FreeBSD git weekly: 2025-12-08 to 2025-12-14

* If invoked as fasthalt or fastboot, behavior is unchanged.

* If not invoked as fasthalt or fastboot, we simply signal init(8),
  just like shutdown(8) does, instead of taking the system down
  ourselves.

* Since only init can handle the RB_REROOT case, the -r flag is not
  supported in fast mode.

* Update the usage string to correctly reflect the program being run
  (fast or normal; halt, boot, or nextboot) and the options available
  in each case.

* Update the manual page to make the distinction between normal and
  fast mode clear, better explain what shutdown(8) still does that
  reboot(8) does not, and add a historical note explaining what the
  difference between the two used to be.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D54117

Currently, we have very long timeouts for the initial probing
commands. However, these are not appropriate for modern (post 2010) SCSI
disks. Sandards since SPC3 state that these commands should not wait for
media access. Since we retry them several times during the initial bus
scan, these delays can delay the boot by minutes (5 minutes per errant
disk in our expereince). These delays don't help and only hurt, so
reduce the TESTUNITREADY, INQUIRY and MODESENSE commands (during the
initial probe). Provide sysctl/tuneables to change the time for these
and also the REPORTLUNS commands for people that might need to adjust
them for devices that violate this belief but none-the-less work with
longer timeouts.
        kern.cam.tur_timeout            (default was 60s, now 1s)
        kern.cam.inquiry_timeout        (default was 60s, now 1s)
        kern.cam.reportluns_timeout     (default is 60s)
        kern.cam.modesense_timeout      (default was 60s, now 1s)
This can be partially merged: the sysctls can, but the new defaults likely
shouldn't.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D52427

Differential Revision:        https://reviews.freebsd.org/D54195

Reviewed by:  emaste, imp
Differential Revision:  https://reviews.freebsd.org/D54197

@bdrewery reported D48873 broke "bzgrep -q '1 2' /var/log/messages.0.bz2"
The mistake was in using $* instead of "$@" (I suspect $* is never right).

Reported by:    bdrewery
Reviewed by:    markj
Approved by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=1070477cc8b7 ("Fix remaining zgrep(1) wrapper script regressions")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54217

MFC after:    1 week

Further explain that trim(8) is not for trimming free blocks
in populated file systems/ZFS pools, as people still take it wrong sometimes.

MFc after:      1 week

Grammar fix after previous commit.

MFC after:      1 week
X-MFC-with:     dbc4a1c69191909a7210cad6da46b755557d0d34

Reported by:  ziaee

+ Adjust document description matching another terabit driver
+ Add BCM576XX family to DESCRIPTION, switch to XX notation
+ Add some model names, additional models, and improvements to HARDWARE

MFC after:              3 days
Reviewed by:            sumit.saxena_broadcom.com (previous)
Differential Revision:  https://reviews.freebsd.org/D54028

Differential Revision:        https://reviews.freebsd.org/D54195

Reviewed by:  emaste, imp
Differential Revision:  https://reviews.freebsd.org/D54197

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291649
Fixes: https://cgit.freebsd.org/src/commit/?id=905571c03119 ("Remove copyright strings printed at login time via login(1) or sshd(8).")

When migrating the firmware to be installed as plain firmware files
to /boot/firmware the iwm8000C firmware lost its "fw" suffix that
iwm(4) expects.
The follow-up change to defaults/loader.conf is also consistently
missing the "fw".

Fix both places, and add the wrongly spelt version to ObsoleteFiles.inc
(entirely untested).

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291403
Reported by:    Augustin Hoffmann (avgwst tutanota.de)
Fixes:          https://cgit.freebsd.org/src/commit/?id=af0a81b6470aba4af4a24ae9804053722846ded4
Fixes:          https://cgit.freebsd.org/src/commit/?id=a0f06dfb0d188966bee7265ec7d9f20093186bb6
MFC after:      3 days

MFC after:    1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D54038

Reviewed by:  np, imp
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D53030

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53405

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53406

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53407

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53408

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53409

Remove type and rid arguments from
bhnd_bus_(activate|deactivate|release)_resource.  This should have
been done earlier to match the changes made to bus_release_resource,
etc.

While fixing up the callers, remove rid members from softc structures
since the only time a value is needed is as a constant input to
bhnd_bus_alloc_resource*.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D53410

These were a doodle that escaped into my staging tree. Remove them.

Sponsored by:           Netflix

Interface for the nvme driver notifying its children of different
events: async notifications, namespace events and device failure. These
aren't yet connected.

Sponsored by:           Netflix
Reviewed by:    dab
Differential Revision:  https://reviews.freebsd.org/D51386

Step 1 in the move from registering consumers for NVMe drives to newbus
nvme drives:

Add a child device and attach them for each controller that we
initialize. Detach them when we detach the main device.

Sponsored by:           Netflix
Reviewed by:            dab
Differential Revision:  https://reviews.freebsd.org/D51383

Rather than registering as a consumer of the nvme controller, hook into
the child device and use that.

This is a small regression at the moment: we don't fail the device when
that happens at runtime, and we don't handle new namespaces when they
arrive (though that feature is currently fragile).

