FreeBSD git weekly: 2026-07-01 to 2026-09-30

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

Add the option "oemstring" to allow setting the DMI type 11 ("OEM
Strings") SMBIOS structure. These are free-form strings, available for
any purpose, but can be especially useful to pass configuration,
secrets, and credential information into a Linux guest and consumed by
systemd.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57516

Point out which features are non-POSIX and thus can not be
safely assumed to be portable and exist in other implementations.

Relnotes:               YES!
Reviewed by:            ziaee, jilles
Differential Revision:  https://reviews.freebsd.org/D55333

Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293183
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58391

Add the ability to select source ip address of outgoing packets
even when the source ip address is configured on another interface.
Also add this new rtnetlink attribute to manual.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius, ziaee (manpages)
Tested by:      ivy, Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D58294

Register the 82576 and I350 VF PCI IDs under a separate igbv driver
while continuing to share the igb datapath implementation.

Follow the ixv driver split and give the VF context IFLIB_IS_VF so
iflib does not apply the PF SR-IOV detach guard to a child VF. Program
VTIVAR_MISC in the VF low byte so mailbox and reset notifications reach
the VF admin vector.

The split will become increasingly obvious as bug fixes land, trying to
bias everything with if (sc->vf_ifp) everywhere is error prone in two
directions.

This breaks existing naming/configurations and cannot be MFCed as-is.
I have no plans of adapting it to prior branches at the moment but it
may be possible.

Relnotes:       yes
Sponsored by:   BBOX.io

Add the PCI IOV schema and PF control plane for up to seven VFs with
one hardware queue per pool. Implement VF mailbox handling, MAC and
VLAN assignment, multicast filtering, promiscuity policy,
anti-spoofing, malicious-driver recovery, reset replay, and queue
lifecycle management.

The basic SR-IOV and VMDq PF implementation follows DPDK Intel e1000
code, including PF pool selection, one queue per pool, mailbox
dispatch, and VF enablement. Intel FreeBSD igb-2.5.31 supplies the
older driver baseline. Linux igb and the Intel SDMs clear up lifecycle,
isolation, reset, and family-specific details absent from DPDK.

Enabling IOV requires the PF to attach with one TX and RX queue.
Systems whose defaults select RSS queues must set the documented iflib
queue override tunables before attach.

Only 82576 and I350 support SR-IOV in silicon.  The series has been
extensively tested on I350, including thowing boundaries at the PCI BAR
that shipping drivers will never.  Still, think carefully before
reaching for this in critical environments.

Relnotes:       yes
Sponsored by:   BBOX.io

Document supported controllers, PF and VF naming, PCI_IOV and IOMMU
requirements, queue and lifecycle constraints, iovctl schema, filtering
and anti-spoof policy, mailbox and MDD recovery, shared hardware
limits, rate control, and statistics cadence.

Relnotes:       yes
Sponsored by:   BBOX.io

Borrow the e1000 VLAN filter table

Ambiguous presence of the feature by Intel was settled by DPDK and
emperical testing.

MFC after:      2 weeks
Relnotes:       yes

Unlike its GNU counterpart, our tail(1) has always errored out if given
repetitive or contradictory options, even prior to Keith Bostic's 1991
reimplementation.  There is no good reason to continue to do so, not
even tradition, since many other commands (including head(1)) simply
apply the rightmost option in cases like this.

MFC after:      1 week
Reviewed by:    allanjude, markj
Differential Revision:  https://reviews.freebsd.org/D58192

Now that fetchTimeout works reliably, setting an alarm is not only no
longer necessary but counterproductive, as it will trigger even if the
connection is not actually stalled but merely slow.

While here, improve the wording of the manual page's description of the
various options for setting a timeout.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57911

While preparing GPT-schemed RaspberryPi images for the NanoBSD
Reimagined GSoC 2026 project, a discrepancy was identified between
mkimg(1) and gpart(8) regarding Microsoft Basic Data partitions (GUID
!ebd0a0a2-b9e5-4433-87c0-68b6b72699c7).

Currently, mkimg(1) relies on the MBR-centric name "ntfs" to identify
this partition type under the GPT scheme.  Conversely, gpart(8)
identifies this type as "ms-basic-data".

To allow automation scripts (such as those consuming from gpart backup)
to use a common partition type across tools, add ALIAS_MS_BASIC_DATA as
a valid alias.

This is part of a larger effort to avoid a custom, MBR-based image
generation logic for embedded SoCs like the Raspberry Pi, standardizing
on GPT layouts across all supported FreeBSD embedded devices.

Reviewed by:    imp
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58198

This allows to use output of '/usr/bin/time -ao foo' as direct input to
ministat(1).

While here make diagnostic message more verbose.

GNU hexdump supports octal and hex, we add supports for BSD style
hexdump for better compatibility.

See: https://github.com/llvm/llvm-project/pull/206581/

MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58074

- gnum4.c: fix m4_warnx() to use vwarnx() instead of warnx()
- eval.c: improve error messages for empty macro names
- extern.h: remove compute_prevep() declaration
- Update OpenBSD version strings

MFC After: 3 days

This partially reverts commit 77a201b1705dbd97ea9ebe5b25b1d4ddac8a7d38.

Requested by:   des, fuz

The fallback glyph is stored at index 0, and does not need to be
inserted into a mapping.

Previously there was a dead store of add_glyph's return value for the
fallback case, which upset Clang's static analyzer.  Now, cast the
return value to (void) to make it clear this is intentional.

Also change add_glyph's fallback parameter to a c99 bool to make its use
more clear.

Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57174

install: Allow installing stdin

If from_name is "/dev/stdin" or "-" and the target is not a directory,
skip the comparison and copy data from standard input to the target.

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58348

install: Fix typo

MFC after:      1 week
Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=d34870708db9 ("install: Allow installing stdin")

This is mainy focused on using bool for booleans but also renames some
variables for clarity, adds some explicit comparisons, adds some braces,
with miscellanous style fixes thrown in.

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58355

Check the `fdopen` return value before calling `cook_cat`.

Reviewed by:    markj, bnovkov
Differential Revision:  https://reviews.freebsd.org/D57741
MFC after:      1 week

pwait: Optionally wait until process is reaped

If the new -r option is specified, wait until the target process not
only terminates but is reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58314

pwait: Add a SIGINFO handler

On SIGINFO, print a space-separated list or remaining processes to
standard error.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58386

rc.subr: Fix premature return from wait_for_pids

Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293183
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58391

Bump dates

Fixes:          https://cgit.freebsd.org/src/commit/?id=c8f5e6819d4d ("pwait: Optionally wait until process is reaped")
Fixes:          https://cgit.freebsd.org/src/commit/?id=eddd8aa99ca8 ("pwait: Add a SIGINFO handler")
Fixes:          https://cgit.freebsd.org/src/commit/?id=356d0b79cf6f ("rc.subr: Fix premature return from wait_for_pids")

Sponsored by: AFRL, DARPA

Several functions were using sprintf() to write RPC server-controlled
data to a stack buffer.  Adopt some minimal changes from NetBSD to avoid
the potential overflows.

Security:       CVE-2026-16277
Security:       CVE-2026-16461
Reviewed by:    khorben
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58441

Reviewed by:  emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58442

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks rpcgen during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

For mkfile_output(), the pointed-to value is never modified, so
fix this by making the pointer const as well.

For open_log_file(), the current code modifies the supposedly const
value in-place to remove the filename suffix, which happens to work
but is wrong even in older versions of C.  Change the code to use a
printf "%.*s" format specifier to strip the suffix instead.

MFC after:      1 week
Reviewed by:    brooks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58489

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks sort during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

As the returned pointer is never used to modify the value, fix this
by making the temporary variable const.

MFC after:      1 week
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58491

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks xinstall during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

As the returned pointer is never used to modify the value, fix this
by making the temporary variable const.

MFC after:      1 week
Reviewed by:    ray, markj, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58492

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks mkimg during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Make the existing 'sep' pointer const to fix the first case, and
for the second, introduce a new non-const pointer for strchr,
since we do modify the result in that case.

MFC after:      1 week
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58493

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks m4 during the
bootstrap build, since it assumes the return value is always a
mutable pointer.

Since the returned value is never modified, simply make the
temporary const.

MFC after:      1 week
Reviewed by:    bapt, dim
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58494

Add some minimal handling of category sources other than static kernel
sources.  We don't actually look up dynamic sources yet (that would
require extended trace records to add the file names to the trace file
since we can't assume the trace file is running on a kernel with the
same numbers.)

Make the decision to append a "src/" prefix to each file name
dependent on the category source.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58412

While here, remove the long-unused dash in the first line.

Reviewed by:    ziaee, olce
Fixes:          https://cgit.freebsd.org/src/commit/?id=ddf144a04b53 ("ps.1: Revamp: Explain general principles, update to match reality")
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D58038

* Modernize the markup

* Describe the comment syntax

* Drop obsolete advice

* Capitalize sentences

* Improve the language

* Replace no_tld_query with no-tld-query; both are supported, but all the
  other multi-word options use hyphens rather than underscores.

* Add missing ENVIRONMENT section

* Redo the example

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57921

MFC after:    1 week

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Also do not start a new list for each flag item.

Reviewed by:    markj
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential revision:  https://reviews.freebsd.org/D57124

Submitted by: des
MFC after:      1 week

Submitted by: des
MFC after:      1 week

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Commit 74654ba3b1b3 added and new chflags(1) flag called
"udontcache" or "dontcache".  This patch documents this flag.

This is a content change.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58181

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58123

Document the global fetchTimeout variable, now that it works reliably.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57910

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58247

According to RFC 1918, the following IP prefixes are reserved for
private internets:

    10.0.0.0/8
    172.16.0.0/12
    192.168.0.0/16

This PR fixes the prefix lengths in references to private networks
("RFC 1918 networks", "the standard private IP address ranges").
The changes are limited to man pages.

Signed-off-by:  Yusuke Ichiki <public@yusuke.pub>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2328
MFC after:      3 days

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58292

boot.9 was moved to kern_reboot.9, but this reference was not changed
appropriately.

Reviewed by:    mhorne, kib, emaste
Fixes:  https://cgit.freebsd.org/src/commit/?id=800e74955d4e ("boot(9): update to match reality")
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58350

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58315

Point out which features are non-POSIX and thus can not be
safely assumed to be portable and exist in other implementations.

Relnotes:               YES!
Reviewed by:            ziaee, jilles
Differential Revision:  https://reviews.freebsd.org/D55333

List every AQC part aq_vendor_info_array[] probes, each with the
maximum speed aq_hw_capabilities() grants it.

Only the Atlantic 2 parts link at 10 Megabit.  The AQC100 and AQC100S
are the only SFP+ controllers; the rest are twisted pair.

Reviewed by:            adrian, ziaee
Signed-off-by:          Nick Price <nick@spun.io>
Differential Revision:  https://reviews.freebsd.org/D58144

Reviewed by:  ziaee, imp
Differential Revision:  https://reviews.freebsd.org/D58267

contigmalloc.9: Note that M_WAITOK may still return NULL

Reviewed by:    markj, bapt
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58382

contigmalloc.9: Correct typo

Reported by:    alc, rlibby
Fixes: https://cgit.freebsd.org/src/commit/?id=caabdb3aefdc ("contigmalloc.9: Note that M_WAITOK may still return NULL")

The manual page claimed that SIGINFO caused information to be printed to
stdout, when in fact it is printed to stderr, as one would expect.  This
has been true ever since the feature was first added in 2003.

MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=00d321a2b395 ("Add a SIGINFO handler.")
Reviewed by:    jilles
Differential Revision:  https://reviews.freebsd.org/D58392

Describe the disabled, adaptive, and low-latency settings and their
interrupt-rate tradeoffs.

MFC after:      1 week

Describe the disabled, adaptive, and low-latency settings and their
interrupt-rate tradeoffs.

MFC after:      1 week

Reviewed by:  markc
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58458

mknod.2: update the man page

State that FIFOs can be created, document the requirement that
dev must be zero then.  Mention whiteouts.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297082
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D58478

mknod.2: properly document root requirements

Submitted by:   Martijn Dekker <mcdutchie@hotmail.com>
PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297082
Fixes:  https://cgit.freebsd.org/src/commit/?id=4090d103b0c3 ("mknod.2: update the man page")
MFC after:      3 days

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

There are expected to be additional improvements and this RELNOTES
entry will be updated accordingly.

Reviewed by:  des
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58483

Adjust the man page to what other LinuxKPI wlan man pages say and look
like as it has been a while since I wrote it.  The man page is not yet
hooked up to the build on purpose as the driver is not yet enabled in
the tree.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    ziaee (earlier version)
Differential Revision: https://reviews.freebsd.org/D58479

There are few warnings reported by mandoc -Tlint:

bhyve_config.5:255:31: WARNING: new sentence, new line
bhyve_config.5:257:43: WARNING: new sentence, new line
bhyve_config.5:422:2: WARNING: missing section argument: Xr nm_open
bhyve_config.5:469:24: WARNING: skipping no-space macro
bhyve_config.5:483:2: WARNING: wrong number of cells: 2 columns, 4 cells
bhyve_config.5:484:2: WARNING: wrong number of cells: 2 columns, 4 cells
bhyve_config.5:541:24: WARNING: skipping no-space macro

 - "new sentence, new line" is a trivial formatting fix.
 - "missing section": there is actually no nm_open() manual page,
    so use .Nm instead of .Xr for it.
 - "no-space macro": format without .Oc and .Ns, similarly to
    how it is already done in bhyve.8 for VNC addresses.
 - "wrong number of cells": also a trivial fix.

Reviewed by:    jhb
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58415

`nvmecontrol power -l ...` lists the available power modes.
Non-operational modes are marked with an asterisk. While here,
add <device-id | namespace-id> to the "nvmecontrol power" synopsis.

MFC after:              3 days
Reviewed by:            dab, imp, michaelo, ziaee
Differential Revision:  https://reviews.freebsd.org/D58480

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58264

Reviewed by:  emaste, mckusick
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D58592

The IPv6 socket options IPV6_JOIN_GROUP and IPV6_LEAVE_GROUP
socket options are being extended to accept IPv4 multicast group
addresses in the RFC 3493 IPv4-mapped address format as a convenience
to application developers.

Caveat this addition carefully in the newly added HISTORY section,
addressing all previous review comments.

Approved by:    ziaee
Reviewed by:    ziaee, glebius
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision:  https://reviews.freebsd.org/D55382

asmc: try PIO before MMIO to avoid false T2 detection

Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.

Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57844

asmc: add system state and board identity sysctls

Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).

Each sysctl is registered only if the key exists on the hardware.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57853

asmc: deduplicate sensor converters and cause sysctls

Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57854

Book-E powerpc has 64-bit bus_addr_t but only a 32-bit bus_size_t.  Use
the right macros for maxsize and maxsegsize to fix the build.

Fixes:  https://cgit.freebsd.org/src/commit/?id=4bf8ce037 ("if_rge: initial import of if_rge driver from OpenBSD.")
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57794

Depend on clknode_if.h in the module Makefile, so that it gets
explicitly built for the module.  Also, reduce the #if guards to only
the new clock output code, and gate them on all powerpc, not just
powerpc64.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6b77d34f ("HYM8563: Add support for clock output.")
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D57795

These were added during the DPAA driver rewrite, and should not have
gone in then.  Remove them.

Reviewed by:  mav
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58003

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199101
MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57929

MFC after:    1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57930

Some firmware delivers the power or sleep button press that woke the
system as an ordinary button press (Notify 0x80) shortly after resume,
rather than as the wakeup notification (Notify 0x02) the ACPI
specification requires for a button that is also a wake source.

On affected machines (e.g. the Framework Laptop 12, Intel Raptor Lake-P)
the power button is a control-method device behind the embedded
controller.  The EC latches the key press that woke the system across the
sleep transition and flushes it through its normal _Qxx query path as
soon as it is reinitialized on resume.  The replayed press is
indistinguishable from a genuine one, so the kernel honors it as a fresh
suspend request and the machine suspends again immediately after waking;
it cannot be kept awake with the button.

The event cannot be filtered at its source: it arrives over the same EC
query path that also carries legitimate events (lid, AC, thermal,
battery), so suppressing the drain would lose real notifications.
Instead, record the time of resume and ignore a button-initiated suspend
that arrives within a short grace window of it.  The timestamp is taken
before DEVICE_RESUME() re-initializes the EC, so it is set before the
replay can be processed on the ACPICA notify taskqueue; otherwise the
replay can be evaluated before the timestamp is written and slip through.
Measured from that point, the replay lands at ~600 ms across many cycles
on a Framework Laptop 12, whereas a deliberate press cannot occur that
quickly -- it happens well after the display is back -- so a one-second
window separates the two without ignoring real presses for any
perceptible time.

Spec-compliant firmware reports the wake as Notify 0x02, which is handled
on a different path and never reaches this check, so there is no change
in behavior on such systems.

The replay window is a fixed compile-time constant rather than a tunable
on purpose: it tracks a hardware characteristic -- the EC's post-resume
replay latency -- not a user policy, so there is no value a user would
meaningfully choose.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296243
Reviewed by:    adrian, imp (earlier revision), olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57712

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, still waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 25A in AF0349, before leaving Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

This fixes associating to various APs.

It worked fine to a FreeBSD AP (which is a wholly separate problem
I'm going to need to dive into) but not to my tplink AX1800 Wifi-6
router.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296503

Locally tested:

* STA: Intel Centrino Advanced-N 6205 (iwn), Lenovo T420
* AP: TP-Link AX1800 wifi-6 router

M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.

xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.

Reviewed by:    zlei, adrian
Differential Revision:  https://reviews.freebsd.org/D57495

Use kn->kn_sdata to track the last bs->total value for each knote
attached to an mmaped channel. An event is delivered only when the total
byte counter has advanced by at least c->lw since the last delivery.
After delivery kn_sdata is updated to the current total.

Each knote tracks its own watermark independently, so multiple knotes
attached to the same mmaped channel all receive events correctly.

Non-mmap channels keep the existing level-triggered behavior via
chn_polltrigger().

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D57833

arm64/vmm: Add FEAT_NV2 definitions

Add the definitions for the VNCR_EL2 register and all of the offsets
to registers in memory relative to the page stored in VNCR_EL2.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56550

arm64/vmm: Use the VNCR_EL2 memory page to store guest registers

Wherever possible, move the storage space for guest register values from
the hypctx struct into a preallocated memory page matching the layout of
the page pointed to by VNCR_EL2.
This will streamline implementing support for nested virtualization, but
the implementation itself is not reliant on the presence of nested
virtualization architecture features.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56551

arm64/vmm: Store non-VNCR registers in an array

Move non-VNCR EL0 and EL1 registers into a dedicated array inside of
hypctx. This enables uniform accesses to both VNCR and non-VNCR guest
register state through hypctx_[read|write]_sys_reg().

The accessors are _not_ used for non-VNCR EL2 registers in order to
create a clear separation between guest-visible and guest-invisible
register state.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56552

arm64/vmm: Refactor vmm_hyp.c

Refactor vmm_hyp.c to split register reload logic by type of register,
streamline the implementation and improve readability.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56553

arm64/vmm: Move vttbr_el2 & vtimer into struct hypctx

Move vttbr_el2 & vtimer from struct hyp into struct hypctx to streamline
the logic and handle them in the same way as other *_el2 registers are
already being handled.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56554

arm64/vmm: Move host-side EL2 regs into sys_regs

Move EL2 host registers that are not visible to the guest into
hypctx->sys_regs. Prefix them with HOST_ to distinguish from EL2
registers which are part of the guest's own state (e.g. in VNCR).

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56555

arm64/vmm: Make remaining registers use hypctx_*_sys_reg

Move vgic, timer and trapframe registers into sys_regs to handle them
in the same way as all the other registers.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56556

Fix tid_set_busy() for when `pmap` is NULL. Obviously a NULL pointer
cannot be correctly used, so I'm not sure how it worked in testing on
64-bit.

When the TID rolls over on a given CPU, simply flash-invalidate the
TLB instead of walking the TLB to only invalidate the repurposed TID.
Walking 256 entries is expensive, and we'll likely be inserting a bunch
new ones anyway in the new environment, since 256 really only handles
1MB of storage, so the likelihood of other mappings continuing to exist
in the TLB when their thread owner is scheduled again is very very
small.

DEVX event notifier returned true for the command-completion and
page-request events. This is causing mlx5_eq_int() to skip the core EQ
handler, so the firmware command interface and the page supply stop
being serviced and the device wedges.

This commit also make notifier registration and dispatch safe against
the EQ interrupt running concurrently: publish the table pointer before
the callback and load it with acquire semantics. run the callback under
RCU, and drain it with synchronize_rcu() on teardown. Otherwise the
interrupt handler could observe a half-initialized notifier or race with
cleanup.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commits a8b92ca1b0e5ce620e425e9d2f89ce44f1a82a82
and c59450c463695a016e823175bac421cff219935d.

The DEVX object and method definitions were already present, but nothing
pointed ib_device.driver_def at them.  ibcore therefore never merged
them into the uverbs uapi tree and every DEVX ioctl came back as
EPROTONOSUPPORT.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 342ee59de98a2ecdf15a46849a2534e7c808eb1f.

The dynamic UAR object was declared in the ABI headers but had no handler,
so the ioctl was rejected and dynamic-UAR contexts could not allocate a
doorbell UAR at all.

Implement the alloc and destroy methods following the upstream driver:
grab a UAR stamped with the caller's DEVX uid, expose it to user space
through an rdma_user_mmap entry (write-combining or non-cached as
requested), and free it on destroy.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

A firmware object owned by a DEVX uid may only reference resources owned
by the same uid or ones explicitly marked as shared.  Completion EQs
were created with uid 0, so a CQ owned by a DEVX uid could not attach to
its EQ and CREATE_CQ failed with "bad resource".

Create completion EQs with MLX5_SHARED_RESOURCE_UID on devices that
support user contexts, so uid-owned CQs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: allocate IB queue counters as a shared resource

A QP owned by a DEVX uid references the port's queue counter.  The
counter was allocated with uid 0, so RST2INIT_QP on a uid-owned QP
failed with "bad resource state".

Allocate and free the IB queue counters directly and, on devices that
support user contexts, stamp them with MLX5_SHARED_RESOURCE_UID so
uid-owned QPs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: encode dynamic UAR mmap offsets in the reserved command range

The UAR ioctl handed user space a raw mmap offset, so the first dynamic
UAR landed at page offset 0.  mlx5_ib_mmap() decodes offset 0 as the
legacy regular-page command and routed the mapping through the old bfreg
path, which rejects dynamic-UAR contexts, so mmap() failed with EINVAL
and mlx5dv_devx_alloc_uar() returned NULL.

Follow the upstream scheme: reserve the mmap command range [9, 255] for
rdma_user_mmap entries and return command-encoded offsets, so the
dynamic-UAR mappings decode to the intended mlx5_ib_mmap() path.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: advertise write-combining support for dynamic BlueFlame UARs

Import Linux upstream commit 1f3db161881b7e21efb149e0ae8152b79a571a8f.

dev->wc_support was never set, so it was always false and the UAR ioctl
refused BlueFlame (write-combining) UAR allocations with EOPNOTSUPP.
That breaks QP creation in pure dynamic-UAR mode, where user space asks
for a BF doorbell UAR.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: pass the full EQE to the DEVX event notifier

The DEVX event notifier and its helpers expect a full struct mlx5_eqe
and read eqe->data from it, but mlx5_eq_int() passed &eqe->data, so the
data offset was applied twice.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: guard against a NULL CQ event handler in mlx5_cq_event()

DEVX and mlx5en created CQs are registered without an asynchronous
event handler (mcq.event is NULL).  An asynchronous CQ_ERROR event for
such a CQ made mlx5_cq_event() call through a NULL pointer and panic.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: propagate the DEVX uid through SRQ create and destroy

The SRQ command builders never stamped the owning DEVX uid into the
firmware CREATE_SRQ/CREATE_RMP/CREATE_XRC_SRQ commands, so a basic SRQ
was always created with uid 0.  Every modern libmlx5 context runs with a
DEVX uid, and the QPs that reference the SRQ carry that uid, so firmware
rejected CREATE_QP with "bad resource": a uid-owned QP may not reference
a uid-0 SRQ.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

The thermal interrupt is initially masked.

Thermal interrupt handling is enabled by calling lapic_enable_thermal(),
which installs a (single) handler.

[olce: Wrote the commit message.]

Reviewed by:    kib, olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D44454

acpi: Add a pseudo-bus for APEI devices to manage resources

Different APEI tables can reuse the same registers (and sometimes
different views of the same register, e.g. 32- vs 64-bit mappings of
the same register).  To enable this sharing, apei0 now acts as a bus
device managing a pool of allocated resources and handing out mappings
to child devices which handle individual tables.

Most of the previous apei(4) driver has been moved into a new
hest0 device that is a child of apei0.

Reviewed by:    gallatin
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58024

acpi: fix instant panic in hest_attach()

Since now there is a pseudo-bus between our device and acpi0, we need to
go deeper.

Fixes:  https://cgit.freebsd.org/src/commit/?id=9313f6b01485ad9a0b7cc59b459f5714533587c3

Fixed the post-LPS delay from 500us to the IEEE 1394a-2000 s6.1 mandated
10ms ceiling. Handled PHY_INT by clearing W1C status bits in register 5
(masked ISBR to avoid spurious bus resets). Added a SID timeout callout
that recovers the state machine when a remote device fails to complete
self-ID. Fixed FW_PHY_SPD operator precedence and gated noisy messages
behind bootverbose/firewire_debug.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58033

fwcam: add dynamic resolution and frame rate support

Read V_MODE_INQ and V_RATE_INQ registers for all supported formats
during probe, caching the camera's actual capabilities.  Use these
to validate SMODE ioctl requests before writing to the camera.

Writing an unsupported combination caused the camera to
stop responding, requiring a physical power cycle.

Tested with: Apple iSight (external FireWire)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58090

fwcam: set ISO speed from device link speed

iso_speed was never initialized, defaulting to S100 regardless of the
camera's actual link speed. Some cameras firmwares reject ISO_EN
when the speed field in the ISO_CHANNEL register
does not match their capabilities.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58091

fwcam: write video mode registers before enabling ISO streaming

The IIDC spec (s3.1) requires the video mode to be programmed before ISO
enable. Without this, cameras that power up with invalid default
mode/rate combinations reject the ISO_EN write.

This can happen when the firmware of teh camera is outdated or
vendor never updated it.

Differential Revision:  https://reviews.freebsd.org/D58092

Sponsored by; The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Moved ISO start to first usage. Opening the device now
only validates state and increments the open count, allowing info
queries and mode changes without starting the camera. ISO streaming
begins on demand when userland first reads frame data.
This avoid the camera led to turn-on at attach.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58100

Some IIDC cameras power down the sensor when inactive (e.g. lens
cover closed) and reject ISO enable with EIO. Re-power the camera
and retry once before failing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58101

MFC after:    1 week
Sponsored by:   The FreeBSD Foundation

USB vendor:product 184f:0051

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56794

This can't be a loadable module, so add it to MINIMAL

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58067

This makes the code slightly more compact and easier to read.

No functional change intended.

Reviewed by:    bnovkov
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58110

The thermal LVT slot does not necessarily exist.

According to Intel's Software Developers Manual, for Intel processors
supporting 64-bit operation (amd64), probably even the earliest ones
should have a local APIC with such a slot (the slot was introduced with
Pentium 4 and Xeon processors according to the manual, and the 64-bit
implementation in some later versions of them).  AMD's Architecture
Programmer's Manual also seems to imply that all AMD processors
supporting amd64 should have the slot too.  So this change may not be
needed when i386's code is dropped, but it does not hurt to have it, and
it might ease possible MFCs.

Change the signature of lapic_enable_thermal() so that it can report
failure (if there is no local APIC or if there is no thermal LVT slot).

Reviewed by:    bnovkov, kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58086

Differential Revision:        https://reviews.freebsd.org/D56923
Reviewed by:    mhorne

This change implements the equivalent of the amd64-specific
'show pte' ddb command used to dump the page table entries
associated with a specific virtual address.

Differential Revision:  https://reviews.freebsd.org/D56924
Reviewed by:    mhorne

Spurious page faults caused by cached invalid entries may occur when
starting APs and potentially panic the kernel if we're running in
a non-sleepable context.

Fix this avoidable panic by flushing the TLB after the AP is released.

Differential Revision:  https://reviews.freebsd.org/D57003
Reviewed by:    markj

The Privileged ISA specification permits caching of invalid PTEs
12.2.1. Supervisor Memory-Management Fence Instruction), which may
result in a spurious page fault. Such faults are handled by 'pmap_fault'
which locks the kernel pmap before inspecting and possibly updating the
offending L2 entry.
Unfortunately, spurious faults may also occur when we're already holding
the kernel_pmap lock or running in a critical section, where any attempt
to grab the pmap lock will result in a kernel panic.

Fix this avoidable panic by performing a lockless lookup to determine
whether a valid kernel mapping exits and flushing appropriate TLB entry.

Differential Revision:  https://reviews.freebsd.org/D56925
Reviewed by:    jrtc27, mhorne, markj

Using cpu_get_pcpuid() directly or having a CPU ID cache does not really
make any significant difference.  With cache: Less function calls, less
space on stack, but an additional allocation in the softc, who stays
permanently.  Without cache: Some function calls, but one less slot in
the softc, and no data duplication (but that info never changes).

The main reason for this change is to reduce conflicts with some
work-in-progress by aokblast@.

While here, move the check that a per-CPU structure is provided by the
bus from the attach to the probe method, as it is already used by
hwpstate_probe_pstate() there.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

To minimize the diff with hwpstate_intel(4).  See previous commit there
for the rationale.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

KVM does not always use 0x40000000 as its CPUID base. For example, QEMU
adds a 0x100 offset when nested virtualization is detected and the host
exposes Hyper-V enlightenment hints. To accommodate this behavior,
switch the detection logic to use the CPUID leaf returned by do_cpuid(),
making the implementation more flexible.

See:
https://github.com/qemu/qemu/blob/master/target/i386/kvm/kvm.c#L2300

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58146

Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
triggering SSP when ntpd set the time on the RockPro64, at the very
least.  A minor oops meant that the weeks mask was getting tossed into
the wrong field, and the mask was never populated.  The mask is 0x7 for
all three of these, thus overflowing the `data` array in settime by one
byte.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296719
Reported by:    jsm, "Tenkawa" on Discord
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D58182

Using if_getflags() to check IFF_DRV_RUNNING is wrong;
if_getdrvflags() is required.  This issue resulted in the
multicast filter not being updated.

This was an oversight by me in my initial port.

Thanks to danilo@ for reporting it and Oleg <oleglelchuk@gmail.com>
for the fix.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295176

Currently, devd emits events for external adapters only.

Send Netgraph init/disconnect events to devd so the internal adapter's
state could be asserted from userland.

(adrian - indentation changes.)

Signed-off-by: Kirill Orlov (-k) <slowdive@me.com>
Reviewed-by: adrian, imp
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2196

Matches tcpdump naming, but without getting more intense as you add more
-t.  This slightly reduces the post-processing needed on usbdump output
to diff two transactions.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58196

Introduce fdt_ether_get_addr() in fdt_common.c/h that tries standard
DT properties in the correct order and falls back to a random address
when needed. This should be used by ethernet drivers instead of open-coding
the same logic.

MFC after:      2 weeks

Reviewed by:    mhorne, adrian, bz, jrtc27
Differential Revision:  https://reviews.freebsd.org/D58104

When compiled without 'options RSS', the ena driver created taskqueues
using taskqueue_start_threads_cpuset passing a mask value of NULL,
both in the ena_setup_tx_resources path (for enqueues) and in the
ena_create_io_queues path (for the completion-processing).

In the default configuration, on most EC2 instances, this results in
taskqueues running in the right NUMA domain, but only by accident; in
non-default configurations (e.g. with with multiple EBS volumes
attached and associated NVMe taskqueues) the taskqueues may land in
the wrong NUMA domain even on instance types where the one-EBS-one-ENA
case produces the desired results.

Set (struct ena_que)->domain and use that to inform the choice of CPU
sets.  On a c8gn.48xlarge EC2 instance this doubles throughput on a
32-TCP-stream benchmark.

Reviewed by:    akiyano
MFC after:      7 days
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D57918

In the DEVX_SUBSCRIBE_EVENT handler the eventfd path can fail and
"goto err" before the subscription's xa keys and ev_file have been set;
they are still zeroed from kzalloc().  The cleanup then looks up a
level-1 xa entry with key 0, gets NULL, and faults dereferencing it.

Initialize the fields the cleanup path relies on right after the
subscription is allocated, before it is linked and before the fallible
fdget(), so a later failure unwinds cleanly.

Reviewed by: kib
Sponsored by: Nvidia networking
MFC after: 1 month

The DEVX_SUBSCRIBE_EVENT redirect path resolved the user's eventfd with
fdget(), which on FreeBSD only finds LinuxKPI files.  rdma-core creates
the eventfd with the native FreeBSD eventfd(2), so the lookup failed and
subscription returned EBADF; the delivery side likewise assumed a
LinuxKPI-pollable file.

