FreeBSD git weekly: 2026-09-21 to 2026-09-27

The Unicode closing single quotation mark is classified as a homoglyph
and can trip automated code quality checks in downstream CI pipelines or
cause code review UIs to refuse to display a file.  If used as an
apostrophe, use the ASCII single quote instead.  If used as a closing
single quote, replace with double quotes or no quotes at all.

Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    ziaee, obiwac, olce
Differential Revision:  https://reviews.freebsd.org/D59911

MFC after:    3 days
Approved by:    bnovkov (mentor)
Sponsored by:   fme AG
Differential Revision:  https://reviews.freebsd.org/D59927

Simplify the way we build paths.
Avoid decolonification of source paths.
Remove gnu directories and add non-tracked ones.

Fix a memory leak while here.

Approved by:            ngie@
Differential Revision:  https://reviews.freebsd.org/D59846

This driver is for NTT DoCoMo 3G cellular equiment, which afaict all
went offline six months ago. Tidy up the entry until we can remove it.

MFC after:      3 days

+ Update SYNOPSIS to the new standard format
+ Rename CONFIGURATION to the usual LOADER TUNABLES
+ Adjust tunable markup for inclusion in the search index
+ Editorial nit: Unwind a parenthetical

MFC after:      3 days

MFC after:    3 days

MFC after:    3 days

MFC after:    3 days

+ Update SYNOPSIS to the new standard format
+ Give this a clearer description in apropos
+ Give this a clearer description in hardware note
+ Spinoff SYSCTL VARIABLES from HARDWARE
+ Pet linter for long lines and trailing punctuation
+ Tag SPDX

MFC after:      3 days

MFC after:    3 days

MFC after:    3 days

Also add a missing Cd tag for consistency.

MFC after:      3 days

MFC after:    3 days

MFC after:    3 days

+ tag SPDX
+ improve apropos and hardware notes context
+ canonicalize SYNOPSIS

MFC after:      3 days

MFC after:    3 days

MFC after:    2 weeks
MFC with:       f6db138f97b7 ("src.opts.mk: force the Dtrace tests ...")

I added the text when this driver was merely an import of
https://github.com/Aquantia/aqtion-freebsd with patches from ports applied.
nprice@ resolved issues and added support for newer cards and the note is
no longer applicable.

Reviewed by:    adrian
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59909

Those are FreeBSD-specific member and flag still better to be
documented.

Reviewed by:    kib
Sponsored by:   Sippy Software, Inc.
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59915

Fixes:                https://cgit.freebsd.org/src/commit/?id=aba599a6cc55 ("zzz: Rewrite to use new power device")

While here, fix two trivial typos.

MFC after:      3 days

The standard list and status subcommands of every GEOM class emit
through libxo, and so does geom -p, but only geom.8 (list, status) and
gpart.8 (show) mentioned it.  Mark the list and status forms with
--libxo in all class manual pages, add the option description, and
cross-reference xo_options(7).  Also mark geom -p in geom.8.

Only forms whose output already goes through libxo are marked;
class-specific verbs such as gmirror dump still print directly and are
left alone.

Reviewed by:    adrian, bcr, carlavilla, des
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D59574

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

And replace inline assembly

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59482

arm64/smmu: Move smmu later

We need to wait for the interrupt drivers to attach before the smmu
driver. As both of these happened at BUS_PASS_INTERRUPT +
BUS_PASS_ORDER_MIDDLE there was no guarantee this would happen in the
correct order.

Fix by moving the smmu driver to BUS_PASS_ORDER_LATE.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59485

arm64/smmu: Start handling errata

Handle the Arm MMU-600 erratum 1076982 where when we poll for a sync
command completion we can't use the wait-for-event instruction.

This is in preparation for later adding support for polling for sync
command completion and is not an issue on stable branches.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59486

arm64/smmu: Split out waiting for sync completion

In preparation for adding a non-MSI method split out waiting for sync
completions from smmu_sync.

While here fix the loop to wait for sync timeout to the worst case
Linux uses.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59487

arm64/smmu: Support polling for sync completion

When the hardware doesn't support MSIs we need to poll to wait for
sync operations to complete. Add support for this to support booting
on this hardware.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59488

arm64/smmu: Only MSI poll when cache-coherent

Only use the MSI polling method when we support MSIs and the SMMU is
cache-coherent.

The SMMU writes to a memory location. If it is not cache-coherent then
the CPU may read the existing value in its cache and miss the signal
the sync operation has completed.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D59489

arm64/smmu: Fix the SMMU-600 errata check

Fixes:  https://cgit.freebsd.org/src/commit/?id=6dca6e2aa89d ("arm64/smmu: Start handling errata")
Sponsored by:   Arm Ltd

vmm: Normalize a zero PIT count before starting channel 0

pit_timer_start_cntr0() does not schedule a callout when the initial
count is zero.  The counter write handler normalizes a programmed zero
count only after calling it, leaving an initially unarmed channel 0
without a scheduled timer event.

Move the existing normalization before the timer-start call.  Retain the
historical 0xffff representation of a zero count.

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59749

vmm: Synchronize long-mode state when emulating CR0 writes

vmx_emulate_cr0_access() sets EFER.LMA and the IA-32e guest VM-entry
control when enabling paging with EFER.LME set, but does not clear them
when disabling paging.  This can leave an inconsistent guest state that
fails VM entry.

Update both fields in either direction based on EFER.LME and the CR0
value written to the VMCS.  Use the mask-adjusted CR0 value so the
resulting state remains consistent with the VMX fixed-bit requirements.

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59756

vmm: Fix a page wiring leak in MOVS emulation

When emulating a MOVS from MMIO to guest RAM, the kernel's
vm_copy_setup() wires the destination pages.  If the subsequent
MMIO read fails, emulate_movs() skips vm_copy_teardown(), leaking
the page wire references acquired during setup.

Run vm_copy_teardown() regardless of the MMIO read result, and
only copy the value to guest memory if the read succeeds.
Preserve the existing error return.

This matches illumos change 13309.

Reviewed by:    markj
Obtained from:  illumos 83cd75bb2949d26e6eb38ddefc60fdeed1909643
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59823

vmm: Re-arm the PIT callout for square wave mode

The 8254's square wave mode (mode 3) is periodic, with the same
interrupt rate as the rate generator mode (mode 2), but
vatpit_callout_handler() only re-arms the channel 0 callout for
TIMER_RATEGEN.  A guest that programs mode 3 therefore receives a
single IRQ0 and no further timer interrupts.