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D51384

Rather than registering as a consumer of the nvme controller, hook into
the child device and use that.

This is a small regression at the moment: we don't fail    the device when
that happens at runtime.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D51385

Connect up the nvme_ns_* events. Copy code from old ways, as needed, and
refactor a little.

Sponsored by:           Netflix
Reviewed by:            dab
Differential Revision:  https://reviews.freebsd.org/D51387

Conenct methods to manage namespaces explicitly to replace the old
consumer interface.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D51388

nvme: Use new method to do async notifications

Nothing uses these at the moment, but it would be useful to use in the
future so convert this functionality to an newbus function dispatch.

Sponsored by:           Netflix
Reviewed by:            dab
Differential Revision:  https://reviews.freebsd.org/D51390

nvme: Notify failure with newbus call

Sponsored by:           Netflix
Reviewed by:            dab
Differential Revision:  https://reviews.freebsd.org/D51391

nvme: remove now-redundant consumer interface

Now that we've moved to newbus methods, we can delete this...

Sponsored by:           Netflix
Reviewed by:            dab
Differential Revision:  https://reviews.freebsd.org/D54095

And remove some unused definitions.

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54152

Sponsored by: CHERI Research Centre

This is useful when dev.netmap.port_numa_affinity is set to 1.  When
interfaces attach, they get a memory allocator that is copied from
nm_mem.  Parameters in nm_mem can be set using sysctls, but this happens
after their values are copied.

To work around this, we can make it possible to set these memory
parameters as tunables.

Reviewed by:    vmaffione
MFC after:      1 week
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54178

Reviewed by:  kp
Reported by:    Kevin Day <kevin@your.org>
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=a7191e5d7b62 ("pf: add a way to list creator ids")
Differential Revision:  https://reviews.freebsd.org/D54083

- pfr_table_count() can return an error.
- We must check for failure from mallocarray(M_NOWAIT).

Fixes:          https://cgit.freebsd.org/src/commit/?id=9e8d2962aad3 ("pf: convert DIOCRGETTSTATS to netlink")
Reported by:    Kevin Day <kevin@your.org>
Reviewed by:    kp
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54094

Add a sysctl/tunable (net.inet.ipf.jail_allowed) to control whether a
jail can manage its own ipfilter rules, pools, and settings. A jail's
control over its own ipfilter rules and settings may not be desireable.
The default is jail access to ipfilter is denied.

The host system can stil manage a jail's rules by attaching the rules,
using the on keyword, limiting the rule to the jail's interface. Or
the sysctl/tunable can be enabled to allow a jail control over its own
ipfilter rules and settings.

Implementation note: Rather than store the jail_allowed variable,
referenced by sysctl(9), in a global area, storing the variable in the
ipfilter softc is consistent with ipfilter's use of its softc.

Discussed with:         emaste, jrm
MFC after:              1 week
Differential revision:  https://reviews.freebsd.org/D53623

At the moment ipfs(8) is a tool that can be easily abused. Though the
concept is sound the implementation needs some work.

ipfs(8) should be considered experimental at the moment.

This commit also makes ipfs support in the kernel optional.

Reviewed by:            emaste, glebius
MFC after:              1 week
Differential revision:  https://reviews.freebsd.org/D53787

Add struct mtx to struct lltable and stop using IF_AFDATA_LOCK, that
was created for a completely different purpose.  No functional change
intended.

Reviewed by:            zlei, melifaro
Differential Revision:  https://reviews.freebsd.org/D54086

Avoid a possible use-after-free in the rx path.
ovpn_decrypt_rx_cb() calls ovpn_finish_rx() which releases the lock,
but continues to use the peer.
Ensure that the peer cannot be freed until we're sure all potential
users have stopped using it (i.e. have left net_epoch).

Reported by:    Kevin Day <kevin@your.org>
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

First, a bit of background on some of the data structures netlink uses
to manage data associated with a netlink connection.

- struct linear_buffer contains a single virtually-contiguous buffer
  of bytes.  Regions of this buffer are suballocated via lb_allocz()
  which uses a simple "bump" where the buffer is split into an
  allocated region at the start and a free region at the end.  Each
  allocation "bumps" the boundary (lb->offset) forward by the
  allocation size.

  Individual allocations are not freed.  Instead, the entire buffer is
  freed once all of the allocations are no longer in use.

  Linear buffers also contain an embedded link to permit chaining
  buffers together.

- snl_state contains various state for a netlink connection including
  a chain of linear buffers.  This chain of linear buffers can contain
  allocations for netlink messages as well as other ancillary data
  buffers such as socket address structures.  The chain of linear
  buffers are freed once the connection is torn down.

- snl_writer is used to construct a message written on a netlink
  connection.  It contains a single virtually-contiguous buffer
  (nw->base) allocated from the associated snl_state's linear buffer
  chain.  The buffer distinguishes between the amount of space
  reserved from the underlying allocator (nw->size) and the current
  message length actually written (nw->offset).  As new chunks of data
  (e.g. netlink attributes) are added to the write buffer, the buffer
  is grown by snl_realloc_msg_buffer by reallocating a larger buffer
  from the associated snl_state and copying over the current message
  data to the new buffer.