Use the LinuxKPI eventfd_ctx API instead: eventfd_ctx_fdget() resolves
the native eventfd, eventfd_signal() notifies it, and eventfd_ctx_put()
releases it.  DEVX async events can then be delivered through a redirect
eventfd.

Reviewed by: kib
Sponsored by: Nvidia networking
MFC after: 1 month

Fixes:                https://cgit.freebsd.org/src/commit/?id=fc9dc8482396 ("snd_uaudio: Lock usbd_transfer_start() in uaudio_mixer_ctl_set()")
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296682
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

virtio: Add feature bit definitions up to VirtIO v1.3

Signed-off-by: Faraz Vahedi <kfv@kfv.io>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2319

virtio: Report feature masks on negotiation failure

Signed-off-by: Faraz Vahedi <kfv@kfv.io>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2319

virtio: Accept VIRTIO_F_RING_RESET in the modern PCI transport

Accept per-virtqueue reset when the device offers it, alongside
the V1 flag.  Negotiating the feature merely permits the use of
per-virtqueue reset and imposes no obligation on a driver that
never uses it, while refusing capability-only transport features
can make strict devices reject the feature set altogether.

No functional change on hosts that do not offer RING_RESET.

Signed-off-by: Faraz Vahedi <kfv@kfv.io>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2319

This is to prevent child drivers from using the features returned by
previous drivers (in an arbitrary order).  None of the existing ones do
that, so this is purely defensive.

MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation

This is needed for VM_PHYS_TO_PAGE() to work, which is needed for
pmap_map_io_transient() to work, which is needed for uiomove_fromphys()
to work.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296348
Reported and tested by: Anton Saietskii <vsasjason@gmail.com>
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58274

As RX processing is heavier than TX completions processing, swap the
order and process TX completions first, in order to avoid starving the
completions and causing potential missing TX completions.

Submitted by: Ofir Tabachnik <ofirt@amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58239

Move per-packet counter_enter/counter_exit pairs out of the RX
processing loop and batch them into a single update after the
loop completes.

Previously, each received packet triggered two separate
counter_enter/counter_exit blocks -- one for bytes and one for
packet count. This commit accumulates totals in local variables
and updates all four counters (ring and hw stats for both packets
and bytes) in a single counter_enter/counter_exit block after the
loop.

Also move the stats update to after the refill and LRO flush
so that the error path (goto update_stats) and the normal path
converge at the same label, avoiding code duplication.

Submitted by: David Arinzon <darinzon@amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58240

Sporadic 'Found a Tx that wasn't completed on time' warnings appear
under sustained TX load, always reporting '1 msecs since last cleanup'
despite the 5-second timeout threshold.

The per-packet TX timestamp uses struct bintime (128 bits: two 64-bit
fields sec and frac) which is read and written non-atomically. A race
exists between the missing TX completion check
(check_missing_comp_in_tx_queue reading the timestamp) and the TX
submit path or cleanup path writing it on another CPU. Since the two
fields are not updated atomically, the check can observe a partially
written timestamp - one field from the old value and one from the new.
This can produce a timestamp with {sec=0, frac=valid}, causing the
check to compute a time offset equal to system uptime and falsely
exceeding the 5-second timeout.

Confirmed by instrumentation showing all occurrences had sec=0 with
valid frac/mbuf, cleanup_running=0, and ticks==last_cleanup_ticks.

Replace struct bintime with sbintime_t (a single 64-bit value) for
tx_buf->timestamp. An aligned 64-bit store/load cannot be torn on
64-bit architectures. Additionally, snapshot the timestamp into a
local variable in the check path to prevent a read-then-read race
where the timestamp could be zeroed between the zero-check and the
offset calculation.

Testing:
On m6i.large (FreeBSD 15.0-RELEASE-p6 amd64, 2 IO queues), two
instances with MTU 1500. Ran iperf -P 20 -u -b 320kpps (CPU
saturated at ~7 Gbps aggregate).

Without the fix: 8 warnings in 6 hours (first at ~72 min).
With the fix: 0 warnings after 20+ hours under identical conditions.

Fixes: https://cgit.freebsd.org/src/commit/?id=9b8d05b8ac78 ("Add support for Amazon Elastic Network Adapter (ENA) NIC")
Submitted by: Gilad Ben Yakov <giladben@amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58241

Bug Fixes:
* Fix false 'missing TX completions' warnings due to timestamp race
* Put taskqueues into correct NUMA domain if !RSS

Minor Changes:
* Batch RX statistics updates
* Swap RX/TX completions cleanup order

Submitted by: Arthur Kiyanovski <akiyano@amazon.com>
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D58242

Added structure to allow multiple device to attach to the same driver.
Also removed the deprecation warning from the man page.

Differential Revision:  https://reviews.freebsd.org/D58201
Reviewed by:    adrian

Migrated fwcam to use per-unit-directory child device

Differential Revision:  https://reviews.freebsd.org/D58202
Reviewed by:    adrian

Migrated fwisound to use per-unit-directory child device

Differential Revision:  https://reviews.freebsd.org/D58203
Reviewed by:    adrian

Migrated fwdv to use per-unit-directory child device

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58204

SPL is a no-op on amd64. Real locking is already handled by fc_mtx and
per-driver mutexes.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58210

Otherwise we try to disable the wrong IRQ.

Fixes:          https://cgit.freebsd.org/src/commit/?id=47e073941f4e ("Import the kernel parts of bhyve/arm64")
MFC after:      1 week

Now that IRQs can properly be disabled by GICD_ICENABLERn, an EOI for a
disabled IRQ ends up being lost, since we don't assign it to a list
register and don't enable maintenance interrupts for such cases. As a
result, we keep the IRQ active, which stops it from ever being delivered
again (which would be true even if we supported the active and pending
state). Keep disabled but active IRQs around in list registers so we can
see the EOI having taken place in a future sync (noting that since we
already don't create list registers in active and pending state there
are no concerns with causing a disabled IRQ to be delivered).

Fixes:          https://cgit.freebsd.org/src/commit/?id=47e073941f4e ("Import the kernel parts of bhyve/arm64")
MFC after:      1 week

dpaa2_ni_init() only enabled the DPNI object; it never pushed the
promiscuous/allmulti state or the multicast filter table to the MC
firmware.  The SIOCSIFFLAGS handler ignores flag changes that arrive
while the interface is down, yet still latches them into sc->if_flags,
so a promiscuous mode request made before the first up was silently
lost and could never be applied afterwards: the up path runs
dpaa2_ni_init(), which did not read the flags, and every later
SIOCSIFFLAGS compares against the already-latched value and sees no
change.

This is exactly what happens when if_bridge adds a dpni member while
the dpni is still down, e.g. rc.conf's

    create_args_bridge0="... addm dpni0"

running at bridge clone time, before ifconfig_dpni0="up" is processed.
bridge_ioctl_add() puts the member into promiscuous mode at addm time;
the request never reaches the firmware, so the DPNI continues to
hardware-filter unicast destined to other MACs.  ifconfig still
reports PROMISC (a stack-level flag), which makes the failure
invisible: the host stays reachable only via the DPNI's own MAC
address (e.g. with net.link.bridge.inherit_mac=1), while bridged
epair/vnet jail traffic is silently dropped on RX.

Reapply both pieces of administrative state after enabling the DPNI,
as other NIC drivers do in their init path.  This also restores
multicast memberships joined while the interface was down.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292006
Reported by:    jhibbits

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    jhibbits
Differential Revision:  https://reviews.freebsd.org/D58330

This fixes a build break for i386.

Reviewed by:    kib, olce, Koine Yuusuke <koinec@yahoo.co.jp>
Fixes:  https://cgit.freebsd.org/src/commit/?id=87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Differential Revision:  https://reviews.freebsd.org/D58332

hwpstate_intel: Fix i386 build

Reviewed by:    olce
Fixes:  https://cgit.freebsd.org/src/commit/?id=7b26353a59d6
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58208

hwpstate_intel: Minimize ifdef for i386 build

Reported by:    jrtc27
Fixes:  https://cgit.freebsd.org/src/commit/?id=bdc0f7678257
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

aq(4): expand and correct offloads, fix VLAN/multicast filtering

Advertise the offloads the hardware already performs, correct the TX
descriptor's L3 family selection, and correct the VLAN and multicast
receive-filter paths.

Offloads: advertise IFCAP_HWCSUM_IPV6 (adding CSUM_IP6_TCP/UDP/TSO to
isc_tx_csum_flags) and IFCAP_VLAN_HWTSO, and enable the RX outer
(S-VLAN) tag parse mode in aq_hw_offload_set().

TX descriptor L3 family: aq_setup_offloads() derived tx_desc_cmd_ipv4
from CSUM_IP|CSUM_TSO, but CSUM_TSO is (CSUM_IP_TSO|CSUM_IP6_TSO) and
tcp_output() sets both bits without regard to address family, so an
IPv6 TSO frame matched on CSUM_IP_TSO and went out with the IPv4
header-checksum command set on a frame that carries no IPv4 header.
The checksum flags cannot distinguish the family; key the bit off
IPI_TX_IPV4 instead, which iflib derives from the parsed ethertype,
as the IPI_TX_INTR test below it already does.  Plain IPv6 checksum
offload was unaffected, as CSUM_IP6_TCP alone never matched the mask.

RX VLAN tag stripping: ring init hardwired hardware tag stripping off
while the RX path still set M_VLANTAG and the writeback tag for every
tagged frame, so a tagged frame arrived with the tag in line while the
mbuf claimed it stripped and ether_demux() parsed four bytes short of
the payload.  Program per-ring stripping from IFCAP_VLAN_HWTAGGING and
set M_VLANTAG only under the same capability, so the two states stay
coherent.

VLAN filter and promiscuous edge cases: filter only when 1..16 VLANs are
registered -- with none (or more than the 16 the table holds) fall back
to VLAN-promiscuous and pass all tags, rather than dropping every tagged
frame against an empty filter table; and keep VLAN-promiscuous set
whenever the interface is IFF_PROMISC, so adding or removing a VLAN under
promisc does not clear it and start dropping tagged frames.

Multicast reconcile: ifdi_multi_set is declarative, but aq_if_multi_set()
only added -- shrinking the list left accept-all-multicast latched or
stale exact slots enabled, defeating hardware multicast filtering until
a reinit.  Clear the exact slots before reprogramming the current list,
and always drive accept-all-multicast from the current state so a shrink
clears it.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58145

aq(4): drop errored RX frames instead of resetting the interface

aq_isc_rxd_pkt_get() returned EBADMSG when a receive descriptor's
MAC/receive-error bit (rx_stat bit 0) was set.  iflib treats any error
from isc_rxd_pkt_get() as a fatal ring fault and answers with
IFC_DO_RESET -- a full interface reinitialization.  A per-frame receive
error is not a ring fault: on a marginal link or cable the Atlantic
delivers errored frames continuously, so each one triggered another
reset and the interface reset-stormed itself into carrying no traffic
instead of merely dropping the bad frames.

The Atlantic delivers errored frames to the host by design (Linux drops
them in software via buff->is_error), and iflib offers no per-frame
error return that isn't a reset.  Follow the vmxnet3 model: on a receive
error zero the fragment lengths and return success.  iflib then discards
the packet (assemble_segments() excludes zero-length fragments) while
still recycling the descriptors through the refill path -- no reset.
Also drop frames flagged with an RX-DMA fault (rdm_err), not just the
MAC-error bit; and keep iri_len non-zero on that drop path, since iflib
asserts iri_len != 0.

The genuinely structural errors -- more segments than isc_rx_nsegments,
or a pkt_len inconsistent with the descriptor count -- still return
EBADMSG, since those indicate a confused ring where a reset is the right
recovery.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58136

aq(4): honor the kernel RSS policy and add a TX traffic-class helper

Align RX steering with the kernel RSS framework and factor out the
active-traffic-class count.

RSS key and indirection table: on an options RSS kernel the stack owns a
canonical hash key and a hash-to-bucket indirection table binding each
bucket to a CPU.  aq programmed a random arc4rand() key and a plain
i % rss_qs table, so the hash it stamped in iri_flowid and the queue it
steered a flow to did not match the CPU the stack chose -- defeating RSS
affinity.  Under #ifdef RSS take the key from rss_getkey() and each entry
from rss_get_indirection_to_bucket(), as e1000/ixgbe/ixl do; the non-RSS
build keeps the random key and round-robin table.

RSS hash-type policy: drop the private hw.aq.enable_rss_udp knob (RDTUN,
default on) and add aq_rss_hashconfig(), which under options RSS returns
rss_gethashconfig() and otherwise the same UDP-off default.  UDP 4-tuple
hashing scatters a fragmented datagram's pieces across queues because
only the first fragment carries the L4 ports, so it is now off by default
and re-enabled the standard way, via net.inet.rss.udp_4tuple, matching
ix/ixl/mlx5.  On Atlantic 1 the UDP-off action stays the existing L3L4
flow-filter workaround; only its policy source changes.

TX traffic-class helper: factor the active-TC count (one per active
8-ring group, capped at HW_ATL_B0_TCS_MAX) out of aq_hw_qos_set() into
aq_hw_active_tcs(), so there is a single definition of the policy; the
Atlantic 2 RSS redirection table reuses it.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58137

aq(4): harden the attach, detach, and reset error paths

Correct several attach/detach/reset paths that either swallowed failures
or acted on undefined state.

MSI-X attach-failure double-free: aq_if_msix_intr_assign() freed the
per-RX-ring interrupts in its failure path and then returned an error, so
iflib's IFDI_DETACH freed the same irq structures again --
bus_teardown_intr() on a dangling tag and bus_release_resource() on an
already-released IRQ, panicking a box that should have simply failed to
attach.  Let iflib own the teardown; drop the failure-path loop and the
now-dead index bookkeeping.

Detach loop bound: aq_if_detach() freed the per-ring interrupts looping
to isc_nrxqsets while indexing rx_rings[], which is sized by
rx_rings_count; index by rx_rings_count to match every other RX-ring
loop.

AQ_HW_WAIT_FOR final poll: the macro derived its result from the loop
counter rather than the condition, so a condition that became true on the
last iteration reported ETIMEDOUT.  Worst for the acquire-on-read
firmware RAM semaphore, which was acquired in hardware but reported as a
timeout.  Return based on the last evaluation of the condition.

RBL MAC reset SPI cleanup: mac_soft_reset_rbl() fired the global reset
without first tearing down the SPI/flash interface, so a flash burst in
flight left the SPI bus wedged, the RBL could not re-read flash, and the
reset returned EBUSY -- fatal at attach ("MAC reset failed: 16").  Set
bit 4 of the SPI control register (0x53c) before the global reset, as the
sibling FLB path and the Linux driver do.

Reset failure propagation: aq_hw_reset() discarded fw_ops->reset()'s
return, so a failed attach-time fw2x capability read left fw_caps == 0
permanently and stats silently froze.  Propagate the error so the reset
fails and is retried.

aq_hw_init failure propagation: aq_hw_init() discarded
aq_hw_init_tx_path()/aq_hw_init_rx_path() returns and reported success,
bringing the interface up half-initialized; capture both and goto
err_exit (mainly the Atlantic 2 RX action-resolver path, which returns
EBUSY on ART semaphore timeout).

Link-state outputs: aq_hw_get_link_state() left *link_speed and *fc_neg
unwritten on early-return paths, and the caller acts on them
uninitialized, so a transient firmware get_mode() failure could fabricate
a phantom link-up at a garbage speed and program a garbage RX-pause bit.
Initialize both to safe link-down values before calling get_mode().

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58138

aq(4): harden the interrupt and MAC-statistics paths

Firmware-statistics accounting and interrupt-routing fixes.

Stats delta underflow: guard the MAC statistics delta accumulation
against counter wrap or a firmware counter reset, so a snapshot smaller
than the previous one does not underflow into a huge spurious delta.

Skip stats on a failed read: aq_update_hw_stats() ignored
aq_hw_mpi_read_stats()'s return and committed the on-stack mbox into
last_stats unconditionally.  On a failed read that snapshot is garbage or
zero and poisons the delta baseline (a zeroed snapshot wipes last_stats,
so the next good read double-counts).  Check the return and skip the
accumulation and the last_stats commit on failure.

Mailbox/stats separation: struct aq_hw_stats served both as the raw fw1x
MCP mailbox layout and as the driver's canonical stats snapshot, so any
field added to it would silently shift the fw1x mailbox read.  Give the
fw1x mailbox its own raw layout in struct aq_hw_fw_mbox and let
aq_hw_stats become purely driver-owned; with the coupling gone, add
first-class aggregate octet fields (brc/btc) that Atlantic 2 B0 firmware
can populate directly.  No A1 behavior change.  The raw block is a named
struct (aq_fw1x_mbox_stats) with a _Static_assert tying its size to
aq_hw_stats' matching prefix, so the fw1x memcpy cannot silently misalign
if either field list drifts.  Also drop the unused FW1X_MPI_STATE_ADR /
FW1X_MPI_CONTROL_ADR macros and the redundant fw1x_get_stats() dpc
assignment that the caller immediately overwrites.

Per-speed interrupt moderation: aq_hw_interrupt_moderation_set()
hardcoded speed_index = 0, so every link speed got the 10G timer pair and
the other rows were dead.  Record the negotiated rate and index the
tables by ffs(speed) - 1, reordering the rows to match the
enum aq_fw_link_speed bit positions so the index cannot drift from the
enum.  Rename the two per-speed timer tables (AQ_HW_NIC_timers_table_
{rx,tx}_ -> aq_itr_timers_{rx,tx}), function-local static arrays whose
SCREAMING_CASE vendor names read like macros.

Hardware error interrupts: route both hardware error causes (interrupt
map register 0) to the admin vector so they are actually delivered.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58139

aq(4): remove dead code and tidy macros, diagnostics, and naming

Non-functional cleanup, with two diagnostic corrections.

Dead code: delete leftover commented-out AQ_DBG_ENTER/EXIT/PRINT calls
(aq_hw.c, aq_fw2x.c, aq_irq.c, aq_main.c), a commented-out aq_nic_cfg
local, the stale old-signature parameter blocks between the ring-init
declarations and their bodies (aq_ring.c), a trailing note on a live
statement, and the unused DumpHex() vendor debug helper (no callers; its
body only compiled under AQ_CFG_DEBUG_LVL > 3).

Register-write macros: parenthesize AQ_WRITE_REG_BIT's msk/shift/value
arguments so a compound argument cannot mis-bind, give AQ_HW_FLUSH() an
explicit hw parameter instead of capturing it from caller scope, and drop
the duplicate lowercase aq_hw_write_reg[_bit] aliases (converting the 43
call sites to the uppercase spelling) so there is a single form.

Diagnostics: the aq_log* family expanded through the base log macro, which
ignored its level and printed unconditionally, while the error traces
gated on a debug level that defaulted below LOG_ERR and so were suppressed
-- backwards.  Gate the base log macro the way the trace one does and
default the level to lvl_error, so the once-per-event firmware reset /
capability errors are visible by default while the verbose info/dump
output stays opt-in.

Naming: rename identifiers carried verbatim from the vendor import that do
not match style -- names mixing an ALL-CAPS macro-style prefix with a
lowercase tail, and a trailing underscore the vendor used as a
"file-local" marker in place of static.

- dbg_level_ / dbg_categories_ -> aq_dbg_level / aq_dbg_categories: these
  are real globals (the log/trace macros reference them from every
  translation unit), so the trailing underscore was never a stand-in for
  static; give them the aq_ namespace so the driver stops exporting
  generically-named global symbols.
- log_base_ / trace_base_ -> aq_log_base / aq_trace_base: the internal
  macros behind the aq_log*/trace* families.
- bootExitCode / flbStatus -> boot_exit_code / flb_status (aq_fw.c);
  flb_status now matches the identically-purposed variable already spelled
  that way in the sibling FLB-reset path.

Cosmetic: terminate the ring/HW-init, MSI-X admin-handler, and
media-change error messages with a newline so they are not garbled into
adjacent dmesg output, and label the per-queue rx_bytes sysctl "RX Octets"
(it was copy-pasted "TX Octets").

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58140

aq(4): add Atlantic 2 (AQC113) device support

Add support for the Marvell Atlantic 2 (AQC113/114/115/116) controllers,
a new chip generation that is not register-compatible with the Atlantic 1
parts aq(4) supports today.  Adapted from the OpenBSD/NetBSD if_aq driver.

Register and device definitions (aq2_hw.h): the firmware handshake
(MIF_BOOT / MCP_HOST_REQ_INT / MIF_HOST_FINISHED), the 0x12000/0x13000
firmware interface windows, and the action-resolver table (ART) that
replaces Atlantic 1's discrete RX filters, plus the Atlantic 2 PCI device
ids and the aq_is_atlantic2() helper.  Reserve a chip-feature bit
(AQ_HW_CHIP_ATLANTIC2) and add the aq_hw fields the firmware fills at boot
(ART base index, statistics interface version A0/B0).  The per-VLAN-filter
resolver-tag field comes from the Linux driver; the BSD sources never
write it.

Firmware operations (aq_fwa2.c): Atlantic 2 talks to the management CPU
through the 0x12000/0x13000 register windows plus the boot handshake,
rather than Atlantic 1's mailbox in shared RAM.  Implement that as a third
aq_firmware_ops vtable (reset, set_mode, get_mode, get_mac_addr,
get_stats); aq_fwa2_reboot() boots the firmware, selects the A2 ops, and
reads the version and ART base index, failing fast on the
crash-init / boot-failed bits.  fwa2_set_mode advertises full duplex only
(the media model exposes no half-duplex types) and writes and acks the
link options before raising ACTIVE mode, so a forced media change does not
begin negotiation with a stale rate mask.  enum aq_fw_link_speed gains
aq_fw_10M, which Atlantic 2 supports and Atlantic 1 does not.

Probe and attach: list the device ids with their media types and link
speeds (all copper; AQC113* up to 10G, AQC116C to 1G), populate
hw->device_id, and tag the generation with AQ_HW_CHIP_ATLANTIC2 so
IS_CHIP_FEATURE() recognises it uniformly.  Branch firmware bring-up and
reset on the generation: aq_hw_init_ucp() and aq_hw_reset() reboot the MCP
instead of the Atlantic 1 RBL/FLB reset -- without a real datapath reset
every stop/init cycle reprograms the rings on a live, desynced RX DMA
engine and the receive path stays dead.  aq_hw_init() programs the
Atlantic 2 launch-time clock ratio in place of the Atlantic 1
MRRS / TX-DMA request-limit clamp.  Add an AQ_LINK_10M capability bit
(Atlantic 2 links at 10M, Atlantic 1 cannot), offer 10baseT media, and map
IFM_10_T to aq_fw_10M.

With every supported media type now present, replace the per-speed switch
statements in aq_media.c with a single {link bit, fw rate, IFM_* subtype,
Mbit/s} table -- one source of truth for the supported link speeds.

With this an Atlantic 2 card probes, brings up its firmware, reads its
MAC, and negotiates link; the RX action-resolver datapath comes next.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58141

aq(4): program the Atlantic 2 multiqueue datapath

Wire up the Atlantic 2 receive datapath: the action-resolver table (ART),
multiqueue RSS, QoS, and interrupt moderation.

RX action-resolver table: Atlantic 2 replaces Atlantic 1's discrete RX
filter registers with an ART -- hardware computes a per-packet
classification tag, then walks {tag, mask, action} rows to drop, assign a
queue, or assign a TC.  aq_hw_art_filter_set() installs one row under the
ART semaphore; aq_hw_init_rx_path() enables the resolver, tags L2
unicast/broadcast, installs the unicast/all-multicast and VLAN drop rows,
and assigns every 802.1p priority to TC 0 (mirroring the Atlantic 1
user-priority map, since our RX side is a single 8-ring group in TC 0).
Tag every enabled VLAN filter in the per-filter resolver-tag field -- a
register the BSD ports never write -- because the VLAN drop row matches
resolver tag 0, so without it all tagged receive was dead under VLAN
filtering.  Promiscuous mode disables the drop rows rather than toggling
the Atlantic 1 promiscuous bits; all ART callers surface a semaphore
timeout consistently.  The Atlantic 1 RX_TCP_RSS_HASH and TPO2
programming is gated to Atlantic 1.

Multiqueue RSS and QoS: fill Atlantic 2's own per-TC redirection table
(AQ2_RPF_RSS_REDIR), skipping the Atlantic 1 table and its write-enable
handshake.  Program Atlantic 2's smaller packet-buffer sizes, its wider
data-TC credit/weight fields, and its ring-to-TC map, using
aq_hw_active_tcs() for the TC loops.

RSS hash types: the Atlantic 2 resolver has per-protocol hash-type enables
in REDIR2, so build the mask from aq_rss_hashconfig() instead of
hardcoding every protocol -- UDP 4-tuple hashing now follows the kernel
policy (off by default) with no L3L4 flow-filter workaround, and
aq_hw_udp_rss_enable() is skipped on Atlantic 2.  The kernel-to-hardware
hash-type mapping is a small static lookup table rather than a nine-branch
chain, since the two bit spaces do not share a simple shift.

Tx interrupt moderation: Atlantic 2's per-ring Tx moderation control
register lives at a different address, but its field layout matches the
value the driver already builds, so write that value straight to it; Rx
moderation is shared.

HW-validated on AQC107 <-> AQC113C: TCP RSS spreads across 7/8 RX queues
under 16 parallel flows, rx_err=0.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58142

aq(4): correct Atlantic 2 register access

Four Atlantic 2 register-access corrections found in bring-up.

B0 aggregate octet counters: the B0 firmware statistics interface reports
only aggregate rx/tx good octets, not the per-cast breakdown A0 and
Atlantic 1 provide, so every octet sysctl read a permanent zero while
frame counters advanced.  Populate the aggregate octet fields from the B0
buffer; aq_update_hw_stats() accumulates them directly when the per-cast
octets are absent.

Drop the duplicate attach-time MCP reboot: aq_hw_mpi_create() already
reboots the A2 firmware to read its version and caps, then aq_hw_reset()
immediately rebooted it again -- a full MCP restart plus several
transaction-id-bracketed window reads, adding attach latency and a
duplicate banner.  Give aq_hw_reset() a reboot flag and pass reboot=false
for A2 at attach; the load-bearing down/stop reboot (which resyncs A2 RX
DMA across ifconfig down/up) keeps reboot=true.

Skip Atlantic 1 register accesses on Atlantic 2: gate out the 0x7040
Atlantic 1 TPO write (which A2 lacks; already a no-op via the unset TPO2
feature, but Linux hw_atl2 omits it), and guard the
aq_hw_mpi_read_stats() direct reads of reg_rx_dma_stat_counter7 (dpc) and
the LRO counter (cprc) with !ATLANTIC2 -- those are Atlantic 1 codegen
offsets that on Atlantic 2 land on unrelated registers and can report
bogus input-drop / LRO counts.

HW-validated on AQC107 <-> AQC113C: A1 stats unchanged, A2 IQDROPS stays
0, attach consumes one MCP reboot instead of two, bidirectional iperf3
clean.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58143

aq(4): observability controls and sysctl/header hygiene

Fold the driver's observability and infrastructure work.

Make aq_device.h self-contained: it declares struct aq_dev in terms of
iflib, bitstring, socket, and ethernet types but included none of the
headers that define them, compiling only because every includer happened
to pull those first.  Include what it uses.  No functional change.

Make the debug controls per-instance.  The debug and debug_categories
sysctls were registered per device but pointed at file-scope globals, so
writing dev.aq.1.debug also changed dev.aq.0.debug and a card could not
be traced in isolation.  Move the level and category mask into struct
aq_dev, reach them through the aq_dev back-pointer in struct aq_hw (wired
up in attach_pre before the first firmware trace and guarded against a
NULL deref), emit through device_printf() so each line carries its unit,
and seed initial values from per-unit device hints so attach can be
traced.

Expose the PHY die temperature as dev.aq.N.temperature through a new
firmware get_temp op: Atlantic 1 v2 reads it through the mailbox MPI
control/state toggle, Atlantic 2 from the phy_health_monitor block in the
OUT window (located at 0x13620 and confirmed by its ready bit).  Atlantic
1 v1 has no sensor and exposes no node.  Because this is the first
firmware accessor iflib does not serialise, add a per-instance mutex in
struct aq_hw and take it across the v2 read-modify-write in set_mode(),
get_stats(), get_mode(), and get_temp(); the v1 and Atlantic 2 paths do
not need it and say so.

Trace the Atlantic 2 firmware path, which previously emitted nothing at
any debug level (aq2_fw.c did not even include aq_dbg.h): the boot
handshake, reset policy, MAC address, and link mode set/read, using the
existing dbg_init and dbg_fw categories, with the per-poll mode read at
detail level.

Scope the driver sysctls to a context freed at detach.  They were
registered on the device newbus context, which newbus tears down only
after DEVICE_DETACH returns, yet iflib frees the rings and softc inside
DEVICE_DETACH -- a sysctl read racing detach could touch freed memory.
Give the driver its own sysctl_ctx_list and free it at the start of
aq_if_detach, draining in-flight readers first.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58434

aq(4): PHY thermal-shutdown handling and correctness fixes

Fold the thermal-protection work and the correctness fixes that landed
alongside it.

Report and auto-recover from PHY thermal shutdown.  The Atlantic PHYs can
autonomously shut down on over-temperature, latching global fault 0x8007
and dropping the link; Atlantic 2 ships this armed, Atlantic 1 disabled.
Arm it on Atlantic 1 at interface init (1E.C478.A via the MAC's MDIO
controller), and recover from a trip automatically: the admin-status poll
detects the fault, logs the shutdown limit and measured temperature, and
holds the link down until the PHY cools, then restores it -- Atlantic 1
needs a PHY reset (1E.2681.0) with the MAC firmware running plus a full
re-init, Atlantic 2 recovers on the re-init alone.  New firmware ops
get_phy_fault, phy_reset, thermal_arm, and get_thermal_limit back the
state machine in aq_if_update_admin_status().

Make that Atlantic 1 thermal MDIO path address-correct and fail-safe.
The direct-MDIO helpers hardcoded the Clause-45 port address to 0, but it
is strap-selectable: on a board whose PHY answers elsewhere every thermal
op targeted nothing, so arming silently no-oped and the post-trip reset
never cleared the latch.  Discover the address by scanning ports 0..31
for a PMA/PMD identifier and form it as (phy_id << 5) | mmd, marking it
valid only when a PHY actually answers.  aq_fw2x_phy_read also returned 0
on a semaphore timeout, indistinguishable from a real 1E.C478 == 0, so
thermal_arm could zero live provisioning bits; give the read an error
return and gate thermal_arm and get_thermal_limit on it.

Bound the multicast filter slot index.  aq_mc_filter_apply() programmed
slot count + 1 and bailed only at count == AQ_HW_MAC_MAX (33), one
address too late, so a 33rd entry raced in between the if_llmaddr_count()
snapshot and the if_foreach_llmaddr() walk drove an out-of-bounds MMIO
write to slot 33.  Fire the guard at AQ_HW_MAC_MAX - 1, and also reject
index >= AQ_HW_MAC_MAX in aq_hw_mac_addr_set() where the slot becomes an
RPF register offset.

Correctness and safety fixes: initialize the sysctl context in
attach_pre so the iflib fail-path detach cannot sysctl_ctx_free() an
uninitialized list (a page fault when MSI/MSI-X is denied); range-check
the Atlantic 2 action-resolver table index, taken verbatim from a
firmware-supplied base, before writing the ART registers; and accumulate
statistics deltas as unsigned, since AQ_SDELTA discarded a forward delta
of 2^31 or more at 10G across a stretched admin poll.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58435

aq(4): clean up diagnostics and remove dead code

Non-functional cleanup, no change in behavior.

device_printf() already prefixes each line with the device name, so the
inline "atlantic:" token in the status and error messages produced a
doubled prefix and diverged from the trace macros; remove it so all
output carries one uniform "aqN:" prefix.  Compile the RX/TX descriptor
tracers only when AQ_CFG_DEBUG_LVL > 2 and make them no-op macros
otherwise, so the default build no longer pays a cross-TU call plus
argument evaluation per descriptor.

Drop enum aq_dev_state, struct aq_rx_filters, and struct aq_vlan_tag,
which have no remaining references now that VLAN state lives in a
bitstr_t.  Replace the four identical aq_sysctl_print_{tx,rx}_{head,tail}
handlers, each carrying a dead write path on a read-only oid, with one
aq_sysctl_print_ring_ptr that selects the accessor from arg2.  Reduce the
thermal and PHY-recovery comments to single terse lines that keep the
load-bearing register numbers and the A1-vs-A2 recovery difference.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58436

aq(4): mailbox, flow-control and firmware error-handling fixes

Fold the whole-driver-review correctness and hardening fixes for the
firmware and hardware layers.

