FreeBSD git weekly: 2026-07-06 to 2026-07-12

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

* Modernize the markup

* Describe the comment syntax

* Drop obsolete advice

* Capitalize sentences

* Improve the language

* Replace no_tld_query with no-tld-query; both are supported, but all the
  other multi-word options use hyphens rather than underscores.

* Add missing ENVIRONMENT section

* Redo the example

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57921

MFC after:    1 week

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Also do not start a new list for each flag item.

Reviewed by:    markj
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential revision:  https://reviews.freebsd.org/D57124

Submitted by: des
MFC after:      1 week

Submitted by: des
MFC after:      1 week

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Commit 74654ba3b1b3 added and new chflags(1) flag called
"udontcache" or "dontcache".  This patch documents this flag.

This is a content change.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58181

Use kn->kn_sdata to track the last bs->total value for each knote
attached to an mmaped channel. An event is delivered only when the total
byte counter has advanced by at least c->lw since the last delivery.
After delivery kn_sdata is updated to the current total.

Each knote tracks its own watermark independently, so multiple knotes
attached to the same mmaped channel all receive events correctly.

Non-mmap channels keep the existing level-triggered behavior via
chn_polltrigger().

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D57833

arm64/vmm: Add FEAT_NV2 definitions

Add the definitions for the VNCR_EL2 register and all of the offsets
to registers in memory relative to the page stored in VNCR_EL2.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56550

arm64/vmm: Use the VNCR_EL2 memory page to store guest registers

Wherever possible, move the storage space for guest register values from
the hypctx struct into a preallocated memory page matching the layout of
the page pointed to by VNCR_EL2.
This will streamline implementing support for nested virtualization, but
the implementation itself is not reliant on the presence of nested
virtualization architecture features.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56551

arm64/vmm: Store non-VNCR registers in an array

Move non-VNCR EL0 and EL1 registers into a dedicated array inside of
hypctx. This enables uniform accesses to both VNCR and non-VNCR guest
register state through hypctx_[read|write]_sys_reg().

The accessors are _not_ used for non-VNCR EL2 registers in order to
create a clear separation between guest-visible and guest-invisible
register state.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56552

arm64/vmm: Refactor vmm_hyp.c

Refactor vmm_hyp.c to split register reload logic by type of register,
streamline the implementation and improve readability.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56553

arm64/vmm: Move vttbr_el2 & vtimer into struct hypctx

Move vttbr_el2 & vtimer from struct hyp into struct hypctx to streamline
the logic and handle them in the same way as other *_el2 registers are
already being handled.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56554

arm64/vmm: Move host-side EL2 regs into sys_regs

Move EL2 host registers that are not visible to the guest into
hypctx->sys_regs. Prefix them with HOST_ to distinguish from EL2
registers which are part of the guest's own state (e.g. in VNCR).

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56555

arm64/vmm: Make remaining registers use hypctx_*_sys_reg

Move vgic, timer and trapframe registers into sys_regs to handle them
in the same way as all the other registers.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56556

Fix tid_set_busy() for when `pmap` is NULL. Obviously a NULL pointer
cannot be correctly used, so I'm not sure how it worked in testing on
64-bit.

When the TID rolls over on a given CPU, simply flash-invalidate the
TLB instead of walking the TLB to only invalidate the repurposed TID.
Walking 256 entries is expensive, and we'll likely be inserting a bunch
new ones anyway in the new environment, since 256 really only handles
1MB of storage, so the likelihood of other mappings continuing to exist
in the TLB when their thread owner is scheduled again is very very
small.

DEVX event notifier returned true for the command-completion and
page-request events. This is causing mlx5_eq_int() to skip the core EQ
handler, so the firmware command interface and the page supply stop
being serviced and the device wedges.

This commit also make notifier registration and dispatch safe against
the EQ interrupt running concurrently: publish the table pointer before
the callback and load it with acquire semantics. run the callback under
RCU, and drain it with synchronize_rcu() on teardown. Otherwise the
interrupt handler could observe a half-initialized notifier or race with
cleanup.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commits a8b92ca1b0e5ce620e425e9d2f89ce44f1a82a82
and c59450c463695a016e823175bac421cff219935d.

The DEVX object and method definitions were already present, but nothing
pointed ib_device.driver_def at them.  ibcore therefore never merged
them into the uverbs uapi tree and every DEVX ioctl came back as
EPROTONOSUPPORT.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 342ee59de98a2ecdf15a46849a2534e7c808eb1f.

The dynamic UAR object was declared in the ABI headers but had no handler,
so the ioctl was rejected and dynamic-UAR contexts could not allocate a
doorbell UAR at all.

Implement the alloc and destroy methods following the upstream driver:
grab a UAR stamped with the caller's DEVX uid, expose it to user space
through an rdma_user_mmap entry (write-combining or non-cached as
requested), and free it on destroy.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

A firmware object owned by a DEVX uid may only reference resources owned
by the same uid or ones explicitly marked as shared.  Completion EQs
were created with uid 0, so a CQ owned by a DEVX uid could not attach to
its EQ and CREATE_CQ failed with "bad resource".

Create completion EQs with MLX5_SHARED_RESOURCE_UID on devices that
support user contexts, so uid-owned CQs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: allocate IB queue counters as a shared resource

A QP owned by a DEVX uid references the port's queue counter.  The
counter was allocated with uid 0, so RST2INIT_QP on a uid-owned QP
failed with "bad resource state".