Commit 0c511bafdd5b309505c13c8dc7c6816686d1e103 aimed to fix two bugs
in snl_realloc_msg_buffer.

The first bug is that snl_realloc_msg_buffer originally failed to
update nw->size after growing the buffer which could result in
spurious re-allocations when growing in the future.  It also probably
could eventually lead to overflowing the buffer since each
reallocation request was just adding the new bytes needed for a chunk
to the original 'nw->size' while 'nw->offset' kept growing.
Eventually the new 'nw->offset' would be larger than 'nw->size + sz'
causing routines like snl_reserve_msg_data_raw() to return an
out-of-bounds pointer.

The second change in this commit I think was trying to fix the buffer
overflows due to 'nw->size' being wrong, but instead introduced a new
set of bugs.  The second change ignored the returned pointer from
snl_allocz() and instead assumed it could use all of the
currently-allocated data in the current linear buffer.  This is only
ok if the only data in the linear buffer chain for the associated
snl_state is the snl_writer's message buffer.  If there is any other
data allocated from the snl_state, it could be earlier in the current
linear buffer, so resetting new_base to nw->ss->lb->base can result in
overwriting that other data.  The second change was also
over-allocating storage from the underlying chain of linear buffers
(e.g. a writer allocation of 256 followed by 512 would end up using
the first 512 bytes, but 768 bytes would be reserved in the underlying
linear buffer).

To fix, revert the second change keeping only the fix for 'nw->size'
being wrong.

Reviewed by:    igoro, markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=0c511bafdd5b ("netlink: fix snl_writer and linear_buffer re-allocation logic")
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D54148

If the TTL (or hop limit) expires during nat64 translation we may
need to send the error message in the original address family (i.e.
pre-translation).
We'd usually handle this in pf_route()/pf_route6(), but at that point we
have already translated the packet, making it difficult to include it in
the generated ICMP message.

Check for this case in pf_translate_af() and send icmp errors directly
from it.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291527
MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D54166

Submitted by: lampa@fit.vutbr.cz
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291565
MFC after:      1 day

See c3fc0db3bc50df18a724e6e6b12ea4e060fd9255 for details.

This shrinks the structure a bit.  Should be no functional change.

Differential Revision:  https://reviews.freebsd.org/D53870

pfsync_state_export() takes a pointer to a union that is in reality a
pointer to one of the three state formats (1301, 1400, 1500), and zeros
the union.  The three formats do not have the same size, so zeroing is
wrong when the format isn't that which has the largest size.

Refactor a bit so that the zeroing happens at the layer where we know
which format we're dealing with.

Reported by:    CHERI
Reviewed by:    kp
MFC after:      1 week
Sponsored by:   CHERI Research Centre (EPSRC grant UKRI3001)
Differential Revision:  https://reviews.freebsd.org/D54163

Instead of having FILESYSTEMS require cleanvar, which doesn't really
make semantic sense, say that cleanvar needs to run before FILESYSTEMS.

MFC after:      3 days
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D54118

This rc script exists solely to create a file, so have it explicitly
require FILESYSTEMS.  In its current form, it was as likely as not to
end up running before cleanvar, which would undo its work.

MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=384d976725a5 ("rc.d: Add precious_machine rc.conf knob to create /var/run/noshutdown")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54119

* Reimplement the -a option which was available in the original shell
  script and is still documented.

* Print the correct usage string when invoked as nextboot.

* Add the -D option to the manual page synopsis.

MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=fd6d47375a78 ("rescue,nextboot: Install nextboot as a link to reboot, rm nextboot.sh")
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D54120

MFC after:    1 week
Reported by:    Kevin Day <kevin@your.org>

Normally after partitions are created by the installer, the 'mount'
script is used to mount the target disk partitions under /mnt.  The
tail end of this script also mounts a couple of additional filesystems
under /mnt so that chrooted programs can work such as devfs and
/packages.

When the "Shell" option is used to permit the user to manually mount
the destination filesystem, the "mount" script is not used as the user
is instructed to mount the target filesystems and construct
/mnt/etc/fstab, etc.  However, this means that the user is responsible
for mounting devfs (which is not included in /etc/fstab) and /packages
as well.  The help message for the "Shell" option doesn't mention
these requirements, so users may not know to do so.  This can lead to
confusing errors as chrooted commands can fail to find needed /dev
entries.  For example, running fwget to fetch wireless firmware fails
because /dev/pci doesn't exist.

To make this less painful for users using this option, split out the
bottom half of the 'mount' script that mounts these non-fstab-related
filesystems into a separate 'mount_aux' script.  Invoke 'mount_aux'
after using "Shell" to create the filesystem to ensure that these
filesystems are always present.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290901
Reported by:    Peter <freebsd@peterk.org>
Tested by:      Peter <freebsd@peterk.org>
Differential Revision:  https://reviews.freebsd.org/D53770

ipfilter options are erased and reset to default when ipfilter is
disabled. This results in nullifying options from rc.conf that were
previously set.

8d6feaaaa26f, which added this code, was incorrect as it was for a bug in
ipfilter 4.2.28 and no longer applies to ipfilter 5.1.2.