Advance the firmware-mailbox address per word in aq_hw_fw_downld_dwords():
on B1 silicon each loop iteration waits for the mailbox address register
to differ from the expected address, but it was set once and never moved,
so after the first word every wait returned immediately and read stale
data.  Advance it four bytes per word.  B0 is unaffected (it polls the
busy bit).  The same function also left err set to ETIMEDOUT after
successfully force-recovering the RAM CPU semaphore; the transfer loop is
guarded by "--cnt && !err", so it ran zero iterations and returned a
timeout with an untouched buffer, making the recovery path dead code.

aq_hw_get_mac_permanent() ignored the get_mac_addr() error and then
examined a buffer the firmware op never wrote on failure.  A fresh softc
is zero, so the "invalid address" test fired, a random locally
administered MAC was substituted, and err was overwritten with 0 -- a
transient mailbox failure produced a card that attached with a different
MAC every boot.  Fail instead; the random-address fallback still covers a
genuinely blank or multicast burned-in address.  aq_fw1x_reset()
discarded the same download's return value and then read transaction_id
out of an uninitialized stack struct, so propagate that error too.

Encode RX-only flow control as PAUSE|ASYM_PAUSE rather than PAUSE alone:
firmware 2.x/3.x has no independent RX-only bit, so the old encoding
advertised symmetric pause when RX-only was requested.  The MPI_INIT path
also never cleared the pause bits before OR-ing in the requested ones, so
flow control could be enabled and never disabled; clear them first, as
the Atlantic 2 and Linux implementations do.

Reject single-vector MSI in aq_if_attach_post() the same way legacy INTx
is rejected: ift_legacy_intr is NULL, so no driver filter would
acknowledge the not-clear-on-read, auto-masked device interrupt status;
every supported Atlantic device provides MSI-X.

Propagate firmware and MDIO errors instead of discarding them.  The fw2x
MDIO primitive returned a data word with no way to report a controller
timeout; give aq_fw2x_mdio_op() a status return and a data out-parameter,
propagate it through phy_write/read/reset/thermal_arm, and stop advancing
the thermal recovery state machine when a PHY reset fails.  Use that
error to end the PHY address scan early: aq_fw2x_init_phy_id() probed all
32 MDIO ports even when the controller itself was timing out, spending up
to ten seconds under fw_mtx and the iflib context lock.  aq_fw2x_reset()
also drove the shared MIF mailbox without fw_mtx, unlike every other fw2x
mailbox user, so it could interleave with the temperature sysctl and load
the capability mask from the wrong window.

aq_hw_mpi_set() can return ETIMEDOUT when the Atlantic 2 shared firmware
buffer is not acknowledged; aq_hw_init() now aborts through its error
path rather than enabling rings with an unaccepted link state, and
aq_if_init() logs the later link-speed error.

Retry a failed initialization instead of leaving the link down.  ifdi_init
has no return value, so iflib marks the interface running once aq_if_init()
returns; a propagated firmware-ack failure would otherwise leave it running
with no initialized hardware and no recovery.  Record the failure and retry
from the admin task via iflib_request_reset(), paced by the once-per-second
timer, giving up after a bounded number of attempts.  Ring and queue start
failures are deliberately left to the existing diagnostic, since they leave
the remaining queues usable.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58437

aq(4): interface lifecycle and link-state fixes

aq_if_init() programmed the address captured at attach, so an address set
with "ifconfig ether" or by lagg(4) enslavement was never written to
unicast filter slot 0: the interface transmitted with the new address but
the MAC still filtered on the old one, so it received nothing.  Copy the
current if_getlladdr() the way the other iflib drivers do.

The link state could latch UP forever.  aq_if_stop() cleared linkup
before calling aq_if_update_admin_status(), which suppressed the
LINK_STATE_DOWN transition the "link was UP" branch would have made.
Announce the down transition directly from aq_if_stop() instead, and do
not poll the admin status there at all: the MAC has just been reset, so a
stale link reading would re-announce the link as up.

The admin task itself had to stop reporting a link on a stopped
interface.  iflib runs it while either IFF_DRV_RUNNING or IFF_DRV_OACTIVE
is set, and iflib_stop() sets OACTIVE, so the task kept polling after the
stop and re-announced LINK_STATE_UP behind the driver's back.  Treat a
non-running interface as having no link.  A lagg(4) parent otherwise
keeps hashing flows onto a port whose carrier is gone, because
LAGG_PORTACTIVE tests if_link_state together with IFF_UP.  Stop the rest
of the task there as well: the PHY thermal poll and the initialization
retry both end in iflib_request_reset(), and _task_fn_admin() acts on
that with no test of its own, so either could re-initialize an interface
the operator had just taken down.

aq_if_update_admin_status() also only reacted to transitions in and out
of zero speed, so an autoneg downshift that kept the link up left
if_baudrate, ifmedia, RX pause and interrupt moderation programmed for
the old speed.  Track the announced speed and re-run that work when it
changes.

aq_if_suspend() resets the MAC and stops the rings, but
iflib_device_suspend() only calls IFDI_SUSPEND and never stops the
interface, leaving IFF_DRV_RUNNING set over a suspended device.  Clear it.

Signed-off-by: Nick Price <nick@spun.io>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58473

re(4): quiesce RTL8168G+ and reset before freeing buffers in re_stop()

The STOPREQ command written by re_stop() is not defined for
RTL8168G and later; issuing it can wedge the MAC.

Replace it on those parts with the vendor-documented sequence:

* settle delay
* bounded poll for Tx queue empty
* clear TE/RE
* then bounded poll of the MCU command register (0xD3) FIFO-empty bits.

Also reset the controller before the Rx/Tx buffer free: a controller that
has not quiesced keeps DMAing stale, still-owned descriptors pointing at
freed mbufs (use-after-free under INVARIANTS, cross-NIC mbuf corruption
reported in the PR).

Adds the RL_MCU_* register definitions.

All waits are bounded; error paths only.

* iperf3 --bidir at line rate against RTL8168H (XID 0x541);
  previously wedged the controller until power cycle, with the
  quiesce the reset path recovers.

* Deployed in production on an RTL8168H fleet since 2026-07-01.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58276
PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=166724

re(4): re-arm the Tx doorbell when re_txeof() leaves a non-empty ring

On PCIe parts a TxPoll request can be lost when packets are queued
in quick succession, leaving owned descriptors with no transfer in
progress until the watchdog fires. re_txeof() runs from the interrupt
handlers, re_tick() and re_watchdog(), so re-writing TXSTART whenever
the ring is still non-empty turns a potential 5-second stall into at
most one tick.

One register write on a path that already took an interrupt;
fast path untouched.

* Sustained bidirectional load on RTL8168H; no Tx stalls, no throughput
  regression at 941 Mbps line rate.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58277
PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=166724

re(4): recover Tx completions whose MSI was swallowed in re_intr_msi()

A Tx completion that raises a status bit between the ISR ack at the top
of re_intr_msi() and the IMR re-enable at the bottom is never re-signalled:
these controllers do not re-assert MSI for an already-set status bit
(this is why hw.re.msi_disable is a known workaround in the PR).

Re-read ISR before re-enabling; if a Tx bit is pending, ack just that bit,
reap the ring and restart the queue. Rx bits are deliberately left set so
they re-arm the interrupt normally and Rx moderation state is untouched.

Also flush the posted IMR write. Mirrors what the INTx path already
achieves via the loop in re_intr().

* MSI interrupt mode on RTL8168H under load; "missed Tx interrupts"
  watchdog recoveries no longer occur.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58278
PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=166724

re(4): harden re_watchdog() recovery and log controller state

Distinguish the two failure classes from the PR in a single log line
(ring indices, ISR/IMR, TXCFG, interrupt mode): lost interrupt vs
genuine DMA stall.

Bail out instead of re-initializing when the controller reads back
all-ones (fallen off the bus; reinit cannot help).

Re-assert the driver's existing ASPM-disabled policy before reinit,
since firmware/power transitions re-arming L0s/L1 is a documented
stall trigger.

Diagnostics-only on the recovered path; no fast-path change.

* Field diagnostics running on an RTL8168H production fleet; the log
  format distinguishes lost-doorbell / DMA-stall / dead-controller
  without a debug build.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58279
PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=166724

re(4): add hw.re.aspm_disable loader tunable

re(4) has unconditionally disabled ASPM L0s/L1 and CLKREQ at attach
for years; on laptops this costs 200mW+ (requested by adrian@ in the PR).

Make it a tunable following the existing hw.re.* pattern:

* default 1 keeps today's behavior;
* 0 preserves the firmware-configured ASPM state at attach and
  skips the watchdog re-assert from the previous revision.

Documented in re.4.

* Verified on RTL8168H (XID 0x541): with hw.re.aspm_disable=0,
  attach no longer logs "ASPM disabled" and pciconf -lcb shows
  the firmware Link Control state preserved -- including Clock PM,
  which the unconditional code previously cleared.

* Default (1) is behaviorally identical to the current driver.

* Note the tunable also stops the driver clearing CLKREQ, a small power
  win even where firmware leaves L0s/L1 off.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58280
PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=166724

Provide pc_small_core for i386 too to fix an i386 build break from x86
code referring to it.  It won't be set.

Reviewed by:    aokblast, kib
Fixes:  https://cgit.freebsd.org/src/commit/?id=7b26353a59d6 ("hwpstate_intel: Disable package control on hybrid CPU")
Differential Revision:  https://reviews.freebsd.org/D58335

bus_{read,write}_8 are macro wrappers around the corresponding bus_space
functions in sys/bus.h, so implementing bus_{read,write}_8 won't work.
Implement the underlying bus_space function instead.

Reviewed by:    jrtc27, rlibby
Fixes:          https://cgit.freebsd.org/src/commit/?id=9313f6b01485
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58301

The accumulated count of a process-mode counting PMC is kept in a
64-bit software counter and seeded into the hardware counter at every
context switch in.  Hardware counters are narrower than that - each
PMC class discovers and records its own counter width, e.g. 48 bits
on current x86 (queried from CPUID on Intel, architectural on AMD) -
so once the accumulated count approaches the end of the hardware
counter range, the counter wraps during a time slice and the value
read back at switch out is smaller than the value seeded.  The
increment was computed assuming a full 64-bit counter: on INVARIANTS
kernels a long enough counting run panics with "negative increment"
the moment the accumulated count first crosses the hardware counter
range, and on other kernels the totals silently lose a full counter
range per wrap.

Compute the increment modulo the per-class hardware counter width
instead, in both places that accumulate switch-out deltas.

Reviewed by:            adrian
MFC after:              2 weeks
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58340

A process-mode PMC's runcount tracks how many CPUs currently have it
loaded in hardware.  It is decremented only by the context-switch-out
and process-exit reclaim paths, both of which the scheduler invokes
only for processes flagged P_HWPMC.  Detaching a target that still has
the PMC live in hardware dropped the target and cleared P_HWPMC without
taking the PMC off the hardware or dropping the runcount reference, so
the reference leaked.  A subsequent release then spun in
pmc_wait_for_pmc_idle() forever waiting for the runcount to reach zero:
on an INVARIANTS kernel this panics ("waiting too long for pmc to be
free"), otherwise it is an unkillable loop holding the hwpmc lock.  Any
process able to allocate a PMC can trigger this by attaching a counting
PMC to itself and detaching it before releasing.

Take the PMC off the hardware and drop the runcount reference as part
of detaching, before P_HWPMC is cleared: reclaim it from the detaching
thread's own CPU directly, and, when the detach removes the PMC's last
target, wait for any references held by the target's other threads to
drain while P_HWPMC is still set (they can no longer reload it).

Reviewed by:            adrian
MFC after:              2 weeks
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58342

Some UVC devices (e.g. Logitech C920) expose more than 8 Processing
Unit descriptors, causing "too many PU descriptors found!" errors.
Increase both limits from 8 to 32 to accommodate such devices.

Import the device quirk system from OpenBSD to handle UVC devices
that need special handling. This includes:

- UVIDEO_FLAG_ISIGHT_STREAM_HEADER: non-standard streaming header
- UVIDEO_FLAG_REATTACH: needs reattach after firmware upload
- UVIDEO_FLAG_VENDOR_CLASS: incorrectly reports as vendor class
- UVIDEO_FLAG_NOATTACH: device not supported
- UVIDEO_FLAG_FORMAT_INDEX_IN_BMHINT: format index in bmHint

Add quirks table with known devices and lookup function.
Add iSight stream header decoder for Apple iSight cameras.

Obtained from:  OpenBSD

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56005

A bunch of drivers weren't properly converted.  I mistakenly
put a call to ieee80211_output_seqno_assign() wherever the
crypto header was added, which isn't exactly correct.
There are plenty of drivers which don't share enough of their
raw and normal transmit path code for that to hold true.

So after some manual review, it looks like I've captured the
places (outside of iwn(4) which I committed earlier) where
I missed ieee80211_output_seqno_assign() calls.

* For bwi(4) and bwn(4) I refactored it out into a place that is
  common enough and happens in the same lock hold window,
  so it's serialised.

* For the rest, it's just plain missing from the raw path.

Locally tested:

* ural(4)
* ral(4)
* bwi(4)

Differential Revision:  https://reviews.freebsd.org/D58098

firewire: add warn-only CRC validation for CSR ROM directories

Implemented crom_crc_valid() helper to validate IEEE 1394 config ROM CRC-16
checksums.

Skipped root header CRC validation since csrhdr.crc_len cover the entire
ROM body which is not fully read at header parse time. Per-directory
CRC checks below catch corruption where it needed.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58307

firewire: drain pending xfers after callout stop in detach

Removes a TODO that predates the existing drain call.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58308

firewire: force root change when root node is not cycle master capable

When a FireWire bus resets, all devices negotiate who is the new boss.
when we detect the root node can't be cycle master,
we send a PHY config packet that forces a reelection.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58309

firewire: remove dead code across the subsystem

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58310

firewire: replace magic numbers with named constants

No functional change.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58311

Sponsored by: Klara, Inc.
Sponsored by:   NetApp, Inc.
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=6d0001d44490 ("nvme: add support for DIOCGIDENT")
Reviewed by:    bnovkov, imp
Differential Revision:  https://reviews.freebsd.org/D58357

The uvideo driver freed the mmap buffer (contigmalloc'd) in several
paths (VIDIOC_STREAMOFF, last close, detach) without coordinating
with the lifetime of existing user-space mmap mappings.  This could
lead to use-after-free when user-space continued to access the
mapped memory after the backing pages had been freed.

Fix this by switching from the simple d_mmap callback to d_mmap_single
with custom cdev_pager_ops, and by attaching the contig buffer to a
single shared vm_object created at REQBUFS time:

- uvideo_reqbufs() allocates a uvideo_mmap_state (independent of the
  softc) and a shared vm_object via cdev_pager_allocate() that spans
  the whole buffer; the softc holds one reference to it.
- uvideo_cdev_mmap_single() simply hands out additional references to
  that shared object; the requested offset selects which buffer is
  mapped.  The VM system tracks mapping lifetime through the object
  reference count, so no per-mapping bookkeeping is needed.
- uvideo_pg_ctor/uvideo_pg_dtor validate the mapping and free the
  contig buffer together with the state when the last reference
  (softc's own or a user mapping) is dropped.
- uvideo_pg_fault installs a fictitious page for the backing physical
  address, following the canonical device-pager pattern: update the
  passed-in page in place when it is already fictitious, otherwise
  allocate a fake page and vm_page_replace() the busy placeholder,
  so that dev_pager_dealloc() does not deadlock.
- uvideo_vs_free_frame() drops the softc's reference instead of
  contigfree()'ing directly; if mappings still exist the buffer stays
  alive until the last uvideo_pg_dtor().
- VIDIOC_STREAMOFF no longer frees the buffer (per V4L2 spec).
- Last close always releases the buffer (deferred if mappings exist).
- The mmap_state outlives the softc, so the pager dtor can safely
  free the buffer even after device detach.

Reported by:    章鱼哥 (@aipyapp) (www.aipyaipy.com)
Reported by:    Chris Jarrett-Davies of the OpenAI Codex Security Team

This fixes an issue with the Solo2 (and likely some of the Nitrokey
family) where hangs would occur with OpenSSH- it issues a CANCEL prior
to closing the device unconditionally, and without draining the read
endpoint we end up seeing the response to that CANCEL the next time
OpenSSH tries to connect.  This throws the entire command/response
sequence out of whack.

This call used to break Yubikeys in some situations, but the fix that
landed in 28d85db46b48 ("xhci: Do not drop and add bits in xhci") seems
to have addressed that- presumably we sometimes end up stopping the
command and desyncing at the controller level.  This probably implies
that we need a SYNCWRITE HID quirk, but that requires a little more work
in usbhid_sync_xfer() and this doesn't seem to cause any problems in
normal usage.

Reviewed by:    aokblast, wulf
Differential Revision:  https://reviews.freebsd.org/D58199

Replace bare EINVAL in AMD/IBS allocation and config-validation with
EXTERROR(), so a failed pmc(3) allocation names the check and value.

Register HWPMC_AMD in exterr_cat.h and the generated filenames.h.

Signed-off-by:  Andre Silva <andasilv@amd.com>
Reviewed by:    Ali Mashtizadeh <ali@mashtizadeh.com>, mhorne
Sponsored by:   AMD
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2180

Annotate validation failures in the PMC syscall handlers (allocate,
attach, read/write) with EXTERROR(), so pmc(3) callers see which
precondition failed, not a bare errno.

Register HWPMC_MOD in exterr_cat.h and the generated filenames.h.

Signed-off-by:  Andre Silva <andasilv@amd.com>
Reviewed by:    Ali Mashtizadeh <ali@mashtizadeh.com>, mhorne
Sponsored by:   AMD
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2180

vtnet: Retry feature negotiation without offloads

A device is permitted to reject an otherwise valid subset of its
offered features by refusing to accept FEATURES_OK (VirtIO v1.3,
2.2.2).  Apple's Virtualization.framework does this in practice;
it treats the offered CSUM/TSO offloads as all-or-nothing, while
vtnet's default request contains only part of that group because
of hw.vtnet.lro_disable that would drop the guest TSO bits, thus
negotiation fails and the device does not attach.

If FEATURES_OK is rejected, retry the negotiation once with every
offload-related feature stripped.  Changing the feature set after
a failed FEATURES_OK requires re-initialising from device reset
(VirtIO v1.3, 3.1.1), so the retry goes through virtio_reinit().

A NIC without offloads is preferable to no NIC at all.  Devices
that accept the initial feature set are unaffected, while those
that also reject the reduced set continue to fail attachment as
before.

Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Reviewed by:    adrian
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2322

vtnet: Implement VIRTIO_NET_F_GUEST_ANNOUNCE

When the device sets VIRTIO_NET_S_ANNOUNCE in the config status
field, for example after a VM migrates to a new host, announce
the interface's presence on the network so peers and switches
learn the new attachment point, then acknowledge the request
with the VIRTIO_NET_CTRL_ANNOUNCE_ACK control command, as per
VirtIO v1.3, 5.1.6.5.4.

The announcement raises iflladdr_event: the stack sends gratuitous
ARPs and unsolicited neighbor advertisements for the interface's
addresses, and stacked interfaces such as vlan(4) propagate the
event and announce theirs as well.  The event handlers may sleep,
so the work is deferred from the config change interrupt to a task
on taskqueue_thread; that context also allows the acknowledgement
to be skipped safely if the interface was stopped in the meantime,
in which case the device keeps the bit set and the request is
re-delivered with the next config change interrupt.

Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Reviewed by:    adrian
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2322

vtnet: Accept VIRTIO_NET_F_CTRL_RX_EXTRA

Although the driver does not issue the extra receive-mode commands
accepting the feature is harmless and some devices, notably Apple's
Virtualization.framework, offer their control-queue features as a
group and refuse FEATURES_OK unless the whole set is acknowledged.

Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Reviewed by:    adrian
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2322

These kernconfs were missed in the previous commit.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289236
Reviewed by:    kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=f38cbefef8090f3363e5685c5a3b30ffbf1d3ad0
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

uvideo: replace contigmalloc with OBJT_PHYS vm_object for mmap buffer

Allocate the mmap buffer via phys_pager_allocate() and map it into
kernel space with vm_map_find()/vm_map_wire(), instead of a custom
cdev_pager backed by contigmalloc.  phys_pager_allocate() is required
over a bare vm_object_allocate(OBJT_PHYS) to initialise un_pager.phys.ops,
otherwise phys_pager_getpages() NULL-derefs during vm_map_wire().

Reviewed by:            markj
Reported by:            markj
Differential Revision:  https://reviews.freebsd.org/D58394

uvideo: validate frame size before mmap buffer allocation

dwMaxVideoFrameSize comes from the USB probe/commit response and is not
validated.  reqbufs() computed buf_size_total with signed int arithmetic
and no bound, so a bogus value could wrap the product to a small size
and yield a too-small buffer with a huge sc_mmap_buffer_size, causing
out-of-bounds writes from the USB transfer callbacks.

Bound the frame size against sc_max_fbuf_size and use overflow-checked
size_t arithmetic for the total and per-buffer offsets.

Reported by:    emaste

uvideo: lock the mmap queue and read path

qbuf(), dqbuf() and read() manipulated sc_mmap_q / sc_mmap_cur /
sc_frames_ready without sc_mtx, racing with the USB transfer callbacks
(producer) that run under the mutex.  This could corrupt the queue or
trigger use-after-free.

Take sc_mtx around qbuf(), use mtx_sleep() and protect the queue
operations in dqbuf(), and use mtx_sleep() with a snapshot of sc_fsize
in read().

Also reject S_FMT and S_PARM with EBUSY while streaming: both
re-negotiate the probe/commit controls with the device, which disrupts
the active USB transfers (a second client opening the device would
otherwise freeze the first one's stream).

uvideo: bounds-check frame interval reads against bLength

Frame interval data is read from device-supplied frame descriptors whose
bLength may be shorter than the number of intervals declared by
bFrameIntervalType.  The continuous branch of uvideo_enum_fivals() read
three intervals unconditionally, and the discrete branch checked the
pointer but not the four bytes that UGETDW() reads, so a short or
malformed descriptor could read past bLength and leak adjacent kernel
memory to userspace.  uvideo_vs_parse_desc_frame_max_rate() had the same
class of off-by-up-to-three-bytes read.

Compute the available bytes from bLength and validate before each read.

Reported by:    emaste

uvideo: track streaming ownership per-fd and free buffers on STREAMOFF

The driver shared a single streaming state and buffer pool across all
open file descriptors, so a second client (e.g. another browser tab)
could disrupt the first: its cleanup STREAMOFF would tear down the
active stream, and stale buffers prevented re-acquisition.

Add per-fd state via devfs cdevpriv tracking whether this fd started
streaming.  STREAMOFF and close from a non-streaming fd are no-ops.
STREAMOFF from the streaming fd stops the stream and frees the buffers
so that a new fd can re-acquire the camera.  DQBUF returns EPIPE
immediately when buffers are freed instead of waiting for a timeout.

uvideo: fix close/detach race on streaming teardown

detach() stopped streaming and called uvideo_vs_close() before
destroy_dev(), so a concurrent close() could race the teardown and call
uvideo_vs_close() a second time (double usbd_transfer_unsetup), and
mtx_destroy() could race a close still holding sc_mtx.  sc_streaming
was also read without the lock in both paths.

Reorder detach() to call destroy_dev() first so all in-flight cdev
methods drain before any teardown.  Read sc_streaming under sc_mtx in
both detach() and the last-close safety net.

uvideo: use size_t for sc_mmap_count and loop index in reqbufs

uvideo: validate frame descriptors and fix integer overflows in size computation

uvideo: fix printf type

Reported by:    vishwin

Reviewed by:  aokblast, kib, olce
Differential Revision:  https://reviews.freebsd.org/D58336

Some UAC2 devices expose a single Clock Source entity that is shared
between their playback and capture interfaces (it appears in both the
output and input clock bitmaps).  On such a device uaudio(4) programs
the sample rate for both directions when a stream starts.  If playback
runs at a 44.1 kHz-family rate while the idle capture channel is left
at its 48 kHz-family default, the capture
SET_CUR(UA20_CS_SAM_FREQ_CONTROL) is issued after the playback one and
overwrites the rate on the shared clock.  The device then runs at
~48 kHz while the playback stream carries 44.1 kHz data.  Consuming
samples faster than they arrive, the device repeatedly runs out of
data, loses sync with the playback stream, and re-locks onto it
(audible dropouts, front-panel play/idle flicker).  The 48 kHz family
is unaffected because both directions then agree on the rate.

Fix it in three parts:

- Add a shared-clock guard: before issuing SET_CUR to a clock id, if
  that clock is shared between playback and capture and the other
  direction is already streaming at a different rate, skip it.  The
  first active stream owns the clock; a later one follows it.

- When the recording channel is auto-started only as a source of jitter
  information for asynchronous playback, align its nominal rate to the
  playback rate before starting it, so it neither reprograms the shared
  clock to a conflicting rate nor produces mismatched frame sizes.

- Always submit the explicit-feedback SYNC transfer so
  dev.pcm.%d.feedback_rate stays live as a diagnostic even when a
  capture stream is present.

Reproduced on an OKTO RESEARCH DAC8 STEREO (0x152a:0x88c5), whose
vestigial capture interface never streams; the same device plays the
44.1 kHz family correctly under Linux's snd-usb-audio.

As a side effect, this patch also fixes the sample rate bug mentioned in
the BUGS section of sound(4)'s man page, where a device needs to have
the same sample rate set for both playback and recording in order to
work properly.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295933
Assisted-By:    Claude Opus 4.8 (claude-opus-4-8)
Signed-off-by:  giacomo <delleceste@gmail.com>
MFC after:      2 weeks
Reviewed by:    christos
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2323

The fixed 128 KiB secondary buffer cap dates from stereo-sized streams.
High channel-count or high sample-width OSS streams can consume most of
that budget in one graph quantum, leaving too little room for capture
catch-up or playback headroom.

Keep 128 KiB as the low-rate floor, but derive the effective soft-ring
cap from the channel byte rate, clamped to 4 MiB. Use that per-channel
cap when resizing the soft buffer and when clamping
SNDCTL_DSP_SETFRAGMENT requests.

Also clamp SNDCTL_DSP_LOW_WATER to the current soft-buffer size so an
impossible readiness threshold cannot make poll/select wait forever.

MFC after:      3 weeks
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D58064

Prevent infinite loop in uvideo_vs_negotiation() when a USB camera reports
step=0 in its continuous frame interval descriptor.
Cast fbuf_size calculation to uint64_t to avoid int overflow for large
width/height/bpp combinations.

Reported by:    emaste

Don't coerce errors to EINVAL, which isn't correct for mtx_sleep's
failure cases.

Sponsored by:   The FreeBSD Foundation

Our USB TRB buildup subroutines were previously difficult to follow. In
setup_generic_chain_sub(), the routine filled TRB packets based on the
characteristics passed by the caller and the current state (for example,
whether the TRB was the last in the TD).

However, most TRB types (except Normal TRBs) cannot be shared across TDs.
To simplify the logic, refactor xhci_setup_generic() so that TRBs are
constructed according to their transfer type, with dedicated helper
functions for each TRB type.

Sponsored by:   The FreeBSD Foundation
Assisted-by:    Claude Code (Opus 4.6, Opus 4.8(1M) and Sonet 5.0)
Differential Revision:  https://reviews.freebsd.org/D57130

When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58432

Reviewed by:    markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56311

e1000: Defer link-up notification until after TSO reset

em_automask_tso() changes the enabled TSO capabilities when the link
moves between 10/100 and 1000 Mb/s.  A running interface must be
reinitialized to apply the new capability set.  Do not publish
LINK_STATE_UP until the requested iflib reset has completed.

Replace link_active with an explicit state machine that distinguishes
the physical link, its publication to iflib, and an outstanding reset
barrier.  Preserve that barrier across a link flap with
DOWN_RESET_PENDING, and only publish DOWN if UP was previously
published.

Only request a reset for a running interface or for an initialization
while the interface is administratively up.  In other states the next
initialization will apply the capability changes, avoiding a reset
request that iflib's admin task could discard.

Reviewed by:    Faraz Vahedi <kfv@kfv.io>
Fixes:  https://cgit.freebsd.org/src/commit/?id=2ddf24f8f525 ("e1000: Automask TSO on lem(4)/em(4) 10/100 Ethernet")
MFC after:      1 week

e1000: fix 82574 MSI-X interrupt throttling

em_newitr() and the per-queue interrupt_rate sysctl both tested
que->msix to decide whether an 82574 is running in MSI-X mode.  0 is a
valid MSI-X vector so queue 0 was misclassified as legacy/MSI.

Test sc->intr_type == IFLIB_INTR_MSIX instead.  While here, index the tx
EITR read by tque->msix rather than tque->me so it matches the register
em_newitr() actually writes; the two differ once tx_num_queues exceeds
rx_num_queues.

Also seed que->itr_setting in em_initialize_receive_unit() with the rate
the hardware was just programmed with.  Otherwise an itr_setting left
over from AIM across an interface re-init makes the change detection in
em_newitr() suppress the write that would restore it, leaving the
hardware at the default rate while software believes otherwise.

Fixes:          https://cgit.freebsd.org/src/commit/?id=3e501ef89667 ("e1000: Re-add AIM")
MFC after:      3 days

e1000: fix rx accounting for multi-descriptor packets

The receive paths accumulate ri->iri_len across the descriptors making
up a packet, then add that running total to rxr->rx_bytes on every
iteration of the loop.  A packet spanning descriptors of length l1, l2
and l3 thus contributes 3*l1 + 2*l2 + l3 instead of l1 + l2 + l3.

Single descriptor packets, the common case, are accounted correctly,
so this only shows up on jumbo frames.

Add the per descriptor length instead.  iflib memsets the if_rxd_info
before each isc_rxd_pkt_get() call, so summing len gives the same total
as the final iri_len, and the frame error path that returns without
incrementing rx_packets keeps counting bytes exactly as before.

MFC after:      1 week

e1000: make AIM counter sampling coherent

Sample free-running counters by delta instead of clearing them from the
interrupt filter, which can race their producers.  Publish byte and
packet counts together at the TX and RX doorbells so each sample is
coherent.

Aggregate every TX ring assigned to the interrupt vector so unequal RX
and TX queue counts are safe.  Count RX bytes only after a frame is
accepted.

MFC after:      1 week

e1000: synchronize interrupt moderation state

Keep the saved EITR and PBA values synchronized with hardware across
reinitialization.  Correct EITR encoding, decoding, and MSI-X register
selection, and reject nonpositive fallback rates.

Treat only sub-gigabit links as sub-gigabit and apply the packet-buffer
fallback without permanently disabling AIM.

MFC after:      1 week

e1000: restore packet-size AIM

Restore the packet-size calculation introduced in a69ed8dfb381 and used
by igb(4) until the iflib conversion in f2d6ace4a684.  It derives
interrupt holdoff from average packet size, so RSS queue count does not
change its behavior.

The calculation follows the pre-iflib code.  Retain the current normal
and low-latency rate caps, and keep the current setting when an interval
has no usable sample.

Fixes:          https://cgit.freebsd.org/src/commit/?id=3e501ef89667 ("e1000: Re-add AIM")
MFC after:      1 week

e1000: count TSO wire segments in the AIM counters

The transmit paths billed one packet of ipi_len bytes per request.  For
TSO that is the whole unsegmented payload, up to 64KB, so the average
size the moderation calculation sees is not a size that appears on the
wire.

Count the segments the hardware will put on the wire and the header each
of them carries.

Non-TSO accounting is unchanged.

MFC after:      1 week

igc: fix RX accounting for multi-descriptor packets

The receive path adds the running packet length to rx_bytes for every
descriptor.  A packet spanning descriptors of length l1, l2, and l3 is
therefore counted as 3*l1 + 2*l2 + l3.

Add each descriptor length once.  Single-descriptor accounting remains
unchanged.

MFC after:      1 week

igc: make AIM counter sampling coherent

Sample free-running counters by delta instead of clearing them from the
interrupt filter, which can race their producers.  Publish byte and
packet counts together at the TX and RX doorbells so each sample is
coherent.

Aggregate every TX ring assigned to the interrupt vector so unequal RX
and TX queue counts are safe.  Count RX bytes only after a frame is
accepted.

MFC after:      1 week

igc: synchronize interrupt moderation state

Keep the saved EITR value synchronized with hardware across
reinitialization.  Correct EITR encoding, decoding, and MSI-X register
selection, and reject nonpositive fallback rates.

Apply the packet-buffer fallback without permanently disabling AIM.

MFC after:      1 week

igc: use packet-size AIM

Use the packet-size calculation introduced for igb(4) in a69ed8dfb381
and retained there until the iflib conversion in f2d6ace4a684.  It
derives interrupt holdoff from average packet size, so RSS queue count
does not change its behavior.

The calculation follows the pre-iflib igb code.  Retain igc's normal and
low-latency rate caps, and keep the current setting when an interval has
no usable sample.

MFC after:      1 week

igc: count TSO wire segments in the AIM counters

The transmit path bills one packet of ipi_len bytes per request.  For
TSO that is the whole unsegmented payload, up to 64 KiB, rather than a
packet size that appears on the wire.

Count the segments the hardware emits and the header carried by each
segment.  Non-TSO accounting is unchanged.