Allocate and free the IB queue counters directly and, on devices that
support user contexts, stamp them with MLX5_SHARED_RESOURCE_UID so
uid-owned QPs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: encode dynamic UAR mmap offsets in the reserved command range

The UAR ioctl handed user space a raw mmap offset, so the first dynamic
UAR landed at page offset 0.  mlx5_ib_mmap() decodes offset 0 as the
legacy regular-page command and routed the mapping through the old bfreg
path, which rejects dynamic-UAR contexts, so mmap() failed with EINVAL
and mlx5dv_devx_alloc_uar() returned NULL.

Follow the upstream scheme: reserve the mmap command range [9, 255] for
rdma_user_mmap entries and return command-encoded offsets, so the
dynamic-UAR mappings decode to the intended mlx5_ib_mmap() path.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: advertise write-combining support for dynamic BlueFlame UARs

Import Linux upstream commit 1f3db161881b7e21efb149e0ae8152b79a571a8f.

dev->wc_support was never set, so it was always false and the UAR ioctl
refused BlueFlame (write-combining) UAR allocations with EOPNOTSUPP.
That breaks QP creation in pure dynamic-UAR mode, where user space asks
for a BF doorbell UAR.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: pass the full EQE to the DEVX event notifier

The DEVX event notifier and its helpers expect a full struct mlx5_eqe
and read eqe->data from it, but mlx5_eq_int() passed &eqe->data, so the
data offset was applied twice.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: guard against a NULL CQ event handler in mlx5_cq_event()

DEVX and mlx5en created CQs are registered without an asynchronous
event handler (mcq.event is NULL).  An asynchronous CQ_ERROR event for
such a CQ made mlx5_cq_event() call through a NULL pointer and panic.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: propagate the DEVX uid through SRQ create and destroy

The SRQ command builders never stamped the owning DEVX uid into the
firmware CREATE_SRQ/CREATE_RMP/CREATE_XRC_SRQ commands, so a basic SRQ
was always created with uid 0.  Every modern libmlx5 context runs with a
DEVX uid, and the QPs that reference the SRQ carry that uid, so firmware
rejected CREATE_QP with "bad resource": a uid-owned QP may not reference
a uid-0 SRQ.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

The thermal interrupt is initially masked.

Thermal interrupt handling is enabled by calling lapic_enable_thermal(),
which installs a (single) handler.

[olce: Wrote the commit message.]

Reviewed by:    kib, olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D44454

acpi: Add a pseudo-bus for APEI devices to manage resources

Different APEI tables can reuse the same registers (and sometimes
different views of the same register, e.g. 32- vs 64-bit mappings of
the same register).  To enable this sharing, apei0 now acts as a bus
device managing a pool of allocated resources and handing out mappings
to child devices which handle individual tables.

Most of the previous apei(4) driver has been moved into a new
hest0 device that is a child of apei0.

Reviewed by:    gallatin
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58024

acpi: fix instant panic in hest_attach()

Since now there is a pseudo-bus between our device and acpi0, we need to
go deeper.

Fixes:  https://cgit.freebsd.org/src/commit/?id=9313f6b01485ad9a0b7cc59b459f5714533587c3

Fixed the post-LPS delay from 500us to the IEEE 1394a-2000 s6.1 mandated
10ms ceiling. Handled PHY_INT by clearing W1C status bits in register 5
(masked ISBR to avoid spurious bus resets). Added a SID timeout callout
that recovers the state machine when a remote device fails to complete
self-ID. Fixed FW_PHY_SPD operator precedence and gated noisy messages
behind bootverbose/firewire_debug.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58033

fwcam: add dynamic resolution and frame rate support

Read V_MODE_INQ and V_RATE_INQ registers for all supported formats
during probe, caching the camera's actual capabilities.  Use these
to validate SMODE ioctl requests before writing to the camera.

Writing an unsupported combination caused the camera to
stop responding, requiring a physical power cycle.

Tested with: Apple iSight (external FireWire)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58090

fwcam: set ISO speed from device link speed

iso_speed was never initialized, defaulting to S100 regardless of the
camera's actual link speed. Some cameras firmwares reject ISO_EN
when the speed field in the ISO_CHANNEL register
does not match their capabilities.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58091

fwcam: write video mode registers before enabling ISO streaming

The IIDC spec (s3.1) requires the video mode to be programmed before ISO
enable. Without this, cameras that power up with invalid default
mode/rate combinations reject the ISO_EN write.

This can happen when the firmware of teh camera is outdated or
vendor never updated it.

Differential Revision:  https://reviews.freebsd.org/D58092

Sponsored by; The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Moved ISO start to first usage. Opening the device now
only validates state and increments the open count, allowing info
queries and mode changes without starting the camera. ISO streaming
begins on demand when userland first reads frame data.
This avoid the camera led to turn-on at attach.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58100

Some IIDC cameras power down the sensor when inactive (e.g. lens
cover closed) and reject ISO enable with EIO. Re-power the camera
and retry once before failing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58101

MFC after:    1 week
Sponsored by:   The FreeBSD Foundation

USB vendor:product 184f:0051

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56794

This can't be a loadable module, so add it to MINIMAL

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58067

This makes the code slightly more compact and easier to read.

No functional change intended.

Reviewed by:    bnovkov
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58110

The thermal LVT slot does not necessarily exist.

According to Intel's Software Developers Manual, for Intel processors
supporting 64-bit operation (amd64), probably even the earliest ones
should have a local APIC with such a slot (the slot was introduced with
Pentium 4 and Xeon processors according to the manual, and the 64-bit
implementation in some later versions of them).  AMD's Architecture
Programmer's Manual also seems to imply that all AMD processors
supporting amd64 should have the slot too.  So this change may not be
needed when i386's code is dropped, but it does not hurt to have it, and
it might ease possible MFCs.

