FreeBSD git weekly: 2026-08-03 to 2026-08-09

The SR-IOV schema advertises MAC anti-spoofing and enables it by
default, but the VF configuration was never consumed and the hardware
policy remained disabled.

Record the configured policy and apply MAC and VLAN anti-spoofing
throughout VF initialization and reset. On X550-family devices, also
protect the LLDP and flow-control Ethertypes and enable per-VF
spoof-event accounting. Remove the driver-owned state during SR-IOV
teardown.

Adapt the anti-spoof configuration lifecycle used by igb(4) in
a2ed165f0049 to the ixgbe hardware controls.

MFC after:      1 week
Relnotes:       yes

The VF VLAN capability is checked but never granted, and no SR-IOV
configuration property exposes the existing default-VLAN support. PF
VLAN updates also replace VFTA registers from a PF-only shadow, erasing
live VF filters.

Expose access VLAN and trunk policy through the IOV schema. Track each
VF VLAN as desired state, restore the administrative VLAN after reset,
and use the native VLVF helper for incremental PF and VF ownership
changes.

Keep VLAN filtering enabled while SR-IOV is active. When PF hardware
filtering is disabled, admit every VLAN to the PF without bypassing
per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and
VF desired state after reset or a filtering-mode transition, and
restore PF-only state on teardown.

When the last VF leaves a VLAN still owned by the PF, free its VLVF
slot while retaining the shared VFTA bit. This prevents a trunk VF from
exhausting the 64-entry VLVF table by cycling VLAN memberships.

Adapt the VLAN ownership model introduced for igb(4) in a2ed165f0049 to
ixgbe's native VLVF machinery.

Match Linux receive semantics by exposing a stripped VLAN tag only
when that VID was registered by the VF.  A PF-assigned port VLAN is an
administrative tag and must be delivered to the VF as untagged traffic;
otherwise the stack dispatches it to a nonexistent VLAN interface and
access-VLAN receive traffic is blackholed.

MFC after:      1 week
Relnotes:       yes

The allow-promisc IOV property is advertised but ignored, and the PF
rejects the xcast request used by modern VFs. Negotiate mailbox APIs
1.2 and 1.3, implement pool-scoped xcast modes, and require
allow-promisc for requested all-multicast or unicast-promiscuous modes.

The VF mailbox can carry only 30 multicast hashes. When ixv has a
larger list, request the API 1.2 all-multicast xcast mode instead of
extending the legacy SET_MULTICAST message. The PF grants that fallback
only to VFs configured with allow-promisc; otherwise ixv reports that
only the first 30 addresses are active.

Reset xcast state with the VF and have ixv replay the mode implied by
its interface flags after multicast updates.

Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc
policy adapted from igb(4) in a2ed165f0049.

MFC after:      1 week
Relnotes:       yes

The PF advertises the legacy SET_MACVLAN mailbox request but always
rejects it. The request installs secondary unicast addresses.

Allocate an owned RAR pool for VF secondary addresses, reserve low
entries for PF filters, and place VF-primary addresses at the top of
the usable RAR range. Reject address collisions and cap each VF at
three secondary filters so one guest cannot exhaust the shared table.

Clear secondary filters on VF or PF reset and on SR-IOV teardown. This
hardware can anti-spoof only the VF primary source address. Reject
secondary filters while MAC anti-spoofing is configured, so installing
them requires an explicit administrative policy choice. Report optional
filter-table allocation failure without disabling SR-IOV.

Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in
a2ed165f0049 to DPDK's ixgbe SET_MACVLAN mailbox semantics.

MFC after:      1 week
Relnotes:       yes

The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.

Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.

Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
mailbox interrupt edge, while suppressing already-fenced pools. Latch a
PF reset request until the next hardware initialization.

The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue
bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS,
which has reserved-zero bits, also reads as all ones and confirms dead
MMIO.

Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates,
which hardware otherwise reports as queue-context changes. Serialize
that window with the iflib context lock and resample pending work after
MDD is restored.

Apply the per-pool recovery model used by igb(4) in a2ed165f0049 to the
existing DPDK-derived X550 hooks. The same register interface is
documented for X552 and X553, so cover the entire X550 family. Document
that VF traffic remains disabled until the reset handshake completes.

MFC after:      2 weeks
Relnotes:       yes

iflib counts resets initiated by its transmit watchdog in 69c3e0de01c1.

Export the counter in the per-device iflib sysctl tree so every
driver provides the diagnostic without a driver callback or duplicate
storage.

A watchdog reset does not establish how many packets failed.  It can
recover a hardware stall involving several queued packets or a missed
completion involving no packet loss.  Stop adding one output error per
watchdog event in em(4), igb(4), and igc(4).

Remove the redundant driver counters and move the diagnostic to
dev.<driver>.<unit>.iflib.tx_watchdog_events.

MFC after:      1 month
Relnotes:       yes

Add -L to query the generic packed-nvlist IOV_GET_STATUS interface.
Report PF enable state and configured and total VF counts.  For each VF,
print its PCI address, newbus attachment, bound driver, and ppt state.

Retry size negotiation if the topology changes between ioctls and reject
malformed or incompatible status records.

Keep NIC-specific operational state in ifconfig -v; iovctl owns the
device-neutral PCI topology and applies to any SR-IOV device class.

Relnotes:       yes

* On SIGINFO, print the current path to stderr rather than stdout.

* Do so immediately, instead of the next time we finish a directory.

* Document this behavior in the manual page.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296861
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=d1588599c024 ("Report the next directory being scanned ...")
Reviewed by:    wollman
Differential Revision:  https://reviews.freebsd.org/D58702

Reviewed by:  fuz, ngie
Co-authored-by: Robert Clausecker <fuz@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D58727

The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover.  The implementation uses a TCP
connection to exchange messages.  There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts.  This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.

Provide a warning to this effect in the CTL man page.

Reported by:    Ryan of Calif.io
Reviewed by:    ziaee, ken, mav
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58622

Noted  and reviewed by:       lwhsu
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58666

Reviewed by:  ziaee
Differential Revision: https://reviews.freebsd.org/D58565

- Remove `\(em` from .Nm section as it's not valid mandoc markup.
- Remove the section from the .Nm directive (it's handled under the .Dt
  directive).

MFC after:      1 week
Reported by:    make manlint

Add missing commas after .Nm entries.

MFC after:      1 week
Reported by:    make manlint

MFC after:    1 week
Reported by:    make manlint

MFC after:    1 week
Reported by:    make manlint

Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.

The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.

While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58628

igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.

Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.

Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.

While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58629

gpio: add generic Intel GPIO pin controller framework

Add a platform-independent driver framework for Intel GPIO pin controllers
found on modern Intel SoCs. The driver accesses GPIO pad registers through
ACPI-provided memory-mapped resources and implements the gpio interface [1]
including pin enumeration, capability reporting, configuration, and
read/write/toggle operations. A common data model of communities and pad groups
allows individual SoC-specific drivers to supply their own pad tables and ACPI
hardware IDs while sharing all register-level logic.

[1] https://wiki.freebsd.org/GPIO

Reviewed by:            vexeduxr
MFC after:              1 week
Sponsored by:           Beckhoff Automation GmbH & Co. KG
Pull Request:           https://github.com/freebsd/freebsd-src/pull/2205

gpio: add Intel Alder Lake-N GPIO driver

Add a GPIO driver for the Intel Alder Lake-N platform based on the generic
intelgpio framework. The driver provides pad group definitions for four GPIO
communities covering groups GPP_A through GPP_T, vGPIO and HVCMOS, and matches
ACPI hardware IDs INTC1056, INTC1057 and INTC1085. The kernel module build
infrastructure and the wiring into files.x86 are included.

Reviewed by:            vexeduxr
MFC after:              1 week
Sponsored by:           Beckhoff Automation GmbH & Co. KG
Pull Request:           https://github.com/freebsd/freebsd-src/pull/2205

gpio: add Intel Tiger Lake-H GPIO driver

Add a GPIO driver for the Intel Tiger Lake-H platform based on the generic
intelgpio framework. The driver defines five GPIO communities with pad groups
GPP_A through GPP_K, vGPIO and JTAG, and matches ACPI hardware ID INT34C6.
The kernel module build infrastructure and the wiring into files.x86 are
included.