MFC after:      1 week

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Previously, multiple frames of xfers are split into many tds. In the
refactor process, we forget to consider this. The td builder is already
allocate with enough numbers of tds. What we need to do is to fill the
normal trbs for muiltiple tds when building trbs.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297053
Tested by:      phk, oleglelchuk@gmail.com
Fixes:  https://cgit.freebsd.org/src/commit/?id=e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58465

It is better to propagate it to pcm_register(), and later to the device
drivers, than to simply ignore it and return ENXIO.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.

MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426

specialreg.h is the tree's MSR registry and already carries the Intel
RAPL group. Add the AMD RAPL package/core energy and unit MSRs here so
the hwpmc RAPL class can reference them without a private driver copy.
Use the names Linux's msr-index.h gives these registers.

Reviewed by:    mhorne, adrian, Ali Mashtizadeh <ali@mashtizadeh.com>
MFC after:      3 days
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58027

Add hwpmc_rapl.c/.h implementing PMC_CLASS_RAPL, a read-only
system-scope class modeled on TSC and wired into x86 AMD and Intel MD
init. A per-vendor MSR table covers AMD/Hygon and Intel; energy is
reported in microjoules, with the Intel server 2^-16 J DRAM unit
handled and 32-bit wraps recovered into a 64-bit accumulator.

The overflow guard follows the PMC lifetime: armed on the first
allocated PMC, callout_drain()d on the last release, and each tick only
rendezvouses CPUs holding one. Per-CPU spin locks guard the accumulator
against torn reads on i386. PMC_CAP_DOMWIDE lets pmcstat(8) allocate
one counter per NUMA domain instead of per CPU.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58028

Register PMC_CLASS_RAPL in libpmc: event table, allocator, class-table
descriptor, and the event-name/class-listing lookups, all x86-guarded
and modeled on the TSC class. Energy events are read-only and
unqualified. The class prefix (RAPL-) supplies the friendly spelling, so
pmcstat -S rapl-energy-pkg resolves to the canonical ENERGY_PKG event.

Add a pmc.rapl.3 manual page documenting the events, counter scope, the
microjoule unit and wrap handling, and the NUMA/package domain mapping;
link it from pmc.3.

Reviewed by:    mhorne
Discussed with: Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Differential Revision:  https://reviews.freebsd.org/D58029

Neither of these options are checked in the file and cdefs.h should not
be included explicitly. No functional change.

Sponsored by:   The FreeBSD Foundation

amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.

Reviewed by:    mhorne
Approved by:    mhorne
MFC after:      1 week
MFC to:         stable/14, stable/15
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58468

{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.

Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.

Reviewed by:    kbowling, gallatin
Approved by:    kbowling
MFC after:      1 week
MFC to:         stable/14, stable/15
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58513

Add a QUIRK_EMPTY_NAMESPACE_CHANGED_LOG quirk which indicates that the
nvme controller may not properly populate the namespace-changed log
page.  If we receive a NVME_LOG_CHANGED_NAMESPACE page for a device
with this quirk and the page is empty, probe all of the namespaces
rather than none of them.

Reviewed by:    imp
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58231

This controller exhibits QUIRK_EMPTY_NAMESPACE_CHANGED_LOG behaviour.

A bug report has been filed with the vendor.

Reviewed by:    imp
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58232

In particular, handle authentication errors due to bad MACs when
decrypting packets.

Since the current dispatch code assumes synchronous OCF sessions by
design, explicitly reject any created OCF session that is not
synchronous.  Software sessions are always synchronous in practice, so
this should be a nop.

Approved by:    so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Intel Apollo Lake SDXC controller reports a Slot Type of
"Embedded Slot for One Device" in SDHCI_CAPABILITIES bits, even
when the slot is a removable card reader.
This caused 48 timeouts before the boot sequence resumed.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58467

Update the shared e1000 PF/VF mailbox interfaces for an in-tree igb
SR-IOV implementation.

Intel FreeBSD igb-2.5.31 and DPDK provide the older PF/VF mailbox
baseline.

The retained PF mailbox read and explicit unlock operation follow a
simple Linux igb parameter addition to make PF mailbox acquisition
nonblocking so the driver can retry outside the shared primitive.

Treating a CTS-less E1000_PF_CONTROL_MSG as a reset follows DPDK.

Sponsored by:   BBOX.io

Use each ring's physical queue index for initialization, MSI-X routing,
register dumps, sysctls, and debug output instead of assuming that its
logical array index is also its hardware index.

This is a no-op for the normal queue layout.  A later SR-IOV change
moves the PF ring to hardware queue num_vfs, so its hardware ID then
differs from logical queue zero.

Sponsored by:   BBOX.io

A non-zero VF device number does not always require ARI. The Intel
82576 and I350 [1] explicitly support a non-ARI layout that places VFs
on the next bus.

Check every requested VF RID and reject a non-zero device only when it
is on the PF bus. This retains the ARI guard for invalid same-bus
layouts while permitting the documented second-bus layout.

[1] Intel I350 Datasheet, sections 7.8.2.6.1.2, 9.6.4.6

Sponsored by:   BBOX.io

pci_iov_config() programs NumVFs before validating the final VF RID
layout and allocating all generic resources. A subsequent error ran the
driver uninit callback but left the hardware NumVFs register programmed
while the software VF count returned to zero.

Clear NumVFs in the error path after the driver uninit callback,
matching normal SR-IOV teardown ordering. This prevents stale hardware
state after a failed configuration and permits a clean retry.

MFC after:      1 week
Sponsored by:   BBOX.io

Register the 82576 and I350 VF PCI IDs under a separate igbv driver
while continuing to share the igb datapath implementation.

Follow the ixv driver split and give the VF context IFLIB_IS_VF so
iflib does not apply the PF SR-IOV detach guard to a child VF. Program
VTIVAR_MISC in the VF low byte so mailbox and reset notifications reach
the VF admin vector.

The split will become increasingly obvious as bug fixes land, trying to
bias everything with if (sc->vf_ifp) everywhere is error prone in two
directions.

This breaks existing naming/configurations and cannot be MFCed as-is.
I have no plans of adapting it to prior branches at the moment but it
may be possible.

Relnotes:       yes
Sponsored by:   BBOX.io

I350 loopback receive descriptors report VLAN tags byte-swapped for
both PFs and VFs. The receive path handled the PF device types but
omitted e1000_vfadapt_i350, causing an admitted VF VLAN packet to be
delivered untagged to the VF parent.

Include the I350 VF type in the existing correction. This matches the
dedicated IGB_RXQ_FLAG_LB_BSWAP_VLAN handling in DPDK igbvf.

MFC after:      1 week
Sponsored by:   BBOX.io

The register-dump sysctl is installed before iflib allocates the queue
arrays and remains visible while they are freed. Return ENXIO outside
the queue lifetime instead of dereferencing a NULL or stale array.

Sponsored by:   BBOX.io

Add the PCI IOV schema and PF control plane for up to seven VFs with
one hardware queue per pool. Implement VF mailbox handling, MAC and
VLAN assignment, multicast filtering, promiscuity policy,
anti-spoofing, malicious-driver recovery, reset replay, and queue
lifecycle management.

The basic SR-IOV and VMDq PF implementation follows DPDK Intel e1000
code, including PF pool selection, one queue per pool, mailbox
dispatch, and VF enablement. Intel FreeBSD igb-2.5.31 supplies the
older driver baseline. Linux igb and the Intel SDMs clear up lifecycle,
isolation, reset, and family-specific details absent from DPDK.

Enabling IOV requires the PF to attach with one TX and RX queue.
Systems whose defaults select RSS queues must set the documented iflib
queue override tunables before attach.

Only 82576 and I350 support SR-IOV in silicon.  The series has been
extensively tested on I350, including thowing boundaries at the PCI BAR
that shipping drivers will never.  Still, think carefully before
reaching for this in critical environments.

Relnotes:       yes
Sponsored by:   BBOX.io

Disable each igb-class transmit and receive queue and flush before
changing its descriptor-ring registers. Restore the head and tail
indices that Intel documents as surviving a VF reset.

Use the igb queue-enable control instead of programming legacy TXDCTL
granularity, low-water, and reserved bits that do not belong to the
82575 and later.

Sponsored by:   BBOX.io
MFC after:      1 week

igbv: Isolate VF policy and validate its registers

Give igb virtual functions a separate ifdi method table and move
VF-specific attach, reset, queue, interrupt, and diagnostic policy to
if_igbv.c. Keep shared descriptor-ring mechanisms in if_em.c.

Derive VF identity from IFLIB_IS_VF and assert that hardware
identification agrees. Under INVARIANTS, validate normal VF CSR
accesses against the sparse 82576 and I350 VF register maps.

Stop shared setup from accessing PF-only controls. Require MSI-X and
defer VF sysctls until attach succeeds so failed attachment cannot
leave handlers pointing at freed driver state.

Advertise only VF capabilities, run adaptive moderation without the
PF receive-buffer guard, enable SRRCTL.DROP_EN, and provide a VF-safe
diagnostic register view.

The moved implementation is the existing FreeBSD code. Register model
was cross-checked against the Intel datasheets and other Intel drivers.

Sponsored by:   BBOX.io

igbv: Improve VF mailbox and status behavior

Treat VF media as fixed 1000baseT full duplex and report PF not ready
and generated MAC fallback states during attach.

After a successful reset handshake, reconcile a PF rejected MAC back
into the ifnet. If the PF is unavailable, defer MAC, multicast, VLAN,
LPE, and promiscuity replay until CTS is restored. Track a rejected
VLAN removal separately so leaked traffic remains tagged until reset
proves that the stale hardware filter is gone.

Baseline VF counters at attach, collect the four loopback packet and
octet counters with rollover-safe deltas, and account software RX
checksum offload results. Preserve accumulated statistics across PF
resets by rebasing the raw hardware counters, and sample them while
physical link is down because VF loopback can remain active.

Retain the 82576 VFMPRC hardware statistic, but do not read it on I350
VFs because specification update errata 31 says it is unavailable.

Clear PF owned flow control state and reset a link down VF when queued
transmit descriptors must be flushed.

Sponsored by:   BBOX.io

igbv: Support secondary unicast filters

Support the Linux igbvf secondary-MAC mailbox subprotocol, used by
Linux guests running MacVTap.

Replay up to three non-primary unicast addresses after reset and
whenever the address list changes, subject to PF allow-set-mac policy.

Sponsored by:   BBOX.io

igb: Stop writing the legacy TADV register

TADV is an em-class interrupt delay register and is absent from the
82575 and later register model. The igb attach path does not expose or
initialize that control, but transmit initialization still wrote its
zero valued storage into a reserved queue-window offset.

Apply the same igb_mac_min boundary already used for TIDV and the
absolute-delay sysctls.

MFC after:      1 week
Sponsored by:   BBOX.io

igb: Update only changed IOV multicast hashes

Build the aggregate PF/VF multicast bitmap in software and compare it
with the e1000 MTA shadow. Write only registers whose desired value
changed, while forcing a complete write after PF reset invalidates the
hardware table.

This bounds alternating VF multicast updates without NACKing them.
Linux igbvf and DPDK ignore multicast reply status, so a command-rate
limiter could otherwise acknowledge configuration while leaving
hardware state stale.

Sponsored by:   BBOX.io

igb: Update only changed IOV VLAN filters

Keep the full VFTA/VLVF software recomputation and clear-map-set
ordering, but compare each phase against the authoritative old value.
Write only VFTA words and VLVF slots whose effective contents change.

I350 uses its software VFTA shadow because erratum 20 makes live reads
unreliable; an invalid shadow forces a complete clear before sparse
restoration. 82576 continues to diff against live VFTA reads.

Add SDT probes for every logical write phase and the final software
images so hardware tests can verify exact elision counts. On my I350
DUT, the old full table path averaged 819 us across 31 VLAN removals
versus about 79 us for the PF statistics sweep.

Sponsored by:   BBOX.io

igb: Rate-limit VF VLAN rebuild requests

Give each VF a burst of 64 VLAN additions and refill it at eight
additions per second. Removals remain unrestricted, idempotent requests
consume nothing, and trusted PF-wide initialization replenishes the
burst while guest resets do not.  Checks VLVF capacity before charging
a token.

Do not apply this policy to multicast requests because Linux igbvf and
DPDK ignore their reply status; aggregate MTA write elision bounds
those updates instead.

Sponsored by:   BBOX.io

Mailbox and link interrupts share iflib admin service with the periodic
timer. Mark timer-driven passes explicitly and run the hardware
statistics sweep only for those samples instead of repeating 66 PF MMIO
reads for every VF mailbox message.

DTrace on the I350 DUT measured the PF sweep at about 79 us on average.
The normal hz/2 timer continues to extend clear-on-read counters
safely; exported counters may trail hardware by up to 500 ms.

Sponsored by:   BBOX.io

A PF mailbox NACK does not distinguish the SR-IOV VLAN request rate
limit from permanent VLVF exhaustion. Preserve desired VLAN membership
and retry four additions per 500 ms timer tick, matching the PF
sustained allowance.

Bound the whole recovery batch to eight seconds from its first failure
and consolidate restore diagnostics, so a full table cannot create a
permanent mailbox poller or repeated per-VID log bursts.

Sponsored by:   BBOX.io

Pass the VF generation through the CSR accessors so the validator can
distinguish the sparse 82576 and I350 register maps.

Admit the queue-zero RXCTRL, TXCTRL, TDWBAL, TDWBAH, and
VFPSRTYPE registers exposed by both families.

82576 exposes VFMPRC at 0xf3c.  I350 erratum 31 makes its
corrected 0xf38 address inaccessible to a VF, so reject both I350
spellings while retaining read access on 82576.

Sponsored by:   BBOX.io

82576 and I350 VFLR leave the VF queue configuration unchanged.  A VF
can program transmit head write-back and leave its DMA destination for
a later VF owner; mainstream VF drivers do not overwrite TDWBAL/H.

Disable every receive and transmit queue assigned to the VF, wait for
the enable bits to clear, then clear SRRCTL, PSRTYPE, RXCTRL, TXCTRL,
and TDWBAL/H.  Spin briefly for the normal transition, then sleep at
100 microsecond intervals with an approximately 1 ms bound.  This
prevents a VF that keeps asserting QUEUE_ENABLE from busy-waiting the
PF context lock for 10 ms.

If a queue does not quiesce, leave the VF disabled and NACK its reset
rather than programming an active queue.  Rate-limit this diagnostic
independently from mailbox and malicious-driver notifications.

I350 maps pool n to queue n.  82576 assigns physical queues n and n+8
to VF n, so sanitize both queues while clearing per-pool PSRTYPE once.
An incoming VF initializes its active ring base, head, and tail while
enabling each queue.

This is also required by malicious-driver recovery, which deliberately
does not assert VTCTRL.RST because doing so would discard the VF's
admin-vector routing before the PF can notify it.

This implements Software Clarification 3 from the 82576 and I350
specification updates.

Sponsored by:   BBOX.io

82576 and I350 VFLR leave queue configuration unchanged.  A previous
VF owner can therefore leave a transmit head-writeback DMA destination
and other queue policy for the next guest.

After each reset attempt, disable all exposed VF queues and wait for
their enable bits to clear before clearing SRRCTL, VFPSRTYPE, RXCTRL,
TXCTRL, and TDWBAL/H.  Spin briefly and then sleep until the bounded
queue-disable deadline.

iflib cannot report initialization failure and marks an interface
running after its init callback returns.  On sanitation failure, keep
interrupts disabled and use the deferred admin task to clear RUNNING.
Retry after 100 and 500 ms; after three total failures, leave the
interface down until another administrative initialization starts a
new bounded attempt set.

igbv uses queue zero on both families, but 82576 exposes a second VF
queue whose retained state must also be cleared.  Extend the INVARIANTS
register validator for only those queue-one CSRs and only on 82576.

This implements the VF side of Software Clarification 3 from the 82576
and I350 specification updates.  It also means an igbv guest does not
depend on its PF to sanitize a previous VF owner's state.

Sponsored by:   BBOX.io

amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)

Also do not mask bits in the mxcsr_mask.  It is ignored by FRSTOR/XRSTOR.

Reported by:    markj
Reviewed by:    jhb, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58548

ptrace: Propagate errors from set_fpregs()

Otherwise ptrace(PT_SETREGSET) will not return errors to userspace.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cef05c5a62ba ("amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58577

Reported by:  jhb
Reviewed by:    jhb, jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58550

Some conventional PCI e1000 configurations hang when given DMA
addresses above 4 GB, particularly on systems using AMD
HyperTransport-to-PCI bridges.  Linux has restricted e1000 to DMA32 in
PCI mode since 2011 for the same failure class in commit
e508be174ad36b0cf9b324cd04978c2b13c21502.

Set iflib's DMA width after determining the negotiated bus type.  This
covers descriptor and packet-buffer mappings while preserving 64-bit
DMA for PCI-X and PCIe devices and providing a conditional tunable.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297064
Reported by:    Alexander Leidinger <netchild@FreeBSD.org>
Tested by:      Alexander Leidinger <netchild@FreeBSD.org>
MFC after:      1 week

Add register/bit definitions for the L1 PM substates capability
(PCIZ_L1PM) to pcireg.h.

Signed-off-by: Michael Adler <madler@tapil.com>

MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

I226 parts advertise support for the PCIe L1.2 link substate, but a
hardware erratum makes the exit latency from that low-power state
longer than the packet buffer can absorb under load. This stalls the
inbound packet stream. Disabling ASPM system-wide (BIOS or OS ASPM
policy) does not fix it. The L1.2 enable bit must be cleared directly
in the device's own PCIe L1 PM extended capability.

Add igc_is_device_id_i226() to identify affected parts and
igc_disable_broken_aspm_l1_2() to clear the ASPM L1.2 enable bit
on attach and after resume, since PCIe config space can be
reset across a suspend/resume cycle.

Adapted from the Linux igc driver:

  0325143b59c6 igc: disable L1.2 PCI-E link substate to avoid
               performance issue
  1468c1f97cf3 igc: fix disabling L1.2 PCI-E link substate on I226
               on init

Signed-off-by: Michael Adler <madler@tapil.com>

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279245
Reviewed by:    Jim Thompson
MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

ixgbe: isolate VF reset state

IXGBE_VF_INDEX() selects a 32-VF register bank.  PFMBMEM() selects
one mailbox per VF, while ixgbe_toggle_txdctl() calculates queue
offsets from a VF number.  Passing the bank index aliases VF1-31 to
VF0 and VF32-63 to VF1.  Resetting one VF can therefore clear the peer
mailbox and leave its transmit queues disabled.

The VF raises its reset event before posting its mailbox request.  The
PF checks reset events before mailbox messages.  If both are pending,
clearing PFMBMEM during generic reset handling can erase the request
before ixgbe_read_mbx() consumes it.  Clear the mailbox only from the
reset-message handler after the request has been read.

Use the VF number for queue toggling and document that API contract.

MFC after:      1 week

ixgbe: respect peer mailbox ownership

A VF currently treats an existing VFU bit as a successful acquisition,
while the PF checks its own PFU bit before claiming the mailbox.  Check
both the local and peer ownership bits before setting local ownership.
This prevents same-side callers from sharing the mailbox and avoids an
acquisition attempt while the peer owns it.

VFLR does not clear VFMAILBOX.VFU.  Clear stale VF ownership and cached
mailbox status after the reset indication settles and before sending the
reset request, so the ownership check cannot strand a reinitialized VF.

Adapt only the live ownership checks from Intel ix 3.4.39.  Do not import
its upgraded-mailbox changes, which are not active in FreeBSD.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: fail fast on VF-held PF mailboxes

The active PF mailbox operations use the legacy helpers.  The mailbox API
import changed check_for_msg into a read-only probe and added up to 2,000
500-microsecond lock retries.  If a VF leaves VFU set, the PF cannot acquire
the lock, busy-waits for up to one second, and leaves VFREQ pending so the
delay can repeat.

Give the legacy checker its old consume-on-check behavior so a failed read
does not leave VFREQ asserted.  If VFU is already set, fail immediately
instead of retrying, while preserving retries for PF-side contention.  Do
not force RVFU, which would discard peer transaction state.

MFC after:      1 week

if_foreach_llmaddr() adds each callback return value to its running
count.  Returning the incremented count made the address indices grow
as 0, 1, 3, 7, and so on, eventually writing beyond the multicast
address array.

Return one address per callback and stop copying when the array is
full, matching the ixv-1.6.12 driver.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ff06a8dbb677 ("Mechanically convert ixgbe(4) to IfAPI")
MFC after:      1 week

DPDK commit message

net/ixgbe/base: add missing buffer copy for ACI

Add the missing buffer copy in ixgbe_aci_send_cmd().

The retry path saves the original descriptor and allocates storage for
the command buffer so both can be restored before another attempt.  It
did not copy the original command buffer into that storage.

Fixes:          https://cgit.freebsd.org/src/commit/?id=25b48e569f2f
Cc: stable@dpdk.org

Signed-off-by: Dan Nowlin <dan.nowlin@intel.com>
Signed-off-by: Yuan Wang <yuanx.wang@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (37239792b0)
MFC after:      1 week

DPDK commit message

net/ixgbe: fix flow control frame byte adjustment

LXONTXC and LXOFFTXC are 32-bit counters for transmitted XON and XOFF
packets.  Their deltas are summed and used to adjust the transmitted
packet and byte counters.

Perform the addition in 64 bits so it cannot wrap before the result is
used for the byte adjustment.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes:          https://cgit.freebsd.org/src/commit/?id=af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (bdf8608559)
MFC after:      1 week

DPDK commit message

net/ixgbe/base: fix unchecked return value

Check the return value from ixgbe_read_eeprom() before using the
control word to configure link disable during D3.

Fixes:          https://cgit.freebsd.org/src/commit/?id=b7ad3713b958 ("ixgbe/base: allow to disable link on D3")
Cc: stable@dpdk.org

Signed-off-by: Barbara Skobiej <barbara.skobiej@intel.com>
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Obtained from:  DPDK (eb3684b191)
MFC after:      1 week

FreeBSD's I2C helper already retries failed transactions.  Limit this
new outer loop to successful reads with an invalid identifier so that
retry budget is not multiplied.

DPDK commit message

net/ixgbe: retry misbehaving SFP read

Some XGS-PON SFPs ACK I2C reads and return uninitialized data while
their microcontroller boots.  A bogus identifier can cause an otherwise
working module to be marked unsupported.

Retry the identifier read several times, checking for both successful
I2C completion and a valid SFP identifier.

Signed-off-by: Stephen Douthit <stephend@silicom-usa.com>
Signed-off-by: Jeff Daly <jeffd@silicom-usa.com>
Reviewed-by: Haiyue Wang <haiyue.wang@intel.com>

Obtained from:  DPDK (774263bb4e)
MFC after:      1 week

ixgbe: fix unaligned access in ixgbe_update_flash_X550()

ixgbe_host_interface_command() treats its buffer as a u32 array.  The
local union contained only byte-sized fields, giving it one-byte stack
alignment and allowing unaligned accesses on strict-align systems.

Add a u32 member to the union to provide the required alignment and
pass that member to ixgbe_host_interface_command().

No functional change is expected on x86.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: avoid signed overflow in pause time calculation

pause_time is promoted to signed int before multiplication.  Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.

Make the multiplier unsigned so the calculation has the intended u32
semantics.  Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction.  The 82598-specific flow
control operation contains the identical expression, so correct it as well.

MFC after:      1 week

ixgbe: reject VF requests before CTS

A VF that sends a non-reset request before completing reset negotiation
has not received CTS.  The PF ignores the request but currently reports
success, leaving the VF with a false view of the programmed state.

Return failure for the ignored request.  This restores the behavior lost
when the mailbox helpers were renamed.

Fixes:          https://cgit.freebsd.org/src/commit/?id=36c516b31136 ("ixgbe: update if_sriov to use the new mailbox apis")
MFC after:      1 week

ixgbe: check negotiated API for VF queue query

The GET_QUEUES handler switches on msg[0], which contains the mailbox
command rather than the negotiated API version.  It therefore cannot
reject API 1.0 or an unnegotiated VF as intended.

Switch on the API version stored for the VF.

MFC after:      1 week

Clear ROMPE for an empty list and enable it only for a nonempty list.
FreeBSD already clears ROMPE when resetting a VF, so that part of the
DPDK change is not needed.

DPDK commit message

net/ixgbe: fix over using multicast table for VF

VMOLR.ROMPE allows a VF to receive packets matching the shared multicast
table.  Leaving it enabled after the VF removes its last multicast
address lets PF or peer-VF table entries continue selecting that VF.

Signed-off-by: Wei Zhao <wei.zhao1@intel.com>
Acked-by: Qi Zhang <qi.z.zhang@intel.com>

Obtained from:  DPDK (dc5a6e7422)
MFC after:      1 week

ixgbe: fix host interface timeout detection

The host-interface polling loop was scaled from milliseconds to
microseconds, but its terminal test was left using the unscaled timeout.
Completion at that intermediate iteration can be reported as a timeout,
while actual expiry is not recognized and can accept stale status.

Test against the scaled loop bound used by the polling loop.

Fixes:          https://cgit.freebsd.org/src/commit/?id=f46d75c90f5f ("ixgbe: improve MDIO performance by reducing semaphore/IPC delays")
MFC after:      1 week

ixgbe: avoid signed shift when assembling ETrack ID

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: dispatch PBA string reads through EEPROM ops

E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation.  Dispatch through the EEPROM
operation table so device overrides are honored.

Initialize the generic operation for devices that use the ordinary
EEPROM representation.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week

ixgbe: clear VF head write-back state on reset

VF reset and FLR do not clear the transmit head write-back address
registers.  A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.

After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF.  Derive the queue
count from the active IOV mode so peer queue state is not touched.

Linux commit dbf231af81a7 documents the hardware behavior.  The FreeBSD
implementation follows the local queue mapping and register interfaces.

MFC after:      1 week

Fixes:                https://cgit.freebsd.org/src/commit/?id=fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

acpi_probe_child() keeps PCI link devices, the RTC,
and docking stations enabled even when _STA reports them not present,
but skipped acpi_parse_resources() for them. With an empty resource
list, resource-based hint matching (BUS_HINT_DEVICE_UNIT) cannot wire
such a device to its hinted unit, and the hinted ISA device is then
created as a duplicate.

Modern AMI firmware reports the PNP0B00 RTC as not present while
handing timekeeping to the ACPI Time-and-Alarm device.

Reviewed by:    adrian, jhb
Differential Revision:  https://reviews.freebsd.org/D58047

Classify I226_LMVP and I226_BLANK_NVM as I226 silicon so they
receive the I226-specific ASPM L1.2 workaround.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279245
MFC after:      1 week
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2318

When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.

Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.

Fixes:          https://cgit.freebsd.org/src/commit/?id=7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
MFC after:      3 days

The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.

Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.

I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3.  Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.

Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=265714
MFC after:      4 days

igb: preserve coalesced 82576 MDD events

WVBR is read-clear, so reading it from the deferred admin pass loses
earlier queue bits when multiple VF malicious-driver events arrive
before that pass.

Snapshot WVBR in the interrupt filter, translate its staggered queue
bitmap to pool bits, and OR observations into software latches for
deferred notification and recovery.

Retain the one-queue VMDq policy used for mixed-driver safety (the
vswitch cannot handle a 2Q guest loopback to a 1Q guest per errata).

igb: drain stale MDD state before interrupt arm

IOV policy setup can leave MDDET and its read-clear diagnostic
registers populated while the admin vector is masked. Carrying that
state across the unmask can suppress the next spoof-event edge.

Mark initialization for a one-shot drain and consume LVMMC, WVBR when
applicable, and ICR immediately before EIMS/IMS arms the vector.
Preserve the synthetic link-status cause across the arm-time ICR read,
and clear the one-shot latch at reset preparation.

igb: recover retained i350 admin interrupts

I350 can retain EICR.OTHER with MDDET and LVMMC asserted while the
admin vector and legacy cause remain enabled. The anti-spoof filter
continues dropping packets, but no MSI-X is delivered and the spoof
diagnostic is lost.

Preserve the one-shot setup drain across iflib reset preparation,
clear ICR before LVMMC during i350 setup, and kick the enabled admin
vector from each admin pass. The synthetic no-cause interrupt stays
in the filter and also releases a retained MDDET cause.

Keep 82576 drain ordering and stop-time cleanup unchanged.

I225 v1 cannot receive the minimum inter-packet gap required at
2.5 Gb/s.  For affected back-to-back links, Intel recommends using a
15-byte transmit IPG instead of 12 bytes.

Program TIPG.IPGT to 0xb for pre-v2 I225 devices at 2.5 Gb/s and
restore the default at lower speeds.  Avoid penalizing fixed I225 and
I226 parts.

MFC after:      2 weeks

Track RERC separately instead of adding receive errors to the collision
count, and read the previously omitted RXERRC register.  Include RFC in
input errors because CRCERRS does not count bad-CRC runts, implementing
the I225 length-error accounting workaround alongside RUC and ROC.

Stop treating host transmit MAC discards as receive errors.  Expose both
RERC and HTDPMC as dedicated MAC statistics so their overlapping counts
remain available without corrupting aggregate interface counters.

MFC after:      2 weeks

Both these functions have non-static linkage for good reasons, however, their
naming may confuse folk when working with crypto(9) code at global scope.

Borrow the e1000 VLAN filter table

Ambiguous presence of the feature by Intel was settled by DPDK and
emperical testing.

MFC after:      2 weeks
Relnotes:       yes

X550-family malicious-driver detection validates the transmit
context selected by a data descriptor with Check Context set.  ixgbe
sets that bit on every transmit data descriptor, but ordinary PF
packets without a VLAN or checksum offload do not create a context
descriptor.  The empty context then reports an invalid MAC-header
length and blocks the PF queue as soon as MDD is enabled.

Create the existing context descriptor for every PF packet while
SR-IOV is active.  This supplies the required MAC-header length and
keeps MDD from mistaking normal PF traffic for a malicious-driver
event.

MFC after:      1 week

Update ieee80211_crypto_init_aad() to do what 802.11-2020 says -
only mask fc[0] bits 4-6 on data frames, not on management frames.
This (with other diffs to actually negotiate MFP and configure
ath(4) for MFP + software keys) allows the CCMP path to decrypt
CCMP MFP frames in the software path.

Differential Revision:  https://reviews.freebsd.org/D57799

There is no visible bug fixed as in current tree masks are the same.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6883b120c53735ff1681ef96d257f376731f56b3

Add const-qualified versions of the NLA iteration helpers to allow
walking immutable netlink attribute buffers without discarding const
qualifiers.

This introduces NLA_NEXT_CONST(), _NLA_END_CONST(), and
NLA_FOREACH_CONST() in netlink_snl.h.

Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by : Google LLC (GSoC 2026)

Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.

Reviewed by:    markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D54175

Revert pf_nl.h part of 017690e50913 and use new libsysdecode build glue
that parses enums.

Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D57866

The historical design of sockets is that on a re-connect the disconnect is
performed at the socket layer in soconnectat().  Since SMP times this is
known to be racy and the function has appopriate comment.  I missed that
in the recent change.  The pr_connect method should normally expect the
socket to be already disconnected, however should be able to handle a race
where socket is actually connected.  Convert the check that incorrectly
tried to handle normal path of re-connect into check that handles the
race.

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ece716c5d34728a170f1dfe1b3389c267d6ddd1e

The ```int disable``` parameter is included in the bridge_stop function
signature but is not used in the function body.

I had noticed this when tracing the driver's path while learning more
about the ifnet library.

This parameter originally appeared when importing the driver from NetBSD.
However, the FreeBSD ifnet library no longer requires an if_stop function.
Meaning that the function signature can be changed to only contain needed
parameters for our bridge driver.

Discussed with: freebsd-net@ mailing list
Signed-off-by:  Acesp25 <acesp25@freebsd.org>
Reviewed by:    kp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2290

A mistake from 90ea8e89d9b7 is that in6_pcblookup_internal() was skipped
for an inpcb that had unspecified local address.  This is incorrect, as
such inpcb could have already have a port set, and in_pcb_lport_dest()
shall not be called on such inpcb.  That could lead to creation of an
alised connection in the database.

This makes the function almost identical to in_pcbconnect().  While here,
fix minor bug of missing INP_ANONPORT.  This flag has no use in kernel,
but affects netstat(1) output in certain mode.

Fixes:  https://cgit.freebsd.org/src/commit/?id=90ea8e89d9b751e8b5ae90ef3397883b035788e5
Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D57987

And make net.inet.ip.portrange.randomized boolean.

Reviewed by:            pouria, tuexen, markj
Differential Revision:  https://reviews.freebsd.org/D57291

Enable IFCAP_MEXTPG by default, which may bring performance benefits.
Allow it to be disabled, and when disabled assert that we do not receive
any mbufs with M_EXTPG set. This is useful for testing.
Default the tests to disabling MEXTPG support.

Reviewed by:    zlei
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58054

The network layer must not pass unmapped (M_EXTPG) mbufs to if_output()
of network interfaces without IFCAP_MEXTPG. pf should convert these
mbufs by mb_unmapped_to_ext() for such interfaces but it didn't.
The problem had occurred on sendfile because sendfile system call
uses unmapped mbufs for the file data.