Fixes:          https://cgit.freebsd.org/src/commit/?id=8d6feaaaa26f
MFC after:      1 day

* If invoked as fasthalt or fastboot, behavior is unchanged.

* If not invoked as fasthalt or fastboot, we simply signal init(8),
  just like shutdown(8) does, instead of taking the system down
  ourselves.

* Since only init can handle the RB_REROOT case, the -r flag is not
  supported in fast mode.

* Update the usage string to correctly reflect the program being run
  (fast or normal; halt, boot, or nextboot) and the options available
  in each case.

* Update the manual page to make the distinction between normal and
  fast mode clear, better explain what shutdown(8) still does that
  reboot(8) does not, and add a historical note explaining what the
  difference between the two used to be.

MFC after:      1 month
Relnotes:       yes
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D54117

Now that halt and reboot actually signal init, shutdown needs to run
fasthalt or fastboot instead when given the -o option.

MFC after:      1 month
Reviewed by:    imp, allanjude
Differential Revision:  https://reviews.freebsd.org/D54122

Add leaf-list modifier to attrib as it's possible to have multiple
attributes on a gpart provider.

I purposely made it so that the normal output still says "attrib:" just
so we don't break any scripts people may be using to parse the output,
but the libxo output now says "attribute" just like `gpart show` will do
once https://reviews.freebsd.org/D53950 is merged.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291377
MFC after:      1 week
Reviewed by:    asomers
Sponsored by:   ConnectWise
Differential Revision: https://reviews.freebsd.org/D54080

When looking for the boot_params symbol we need to get the UEFI memory
map, use host: prefix. The short-circuit we have for this only works
when we have a filesystem. During the earliest parts of boot, we can
sometimes not have this yet, so making this explicit allows these
environments to function.

It's always in the host path. Print better
error messages, and add newlines in two palces.

Sponsored by:           Netflix

edk2 PciSioSerialDxe driver setup depends on subclass and function
being set, adding them does make it possible to access pci-uart
serial port from UEFI.

Reviewed by:            corvink
Differential Revision:  https://reviews.freebsd.org/D54167
Sponsored by:           Edgecast Cloud LLC

When building with WITHOUT_SENDMAIL this result in a FreeBSD-libmilter-dev
package with only this directory and a dependacy on FreeBSD-libmilter which
doesn't exists.

Differential Revision:  https://reviews.freebsd.org/D54193
Fixes:          https://cgit.freebsd.org/src/commit/?id=436618a427b4 ("etc/mtree: Add package tags for /usr/include")
Reviewed by:    ivy
Sponsored by:   Beckhoff Automation GMbH & Co. KG

Currently, after suspending, bhyve(8) exits with 0. This code is
also used to indicate that a VM was rebooted. To differentiate
reboot and suspend, use the next available exit code, 5, for suspend.

Approved by:            markj
Sponsored by:           The FreeBSD Foundation
MFC after:              2 weeks
Differential Revision:  https://reviews.freebsd.org/D54087

Currently, it is possible to execute bhyvectl(8) with mutually exclusive
options, such as "--destroy" and "--suspend", and it will print out
obscure errors, e.g.:

 bhyvectl --suspend=/var/run/vms/my_vm --destroy --vm my_vm
 connect() failed: Connection refused

Address that by failing early if mutually exclusive options were
specified.

Additionally, move the BHYVE_SNAPSHOT block before the errors are
printed, so its errors are also displayed.

Approved by:            markj
Sponsored by:           The FreeBSD Foundation
MFC after:              2 weeks
Differential Revision:  https://reviews.freebsd.org/D54092

Build fails without BHYVE_SNAPSHOT due to undeclared identifier
'checkpoint_file'. Wrap that with a proper #ifdef.

Reported by:    dhw

Remove the '#ifndef INET6', which never actually mattered because this
define is never set. This makes us report ICMP states for IPv4 and IPv6
the same way (and also aligns us with OpenBSD).

This means we will now always report state 0:0 rather than
NO_TRAFFIC:NO_TRAFFIC for icmp6 (like we already did for icmp).

Reported by:    Lev Prokofev <lev@netgate.com>
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Reported by:  gtetlow
Fixes:          https://cgit.freebsd.org/src/commit/?id=39ee24182b92 ("rc.subr: Support setting the audit user when starting services")
MFC after:      1 week

Unicode 17.0 adds 4803 characters, for a total of 159,801 characters.
The new additions include 4 new scripts:

- Sidetic
- Tolong Siki
- Beria Erfe
- Tai Yo

https://www.unicode.org/versions/Unicode17.0.0/

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54066

Add an nscache specific inline function to calculate the misalignment
rather than adding and subtracting _ALIGN(p) and p which can take the
buffer far out of bound (undefined behavior in C and unsupported on
CHERI).

Reviewed by:    kib
Effort:         CHERI upstreaming
Obtained from:  CheriBSD
Sponsored by:   DARPA
Differential Revision:  https://reviews.freebsd.org/D53945

Without the void * casts, the compiler complains about an alignment
requirement increase.