Reviewed by:            vexeduxr
MFC after:              1 week
Sponsored by:           Beckhoff Automation GmbH & Co. KG
Pull Request:           https://github.com/freebsd/freebsd-src/pull/2205

The VF admin vector carries both link and PF mailbox causes, but the
filter schedules the admin task only for link-status changes. Defer
administration for every interrupt so reset and control notifications
are serviced promptly.

MFC after:      1 week

The shared VF set-RAR helper restores hw.mac.addr when the PF rejects a
requested address, but ixv ignores the error and leaves the interface
link-layer address unchanged. Subsequent initialization repeats the
rejected request while the interface appears to use an address the PF
will not deliver.

Refresh the permanent address returned by the PF after every successful
reset handshake. Copy the resulting PF-approved address back to the
interface and emit the normal link-layer address notification without
re-entering the driver initialization path. This also recovers from a
prior mailbox transport failure or a PF-side reassignment.

Adapt the igb VF address reconciliation added in a6bb3850e7c6.

MFC after:      1 week

The MTA is shared by the PF and all VFs. The VF mailbox handler only
ORs new bits, so hashes survive list removal and VF reset. Conversely,
PF multicast updates replace the whole table with PF-only state and
discard live VF filters.

Rebuild the table from the PF list and every active VF whenever either
changes. Clear VF multicast state during reset and PF reinitialization,
and remove all VF hashes on SR-IOV teardown. Keep the software shadow
and multicast control state synchronized, and avoid writes to unchanged
MTA registers.

Adapt the aggregate desired-state rebuild introduced for igb(4) in
a2ed165f0049 and its write-elision scheme from 350211ab1782 to ixgbe's
shared MTA.

MFC after:      1 week

ixgbe: enforce configured VF anti-spoofing

The SR-IOV schema advertises MAC anti-spoofing and enables it by
default, but the VF configuration was never consumed and the hardware
policy remained disabled.

Record the configured policy and apply MAC and VLAN anti-spoofing
throughout VF initialization and reset. On X550-family devices, also
protect the LLDP and flow-control Ethertypes and enable per-VF
spoof-event accounting. Remove the driver-owned state during SR-IOV
teardown.

Adapt the anti-spoof configuration lifecycle used by igb(4) in
a2ed165f0049 to the ixgbe hardware controls.

MFC after:      1 week
Relnotes:       yes

ixgbe: preserve VLAN ownership with SR-IOV

The VF VLAN capability is checked but never granted, and no SR-IOV
configuration property exposes the existing default-VLAN support. PF
VLAN updates also replace VFTA registers from a PF-only shadow, erasing
live VF filters.

Expose access VLAN and trunk policy through the IOV schema. Track each
VF VLAN as desired state, restore the administrative VLAN after reset,
and use the native VLVF helper for incremental PF and VF ownership
changes.

Keep VLAN filtering enabled while SR-IOV is active. When PF hardware
filtering is disabled, admit every VLAN to the PF without bypassing
per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and
VF desired state after reset or a filtering-mode transition, and
restore PF-only state on teardown.

When the last VF leaves a VLAN still owned by the PF, free its VLVF
slot while retaining the shared VFTA bit. This prevents a trunk VF from
exhausting the 64-entry VLVF table by cycling VLAN memberships.

Adapt the VLAN ownership model introduced for igb(4) in a2ed165f0049 to
ixgbe's native VLVF machinery.

Match Linux receive semantics by exposing a stripped VLAN tag only
when that VID was registered by the VF.  A PF-assigned port VLAN is an
administrative tag and must be delivered to the VF as untagged traffic;
otherwise the stack dispatches it to a nonexistent VLAN interface and
access-VLAN receive traffic is blackholed.

MFC after:      1 week
Relnotes:       yes

ixgbe: Preserve priority-tagged traffic with SR-IOV

VID 0 carries only 802.1p priority and does not identify VLAN
membership. Keep VFTA bit zero in the persistent PF shadow table so
reset and SR-IOV replay admit priority-tagged frames while VLAN
filtering is enabled.

In virtualization mode, also reserve VLVF slot zero and restore PF and
eligible VF pool memberships. A VFTA hit alone admits the tag globally
but does not deliver it to the correct pools.

This matches the priority-tag treatment in em/igb.

MFC after:      1 week

ixgbe: enforce VF promiscuity and multicast policy

The allow-promisc IOV property is advertised but ignored, and the PF
rejects the xcast request used by modern VFs. Negotiate mailbox APIs
1.2 and 1.3, implement pool-scoped xcast modes, and require
allow-promisc for requested all-multicast or unicast-promiscuous modes.

The VF mailbox can carry only 30 multicast hashes. When ixv has a
larger list, request the API 1.2 all-multicast xcast mode instead of
extending the legacy SET_MULTICAST message. The PF grants that fallback
only to VFs configured with allow-promisc; otherwise ixv reports that
only the first 30 addresses are active.

Reset xcast state with the VF and have ixv replay the mode implied by
its interface flags after multicast updates.

Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc
policy adapted from igb(4) in a2ed165f0049.

MFC after:      1 week
Relnotes:       yes

ixgbe: implement VF secondary MAC filters

The PF advertises the legacy SET_MACVLAN mailbox request but always
rejects it. The request installs secondary unicast addresses.

Allocate an owned RAR pool for VF secondary addresses, reserve low
entries for PF filters, and place VF-primary addresses at the top of
the usable RAR range. Reject address collisions and cap each VF at
three secondary filters so one guest cannot exhaust the shared table.

Clear secondary filters on VF or PF reset and on SR-IOV teardown. This
hardware can anti-spoof only the VF primary source address. Reject
secondary filters while MAC anti-spoofing is configured, so installing
them requires an explicit administrative policy choice. Report optional
filter-table allocation failure without disabling SR-IOV.

Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in
a2ed165f0049 to DPDK's ixgbe SET_MACVLAN mailbox semantics.

MFC after:      1 week
Relnotes:       yes

In preparation of increasing the KVA on powerpc64 to 2TB to mirror
amd64's, rework the 64-bit Book-E pmap to not allocate all page table
pages at boot time, since that would be a waste of a lot of memory.
Instead, allocate all page table pages for the higher levels, leaving
the leaves (page directories) for dynamic allocation.  This cuts the
boot-time page table size down from ~64MB to ~8MB with the current 32GB
KVA size, and bumping to 2TB KVA the boot-time page table is still ~8MB
instead of ballooning to ~4GB of mostly wasted space.

This reflects what amd64 has, and is needed for using GPUs with large
VRAM.

VLAN registration callbacks only update the software shadow, leaving
the PF unaware until a later full initialization.  Initialization then
retries each failed request in a tight loop, while skipping replay
entirely when local hardware filtering is disabled.

Send additions and removals as soon as the desired state changes,
independent of the VF local-filter capability.  Replay the desired
memberships after reset and retry a bounded batch per timer tick.  Stop
after the first failure so a silent PF can consume only one mailbox
timeout per pass, while a responsive PF can drain several requests.
Treat the retry window as a no-progress deadline: advance it when
pending work succeeds so a large backlog can drain, but leave entries
dormant after a sustained failure.

A successful mailbox request wakes a dormant backlog.  Dispatch
timer-driven retries only while iflib marks the VF running, so a stale
timer tick cannot restore PF VLAN state after the stop path resets the
VF.

Because the callbacks now update the PF or retain failed work for
retry, do not restart the VF for VLAN configuration changes.  This
avoids resetting and flapping the interface for every VLAN addition or
removal.

Also keep receive VLAN stripping synchronized in both the enabled and
disabled cases.

Adapt the bounded VLAN reconciliation scheme from igb VF commit
fdce3830d9a6 to the ixgbe VF mailbox.

MFC after:      1 week

pci: Ignore SR-IOV VFs when tuning MPS

The VF Device Control MPS and MRRS fields are reserved and preserved.
VF transactions use the PF MPS, so a hardwired VF value must not be
used to retune the shared PCIe hierarchy.

Document the previously undocumented tuning knob and clarify why a VF
may continue to display its reserved hardwired value.

This fixes an instant crash/reboot on my Zen3 system with 82599 VFs.