Re-arm the callout for TIMER_SQWAVE as well, matching illumos
change 13301.

Reviewed by:    markj
Obtained from:  illumos 93d78aba5b32996fc2ae893a6237a0d3972f86b2
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59816

Also explicitly specify .cfi_sections to emit the cfi bytecode into the
loadable .eh_frame section.

Reviewed by:    mchoo
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59838

Reduce very common console messages:
        Receive error rdes3=30208000

As observed on the VisionFive v2 hardware after some large transfers.

Differentiate between overflow errors and others. Report the errors when
the length is non-zero (overflow errors).

Also, count errors for netstat purposes.

Reviewed by:    mhorne
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59479

It is functional, and there are some RISC-V platforms which can benefit
from it.

Requested by:   Brian Scott <bscott@bunyatech.com.au>
Sponsored by:   The FreeBSD Foundation

AMD_NPMCS_MAX = 342 (16 core + 6 L3 + 64 DF + 256 UMC). On a Zen 4
EPYC 9654 with 6 core, 6 L3, 16 DF, and 4 UMC counters, only 32
descriptors are needed; the static arrays over-allocate by ~10x.

Replace both amd_pmcdesc[AMD_NPMCS_MAX] and per-CPU pc_amdpmcs[AMD_NPMCS_MAX]
with mallocarray() sized to the actual registered PMC count:
  - amd_pmcdesc: allocated in pmc_amd_initialize()
  - pc_amdpmcs:  allocated per-CPU in amd_pcpu_init(), freed in fini()

Normalize amd_l3_npmcs and amd_df_npmcs against the AMDID2_PTSCEL2I
and AMDID2_PNXC feature bits before computing npmcs_total, so that
allocation, registration, and amd_get_msr() row offsets are all derived
from the same values.  Previously the ternary in npmcs_total excluded
L3/DF from the allocation while the globals retained their defaults,
causing amd_get_msr() to miscompute DF row offsets when L3 is absent.

amd_umc_npmcs comes from CPUID Fn8000_0022h EBX[23:16] (NumUMCCounters)
and is zero when the leaf is absent, so no additional feature flag is
needed.  See AMD64 APM Vol.3 Appendix E.

Fix three error-path memory leaks: amd_hwcheck() failure, goto error,
and finalize.  Reset amd_npmcs = 0 on the error path.

Tested on AMD EPYC 9654 (Zen 4, Family 19h Model 11h, 192 threads).
Full PMC test suite (IBS/UMCDF/PMC/L3/DF/TSC): 0 failures.

Signed-off-by: Osvaldo Janeri Filho <ojanerif@amd.com>
Reviewed by:    mhorne
MFC after:      1 week
Sponsored by:   AMD
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2415

s2_tlbi_range under VHE is supposed to clear HCR_EL2.TGE, but it erroneously
clears an unrelated bit 27 in TCR_EL2 (HWU61). Since HCR_TGE determines which
translation regime will be used by a tlbi, the instruction targets the
wrong regime when it is not cleared.

Fix the register accessed by the function to actually clear HCR_EL2.TGE.

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://github.com/freebsd/freebsd-src/pull/2435

This patch adds a driver for the CPU temperature sensor on the jh7110
SoC.

The calibration numbers come from the OpenBSD driver but are reworked to
produce a result in K rather than C.

The temperature is exposed as a sysctl, dev.jh7110_temp.0.temperature
but I have also exposed it as dev.cpu.0.temperature because that's where
you find it on a RaspberryPi and amdtemp(4), so it's a lot more obvious.

(mhorne: Added 'starfive,jh7100-temp' compatible.)

Reviewed by:    mhorne, bnovkov
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59478

pmc_ibs_initialize() allocates the ibs_pcpu[] pointer array, and
pmc_ibs_finalize() exists to free it, but pmc_ibs_finalize() is
never called.  Every hwpmc unload on a CPU with IBS therefore leaks
one pmc_cpu_max()-sized pointer array.

Call pmc_ibs_finalize() from pmc_amd_finalize(), alongside the RAPL,
TSC and perf classes.  IBS is only initialized on CPUs that support
it, so make pmc_ibs_finalize() return early when ibs_pcpu is NULL,
making it safe to call when the class was skipped at initialize
time, as pmc_rapl_finalize() already is.

Tested on an AMD Ryzen 5 5600X (Zen 3, 12 threads) with INVARIANTS.
Before the change, each kldload/kldunload cycle leaked one 96-byte
M_PMC allocation, and DTrace showed the ibs_pcpu[] allocation from
pmc_ibs_initialize() as the only one never freed.  After the change,
50 load/unload cycles leave M_PMC InUse and MemUse unchanged, and
every allocation made at load is freed at unload.

Reviewed by:    mhorne
Fixes:          https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Sponsored by:   NLINK (https://nlink.com.br), Recife, Brazil
Differential Revision:  https://reviews.freebsd.org/D59881

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: add md thread flags word

Use a hole in struct mdthread.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: handle #AC in kernel mode

Recover from it if PCB_ONFAULT handler is provided.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: calculate if hardware supports disabling splitlocks

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: support for tracking per-thread 'disable splitlocks' state

If hw supports it, on atomic operation that requires exclusive ownership
of more than one cache line, #AC is generated.
The state is maintained as the arch-private TDF_MD_SPLITLOCK_AC flag.

The state is inherited on thread creation from the thread spawning the
new one.  It is cleared on exec.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: add userspace control for disabling splitlocks

Thread can control it with sysarch(I386_SET_SPLITLOCK). The global
default is set with hw.splitlock_force.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: cache MSR_MEMORY_CTL in pcpu

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

amd64: use WRMSRNS immediate form to update splitlock control, when available

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59815

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

They exist only to fill in MODULE_DEPEND() and MODULE_VERSION(), and
every consumer passed the same value for all three, so the version
range never did anything. Use 1, like the rest of the tree does.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Reviewed by:    kib, emaste
Differential Revision:  https://reviews.freebsd.org/D59873

mmu_radix_sync_icache() adds the offset of va within its page to the
physical address it gets from mmu_radix_extract_locked().  That address
already includes the offset - the extract routines return the physical
address of the byte, not of the frame - so the offset is counted twice
and __syncicache() is handed frame + 2 * offset.