Change the signature of lapic_enable_thermal() so that it can report
failure (if there is no local APIC or if there is no thermal LVT slot).

Reviewed by:    bnovkov, kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58086

Differential Revision:        https://reviews.freebsd.org/D56923
Reviewed by:    mhorne

This change implements the equivalent of the amd64-specific
'show pte' ddb command used to dump the page table entries
associated with a specific virtual address.

Differential Revision:  https://reviews.freebsd.org/D56924
Reviewed by:    mhorne

Spurious page faults caused by cached invalid entries may occur when
starting APs and potentially panic the kernel if we're running in
a non-sleepable context.

Fix this avoidable panic by flushing the TLB after the AP is released.

Differential Revision:  https://reviews.freebsd.org/D57003
Reviewed by:    markj

The Privileged ISA specification permits caching of invalid PTEs
12.2.1. Supervisor Memory-Management Fence Instruction), which may
result in a spurious page fault. Such faults are handled by 'pmap_fault'
which locks the kernel pmap before inspecting and possibly updating the
offending L2 entry.
Unfortunately, spurious faults may also occur when we're already holding
the kernel_pmap lock or running in a critical section, where any attempt
to grab the pmap lock will result in a kernel panic.

Fix this avoidable panic by performing a lockless lookup to determine
whether a valid kernel mapping exits and flushing appropriate TLB entry.

Differential Revision:  https://reviews.freebsd.org/D56925
Reviewed by:    jrtc27, mhorne, markj

Using cpu_get_pcpuid() directly or having a CPU ID cache does not really
make any significant difference.  With cache: Less function calls, less
space on stack, but an additional allocation in the softc, who stays
permanently.  Without cache: Some function calls, but one less slot in
the softc, and no data duplication (but that info never changes).

The main reason for this change is to reduce conflicts with some
work-in-progress by aokblast@.

While here, move the check that a per-CPU structure is provided by the
bus from the attach to the probe method, as it is already used by
hwpstate_probe_pstate() there.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

To minimize the diff with hwpstate_intel(4).  See previous commit there
for the rationale.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

KVM does not always use 0x40000000 as its CPUID base. For example, QEMU
adds a 0x100 offset when nested virtualization is detected and the host
exposes Hyper-V enlightenment hints. To accommodate this behavior,
switch the detection logic to use the CPUID leaf returned by do_cpuid(),
making the implementation more flexible.

See:
https://github.com/qemu/qemu/blob/master/target/i386/kvm/kvm.c#L2300

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58146

Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
triggering SSP when ntpd set the time on the RockPro64, at the very
least.  A minor oops meant that the weeks mask was getting tossed into
the wrong field, and the mask was never populated.  The mask is 0x7 for
all three of these, thus overflowing the `data` array in settime by one
byte.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296719
Reported by:    jsm, "Tenkawa" on Discord
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D58182

Using if_getflags() to check IFF_DRV_RUNNING is wrong;
if_getdrvflags() is required.  This issue resulted in the
multicast filter not being updated.

This was an oversight by me in my initial port.

Thanks to danilo@ for reporting it and Oleg <oleglelchuk@gmail.com>
for the fix.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295176

Currently, devd emits events for external adapters only.

Send Netgraph init/disconnect events to devd so the internal adapter's
state could be asserted from userland.

(adrian - indentation changes.)

Signed-off-by: Kirill Orlov (-k) <slowdive@me.com>
Reviewed-by: adrian, imp
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2196

Matches tcpdump naming, but without getting more intense as you add more
-t.  This slightly reduces the post-processing needed on usbdump output
to diff two transactions.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58196

Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.

Reviewed by:    markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D54175

Revert pf_nl.h part of 017690e50913 and use new libsysdecode build glue
that parses enums.

Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D57866

The historical design of sockets is that on a re-connect the disconnect is
performed at the socket layer in soconnectat().  Since SMP times this is
known to be racy and the function has appopriate comment.  I missed that
in the recent change.  The pr_connect method should normally expect the
socket to be already disconnected, however should be able to handle a race
where socket is actually connected.  Convert the check that incorrectly
tried to handle normal path of re-connect into check that handles the
race.

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ece716c5d34728a170f1dfe1b3389c267d6ddd1e

The ```int disable``` parameter is included in the bridge_stop function
signature but is not used in the function body.

I had noticed this when tracing the driver's path while learning more
about the ifnet library.

This parameter originally appeared when importing the driver from NetBSD.
However, the FreeBSD ifnet library no longer requires an if_stop function.
Meaning that the function signature can be changed to only contain needed
parameters for our bridge driver.

Discussed with: freebsd-net@ mailing list
Signed-off-by:  Acesp25 <acesp25@freebsd.org>
Reviewed by:    kp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2290

A mistake from 90ea8e89d9b7 is that in6_pcblookup_internal() was skipped
for an inpcb that had unspecified local address.  This is incorrect, as
such inpcb could have already have a port set, and in_pcb_lport_dest()
shall not be called on such inpcb.  That could lead to creation of an
alised connection in the database.

This makes the function almost identical to in_pcbconnect().  While here,
fix minor bug of missing INP_ANONPORT.  This flag has no use in kernel,
but affects netstat(1) output in certain mode.

Fixes:  https://cgit.freebsd.org/src/commit/?id=90ea8e89d9b751e8b5ae90ef3397883b035788e5
Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D57987

And make net.inet.ip.portrange.randomized boolean.