MFC after:      1 week

pci: Preserve adjusted PCIe control state

The PCI bus changes live capability registers after the initial
configuration snapshot has been saved. A later driver reprobe restores
that snapshot and can silently undo the adjustment.

Update the cached Device Control and Root Control bits together with
pcie_adjust_config() writes. Route the persistent Maximum Read Request
setter and the bus-owned AER control changes through that helper as
well, so they share the same restore semantics as MPS reconciliation.

Document the persistent-write contract. Merge only explicitly adjusted
bits into the saved image so unrelated or transient bits observed during
the hardware read-modify-write cannot become persistent.

MFC after:      2 weeks

pci: Reconcile MPS before attaching PCIe devices

Reconcile each newly enumerated link as a unit before child drivers
attach. Firmware may leave Bus Master Enable set after handoff, so use
the bus attachment state rather than that bit to identify the cold
phase.

Preserve an established hierarchy during rescan and hot-add. Refuse a
reduction below a switch because recursive enumeration may already have
made a sibling subtree live; lowering only the local port or Root Port
would produce an inconsistent path. Report capability and active-use
conflicts distinctly.

Handle OFW PCI buses that clone the generic enumeration path.

MFC after:      2 weeks

pci: Add a hierarchy-wide MPS limit

Add a boot-time ceiling for MPS reconciliation. Apply it only while an
entire cold-enumerated link can be configured consistently, and leave
an established active path unchanged.

MFC after:      2 weeks

pci: Optionally disable endpoints with unsafe MPS

Keep warn-only behavior as the default. Add an opt-in policy that
clears endpoint decoding and bus mastering when a newly discovered
function cannot match its active path, while never disabling bridge
functions and their subtrees.

MFC after:      2 weeks

pci: Permit function-level reset of 82599 VFs

Intel 82599 supports FLR on VFs but reports FLR support only in the PF
Device Capabilities register.  The VF register therefore leaves the FLR
Capable bit clear, and pcie_flr() rejects the reset.

Intel documents the zeroed VF PCIe capability structure as erratum 35
in the 82599 Specification Update (B0=Yes; NoFix).

Add a positive FLR quirk for the 82599 VF.  Keep the capability check
for every other function, so an unknown nonconforming VF cannot make
pcie_flr() report success when its reset request was ignored.

SR-IOV requires VFs to support FLR, but a clear capability bit cannot
distinguish the 82599's misadvertisement from a VF that fails to
implement it.

MFC after:      1 week

The IOV callback changes the PF pool, virtualization mode, and hardware
queue indices while iflib still considers the old queue layout live.
Teardown likewise leaves the software pool and mode at their SR-IOV
values.

Use iflib stop/mutate/restart transactions for both transitions.
Disable VF DMA and PCI VF Enable before queue reuse, let outstanding
transactions drain, and restore the non-IOV pool and queue indices on
teardown.

Remove the redundant driver-local pci_iov_detach() wrapper; iflib
already performs that check centrally before the driver detach
callback.

It may be possible to avoid some restart in the future on this hardware
pausing DMA and remapping rings but not pursued yet.

MFC after:      2 weeks

A deterministic IOV configuration error currently reaches the driver
only after iflib has stopped the PF. The required cleanup restart then
causes an avoidable carrier flap.

Follow the igb pattern and validate the request in the PCI IOV method
before entering the restart transaction. Reject queue layouts wider
than the selected virtualization pool before they can alias unrelated
82599 registers.

MFC after:      2 weeks

ixgbe: complete PF cleanup after VF FLR

The 82599, X540, and X550 documentation identifies VF registers which
retain state across VFLR and must be reconfigured before a VF is reused.
The VF reset path already initializes its queue-owned registers, but the
PF only cleared VF mailbox memory and transmit head write-back addresses
after a cooperative mailbox reset.  A bare hardware VFLR therefore left
both behind on affected devices.

Move TDWBA cleanup into the common reset path.  Clear CTS when VFLR
invalidates the mailbox session, and accept only VF_RESET during the
reset pass before restoring VF traffic.

Clear VFMBMEM through the PFU/VFU semaphore.  Recheck VFREQ while
holding PFU so a reset event cannot erase a request posted between the
initial mailbox check and the clear.  Dispatch an already-read message
even if the residual clear fails, but keep cleanup pending until a
synchronized clear succeeds.  Retry cleanup in the same admin pass
after a failed message read or clear.

The 82599 also retains VFMAILBOX.VFU across VFLR.  Leave a VF-owned
mailbox intact initially so a live post-reset writer can finish.  Retry
cleanup from the admin timer and, after a two-second grace period, use
PFMAILBOX.RVFU only when VFU remains set and no request has been posted.
Clear the mailbox under PFU afterward.  This recovers an abandoned
pre-reset owner without sleeping under the iflib context lock or
immediately stealing from a new reset request.

Suppress mailbox dispatch once iflib has cleared IFF_DRV_RUNNING so a
pending reset request cannot re-enable VF traffic inside the PF stop
path.  Periodically sample aggregate VFREQ, VFACK, and VFLR registers,
masked to active VFs, so work suppressed across a stop/restart and a
bare 82599 VFLR without EICR_MAILBOX are both discovered without another
interrupt edge.

MFC after:      2 weeks

ixgbe: recover from X550 malicious-driver events

The shared X550 code provides malicious-driver detection, event
decoding, and per-pool recovery operations, but the PF never enables or
services them. A malformed VF descriptor can therefore go undetected
and avoid the per-pool recovery path supplied by the MAC.

Configure IOV state while VF DMA remains disabled, then enable MDD and
activate the VFs only after PF queue initialization is complete. On an
MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and
PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset
epoch; PFVFTE can still permit descriptor fetches into the internal
queue, so releasing WQBR early would allow a hostile VF to retrigger
MDD before it resets.

Send the non-CTS reset notification after servicing the VF mailbox.
Let a posted VF request win mailbox arbitration, defer notification if
the pass produced a response, and retry failed notifications from the
periodic admin pass. Poll WQBR so recovery does not depend on another
mailbox interrupt edge, while suppressing already-fenced pools. Latch a
PF reset request until the next hardware initialization.

The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue
bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS,
which has reserved-zero bits, also reads as all ones and confirms dead
MMIO.

Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates,
which hardware otherwise reports as queue-context changes. Serialize
that window with the iflib context lock and resample pending work after
MDD is restored.

Apply the per-pool recovery model used by igb(4) in a2ed165f0049 to the
existing DPDK-derived X550 hooks. The same register interface is
documented for X552 and X553, so cover the entire X550 family. Document
that VF traffic remains disabled until the reset handshake completes.

MFC after:      2 weeks
Relnotes:       yes

ixgbe: force receive drops on every VF queue

PFQDE is indexed by absolute receive queue, but the driver programs one
index per VF. Only the first quarter or half of the VF queues therefore
have queue-drop isolation, depending on the virtualization mode. The
flow-control path can also clear those bits even though SR-IOV requires
them independently of the PF pause policy.

Program every queue in a VF pool before enabling receive for that VF.
For an X550-family VF with an administrative port VLAN, also hide the
VLAN tag as the hardware requires. Keep PF flow-control changes
confined to the PF SRRCTL registers, and clear the VF queue settings
when SR-IOV is torn down and the queues can be reassigned to the PF.

MFC after:      2 weeks

Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.

During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).

Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.

Signed-off-by: Sujithra Periasamy <sujithra@google.com>

Reviewed by:    markj
MFC after:      1 week
Sponsored by:   Google
Differential Revision:  https://reviews.freebsd.org/D58696

A VF's pci_devinfo references its PF's pcicfg_iov for resource
bookkeeping, but only the PF implements the SR-IOV capability.
pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as
an owned capability and accessed the PF capability offset in VF
configuration space. Saving a VF could therefore replace the shared
PF settings with unrelated VF register values.

Skip SR-IOV capability save and restore for PCICFG_VF children. The
generic PCI and PCIe state of the VF remains preserved. This is also
required by drivers that save VF state around a PF-driven
function-level reset.

MFC after:      2 weeks

ixgbe: Recover legacy VFs from invalid DMA targets

82599 and X540 lack the X550 malicious-driver detector. Detect a VF
whose PCI status reports a received master abort while its transmit
ring has outstanding descriptors and makes no progress across
consecutive samples.