Reviewed by:    kib, markj
Obtained from:  CheriBSD
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D53946

Due to incorrect unit test design, two overread conditions went
undetected in the amd64 baseline stpncpy() implementation.
For buffers of 1--16 and 32 bytes that do not contain nul bytes
and end exactly at a page boundary, the code would incorrectly
read 16 bytes from the next page, possibly crossing into an
unmapped page and crashing the program.  If the next page was
mapped, the code would then proceed with the expected behaviour
of the stpncpy() function.

Three changes were made to fix the bug:

 - an off-by-one error is fixed in the code deciding whether to
   enter the runt case or not, entering it for 0<n<=32 bytes
   instead of 0<n<32 bytes as it was before.
 - in the runt case, the logic to skip reading a second 16-byte
   chunk if the buffer ends in the first chunk was fixed to
   account for buffers that end at a 16-byte boundary but do not
   hold a nul byte.
 - in the runt case, the logic to transform the location of the
   end of the input buffer into a bit mask was fixed to allow
   the case of n==32, which was previously impossible due to the
   incorrect logic for entering said case.

The performance impact should be minimal.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291359
See also:       D54169
Reported by:    Collin Funk <collin.funk1@gmail.com>
Reviewed by:    getz
Approved by:    markj (mentor)
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=90253d49db09a9b1490c448d05314f3e4bbfa468 (https://cgit.freebsd.org/src/commit/?id=D42519)
Differential Revision:  https://reviews.freebsd.org/D54170

When creating a unionfs mount, it's fairly easy to shoot oneself
in the foot by specifying upper and lower file hierarchies that
resolve back to the same vnodes.  This is fairly easy to do if
the sameness is not obvious due to aliasing through nullfs or other
unionfs mounts (as in the associated PR), and will produce either
deadlock or failed locking assertions on any attempt to use the
resulting unionfs mount.

Leverage VOP_GETLOWVNODE() to detect the most common cases of
foot-shooting at mount time and fail the mount with EDEADLK.
This is not meant to be an exhaustive check for all possible
deadlock-producing scenarios, but it is an extremely cheap and
simple approach that, unlike previous proposed fixes, also works
in the presence of nullfs aliases.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=172334
Reported by:    ngie, Karlo Miličević <karlo98.m@gmail.com>
Reviewed by:    kib, olce
Tested by:      pho
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D53988

Prior to c86af2cc4cd1 ("imgact_elf: Check note body sizes"), this was
note_name + n_namesz >= note_end, which checks that there is at least
one byte after the unpadded name (which could be either padding or
data), and given our notes always have data with them this was fine.
However, once we started checking the padded name (note that "FreeBSD\0"
is already a multiple of 4 bytes, so has no padding) and data, this
turned into checking that there is at least one byte after the unpadded
data, and since our ELF notes already have a multiple of 4 bytes for
their data and therefore have no padding, this means that we are now
checking that there is at least one byte after the ELF note, which is
not going to be the case for the last ELF note. Instead, switch this to
a strict greater than, as should be used when comparing one-past-the-end
pointers, which both sides of the inequality are.

For executables, this was generally not a problem in reality, since the
last of our ELF notes is NT_FREEBSD_NOINIT_TAG, which isn't read by the
kernel. However, ld-elf.so.1 (and libcompat variants), like shared
libraries, only has NT_FREEBSD_ABI_TAG, which meant the kernel did not
see this ELF note when directly executing it (e.g. as done by ldd), and
on RISC-V this is the only branding present, so doing so would fail with
ENOEXEC. This does also mean on non-RISC-V direct exec ld-elf.so.1 runs
with the wrong p_osrel, but given it sets kern.proc.osrel.PID to the
executable's NT_FREEBSD_ABI_TAG that it loads, this probably doesn't
matter in practice.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291446
Reported by:    bdragon
Tested by:      bdragon
Fixes:          https://cgit.freebsd.org/src/commit/?id=c86af2cc4cd1 ("imgact_elf: Check note body sizes")
MFC after:      3 days

If the length of the string is maxlen, we would end up copying maxlen+1
bytes, which violates the contract of the function.  The result is the
same since that extra byte is overwritten.

Reported by:    Kevin Day <kevin@your.org>
Reviewed by:    imp, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54093

Use it in proc0_post to reset per-process CPU usage.

Suggested by:   olce
Reviewed by:    olce, kib
Differential Revision:  https://reviews.freebsd.org/D54049

proc0_post aims to reset the CPU usage accounting for all threads and
processes in the system to zero once the time of day is verified.
However, not all of the per-thread stats were not being cleared,
resulting in over-reported time for thread0 post-boot.

Reviewed by:    olce, kib, markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=bed4c5241663 ("Implement RUSAGE_THREAD. Add td_rux...")
Differential Revision:  https://reviews.freebsd.org/D54040

rufetch() has several other effects besides clearing these per-thread
stats most of which are explicitly discarded by the subsequent calls
to ruxreset().  Just clear the relevant stats directly instead.

Reviewed by:    olce, kib, markj
Differential Revision:  https://reviews.freebsd.org/D54050

linux: separate all ifnet(9) related code into linux_ifnet.c

Remove linux_use_real_ifname().  It is no longer used outside of the
file since 3ab3c9c29cf0.  There is no functional change.