The hash MMU counterpart, moea64_sync_icache(), has to add the offset
because PVO_PADDR() yields only the frame.  Here the addition is wrong.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6f0b2a235a13 ("powerpc/pmap: Add pmap_sync_icache() for radix pmap")
Reviewed by:    jhibbits
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59870

Turns out that ever since introducing ELFv2 support, it was missing
ASLR, it was only used for ELFv1 processes.

Reviewed by:    jhibbits (via IRC #powerpc64)
MFC after:      1 week

The single-vector MSI-X fallback installs the shared interrupt
handler, which masks interrupts through INTMS/INTMC around the
completion poll.
INTx and MSI are unaffected. Only MSI-X track the interrupt mode
and skip un/masking

Reviewed by:    ngie, imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59637

The Get Log Page request for the error log is clamped to
NVME_MAX_AER_LOG_SIZE, but the byte-swap loop iterated ELPE + 1
entries. A controller reporting more than 63 entries makes the loop
overrun the 4 KiB log page buffer.

Reviewed by:    ngie, imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59626

This fixes a bug where a binary linked using max-page-size=0x200000
can result in a bogus relocation offset when running on a system
with a smaller page size.  This causes samples  to fall outside
the image mapping or be translated to the wrong address (resulting
in symbol resolution, or incorrect symbol resolution).  We noticed
this at Netflix because we run a patchset enabling 16k pages on
amd64 and have been compiling userspace with a 2MB page size.
Since we started doing this profiling userspace binaries has been
wonky.

Reviewed by: ali_mashtizadeh.com
Differential Revision: https://reviews.freebsd.org/D59771
Sponsored by: Netflix

This driver was removed several years ago.

Fixes:          https://cgit.freebsd.org/src/commit/?id=c1c9764296e5 ("Remove the si(4) driver and sicontrol(8) for Specialix serial cards.")

Fixes:                https://cgit.freebsd.org/src/commit/?id=7a323f873662 ("sys: Retire le(4)")

CC.CSS was always writting zero, which is a reserved encoding on a
controller that does not support the NVM command set.
Select 111b on admin-only controllers and 110b when the
I/O command set mechanism is available.

Reviewed by:    ngie, imp, adrian
Differential Revision:  https://reviews.freebsd.org/D59628

The receive queue of a PAPR logical LAN is filled in by the hypervisor, so
its fields are big endian, but llan_intr() read the offset and the length of
each frame natively.  On a little endian kernel the length of a 134 byte
frame reads as 0x86000000, and ether_input() discards the mbuf because m_len
is not even large enough for an ethernet header.  No frame is ever received.

Reproduced on a POWER9 pseries guest with a spapr-vlan interface.  Before:

  llan0: discard frame w/o leading ethernet header (len -2046820352
      pkt len -2046820352)
  llan0 1500 <Link#1> 52:54:00:12:34:56  123  118  0  5838733312  7  0

that is 118 input errors out of 123 packets, dhclient(8) never completes and
ping(8) loses every packet, although transmit works because the transmit
path passes the lengths in hcall registers rather than through memory.
Afterwards the interface gets a DHCP lease and ping reports no loss.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59926
Approved by:    jhibbits

Atlantic controllers can retain receive descriptors and their data
addresses after their rings are disabled. Reusing or releasing those
mappings without invalidating the device cache has caused observed
IOMMU and SMMU faults in the referenced Linux reports (7a1bb49461b1,
ed4d81c4b3f2 and 7526183cfdbe).

Move global cache invalidation out of the per-ring stop routine. Disable
every ring first, toggle invalidation once, and wait for its completion
indication. Exclude Atlantic A0, as in the upstream workaround. Report
a completion timeout rather than silently discarding it.

Reviewed by:    nprice
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59852

Stop initialization when hardware setup, ring initialization/start, or
datapath start fails. Run the existing best-effort stop/cache/reset
cleanup and report the failure through iflib_init_failed(). Do not keep
configuring later rings or publish the interface as running.

Reviewed by:    nprice
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59853

Fixes:          https://cgit.freebsd.org/src/commit/?id=1f38677ba40b ("x86 NOTES: Move shared options from amd/i386 NOTES to x86 NOTES")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60011

The int_coal_time and int_coal_threshold handlers differed only in which
controller field they updated before reprogramming the feature.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60018

The routine is entered with the namespace lock held and drops it before
completing the requests, which preserves the existing locking.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60019

A single handler that takes the counter's offset
within struct nvme_qpair in arg2.

No functional change

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60020

Reviewed by:  imp, adrian
Differential Revision:  https://reviews.freebsd.org/D60021

Catch up with 8452afeb568: now dev.hwpstate_intel.%d.epp accepts
values from 0 to 255.  Update its description accordingly to sync
with the code and the man page.

If userspace provides rate == 0, it causes kernel panic as rate is
directly used as a divident, which cannot be zero. Fix it by set the
rate to 1 if it is passed as 0.

Reviewed by:    imp, emaste
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59111

dpaa2_mc_simplebus_get_devinfo() must not treat the MC resource-container
device as a simplebus child. Return NULL when child is sc->rcdev instead
of forwarding OFW_BUS_GET_DEVINFO() for that device.

MFC after:      2  weeks
Differential Revision:  https://reviews.freebsd.org/D59836

Stop embedding struct simplebus_softc as the first member of subclass
softcs. Use device_get_softc_class() to locate the simplebus portion of
the device softc

MFC after:      2 months
Differential Revision:  https://reviews.freebsd.org/D59837

This support was introduced in LLVM 20 and we still support releases
with LLVM 19 so it's too early to require LLVM 20.  Decay to the
non-immediate form when the compiler it too old.  This makes the ifunc
pointless, but limits the need for other ifdefs.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D60023

Creating an executable user-space mapping to write-back memory
synchronizes the icache with the page's contents, whether or not those
contents have changed since the previous synchronization.  Use the pmap
private page flag PGA_ICACHE_SYNCED to record that the icache has been
synchronized with a managed page's contents and that the page has no
writable mappings.  When the flag is set, the creation of another
executable mapping to the page can skip the synchronization.  The flag
is cleared when a writable mapping to the page is created, using a
single atomic operation that keeps PGA_WRITEABLE and PGA_ICACHE_SYNCED
from ever being simultaneously set, and when the page's last mapping is
destroyed.