Consume the accepted PCI status latch, gate that VF I/O, and recover
one pending VF per task pass with round-robin selection. This prevents
an unreadable function from starving detection or recovery of other
VFs.

Save the complete writable VF PCI configuration before FLR, restore it
afterward, and verify the hardware-backed Command state. Preserve the
first good snapshot and pending state across reset events until restore
and verification succeed.

Introduce a common I/O-disabled policy bitmask so later quarantine
policy can extend traffic gating without duplicating fault-state
checks.

MFC after:      2 weeks

ixgbe: quarantine repeatedly faulting legacy VFs

A guest can reinitialize after a VF function-level reset and
repeatedly strand an 82599 or X540 PF with invalid descriptor DMA
targets. Count only distinct Received Master Abort events accepted by
the qualified transmit-stall detector and quarantine the VF after five
events.

Preserve quarantine across PF reinitialization, reject reset mailbox
requests, and keep transmit, receive, and clear-to-send disabled.
Recreating SR-IOV clears quarantine. Expose the affected pools through
a read-only bitmap.

After a successful quarantine FLR, leave the function in post-FLR
configuration, explicitly keep decode and bus mastering disabled,
verify the Command register, and refresh its PCI-layer cache so a later
restore cannot re-enable the function.

This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure
policy to X540 as defense in depth; the CVE does not list X540. Intel
documents the 82599 issue in:
http://iommu.com/datasheets/ethernet/controllers-nics/intel/ixgbe/Intel_82599_Application_Note_655276.pdf

MFC after:      2 weeks
Security:       CVE-2021-33061

ixgbe: Re-enable the SFP laser during initialization

ixgbe_if_stop() disables the transmit laser on every 82599 SFP fiber
port, but the iflib initialization path did not re-enable it. Re-enable
the laser before deferred SFP module setup so interface
reinitialization cannot leave either single-speed or multispeed optics
dark.

The hardware wrapper is a no-op when laser control is unavailable. The
placement follows Intel ix-3.4.39; this version deliberately applies to
every SFP port affected by the stop path.

MFC after:      1 week

When link polling loses mailbox clear-to-send or times out, request an
iflib reset instead of continuing with stale VF state.

The driver callback runs after iflib samples reset requests, so requeue
the admin task to make iflib consume the request on its next pass
rather than waiting for an unrelated timer or interrupt.

MFC after:      2 weeks

ixgbe: Apply the 82599 D3 link workaround only for D3

ixgbe_stop_mac_link_on_d3_82599() implements the workaround for
82599 erratum 33.  It forces incompatible auto-negotiation settings
before the device enters D3, and reset clears them when returning to
D0.

ixgbe_if_stop() is also used for ordinary interface reconfiguration
and recovery.  Those paths do not enter D3 and should not program
this power-management workaround.  They continue to stop the adapter
and disable the transmit laser.

Move the call to ixgbe_setup_low_power_mode(), after
ixgbe_if_stop().  This preserves the required ordering for detach,
shutdown, and suspend while avoiding the D3 settings during ordinary
restarts.

MFC after:      2 weeks

ixgbe: Use PF MTU for 82599 VF jumbo policy

The shared maximum frame size is raised by VF LPE requests, so it
cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo
restriction. Consult the PF ifnet MTU instead.

Also correct the API 1.1 and later comparison so a jumbo VF is enabled
when, and only when, the PF itself uses a jumbo MTU. This matches the
policy implemented by DPDK.

MFC after:      2 weeks

ixgbe: Quiesce VFs across PF reset

Stop VF transmit and receive in hardware, clear PF-side mailbox CTS,
and notify active VFs before resetting a PF. A PF reset invalidates VF
queue state, so the no-CTS control message makes cooperative VFs
discard stale state and renegotiate after the PF returns.

The hardware queue gates synchronously prevent further VF DMA. Do not
hold the exclusive iflib context lock for a fixed VF-watchdog interval
after the reset. Report the PF link transition directly instead of
dispatching mailbox work from the stop path, which could otherwise
re-enable VF I/O mid-reset.

The CTS, PF-control, and VF queue controls follow the reset mechanisms
used by DPDK.

MFC after:      2 weeks

netmap: Fix driver name handling

if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.

While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.

Reported by:    syzkaller
Reviewed by:    vmaffione
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58676

netmap: Fix a race in kqueue registration

We need to acquire the netmap global lock earlier, to avoid racing with
the NETMAP_REQ_REGISTER ioctl handler.

Reported by:    syzkaller
Reviewed by:    vmaffione
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58677

netmap: Handle overflow when computing ring sizes

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297300
Reported by:    Robert Morris
Reported by:    syzkaller
Reviewed by:    vmaffione
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58678

Found with:   clang -Werror=assign-enum

Found with:   clang -Werror=assign-enum

No functional change, as current callers either don't check the return
value or check it against OCS_HW_RTN_SUCCESS only.

Found with:     clang -Werror=assign-enum

DMA channels are allocated by attach_pre but released by queues_free.
When iflib fails after attach_pre and before queue allocation, neither
the old detach nor queues_free path releases them.

Allocate channels with the TX queue state and make queues_free tolerate
partially allocated rings. Use it to unwind allocation failures so TX
rings are also released when RX allocation fails.

An early detach can also precede PHY initialization and interrupt
assignment. Skip absent PHY and channel state, and release the locks
owned by attach_pre on both failure and detach.

MFC after:      2 weeks

Completion queues are allocated by attach_pre but released by
queues_free. An iflib failure between those stages leaks the allocation,
while the original size expression also underallocates the array.

Move completion queue allocation into the TX queue callback, correct its
size, and unwind it with TX state if RX allocation fails. Make interrupt
cleanup tolerate an unavailable array and reuse the array allocated
during device initialization instead of replacing and leaking it.

Release the DMA, multicast, and lock resources owned by a successful
attach_pre during detach. Avoid allocating the statistics DMA area a
second time near the end of attach_pre.

MFC after:      2 weeks

A PF can be resetting, handling a slow link event, or deliberately
withholding mailbox CTS while its VFs enumerate. Keep the VF attached
when the reset handshake is temporarily unavailable so a later if_init
can retry.

Never leave VF hardware running without a negotiated mailbox API: start
hardware only after reset succeeds, stop it when negotiation fails in
attach or init, and defer later recovery through iflib. This prevents a
tight reset loop while preserving recovery when the PF returns.

MFC after:      2 weeks

The iflib conversion records link-status interrupts in the
administrative request mask, but the administrative task did not
consume them.  Timer polling usually hid the omission; frequent mailbox
interrupts could continually rearm that timer and leave cached link
state down after hardware recovered.

Claim request batches atomically, process link-setup dependencies, and
sample hardware before publishing link state.  Bound each invocation to
eight batches and requeue residual work so a continuous producer cannot
monopolize the admin taskqueue.

Queue every link-related request from the legacy interrupt path.
Unlike MSI-X, its threaded continuation services RX and does not enqueue
the admin task.  This restores the event-driven behavior of ix-3.4.39.

Fixes:  https://cgit.freebsd.org/src/commit/?id=b2c1e8e62049 ("ix(4): Run {mod,msf,mbx,fdir,phy}_task in if_update_admin_status")
MFC after:      2 weeks

The aggregate VF mailbox poll includes only VFs whose driver
configuration completed. A configured VF slot whose vf_add callback
failed can nevertheless report reset, request, or acknowledgement
events. Because the mailbox handler skips inactive entries, such an
event remains latched and can retrigger administrative work
indefinitely.

Build the poll masks from every configured VF index and consume reset,
message, and acknowledgement events for inactive entries without
treating them as usable VFs. Use the index rather than the pool because
early vf_add errors precede pool initialization. Also include E610
PFVFLREC in aggregate reset sampling.

MFC after:      2 weeks

Register the vmm module handler after both the bundled device drivers
and SMP. On platforms without EARLY_AP_STARTUP, SI_SUB_SMP follows
SI_SUB_DRIVERS; using the later subsystem preserves the
smp_rendezvous() requirement.

The resulting reverse unload order performs IOMMU cleanup while every
IVHD softc remains valid. Refuse an independent IVHD detach while
translation state remains initialized.