Reviewed by:            pouria, tuexen, markj
Differential Revision:  https://reviews.freebsd.org/D57291

Enable IFCAP_MEXTPG by default, which may bring performance benefits.
Allow it to be disabled, and when disabled assert that we do not receive
any mbufs with M_EXTPG set. This is useful for testing.
Default the tests to disabling MEXTPG support.

Reviewed by:    zlei
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58054

The network layer must not pass unmapped (M_EXTPG) mbufs to if_output()
of network interfaces without IFCAP_MEXTPG. pf should convert these
mbufs by mb_unmapped_to_ext() for such interfaces but it didn't.
The problem had occurred on sendfile because sendfile system call
uses unmapped mbufs for the file data.

Reported by:    feld
Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D58021

Some nic drivers (including iflib) do not initialize if_hwassist
until after the interface is brought up.  If a lagg member is included
in a lagg when its not yet been brought up, that will cause lagg to see
if_hwassist=0 and will disable all checksum offload, etc, on the interface.
This is almost impossible to debug without kgdb or dtrace, as ifconfig does
not surface if_hwassist.

Fix this by re-calculating lagg caps (including if_hwassist) after adding a port.

I encountered this problem when I had a commented-out if_foo1=up entry in
my rc.conf that i neglected to uncomment when I was re-configuring a lagg.

Sponsored by: Netflix
Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D58062

RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero
octets, then the 20-octet IPoIB link-layer address.
The ND code assumed the Ethernet layout (RFC 4861, section 4.6.1)
everywhere and read/wrote the address directly after the option
header, i.e. two octets early.
The option-length sanity check computes 24 for both layouts for
a 20-octet address, so the mismatch was silent.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296585
Reviewed by:    adrian, pouria
Sponsored by:   VersatusHPC
Differential Revision: https://reviews.freebsd.org/D58096

From openssh-portable commit c14709356563.

Reported by:    cy

Fixes:        https://cgit.freebsd.org/src/commit/?id=e7d02be19d40063783d6b8f1ff2bc4c7170fd434
Signed-off-by:  Yusuke Ichiki <public@yusuke.pub>

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295434

Update nexthop flags with interface link status events and
instead of checking link status of interface for every packet
only check the reachability flag of the final nexthop.

Reviewed by:    glebius
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D57375

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

This tool supports two commands.  The list command outputs a summary
of injectable errors supported by the current system.  The inject
command injects the requested error.

Reviewed by:    gallatin, imp
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58026

LOG_CONS was OR'd into the facility argument instead of logopt, leaving
logopt as 0.  The correct call is openlog(ident, LOG_CONS, LOG_AUTH),
as shutdown(8) and init(8) already do.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296315
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, des
Pull Request: https://github.com/freebsd/freebsd-src/pull/2300

By default bhyve(8) creates a snapshot socket in
"/var/run/bhyve/" (BHYVE_RUN_DIR).
As this is a system directory not writable by users,
this does not work when bhyve(8) is being started
as a non-root user.

Address that by allowing to override this directory.
In bhyve(8) it is done by setting 'rundir' option
with '-o rundir=<path>'.

In bhyvectl(8) it is done with '--rundir=<path>'.

MFC after:              1 month
Reviewed by:            bcr (manpages), bnovkov
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57494

The download protocol calls download_data with FileOffset and
BufferLength of 0 first to start the download (no data yet
available). Calls it again with BufferLength == 0 and FileOffset the
size of the download (again, no data). It then starts calling with
BufferLength != 0 and FileOffset == 0 to start the download. The
heuristic I used to detect the start was wrong, so we'd allocate the
buffer twice. Fix that by being more explicit and not using the
heuristic that was bogus.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58068

The end address is the final byte in the array, not one byte past the
end of the array, so we need to add 1 to get the full length.

Fixes: https://cgit.freebsd.org/src/commit/?id=59219fc76a4b ("loader.efi: efiblk_memdisk_preload passes the VirtualDisks to FreeBSD")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58069

This code is simpler when we spell it the Unix way. Also, add sanity
checks to make sure the offset is where we think it is.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58070

kldxref -m <file> will print the same data that the '-d' flag produces,
except restrict the output to one file. This should be the full path to
the file, and the directory name to process is omitted.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D57902

Reviewed by:  jfree, kib
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D58160

loader: Add xzfs, like gzipfs but with xz.

This is just like gzipfs or bzipfs, except done with the newer xz
program. This is off by default for the moment.

Sponsored by:           Netflix

loader: zstd based filesystem, zstdfs like gzipfs

Off by default.

Sponsored by:           Netflix

loader: Add forgotten xz.c and zstdfs.c

These were overlooked when I added compression support.

Fixes: https://cgit.freebsd.org/src/commit/?id=86d719ae68aa ("loader: Add xzfs, like gzipfs but with xz.")
Fixes: https://cgit.freebsd.org/src/commit/?id=c61ee49cd06a ("loader: zstd based filesystem, zstdfs like gzipfs")
Sponsored by:           Netflix

zonectl's Report Zones subcommand displays a tabular list of zones.  A
conventional zone's WP column is displayed as 0xffffffffffffffff , the
literal value that the HDD reports.  But that's too wide for the column,
causing the text to be misaligned.  It's also not really meaningful,
because the Write Pointer isn't really defined for a Conventional zone.
Change it to "-1" to fix the text misalignment.

MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    fuz
Differential Revision: https://reviews.freebsd.org/D57512

libc/resolv: Drop Solaris 2 compatibility

MFC after:      1 week
Reviewed by:    kevans, markj
Differential Revision:  https://reviews.freebsd.org/D57922

libc/resolv: Refactor the option parser

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

libc/resolv: Refactor the configuration parser

This was previously all a single loop in res_init(), apart from option
parsing which we cleaned up in a previous commit.  Break it out into
separate functions for reading the configuration line by line, setting
the default domain, setting the search list, and adding a nameserver
to the nameserver list.  Sprinkle bounds checks and code comments all
around.

The sortlist code, which has been disabled for the past 20 years, will
be dealt with in a separate commit.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57924

libc/resolv: Reimplement the sortlist parser

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

libc/resolv: Add no-debug and no-rotate options

These are simply the reverse of the debug and rotate options.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57926

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57927

getfacl / acl_to_text() incorrectly prints uid/gid numbers as signed integers.
This causes uid / gid numbers larger than 2G (2147483648) to print as
negative numbers.
The libc acl_from_text() function does not handle negative numbers.
This diff adds a backwards compatiblity fix to allow negative numbers...

Reviewed by:    rmacklem
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57180

While here, clean up and simplify the existing code.

MFC after:      1 week
Reviewed by:    glebius, jhb
Differential Revision:  https://reviews.freebsd.org/D57993

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Skip UFS2 fs_metaspace upper-bound validation that rejects NetBSD FFSv2
WAPBL filesystems due to differing superblock layouts.

Detect the condition during mount instead and permit read-only mounts
while rejecting read-write mounts with EROFS.  This follows NetBSD's
recommendation for systems without WAPBL support and avoids modifying
unsupported journal metadata.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296022
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, kirk
Pull Request: https://github.com/freebsd/freebsd-src/pull/2279

nfsd: Garbage collect stray NFSv4 state

When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.

This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.

While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.

Reported by:    Richard Purdie <richard.purdie@linuxfoundation.org>
Tested by:      Michael Halstead <mhalstead@linuxfoundation.org>
MFC after:      2 weeks

nfsd: Commit missing patches for c52bcd09c2a6

Oops, I missed the other files for the commit.

This should fix the build.

Pointy hat goes on me.

MFC after:      2 weeks
Fixes:  https://cgit.freebsd.org/src/commit/?id=c52bcd09c2a6 ("nfsd: Garbage collect stray NFSv4 state")

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

When a GID table entry is empty or not yet present in the cache,
show_port_gid() falls back to printing a zero GID.  Use the existing
GID_PRINT_FMT/GID_PRINT_ARGS helpers instead of Linux's %pI6 format,
which FreeBSD printf treats as a pointer followed by "I6".
This makes empty GID sysctl entries consistently report
0000:0000:0000:0000:0000:0000:0000:0000.

Tested by:      Wafa Hamzah <wafah@nvidia.com> (mlx5_ib)
Reviewed by:    jhb, kib
Sponsored by:   NVIDIA Networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential Revision:  https://reviews.freebsd.org/D58042

inotify: Unconditionally generate IN_IGNORED events for files/dirs

The implementation previously only generated an IN_IGNORED event for a
deleted watched file if the watch explicitly requested IN_DELETE_SELF.
This is not correct, IN_IGNORED should always be raised when the watched
subject is deleted.  Adjust the implementation of inotify_log_one()
accordingly.

This also fixes a problem where a deleted watched file's watch
would not be removed if IN_DELETE_SELF was not in the watch's event
mask, in which case the unlinked vnode would linger until the inotify
descriptor itself is closed.

Add a regression test.

Reported by:    jrtc27
Reviewed by:    jrtc27
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58050

inotify: Ensure that "allocfail" is initialized in inotify_log_one()

Fixes:  https://cgit.freebsd.org/src/commit/?id=b70997c8c75a ("inotify: Unconditionally generate IN_IGNORED events for files/dirs")

jaildesc_alloc() finishes initializing the file structure only after it
is made visible from the file descriptor table via finit().  In that
window, other threads could try to perform operations on the descriptor
and thus access an incompletely initialized jaildesc.

Defer the finit() call until locks are initialized.  While here,
simplify the error path for falloc_caps().

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58049

dtrace: Improve DOF section size validation

The loop which validates each DOF section assumes that the section
header is present, so the section size must be at least as large as the
header, otherwise a small OOB access is possible.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57975

dtrace: Fix DOF section bounds validation

We must ensure that each DOF section does not overlap with the DOF
header or section table.  Otherwise the relocations processed in the
second pass over sections can manipulate DOF metadata, leading to OOB
writes.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57976

dtrace: Improve DOF string table validation

The check for a nul terminator implicitly assumes that the section size
is positive.  Make the assumption explicit.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57977

dtrace: Fix DOF section-specific validation

The entry size of the probe section is assumed to be at least
sizeof(dof_probe_t) by the loop further below.

enoff_sec->dofs_entsize was not being validated at all.

When multiplying an index by a table entry size, make sure the
multiplication can't overflow.

Fix an off-by-one when validating the translated probe argument array.

Make sure that the probe argument argvs are valid string offsets
even if the argument count is zero.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57979

Fixes:                https://cgit.freebsd.org/src/commit/?id=2ec2ba7e232d ("vfs: Add VFS/syscall support for Solaris style extended attributes")
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    rmacklem, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58053

A test site determined that, for a Mellanox NIC which can handle
M_EXTPG mbufs, an improvement of 5-15% for read rate could be
achieved if the read reply was in M_EXTPG mbufs.

A patch that tried to determine if the outbound NIC supported
M_EXTPG mbufs (IFCAP_MEXTPG) did not pass review.
However, it does appear that this can be useful for NFS-over-RDMA.
(Which just happen to use NICs that do support M_EXTPG mbufs.)