Assisted-by:    Claude Code (Fable 5.1)
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D59865

Commit 4e0f283fb97a made tpm_tis12_init() wait for TPM_STS_CMD_READY
after aborting any command.  The wait is implemented by the driver's
existing tpm_waitfor_poll() loop, which sleeps with a one-tick tsleep()
between status reads.  Until now, that loop only ran from the resume and
command paths after boot.  From tpm_attach() it can panic with "timed
sleep before timers are working" when the TPM is attached from ACPI
during cold boot and the chip does not report ready on the first status
read.

Before 4e0f283fb97a, tpm_tis12_init() wrote TPM_STS_CMD_READY and
returned without waiting, so the polling loops only ran after boot.
tpm_request_locality() had the same latent hazard but its fast path
returns before sleeping whenever locality is already active.

Nothing calls wakeup() on the channels used by these polling loops, so
the sleeps are pure delays.  Use pause_sig(), which falls back to
DELAY() while the kernel is cold and returns EWOULDBLOCK, a value these
loops already tolerate.

The c argument to tpm_waitfor_poll() is now unused.  It is left in place
to keep this change minimal for MFC and can be removed in a follow-up.

Reviewed by:    kbowling
Fixes:          https://cgit.freebsd.org/src/commit/?id=4e0f283fb97a ("tpm: Bound TPM 1.2 locality ownership")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60050

When performing an unconnected sendto() on a v6 UDP socket in a classic
jail, we were not applying the usual policy of replacing the loopback
addr with the jail's primary IP.  Compare with, e.g., udp6_connect() or
the IPv4 udp_send().  Fix that.

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by:    bz, glebius
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59772

When one pfsync host clears states it informs its peers about this.
While processing such messages, in pfsync_in_clr() we failed to take the
interface name into account.
This meant that if one host cleared states on one interface the peers
would clear all states, not just those on the affected interface.

Actually check for the interface in pfsync_in_clr()

Sponsored by:   Rubicon Communications, LLC ("Netgate")

fd is allocated with M_ZERO and fd_num_af never decreases.
Therefore, no need for zeroing nhaf_count and nhaf_base here.

Fixes:  https://cgit.freebsd.org/src/commit/?id=633438224304 ("route/fib_algo: Fix nexthop index ...")

Now fd_ref_nhop() returns zero for cross family routes,
Do not schedule nhop references and try to rebuild it immediately
for connected and static routes.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298733
Fixes:  https://cgit.freebsd.org/src/commit/?id=633438224304 ("route/fib_algo: Fix nexthop index ...")

Sponsored by: Rubicon Communications, LLC ("Netgate")

Sponsored by: Rubicon Communications, LLC ("Netgate")

ipf_lookup_iterate() validates iter.ili_unit with

  if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)

or alternatively,

  if (iter.ili_unit < -1 && iter.ili_unit > 7)

ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||

Submitted by calif.io for the OpenAI Patch The Planet program

Signed-off-by: Andrew Griffiths <andrew@calif.io>

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59726

Currently, bhyveload(8) does not validate the supplied disk
image path. For example, it allows passing the /dev/null
device, which later fails in userboot because it does not
support DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls (see
userdisk_init() in stand/userboot/userboot/userboot_disk.c).

Fix that by checking DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls early.
A similar check already exists in bhyve(8). While here, make
cb_diskioctl() report the obtained sector size instead of
hard-coding 512.

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59253

EDK2's QemuBootOrderLib inspects the bootorder file provided
via fw_cfg and requires it to be NUL-terminated. Otherwise,
it rejects the supplied bootorder and falls back to its
default boot order.

Currently, bhyve registers bootorder with qemu_fwcfg_add_file()
using bootorder_len returned by open_memstream(), which excludes
the trailing NUL byte.

Fix that by passing bootorder_len + 1 to qemu_fwcfg_add_file() so
the fw_cfg payload is properly NUL-terminated.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279720
Reviewed by:    markj
Found with:     codex (gpt-5.6-sol)
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59859

Differential Revision:        https://reviews.freebsd.org/D59602
MFC after:      3 weeks
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289923
Reviewed by:    bnovkov

Otherwise, the following would segfault

dnctl pipe 1 config bw 1Mbit/s profile 1025points.txt

Found with:     Claude Code Sonnet 5
MFC after:      2 weeks

Reviewed by:  fuz, dteske
Approved by:    fuz (mentor), dteske (mentor)
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59876

Check if the response's error_index is within a sane interval.
Otherwise, a rogue peer could crash us.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298222
Reported by:    Robert Morris
Reviewed by:    markj
Discussed with: secteam (markj)
MFC after:      2 weeks
Analyzed with:  Claude Code Opus 5

Otherwise, "bsnmpget -o verbose -I cut" crashes.

Reported by:    clang static analyzer
MFC after:      2 weeks

For the images we read into the memory, use EfiLoaderData memory type
instead of EfiReservedMemoryType. The kernel handles the former properly
and won't reallocate it. While the latter isn't necessarily mapped,
which can cause ram disks to fault when loaded. memdisk_uefi.efi
used the latter type, but also registered the device as an ACPI
RAM disk, which we don't do.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e45
Sponsored by: Netflix

When we're searching for the EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID (GOPs) to
use, skip any whose Mode or Mode->Info pointers are NULL. The spec
requires these to be non-null, however, some firmwares seem to fail to
populate the Info when, for example, a monitor is not present. Work
around these bugs by skipping any GOPs with bad pointers.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288900
Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D59830

Merge the nearly identical level 1 and level 2 filename conversion
functions and add output buffer bounds checking.

Always NUL-terminate the converted filename, allowing the redundant
memset() in cd9660_translate_node_common() to be removed.

Signed-off-by: Manuel Einfalt <einfalt1@proton.me>
Reviewed by: emaste
Pull request: https://github.com/freebsd/freebsd-src/pull/2443

Obtained from:        NetBSD 2501d4dfda92, 7022656d8ab2

Obtained from:        OpenBSD 4f3c7809d4013a2eb3e75fc5e7bd2d8ae1f41843

There is no need at all to load the cuse module to just access the tool help.

kldload always checks for permissions first returning -EPERM if the user can't
load modules and -EEXIST if the user can, but the module is already loaded.

Approved by:            christos@
Differential Revision:  https://reviews.freebsd.org/D59844
MFC after:              2 weeks

bitmap_ctor() computed the allocation size as

        roundup2(bits, LONG_BIT) / (LONG_BIT / 8)

The dividend is a count of bits, so converting it to bytes requires
dividing by 8 (bits per byte), not by LONG_BIT / 8 (bytes per long).
The two divisors happen to coincide on LP64, but on ILP32 platforms
the head bitmap was allocated at twice the required size; for a
FAT32 file system with close to 2^28 clusters, that is 64 MiB instead
of 32 MiB.