MFC after:      2 weeks

Do not instantiate an interrupt-remapping context for a unit whose IRTE
support is disabled. In that mode the caller must retain the ordinary
interrupt path.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58725

The iflib Flow Director path does not assign filters using the
absolute queue and pool identifiers required by SR-IOV.  Reject the
combination during preflight validation rather than allowing an
unsupported configuration to alter the PF receive path.

The loader tunable is fixed before VFs can be created, so validation
also prevents the reverse ordering of this combination.

MFC after:      2 weeks

The flow_control and hdr_split variables have never been read.  VF
flow control is controlled by the PF, while implementing header split
would require receive-path support that ixv does not provide.

MFC after:      2 weeks

The shared ixgbe transmit path already creates SCTP context
descriptors, and the hardware exposes the same checksum capability to
VFs.  Advertise it through iflib as the PF driver does.

MFC after:      2 weeks

TXDCTL programming is family dependent.  82543 erratum 35 and
82544 erratum 20 require WTHRESH to remain zero; a nonzero value
can corrupt descriptor writebacks and hang the controller.  Leave all
descriptor-control thresholds at their reset values on 82542, 82543,
and 82544.

On the remaining em controllers, retain the established PTHRESH=31,
HTHRESH=1, WTHRESH=1, and descriptor granularity policy.  Several
legacy specification updates identify full descriptor writeback as a
workaround for transmit descriptor-queue errata.

TXDCTL bit 22 is also family dependent.  It is COUNT_DESC on the
82571 family and 80003ES2LAN.  Intel shared initialization explicitly
sets raw bit 22 on both transmit queues of every supported ICH/PCH
generation, although the integrated public documentation marks it
reserved.  Preserve that required setting when iflib programs the
thresholds, as DPDK does.  Clearing it caused a persistent I219
transmit stall under descriptor pressure.

The combined em/igb setup also wrote LWTHRESH=1 on every em
controller.  The driver does not enable the TXD_LOW interrupt
controlled by that field.  Enumerate every supported em MAC type and
leave the unused low-water threshold disabled.

This keeps the legacy descriptor-writeback safety policies separate
from igb sparse-RS operation while programming only the fields
appropriate to each family.

MFC after:      2 weeks

Jumbo receive tuning on integrated controllers enabled PTHRESH without
a nonzero HTHRESH, contrary to the hardware programming requirements.
It also covered only the integrated MAC generations present when the
workaround was added.  Enumerate every jumbo-capable ICH and PCH type
and program PTHRESH=3 with HTHRESH=1.  Linux fixed the same HTHRESH
omission in b701cacdbcfb.

The 82574 path combined threshold values with the reset values using
bitwise OR.  Requesting WTHRESH=4 while the reset value was one thus
programmed five.  Clear the complete threshold fields before installing
the established PTHRESH=32, HTHRESH=4, WTHRESH=4 descriptor-granularity
policy.

MFC after:      2 weeks

iflib requests transmit completion status only on selected descriptors.
Program a zero writeback threshold so igb hardware honors those sparse
RS bits instead of writing back every descriptor in threshold-sized
batches.

Use the existing family specific prefetch threshold: eight descriptors
on most controllers and 20 on I354, with a host threshold of one.  These
values match the Intel-derived Linux and DPDK drivers.  Their nonzero
writeback settings are not appropriate here because those drivers set
RS on every packet.

A zero writeback threshold also avoids depending on interrupt timer
flushes affected by 82576 specification update erratum 26.  Remove the
old IGB_TX_WTHRESH macro as well.  It has had no callers since the iflib
conversion, so its 82575 conditional no longer implements any policy.

MFC after:      2 weeks

82576 specification-update erratum 26 says MSI-X EITR expiration can
fail to trigger receive descriptor writeback.  A WTHRESH above one can
therefore leave received packets invisible until the threshold fills.

The shared threshold macros selected policy by enum ordering, so an
82576 VF fell into the generic WTHRESH=4 case.  VFs always use MSI-X
and require the same WTHRESH=1 workaround as the PF.

Use PTHRESH=8 for 82575 and 82576 PFs and VFs, matching DPDK and the
current Linux PF driver.  The legacy FreeBSD PF and Linux igbvf value
of 16 thrashes limited descriptor cache; no specification or erratum
requires it.  Retain the i354 PTHRESH=12 exception.

Enumerate every supported igb PF and VF MAC type so each receives its
intended policy.  Also clear every threshold bit before installing the
new values.  The old mask retained the high WTHRESH bit, and 82575
uses six-bit fields while later controllers use five-bit fields.

MFC after:      2 weeks

The transmit-ring setup was copied from the e1000 path.  On I225
and I226, bits 22 through 24 are reserved and bit 25 enables the
queue; it is not a legacy low-water threshold.  Correct the field
masks, remove the nonapplicable legacy definitions, and program only
defined fields.

Use PTHRESH=8 and HTHRESH=1.  Keep WTHRESH at zero so the hardware
honors sparse RS descriptors issued by iflib.  Linux and DPDK use a
writeback threshold of 16, but request status on every packet.  A
nonzero threshold makes hardware ignore individual RS bits and is
unsuitable for the iflib completion model.

The receive-ring setup likewise used a magic mask that left bit 20
of the five-bit WTHRESH field untouched.  Define the receive threshold
fields and replace them exactly before installing the established
PTHRESH=8, HTHRESH=8, WTHRESH=4 policy.

MFC after:      2 weeks

PTHRESH controls when the device prefetches transmit descriptors,
HTHRESH controls how many host descriptors must be ready, and WTHRESH
controls completion writeback batching.

iflib places RS on selected descriptors and reclaims through those
checkpoints.  The data sheets require WTHRESH to be zero when software
uses RS.  Clear WTHRESH while retaining the established PTHRESH 32 and
HTHRESH 1 fetch policy.

This also follows DPDK in pairing sparse RS descriptors with
WTHRESH zero.  DPDK defaults to 32/0/0, while Linux ixgbevf uses
32/1/8.  The 32/1/0 setting preserves FreeBSD's prefetch policy and the
data-sheet requirement that HTHRESH be nonzero when PTHRESH is used.

MFC after:      2 weeks

ixv uses one queue set on 82599 and X540 VFs and assumes two on
X550-family VFs.  The PF reports the queues assigned to each VF with
GET_QUEUES after mailbox API 1.1 negotiation.

Query the PF during attach.  Bound symmetric iflib queue sets by the PF
grant and available MSI-X data vectors.  Retain one queue set per data
vector: ixgbe VFs expose at most three vectors and one is reserved for
the mailbox.  The hardware permits each pool to use a subset of its RSS
queues, so a two-queue ceiling is valid when the PF assigns four.

This enables the second data vector on 82599 and X540 while avoiding an
assumed second queue when an X550-family VF is granted only one.  Keep
the existing family limits if the mailbox is unavailable or the PF uses
an older API.

MFC after:      2 weeks

iflib clears IFF_DRV_RUNNING before the driver stop callback but leaves
IFF_DRV_OACTIVE set.  Consequently, an already queued admin task can
run after the VF reset.  If that task consumes a pending timer sample,
it can retry failed VLAN mailbox operations and restore PF filters for
the stopped VF.

Continue sampling statistics, but only run the VLAN retry worker while
the interface is running.

Expose the cached per-VF configuration through the iflib VF status
method.  Report mailbox handshake state, MAC address, access or trunk
VLAN mode, hardware queue count, administrator policy, and MDD blocking
state without issuing mailbox requests or reading hardware registers.

ixgbe: Report SR-IOV VF status

Expose cached VF configuration, policy, and runtime state through the
iflib VF status method.  Include access or trunk VLAN mode, the queue
count selected by the current virtualization mode, negotiated mailbox
API, whether traffic is enabled, and the MDD-blocked and quarantine
state.

The query runs under the iflib context lock and does not issue mailbox
requests or read hardware registers.

ixgbe: Add missing mailbox API 1.6 definition

The SR-IOV status change reports mailbox API 1.6 but omitted its enum
definition, leaving main unable to compile.

API 1.6 is an established ixgbe mailbox wire revision.  Add it at the
end of the revision enum, before the unknown sentinel as required by
the stable numbering contract.  Naming the revision does not enable
negotiation or operations which will come with the E610 support.