Reported by:    feld
Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D58021

Some nic drivers (including iflib) do not initialize if_hwassist
until after the interface is brought up.  If a lagg member is included
in a lagg when its not yet been brought up, that will cause lagg to see
if_hwassist=0 and will disable all checksum offload, etc, on the interface.
This is almost impossible to debug without kgdb or dtrace, as ifconfig does
not surface if_hwassist.

Fix this by re-calculating lagg caps (including if_hwassist) after adding a port.

I encountered this problem when I had a commented-out if_foo1=up entry in
my rc.conf that i neglected to uncomment when I was re-configuring a lagg.

Sponsored by: Netflix
Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D58062

RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero
octets, then the 20-octet IPoIB link-layer address.
The ND code assumed the Ethernet layout (RFC 4861, section 4.6.1)
everywhere and read/wrote the address directly after the option
header, i.e. two octets early.
The option-length sanity check computes 24 for both layouts for
a 20-octet address, so the mismatch was silent.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296585
Reviewed by:    adrian, pouria
Sponsored by:   VersatusHPC
Differential Revision: https://reviews.freebsd.org/D58096

From openssh-portable commit c14709356563.

Reported by:    cy

Fixes:        https://cgit.freebsd.org/src/commit/?id=e7d02be19d40063783d6b8f1ff2bc4c7170fd434
Signed-off-by:  Yusuke Ichiki <public@yusuke.pub>

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295434

Update nexthop flags with interface link status events and
instead of checking link status of interface for every packet
only check the reachability flag of the final nexthop.

Reviewed by:    glebius
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D57375

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

Provide a name for SCTP sockets.

Fixes:          https://cgit.freebsd.org/src/commit/?id=8b2b62b49d88 ("sockstat: consolidate unix(4) protocols in the array of protocols")

Fix missing Include which is currently leaked through vnet code.

Reported by: bz
Fixes: https://cgit.freebsd.org/src/commit/?id=d05d1f256082 ("routing: Subscribe nhops to ifnet link events")
Differential Revision: https://reviews.freebsd.org/D57375

Per sys/conf/files this unit is not compiled for a NOIP kernel.

Reported by:  Alexander Sideropoulos <Alexander.Sideropoulos@netapp.com>
MFC after:      1 week

This is exactly the same as the second part of IPv4's change
136c5e17b61a1/D49153.

Make R-bit per RFC 6275 8.3 and P-bit per RFC 9762 7.1 in
Prefix Information option available to userland for future implementations.

RFC 9762 7.1: For each interface, the client MUST keep a list of every prefix
that was received from a PIO with the P flag set and currently has a non-zero
preferred lifetime.

Differential Revision: https://reviews.freebsd.org/D56207

- Early return when no new data is delivered
- Switching from PRR-CRB to PRR-SSRB only when both SND.UNA advances and no further loss is indicated.
- Accounting for sequence ranges SACKed before entering recovery in RecoverFS calculation.
- Force a fast retransmit upon entering recovery when prr_out is 0 AND SndCnt is 0.
- Set cwnd to ssthresh post recovery.

Obtained from: mohnishhemanthkumar_gmail.com
Reviewed by: rscheff, tuexen
Differential Revision: https://reviews.freebsd.org/D56535
MFC after: 3 months

Add FIB selection logic by introducing ifa_ifwithaddr_fib() to
support FIB-specific lookups. Then have ifa_ifwithaddr() wrap it
with RT_ALL_FIBS.
Also, do the same for ifa_ifwithaddr_check().

Reviewed by:    glebius, bnovkov
Differential Revision: https://reviews.freebsd.org/D58305

Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.

Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58361

Sponsored by:   NetApp, Inc.
MFC after:      1 week
Reviewed By:    tuexen, #transport, markj
Differential Revision: https://reviews.freebsd.org/D58360

When a protocol-specific 'bind_all_fibs' tunable is set to 0, a
listening socket will only receive traffic originating from the FIB
it was bound to. However, there are no checks to determine whether
an address exists in the target FIB when binding the socket, which can
lead to a situation where a socket and the address it was bound to
belong to different FIBs.

Prevent this footgun by looking up the requested address in the current
FIB if 'bind_all_fibs' is active and returning an error if the address
does not exist.

Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D58281
Reviewed by:    glebius, pouria, markj
MFC after:      2 weeks

In practice, this is not possible, but we are adding it just to be safe.

Reported by:    markj

pf(4) currently ignores fragment direction (in vs. out)
in pf_frnode_compare() function.

Issue noticed and reported by Frank Denis

OK @bluhm

Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, eaa2c80721
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Outbound packet which matches rule with source limiter attached,
for example:

    source limiter "crash" id 1 entries 10000 limit 1000
    pass out from any to any source limiter "crash" keep state

triggers a NULL pointer dereference.

The issue was kindly reported and initial version of fix
submitted by SecBuddyF, Tencent KeenLab.

The submitted diff fixed the issue for failing look up by destination
address in outbound packet. dlg@ also pointed out the change should
be further improved so NULL pointer dereference is avoided when rule
uses nat-to/rdr-to option.

OK dlg@

Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, f0f215c11e
Sponsored by:   Rubicon Communications, LLC ("Netgate")

The latest version of draft-ietf-tcpm-tcp-ghost-acks changed
a condition. This should make no substantial difference, but makei
it compliant to the latest version of the specification.

Reviewed by:            rscheff, Peter Lei
MFC after:              3 days
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D58411

During call to `icmp_verify_redirect_gateway()` ensure using
fib-aware source address selection function.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58409

When we drop the prefix lock to call nd6_prefix_offlink() or
nd6_prefix_onlink(), make sure to keep the correpsonding prefix
structure alive.  It is possible for a concurrent nd6_timer() to expire
the prefix while the lock is dropped.

Reported by:    Maik Muench of Secfault Security
Reviewed by:    pouria, zlei
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58423

inpcb: declare struct in_conninfo as a single declaration

This removes just one level of #define mess that is needed to reach into
an inpcbs IPv4 address.  And makes the declaration easier to read.  No
functional change.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D58273

libdtrace: Fix up translators after struct in_conninfo changes

Fixes:  https://cgit.freebsd.org/src/commit/?id=698402f4f97c ("inpcb: declare struct in_conninfo as a single declaration")

libdtrace: Fix up one more translator

Fixes:  https://cgit.freebsd.org/src/commit/?id=d8bcb13b79b4 ("libdtrace: Fix up translators after struct in_conninfo changes")

in_ifprimaryaddr() exists only to support IPv4 multicast usage. Since the
adoption of epoch tracking, ifa_ref() is no longer required in its body;
that was originally introduced by rwatson in 2009.

We could not use __deprecated1() from <sys/cdefs.h> anyway, as
IFP_TO_IA() is a macro, not a function.

Approved by:    glebius (2026-02-26)
Reviewed by:    adrian, glebius, pouria
Differential Revision:  D55344

IPv4 multicast currently has the big caveat that it depends on the first
assigned IPv4 address on an interface (the so-called "primary address").

in_ifprimaryaddr() only needs to be used by the following:
 - the 0.0.0.0 booting node input workaround in IGMPv1;
 - filtering out the node's own reports in IGMPv2;
 - preserving the source IP where an IGMPv3 report has been looped back;
 - inferring the default upstream IPv4 interface address for the
   IP_MULTICAST_IF socket option;
 - and inferring the source address during ip_output() for a multicast
   datagram where an interface has been explicitly specified by that option.

All of these uses mandate the use of IPv4 source address selection, but
FreeBSD does not yet (fully) implement this functionality.

Approved by:    glebius (2026-02-26)
Reviewed by:    adrian, glebius, pouria
Differential Revision:  D55345

If we have source address specified, try to find it by enumerating
ifas on specified fib.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58444

Revert UseBlocklist from SSHCFG_ALL to SSHCFG_GLOBAL (with
SSHCFG_COPY_NONE), ensuring it can only be set globally in sshd_config
rather than within conditional Match blocks, matching historical
behavior.

Reviewed by:    emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision:  https://reviews.freebsd.org/D58520

This may plug minor leaks which no-one has reported. The default IPv6 source
address selection policy list in FreeBSD is usually limited to 9 entries,
and can be readily inspected with ip6addrctl(8). The policy table is
however instantiated for each VNET.

The leak of a pol instance in delete_addrsel_policyent() was already
plugged by @ae in commit-id ecc5c73, so that change has not been merged.

Do not tear down the sxlocks as glebius has requested, and move the
addrsel_policyent{} declarations further up to avoid redundant forward
declarations as glebius requested for stylistic reasons.

Reviewed by:    ae, pouria
Sponsored by:   Cisco Systems, Inc.
Differential Revision: https://reviews.freebsd.org/D55599

When a TCP timer is stopped, t_timers[] is set to SBT_MAX. Adding the
corresponding t_precisions[], if it is not zero, would result in
overflows in tcp_timer_next(). To avoid this, skip stopped timers.

The problem was identified while debugging uperf by Lukas Book and
an initial patch was provided by him. The committed patch was
suggested by glebius.

The problem can be observed by running netstat -nxptcp and looking for
negative timer values and by observing very long running timers in
some cases.

Reported by:            Lukas Book <lkbook@outlook.de>
Reviewed by:            glebius
Differential Revision:  https://reviews.freebsd.org/D58484

nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
uses that pointer afterwards to set nd_ra.

When m_pullup() relocates the chain it frees the original first mbuf and
returns a new one, leaving ip6 dangling; the subsequent access may be a
use-after-free read.

The fix writes ip6 from the returned mbuf after m_pullup() inside the
conditional if.

Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D58229

nd6_prefix_onlink will enter net_epoch when necessary.
Also, exit net_epoch earlier in nd6_prefix_onlink,
Because we acquired a reference to ifa, and we got our ifa
from the pr->ndpr_ifp, we don't need to stay under epoch.
While here, style it.

Reviewed by:    markj, glebius
Discussed with: zlei
Differential Revision: https://reviews.freebsd.org/D56129

Add the ability to select source ip address of outgoing packets
even when the source ip address is configured on another interface.
Also add this new rtnetlink attribute to manual.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius, ziaee (manpages)
Tested by:      ivy, Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D58294

    Restrict the scope of the struct hc_metrics_lite to the kernel only.
    Update the naming to align with other kernel structures and add a tcp_ prefix.

Reviewed by:            glebius
MFC after:              2 weeks
Sponsored by:           NetApp, Inc.
Differential Revision:  https://reviews.freebsd.org/D58440

    When configuring the expire timeout to something short, make sure that the
    prune time runs at least at that interval. Similarly, when adjusting the
    prune interval up, ensure the expire timeout reflect that expected minimum
    time also. Finally, restart the callout timer so that the next pruning
    happens after the new, expected interval.

Reviewed By:            glebius
MFC after:              2 weeks
Sponsored by:           NetApp, Inc.
Differential Revision:  https://reviews.freebsd.org/D58424

Prior to commit 90ea8e89d9b751e8b5ae90ef3397883b035788e5, this was
handled by calling in6_pcbladdr().

Reported by:    syzkaller
Reviewed by:    pouria, glebius
Fixes:          https://cgit.freebsd.org/src/commit/?id=90ea8e89d9b7 ("netinet6: refactor in6_pcbconnect()")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58518

Reported by:  Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by:    pouria, kp
Fixes:          https://cgit.freebsd.org/src/commit/?id=0361f165f219 ("ipsec: replace SECASVAR  mtx by rmlock")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58521

Some devices remap the PF queues when entering or leaving SR-IOV. Add
opt-in PCI IOV helpers that hold the iflib context lock across the
complete stop, driver callback, and restart transaction.

Existing drivers continue to use the non-restarting helpers.

Sponsored by:   BBOX.io

Remove unused rnh_multipath and rib_algo_fixed members.
While here, convert rib_dying and rib_algo_init from uint32_t to bool.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58537

Add validation for unused parameter values in the gap between
VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent
panics.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297151
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    markj
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58552

if_gre(4): Fix races by changing initialization order and locks

Treat if_gre like any other network drivers during module
initialization by using SI_SUB_PROTO_IF.
Also, destroy cloned interfaces via a prison removal callback for
gre over udp.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275474
Reviewed by:    markj
Discussed with: glebius
Differential Revision: https://reviews.freebsd.org/D57669

if_gre(4): Fix link state announcement in SIOCDIFPHYADDR

Since we unlock gre before if_detach() and use slock in gre_clone_modify_nl()
there is no need to split if_link_state_change() out of gre_delete_tunnel().

Reported by: markj
Fixes: https://cgit.freebsd.org/src/commit/?id=a0d2e5ebaa2e ("if_gre(4): Fix races by changing initialization order and locks")

Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666

A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.

The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.

For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.

When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,
check for both. Add this only to the base stack, since the RACK and
BBR stacks already do this.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296594
Reviewed by:            rscheff
MFC after:              3 days
MFC to:                 stable/14
MFC to:                 stable/15
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D58594

This change is intended to address @glebius comments from the original D55663.
ip6_hdr_pseudo{} is referenced by certain OpenBSD OCF related components. I am
using __aligned(4) and not __packed as urged by the late Hans-Petter Selasky.
Use C99 types and style. We must eat the churn now cross-BSD compatibility
is "Fade to Black".

Put _Static_assert under #ifdef INVARIANTS to not disrupt regular compilation,
as this resides in a commonly included header file.

This brings xform_tcp.c into line with possible future OCF related imports.

Add support for allowing IPv4 multicast groups to be joined on IPv6 sockets,
as a number of applications began to rely on this over the years, despite it
only ever having been a convenience which appeared in Solaris & Linux over
the course of the 00s decade. It is limited to any-source joins (ASM).

To avoid further quibbling over the meaning of the term "undocumented" as it
applies to this change, I have chosen to use the wording "non-IETF-ratified
extension" in comments, with reference to the updated ip6(4) man page.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246

Comment updated only. No functional change.

It is unrealistic to expect that this feature will ever be resurrected from
the legacy KAME tree, given historical divergence, and that applications
which really need to consume all group state (e.g. proxies) will either
join on a per-group basis, or use link-layer mechanisms anyway. It was also
very poorly documented to begin with.

1. EFAULT was happening because sooptcopyin() from inp_join_group() was
seeing the user-space thread descriptor in the faked-up sockopt. So, do
not attempt a user copyin(); defer to C99 initialization nulling sopt_td
for us to force a KVA memcpy().

2. It seems necessary to byte-swap ipv6mr_multiaddr.s6_addr32[3] on amd64
for similar reasons as to how the user-space initialization needed for
passing an IPv4-mapped group address also requires byte-swapping of the
0x0000FFFF field for s6_addr32[2]; it is a direct assignment to a integer
member of a struct, NOT a memcpy().

3. The assignment to imr_interface within in6_v6_mreq_to_v4() was obfuscated
by a cast back to its own type due to use of the IA_SIN() macro. Elided.

With this change, the feature gap seems to be closed; tested with a simple
link-scope IPv4 group under 224.0.0.0/24 with an mlx5(4) SR-IOV VF in bhyve.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision:  https://reviews.freebsd.org/D58590

cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296838
MFC after:      4 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58377

pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297220
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

The SIOCGETSGCNT handler may be invoked in this scenario, and if no
router has initialized the lookup table, we'll have
mfct->mfchashtbl == NULL.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297148
Reported by:    Robert Morris
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

This should assist setups that connect a lot of nodes to ipfw: and then
distribute traffic with ipfw(4) tablearg feature.

Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D58547

The same variable was used as a counter for an inner and out loop.
Add a new one for the inner loop.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283934
Reported by:    crest at rlwinm.de

This tool supports two commands.  The list command outputs a summary
of injectable errors supported by the current system.  The inject
command injects the requested error.

Reviewed by:    gallatin, imp
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58026

LOG_CONS was OR'd into the facility argument instead of logopt, leaving
logopt as 0.  The correct call is openlog(ident, LOG_CONS, LOG_AUTH),
as shutdown(8) and init(8) already do.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296315
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, des
Pull Request: https://github.com/freebsd/freebsd-src/pull/2300

By default bhyve(8) creates a snapshot socket in
"/var/run/bhyve/" (BHYVE_RUN_DIR).
As this is a system directory not writable by users,
this does not work when bhyve(8) is being started
as a non-root user.

Address that by allowing to override this directory.
In bhyve(8) it is done by setting 'rundir' option
with '-o rundir=<path>'.

In bhyvectl(8) it is done with '--rundir=<path>'.

MFC after:              1 month
Reviewed by:            bcr (manpages), bnovkov
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57494

The download protocol calls download_data with FileOffset and
BufferLength of 0 first to start the download (no data yet
available). Calls it again with BufferLength == 0 and FileOffset the
size of the download (again, no data). It then starts calling with
BufferLength != 0 and FileOffset == 0 to start the download. The
heuristic I used to detect the start was wrong, so we'd allocate the
buffer twice. Fix that by being more explicit and not using the
heuristic that was bogus.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58068

The end address is the final byte in the array, not one byte past the
end of the array, so we need to add 1 to get the full length.

Fixes: https://cgit.freebsd.org/src/commit/?id=59219fc76a4b ("loader.efi: efiblk_memdisk_preload passes the VirtualDisks to FreeBSD")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58069

This code is simpler when we spell it the Unix way. Also, add sanity
checks to make sure the offset is where we think it is.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58070

kldxref -m <file> will print the same data that the '-d' flag produces,
except restrict the output to one file. This should be the full path to
the file, and the directory name to process is omitted.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D57902

Reviewed by:  jfree, kib
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D58160

loader: Add xzfs, like gzipfs but with xz.

This is just like gzipfs or bzipfs, except done with the newer xz
program. This is off by default for the moment.

Sponsored by:           Netflix

loader: zstd based filesystem, zstdfs like gzipfs

Off by default.

Sponsored by:           Netflix

loader: Add forgotten xz.c and zstdfs.c

These were overlooked when I added compression support.

Fixes: https://cgit.freebsd.org/src/commit/?id=86d719ae68aa ("loader: Add xzfs, like gzipfs but with xz.")
Fixes: https://cgit.freebsd.org/src/commit/?id=c61ee49cd06a ("loader: zstd based filesystem, zstdfs like gzipfs")
Sponsored by:           Netflix

zonectl's Report Zones subcommand displays a tabular list of zones.  A
conventional zone's WP column is displayed as 0xffffffffffffffff , the
literal value that the HDD reports.  But that's too wide for the column,
causing the text to be misaligned.  It's also not really meaningful,
because the Write Pointer isn't really defined for a Conventional zone.
Change it to "-1" to fix the text misalignment.

MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    fuz
Differential Revision: https://reviews.freebsd.org/D57512

illumos smatch build is complaining:
    pci_nvme_parse_config() warn: 'sc->max_qentries' unsigned <= 0
    pci_nvme_parse_config() warn: 'sc->ioslots' unsigned <= 0

Because we are using atoi() to translate string to int, we need
to use int type variable for translation.

Reviewed by:    bnovkov
Differential Revision:  https://reviews.freebsd.org/D58213

Somehow, I wound up with space indents rather than tab indents, so fix
this.

Sponsored by:           Netflix

For devices like the rtw88, they will show up in `ifconfig -l` as
rtw880, rtw881, etc. We want to query the rtw88.0 and rtw88.1 sysctl
respectively, not rtw.880.

Chances are that there aren't more than 9 wlan devices using the same
driver. Use a better heuristic to get the device description.

Reviewed by:    bz
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Modify `blockif_open` to properly release a partially initialized
`blockif_ctxt` structure on error.

Differential Revision:  https://reviews.freebsd.org/D57887
Reviewed by:    novel, bnovkov, glebius
Tested by:      bnovkov
MFC after:      2 weeks

Since init become dynamically linked, reroot appeared to be broken
because init copies itself into a transient tmpfs mount to continue
controlling execution right after the reboot(REROOT) syscall.  Because
the binary is dynamically linked, it cannot be properly executed.

Provide a minimal static binary 'reroot_seed' embedded into the init as
byte stream, which performs what the 'init -r' did, namely, the second
phase reroot.

For the static build of init as part of the /rescue crunch, keep the
inline reroot code.

Reported and tested by: markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58164

pfr_add_table() does not set errno, it returns an error (now).
Read the error code from the return value so we display the correct
error message to the user.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

These calls return an error value, they do not set errno. Check their
return values.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

Pass such a section to the kernel using modinfo, otherwise link_elf.c
won't execute constructors for the file.  This is required for KASAN,
otherwise redzones for global buffers are not poisoned during boot.

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58244

- Scope local variables properly to each function.
- Quote variables that should be treated as single words.
- Replace `${cmd}; if [ $? -eq 0 ]` with `if ${cmd}` for simplicity.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57899

Add the option "oemstring" to allow setting the DMI type 11 ("OEM
Strings") SMBIOS structure. These are free-form strings, available for
any purpose, but can be especially useful to pass configuration,
secrets, and credential information into a Linux guest and consumed by
systemd.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57516

When writing to a file, call fchmod() to ensure the file mode matches
the intended mode, which is 0444.  This was already done when replacing
an existing file, but not when creating a new file, which meant if the
process umask was 077, the resulting certificates and bundle would be
unreadable by unprivileged users.

MFC after:      1 week
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58304

hwpmc: add regression tests for counting-PMC counter wraparound

Exercise a process-mode counting PMC whose accumulated count crosses,
or already exceeds, the range of the underlying hardware counter.
Before the previous commit, the first context switch after the
hardware counter wrapped panicked INVARIANTS kernels with "negative
increment" and silently corrupted the accumulated count on other
kernels.

The tests need a hardware counting event backed by a counter narrower
than 64 bits and skip where none is available (hwpmc(4) not loaded,
or a VM without a vPMU).

Reviewed by:            adrian
MFC after:              2 weeks
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58341

tests/sys/pmc: only build if MK_PMC != no

This unbreaks the build when pmc support is explicitly disabled via the
aforementioned build knob.

MFC after:      10 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=2cfd82f74 ("hwpmc: add regression tests for ...")
Differential Revision:  https://reviews.freebsd.org/D58401

vt(4) does not (currently) support changing the video mode.  Report that
-i mode is not supported rather than printing an empty list.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207411
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58163

The max_qentries in pci_nvme_softc is uint16_t and
too large int may get truncated to invalid value.
While there, use local declarations for val.

Suggested by: Bill Sommerfeld
Reviewed by:    chuck
Differential Revision:  https://reviews.freebsd.org/D58293

Firmware on a test machine applied NX to non-code allocations, which
resulted in a fault when jumping to the trampoline.

Reviewed by:    kib
Tested by:      Jim Huang Chen <jim.chen.1827@gmail.com>
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58383

MFC after:    1 week

Commit 9e1db51d4b5fc made nvmecontrol devlist get list of active
namespaces from the device instead of iterating through all possible
IDs.  The problem is that this request is not supported before NVMe
1.1, and in particular by Intel Optane 905P drives.  This change
reintroduces iteration for devices before NVMe 1.2.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D58010

Update fwget(8) to download wifi-firmware-mt76-kmod-mt7921, and
wifi-firmware-mt76-kmod-mt7925 firmware packages instead of the
no longer available mt792x version.
Add another PCI vendor to recognize ITTIM IDs for mt7921-based
MediaTek cards.

(bz reduced the license in the ittim file to an SPDX tag and updated
the commit message, given this is only half the work from the review)

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57242

pmc: console configuration and table rendering for new PMC tools

Initializes the terminal rendering code used by the new pmc tools.  Then
provides a table abstraction for collecting, sorting and rendering
tables.  It provides pretty printed results with typed fields that print
several types used throughout the new PMC tools.  By default the fields
are formatted in engineering notation.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57775

pmc: new pmc log processing framework

View is a class for building PMC log processing tools it is designed to
work with the new PMC record command that adds a header with additional
CPU information.  The new framework processes PMC logs about 2.5 times
faster and in about half the code as libpmcstat.

Sponsored by: Netflix
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57776

pmc: pmc record command

The record command is designed around the idea of predefined studies.
While you can still select individual counters, the predefined studies
are meant to enable the best hardware options for a given generation.
It implements all of the base studies that I have built so far.

Sponsored by: Netflix
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57777

pmc: pmc info command

Prints the log header including machine, cpu and kernel details along
with what counters were selected.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57778

pmc: pmc frontend stall analysis based on IBS

The frontend command uses AMD IBS frontend events to analyze the major
sources of frontend stalls.  It displays a table breakind down the major
causes of front end stalls.  This is a simple demonstration of the tools
as you can use the filtering tools to limit the analysis to a subset of
the samples including filtering by fetch latencies.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57779

pmc: enable the new pmc commands

This change hooks everything up to the pmc command and improves the
usage to document all functions.  There are a couple older commands that
are currently broken that I have hidden from the usage, but left in the
code for those using it.  I won't remove those until we have our
replacements upstreamed that depend on the AMD PMC multiplexing patches.

Sponsored by: Netflix
Reviewed by:    adrian, imp
Differential Revision:  https://reviews.freebsd.org/D57780

route(8): Add prefsrc option in netlink

Add prefsrc option that is frequently used on unnumbered interfaces
or L3 multi-homed network hosts.
This option uses RTA_PREFSRC.
Now you can add a static route by specifying the prefsrc option
with the loopback IP.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285422
Reviewed by:    glebius
Differential Revision: https://reviews.freebsd.org/D58294

route(8): Add null check for prefsrc option

Reported by:    Shawn Webb <shawn.webb@hardenedbsd.org>, bms
Fixes:  https://cgit.freebsd.org/src/commit/?id=dd235f097af4 ("route(8): Add prefsrc option in netlink")

Modify the disk check to allow arbitrary files as the trailing argument
instead of requiring a live GEOM disk provider.

This enables modifying a boot0 binary file in-place before flashing it
to a disk via gpart bootcode, or using it directly as an argument to
mkimg's partition specification, as these tools cannot directly adjust
the parameters of the boot0 boot manager.

Reviewed by:    imp, jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57310

The need for this step is fading, now is mostly used to allow the
selection of just the two code partitions in the boot0 boot manager,
instead of the default of allowing all four MBR slices (the other two
being cfg and data, which cannot boot).

Reviewed by:    imp
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57311

The test uses a fail point to inject a decryption error in OCF while
sending a ping across the tunnel.  The driver should then fail to
respond to the ping and increment the input error counter on the
interface.

Approved by:    so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Reviewed by:  kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=561991144e42 ("Remove Obj_Entry textsize member.")
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D58522

 - When cached response is available, actually use xid from one
instead of using its byte-swapped value for BIOS and 1 for UEFI.
 - If cached response is not available, generate pseudo-random xid,
since use of a constant may cause conflicts if two systems are
booting same time, and server sends responses as broadcast.
 - When cached response is available, skip DHCP DISCOVER/OFFER
and just send REQUEST to the DHCP server from the cached response.
We could skip this phase too and just use the cached response, but
we don't know whether firmware requested all of DHCP options we'd
like to get.

Tested on amd64 Supermicro X11DPI-NT for both BIOS and EFI, with
and without cached response packet.

Implement netlink support for gre in ifconfig

Differential Revision: https://reviews.freebsd.org/D55366

Transaction ID should persist only between OFFER and the following
REQUEST.  In all other cases it should change.

This implementation does not cover tunnel addresses.

Differential Revision: https://reviews.freebsd.org/D57667

Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271910
Reported by:    Robert Morris
Reported by:    Décio Brandão (0xDBJ)
Reviewed by:    emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58554

Some drivers do this routinely, e.g., FreeBSD's tpm20 does this every
time it sends a command in tpmcrb_transmit().  This causes the console
to fill up with messages.  Instead, only print a warning if the cancel
bit is set to one.

Reviewed by:    corvink
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D52425

Commit 505222d35fea removed a batch of code that this goto used to skip
around.

Reviewed by:    olce, kib, markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=505222d35fea ("Implement the long-awaited module->file cache database.  A userland tool (kldxref(8)) keeps a cache of what modules and versions are inside what .ko files.  I have tested this on both Alpha and i386.")
Differential Revision:  https://reviews.freebsd.org/D58539

Previously all the 'goto out' statements after the image was loaded into
memory returned success rather than an error.  This is despite comments
indicating some of these conditions were in fact errors, and some of
these error conditions (such as missing PT_DYNAMIC) are treated as errors
in the kernel linker.

In addition, when failing to looking up the symbols for the linker
set, those cases returned failure leaking memory (though it's clear
from the original code from commit ca49b3342d1e that only the second
failure was intended to be an actual error).

To avoid more confusion, move the assignment of `ret` to just before
the `out` label so that `goto out` always returns an error.  This is a
more consistent pattern with other code in the tree that tends to use
labels for the error case.

Restructure some other code to avoid a few bogus errors.
Specifically, a symbol table is not required so don't treat lack of a
symbol table as an error.  Also, if the start symbol for the module
metadata linker set is not found, don't treat that as an error either.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58540

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.  The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58541

Reviewed by:  jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58543

Pass a single module name to load_kld for kbdmux and vkbd, allowing
bthidd_prestart to load both modules successfully.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cfe1962a1925 (rc: Fix improper use of load_kld)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Allowing nuageinit user scripts to run before these makes it possible to
customize official BASIC-CI and BASIC-CLOUDINIT FreeBSD images.

This was requested by KDE for their CI.

Approved by:    cperciva
Pull-Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/60

Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have.  Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.

Reported by:    Joshua Rogers <joshua@joshua.hu>
Tested by:      Décio Brandão (0xDBJ)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58555

This is in lieu of a full Kyua/ATF regression test, as this is an optional
feature that was beyond the scope of IETF's normative references for IPv6
multicast; support has been strictly on a best-effort basis.

Two new commands are added to mtest(8):
u mcast-addr ifname - join IPv4-mapped group on IPv6 socket
v mcast-addr ifname - leave IPv4-mapped group on IPv6 socket

Add an internal helper function __in6_v4_to_v4mapped() to perform the
converse of the IN6_IS_ADDR_V4MAPPED() check to support this use case.
Whilst __in6_v4_to_v4mapped() returns its first argument as a convenience,
avoid the temptation to dereference a pointer to that which we already hold.

Strictly the use of sockunion_t within mtest(8) more generally is a form
of controlled type punning (aliasing). Use a temporary as we overwrite
contents of su; the resultant write would overlap memory locations.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision: https://reviews.freebsd.org/D58589

Fixes:                https://cgit.freebsd.org/src/commit/?id=7e2f38311e62 ("rtld-elf/rtld.c: apply clang-format")
Sponsored by:   Innovate UK

Populate stand/libsa/bootp.c's bootp_response global from the UEFI PXE
Base Code Protocol's cached DhcpAck, so bootp() can enter RFC 2131
INIT-REBOOT and skip DISCOVER/OFFER instead of running a fresh DHCP
transaction after the firmware has already done one.

Fixes:        https://cgit.freebsd.org/src/commit/?id=255538cd906045095d0c2113ae6c4731ce36c0cf
Differential Revision: https://reviews.freebsd.org/D57850
Reviewed by:    adrian

MFC after:    1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=c3276e02beab ("sockets: make shutdown(2) how argument a enum")
Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D57915

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296410
Submitted by:   Tomas Vondra <tomas@vondra.me>
MFC after:      1 week

libsysdecode: decode Generic Netlink controller messages

Decode Generic Netlink controller (GENL_ID_CTRL) messages in
Netlink payloads. Display the Generic Netlink header along with
the CTRL_CMD_GETFAMILY attributes, including the family ID and
family name.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: cache Generic Netlink family IDs

Record Generic Netlink family IDs learned from
CTRL_CMD_GETFAMILY responses and use them to decode subsequent
Generic Netlink messages using symbolic family names instead of
numeric IDs.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: decode PF Generic Netlink commands

Decode the Generic Netlink command header for messages
belonging to the PF Generic Netlink family. Display the
command name using the PF Generic Netlink command decoder.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libc/resolv: Drop Solaris 2 compatibility

MFC after:      1 week
Reviewed by:    kevans, markj
Differential Revision:  https://reviews.freebsd.org/D57922

libc/resolv: Refactor the option parser

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

libc/resolv: Refactor the configuration parser

This was previously all a single loop in res_init(), apart from option
parsing which we cleaned up in a previous commit.  Break it out into
separate functions for reading the configuration line by line, setting
the default domain, setting the search list, and adding a nameserver
to the nameserver list.  Sprinkle bounds checks and code comments all
around.

The sortlist code, which has been disabled for the past 20 years, will
be dealt with in a separate commit.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57924

libc/resolv: Reimplement the sortlist parser

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

libc/resolv: Add no-debug and no-rotate options

These are simply the reverse of the debug and rotate options.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57926

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57927

getfacl / acl_to_text() incorrectly prints uid/gid numbers as signed integers.
This causes uid / gid numbers larger than 2G (2147483648) to print as
negative numbers.
The libc acl_from_text() function does not handle negative numbers.
This diff adds a backwards compatiblity fix to allow negative numbers...

Reviewed by:    rmacklem
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57180

While here, clean up and simplify the existing code.

MFC after:      1 week
Reviewed by:    glebius, jhb
Differential Revision:  https://reviews.freebsd.org/D57993

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

libfetch: Overhaul socket read / write

* Make fetch_ssl_read() and fetch_ssl_write() behave more like read(2)
  and write(2), and drop fetch_socket_read() in favor of read(2).