The extra half of the allocation was never accessed, so there is no
functional change other than the reduced memory footprint.

MFC after:      3 days
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2440

boot-test.sh: Add virtio-rng-pci to the EFI RAM-disk netboot qemu invocation

Since the PixieFail security fixes (CVE-2023-45237), EDK II's DxeNetLib --
underneath essentially all of NetworkPkg (Mnp/Arp/Ip4/Dhcp4/Tcp/Http) --
carries a DEPEX on EFI_RNG_PROTOCOL. With no RNG protocol producer
available, that DEPEX is never satisfied and the entire NetworkPkg driver
stack silently fails to load: no error, no assert, it just isn't there.

netboot-efi and netboot-ramdisk never noticed because they only ever touch
the raw EFI_SIMPLE_NETWORK_PROTOCOL via our own net.c, which has no such
dependency. A test that needs EDK II's own NetworkPkg (e.g. one exercising
EFI_HTTP_PROTOCOL) is the first to be affected.

RngDxe can satisfy the DEPEX from the RDRAND instruction alone on a
sufficiently recent edk2 build, but not every installed OVMF is that
recent. -device virtio-rng-pci provides an RNG unconditionally via
VirtioRngDxe, regardless of edk2 vintage or host CPU features.

Unfortunately, the edk2 shipped with qemu lacks the network this needs.

Sponsored by:           Netflix

boot-test.sh: Add a http server per interface

Add the built-in python http server, bound to each of the interaces we
create to expand network testing to include http:// in various
scenarios.

Sponsored by:           Netflix

boot-test.sh: Add netboot-http-efi test

Using iPXE, chainboot loader.efi with rootdev=http://${next-server}/
to test the loader's http:// code.

Sponsored by:           Netflix

BSDRP images are built with "poudriere image -t firmware", which puts
gptboot.efi on the ESP instead of loader.efi.  gptboot.efi reads the GPT
bootme attribute, picks the active system partition (BSDRP1 or BSDRP2),
chainloads /boot/loader.efi from it and hands loader.efi that partition
in LoadedImage->DeviceHandle (stand/efi/boot1/boot1.c:try_boot).

Since ce9bfd78167 ("loader.efi: Refactor try_boot_device_partitions"),
find_currdev() no longer tries that device: try_boot_device_partitions()
walks the parent disk while explicitly skipping dp->pd_handle, on the
assumption that the boot image always comes from an ESP holding no root
filesystem.  When chainloaded, the partition gptboot.efi selected is
therefore the one partition never considered, and loader.efi falls
through to the first other UFS partition on the disk - the previous
system.  Every A/B upgrade silently boots the old slice.

Commit 1c85c5eea09, which introduced try_boot_device_partitions(), did
try dp itself before its siblings; the refactor dropped it.  Restore it,
keeping the sibling walk as the fallback for the normal ESP case.

Fixes: https://cgit.freebsd.org/src/commit/?id=ce9bfd78167
Assisted-by: Claude Code (Fable 5, Opus 5)
Sponsored by: Netflix

Report net.ue.<unit>.%parent as "parent interface", consistent with
wlan(4):

  # ifconfig ue0
  ue0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
          ether 00:00:5e:00:53:2a
          inet 192.0.2.10/24 broadcast 192.0.2.255
          parent interface: ure0
          media: Ethernet autoselect (2500Base-T <full-duplex>)
          status: active

Reviewed by:    aokblast
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59060

Copy the descriptor into a buffer of at most 64 MiB (raise it with
BSDCONF_MAX_BYTES) and tokenize with bsdconf_scan(), the walker
bsdconf_put() already uses.  Input above the cap fails with EFBIG.
Bump libbsdconf to 1.2.0 and sysconf(8) to 2.0.

Suggested by:   fuz
Reviewed by:    fuz
Differential Revision:  https://reviews.freebsd.org/D59751

Approved by: kib
Differential Revision: https://reviews.freebsd.org/D59929

Provide a tunable env variable to request immediate GC on destroy
to allow to return to the previous behavior.

Based on the report and patch by Atle Solbakken <atle.solbakken@gmail.com>.
PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268532
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

If a daemon never responds to FUSE_INIT, but some process attempts to
access the mountpoint, and a different process (possibly the daemon
itself) attempts to unmount, a deadlock would result.

Fix this bug by blocking any thread that enters fuse_vfsop_root until
the daemon responds to FUSE_INIT or it times out.  That will block any
thread attempting to lookup a path in the fuse mountpoint, before it
even gets to fuse VOPs.  Remove less thorough initialization checks in
fuse_ticket_fetch and fuse_vnop_access that are no longer necessary.
And add a test case.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=287431
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    js
Differential Revision: https://reviews.freebsd.org/D59737

As result, we lock the devvp vnode around calls to VOP_FSYNC() on
unmount. For instance, the vn_fsync_buf() implementation of fsync()
needs exclusive lock on the vnode to guarantee that all dirty buffers
are indeed synced.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59932

Calling dtrace_copy and dtrace_copystr with the kaddr and uaddr
arguments inversed does not work with PAN. Rename them
dtrace_copyin_pan and dtrace_copyinstr_pan, respectively, and
implement dtrace_copyout_pan and dtrace_copyoutstr_pan.

Avoid excessive faulting by checkin DTrace's CPU flags. Implement the
trick from OpenSolaris/Illumos of only checking the flags when
crossing into a new page, altough more effectively by examining the
vaddr instead of the count.

Reviewed by:    markj
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D59449

__func__ is a variable not a string literal so pass it to printf.  This
only manifest when KLD_DEBUG was defined so wasn't tested by an kernel
including LINT.

Reported by:    Mark Millard <marklmi@yahoo.com>
Sponsored by:   Innovate UK

Without this, no kernel config contained this option so it was easy to
break.

Sponsored by:   Innovate UK

Otherwise vfs_report_lockf() can race with lf_purgelocks() while the
latter is freeing active lock entries without any locks held.

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59768

This matches upstream behaviour since Linux's demangle_poll()
silently discards POLLREMOVE from the requested events.