Reported by:    Herbert J. Skuhra <herbert@gojira.at>
Fixes:  https://cgit.freebsd.org/src/commit/?id=c30021fe0df9 ("ixgbe: Report SR-IOV VF status")

video: add generic video(4) capture framework

Add a new video(4) framework that provides /dev/videoN, buffer
management, mmap lifetime, and V4L2 ioctl dispatch for video capture
drivers. Hardware drivers implement struct video_hw_ops callbacks
and use video_buf_acquire/write/done to deliver frames.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58367

video: disable the static assertions for now

The previous version of this work included the definitions but
not the static asserts.  It's tripping up in some CI builds, likely
due to compat API building.

Since this isn't any more or less broken than before, disable the
static assertions until we figure out a proper path for this.

Fixes: https://cgit.freebsd.org/src/commit/?id=9c9428825f4c55e3cb37412c661bb9d385db4c68 (video: add generic video(4) capture framework)

Replaced the monolithic cdevsw implementation with the video(4)
framework.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58368

Replaced the monolithic cdevsw implementation with the video(4)
framework.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58369

Raising UVIDEO_NFRAMES_MAX from 40 to 128 in 3b6f833c95eb improved
throughput on xhci but made every camera on an ehci bus fail to
stream. Integrated webcams became unusable.

Measured on a MacBookPro9,2 with two ehci(4) FaceTime HD cameras and an
xhci(4) Logitech C920:

                          128            32
  ehci, 12 captures       0 ok           12 ok
  xhci 1920x1080          5 fps           5 fps
  xhci 1280x720          10 fps          10 fps

Fixes:          https://cgit.freebsd.org/src/commit/?id=3b6f833c95eb

Reviewed by:    bapt
Differential Revision:  https://reviews.freebsd.org/D58501

Disabled the IR DMA channel on the error path, which clears the flag and
frees the descriptor blocks before the chunks go away.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58502

Reviewed by:  adrian, bapt
Differential Revision:  https://reviews.freebsd.org/D58503

Fix two small bugs affecting the event parsing of AMD L3 counters.
AMD's manual and JSON disagree about the naming scheme on recent
processors.  I use the naming scheme present in the recent PPRs to be
consistent, so in the JSON parser we rename 'allslices' to 'allsources'
just as we already do with sliceid and sourceid.  Also ensure that we
parse the 0x prefix present in the newer JSON files.

Reviewed by:    mhorne
Sponsored by:   Netflix
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2180

A link flap left nothing in the log to work from.  Both the link up and
link down messages were gated on bootverbose while the message for a
speed change that keeps carrier was not, so a default kernel was silent
about a flap yet loud about a downshift -- the inverse of what an
operator wants.  The generic message from if_link_state_change() carries
no speed, so gating the driver's own left the negotiated rate
unrecorded.  Report both transitions unconditionally.

Say more than the rate.  aq_hw_get_link_state() already negotiates flow
control and throws it away, and Atlantic 2 reports duplex and EEE in the
same link status word the rate comes from; decode them through a new
get_link_info firmware op and name all of it on the up transition.  EEE
matters for a flap: low power idle transitions are a common source of
marginal link trouble on multi-gigabit copper, and whether it was active
is otherwise invisible.

Give the down transition a cause.  The PHY global fault code was only
consulted from the thermal state machine, so an ordinary link loss
reported nothing at all.  Read the fault code, the firmware link state
and the PHY temperature once per transition and append whatever is
available.  The firmware raises a fault one poll after it drops the
link, so a thermal trip usually shows only its temperature here and
aq_thermal_poll() names it on the following poll; the temperature alone
is enough to separate a hot PHY from a cable event.

Warn before the PHY trips rather than only after.  The Atlantic 2 health
monitor word carries a hot warning bit next to the ready and fault bits
that nothing decoded.  Report both edges of it from the thermal poll, so
an adapter that is approaching its shutdown threshold says so while the
link is still up.

Expose the firmware's own link transition counters.  The Atlantic 2 A0
statistics layout opens with link_up and link_down, which were read out
of the firmware on every statistics poll and discarded.  Publish them as
dev.aq.N.fw_link_up and fw_link_down so a single flap can be told from a
link that has been flapping all night.  The B0 layout has no equivalent,
so the op reports ENOTSUP there and the nodes are not created, matching
how the temperature node is handled.

Stop announcing a link state that was never read.  The return value of
aq_hw_get_link_state() was discarded, so a failed read would have been
announced as link down.  No firmware backend can fail that call today --
all three decode a register with no error path -- but the caller no
longer depends on that, and it says so once if it ever starts failing.

Report the hardware failures that were being discarded.  The driver
already reports the errors it keeps, so what stayed quiet was the set of
calls whose result was never examined at all.  None of these are
expected to fail, which is precisely why a failure needs to say so: each
one leaves the interface running but misconfigured in a way that
presents as a network problem rather than a driver problem.  aq_if_init()
discarded aq_hw_start(), aq_hw_rss_hash_set(), aq_hw_rss_set() and
aq_hw_udp_rss_enable(), so a datapath that never started or an
indirection table that was never programmed showed up only as an
interface that passes no traffic or delivers every flow to one queue.
aq_mc_filter_apply() discarded aq_hw_mac_addr_set(), so a multicast
address the stack believes is programmed could silently not be; report
the address that failed and leave the filter slot for the next one
instead of burning it.  aq_update_vlan_filters() reported only the last
of its three register writes.  aq_if_stop() discarded both ring stop
calls and the MAC reset, and a MAC that did not reset can still be
mastering the bus.  aq_if_detach() and aq_if_suspend() discarded
aq_hw_deinit().  The interrupt moderation update on a link speed change
was dropped as well; it runs only on a transition, so reporting it
cannot become noisy.

aq_if_attach_pre() discarded aq_hw_capabilities(), which is the only
behavioral change here: it now fails the attach rather than continuing
with an unset media type and an empty link speed mask, which would
attach an interface that can never negotiate a link.  It returns an
error only for a device the probe table does not cover, so it is not
reachable in practice.

Document the resulting sysctls, along with the existing temperature and
tracing nodes, which had no manual page coverage.

Tested on an AQC113C (Atlantic 2 B0, firmware 1.5.38).  Link up reports
"speed=10000, full-duplex, flowcontrol none, EEE off", and "speed=1000"
after a forced renegotiation, so the rate and duplex are read rather
than assumed.  A cable pull reports "link DOWN, F/W link state 0, temp
59 C" with the PHY fault clause correctly absent, which is what
separates a cable event from a thermal trip.  The B0 interface reports
ENOTSUP for the link counters, so those two nodes are correctly not
created.  Traffic is unaffected: ten flows spread over all eight RX
queues with no errors and no drops.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58749

Signed-off-by: Nick Price <nprice@FreeBSD.org>

A VF reset can sanitize its retained queue registers even when the PF
does not complete the cooperative mailbox handshake.  Keep those two
states separate.  Do not program or enable the rings until both queue
sanitation and mailbox initialization have succeeded.

Report either initialization failure to iflib so the interface remains
stopped.  Stopped admin and media-status passes now publish cached
link-down state without polling the mailbox.  While the VF remains
administratively up, retry complete initialization after 250 ms, one
second, four seconds, and then at a capped eight-second interval.
Conditional iflib reset requests ensure an intervening administrative
down cancels a queued retry.

Avoid a redundant mailbox reset in the stop half of an immediate iflib
reinitialization; the following init performs the required reset.
Preserve the reset on an ordinary administrative stop and keep the
existing bounded queue-sanitation retry policy independent from
mailbox liveness recovery.

iflib: restore TX watchdog functionality

Since f6afed726b00 the TX-hang check in iflib_timer() has required a
queue state other than IFLIB_QUEUE_IDLE, but nothing ever sets
IFLIB_QUEUE_WORKING, so IFLIB_QUEUE_HUNG has been unreachable ever
since: stalled TX queues are not detected, not reported, and not
reset - the TX watchdog of every iflib(4) driver has been dead code.