* Don't request POLLERR, it's implied.

* Don't needlessly set errno, it's relatively costly.

* Always check for EAGAIN from writev(2), otherwise we will abort on a
  short write instead of proceeding to poll(2).

* Always check for EAGAIN from poll(2) even though it can't happen on
  FreeBSD; POSIX says it can, and it might in the future.

* Rewrite fetch_read() and fetch_writev() to be more similar to each
  other.  The main difference is that a partial read is treated as
  success while a partial write is treated as failure.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296316
MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57906

libfetch: Add read buffering

Previously, we would read FTP control connection messages and HTTP
reponse headers one character at a time.  Now, we read as much as will
fit in our buffer and look for a newline.  If there is data left over,
it will be reused by the next fetch_getln() call.  This also requires
the addition of a fetch_bufread() which takes the buffer into account,
otherwise the start of the HTTP response body will be stuck in the
buffer after we read the last line of the header.

This should noticeably improve HTTP performance, especially for small
transfers.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57907

libfetch: Apply timeout to connection attempts

Mark the socket non-blocking before connecting and poll for completion,
applying fetchTimeout if set.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57909

Make fetch_ref() an inline and provide a fetch_deref().

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57944

Reduce the amount of copying we do when performing buffered reads.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D58113

Reviewed by:  zlei, vmaffione
Obtained from:  https://github.com/luigirizzo/netmap/commit/b52a2bcae35e56548acfb0849b248a1e4b0c0c3b
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58150

Reviewed by:  zlei, vmaffione
Obtained from:  https://github.com/luigirizzo/netmap/commit/7d9177ed9a121e66bf4eaa0acb5d574e408297da
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58151

Logic prior to this change would incorrectly try linking when MK_CDDL != no,
instead of MK_CTF != no, which could result in the library and the tests being
broken if/when MK_CTF == no and MK_CDDL != no (an uncommon, but possible
combination with today's build knobs).

This change updates the conditional to correctly track the value of MK_CTF, which
in turn is properly toggled to no if/when MK_CDDL == no as it's a dependent build
knob.

This [niche] build bug has been present in FreeBSD since 2014.

MFC after:      1 week

* Get rid of the pointless LOCALBASE_CTL_LEN mechanism

* Apply minimal normalization to the paths obtained from the environment
  or sysctl variable

* Turn the manual page into a manual page

* Add tests

MFC after:      1 week
Reviewed by:    se
Differential Revision:  https://reviews.freebsd.org/D58362

MFC after:    1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=2a5e58c59694 ("procdesc: add NOTE_PDSIGCHLD")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58388

Introduce a generic Netlink attribute decoding framework based on
attribute decoder tables. The framework supports decoding primitive
attribute types as well as nested attributes and can be reused by
different Generic Netlink families.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed-by:    kp
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2337

Sponsored by:   The FreeBSD Foundation

Sponsored by:   The FreeBSD Foundation

Replace <sysdecode.h> with "sysdecode.h" so local builds use the in-tree header
in lib/libsysdecode instead of a stale installed copy in /usr/include, avoiding
build failures after updating sysdecode.h.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)
Reviewed by:    kp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2338

Change sysdecode_nlm_flag() to decode Netlink message flags as a
bitmask instead of looking up a single flag value. This correctly
prints combinations of NLM_F_* flags while preserving any unknown
bits in hexadecimal.

Reported by:    androvonx95 <androvonx95@tutamail.com>
Reviewed by:    kp
Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by:   Google LLC (GSoC 2026)

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

libfetch: Fix handling of connection failures

After commit 848f360c8f9a, if one tries to connect to a closed port,
fetch reports "Operation now in progress", which is rather confusing.
Return a more useful error message, restoring the old behaviour.

Fixes:          https://cgit.freebsd.org/src/commit/?id=848f360c8f9a ("libfetch: Apply timeout to connection attempts")
Reviewed by:    des
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58481

libfetch: Further improve connection polling

* Reorganize the connection loop to make it a little more readable

* Start the timeout clock earlier

* Correctly calculate the poll timeout before calling poll()

* Don't leak the socket on failure

Fixes:          https://cgit.freebsd.org/src/commit/?id=848f360c8f9a ("libfetch: Apply timeout to connection attempts")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b02e02958dad ("libfetch: Fix handling of connection failures")
MFC after:      3 days
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58512

Some NLM_F_ definitions contain multiple underscores in their name; this
should pick them up.

Reviewed by:    kp, Ishan Agrawal <iagrawal9990@gmail.com>
Fixes:  https://cgit.freebsd.org/src/commit/?id=4c932a4d45fb ("netlink: decode netlink message flags symbolically")
Sponsored by:   The FreeBSD Foundation
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2340

Reviewed by:  jrtc27
Differential Revision:  https://reviews.freebsd.org/D58558

stdio: *memstream: slightly streamline growth function

Inverting the condition after realloc*() is a minor cleanup, but makes
the success path a little cleaner to ease a future change.

Reviewed by:    des, jhb
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57353

stdio: *memstream: decouple the buffer size from the stream length

It's useful to be able to track both facts with a single variable, but
it also makes it more difficult to change how the buffer size scales.

As an example, Apple's implementation seems to scale the buffer size by
1.5x on growth, presumably in an attempt to reduce trips into realloc().
This might be questionable in the face of stdio buffering, but avoiding
serious churn in the line- or un-buffered case is a net positive if
doing so isn't incredibly invasive.

Reviewed by:    des, jhb, obiwac
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57354

stdio: *memstream: grow the buffer by 1.5x on write

This improves performance by reducing the number of allocations as we
write into the memstream, both in the fully buffered case with larger
memstreams and also more trivially in the line- and un-buffered case as
they flush back to the underlying buffer more often.

The inspiration for this was taken from Apple's implementation in
https://github.com/apple-oss-distributions/libc, but expanded to include
wmemstream for consistency.  I've added a test for the bug that I hit in
libder that caused me to notice this in the first place, and fixed that
bug in this version.

Reviewed by:    des, jhb (both slightly previous version)
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D57355

stringf.cc uses errno and related macros without including <cerrno>.

Their availability is guaranteed only when the corresponding header
is included; transitive exposure is implementation-defined.

Modern libc++ has been progressively reducing incidental transitive
includes as part of its header removal policy (see LLVM libc++ Header
Removal Policy and D132284), making such dependencies brittle.

This change includes <cerrno> explicitly to make the dependency
well-defined. No functional or behavioural change intended.

Approved by:    fuz
Signed-off-by:  Faraz Vahedi <kfv@kfv.io>
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2188

Currently mergesort() uses ICOPY_*() to copy data as four byte blocks
instead of one byte. However, this is only achievable when both size and
base arguments are aligned to four bytes.

Use of memcpy() is ideal as 1) it is cleaner and 2) the library will use
SIMD for copying when the hardware supports it. Compared to ICOPY_*(),
SIMD can support up to 64 bytes. When the SIMD-backed memcpy() find the
address is unaligned, it can first copy data up to the nearest aligned
address, and then use SIMD operations for faster transfer. Thus memcpy()
can give better performance than mergesort()'s own implementation.

This is benchmarked on amd64 where there isn't a SIMD-backed
implementation yet. However, the baseline implementation in assembly
already delivers better performance in unaligned cases although there is
some performance drops in aligned cases. The benchmark results and
script is available in the Phabricator review. Ideally, more performance
improvements will come when amd64 gets SIMD implementation of memcpy().

Signed-off-by:  Minsoo Choo <minsoochoo0122@proton.me>
Reviewed by:    fuz
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58002

This commit implements the inverse half-cycle
trigonometric functions:

   asinpi(x) = asin(x) / pi                        Eq. (1)
   acospi(x) = acos(x) / pi
   atanpi(x) = atan(x) / pi

Implemention details are contained in src/s_asinpi.c and
src/a_atanpi.c, where the details for acospi(x) appear in
the former.

*************

CAVEAT EMPTOR: The ld128 code has been only compiled.  It has
not been tested for correctness due to lack of hardware.

*************

Code compiled on AMD Ryzen 7 7700X system run FreeBSD 16.0-CURRENT
main-n284956-de9fe28ab847.

Exhaustive testing of acospif(x), asinpif(x), and atanpif(x)
on the indicated intervals yields

% ./tlibm acospi -fPE -x 0x1p-120 -X 1
Interval tested for acospif: [7.52316e-37,1]
      ulp <= 0.5: 99.627% 1002878299 |  99.627% 1002878299
0.5 < ulp <= 0.6:  0.277%    2789599 |  99.904% 1005667898
0.6 < ulp <= 0.7:  0.096%     965062 | 100.000% 1006632960
Max ulp: 0.63661975 at 5.96046412e-08 0x1.fffffep-25

% ./tlibm asinpi -fPED -x 0x1p-120f -X 1.f
Interval tested for asinpif: [7.52316e-37,1]
      ulp <= 0.5: 99.851% 1005129353 |  99.851% 1005129353
0.5 < ulp <= 0.6:  0.149%    1501097 | 100.000% 1006630450
0.6 < ulp <= 0.7:  0.000%       2510 | 100.000% 1006632960
Max ulp: 0.68957579 at 5.04878759e-01 0x1.027f78p-1

% ./tlibm atanpi -fPE -x 0x1p-120 -X max > zatanpif.txt &
Interval tested for atanpif: [7.52316e-37,3.40282e+38]
      ulp <= 0.5: 99.865% 2077574602 |  99.865% 2077574602
0.5 < ulp <= 0.6:  0.131%    2735011 |  99.997% 2080309613
0.6 < ulp <= 0.7:  0.003%      65170 | 100.000% 2080374783
Max ulp: 0.68433094 at 5.01186252e-01 0x1.009b7cp-1

Testing the double and long double version cannot be done
in an exhaustive manner.  For 300 M values, uniformily
distributed in the indicated interals, one finds the max ULP:

Interval tested for acospi: [9.31323e-10,0.25]
  xm =  2.4423788416892520e-01, /* 0x3fcf432f, 0xde79920f */
libm =  4.2146222480005391e-01, /* 0x3fdaf93c, 0xb201001c */
mpfr =  4.2146222480005396e-01, /* 0x3fdaf93c, 0xb201001d */
 ULP = 0.50499351466286857

Interval tested for acospi: [0.25,0.5]
  xm =  4.9689430915631438e-01, /* 0x3fdfcd1d, 0xc9d945c6 */
libm =  3.3447366122373884e-01, /* 0x3fd56804, 0x371513ef */
mpfr =  3.3447366122373889e-01, /* 0x3fd56804, 0x371513f0 */
 ULP = 0.57195275455053829

Interval tested for acospi: [0.5,0.75]
  xm =  5.0238623667462079e-01, /* 0x3fe0138c, 0x4d0f4be0 */
libm =  3.3245556599062825e-01, /* 0x3fd546f3, 0xb5d36303 */
mpfr =  3.3245556599062820e-01, /* 0x3fd546f3, 0xb5d36302 */
 ULP = 0.63427929243758807

Interval tested for acospi: [0.75,1]
  xm =  7.5853651919512177e-01, /* 0x3fe845ee, 0x60d8789f */
libm =  2.2591472240382732e-01, /* 0x3fcceac6, 0x0c3465ce */
mpfr =  2.2591472240382729e-01, /* 0x3fcceac6, 0x0c3465cd */
 ULP = 0.56915750216472161

Interval tested for asinpi: [9.31323e-10,0.25]
  xm =  1.9502362835488171e-01, /* 0x3fc8f688, 0xc4dda0fb */
libm =  6.2478354989018887e-02, /* 0x3faffd29, 0xb6c57c61 */
mpfr =  6.2478354989018881e-02, /* 0x3faffd29, 0xb6c57c60 */
 ULP = 0.52347765415885006

Interval tested for asinpi: [0.25,0.5]
  xm =  4.9937103583123676e-01, /* 0x3fdff5b1, 0xeeddbf62 */
libm =  1.6643553767987129e-01, /* 0x3fc54dc2, 0x7b9d15a4 */
mpfr =  1.6643553767987126e-01, /* 0x3fc54dc2, 0x7b9d15a3 */
 ULP = 0.66214688371031072

Interval tested for asinpi: [0.5,0.75]
  xm =  5.0228515250761718e-01, /* 0x3fe012b8, 0x4fe92bbb */
libm =  1.6750722213679006e-01, /* 0x3fc570e0, 0x6c75edd5 */
mpfr =  1.6750722213679009e-01, /* 0x3fc570e0, 0x6c75edd6 */
 ULP = 0.78223048105528226

Interval tested for asinpi: [0.75,1]
  xm =  7.5425933001419776e-01, /* 0x3fe822e4, 0x7663a4aa */
libm =  2.7200385380185182e-01, /* 0x3fd16882, 0xda1dc13b */
mpfr =  2.7200385380185188e-01, /* 0x3fd16882, 0xda1dc13c */
 ULP = 0.53747973176773822

Interval tested for atanpi: [9.31323e-10,0.25]
  xm =  1.9666113418757322e-01, /* 0x3fc92c31, 0x29dd6d2f */
libm =  6.1810387818117797e-02, /* 0x3fafa59c, 0x7476baa5 */
mpfr =  6.1810387818117804e-02, /* 0x3fafa59c, 0x7476baa6 */
 ULP = 0.54674297446584263

Interval tested for atanpi: [0.25,0.5]
  xm =  4.1312119637707068e-01, /* 0x3fda7093, 0xe2ee5494 */
libm =  1.2470309560460152e-01, /* 0x3fbfec8a, 0xc554ebec */
mpfr =  1.2470309560460154e-01, /* 0x3fbfec8a, 0xc554ebed */
 ULP = 0.73116638175113347

Interval tested for atanpi: [0.5,0.75]
  xm =  5.0018949583396499e-01, /* 0x3fe0018d, 0x66cd1b82 */
libm =  1.4763186871058706e-01, /* 0x3fc2e599, 0xdffacb8f */
mpfr =  1.4763186871058709e-01, /* 0x3fc2e599, 0xdffacb90 */
 ULP = 0.69192753950764663

Interval tested for atanpi: [0.75,1]
  xm =  7.5007880583359599e-01, /* 0x3fe800a5, 0x448f4c03 */
libm =  2.0484881828445453e-01, /* 0x3fca387c, 0x6f93f71f */
mpfr =  2.0484881828445450e-01, /* 0x3fca387c, 0x6f93f71e */
 ULP = 0.65765471872064396

Interval tested for atanpi: [1,2]
  xm =  1.0103228000344093e+00, /* 0x3ff02a48, 0x3d88d0a2 */
libm =  2.5163447403817019e-01, /* 0x3fd01ac7, 0x7b229108 */
mpfr =  2.5163447403817013e-01, /* 0x3fd01ac7, 0x7b229107 */
 ULP = 0.67409519689166042

Interval tested for atanpi: [2,4]
  xm =  2.0231383267437946e+00, /* 0x40002f63, 0x25a530a9 */
libm =  3.5387589538123299e-01, /* 0x3fd6a5e7, 0x156053c6 */
mpfr =  3.5387589538123293e-01, /* 0x3fd6a5e7, 0x156053c5 */
 ULP = 0.69695587476021503

Interval tested for atanpi: [4,1.79769e+308]
  xm =  4.0000000000000000e+00, /* 0x40100000, 0x00000000 */
libm =  4.2202086962263069e-01, /* 0x3fdb0263, 0xd2508e31 */
mpfr =  4.2202086962263069e-01, /* 0x3fdb0263, 0xd2508e31 */
 ULP = 0.27709400511686716

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295884
MFC after:      1 month
Reviewed by:    fuz

strfromd(), strfromf(), and strfroml() are implemented directly
in terms of gdtoa.  If a non-conforming format string is passed,
the string "EDOOFUS" is returned and errno set to EDOOFUS as an
extension.

Reviewed by:    fuz
MFC after:      1 month
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2301
Signed-off-by:  Faraz Vahedi <kfv@kfv.io>

On some platforms, e.g. Linux Clang 22.1.8 / glibc 2.43, strchr()
now implements the C23 behaviour where passing a const pointer to
strchr() also returns a const pointer.  This breaks getopt during
the bootstrap build, since it assumes the return value is always
a mutable pointer.

Since the pointed-to value is never modified, fix this by making
the pointer const.

MFC after:      1 week
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58488

Add an uncached sysctl based implementation which retrieves individual
categories.  A cache would be an obvious extension should this optional
feature that can only be enabled by an environmental varible have a
noticable performance impact in a case that matters.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58238

Rename am_lock description from autofslk -> autfsm.

The lock description, autofslk, is used as the description for
autofs_softc->sc_lock, which is used to protect autofs requests and the
like as opposed to am_lock which protects autofs nodes for a given
mount.

This change allows witness to distinguish different lock orders for each
lock.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57972

The OpenZFS merge 80aae8a3f8aa introduced HAVE_SIMD() which checks for
HAVE_TOOLCHAIN_* defines via simd_config.h.  The kernel module Makefile
was updated, but kern.pre.mk (static kernel build) and the libzpool/libzfs
Makefiles were missed, still using the old HAVE_SSE2 etc. names.  This
caused all vectorized raidz, fletcher, and blake3 implementations to be
compiled out.

The consequences are:
- for nfs exports and fhopen(2), unlinked but still referenced inodes
  are accessible
- for ffs_vput_pair() with unlock_vp = false, spurious ESTALE is not
  returned when the inode is still alive but unlinked

Note that tmpfs does not return ESTALE for the unlinked nodes.
The same behavior is claimed for Linux in
https://github.com/openzfs/zfs/issues/18699

Reviewed by:    rmacklem
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57982

Fix two locking violations that could happen during execve, while
executing a file stored on fusefs.  Both would cause panics on an
INVARIANTS kernel after 15.0, or a DEBUG_VFS_LOCKS kernel prior to that.
Neither is likely to be noticeable on a release kernel.

* Don't assume that the vnode is exclusively locked during VOP_CLOSE.
  It usually is thanks to !MNTK_LOOKUP_SHARED, but isn't during execve,
  which locks the vnode outside of the lookup path.

* Totally rewrite fuse_io_invalbuf.  It's had a number of problems ever
  since its original introduction[^1]:

  - Don't assume that the vnode is exclusively locked.  That assumption
    failed during execve just like the assumption in fuse_vnop_close.

  - Don't livelock forever if vinvalbuf returns ENOSPC or EDQUOT.

  - Don't attempt to handle multiple threads calling this function at
    the same time.  That would be impossible if the vnode truly were
    exclusively locked.  So the code was dead.  Or it would've been, if
    the assumption hadn't been wrong.  Furthermore, both vinvalbuf and
    vnode_pager_clean_sync only require a shared vnode lock, and are
    already capable of dealing with multiple simultaneous callers.

  - Using fvdat->flag in this way would require some sort of mutex
    protection, if the vnode weren't exclusively locked.

 * Add new test cases that trigger both of the aforementioned panics.

[^1]: https://github.com/glk/fuse-freebsd/commit/efe6eb3005e7633b4e31d5e453eacbaa0cba42fa

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295957
Reported by:    dan.kotowski@a9development.com
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D57536

Previously, an_vnode_lock was initialized with SX_NOWITNESS to silence
lock order reversals. The reversals would occur when autofs_node_vn()
was called with the directory vnode lock held, then lock an_vnode_lock,
then lock the vnode attached to the autofs node. It looked like:

    directory vnode -> an_vnode_lock -> vnode attached to autofs node

The established lock order is now vnode -> an_vnode_lock

Currently, we don't have to worry about losing an autofs node during the
unlock/lock as autofs nodes are only removed during an unmount() after
vflush(). When autofs_node_vn() is called, the mountpoint has either
been busied (preventing unmount) or a directory vnode is locked which
prevents vflush() from finishing until the directory vnode is unlocked.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57857

Commit 016570c4463d modified the client to handle
the upgrade of a read delegation to a write delegation,
where the server provides the same delegation stateid
to the client.  However, it failed to check if the
delegation structure was currently in use.  Without this
patch, if the structure was in use, a use after free
could occur.

This patch handles the "in use" case by copying the
necessary fields into the current/old structure and
free's the new one instead of the old one that is
"in use".

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296224
MFC after:      2 weeks

Skip UFS2 fs_metaspace upper-bound validation that rejects NetBSD FFSv2
WAPBL filesystems due to differing superblock layouts.

Detect the condition during mount instead and permit read-only mounts
while rejecting read-write mounts with EROFS.  This follows NetBSD's
recommendation for systems without WAPBL support and avoids modifying
unsupported journal metadata.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296022
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, kirk
Pull Request: https://github.com/freebsd/freebsd-src/pull/2279

nfsd: Garbage collect stray NFSv4 state

When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.

This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.

While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.

Reported by:    Richard Purdie <richard.purdie@linuxfoundation.org>
Tested by:      Michael Halstead <mhalstead@linuxfoundation.org>
MFC after:      2 weeks

nfsd: Commit missing patches for c52bcd09c2a6

Oops, I missed the other files for the commit.

This should fix the build.

Pointy hat goes on me.

MFC after:      2 weeks
Fixes:  https://cgit.freebsd.org/src/commit/?id=c52bcd09c2a6 ("nfsd: Garbage collect stray NFSv4 state")

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

After a bypassed VOP, nullfs mirrors the lower vnode's inotify state
onto the upper vnode.  The flags were checked with lockless reads
before being updated with the asserting flag set/unset primitives, so
two threads syncing the same vnode concurrently (or a sync racing a
watch being established) could both decide to make the same change;
the loser then trips the "flags already set" assertion on an
INVARIANTS kernel.  On other kernels the race is harmless.

Keep the lockless check as the fast path, but re-make the decision
under the vnode interlock before actually changing the flags.

Reproduced in a 4-CPU VM with one thread cycling an inotify watch on
a lower-filesystem file while several threads stat(2) the same file
through a nullfs mount: the unpatched INVARIANTS kernel panics under
this load, the patched kernel runs it to completion.

Fixes:                  https://cgit.freebsd.org/src/commit/?id=f1f230439fa4 ("vfs: Initial revision of inotify")
MFC after:              2 weeks
Differential Revision:  D58344
Reviewed by:            markj
Assisted-by:            Claude Code (Fable 5)

Differential Revision:        https://reviews.freebsd.org/D57898

If the server is closing (or the device node is going away), or if
devfs_set_cdevpriv() fails, cuse_client_open() returns with the server
reference taken at the top of the function still held and the newly
allocated client still linked on pcs->hcli.  Since cuse_client_free()
has not been registered as the cdevpriv destructor at that point,
nothing ever undoes this work: every open() that races the is_closing
window permanently leaks one server reference and one cuse_client.

A leaked reference is fatal on server exit: cuse_server_free()
busy-waits in an uninterruptible pause("W", hz) loop until pcs->refs
drops to 1, which now never happens, so the exiting server process
(e.g. virtual_oss(8)) is left wedged in state "D", immune to SIGKILL,
cuse.ko is pinned (kldunload hangs too), and only a reboot recovers.

Before 634e578ac7b0 the is_closing error path dropped the reference by
calling devfs_clear_cdevpriv(), which ran the cuse_client_free()
destructor.  That commit moved devfs_set_cdevpriv() after the
is_closing check to fix the panic paths, but left both error returns
without any cleanup.

Fix by calling cuse_client_free() directly on both error paths.  The
client is fully constructed and linked on pcs->hcli at these points,
which is exactly the state cuse_client_free() expects.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296291
Fixes:          https://cgit.freebsd.org/src/commit/?id=634e578ac7b0 ("cuse: Fix cdevpriv bugs in cuse_client_open()")
Assisted-By:    Claude Opus 4.8 (claude-opus-4-8)
Signed-off-by:  giacomo <delleceste@gmail.com>
MFC after:      2 weeks
Reviewed by:    christos
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2324

Unlike RFC5661 (the original NFSv4.1 RFC), RFC8881 specifies
that a NFS4ERR_DELAY reply to the SEQUENCE operation requires
a reply using the same slot/sequence#.

This patch fixes handling of this case, so it conforms to
RFC8881.

Reported by:    J. David (j.david.lists@gmail.com)
Tested by:      J. David (j.david.lists@gmail.com)
MFC after:      1 week

Commit 4d80d4913e79 added a check for nfsess_defunct already
being set.  This was incorrect because, once set, nfsess_defunct
remains set and an additional recovery might be needed.

This patch reverts this part of 4d80d4913e79.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297252
Suggested by:   olivier
MFC after:      3 days
Fixes:  https://cgit.freebsd.org/src/commit/?id=4d80d4913e79 ("nfs: Fix argument typo to avoid a crash")

Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.

Reviewed by:    gallatin, markj
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D57973

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)

LTP open13 expects these operations to fail with EBADF, matching
Linux behavior, but FreeBSD currently returns EOPNOTSUPP
for fgetxattr() on an O_PATH fd

Look up Linux fd-based xattr descriptors with getvnode()
and route the operations through shared kern_extattr_*_fp()
helpers so the O_PATH check and the extattr operation use the
same referenced file.

Apply the same EBADF handling to fsetxattr(), fremovexattr(), and
flistxattr() so the xattr paths stay consistent.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295537
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

linuxulator: Fix operator precedence for LINUX_XATTR_FLAGS in setxattr()

The LINUX_XATTR_FLAGS macro expands to (LINUX_XATTR_CREATE|LINUX_XATTR_REPLACE).
Without parentheses around the macro expansion, the bitwise & operator has
higher precedence than |, causing incorrect flag evaluation and a compiler
warning.

Add the missing parentheses around LINUX_XATTR_FLAGS to ensure correct
operator grouping, matching the existing usage in getxattr().

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=2c905456312b ("linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)")
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2306

Move the atomic size-probe-and-read logic into a new
linux_extattr_get_vp() function in linux_xattr.c instead of
modifying the generic extattr_get_vp() in vfs_extattr.c.
This keeps Linux-specific getxattr semantics (ERANGE on
too-small buffer, EOPNOTSUPP to ENOATTR mapping)
self-contained within the linuxulator.

The function probes the attribute size and reads the data
under a single vnode lock, preventing a TOCTOU race between
the size probe and data read.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

CHERI: declare mem{cpy,move}_data

Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices).  On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance.  This reduces the risk of accidental spread of
pointers on CHERI systems.

Document that bcopy preserves pointer provenance.

Reviewed by:    ziaee, kib, adrian, markj
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57662

CHERI: add sooptcopyinptr to preserve pointer provenance

Most socket options don't involve pointers so make the default
sooptcopyin discard provenance and add a sooptcopyinptr that preserves.

Reviewed by:    markj, emaste
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57665

CHERI: make mem{cpy,move}(9) CHERI compatible

- Use intptr_t in place of long as the word type in the core copying
  loop where aligned words a copied.  This preserved the provenance of
  any copied pointers.
- When working with the address of src or dst use ptraddr_t rather than
  uintptr_t.  This avoid ambigious provenance in expressions involving
  multiple addresses.

As a minor tweak, rename the function to memmove since that is the
interface it implements (overlapping src and dst are permitted) and make
memcpy the alias rather than the other way around.

Reviewed by:    kib, markj
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57965

fetch.9: fix a typo

Fixes:          https://cgit.freebsd.org/src/commit/?id=a1c52e05f571 ("CHERI: declare fueptr and suptr")
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK

Fixes:                https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by:    glebius
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57967

Attaching to a jail changes its root directory and its process
credentials. These operations both require unlocking the jail, and also
need allprison_lock unlocked. That means that if two threads are trying
to attach to different jails at the same time, it's possible for the
process to end up with one jail's root directory but the other jail's
credentials.

Solve this by forcing the process into single-threaded mode during
system calls that attach to a jail (jail_attach, jail_attach_jd, and
sometimes jail_set).

Reviewed by:    kib, markj
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57858

If git is installed and .git exists but git rev-parse failed to report a
hash we previously produced just "-dirty" as the git revision.  Gate the
git commit count and -dirty check on the rev-parse passing.

Reviewed by:    jlduran
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57995

It is a handy shortcut that will be used extensively in
hwpstate_intel(4) and hwpstate_amd(4).

Warn users that it panics if the parent bus does not provide the
CPU_IVAR_PCPU instance variable.  That condition should be tested by
callers (doing so once is enough).  Suggest to do that in driver's
attach method.

Reviewed by:    jhb (code)
Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57897

This makes the header more self-contained.
The symbol is needed only on 32bit arches, but the include file is
provided unconditionally to make the namespace population predictable.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296489
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

When a GID table entry is empty or not yet present in the cache,
show_port_gid() falls back to printing a zero GID.  Use the existing
GID_PRINT_FMT/GID_PRINT_ARGS helpers instead of Linux's %pI6 format,
which FreeBSD printf treats as a pointer followed by "I6".
This makes empty GID sysctl entries consistently report
0000:0000:0000:0000:0000:0000:0000:0000.

Tested by:      Wafa Hamzah <wafah@nvidia.com> (mlx5_ib)
Reviewed by:    jhb, kib
Sponsored by:   NVIDIA Networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential Revision:  https://reviews.freebsd.org/D58042

inotify: Unconditionally generate IN_IGNORED events for files/dirs

The implementation previously only generated an IN_IGNORED event for a
deleted watched file if the watch explicitly requested IN_DELETE_SELF.
This is not correct, IN_IGNORED should always be raised when the watched
subject is deleted.  Adjust the implementation of inotify_log_one()
accordingly.

This also fixes a problem where a deleted watched file's watch
would not be removed if IN_DELETE_SELF was not in the watch's event
mask, in which case the unlinked vnode would linger until the inotify
descriptor itself is closed.

Add a regression test.

Reported by:    jrtc27
Reviewed by:    jrtc27
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58050

inotify: Ensure that "allocfail" is initialized in inotify_log_one()

Fixes:  https://cgit.freebsd.org/src/commit/?id=b70997c8c75a ("inotify: Unconditionally generate IN_IGNORED events for files/dirs")

jaildesc_alloc() finishes initializing the file structure only after it
is made visible from the file descriptor table via finit().  In that
window, other threads could try to perform operations on the descriptor
and thus access an incompletely initialized jaildesc.

Defer the finit() call until locks are initialized.  While here,
simplify the error path for falloc_caps().

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58049

dtrace: Improve DOF section size validation

The loop which validates each DOF section assumes that the section
header is present, so the section size must be at least as large as the
header, otherwise a small OOB access is possible.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57975

dtrace: Fix DOF section bounds validation

We must ensure that each DOF section does not overlap with the DOF
header or section table.  Otherwise the relocations processed in the
second pass over sections can manipulate DOF metadata, leading to OOB
writes.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57976

dtrace: Improve DOF string table validation

The check for a nul terminator implicitly assumes that the section size
is positive.  Make the assumption explicit.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57977

dtrace: Fix DOF section-specific validation

The entry size of the probe section is assumed to be at least
sizeof(dof_probe_t) by the loop further below.

enoff_sec->dofs_entsize was not being validated at all.

When multiplying an index by a table entry size, make sure the
multiplication can't overflow.

Fix an off-by-one when validating the translated probe argument array.

Make sure that the probe argument argvs are valid string offsets
even if the argument count is zero.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57979

Fixes:                https://cgit.freebsd.org/src/commit/?id=2ec2ba7e232d ("vfs: Add VFS/syscall support for Solaris style extended attributes")
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    rmacklem, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58053

A test site determined that, for a Mellanox NIC which can handle
M_EXTPG mbufs, an improvement of 5-15% for read rate could be
achieved if the read reply was in M_EXTPG mbufs.

A patch that tried to determine if the outbound NIC supported
M_EXTPG mbufs (IFCAP_MEXTPG) did not pass review.
However, it does appear that this can be useful for NFS-over-RDMA.
(Which just happen to use NICs that do support M_EXTPG mbufs.)

As such, this patch enables them is xp_extpg is set to true,
which is never for now, but might be set true for RDMA or
when vfs.nfsd.enable_mextpg is set non-zero. (It is 0 by
default, so this is never enabled by default at this time.)

Tested by:      Greg Becker <becker.greg@att.net>
MFC after:      2 weeks

Check that the P_WEXIT flag is set.

Requested by:   markj
Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_alloc()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract pdtofdflags()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_destroy()

Reviewed byL    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Introduce pd_fpcount that counts the number of file references to the
procdesc.  Remove the PDF_CLOSED flag, now it is expressed as
pd_fpcount == 0.

Only send SIGKILL and clear pointers when we are closing the last file
referencing procdesc.

This should be nop until the next commit.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

This is backward ABI-compatible, because the only place in kernel that
uses the structure, namely the mlx5_ib_cq.c:mlx5_ib_create_cq()
function, copies in as much structure members as provided by userspace.

Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24.

rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for
every VMA it maps, but rdma_umap_close() never dropped it.  The entry
was therefore never freed and lingered in ucontext->mmap_xa, tripping
WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking
the firmware UAR on every context close.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Modern Linuxes don't use ethX for almost 15 years already, see [1] and
[2].  The translation logic has always been a source of bugs and PITA.
Switch default to not translate (long due!) and schedule removal of the
code for FreeBSD 17.