Reviewed by:    emaste
Sponsored by:   Sippy Software, Inc.
Differential Revision:  https://reviews.freebsd.org/D59914
MFC after:      1 week
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297467

The Unicode closing single quotation mark is classified as a homoglyph
and can trip automated code quality checks in downstream CI pipelines or
cause code review UIs to refuse to display a file.  If used as an
apostrophe, use the ASCII single quote instead.  If used as a closing
single quote, replace with double quotes or no quotes at all.

Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    ziaee, obiwac, olce
Differential Revision:  https://reviews.freebsd.org/D59911

vfs_register hashes the filesystem name and uses it for sysctl oids.
A filesystem name which hashes to 0 crashes in sysctl_register_oid().

Map 0 to 1 to prevent the kernel crash.

This can be tested with "udf2" as the filesystem name.

MFC after:      1 month
MFC to:         stable/15 stable/14
Reviewed by:    kib
Differential Revision: https://reviews.freebsd.org/D59839

If the entire plaintext is zero-filled, the backwards walk in
tls13_find_record_type() would return the offset of the last byte of the
TLS header.  This causes an underflow when decrypting, resulting in a
null pointer dereference.

Fix the bug and add a regression test.

Reviewed by:    gallatin, jhb
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59767

For some reason, shm_partial_page_invalidate() unlocks the object upon
an error, but its callers don't expect this.  Don't do any special error
handling.  Keep the subroutine anyway since the name is a bit clearer
than vm_page_grab_zero_partial().

While here, normalize the object pointer used for locking in
shm_deallocate().

Reviewed by:    kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=454bc887f250 ("uipc_shm: Implements fspacectl(2) support")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59877

put_device() already triggers lkpi_pci_dev_release(), which removes
pdev from pci_devices, frees pdev->bus, destroys pcie_cap_lock, and
uninits the DMA private data.

Reported by:    gallatin
Fixes:          https://cgit.freebsd.org/src/commit/?id=66b25ddf9125 ("LinuxKPI: pci detach: implement a proper detach (release) path")
Reviewed by:    kib, gallatin, bz
Sponsored by:   NVidia networking
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D59913

All default jail parameter values are an empty or otherwise standard
value, or are copied the jail's parent.  A notable exception is the
root directory, which is instead copied from the creating process's
jail.  Fix that to be in line with everything else.

This change affects only the default when no path is specified; if
a path of "/" is explicitly given, that will still be the creating
process's root directory.

If we are inserting a run of pages into a VM object and fail at some
point due to a memory allocation failure, we have to free all of the
pages in the run.  We do that by resetting some fields and calling
vm_page_free_toq() on each page; this removes the page from the object
and frees it back to the buddy allocator.

If the page is supposed to be wired, we reset the reference count, but
this was done incorrectly: the VPRC_OBJREF flag must be retained as the
page still belongs to an object.  Resetting it to zero will cause a
panic in vm_page_free_prep(): vm_page_free_object_prep() will subtract
VPRC_OBJREF from the refcount, causing underflow, and
vm_page_free_prep() subsequently calls panic() if the refcount is
non-zero.

Reviewed by:    alc, kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=fee2a2fa3983 ("Change synchonization rules for vm_page reference counting.")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59908

A race is possible otherwise: vfs_busy() may return after an unmounted
filesystem has been removed from the global mount list.  That is,
vfs_busy() will block until vfs_mount_destroy() sets MNTK_REFEXPIRE, and
at that point the mountpoint has been removed from the mountlist, so
TAILQ_FOREACH can return an invalid value.

Simply do not block if the mountpoint is being unmounted.

Reviewed by:    kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=eca39864f702 ("Add sysctl KERN_LOCKF")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59982

that locks both bo vnode and topology.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59932

Stop exempting devfs nodes.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59932

It does not provide value over the pre-existing SYSCTL_STATIC_CHILDREN()
macro, which is widely used in the tree, whereas SYSCTL_NODE_CHILDREN()
is not.

Reviewed by:    markj
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60009

This makes it easier to have a full list of them at a glance, and makes
for a natural place to add new ones.

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60010

NOTES: SMP: Move PREEMPTION out of the debugging options section

It has been activated by default for more than 20 years.

Reviewed by:    mchoo, srcmgr (imp)
Fixes:          https://cgit.freebsd.org/src/commit/?id=444ba945136b ("Switch the default scheduler to 4BSD...")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60012

NOTES: IPI_PREEMPTION: Fix documentation, applies to all architectures

Move its description into 'sys/conf/NOTES' and update it to match reality.

Reviewed by:    scheduler (mchoo)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60013

NOTES: Multiple schedulers can be compiled in at once

Mention that ULE is the default scheduler when multiple ones are
compiled in and how the tunable 'kern.sched.name' can be used to select
another one.

While here, regroup SCHED_ULE and SCHED_4BSD, as they control if the
respective scheduler instances are compiled in, putting SCHED_STATS
aside.

Reviewed by:    mchoo
Fixes:          https://cgit.freebsd.org/src/commit/?id=75a66a92c92f ("- Add an option to compile in SCHED_STATS. ...")
Fixes:          https://cgit.freebsd.org/src/commit/?id=1322760fd127 ("sys: enable both SCHED_ULE and SCHED_4BSD for some configs")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60014

The corresponding machinery was removed in commit 0c4440c3aafe6, ten
yearso ago.

No functional change intended.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59986

- refcount_acquire() returns the old value, use that to assert that the
  old value was non-zero.
- refcount_release() already asserts that the refcount value is
  non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
  INVARIANTS and !INVARIANTS.

No functional change intended.

Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59983

If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison.  However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.

Thus, defer the release of the prison refcount until after we've killed
all procs.

Reviewed by:    jamie
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59984

atomic_load_* is a read, not a write.  Otherwise KASAN will report a
use-after-free via atomic_load_* as a write rather than a read.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

aout_coredump() was removed in commit 1eecfae3e53cb3.

No functional change intended.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

nlmsg_translate_ifname_nla() always used nw->ifp for the name,
which is fine for a single-message ifnet event, but an RTM_GETLINK
dump holds one RTM_NEWLINK per interface and is translated with
the ifp the writer had when the buffer was flushed.

The root of the problem is that msgs_to_linux() takes a single
ifp for a buffer that may contain messages about many interfaces.

Use ifi_index to resolve the name instead.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D59595

We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments.  Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.

Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60030

To allow normal users to render through the render device, we expose the
renderD node. This enables Wayland applications to use hardware
acceleration when running under the Linux emulator.