Reviewed by:            melifaro, dchagin
Differential Revision:  https://reviews.freebsd.org/D54076

linux: fix build without VIMAGE

Fixes:  https://cgit.freebsd.org/src/commit/?id=fbf05d2147b1add8b760be166c4b1fd4499ebce8

linux: store Linux Ethernet interface number in struct ifnet

The old approach where we go through the list of interfaces and count them
has bugs.  One obvious bug with this dynamic translation is that once an
Ethernet interface in the middle of the list goes away, all interfaces
following it would change their Linux names.

A bigger problem is the ifnet arrival and departure times.  For example
linsysfs has event handler for ifnet_arrival_event, and of course it wants
to resolve the name.  This accidentially works, due to a bug in
if_attach() where we call if_link_ifnet() before invoking all the event
handlers.  Once the bug is fixed linsysfs won't be able to resolve the old
way.  The other side is ifnet_departure_event, where there is no bug, the
eventhandlers are called after the if_unlink_ifnet().  This means old
translation won't work for departure event handlers.  One example is
netlink.  This change gives the Netlink a chance to emit a proper Linux
interface departure message.

However, there is another problem in Netlink, that the ifnet pointer is
lost in the Netlink translation layer.  Plug this with a cookie in netlink
writer structure that can be set by the route layer and used by the Netlink
Linux translation layer.  This part of the diff seems unrelated, but it is
hard to make it a separate change, as the old KPI goes away and to use the
new one we need the pointer.

Differential Revision:  https://reviews.freebsd.org/D54077

linux: fix panic on kldunload

The vnet_deregister_sysuninit() that is called by linker unload sequence also
calls every registered destructor before unregistering it.  IMHO, this is
not correct in principle, but for now plug the regression right in the code
that introduced the panic.

Fixes:  https://cgit.freebsd.org/src/commit/?id=607f11055d2d421770963162a4d9a99cdd136152

linux: fix unr(9) leak on module unload

Suggested by:   jhb
Fixes:          https://cgit.freebsd.org/src/commit/?id=607f11055d2d421770963162a4d9a99cdd136152

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D53963

If the fs->m page was found invalid on the object queue, PG_ZERO flag is
stale.  Track the source of the page in the new fault state variable
m_needs_zero, and ignore PG_ZERO if the page did not came from the
allocator.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D53963

Unlike in C23 where it's a typedef, char8_t is a built in type in
C++20.  Recognise it as such.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291449
Reported by:    Tomoaki AOKI <junchoon@dec.sakura.ne.jp>
Approved by:    markj (mentor)
Reviewed by:    imp
Fixes:          https://cgit.freebsd.org/src/commit/?id=f0e541118c374869a8226eaa1320bb6eda248a20
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54124

Use TAILQ_HEAD_INITIALIZER and MTX_SYSINIT to remove the 'once' code
from rman_init.

Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D54142

This used a separate allocation when rman was first imported (back
when the lock was a pre-SMPng "simplelock" instead of a mutex).

Reported by:    des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D54143

This is a preparation step for a future addition to this file. This is
also closer to what Linux does.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation

The wrapper functions such as bus_alloc_resource_any() still support
passing the rid by value or pointer, but the underlying implementation
now passes by value.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D53402

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53403

Reviewed by:  imp
Differential Revision:  https://reviews.freebsd.org/D53404

- change the state to SPLICE_EXCEPTION to allow so_unsplice() to work
  to cleanup failed splices (fixes socket reference leak)
- NULL out sp->dst when unsplicing from so_splice() before so2 has been
   been referenced.
- Deal with a null sp->dst / so2 in so_unsplice
- Fix asserts that talked about sp->state == SPLICE_INIT; that state
  is not possible here.

Differential Revision: https://reviews.freebsd.org/D54157
Reviewed by: markj
Sponsored by: Netflix
Fixes: https://cgit.freebsd.org/src/commit/?id=c0c5d01e5374 ("so_splice: Synchronize so_unsplice() with so_splice()")
MFC after: 3 days

Define _ALIGNBYTES using sizeof(void *) (no functional change on any
existing architecture) which will allow it to work with CHERI were we
must align things up to capability alignment.

In _ALIGN, replace integer manipulation which does not preserve pointer
provenance with a type and provenance preserving builtin.  This requires
modest changes in code which assumes _ALIGN returns an integer, but
those are relatively rare.

Reviewed by:    kib, markj
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D53947

This removes an extraneous pctrie_iter_reset before returning.
This is not needed as it simply clears a local variable that
will get cleaned up anyway as we immediately return from the
function.

MFC after:      1 week
Sponsored by:   NVIDIA
Reviewed by:    alc
Differential Revision:  https://reviews.freebsd.org/D54153

Decode the descriptors we put into devd.

Sponsored by:           Netflix

A more efficient way to include multiple bits of data in a sense
decriptor was defined in SBC4 in 2020. Decode and print it.

Sponsored by:           Netflix

The functional change here is that *sent would be zeroed.  Note that some
portable applications, e.g. OpenSSL, use a wrapper around our sendfile(2)
to make it more Linux-like.  These wrappers are usually written in a
manner that expects *sbytes to always be initialized regardless of the
error code returned.