As such, this patch enables them is xp_extpg is set to true,
which is never for now, but might be set true for RDMA or
when vfs.nfsd.enable_mextpg is set non-zero. (It is 0 by
default, so this is never enabled by default at this time.)

Tested by:      Greg Becker <becker.greg@att.net>
MFC after:      2 weeks

Check that the P_WEXIT flag is set.

Requested by:   markj
Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_alloc()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract pdtofdflags()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_destroy()

Reviewed byL    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Introduce pd_fpcount that counts the number of file references to the
procdesc.  Remove the PDF_CLOSED flag, now it is expressed as
pd_fpcount == 0.

Only send SIGKILL and clear pointers when we are closing the last file
referencing procdesc.

This should be nop until the next commit.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

This is backward ABI-compatible, because the only place in kernel that
uses the structure, namely the mlx5_ib_cq.c:mlx5_ib_create_cq()
function, copies in as much structure members as provided by userspace.

Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24.

rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for
every VMA it maps, but rdma_umap_close() never dropped it.  The entry
was therefore never freed and lingered in ucontext->mmap_xa, tripping
WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking
the firmware UAR on every context close.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Modern Linuxes don't use ethX for almost 15 years already, see [1] and
[2].  The translation logic has always been a source of bugs and PITA.
Switch default to not translate (long due!) and schedule removal of the
code for FreeBSD 17.

[1] https://systemd.io/PREDICTABLE_INTERFACE_NAMES/
[2] https://www.freedesktop.org/software/systemd/man/latest/systemd.net-naming-scheme.html

Reviewed by:            iwtcex_gmail.com, vvd, melifaro, dchagin
Differential Revision:  https://reviews.freebsd.org/D57852

sendfile: stop abusing kern_writev()

Provide convenient wrapper kern_filewrite() around fo_write().
Switch to use it in vn_sendfile().  This allows to avoid duplicate
fget() when we already have the reference to the file, which creates a
correctness race with the userspace.  Also td_retval[0] clearing hack
can be removed.

Reviewed by:    glebius, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58035

kern_filewrite(): unconditionally calculate cnt, it is used by callers

Reported by:    dhw, madpilot
Tested by:      dhw
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")

kern_writefile(): fix several regressions

sendfile(): for trailers uio, set uio_rw to UIO_WRITE instead of checking it
kern_filewrite(): remove unused argument offset
kern_writev(): the check should compare cnt against zero, not uio_resid

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Order them alphabetically.
Remove redundand sys/param.h.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

linux_sys_futex() does not copyin a timespec for the timeout if the
operation is LINUX_FUTEX_TRYLOCK_PI, presumably because it doesn't make
sense to specify a timeout for a try-lock operation.  However, this
means that we pass a userspace timespec pointer to
linux_umtx_abs_timeout_init().

Modify linux_futex_lock_pi() to not initialize the timeout if we're
try-locking.

Reviewed by:    kib, dchagin
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58061

This is a mask, so the new value should have taken the next bit to avoid
breaking a shell script that's interpreted by a binmisc-activated
interpreter.

Add a brief note that the new value is only used within the ELF
activator.

Fixes:  https://cgit.freebsd.org/src/commit/?id=389c124fecb0 ("imgact_elf.c indicate that interpreter [...]")
Reported by:    "polyduekes" on discord, madpilot
Reviewed by:    kib, sjg (both previous version)
Differential Revision:  https://reviews.freebsd.org/D58063

pm_runtime_resume_and_get is used by new versions of amdgpu, and began
use between Linux kernel version 6.12, and 6.14.

Reviewed by:    dumbbell
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57463

This catches up with 692b0ef1506ba which added CAPENABLED to
clock_nanosleep(). Curiously recent additions of the pdopenpid(2) and
pddupfd(2) were done before the cited commit, and that regen did not
included the change.

Sponsored by:   The FreeBSD Foundation

Reviewed by:  jfree
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58084

The taskqueue thread loop tries to avoid entering and exiting net epoch
read sections for every task.  This reduces the overhead of net epoch
integration, but the implementation wasn't bounding the length of the
read section, so a busy taskqueue thread could hold an epoch open for an
unbounded period.  This is easy to achieve with the epair task, for
instance.

Bound the number of tasks that we'll execute without observing the
global epoch, and provide a sysctl to control it.  Let the default bound
be eight.

Reviewed by:    glebius
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58031

This function is supposed to wait until all pending callbacks have been
executed.  This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.

The implementation schedules a callback on each CPU and waits for them
all to run.  This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed.  This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.

Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order.  However,
ck_epoch_poll_deferred() may determine that it is safe to execute
callbacks from epoch - 1 (or even from the current epoch if there are
no active readers), and in this case it will push those callbacks onto
the returned stack.  This means that epoch_call_task() will invoke those
newer destructors before the older ones, which means that
epoch_drain_callbacks() may return early.

Fix the correctness problem by simply doing all of this twice: once the
first callback is invoked, we know that all of the callbacks that were
pending at the time that epoch_drain_callbacks() was called are
scheduled to be executed, so when the second callback is executed we
know that they must be finished.  This is slow, but it is already slow,
and the slowness is less noticeable after commit dce56594991.

I note that in an ideal world, this function would not exist, and all of
the teardown would happen asynchronously, rather than the current
mismash of synchronous and asynchronous cleanup.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290201
Reviewed by:    glebius
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58030

The former is called by the latter. We return NULL because linuxkpi does
not implement ACPI (pseudo?) devices associated to regular devices.