[1] https://systemd.io/PREDICTABLE_INTERFACE_NAMES/
[2] https://www.freedesktop.org/software/systemd/man/latest/systemd.net-naming-scheme.html

Reviewed by:            iwtcex_gmail.com, vvd, melifaro, dchagin
Differential Revision:  https://reviews.freebsd.org/D57852

sendfile: stop abusing kern_writev()

Provide convenient wrapper kern_filewrite() around fo_write().
Switch to use it in vn_sendfile().  This allows to avoid duplicate
fget() when we already have the reference to the file, which creates a
correctness race with the userspace.  Also td_retval[0] clearing hack
can be removed.

Reviewed by:    glebius, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58035

kern_filewrite(): unconditionally calculate cnt, it is used by callers

Reported by:    dhw, madpilot
Tested by:      dhw
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")

kern_writefile(): fix several regressions

sendfile(): for trailers uio, set uio_rw to UIO_WRITE instead of checking it
kern_filewrite(): remove unused argument offset
kern_writev(): the check should compare cnt against zero, not uio_resid

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Order them alphabetically.
Remove redundand sys/param.h.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

linux_sys_futex() does not copyin a timespec for the timeout if the
operation is LINUX_FUTEX_TRYLOCK_PI, presumably because it doesn't make
sense to specify a timeout for a try-lock operation.  However, this
means that we pass a userspace timespec pointer to
linux_umtx_abs_timeout_init().

Modify linux_futex_lock_pi() to not initialize the timeout if we're
try-locking.

Reviewed by:    kib, dchagin
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58061

This is a mask, so the new value should have taken the next bit to avoid
breaking a shell script that's interpreted by a binmisc-activated
interpreter.

Add a brief note that the new value is only used within the ELF
activator.

Fixes:  https://cgit.freebsd.org/src/commit/?id=389c124fecb0 ("imgact_elf.c indicate that interpreter [...]")
Reported by:    "polyduekes" on discord, madpilot
Reviewed by:    kib, sjg (both previous version)
Differential Revision:  https://reviews.freebsd.org/D58063

pm_runtime_resume_and_get is used by new versions of amdgpu, and began
use between Linux kernel version 6.12, and 6.14.

Reviewed by:    dumbbell
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57463

This catches up with 692b0ef1506ba which added CAPENABLED to
clock_nanosleep(). Curiously recent additions of the pdopenpid(2) and
pddupfd(2) were done before the cited commit, and that regen did not
included the change.

Sponsored by:   The FreeBSD Foundation

Reviewed by:  jfree
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58084

The taskqueue thread loop tries to avoid entering and exiting net epoch
read sections for every task.  This reduces the overhead of net epoch
integration, but the implementation wasn't bounding the length of the
read section, so a busy taskqueue thread could hold an epoch open for an
unbounded period.  This is easy to achieve with the epair task, for
instance.

Bound the number of tasks that we'll execute without observing the
global epoch, and provide a sysctl to control it.  Let the default bound
be eight.

Reviewed by:    glebius
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58031

This function is supposed to wait until all pending callbacks have been
executed.  This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.

The implementation schedules a callback on each CPU and waits for them
all to run.  This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed.  This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.

Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order.  However,
ck_epoch_poll_deferred() may determine that it is safe to execute
callbacks from epoch - 1 (or even from the current epoch if there are
no active readers), and in this case it will push those callbacks onto
the returned stack.  This means that epoch_call_task() will invoke those
newer destructors before the older ones, which means that
epoch_drain_callbacks() may return early.

Fix the correctness problem by simply doing all of this twice: once the
first callback is invoked, we know that all of the callbacks that were
pending at the time that epoch_drain_callbacks() was called are
scheduled to be executed, so when the second callback is executed we
know that they must be finished.  This is slow, but it is already slow,
and the slowness is less noticeable after commit dce56594991.

I note that in an ideal world, this function would not exist, and all of
the teardown would happen asynchronously, rather than the current
mismash of synchronous and asynchronous cleanup.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290201
Reviewed by:    glebius
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58030

The former is called by the latter. We return NULL because linuxkpi does
not implement ACPI (pseudo?) devices associated to regular devices.

The amdgpu DRM driver started to use `ACPI_COMPANION()` in Linux 6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57577

It takes a task state as its last argument. We enforce that this state
is `TASK_UNINTERRUPTIBLE` for the time being because other states are
not interpreted.

Change `usleep_range()` to call `usleep_range_state()` with the state
set to `TASK_UNINTERRUPTIBLE`, which is what Linux does too.

The amdgpu DRM driver starte to use `usleep_range_state()` in Linux
6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57579

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58147

Currently no filesystems support it.

Reviewed by:    mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

On amd64 there was 4 bytes of padding between the 20-byte p_comm and
(for LP64) 8-byte p_sysent, so the addition of p_execblock just caused
that padding to be eaten up. However, on i386, there was no such
padding, and so the addition of p_execblock rippled through to
p_emuldata.

Fixes:  https://cgit.freebsd.org/src/commit/?id=e1a84b7708c2 ("execve_block(): a mechanism for mutual exclusion with execve() on the process")

The note type wakes up when there is something for pdwait(2) to report
on the process descriptor.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58123

We need to wake up the pdwait(2) waiters when procdesc event is
reported.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58172

Convert several callers to use fget_procdesc().
Eliminate procdesc_find() and directly use fget_procdesc() in
sys_pdkill().  Previous code structure required to fdrop() procdesc
while the process is locked.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58117

LinuxKPI: add system_percpu_wq

In Linux v6.17 system_wq was replaced (renamed to) system_percpu_wq,
with the old name still present.

We just alias system_percpu_wq to linux_system_short_wq like we do
for system_wq to keep both around for the forseeable future.

Note: the original system_wq was a per-cpu queue upstream as well
based on my understanding but we never implemented it as such.
That means we are still lacking a per-cpu implementation for
system_percpu_wq but at least we do not change the status-quo
of the LinuxKPI implementation with this.

Note2: we should add a check somewhere for LINUXKPI_VESION >=
61700 to print a warning if anyone still uses the system_wq
to detect any possible sami-native or out-of-tree drivers
relying on this and not properly updating.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell; emaste (comments on previous review)
Differential Revision: https://reviews.freebsd.org/D57730

LinuxKPI: fix lkpi_pci_get_device() reference counting on device

In case we are passed an "odev" (a device to start the search from),
that device would have an extra reference.  The best way to illustrate
this is to look at for_each_pci_dev(), which will return one device
after the other.  Upon first return we return a pdev with a reference.
That pdev is then passed in as odev on the next call.  If we do not
clear the reference it will be leaked.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=910cf345d0ee9 ("LinuxKPI: pci: implement ...")
Reviewed by:    dumbbell, emaste
Differential Revision: https://reviews.freebsd.org/D57428

LinuxKPI: pci detach: implement a proper detach (release) path

There are two paths in the LinuxKPI PCI code to instantiate a "pdev"
(LinuxKPI pci_dev).  One is using the FreeBSD bus framework and the
pdev will be the softc.
This commit starts cleaning up the detach path for just that case
to the best possible.

So far we did a lot of the work in linux_pci_detach_device(), which is
the internal handler of the detach function and little in the
(*release) callback (devres cleanup only).
The problem with that is, that we tear down resources which later in the
devres cleanup are needed.  With them not being there anymore we panic, e.g.,
in lkpi_dma_unmap < lkpi_dmam_free_coherent < lkpi_devres_release_free_list.
The solution is to migrate most of the cleanup work into the (*release)
callback, which will automatically be called when the device (kobj) reference
drops to zero.  The only work which should be done immediately is to let the
dirver do its cleanup;  this has to happen before we try to teardown the
resources, but also we do want this to happen when detach is called
(the first time).
One problem we have with the deferred cleanup of the remaining parts is
that we do not know upon calling pci_dev_put() whether this cleared
the last reference and triggered the cleanup or not but we cannot return
from the detach function with pending resources and dangling pointers,
which then may be used.  In order to work around this, we clear the
(*release) callback function when it is run and check for that in the
detach routine.  If the (*release) callback was not run, we refuse to
detach (force would be needed) as we'd rather keep the device than
risk a follow-up panic on leaked resources.  Given this should not happen
in a well programmed world, I believe it is fine to take that and log it
to let the user know.

Try to leave a few comments behind to help with understanding in the
future.

With this we can unload the mt7921 driver (or shutdown the system)
without panic.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D57429

LinuxKPI: 802.11: lkpi_80211_txq_tx_one() only pass sta if added to drv

If we are doing a direct (*tx) downcall, only pass sta as meta data
if it was added to the driver (via the state machine).  This prevents
us passing a sta not known to the driver leading to possible follow-up
complications/errors.  This will usually happen if (a) we are doing
software scanning, or (b) if net80211 decides to change the ni from
under us and sends a packet with the new ni.

Adjust a debug statement before to also have the added_to_drv field
in it to ease debugging.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: pci: fix dma handle type in match function

dma_addr_t is a vm_paddr_t which is a uint of some width.  Rather than
passing pointers of it around pass the value.

Comparing the addresses of different storage for the same dma handle
(the actual bug here) will not work when passed to the devres match
function.

Sponsored by:   The FreeBSD Foundation
Fixes:          https://cgit.freebsd.org/src/commit/?id=0a575891211ef ("implement dmam_free_coherent()")
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58285

LinuxKPI: sg_page() remove superfluous ()

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    emaste
Differential Revision: https://reviews.freebsd.org/D58295

LinuxKPI: move clear_page() within the linux/page.h file

clear_page() would normally live in asm/page.h but adding the file
and fixing the dependencies would be too much for a single line.

Move the function to the end of the file with a clear separator
and make it clear that it does not operate on a 'struct page'
but on a page address by changing the argument name and leaving
a comment.

The function is currently used by at least mthca(4) as the only
in-tree consumer, and drm-kmod ttm_pool.c.

No functional changes.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    emaste
Differential Revision: https://reviews.freebsd.org/D58296

LinuxKPI: prefer struct page [*] over struct vm_page[_t]

LinuxKPI is based on Linux 'struct page' which is currently aliased
to struct vm_page.  Upcoming changes may change that so start using
'struct page *' instead vm_page_t to make future changes transparent.

This is a continuation of 9e9c682ff3a1 and should be a NOP.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    emaste (no objections)
Differential Revision: https://reviews.freebsd.org/D58297

LinuxKPI: page.h: use atop() and ptoa() instead of PAGE_SHIFT

With upcoming changes to 'struct page' this will make the lines
easier to read by using the predefined macros from param.h.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    markj, kib
Differential Revision: https://reviews.freebsd.org/D58298

LinuxKPI: page.h: resort lines

Two of the "page macros" can be abstracted elsewhere in the upcoming
struct page work, so sort them away from the four which are here to
stay.

No functional change.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    emaste
Differential Revision: https://reviews.freebsd.org/D58299

LinuxKPI: page pool updates and add to the build

Split implementation out from the header files.

This "page pool" is the very minimalistic version we need in order to
support packets on mt76.
We allocate the page pool in order to have the meta data available of
which we only make limited use.
This implementation does no pooling, it does no page fragments for now,
it always hands out a full page and frees it upon return.

It is written in a way that it can be in the tree before the 'struct page'
work it depends on has landed in order to reduce friction for people who
want to try mt7921 (or others later) upfront.  We use the same #ifdef
as in the struct page work for that reason so one knob will turn everything
on or off.

Once the struct page work has landed and settled we can start filling this
with more complexity.

In the unlikely event that in the mean time any other consumer would start
showing up they will have to be aware that the current code as-is
essentially is a NOP without the 'struct page' work.  A WARN_ONCE() will
notify them.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Checking hlt_cpus_mask is a no-op, and the mask will be removed in the
next commit. However, we can use the more recent CPU_ABSENT() macro to
check the status.

Reviewed by:    olce
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58157

It is a relic, apparently once populated by a machdep.hlt_cpus sysctl.
The sysctl was removed, and ULE has never honored this mask. It is now
safe to remove.

Remove the mask, and its few remaining references in: sched_4bsd(4),
hwpmc(4), and hwt(4).

Reviewed by:    olce, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58158

The check is always true, especially after the removal of hlt_cpus_mask
from sched_4bsd.

Reviewed by:    olce, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58159

This makes an effort to clarify and correct the intent of the code,
which is to either:

 1. Create one software crypto worker thread for each CPU, to be pinned
    later
 2. Create the number of threads requested by the kern.geom.eli.threads
    tunable

This is as described in geli(8).

If a CPU were somehow* absent, it should be skipped, but not in the
second case when creating a set number of threads.

To achieve this cleanly and correctly:
 - split worker creation logic into a helper function
 - keep the loops separate
 - debug message for absent CPUs is dropped
 - add a short explanatory comment
 - style, rename local var to 'nthreads'

*Practically, it is impossible today to get a bootable system with a
sparsely populated CPU map. Thus these concerns are hypothetical and
this change should have no functional effect.

Finally, while here, guard the sc->sc_workers list insertion with the
appropriate mutex. The code is safe from races today, but this gives a
better guarantee.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58214

Like the rest of <acpi/video.h>, this function is unimplemented and
returns `-ENODEV`.

The amdgpu DRM driver started to use it in Linux 6.13.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57576

Reviewed by:  kib
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D58055

exterr: allow exterr to fit pointers on CHERI targets

Switch to uint64ptr_t which is a uint64_t on traditional architectures
and a uintptr_t on CHERI architectures.  This has no ABI impact on
non-CHERI kernels.

Fix truncation of 64-bit values on 32-bit kernels.

Reviewed by:    kib
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58056

exterr_set: sync the definition with the header declaration

This unbreaks buildkernel with TARGET=armv7 (32-bit arm). More work may be required
in order to unbreak `exterr_set` with 32-bit kernels.

Fixes:  https://cgit.freebsd.org/src/commit/?id=844009378da9 ("exterr: allow exterr to fit pointers on CHERI targets")

kern: fix compilation

uintptr64_t -> uint64ptr_t

Fixes:  https://cgit.freebsd.org/src/commit/?id=5cafd6213f145 (exterr_set: sync the definition with the header declaration)

Remove dependency on sys/proc.h.

Reviewed by:    imp
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58235

m_unshare() had crashed if unmapped mbufs exist in the mbuf chain.
This was because memcpy() with mtod() was used without making sure that
the mbuf was mapped. Use m_copydata() that cares unmapped mbufs instead.

Reviewed by:    gallatin
Differential Revision:  https://reviews.freebsd.org/D58189

We do this already for ET_REL files, but it was missed here.  Note that
this function operates only on dynamically loaded files, not on
preloaded files.

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58245

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58247

Since malloc(9) even with M_NOWAIT is forbidden when we hold a spinlock,
we can't print detailed lock tree as the operation tries to allocate
memory.

Fixes:  https://cgit.freebsd.org/src/commit/?id=fb4b0c91195195561560bb2fb2c1ba8da81f7ccf

clock_gettime(CLOCK_TAI) can fail, leaving *ovalue uninitialized.

Reported by:    Hazley Samsudin of GovTech CSG
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58225

A vm_page's a.queue field records the page queue index for the page
queue to which the page belongs.  The PGA_ENQUEUED flag indicates
whether the page is actually enqueued in that queue's TAILQ.  When
modifying the a.queue field, you need to hold the page queue lock for
the queue corresponding to the old value, unless the old value is
PQ_NONE.

Suppose a managed page is freed.  vm_page_free_prep() calls
vm_page_dequeue_deferred(), which checks whether the page belongs to a
queue; if so it schedules an asynchronous dequeue operation so that page
queue lock acquisitions can be batched if possible.

The dequeue operation must be completed before the page's plinks.q
fields are reused.  So, during page allocation, we call
vm_page_dequeue() to finish the dequeue operation.  Similarly, since the
buddy allocator uses the plinks.q fields for its own internal linkage,
vm_freelist_add() calls vm_page_dequeue().

_vm_page_pqstate_commit_dequeue() is the function which actually removes
the page from its queue.  It sets a.queue = PG_NONE and removes the page
from its queue.  However, the update to the page's atomic state is
relaxed, so on systems with store reordering, it may race with a
concurrent enqueue of the page into the buddy queues (probably more
likely) or a page queue.

Fix this: use a release store to update the page's queue state in
_vm_page_pqstate_commit_dequeue(), and make sure that vm_page_dequeue()
uses an acquire load when comparing m->a.queue == PQ_NONE.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296767
Reported and tested by: pkubaj
Reviewed by:    alc, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58261

LinuxKPI: skbuff: improve debugging

Deal with SKB_TRACE_FMT optional arguments; while here properly indent.

Add KASSERT to __skb_unlink() to catch incorrect skbuffs encountered
while debugging a wireless driver (which had other pre-conditions failing).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: add skb_put_zero()

Add skb_put_zero() as a simple wrapper around __skb_put_zero().

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: implement napi_build_skb()

Implement napi_build_skb() around linuxkpi_build_skb().

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: implement __skb_linearize()

skb_linearize() is used by mt7921, mt7925, and in the general mt76 tx dma
code. __skb_linearize() is used in the general iwlwifi TX code but given
the way we currently create TX skbs in LinuxKPI 802.11 we never hit that
case.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: add support for frags in linuxkpi_skb_copy()

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: add reference counting to the skb

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: skbuff: add initial page pool support

Add an internal flag which is set by skb_mark_for_recycle() and upon
"skb_free" then selects whether the skb is freed or returned to the
page pool.
There will likely be more details to figure out once the LinuxKPI page
work is done and we support more of the page pool than the bare minimum.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

rtw89(4) would constantly try to start a TX BlockACK session even if no
HT or higher was available.  The only way to stop this (currently) is
to return -EINVAL instead of any other error.

Note: we should investigate if/when to call (*set_tid_config)() as that
will also offer the ability to forbid BA.

Sponsored by:   The FreeBSD Foundation
Reported by:    arved, bnovkov
Tested by:      bnovkov
MFC after:      3 days

vm_phys: Add a sysctl to dump registered fictitious memory ranges

I've wanted this a couple of times in the past.  Save the memattr in
the fictitious memory segment structure so that we can report it from
the sysctl handler, and add conversion routines for each platform.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58283

arm64: Fix the build

Fixes:  https://cgit.freebsd.org/src/commit/?id=a7e483ee146a ("vm_phys: Add a sysctl to dump registered fictitious memory ranges")

vm: Make sure NULL is defined for vm_memattr_name()

Fixes:  https://cgit.freebsd.org/src/commit/?id=a7e483ee146a ("vm_phys: Add a sysctl to dump registered fictitious memory ranges")

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58334

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58292

procdesc: report NOTE_PDSIGCHLD for traced and stopped process

on attach of the knote.  It is same as for NOTE_EXIT when attaching to
the exiting process.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58327

kqueue: Fix delivery of unwanted events

In both procdesc_kqops_event() and filt_proc(), the event variable can
have more than one bit set.  This means that:

* We cannot compare it directly with NOTE_EXIT; we must binary-and them
  instead.

* We cannot binary-or it with the report mask; we must binary-and it
  with the request mask first.

MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=2a5e58c59694 ("procdesc: add NOTE_PDSIGCHLD")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b328975b9d7c ("procdesc: report NOTE_PDSIGCHLD for traced and stopped process")
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58395

When transferring a thread with near 100% CPU statistics (but not 100%;
up to 57.5/59≈97.46%) to a CPU where the enqueue offset is ahead of at
least 2 from the dequeue one, which requires peculiar conditions to
happen (transfer triggered by a bind request or cpuset change, or during
balancing if a thread or more existed from a brief amount of time on the
origin CPU), the transferred thread can get placed after the dequeue
offset, effectively making it appear as a high priority one unduly,
causing latency increase for other threads.

The change here was missed when changing the enqueue and dequeue offsets
update mechanism to recover pre-256-queue-runqueue ULE anti-starvation
and fairness behavior.  That change opened up the possibility that these
two offsets are apart by more than one.

Reviewed by:    markj
Discussed with: Minsoo Choo <minsoo@minsoo.io>
Fixes:          https://cgit.freebsd.org/src/commit/?id=6792f3411f6d ("sched_ule: Recover previous nice and anti-starvation behaviors")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57829

Different command sets have different encoding for op codes, etc. While
one can normally puzzle out which is which, it's better to explicitly
tag the command set used.

Sponsored by:           Netflix

ptrace(2): add PT_GET_CHILDREN

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58315

kern/sys_ptrace: do not skip P2_PTRACEREQ wait for PT_CLEARSTEP/PT_GET_CHILDREN

Reported and reviewed by:       markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=d3b7bbee9275 ("ptrace(2): add PT_GET_CHILDREN")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58364

amd64: FRED support

FRED support as defined starting from the SDM rev. 90, requires a new
'events' entry point to receive user and kernel mode exceptions and
interrupts notifications from the hardware.  A minimal asm trampoline is
enough, rest can be implemented in C due to the clean FRED organization
of the event reporting.

The syscall entry is handled by a microptimized assembly path, directly
calling into the amd64_syscall() handler, instead of the generic events
entry point.

Tested by:      emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D55829

amd64: Fix an off-by-one in the fred_ipi_handlers definition

Fixes:          https://cgit.freebsd.org/src/commit/?id=6e93f5e4d693 ("amd64: FRED support")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58378

amd64: Remove a prototype for an unimplemented function

Fixes:          https://cgit.freebsd.org/src/commit/?id=6e93f5e4d693 ("amd64: FRED support")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58379

Return the covered vnode instead.

Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58191

We introduced (PRI_MAX_TIMESHARE - PRI_MIN_TIMESHARE) as part of
ESTCPULIM() in commit eebc148f25c3 ("sched_4bsd: ESTCPULIM(): Allow any
value in the timeshare range") in order to use more than a fixed number
(40) of all the available priority levels in the timeshare range (136
before the 256-queue runqueue work, 224 now) to take into account the
number of ticks a thread has run ('ts_estcpu').

In the computation of a new thread's priority (resetpriority()), in
addition to the "ticks running" contribution, the final priority also
includes a "nice" value contribution.  The final value is clamped into
the [PRI_MIN_TIMESHARE; PRI_MAX_TRIMESHARE] range.

Problem is that the new "ticks running" contribution now can lead to
a computed priority value that exceeds PRI_MAX_TRIMESHARE, and is thus
finally clamped to PRI_MAX_TIMESHARE, which becomes an alias for all
out-of-bound values.  In particular, this can conflate CPU-hungry
threads.  With at least two of them competing on the same CPU, with an
increase of 'ts_estcpu' of ~64 per second (stathz being 127) and the
minimal decay of 4/5 (load average 2 or more), both threads will easily
reach the current clamping of 224 (+ PRI_MIN_TIMESHARE), and be
considered indifferently by the scheduler.

Fix this problem by ensuring that the maximum contribution of
'ts_estcpu' (via ESTCPULIM()) cannot exceed the timeshare range of
priorities when the nice contribution is added to it, so the nice
contribution continues to have an effect on CPU-bound threads.

Introduction of the nice term in ESTCPULIM() (then NICE_WEIGHT *
PRIO_MAX) has been done in commit bdf423572ee3 ("Scheduler fixes
equivalent to the ones logged in the following NetBSD commit...") and
does not appear to have made any real sense even then.

Fixes:          https://cgit.freebsd.org/src/commit/?id=bdf423572ee3 ("Scheduler fixes equivalent to the ones logged in the following NetBSD commit...")
Fixes:          https://cgit.freebsd.org/src/commit/?id=eebc148f25c3 ("sched_4bsd: ESTCPULIM(): Allow any value in the timeshare range")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57826

The INVERSE_ESTCPU_WEIGHT scaling had been introduced by commit
b698380f33ef ("Quick fix for scaling of statclock ticks in the SMP
case. ...") to leave more discrimination room for multiple CPUs possibly
adding their ticks to the same 'struct ksegrp' (but also slightly
changing how CPU hogs are penalized).

Then, commit 8460a577a4b4 ("Make KSE a kernel option, ...") introduced
the current thread-based code, where tick accounting is only done on the
current thread, which renders this trick obsolete on !KSE.

Finally, when KSE was removed, the trick became generally obsolete.

The trick is actually even harmful because it changes the intended
behavior of priorizing more the CPUs that use the less ticks (and so,
impairs boosting "interactive" processes).

Remove it now.  Clamping of 'ts_estcpu' and its relation to the
load-average-based decay may be re-examined later.

Fixes:          https://cgit.freebsd.org/src/commit/?id=8460a577a4b4 ("Make KSE a kernel option, ...")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57827

In an upcoming change whose purpose is to stop having 4BSD always
allocate MAXCPU runqueues, wasting space on most machines, 'struct
td_sched' will store the CPU ID to which a thread is bound/pinned
instead of a pointer to the corresponding runqueue.  As a consequence,
existing functions manipulating a thread's runqueue will need to point
to the inferred runqueue through a local variable.  The name 'runq' is
the ideal one for these local variables, but before this change it
designated the global runqueue, also causing unnecessary ambiguity.

Thus, rename the global runqueue to the more explicit 'runq_global'.
Arguably, this should have been performed as part of commit e17c57b14ba9
("- Implement cpu pinning and binding. (...)").

No functional change (intended).

[olce: Massaged the commit message.  Tested with source builds.]

Suggested by:   olce
Reviewed by:    olce
Tested by:      olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58065

4BSD has been allocating an array of MAXCPU runqueues, runq_pcpu[],
instead of one runqueue per actually present CPU.  On amd64, MAXCPU is
1024 and 'struct runq' is 4128 bytes, causing runq_pcpu[] to take more
than 4 MiB of memory.  On the vast majority of current systems, which
have at most 32 cores with SMT, this is a waste of memory.

Besides providing per-CPU runqueues, runq_pcpu[] has also been used to
determine the CPU ID of a given thread's associated runqueue through
pointer arithmetic.

Since per-CPU structures are only allocated for present CPUs, in order
to save space, move the runqueues to per-CPU fields and, for each thread
('struct ts_sched'), replace its runqueue pointer by the CPU ID of the
runqueue it is in (new 'ts_rqcpu' field).  Set the thread's CPU ID to
the special NOCPU value when it is running on the global runqueue.

Drop the SKE_RUNQ_PCPU() macro as it is now simply equivalent to
'ts_rqcpu != NOCPU'.  Introduce the TS_RUNQ_PTR() macro to get a pointer
to the thread's runqueue, which must be passed to runq_add() and
runq_remove().

[olce: Massaged the commit message.  Fixed an inverted KASSERT().
Tested with source builds.]

Reviewed by:    olce
Tested by:      olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58000

We would lock the downcalls during normal operation but not during
vap (vif) creation as there was no need for locking.
Add the missing locking there as drivers seem to always expect it
(by assertion) and cannot distinguish between state.
Add the assertions to the downcalls as we need both of them locked
and both of them can sleep.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296185 ("rtwhttps://bugs.freebsd.org/bugzilla/show_bug.cgi?id=89(https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=4) freezes the system with INVARIANTS kernel")
Debugged by:    Artem Bunichev (temcbun gmail.com)
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Allow userland, in particular test cases for EXTERROR conversions,
to detect at run time whether extended errors include the
descriptive message strings, which depends on the EXTERR_STRINGS
kernel option and cannot be probed in any other way.

Reviewed by:            kib
MFC after:              1 week
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58321

On a test system with 1024 cores the size of exec map exceeds 4GB, and
all of the operands in the size calculation are 32-bit integers.

Tested by:      Jim Huang Chen <jim.chen.1827@gmail.com>
MFC after:      1 week
Sponsored by:   AMD (hardware)

Also be more protective in getsid().

Reported by:    arrowd
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differrential revision: https://reviews.freebsd.org/D58393

Fixes:                https://cgit.freebsd.org/src/commit/?id=963629923308 ("kthread_add(): do not allow to attach the thread to a dead or dying process")
Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58433

Reported by:  Maik Muench of Secfault Security
Reviewed by:    kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=1ad21a652182 ("kern: add pddupfd(2)")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58403

The FD_RESOLVE_BENEATH flag is supposed to be sticky.  It's set when you
receive an fd from a different jail and preserved by openat(<dfd>) etc..
However, if you send the fd to yourself, the flag is stripped since
SCM_RIGHTS message don't preserve file descriptor flags.

Fix this by preserving those flags and checking for UF_RESOLVE_BENEATH
in restrict_rights().

Fixes:          https://cgit.freebsd.org/src/commit/?id=350ba9672a7f ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails")
Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58317

As far as I can see, it is impossible for procdesc_exit() to observe
pd->pd_fpcount == 0: if procdesc_close() decrements that counter to
zero, then it will clean up the procdesc structure too, and this is
atomic with respect to the proctree lock.

No functional change intended.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58396

The scan marker was originally stack-allocated.  In commit
1c0f9af5b5224, it became heap-allocated since the marker is visible to
other threads and a scanning thread's stack may be swapped out.  Now
that kernel stacks can no longer be swapped out, we can avoid these heap
allocations.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58402

uma: Factor out the implementations of uma_zfree_{arg,smr}()

The two function both free an item to a UMA zone, but uma_zfree_arg()
does so in such as way as to ensure that the item will be the first one
returned by a subsequent allocation, while uma_zfree_smr() must defer
reuse of the item and therefore never frees to the per-CPU alloc bucket.

When KASAN is enabled, we actually want uma_zfree_arg() to behave like
uma_zfree_smr(): to improve the reliability of use-after-free detection,
reuse of the newly freed item should be deferred for some time.

Refactor a bit to make it easier to improve KASAN along these lines:
introduce two helper functions, cache_free_item() and cache_free_smr(),
which handle most of the work of interacting with the per-CPU caches.
A subsequent commit will let uma_zfree_arg() use cache_free_smr() when
KASAN is enabled.

No functional change intended.

Reviewed by:    rlibby
MFC after:      1 month
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58268

uma: Make an effort to defer reuse of items when KASAN is enabled

When KASAN is configured, make uma_zfree_arg() free items to the per-CPU
free bucket, rather than to the alloc bucket.  This means that the item
won't be recycled immediately the next time a thread goes to allocate an
item from that zone on the same CPU.  In other words, the item will stay
in a quarantine state longer, which helps make KASAN's use-after-free
detection more reliable.

Reviewed by:    rlibby
MFC after:      1 month
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58269

uma: Avoid allocating from free buckets when KASAN is enabled

When uma_zalloc_arg() hits an empty alloc bucket in the per-CPU cache,
it tries swapping the alloc and free buckets in the hope that the free
bucket has some items available.  If not, it has to lock the zone.

Disable this behaviour when KASAN is configured in order to further
defer reuse of freed items.  This forces a free item to go to the
per-domain full bucket cache before it becomes accessible to the
allocator.

Reviewed by:    rlibby
MFC after:      1 month
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58270

uma: Enqueue full buckets in FIFO order when KASAN is configured

We want to defer reuse of free objects, and this is a trivial way to
promote that.

Suggested by:   rlibby
Reviewed by:    rlibby, alc
MFC after:      1 month
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58312

This makes it easier to grep for the error message to better understand
the call stack when loading firmware modules fails.

Fix a cosmetic-only style(9) bug while here in the same function related
to another logging message.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58380

If something goes very badly (e.g. forcibly removing a medium while
the OS tries to start it), this could end up in params.blksize being 0
(and params.disksize 1).  Avoid an integer divide fault, panicking the
kernel, by bailing out before.

MFC after:      3 days

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

This matches the documented prototype and avoids spurious
-Wincompatible-pointer-types-discards-qualifiers warnings when passing
a constant pathname.

Sponsored by:   AFRL, DARPA

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297062
Tested by:      Jordan Gordeev <jgopensource@proton.me>
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58472

p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization.  However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status.  This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.

Close the race: explicitly copy the field under the proctree lock during
fork.

Reported by:    syzkaller
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58482

kqueue: Add a helper macro for sleeping on in-flux knotes

Other in-flux operations are implemented by this set of macros, so we
should do the same for sleeping.

No functional change intended.

Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58443

kqueue: Associate marker knotes with a queue

Otherwise the assertion in KQ_FLUX_SLEEP_WMESG may fail.

kqueue_fork_copy() already handles this.

Fixes:          https://cgit.freebsd.org/src/commit/?id=1f4b0ea4f3eb ("kqueue: Add a helper macro for sleeping on in-flux knotes")
Reported by:    syzkaller
Reported by:    kbowling
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58516

Otherwise an assertion in umtx_thread_alloc()
(TAILQ_EMPTY(&uq->uq_pi_contested)) is violated.

This use of TDB_EXIT is hacky, but I cannot see another way to check for
an exiting thread without adding some more overhead to kern_thr_exit().

Fixes:          https://cgit.freebsd.org/src/commit/?id=2a339d9e3dc1
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58447

MFC after:    1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.

proc_realparent(): assert that an orphaned child has real parent != parent

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58504

proc_realparent(): do not mark the child as orphan when reparenting to p_opptr pid

Reported and reviewed by:       markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=8cef3c9b768a ("proc_realparent(): assert that an orphaned child has real parent != parent")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58566

to avoid using uninitialized value in the KASSERT() statement on the first
iteration.

Also, do the assert under the proctree_lock, which is not critical but
satisfies the invariants.

Noted and reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58505

We reach ndaasync with the CAM device lock held, so we must pass
M_NOWAIT to disk_* rather than M_WAITOK.

