:    1 week

4523eebc6c1828d4fd41d7f1ab943cf079043bc8 Xin LI 2026-09-19 18:20:29

(4)		Highlighted commits (these are copies, not in stats)
5	1.5%	Userland programs
11	3.4%	Documentation
158	48.5%	Hardware support
20	6.1%	Networking
17	5.2%	System administration
5	1.5%	Libraries
2	0.6%	Filesystems
61	18.7%	Kernel
8	2.5%	Build system
4	1.2%	Internal organizational stuff
1	0.3%	Testing
3	0.9%	Style, typos, and comments
28	8.6%	Contrib code
3	0.9%	Reverted commits
0	0.0%	Unclassified commits
326	100%	total
		Technical notes about this page

FreeBSD git weekly: 2026-09-14 to 2026-09-20

Introduction

Highlighted commits Expand section Collapse section

Userland programs Expand section Collapse section

Documentation Expand section Collapse section

Hardware support Expand section Collapse section

Networking Expand section Collapse section

System administration Expand section Collapse section

Libraries Expand section Collapse section

Filesystems Expand section Collapse section

Kernel Expand section Collapse section

Build system Expand section Collapse section

Internal organizational stuff Expand section Collapse section

Testing Expand section Collapse section

Style, typos, and comments Expand section Collapse section

Contrib code Expand section Collapse section

Reverted commits Expand section Collapse section

Unclassified commits Expand section Collapse section

Technical notes

Highlighted commits

Userland programs

Documentation

Hardware support

Networking

System administration

Libraries

Filesystems

Kernel

Build system

Internal organizational stuff

Testing

Style, typos, and comments

Contrib code

Reverted commits

Unclassified commits