The amdgpu DRM driver started to use `ACPI_COMPANION()` in Linux 6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57577

It takes a task state as its last argument. We enforce that this state
is `TASK_UNINTERRUPTIBLE` for the time being because other states are
not interpreted.

Change `usleep_range()` to call `usleep_range_state()` with the state
set to `TASK_UNINTERRUPTIBLE`, which is what Linux does too.

The amdgpu DRM driver starte to use `usleep_range_state()` in Linux
6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57579

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58147

Currently no filesystems support it.

Reviewed by:    mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

On most architectures we end up not needing ABIBreak.cpp as, although
some of the sources here do reference EnableABIBreakingChecks (or, if
assertions are disabled, DisableABIBreakingChecks) at a source level, we
compile with -ffunction-sections and -fdata-sections, and link with
--gc-sections, and it happens to be the case that all references can be
GC'ed. However, prior to LLVM 21, the RISC-V backend did not apply
-fdata-sections to .sdata, where references to these symbols end up, and
for some files we're building with such references we end up not being
able to GC .sdata due to the other unrelated data in it, meaning that we
do in fact need to build ABIBreak.cpp.

Whilst we could make this conditional on the architecture, it's a tiny
file, and it's a bit fragile to rely on GC behaviour, so just include it
unconditionally.

Reviewed by:    dim, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=770cf0a5f02d ("Fixups after llvm-project main llvmorg-21-init-19288-gface93e724f4 merge")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58044

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Retire the GNU subtree

With GNU diff and cdialog gone, this is now an empty shell.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55425

Add a few missed files to ObsoleteFiles.inc

There were still some left-over files under usr/tests/gnu/usr.bin/diff,
causing the directory to not be fully removed. Add these to OLD_FILES.

Fixes:          https://cgit.freebsd.org/src/commit/?id=134a4c78d070

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

-I${SRCTOP}/sys/contrib/xz-embedded/linux/lib/xz isn't used, and
.PATH: ${SRCTOP}/sys/contrib/xz-embedded/freebsd isn't used either.
Remove them both to simplify things a little.

Sponsored by:           Netflix

The new world may use system calls that are not in the currently-running
kernel, so we cannot chroot into the new environment to run `make
installworld`, `etcupdate`, etc.  Partially revert commit 16702050ac95
("beinstall: perform pre-installworld steps") and switch back to using
DESTDIR for installworld and so on.

Reported by:    olivier
Reviewed by:    olivier
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D50682

I introduced it in commit 1b49115a40ad ("Promote llvm-cov to a
standalone option").  llvm-cov was previously enabled as part of the
CLANG_EXTRAS option.  I made it a standalone, default-enabled option for
parity with the tools provided by the GCC-based toolchain.

We no longer provide an in-tree GCC toolchain.  Now, just build llvm-cov
along with Clang to simplify build infrastructure.

Reviewed by:    dim
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58155

RANLIB is not used by our build, so there is no need to set it.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58156

For the BIOS, add xzfs support. This is a tiny increase in the loader
size, but allows us to fetch compressed files from any of the
filesystems we support, including over the network.

For EFI, also add gzipfs and bzip2fs support we well. The increment for
these files is tiny.

Sponsored by:           Netflix

Sponsored by:         Netflix

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

In order to merge merge commits (such as vendor imports), we need to
tell git cherry-pick which of the two branches referenced in the commit
is the mainline.  In our case, it is always the first.

Approved by:    markj

Previously we searched commits based on the author email address, but
this isn't really right: if I commit something from a contributor, I'm
still responsible for MFCing it, so really we should be filtering on the
committer.

Add a new --committer option to filter results by committer email
address, defaulting to the user.email value in the git config.

Keep the --author option, but don't filter by author unless the option
is explicitly specified.

Reported by:    des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58126

This allows one to resume from a conflict with a plain
`git cherry-pick --continue`, whereas before one would have to re-run
the original git-mfc command after resolving the conflict and running
`git cherry-pick --continue`.

Suggested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58129

Commit hashes listed in ~/.git-mfc-ignore are not listed in output of
git-mfc --dangling or --pending.  This is handy for silencing output
about commits that are tagged for MFC or as fixing another commit, but
which were not MFCed for some reason or other.

Requested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58161

This silences warnings when running git-mfc --pending against stable/13,
14 and 15.

Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58162

Reviewed by:  kib
MFC with:       5c32aa785184 ("kern: add pdopenpid(2)")
Differential Revision:  https://reviews.freebsd.org/D58023

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

In order to reuse the sendfile_helper program in pf tests, move it
to tests/sys/common directory, indicatint that it is also used from
another places than sys/kern.
Also make the readlen variable static.

Reviewed by:    gelbius, kp
Differential Revision:  https://reviews.freebsd.org/D58040

In order to use the sendfile_helper program in a pf test script that
requires non-loopback interfaces, add functionality to sendfile with a
TCP socket that is connected to a remote host.
The behavior for unix sockets and TCP loopback sockets is unchanged.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D58041

MFC after:    3 days

Reported by:  gcc -Werror=shadow
Reviewed by:    asomers, markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ee1c3d38a26a ("fusefs: fix vnode locking violations during execve")
Differential Revision:  https://reviews.freebsd.org/D58130

Make sure we have reachability when one of our nexthops
gets down without deleting the route.