Only attach CAM to the nvme storage devices.

Sponsored by:           Netflix

For consistency rename the "scheduled_txqs" tailq to
"txq_scheduled" and add a lock per txq ("txq_scheduled_lock[]").
We use the "_bh" locking as this called from the device driver.

This fixes panics due to concurrent access to the tailq, especially
in between "first" and "remove" on the out-direction and between
"insert" and "elem_init" on the in-direction.

This was easily reproducible just running iperf3 at basic rates for
a few seconds to minutes with multiple chipsets, not only rtw89.

Sponsored by:   The FreeBSD Foundation
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290636
Reported by:    arved, and others before
MFC after:      3 days

All known software in ports had been addressed three years ago and the
shim stays in stable/14 and stable/15 for another couple years with its
printf(), so all ourliers are expected to conform before 16.0-RELEASE.
See 8624f4347e8133911b0554e816f6bedb56dc5fb3 for details.

The expectation that the allocation will be aligned to the kstack size
only applies when allocating from a kstack arena, not when allocating a
non-standard size from the kernel arena.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Fixes:          https://cgit.freebsd.org/src/commit/?id=7a79d0669761 ("vm: improve kstack_object pindex calculation to avoid pindex holes")
Reviewed by:    bnovkov, siderop1_netapp.com
Differential Revision:  https://reviews.freebsd.org/D54171

The device tree include file for TI TPS65* is in a
relative path to the source for example:
device-tree/src/arm/ti/omap/am335x-bone-common.dtsi#n305
device-tree/src/arm/rockchip/rk3066a-marsboard.dts#n183

This patch gets the dts path and adds that as an include path
for the device tree compiler.

Approved by: manu (mentor)
Differential revision: https://reviews.freebsd.org/D53887

Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1920

Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1920

IMX51 is already EOL and IMX53 is going to be EOL in Feb 2026.
See NXP product longevity site

Remove
Digi ConnectCore Wi-i.MX53
Genesi Efika MX
FreeBSD own DTSI for imx51 and imx53
sys/modules/dtb/imx5 for i.MX53 quick start board.

Approved by: manu (mentor)
Differential revision: https://reviews.freebsd.org/D53888

cam: Reduce overly long timeout values for initial device probing

Currently, we have very long timeouts for the initial probing
commands. However, these are not appropriate for modern (post 2010) SCSI
disks. Sandards since SPC3 state that these commands should not wait for
media access. Since we retry them several times during the initial bus
scan, these delays can delay the boot by minutes (5 minutes per errant
disk in our expereince). These delays don't help and only hurt, so
reduce the TESTUNITREADY, INQUIRY and MODESENSE commands (during the
initial probe). Provide sysctl/tuneables to change the time for these
and also the REPORTLUNS commands for people that might need to adjust
them for devices that violate this belief but none-the-less work with
longer timeouts.
        kern.cam.tur_timeout            (default was 60s, now 1s)
        kern.cam.inquiry_timeout        (default was 60s, now 1s)
        kern.cam.reportluns_timeout     (default is 60s)
        kern.cam.modesense_timeout      (default was 60s, now 1s)
This can be partially merged: the sysctls can, but the new defaults likely
shouldn't.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D52427

cam: Also reduce timeout for wlun probing

wlun probing was added after my initial work on this and was overlooked
in merging forward. Add the timeout here too, for the same reasons as
for REPORT LUNS. This doesn't change the default.

Fixes: https://cgit.freebsd.org/src/commit/?id=8ac7a3801c6a cam: Reduce overly long timeout values for initial device probing
Sponsored by:           Netflix
Reviewed by:            jaeyoon
Differential Revision:  https://reviews.freebsd.org/D54184

getwritevnode->getlowvnode

Reviewed by:    kib, olce
Tested by:      pho
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D53988

This function returns the vnode that will be used to resolve the
access type specified in the 'flags' argument, and is useful for
optimal behavior of vn_copy_file_range(). While most filesystems
can simply use the default implementation which returns the passed-
in vnode, unionfs (like nullfs) ideally should resolve the access
request to whichever base layer vnode will be used for the I/O.

For unionfs, write accesses must be resolved through the upper vnode,
while read accesses will be resolved through the upper vnode if
present or the lower vnode otherwise.  Provide a simple
unionfs_getlowvnode() implementation that reflects this policy.

Reviewed by:    kib, olce
Tested by:      pho
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D53988

Remove SPIGEN device tree overlay used with rpi-b (BCM2835/armv6)

Approved by: manu (mentor)
Differential revision: https://reviews.freebsd.org/D54188

Currently, we unconditionally zero the fsid before returning a struct
statfs to a jailed process.  Move this into prison_enforce_statfs() so
it only happens if enforce_statfs is greater than 1, or enforce_statfs
is 1 but the mountpoint is outside the jail.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291301
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54214

* Move the initialization of p_ktr into proc_init() and make the check
  in proc_dtor() unconditional.  Prior to this, it was possible to fail
  and invoke proc_dtor() after the first thread had been created (which
  was the condition for checking p_ktr in proc_dtor()) but before p_ktr
  had been initialized.