Additionally, libdrm and Mesa need to look up
/sys/dev/char/<major>:<minor> and <pcidev>/drm to identify the
corresponding renderer device (e.g., a renderD device). We expose this
path as well so that libdrm can locate the renderer.

Differential Revision: https://reviews.freebsd.org/D59190

This aligns with copyinuio_t and avoids some hypothetical undefined
behavor around calling functions with mismatched types.

Reviewed by:    kib
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D60024

At present, PGA_EXECUTABLE is only used by the powerpc mmu_oea64 pmap.
The MI layer only accesses this flag to assert that it is clear when a
managed page is freed.  Soon, we will need a similar, but not identical,
machine-dependent flag in the arm64 pmap.  So, we rename this flag to
PGA_PMAP_PRIV1, simply saying that it is reserved for use by the pmap.
Each pmap can then define a name that best reflects its own meaning.
However, we still assert that this flag is clear when a managed page is
freed.

No functional change.

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D59995

Since 80c7315d17ce ("Restore signal mask in epoll_pwait.") the caller's
signal mask is saved in a local variable, but TDP_OLDMASK is still set
and the TDA_SIGSUSPEND AST is still scheduled.  On return to user mode
that AST, or postsig() if a signal is delivered, then installs
td_oldsigmask, which this code never writes and which holds whatever
mask the thread had at its last sigsuspend(2), pselect(2) or ppoll(2).
As a result every epoll_pwait(2)/epoll_pwait2(2) call with a non-NULL
sigmask can leave the thread with a stale signal mask.  In addition, the
explicit restore at the end overwrote the return value, so EINTR (and
any other error) was reported to user space as 0.

Save the old mask in td_oldsigmask and let the AST restore it, as
kern_pselect() and kern_poll_kfds() do: schedule TDA_SIGSUSPEND if the
wait was interrupted, so the signal is delivered with the temporary mask
in place, and TDA_PSELECT otherwise.  This matches Linux, which restores
the saved mask unless the syscall returns -EINTR.

This deadlocks Bun-based programs such as Claude Code (>= 2.1.269) and
opencode.  JavaScriptCore suspends threads for conservative GC stack
scanning by sending SIGPWR and waiting for the target's handler, which
calls sigsuspend(2) with SIGPWR blocked.  Afterwards td_oldsigmask
contains SIGPWR, the event loop's next epoll_pwait2(2) (Bun always
passes an empty sigmask) blocks SIGPWR on the main thread, and the next
GC suspend request waits forever.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298878
Fixes:          https://cgit.freebsd.org/src/commit/?id=80c7315d17ce ("Restore signal mask in epoll_pwait.")
MFC after:      1 week

When creating VM images, we filter the METALOG file created by pkg(8)
when installing non-base packages, rejecting any lines which correspond
to files which don't exist; this solves a problem which arose when a
package was installed and then deinstalled (or upgraded) later in the
image-building process.

Unfortunately [ -e ... ] follows symlinks and is not basedir-aware, so
an absolute symlink which is valid *inside* the image is omitted from
the image if it points to something which isn't present in the build
host system.

Replace [ -e ... ] with [ -e ... ] || [ -L ... ] so that symlinks are
included even if dangling.

While I'm here, add quoting in case future paths become problematic.

Sponsored by:   Amazon
MFC after:      3 days

Prior to this change, Dtrace and ZFS tests and their respective
directories would remain installed even if `${MK_DTRACE_TESTS}` == no or
`${MK_ZFS_TESTS}` == no.

This change enhances the logic to remove the tests when the respective
knobs are disabled so the tests will be removed when `make delete-old`
is run.

MFC after:      2 weeks

Prior to this change Dtrace's tests could be enabled even if
`${MK_DTRACE}` == no. Allowing this doesn't make sense so remove the
tests if `${MK_DTRACE}` is also disabled.

MFC after:      2 weeks

In the event someone specified MK_CDDL == no prior to this change, all
tests under `/usr/tests/cddl` would stick around after the change,
resulting in errors. Similarly, MK_DTRACE == no removed ctfconvert,
which the ctfconvert tests relied on (but remained around after the knob
was disabled).

Remove the tests under the respective blocks now so they don't linger
around on systems where these knobs are disabled, resulting in false
positives when running the complete test suite.

The ctfconvert tests weren't specifically put under
`${MK_DTRACE_TESTS}` == no because ctfconvert was bundled separately
from the upstream provided Dtrace test suite.

MFC after:      2 weeks
MFC with:       30c20ca26 ("Remove Dtrace/ZFS tests if their knobs are disabled")

This was added in the initial import of dtrace and overrides the
normal load/unload targets with a custom target that loads a hardcoded
set of modules.  Over time, the set of modules has not been updated
and is now incomplete.  It's also not really useful compared to the
default implementation of these targets used for loading or unloading
an individual module being actively developed.

This functionality is also available via dtraceall.ko which is how
users commonly load the full suite of dtrace modules.

Reviewed by:    imp, markj
Differential Revision:  https://reviews.freebsd.org/D59821

These aren't referenced in the tree anymore, so remove them from
here. This doesn't chanage src.conf.5, so I didn't commit that file.

Sponsored by:           Netflix

Add myself formally as the "maintainer" for atf, kyua, and lutok, both
in the GitHub CODEOWNERS and MAINTAINERS files.

This change matches the herald rules I recently setup for these
third-party components.

Add myself as the maintainer for routing subsystem
in the GitHub CODEOWNERS and MAINTAINERS files.

This was installed in two different places.

Sponsored by: The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59912

Helps to mitigate failures due to timeout in CI on emulated architectures:
https://ci.freebsd.org/job/FreeBSD-main-riscv64-test/16565/testReport/usr.bin.gh-bc/

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59547

This avoids globally set timeouts for the group of
tarfs_large tests on slower emulated architectures.

While here, lower each testcase's timeout to reflect
the reduction of work. On QEMU aarch64, the largest case
runs in ~500s on a modern desktop, so double that for a
conservative estimate.

Discussed with:         des
MFC after:              3 days
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59033

Test that ipfw's layer-2 hook copes with unmapped mbufs, on the pass
and on the deny path.

Reviewed by:    glebius
Assisted-by:    Claude Code (Fable 5, Opus 5)
Differential Revision:  https://reviews.freebsd.org/D59390

unix_connectat's fdescfs cases call mount_fdescfs(), which skipped on ENODEV.
nmount(2) never returns ENODEV: vfs_donmount() remaps the ENODEV from a failed
fdescfs module load to EINVAL with errmsg "Invalid fstype", so the skip never
fired and the cases failed on kernels without fdescfs.