Instead of resurrecting the queue-state machine, detect the hang
directly.  A transmit queue is frozen while it holds descriptors the
hardware has not reported as completed and none were reclaimed over a
timer period.  Being frozen is not a fault: the hardware may defer
marking descriptors as completed indefinitely.  The check therefore
arms only when a frozen queue also takes on new work, while the link
is up, no pause frames were received and no doorbell is pending; and
it acts only after the queue has stayed frozen for
net.iflib.tx_watchdog_periods consecutive periods.  It then asks the
hardware through the driver's read-only credits peek
(isc_txd_credits_update with clear=false, the same call the mp_ring
can_drain callback makes routinely): if completions are ready but were
not harvested for this long, the completion interrupt went missing -
kick the queue's task instead of resetting; if the hardware reports
nothing although the queue kept receiving work, it is hung and the
existing watchdog reset machinery takes over.

Neither software counters alone nor mere persistence of unharvested
work can make this decision.  iflib reclaims lazily (up to
isc_tx_nsegments completed descriptors stay unharvested indefinitely)
and defers report-status requests, so "descriptors in use" and "no
cleaning progress" are normal states of an idle healthy queue.  And
hardware that coalesces completion reports (e.g. 8254x,
TXDCTL.WTHRESH) legitimately withholds the last one of a quiet queue
indefinitely, so a zero credits peek is a normal idle state, not a
hang indicator: arming on persistence alone reset healthy interfaces
on every traffic lull (field-tested on 82541PI).  Only growth across
frozen periods separates a wedged queue from a coalescing one.  The
threshold is a threshold in time, not in device work: a period is one
iflib_timer interval (hz/2 by default), so at the default of four
periods the verdict falls after roughly two seconds.  It was
calibrated from counter traces on that old and slow hardware, where
healthy coalescing always cleared within two periods; newer hardware
reports completions far sooner and leaves the frozen state earlier, so
the default needs no recalibration for more modern devices.  Setting
the sysctl to zero disables the check.

A queue whose link is down is never flagged - preserving what
f6afed726b00 fixed.

The new per-queue state goes into padding the transmit queue structure
already had, rather than next to the counters it is derived from: that
region is packed, so an insertion there would grow the structure.  What
is left of that padding is now spelled out instead of being implicit.
The size of the structure is unchanged on amd64, arm64, riscv64, i386
and armv7.

The IFLIB_QUEUE_* states no longer participate in the watchdog
decision; they will be removed in a followup commit.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220997, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239240
Fixes:          https://cgit.freebsd.org/src/commit/?id=f6afed726b00 ("iflib: Prevent watchdog from resetting idle queues")
Suggested by:   gallatin (mxge-style detection)
Reviewed by:    adrian, markj
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58266
Assisted-by:    Claude Code (Fable 5, Opus 5)

iflib: remove the unused TX queue state machine

The previous commit stopped using ift_qstatus and the IFLIB_QUEUE_*
states for the TX watchdog decision, leaving only dead stores.
Remove the field, the states, and all assignments.  The byte the
field frees stays behind as explicit padding.  No functional change.

Reviewed by:    gallatin, markj
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58282
Assisted-by:    Claude Code (Fable 5, Opus 5)

iflib: clear the deferred TX descriptor state when a queue is stopped

Stopping an interface frees the queued mbufs and zeroes a transmit
queue's descriptor accounting, but the three counters that track
descriptors deferred to a later doorbell write or report-status
request are not cleared there: they only reach zero when the code
that acts on them runs.  After a reset they therefore describe
descriptors that no longer exist, until enough new traffic flushes
them.

The consequences are small - one doorbell written from a stale
count, and a report-status request on the first packet after the
reset - but the state is simply wrong, and the transmit-hang check
in iflib_timer() reads one of them.

MFC after:      1 week
Assisted-by:    Claude Code (Opus 5)

A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet.  If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.

Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.

Fixes:          https://cgit.freebsd.org/src/commit/?id=de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by:    pouria, glebius
Reported by:    Yunzhi Ke
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58559

pfsync interfaces do not have ifp->if_inet6 set, so when we update the
MTU for those interfaces we panicked.

Add an explicit check for this. This should be temporary, until pfsync
is no longer a struct ifnet (as we've already done for pflog).

Reviewed by:    glebius
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58701

pfsync packets were allocated with m_get2(), which can't return packets
larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work.

Use m_get3(), which can allocate sufficiently large mbufs.

Extend the pfsync:bulk test case to provoke this problem.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297307
MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")

ifconfig: Add SR-IOV VF status output

- Adds SR-IOV VF status to the existing ifconfig "-v" output
- Adds ioctl command for reporting VF status info from drivers
- Adds support to iflib for drivers to handle this new ioctl
- Add support for ioctl in ixl(4)

Signed-off-by: Eric Joyner <erj@freebsd.org>

Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D19647

iflib: Avoid locking for unsupported VF status queries

ifconfig -v requests SR-IOV VF status from every interface.  iflib
previously acquired the context lock before dispatching the request even
for VFs and drivers using the default unsupported method.  Mailbox work
on a VF could therefore delay the complete interface listing.

VF status describes the children of an SR-IOV PF.  Reject requests on
VF contexts and classes using the default method without taking the
context lock.  Keep the lock for actual PF status providers.

Fixes:  https://cgit.freebsd.org/src/commit/?id=1ccf543b21ef ("ifconfig: Add SR-IOV VF status output")

Honor RTEXT_FILTER_VF on RTM_GETLINK requests and expose the versioned
SR-IOV VF status through typed nested FreeBSD attributes.  Report
IFLA_NUM_VF with a successful requested query and preserve per-provider
errors in the status container.

Map the common nvlist schema to native integer, boolean, string, and
binary attributes.  Carry namespaced driver extensions as packed
versioned nvlists so adding a driver-specific field does not expand the
common netlink ABI.

Add SNL parsers, parser verification, a constructed nested-status test,
and an RTM_GETLINK test for an interface without SR-IOV support.
Document the query contract and every attribute.

Populate stand/libsa/bootp.c's bootp_response global from the UEFI PXE
Base Code Protocol's cached DhcpAck, so bootp() can enter RFC 2131
INIT-REBOOT and skip DISCOVER/OFFER instead of running a fresh DHCP
transaction after the firmware has already done one.

It should give DHCP servers more information for proper responses.

During flag inconsistency report, we handle rai->rai_otherflg
as a bool, but the value is 0x40. Make it a simple number comparison.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295995
Reviewed by:    markj, Faraz Vahedi <kfv@kfv.io>
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58672

niov2 returns the number of entries in the iovec starting at offset
"offset".  Here we are unconditionally setting it to 1, which of course
isn't right.

Fixes:          https://cgit.freebsd.org/src/commit/?id=a28cf86c4171 ("bhyve/virtio: Rework iovec handling functions for efficiency and clarity")
Reported by:    Claude and Ada Logics
Reviewed by:    Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58625

bsdinstall: add a hardening knob for unprivileged kenv access

It makes sense.

Reviewed by:    zleei
Differental Revision:   https://reviews.freebsd.org/D57755

kern: fix oversight in security.bsd.unprivileged_kenv_read

It was intended that one could close the hole back in loader, but the
sysctl was actually not marked TUNABLE.  The hardening menu option thus
did nothing, because we wouldn't read the value from kenv.

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=6e81fbf5833d ("bsdinstall: add a hardening knob [...]")
Fixes:  https://cgit.freebsd.org/src/commit/?id=4fd518fcb2bb ("kern: add a security knob to disable [...]")

We can probaby consider these kernel bugs, in which case asserting is
not the most helpful thing we can do.  Let's emit the necessary details
to stderr and exit non-zero to aid debugging these without completely
blocking the ability to export all of the well-formed metrics.

Reviewed by:    rew
Differential Revision:  https://reviews.freebsd.org/D57983

PeriphID and CellID values are determined by macros which take an
index. They currently receive a bus offset which has a stride of 4 bytes.
This causes the ID1-3 registers to report incorrect values.
Scale the offset before passing it to the macro to fix this.

Tested with kvm-unit-tests/arm/pl031.