* Move the p_klist initialization in fork1() past the last possible
  failure point so we don't have to free it on failure.  We didn't,
  which meant we were leaking a knlist every time we failed to fork
  due to hitting the resource limit.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291470
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D54215

Reported by:  des
Fixes:          https://cgit.freebsd.org/src/commit/?id=0a68f644dca1 ("socket: Split up soreceive_generic()")
MFC after:      1 week

(*prepare_multicast)(), for the drivers we support, is iwlwifi(4)-specific.
If it is not available do not let us stop from calling (*configure_filter)()
at least as well.
In addition to the interface setting mc_all_multi, if we have no way to
prepare the multicast filter list this way, set FIF_ALLMULTI for now.
This seems to help some with rtw89 but does not help me with other drivers
yet to get IPv6 link-local (e.g., ff02::1%wlan0) going.
This should also help in case we are scanning and are setting
FIF_BCN_PRBRESP_PROMISC .  We should go and review the full FIF_ list and
start adding conditional support for the other options too.

Sponsored by:   The FreeBSD Foundation
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281982
MFC after:      3 days

Link zfsd against spl and pthread

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54066

Sponsored by: Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D53764

Reviewed by:  brooks, imp
Differential Revision:  https://reviews.freebsd.org/D54147

Update to the latest makefiles etc from bmake.
Mostly this just replaces sjg license with an SPDX tag.

There are also some improvements to meta2deps* and optimizations
to leverage POSIX shell features in some target scripts.
Default isPOSIX_SHELL to ':' in sys.mk to enable these.

Use :sh1 in M_type if possible.

bsd.progs.mk has diverged too much to touch beyond making the
SPDX tag update.

Reviewed by:    stevek
Differential Revision:  https://reviews.freebsd.org/D54150

Add a BUGS subsection about why, in the vain hope that somebody
improves the situation.

Although these line up when prefixed with "# ", once the comment prefix
is deleted they no longer do. Add an extra tab to each to compensate,
just like "Obtained from:".

libc/tests/string: improve stpncpy() "bounds" unit test

The test is extended the same way I previously extended the memccpy()
test to fix what is probably the same kind of bug.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291359
Reported by:    Collin Funk <collin.funk1@gmail.com>
Reviewed by:    ngie
Approved by:    markj (mentor)
Fixes:          https://cgit.freebsd.org/src/commit/?id=6fa9e7d8737548ef93c573387ce62402c368d486 (https://cgit.freebsd.org/src/commit/?id=D42519)
See also:       61ed5748e4e9c7397fcb2638b442f46ac5c9e7c5 (D46051)
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54169

lib/libc/tests/string/stpncpy_test.c: apply ngie's fixes

libc/test: fix typo

I misapplied ngie's recommended correction.

Fixes:  https://cgit.freebsd.org/src/commit/?id=123c086200491819595abc271d360e605288fd18
Differential Revision:  https://reviews.freebsd.org/D54169

MFC after:    3 days
Signed-off-by:  Seth Hoffert <seth.hoffert@gmail.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/1919

MFC after:    1 day

- s/reseting/resetting/

MFC after:      5 days

- s/reseting/resetting/

MFC after:      5 days

- s/depricated/deprecated/

MFC after:      3 days

- s/backet/bucket/

MFC after:      3 days

- s/depricated/deprecated/

MFC after:      3 days

Manually apply a typo fix.  This change has already been submitted
upstream as bin/59824.

MFC after:      1 week

It is now provided by regular string.h.  While there, remove stale
$FreeBSD$ svn tag, and add include guards.

Sponsored by:   NVidia networking
MFC after:      1 week

Sponsored by: NVidia networking
MFC after:      1 week

Changes: https://github.com/eggert/tz/blob/2025c/NEWS

MFC after:      3 days

Merge commit 'f600477feb4ae61a75f61949eb600caff4aeea8c'

MFC after:      1 week
Discussed with: brooks

Manually import latest mtree test suite from NetBSD.

MFC after:      1 week

  FreeBSD: Fix a potential null dereference in zfs_freebsd_fsync()

  In general it's possible for a vnode to not have an associated VM
  object.  This happens in particular with named pipes, which have
  some distinct VOPs, defined in zfs_fifoops.  Thus, this chunk of
  zfs_freebsd_fsync() needs to check for the FIFO case, like other
  vm_object_mightbedirty() callers do.

  (Note that vn_flush_cached_data() calls are predicated on
  zn_has_cached_data() returning true, and it checks for a NULL v_object
  pointer already.)

  Fixes: ef4058fcdc01838117dd93a654228bac7487a37c
  Reported-by: Collin Funk <collin.funk1@gmail.com>
  Reviewed-by: Sean Eric Fagan <sef@FreeBSD.org>
  Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
  Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com>
  Signed-off-by: Mark Johnston <markj@FreeBSD.org>
  Closes #18015

MFC after:      3 days

This patch was based on an incorrect assumption that the linear buffer
chain for an snl_writer only contained the netlink message body.

This reverts commit 828df4d36d9d5a6ca0dcc294d65572b4a0474142.

Sponsored by:   AFRL, DARPA