Approved by:    ngie, asomers
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D59227

Load, list and clear the fingerprints.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

Pin the overlay namei(9) uses for Linux ABI processes: a target under
the ABI root wins (PR 289739), a native-only target should retry from
the native root (PR 297426), an ENOENT past a resolved ABI target is
not retried, and the plain no-symlink native fallback is unchanged.
Skip without a Linux userland so CI stays green.  The two native-only
cases use atf_expect_fail until the retry lands.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297426
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59990

Fixes:        https://cgit.freebsd.org/src/commit/?id=dcb10e3add17
Reported by:    Bruno Banelli <bruno.banelli@sartura.hr> (p_idx typo)

In getcwd_logical(), test for a '.' or '..' component in one of the most
straightforward and intelligible ways possible.

In particular, this removes a superfluous re-test of the the component's
first character being '.' when the first one did not pass and, more
importantly, prevents the second test from relying on a side-effect in
the first.

While here, for better clarity, replace the loop that searches for '/'
with a simple call to strchrnul().

Add high-level comments about what is going on.

While here, test explicitly that pointed 'char' values are not 0 ('\0')
(style(9)).

While here, separate the successive steps of getcwd_logical() with blank
lines.

No functional change (intended).

Discussed with: emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=2df923c5d2d0 ("pwd: Clean up and adopt POSIX semantics")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59709

Wrap long lines, related to the nullfs mounts over regular files and
sockets type checks.  Also fix indent.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Improve manpage compatability by dropping an abbreviation macro that
compiler upstreams do not want, causing manuals using it to render
incorrectly on other toolchains or operating systems. It was only used
in three manuals, which are amended in this commit.

Reviewed by:    fuz, markj
MFC after:      no, these did not MFC
Requested by:   Ingo Schwarze <schwarze@openbsd.org>
Fixes:          https://cgit.freebsd.org/src/commit/?id=db3884b03989 ("contrib/mandoc: add -ieee754-2008")
Fixes:          https://cgit.freebsd.org/src/commit/?id=63cd0841de76 ("document .St -ieee754-2008 in mdoc")
Differential Revision:  https://reviews.freebsd.org/D59880

In the event that NDEBUG is specified in CFLAGS--which is most likely
triggered via `MK_ASSERT_DEBUG` == "no" -- all assert(3) statements are
optimized out by design. This breaks the assert(3) tests as they
specifically rely on assert(3) actually raising a `SIGABRT` instead of
quietly succeeding.

Skip both tests if `NDEBUG` is set. There's no sense running the
`assert(true)` test if the result could instead be a false positive.

MFC after:      2 weeks

contrib/atf: upgrade to 0.26

This new version gets contrib/atf in line with the published version of
the package up on [GitHub][github].

Please note that this release is a major update: it contains several
bugfixes and feature enhancements. Most were already present in the
FreeBSD src repo, but there were a large number of changes made in
addition to what was already present.

MFC after:      1 month

Merge commit '9c78088348bcf1059d82a62bb57a0746309d4312'

Conflicts:
        contrib/atf/.cirrus.yml
        contrib/atf/Makefile.am
        contrib/atf/Makefile.in
        contrib/atf/aclocal.m4
        contrib/atf/admin/ar-lib
        contrib/atf/admin/check-style-common.awk
        contrib/atf/admin/check-style.sh
        contrib/atf/admin/compile
        contrib/atf/admin/config.guess
        contrib/atf/admin/config.sub
        contrib/atf/admin/depcomp
        contrib/atf/admin/install-sh
        contrib/atf/admin/ltmain.sh
        contrib/atf/admin/missing
        contrib/atf/atf-c++/Makefile.am.inc
        contrib/atf/atf-c++/atf-c++.3
        contrib/atf/atf-c++/atf-c++.pc.in
        contrib/atf/atf-c++/check.cpp
        contrib/atf/atf-c++/check.hpp
        contrib/atf/atf-c++/detail/Makefile.am.inc
        contrib/atf/atf-c++/detail/process_test.cpp
        contrib/atf/atf-c/Makefile.am.inc
        contrib/atf/atf-c/atf-c.3
        contrib/atf/atf-c/atf-c.pc.in
        contrib/atf/atf-c/detail/Makefile.am.inc
        contrib/atf/atf-c/detail/fs.c
        contrib/atf/atf-c/detail/fs_test.c
        contrib/atf/atf-c/detail/process_test.c
        contrib/atf/atf-c/tc.c
        contrib/atf/atf-c/tc.h
        contrib/atf/atf-sh/Makefile.am.inc
        contrib/atf/atf-sh/atf-check.cpp
        contrib/atf/atf-sh/atf-check_test.sh
        contrib/atf/bootstrap/Makefile.am.inc
        contrib/atf/bootstrap/package.m4
        contrib/atf/bootstrap/testsuite
        contrib/atf/config.h
        contrib/atf/configure
        contrib/atf/configure.ac
        contrib/atf/doc/Makefile.am.inc
        contrib/atf/doc/atf-test-case.7
        contrib/atf/m4/developer-mode.m4
        contrib/atf/m4/libtool.m4
        contrib/atf/m4/ltoptions.m4
        contrib/atf/m4/ltsugar.m4
        contrib/atf/m4/ltversion.m4
        contrib/atf/m4/lt~obsolete.m4
        contrib/atf/m4/module-defs.m4
        contrib/atf/test-programs/Makefile.am.inc

[github]: https://github.com/freebsd/atf

atf-sh: install kmod_test added as part of the 0.26 release

Fixes:  https://cgit.freebsd.org/src/commit/?id=952231086100 ("contrib/atf: upgrade to 0.26")

integration_test: backport fix from freebsd/atf

See the related merge commit for more details.

MFC after:      28 days
Obtained from:  [freebsd/atf@2690b04c][upstream]
Fixes:          https://cgit.freebsd.org/src/commit/?id=95223108 ("contrib/atf: upgrade to 0.26")

Merge commit '8fd09407c8e64fd26d095c9b00990c545577db5a'

[upstream]: https://github.com/freebsd/atf/commit/2690b04cbc608af165a58426b7275c063b779f03

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes

Security:       CVE-2026-93990
MFC after:      3 days

Verbatim import of these files, with unix line endings.

Sponsored by:           Netflix

Sponsored by:         Netflix