Reviewed by:    imp
Fixes:  https://cgit.freebsd.org/src/commit/?id=628d7a3270b6 ("nda: AC_GETDEV_CHANGED calls media chanaged for sectorsize change")
MFC after:      1 week
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D58230

Reviewed by:  jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58477

There are probably more places which could benefit from allowing to
interrupt vfs_busy() calls at syscalls top level.

Requested by:   Peter Eriksson <pen@lysator.liu.se>
Reviewed by:    jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58477

Otherwise we'll print an error but carry on regardless, presumably
destined to walk off the end of the mapping.

Reported by:    thebugfixers@pm.me
MFC after:      1 week

knotes with a non-trivial f_copy implementation may be activated before
kqueue_fork_copy_knote() is finished.  In particular, it may be enqueued
at the time that kqueue_fork_copy_knote() calls knote_enqueue().  Guard
against this.

Add a test case which triggers the race.

Fix several other problems with the replication of knote state:
- Make sure only the KN_ACTIVE and KN_DISABLED status flags are
  inherited, the rest should not be copied.
- Ignore marker knotes.
- Ignore knotes for kqueues.  They cannot be safely copied into the
  child without more work, as kqueues are inherently local to a process;
  on fork, we need to ensure that such knotes are patched to reference
  the new kqueue, not the original.
- Try to keep knote state stable by holding the kqueue and knlist locks
  while copying.

Approved by:    so
Security:       FreeBSD-SA-26:50.kqueue
Security:       CVE-2026-58083
Reviewed by:    kib
Reported by:    Hazley Samsudin of GovTech CSG
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58223

Approved by:  so
Security:       FreeBSD-SA-26:52.if_wg
Security:       CVE-2026-58085
Reviewed by:    markj
Sponsored by:   Chelsio Communications

Commit 4be491e1b9b3 ("jail: Optionally allow audit session state to
be configured in a jail") removed the #if 0 around the audit cases
in prison_priv_check() and added the PR_ALLOW_SETAUDIT check under
them.  This unintentionally captured the preceding case PRIV_KTRACE,
which used to fall through the disabled block into the unconditional
return (0) of the credential cases: since then, jailed root only has
ktrace privileges (tracing processes with changed credentials, see
ktrcanset()) when the unrelated allow.setaudit knob is enabled, and
conversely gains them when that audit knob is turned on.

Give PRIV_KTRACE back its own unconditional return (0), matching its
comment and the pre-4be491e1b9b3 behaviour.

Approved by:    so
Security:       FreeBSD-SA-26:53.ktrace
Security:       CVE-2026-58086
Fixes:          https://cgit.freebsd.org/src/commit/?id=4be491e1b9b3 ("jail: Optionally allow audit session state to be configured in a jail")
Reviewed by:    markj
Assisted-by:    Claude Code (Fable 5)

These commands take a snapshot of the size of a semaphore set, then drop
the lock and malloc an appropriately sized array before reacquiring the
lock.  A comment explains why this is (probably) safe.  Unfortunately,
it's wrong; it is indeed possible for a malicious userspace to create
and destroy 2^{15} sets in the window where the lock is dropped.  This
race can lead to out-of-bounds reads and writes, and that can be
exploited to elevate privileges.

Replace the assertions with runtime checks.

Approved by:    so
Security:       FreeBSD-SA-26:54.sysvsem
Security:       CVE-2026-58087
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58421

In an ELF coredump, each dumped vm_map_entry is represented by a
segment.  __elfN(coredump) first computes the number of segments by
looping over the vm_map entries (in each_dumpable_segment()), then
allocates a buffer to hold the ELF header and program headers, then
loops over the entries again to populate the program headers.

each_dumpable_segment() holds the vm_map read lock, but that lock is
dropped between the two calls.  If the map is shared with another
process, via rfork(), then the map can change.  cb_put_phdr() did not
account for this, and so could write out of bounds.

Add a check to prevent this; simply do not write out excess segments.

Approved by:    so
Security:       FreeBSD-SA-26:55.elf
Security:       CVE-2026-58088
Reported by:    Maik Muench of Secfault Security
Reviewed by:    kib, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58416

Reviewed by:  kib
Obtained from:  Linux commit d41861942fc55c14b6280d9568a0d0112037f065
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D57952

Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296498
Fixes:          https://cgit.freebsd.org/src/commit/?id=3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by:    gallatin, jhb
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57557

Reported by:  Nick Price
Tested by:      pho
Reviewed by:    jah, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58506

Commit f2202ab5abda did not account for  KTLS mbufs.

m_unshare() tries to linearize the original mbuf chain and creates a
writable copy of it, converting unmapped mbufs.  Both of them are
unsafe for KTLS mbufs.

It is better to return NULL if the mbuf chain contains a KTLS mbuf.

Reported by:    jhb
Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D58466

Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab.  Try to overcome this by adjusting the allocation size to
include a redzone following the object.

With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic.  Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.

Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well.  It
might be worthwhile to provide a stronger guarantee here.

Add an assertion to item_ctor() that the returned item is properly
aligned.  I couldn't see any pre-existing checks which verify this.

Reviewed by:    rlibby
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58271

malloc: Refactor redzone and sanitizer handling

malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset().  Refactor the
implementations to reduce this a bit.

Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.

Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58272

uma: Fix KMSAN integration with malloc zones

In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
basis that UMA and kmem_malloc() would handle updates of the KMSAN
shadow map.  However, I missed that UMA explicitly does not handle this.

Modify UMA to only omit origin map updates for malloc zones.

Fixes:          https://cgit.freebsd.org/src/commit/?id=459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
Reviewed by:    rlibby
Differential Revision:  https://reviews.freebsd.org/D58574

We should of course pass the provided domainset rather than copying what
plain malloc() does.

Fixes:          https://cgit.freebsd.org/src/commit/?id=89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58316

kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.

A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58536
PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296835
MFC after: 1 week

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.

Reported by:    Jane Smith <thebugfixers@pm.me> (via D57785)
Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58542

This just invokes xa_insert similar to other xa_*_irq wrappers.

Reviewed by:    bz
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D58576

If boot_mute is set the system appears to hang during the mountroot
prompt. Temporarily unmute the console so the prompt is visible.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58549

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58407

Instead of accessing the struct proc and gathering data from it,
memoize the data needed for pdwait() on exited process in struct
procdesc, at the time of process termination.

This allows unlimited number of calls to pdwait(2) on procdesc for
terminated process.

Change the locking requirements for pd_flags to proctree_lock. This does
not modify the pre-patch locking regime, but the change requires it.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58407

Add the p_zombieref bitmask into struct proc, which enumerates all
legitimate waiters on the process exit status. Among them are parent
for PZOMBIEREF_PARENT, and the holder of the process descriptor for
PZOMBIEREF_PROCDESC, if the process was created by pdfork().

Require all zombie refs to be cleared to reap zombie. This prevents
stealing the exit status from the parent by pdwait()ing on a procdesc
obtained by pdopenpid(), or by waitpid() by debugger from the real
parent.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58264

Reimplement atomic_{set,clear}_16 using atomic_set_32.

Remove emulation of these operations from vm_page.c.

Reviewed by:    alc, kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58580

sbuf reserves a byte of its buffer for the terminator, so the sbuf
created with maxlen held one byte less than the sizing pass had
computed.  The last record overflowed it, sbuf_bcat() failed, and the
error == 0 guard skipped the copy into the caller's sbuf, so the note
has been emitted at full size but zero filled since 5e7c43ff02dc.

Fixes: https://cgit.freebsd.org/src/commit/?id=5e7c43ff02dc

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58583
MFC after: 1 week

kern_proc_kqueues_out() sized its intermediate sbuf from the preceding
sizing pass, so dumping core for a process with many knotes wired a
buffer as large as the entire report.

Shrank the intermediate to one page and added a drain that copied into
the caller's sbuf up to maxlen, stopping the walk once it was reached.
Truncation stayed byte exact.
A dump of 384k knotes peaked at 20 KB of M_SBUF instead of 445 MB.

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58584
MFC after: 1 week

The "add missing GIDs" loop uses rdma_find_gid_by_port() to test whether
a GID already exists, but forgets to drop the reference it returns. So
every rescan that finds an existing GID leaks one, which pins the entry
and prevents its slot from ever being freed on delete.
Just release the reference once the GID is found, like the "remove stale
GIDs" loop already does.

Reported by:  Wafa Hamzah <wafah@nvidia.com>
Reviewed by:  kib, jhb
Sponsored by: Nvidia networking
Fixes:        https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential revision: https://reviews.freebsd.org/D58511

When cleaning up stale GIDs the scan stopped as soon as
rdma_get_gid_attr() failed. But that can also happen for empty entries
in the middle of the table, so a single gap left everything after it
behind and the GID entries could eventually run out.

Now the whole table is scanned and the empty slots are simply skipped.

Reviewed by:  kib, jhb
Sponsored by: Nvidia networking
Fixes:        https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential revision: https://reviews.freebsd.org/D58510

Make it possible to define categories without compiling their
paths into libc (important for third-party modules).  The
EXTERR_CATEGORY_DYNAMIC macro can be defined to a string describing the
compilation unit (generally the path relative to src/sys) which takes
the place of EXTERR_CATEGORY.

These strings are assembled in linker sets with category numbers
assigned at system startup or module load time.  The strings can be
retrieved from the kern.exterr.categories.<category> sysctl.

Reviewed by:    kib
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D58237

We have separate ports for Ccache 3 and 4.  Suggest both, rather than
only the Ccache 3 port.  Rearrange the text somewhat to avoid an
excessively ragged edge on a standard 80-column terminal.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58005

On most architectures we end up not needing ABIBreak.cpp as, although
some of the sources here do reference EnableABIBreakingChecks (or, if
assertions are disabled, DisableABIBreakingChecks) at a source level, we
compile with -ffunction-sections and -fdata-sections, and link with
--gc-sections, and it happens to be the case that all references can be
GC'ed. However, prior to LLVM 21, the RISC-V backend did not apply
-fdata-sections to .sdata, where references to these symbols end up, and
for some files we're building with such references we end up not being
able to GC .sdata due to the other unrelated data in it, meaning that we
do in fact need to build ABIBreak.cpp.

Whilst we could make this conditional on the architecture, it's a tiny
file, and it's a bit fragile to rely on GC behaviour, so just include it
unconditionally.

Reviewed by:    dim, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=770cf0a5f02d ("Fixups after llvm-project main llvmorg-21-init-19288-gface93e724f4 merge")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58044

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Retire the GNU subtree

With GNU diff and cdialog gone, this is now an empty shell.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55425

Add a few missed files to ObsoleteFiles.inc

There were still some left-over files under usr/tests/gnu/usr.bin/diff,
causing the directory to not be fully removed. Add these to OLD_FILES.

Fixes:          https://cgit.freebsd.org/src/commit/?id=134a4c78d070

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

-I${SRCTOP}/sys/contrib/xz-embedded/linux/lib/xz isn't used, and
.PATH: ${SRCTOP}/sys/contrib/xz-embedded/freebsd isn't used either.
Remove them both to simplify things a little.

Sponsored by:           Netflix

The new world may use system calls that are not in the currently-running
kernel, so we cannot chroot into the new environment to run `make
installworld`, `etcupdate`, etc.  Partially revert commit 16702050ac95
("beinstall: perform pre-installworld steps") and switch back to using
DESTDIR for installworld and so on.

Reported by:    olivier
Reviewed by:    olivier
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D50682

I introduced it in commit 1b49115a40ad ("Promote llvm-cov to a
standalone option").  llvm-cov was previously enabled as part of the
CLANG_EXTRAS option.  I made it a standalone, default-enabled option for
parity with the tools provided by the GCC-based toolchain.

We no longer provide an in-tree GCC toolchain.  Now, just build llvm-cov
along with Clang to simplify build infrastructure.

Reviewed by:    dim
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58155

RANLIB is not used by our build, so there is no need to set it.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58156

For the BIOS, add xzfs support. This is a tiny increase in the loader
size, but allows us to fetch compressed files from any of the
filesystems we support, including over the network.

For EFI, also add gzipfs and bzip2fs support we well. The increment for
these files is tiny.

Sponsored by:           Netflix

Sponsored by:         Netflix

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

sbintime.9 is a manual page that documents the usage of sbintime_t and
its helper functions.

MFC after:      1 week
Reviewed by:    ziaee, markj
Differential Revision:  https://reviews.freebsd.org/D57931

The debugfs options between the various modules (core and chipsets)
are not 100% de-coupled.  This means we may run into unresolveable
symbols at load time of the modules if we enable certain options
generally or for core but not for the chipset.
For now: always build the core module with debugfs support.
Migrate the CONFIG_MAC80211_DEBUGFS flag into the Makefile of each
chipset so we can individually turn it on.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

This is included via acpivar.h so needs to be in SRCS to be generated.

Reported by:    bz
Fixes:  https://cgit.freebsd.org/src/commit/?id=bc49842769bd ("acpi_einj: Support for ACPI error injection")
Sponsored by:   Arm Ltd

Add a workaround for the Arm Cortex-A53 erratum 843419. This has been
targeted when the build is either unoptimised for any CPU/architecture
or targets the Cortex-A53 or ARMv8.0 architecture.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296240
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296395
Reported by:    Hal Murray <halmurray+freebsd@sonic.net>
Reported by:    Andreas Schuh <x55839@icloud.com>
Reviewed by:    cognet, mmel
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D58212

Since the devd rules use sysrc, bsdconfig should be installed.

MFC after:      3 days

Until D57524 is not reviewed and committed we will have a missing
function declaration which prevents us to compile (in) debugfs for
mt76 core and mt7921.  Temporary disable debugfs again.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

We defined CONFIG_DEBUG_FILE only in libwpautils, not in wpa_supplicant,
so all it did was enable code that never got called.  Enable it at the
top level so it also applies to wpa_supplicant(8), and the -f option
mentioned in the manual page now actually works.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281617
MFC after:      1 week
Reviewed by:    cy
Differential Revision:  https://reviews.freebsd.org/D57723

The ssh-sk-helper utility only functions if/when MK_USB == yes.
Installing it on systems where MK_USB == no doesn't make sense.

Differential Revision:  https://reviews.freebsd.org/D58246

Commit 1876de606eb8 exposed missing symbols that the port security/krb5
installed that the base system did not install. Part of the solution
was to make libprofile.so private (not libprofile.a) just as the port
does, Red Hat Enterprise Linux does, and as installing MIT KRB5 by hand
does. The actual fix for this was to put symbols and their corresponding
functions into the correct librarires, i.e. libkrb5.so and othes, just
as the port, Red Hat, and manually installed via tarball do.

Unfortunately INTERNALLIB disables the include of bsd.incs.mk and the
install of header files. This is still needed to install profile.h into
/usr/include (just as the port installs it into ${LOCALBASE}/include
and RHEL installs it in /usr/include). This commit fixes this by
installing profile.h into /usr/include from the krb5/include Makfile.

Reported by:    fluffy
Tested by:      fluffy
Reviewed by:    fluffy
Fixes:          https://cgit.freebsd.org/src/commit/?id=1876de606eb8
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D58286

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

We used to pass CONFIGURE_ARGS to the make command which builds pkg,
but ports/ports-mgmt/pkg/Makefile has its own CONFIGURE_ARGS and the
version we were providing at the command line didn't contain the
--mandir setting which was added to the port with pkg 2.8.0.  This
broke release builds.

Instead of passing --prefix=${LOCALBASE} via CONFIGURE_ARGS, pass
PREFIX=${LOCALBASE}; the port Makefile passes that value through to
its configure script.  We also used to pass a --host parameter, but
that seems to have become unnecessary at some point in the past decade.

MFC after:      1 day
Sponsored by:   Amazon

This module has several source files, with many conditional on the
platform architecture. Make it easier to read, and better for future
diffs against these lists.

- Convert to one SRC per line
- Simplify arm/armv7 condition
- Remove now-empty header comment
- Minor formatting

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D58531

Document supported controllers, PF and VF naming, PCI_IOV and IOMMU
requirements, queue and lifecycle constraints, iovctl schema, filtering
and anti-spoof policy, mailbox and MDD recovery, shared hardware
limits, rate control, and statistics cadence.

Relnotes:       yes
Sponsored by:   BBOX.io

This completes step 5 from Committer's Guide.

Approved by:            jbo (mentor)
Differential Revision:  https://reviews.freebsd.org/D57934

In order to merge merge commits (such as vendor imports), we need to
tell git cherry-pick which of the two branches referenced in the commit
is the mainline.  In our case, it is always the first.

Approved by:    markj

Previously we searched commits based on the author email address, but
this isn't really right: if I commit something from a contributor, I'm
still responsible for MFCing it, so really we should be filtering on the
committer.

Add a new --committer option to filter results by committer email
address, defaulting to the user.email value in the git config.

Keep the --author option, but don't filter by author unless the option
is explicitly specified.

Reported by:    des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58126

This allows one to resume from a conflict with a plain
`git cherry-pick --continue`, whereas before one would have to re-run
the original git-mfc command after resolving the conflict and running
`git cherry-pick --continue`.

Suggested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58129

Commit hashes listed in ~/.git-mfc-ignore are not listed in output of
git-mfc --dangling or --pending.  This is handy for silencing output
about commits that are tagged for MFC or as fixing another commit, but
which were not MFCed for some reason or other.

Requested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58161

This silences warnings when running git-mfc --pending against stable/13,
14 and 15.

Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58162

Sponsored by:         Netflix

git-mfc: Slightly relax the regex used to search for reverts

Prompted by commit 9dfaf1cb37f8ac89cf in FreeBSD src.

Reported by:    des

git-mfc: Let the upstream for PRERELEASE branches be main

Such branches are in code slush but are the same as stable branches for
the purpose of MFCs.

git-mfc: Improve handling of remotes

If we can't figure out which remote to use, print a useful error instead
of assuming that "freebsd" is the right remote to use.

- Make it work even when git arc isn't run from the root of the repo.
- If the patch fails to apply, let git partially apply the patch and
  generate rej files for inspection.

While here, remove the return value from apply_rev(), it's never
actually used.

Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D58532

Reviewed by:  markj
Differential Revision: https://reviews.freebsd.org/D58515

Somehow a few commits ended up with "null" appended to Nick's name and
email address.

Reviewed by:    Nick Price <nick@spun.io>
Differential Revision: https://reviews.freebsd.org/D58517

Instead of making the user run the underlying git-cherry-pick command
after a conflict.

Requested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58514

Completed steps 5-6 and 10 in the committer's guide.

Reviewed by:    jhb
Approved by:    jhb (mentor)
Differential Revision:  https://reviews.freebsd.org/D58507

There is no functional change for existing tests, but allows to write a test
that would expect an immediate success of bind(2).

- Test SOCK_DGRAM (UDP) sockets.
- Test binding to 0:port and to a addr:port in presence of connected socket
  using the port.

Differential Revision:  https://reviews.freebsd.org/D56707

Just avoid repeating the test program name in every test case name.
No functional change.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56727

This fixes an endianness bug in sys/netinet/ip_reass_test.
Just use the code from RFC 1071.

Reported by:            glebius
Reviewed by:            glebius, Timo Völker
MFC after:              1 week
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D57988

/sbin/ping and /sbin/ping6 are hard-linked, and the vmmap sysctl handler
doesn't know which name was used to launch the process.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296116
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=080a4087014e ("tests: Fix race condition in aslr_setuid")

MFC after:    1 week

Reviewed by:  kib
MFC with:       5c32aa785184 ("kern: add pdopenpid(2)")
Differential Revision:  https://reviews.freebsd.org/D58023

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

In order to reuse the sendfile_helper program in pf tests, move it
to tests/sys/common directory, indicatint that it is also used from
another places than sys/kern.
Also make the readlen variable static.

Reviewed by:    gelbius, kp
Differential Revision:  https://reviews.freebsd.org/D58040

In order to use the sendfile_helper program in a pf test script that
requires non-loopback interfaces, add functionality to sendfile with a
TCP socket that is connected to a remote host.
The behavior for unix sockets and TCP loopback sockets is unchanged.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D58041

MFC after:    3 days

Reported by:  gcc -Werror=shadow
Reviewed by:    asomers, markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ee1c3d38a26a ("fusefs: fix vnode locking violations during execve")
Differential Revision:  https://reviews.freebsd.org/D58130

Make sure we have reachability when one of our nexthops
gets down without deleting the route.

Differential Revision: https://reviews.freebsd.org/D57552

Help validate my assertion that "physmem will never report empty
ranges". Part of this is covered by the existing tests, which check the
merging of adjacent/overlapping regions. The other part is to ensure
that addition of zero-sized ranges is ignored.

The physmem implementation also includes logic to ignore the first
physical page of memory (physical addresses 0 to PAGE_SIZE-1). Add a
second test case for this.

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D45914

The fix for this is being tracked upstream here:
https://github.com/onetrueawk/awk/issues/269

While here, just cd into $SRCDIR while executing tests,
since the test engine isolates every testcase's working
directory. This ensures that the xfail actually applies
to the next command.

Reviewed by:    mhorne
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Attach a process-mode counting PMC to the current process, start it,
then detach and release it while it is still loaded on the hardware -
the case that previously leaked the PMC's runcount reference and
wedged pmc_wait_for_pmc_idle() at release.  A second case does the same
from a multi-threaded process so the sibling threads' references have
to be drained too.

The tests need an allocatable process-mode counting event and skip
where none is available (hwpmc(4) not loaded, or a VM without a vPMU).

Reviewed by:            adrian
MFC after:              2 weeks
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58343

stress2: Updated the exclude file

stress2: Added a comment

stress2: Added a regression test

Skip the message-content check on kernels that do not advertise the
exterr_strings feature, and pin the output format by clearing
EXTERROR_VERBOSE.

Reviewed by:            kib
MFC after:              1 week
Assisted-by:            Claude Code (Fable 5)
Differential Revision:  https://reviews.freebsd.org/D58322

This requested fix[0] was not complete before the change
was committed.

Cleans up this error message when running tests[1]:
"Cannot 'start' ipfilter. Set ipfilter_enable to YES in
/etc/rc.conf or use 'onestart' instead of 'start'."

[0] https://reviews.freebsd.org/D21065?id=60288#inline-131488
[1] https://ci.freebsd.org/job/FreeBSD-main-amd64-test/28917/testReport/sys.netpfil.common/rdr/ipfnat_local_redirect/

Fixes:          https://cgit.freebsd.org/src/commit/?id=f97a8a36153a9
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

This keeps the skipped test message consistent with others.

Reviewed by:    netchild
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

The time_unit test case uses PID 1 as a target for pwait.  This doesn't
work in a jail.  Since all we need is a process that we know won't die
while the test is running, we may as well use ourselves.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D58418

The function create_staticobj() is only used inside this translation unit.
Clang produces a -Wmissing-prototypes warning during standard buildworld.
This warning will become a fatal compile error if MK_WERROR is enabled for hardened builds.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285870
Fixes: https://cgit.freebsd.org/src/commit/?id=ee9ce1078 ("libc: tests: add some tests for __cxa_atexit...")
Signed-off-by: Zhang Qiyue <peter-open-source.probing805@aleeas.com>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2321

This change converts the longhand form of `extern "C" {` and its
corresponding `}` into `__BEGIN_DECLS` and `__END_DECLS`, respectively.

The new form is much easier to grep for and is a best practice to use in
the FreeBSD tree.

This is meant to be a non-functional change.

MFC after:      1 week

pwait: Test the new -r option

Test that pwait without -r reports a process as soon as it terminates,
while pwait with -r does not report it until it has been reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58385

pwait: Fix pwait_normal test case

Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=e115066370dc ("pwait: Test the new -r option")

Add tests for both IPv4 and IPv6 routes with the prefsrc attribute.
Also test IPv4 routes over IPv6 nexthops and borrow their IPv4
addresses from the loopback interface.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58326

The child exited immediately after pdfork(), so the parent's pdopenpid() could
catch it mid-exit (P_WEXIT) and fail with EBUSY.
Block the child on a pipe until the parent has opened the second descriptor,
then release it

Approved by:    markj
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58546

Add a regression test for gre(4)
to make sure all of the gre capabilities and options are
working as intended.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D55363

Some of the preadv() and readv() tests were not initializing the iovecs
they pass to the system call.  When the system call is expected to fail,
that's fine since the FORTIFY_SOURCE checks cause the process to be
aborted.  However, in the rest of the test cases, the (p)readv() call
could cause spurious test failures, e.g., when an uninitialized iov
entry points to the current stack frame and the canary gets overwritten.

Modify the tests to explicitly initialize iov entries to avoid this.
The "iov" variants don't have this problem, so leave them alone.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58289

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58530

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58569

The flag is -D, but it was written as a second -d. Add a period too.

MFC after:      3 days

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57928

Fixes:          https://cgit.freebsd.org/src/commit/?id=c3c8f4d9e662 ("cpu: New cpu_get_pcpuid(), retrieves internal CPU ID")
Sponsored by:   The FreeBSD Foundation

Rename handler function type 'lapic_thermal_handle_function' to the
shorter 'lapic_thermal_handler_t'.  Move it closer to the function
declaration block where it is used.  Make it a true function type (no
pointer) and add explicit pointer marks on usage.

Rename 'lapic_thermal_function_value' to the more immediately clear
'lapic_thermal_function_arg'.  In lapic_thermal_enable(), use 'func_arg'
as the argument name for the handler argument, which at least refers to
function 'func', rather than the generic 'value'.

Finally, rename the global handler variable from
'lapic_thermal_function_ptr' to the shorter 'lapic_thermal_function'
(dynamic functions can be referenced only through a pointer).

MFC with:       87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Sponsored by:   The FreeBSD Foundation

MFC after:    1 week

We should exit the net epoch instead of acquiring one more entry.

Reported by:    Wafa Hamzah <wafah@nvidia.com>
Reviewed by:    jhb
Sponsored by:   Nvidia networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=4726b80d9379 ("OFED: Various changes from Linux 4.20")
Differential revision:  https://reviews.freebsd.org/D58127

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Sponsored by: The FreeBSD Foundation
MFC after:      3 days

if administrator mistakenly types into configuration file

anchor=authpf_test

where 'authpf_test' is followed by white space, the authpf(8)
is going to use anchor 'authpf_test ' instead of the 'authpf_test'
which is defined in pf.conf(5) as 'anchor authpf_test/*'

issue kindly reported and patch submitted by

Avinash Duduskar <avinash.duduskar (_at_) gmail (_dot_) com>

OK sashan@

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296958
MFC after:      1 week
Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 2d12a8e44d
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Also use bool for the 'cancel' argument for cond_wait_common().

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58463

Show nhop flags like invalid nexthop to debug cases like
the PR below.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296883
Reviewed by:    glebius
Differential Revision: https://reviews.freebsd.org/D58347

Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.

The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Another, FreeBSD Foundation
was misrepresented as an operating system version instead of an author.
Two more had other parts of the sentence supplied as an argument to Fx.

While I had those open, fix the other mechancial typos visible on those
specific screenfulls. Fix a list width glitch, correct section typo
AUTHOR to AUTHORS, and switch AUTHORS sections containing prose to
prose-mode so that they wrap freely when rendered.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297248
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=d39e310c7d6a ("man/man3: add stdbit.3")
Fixes:          https://cgit.freebsd.org/src/commit/?id=d790b16bbf0c ("add man pages for stdbit functions")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b61850c4e6f6 ("net.link.bridge.member_ifaddrs to false")
Reported by:    wosch (groff is complaining about incorrect Fx usage)

Merge commit 'e988c5eab5231646c612d35ff5b16122cebfbf6a'

In delete(), when copying the deleted character to the d_char buffer,
don't assume that it fits.  utf8_prev() may return a sequence of more
than 5 bytes.

In insert_utf8(), fix the copy-up of the line.  We extended the line by
"len" bytes, so "temp" has to be repositioned accordingly.  Compare with
plain insert().

Use sizeof when copying to buffers instead of hard-coding buffer sizes.

Don't dynamically allocate d_char, there is no need.

Fixes:          https://cgit.freebsd.org/src/commit/?id=62fba0054d9e ("ee: add unicode support")
Reported by:    Sayono Hiragi (overflow in delete())
Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57996

Otherwise one can't easily attach gdb to ee.

Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57997

When looking up self process we can use `ps -p $$` directly rather
than grep which may find other processes ending in the expected PID.

Sponsored by:   Dell Inc.
Reviewed by:    markj, vangyzen
Differential Revision: https://reviews.freebsd.org/D58019

Changes: https://github.com/eggert/tz/blob/2026c/NEWS

MFC after:      3 days

MFC after:    1 week

Full release notes are available at
https://www.openssh.com/txt/release-10.4

Selected highlights from the release notes:

Potentially-incompatible changes
--------------------------------

 * sshd(8): configuration dump mode ("sshd -G") now writes directives
   in mixed case (e.g. "PubkeyAuthentication") whereas previously it
   emitted only lower-case names.

 * ssh(1), sshd(8): make the transport protocol stricter by
   disconnecting if the peer sends non-KEX messages during a post-
   authentication key re-exchange. Previously a malicious peer could
   continue sending non-key exchange messages without penalty. These
   would be buffered, causing memory to be wasted up until the
   connection terminated or the server/client hit a memory limit.
   Implementations that do not restrict messages sent during key
   exchange as per RFC4253 section 7.1 may be disconnected.
   Reported by Marko Jevtic.

Changes since OpenSSH 10.3
==========================

This release contains a number of security fixes as well as general
bugfixes and a couple of new features.

Security
========

 * sftp(1): when downloading files on the command-line using
   "sftp host:/path .", a malicious server could cause the file to
   be downloaded to an unexpected location. This issue was identified
   by the Swival Security Scanner.

 * scp(1): when copying files between two remote destinations, do
   not allow a malicious server to write files to the parent
   directory of the intended target directory.  This issue was
   identified by the Swival Security Scanner.

 * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
   as it was documented to do. Note that PermitTunnel is not enabled
   by default. Reported independently by Huzaifa Sidhpurwala of
   Redhat and Marko Jevtic.

 * sshd(8): avoid a potential pre-authentication denial of service
   when GSSAPIAuthentication was enabled (this feature is off by
   default). This was not mitigated by MaxAuthTries, but would be
   penalised by PerSourcePenalties. This was reported by Manfred
   Kaiser of the milCERT AT (Austrian Ministry of Defence).

 * sshd(8): fix a number of cases where the minimum authentication
   delay was not being enforced. Reported by the Orange Cyberdefense
   Vulnerability Team.

 * ssh(1): fix a possible client-side use-after-free if the server
   changes its host key during a key reexchange. This was reported by
   Zhenpeng (Leo) Lin of Depthfirst.

New features
------------

 * All: add experimental support for a composite post-quantum
   signature scheme that combines ML-DSA 44 and Ed25519 as specified
   in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

   This scheme is not enabled by default. To use it, you'll need
   to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
   Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

Bugfixes
--------

 * sshd(8): avoid sending observably different messages for valid vs
   invalid users in GSSAPIAuthentication (disabled by default).

 * ssh(1), sshd(8): fix several bugs that incorrectly
   classified bulk traffic as interactive. bz3972, bz3958

 * ssh-keygen(1), ssh-add(1): skip unsupported key types when
   downloading resident keys from a FIDO token. Previously, downloads
   would abort when one was encountered. GHPR657

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58083

We don't use this note type today, but as a general purpose ELF
diagnostic tool readelf(1) ought to decode it.

References:
https://fedoraproject.org/wiki/Changes/Package_information_on_ELF_objects
https://systemd.io/ELF_PACKAGE_METADATA/

Reviewed by:    fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D47524

Differential Revision: https://reviews.freebsd.org/D58333
Approved by: ivy
MFC after:  3 days

Changelog: https://github.com/vstakhov/libucl/releases/tag/0.9.4

Add -P as shorthand for --pause-before-cleanup.

MFC after:      1 week
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D56613

Release notes at
        https://community.nlnetlabs.nl/t/unbound-1-25-2-released

Merge commit 'c68e7bcd81d62e9f5364c6da22fd9917976acf85'

Security:       CVE-2026-14586
Security:       CVE-2026-32665
Security:       CVE-2026-40691
Security:       CVE-2026-41637
Security:       CVE-2026-42955
Security:       CVE-2026-44621
Security:       CVE-2026-44687
Security:       CVE-2026-44690
Security:       CVE-2026-46582
Security:       CVE-2026-50045
Security:       CVE-2026-50046
Security:       CVE-2026-50243
Security:       CVE-2026-50248
Security:       CVE-2026-50251
Security:       CVE-2026-50252
Security:       CVE-2026-52863
Security:       CVE-2026-54478
Security:       CVE-2026-55708
Security:       CVE-2026-55717
Security:       CVE-2026-55973
Security:       CVE-2026-55990
Security:       CVE-2026-55991
Security:       CVE-2026-56416
Security:       CVE-2026-56444

Update the mt76/zzz_fw_ports_fwget.sh script to set fwget to download
mt7921 and mt7925 rather than the these days non-existent mt792x flavor.

Sponsored by:   The FreeBSD Foundation
MFC after:      30 days
Differential Revision: https://reviews.freebsd.org/D57242