Differential Revision: https://reviews.freebsd.org/D57552

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57928

Fixes:          https://cgit.freebsd.org/src/commit/?id=c3c8f4d9e662 ("cpu: New cpu_get_pcpuid(), retrieves internal CPU ID")
Sponsored by:   The FreeBSD Foundation

Rename handler function type 'lapic_thermal_handle_function' to the
shorter 'lapic_thermal_handler_t'.  Move it closer to the function
declaration block where it is used.  Make it a true function type (no
pointer) and add explicit pointer marks on usage.

Rename 'lapic_thermal_function_value' to the more immediately clear
'lapic_thermal_function_arg'.  In lapic_thermal_enable(), use 'func_arg'
as the argument name for the handler argument, which at least refers to
function 'func', rather than the generic 'value'.

Finally, rename the global handler variable from
'lapic_thermal_function_ptr' to the shorter 'lapic_thermal_function'
(dynamic functions can be referenced only through a pointer).

MFC with:       87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Sponsored by:   The FreeBSD Foundation

MFC after:    1 week

We should exit the net epoch instead of acquiring one more entry.

Reported by:    Wafa Hamzah <wafah@nvidia.com>
Reviewed by:    jhb
Sponsored by:   Nvidia networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=4726b80d9379 ("OFED: Various changes from Linux 4.20")
Differential revision:  https://reviews.freebsd.org/D58127

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

In delete(), when copying the deleted character to the d_char buffer,
don't assume that it fits.  utf8_prev() may return a sequence of more
than 5 bytes.

In insert_utf8(), fix the copy-up of the line.  We extended the line by
"len" bytes, so "temp" has to be repositioned accordingly.  Compare with
plain insert().

Use sizeof when copying to buffers instead of hard-coding buffer sizes.

Don't dynamically allocate d_char, there is no need.

Fixes:          https://cgit.freebsd.org/src/commit/?id=62fba0054d9e ("ee: add unicode support")
Reported by:    Sayono Hiragi (overflow in delete())
Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57996

Otherwise one can't easily attach gdb to ee.

Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57997

When looking up self process we can use `ps -p $$` directly rather
than grep which may find other processes ending in the expected PID.

Sponsored by:   Dell Inc.
Reviewed by:    markj, vangyzen
Differential Revision: https://reviews.freebsd.org/D58019

Changes: https://github.com/eggert/tz/blob/2026c/NEWS

MFC after:      3 days

MFC after:    1 week

Full release notes are available at
https://www.openssh.com/txt/release-10.4

Selected highlights from the release notes:

Potentially-incompatible changes
--------------------------------

 * sshd(8): configuration dump mode ("sshd -G") now writes directives
   in mixed case (e.g. "PubkeyAuthentication") whereas previously it
   emitted only lower-case names.

 * ssh(1), sshd(8): make the transport protocol stricter by
   disconnecting if the peer sends non-KEX messages during a post-
   authentication key re-exchange. Previously a malicious peer could
   continue sending non-key exchange messages without penalty. These
   would be buffered, causing memory to be wasted up until the
   connection terminated or the server/client hit a memory limit.
   Implementations that do not restrict messages sent during key
   exchange as per RFC4253 section 7.1 may be disconnected.
   Reported by Marko Jevtic.

Changes since OpenSSH 10.3
==========================

This release contains a number of security fixes as well as general
bugfixes and a couple of new features.

Security
========

 * sftp(1): when downloading files on the command-line using
   "sftp host:/path .", a malicious server could cause the file to
   be downloaded to an unexpected location. This issue was identified
   by the Swival Security Scanner.

 * scp(1): when copying files between two remote destinations, do
   not allow a malicious server to write files to the parent
   directory of the intended target directory.  This issue was
   identified by the Swival Security Scanner.

 * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
   as it was documented to do. Note that PermitTunnel is not enabled
   by default. Reported independently by Huzaifa Sidhpurwala of
   Redhat and Marko Jevtic.

 * sshd(8): avoid a potential pre-authentication denial of service
   when GSSAPIAuthentication was enabled (this feature is off by
   default). This was not mitigated by MaxAuthTries, but would be
   penalised by PerSourcePenalties. This was reported by Manfred
   Kaiser of the milCERT AT (Austrian Ministry of Defence).

 * sshd(8): fix a number of cases where the minimum authentication
   delay was not being enforced. Reported by the Orange Cyberdefense
   Vulnerability Team.

 * ssh(1): fix a possible client-side use-after-free if the server
   changes its host key during a key reexchange. This was reported by
   Zhenpeng (Leo) Lin of Depthfirst.

New features
------------

 * All: add experimental support for a composite post-quantum
   signature scheme that combines ML-DSA 44 and Ed25519 as specified
   in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

   This scheme is not enabled by default. To use it, you'll need
   to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
   Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

Bugfixes
--------

 * sshd(8): avoid sending observably different messages for valid vs
   invalid users in GSSAPIAuthentication (disabled by default).

 * ssh(1), sshd(8): fix several bugs that incorrectly
   classified bulk traffic as interactive. bz3972, bz3958

 * ssh-keygen(1), ssh-add(1): skip unsupported key types when
   downloading resident keys from a FIDO token. Previously, downloads
   would abort when one was encountered. GHPR657

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58083

We don't use this note type today, but as a general purpose ELF
diagnostic tool readelf(1) ought to decode it.

References:
https://fedoraproject.org/wiki/Changes/Package_information_on_ELF_objects
https://systemd.io/ELF_PACKAGE_METADATA/

Reviewed by:    fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D47524

This reverts commit 3e3fd1fde8e168910edc538966111c0b5f03cd5f.

This appears to break chainbooting with boot1.efi and similar scenarios
with Root-on-ZFS scenarios. Revert until it's better understood.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296309
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58071