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>

Reviewed by:    jrtc27
Fixes:          https://cgit.freebsd.org/src/commit/?id=014d7082a239 ("bhyve: Implement a PL031 RTC on arm64")
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2358
Closes:         https://github.com/freebsd/freebsd-src/pull/2358

Add -L to query the generic packed-nvlist IOV_GET_STATUS interface.
Report PF enable state and configured and total VF counts.  For each VF,
print its PCI address, newbus attachment, bound driver, and ppt state.

Retry size negotiation if the topology changes between ioctls and reject
malformed or incompatible status records.

Keep NIC-specific operational state in ifconfig -v; iovctl owns the
device-neutral PCI topology and applies to any SR-IOV device class.

Relnotes:       yes

- Prefix all structs with the struct keyword to avoid collisions between
  the types and variables with the same "name".
- Use `_` suffixed variables in initializers to distinguish input
  parameters from public members [1].

Resolve some trailing whitespace issues while here.

NOTE: this doesn't resolve the -pedantic issue reported by g++ with
`pmchdr_cpuidinfo::cpuid` about the field being a flexible array in an
otherwise empty struct.

1. I generally do this the other way around, i.e., suffix private/protected
   members with `_`, but these are public members in structs and I don't want
   to introduce a lot of churn in calling code.

Reported by:    g++14 with FreeBSD CI (powerpc64 tinderbox)
Fixes:  https://cgit.freebsd.org/src/commit/?id=ce6ab51f ("pmc: enable the new pmc commands")

This mutes a number of complains from g++ about needing specific headers
for functionality related to C strings and other function prototypes.

Reported by:    g++ 14

When fts_children() is called, sp->fts_child is set. On the
next fts_read() call, fts_safe_changedir() was incorrectly
passed p->fts_dirfd (pointing to the parent directory) instead
of -1. This caused fts to fchdir to the parent instead of the
child directory, silently skipping the contents of 3rd-level
subdirectories. This was observed as a failure in
nmtree_test:mtree_create which calls fts_children() internally.

Add regression test accpath_correct_after_descent that calls
fts_children() on each directory entry and verifies files at
depth 3 are still visited correctly. The test fails with the
unfixed libc and passes with the fix.

Reported by:    Herbert J. Skuhra <herbert@gojira.at>
Sponsored by:   Google LLC (GSoC 2026)
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=4bd01d6ae01 ("fts: refactor to use fd-relative")
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2354

libifconfig: Add an SR-IOV VF status query

Provide a public helper which retrieves, unpacks, and validates the
versioned VF status nvlist.  Validate the required VF indices and the
shape and version of driver-specific extension namespaces while allowing
unknown optional fields.

The ioctl argument is not copied back when the command returns EFBIG.
Start with a practical buffer and grow it geometrically rather than
relying on the required length being observable.

Use the helper in ifconfig so other consumers share the same transport
and validation behavior.

rescue: Satisfy libifconfig's libnv dependency in crunched links

libifconfig now calls nv(9) routines for the SR-IOV VF status query, so
crunched builds that link the static library must also provide libnv.

The per-program CRUNCH_LIBS_ifconfig hook cannot do this: crunchgen
partially links per-program libraries into the program object and
crunchide then localizes every symbol except the stub entry, so members
absorbed there cannot satisfy references from another archive on the
final link's library list.

List libnv globally next to libifconfig.a in rescue(8) and bsdbox. This
also makes the existing per-program libnv links redundant; remove them
to avoid embedding private localized copies in the crunched binary.

Fixes:  https://cgit.freebsd.org/src/commit/?id=2d6114f6d26b ("libifconfig: Add an SR-IOV VF status query")

On powerpc64le with IEEE-128 long double, the long-double compiler-runtime
helpers are the *kf* soft-float functions (built from the tf sources,
renamed via -D in lib/libcompiler_rt/Makefile.inc) plus the complex
multc3/__divtc3. They are compiled into libgcc_s.so by the powerpc64le
SRCF block, but were never added to Symbol.map, so they stayed local and
unexported.

Every other IEEE-128 architecture already exports its scalar long-double
runtime -- aarch64 and riscv list the tf helpers in GCC_4.6.0. powerpc64le
was simply missed.

Because the helpers are unexported, any clang-built shared library that uses
long double leaves them undefined (permitted in a DSO), and linking an
executable against that DSO then fails under lld's default
--no-allow-shlib-undefined. For example science/harminv fails to link its
binary against its own libharminv.so with undefined multc3/divtc3; at
-O0, mulkf3/addkf3/__subkf3/__unordkf2 appear as well.

Export the full runtime, gated on the PowerPC-specific LONG_DOUBLE_IEEE128
predefine so no other architecture is affected: complex multc3/divtc3 in
GCC_4.0.0 (beside the other complex mul*c3), and the 28 scalar *kf*
functions in GCC_7.0.0. Node placement follows glibc/gcc symbol-versioning
history.

Differential Revision:  https://reviews.freebsd.org/D58248

Commit 4d80d4913e79 added a check for nfsess_defunct already
being set.  This was incorrect because, once set, nfsess_defunct
remains set and an additional recovery might be needed.

This patch reverts this part of 4d80d4913e79.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297252
Suggested by:   olivier
MFC after:      3 days
Fixes:  https://cgit.freebsd.org/src/commit/?id=4d80d4913e79 ("nfs: Fix argument typo to avoid a crash")

Delegations in NFSv4.0 never worked well and, since
the NFSv4.0 protocol is now deprecated, use of delegations
for NFSv4.0 is disabled as far as the client can do so.

It turns out that some Illumos NFSv4.0 server issues
delegations anyhow (even when the callback path is
specified as 0.0.0.0) and this can cause use after free
problems.

This patch deleted some cruft that did an nfsrpc_openrpc()
call recursively when an NFSv4.0 server failed to issue
a delegation when it had previously done so.
This code was only meant to be an optimization and
would have been rarely exercised.  Since this recursive
call of nfsrpc_openrpc() is in some of the backtraces
in the bugzilla PR, getting rid of the cruft makes sense.

It is not known if this helps w.r.t. the use after free
problems at this time.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297233
MFC after:      3 days

This addresses a race when two vnodes attempt to call vfs_hash_insert(),
but only one succeeds. Also, in case of an error from
p9fs_reload_stats_dotl(), it marks the vnode for deletion.

Reviewed by:    kib
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58632

Since autofs_lookup() calls into autofs_trigger_vn() to perform
automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
for the unmount to start meantime.  Then autofs_trigger() accesses freed
memory.

At this point, busy can be only done unblocking, and the transient
failure must abort the trigger operation.  This would cause spurious
automounter errors, but at least should prevent accesses to the freed
memory.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294361
Reviewed by:    markj, rew
Tested by:      rew
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58626

This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.

MFC after:      1 week
Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D58359

Do the advisory aborts of the in-flight requests before flushing the
vnodes.  It should mostly eliminate the waits due to requests busying
the mp.

Reported and reviewed by:       rew
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58637

For pdwait(2) and pddupfd(2), the returned error is kept EINVAL.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297293
Reviewed by:    lwhsu, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58666

Drivers which remap PF queues need a stop/mutate/restart transaction
only when the interface has live queues. Permit their IOV
initialization callback while the interface is administratively down
and leave it down afterward.

This restores the standard boot-time iovctl.conf workflow for igb and
lets other opt-in drivers configure VFs before netif brings the PF up.

MFC after:      1 week

Also add vnode locking wrappers for lockcanrecurse(9) and
lockdisablerecurse(9).

Reviewed by:    jah
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58567

For some complex nullfs mount configurations, it is possible to get the
covered vnode lock for the mount shared with some inside-mount vnode
lock.  Then at unmount time, vflush() would recurse on the covered vnode
lock when reclaiming the vnode.

Work around it, by temprorarily allowing recursion on the covered vnode
lock.  Disable recursion after the unmount if it was not enabled before.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297174
Reviewed by:    jah
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58567

Fixes:                https://cgit.freebsd.org/src/commit/?id=ed85203fb7a0 ("vmm: Deduplicate VM and vCPU state management code")
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58697

It matches our IEEE80211_ELEMID_HTINFO, that is already in use.

Found with:     clang -Werror=assign-enum

Killing a knote releases its file reference, and releasing the last one
runs the close path inline.
 panic: _mtx_lock_sleep: recursed on non-recursive mutex ttymtx

Revoking a controlling tty during exit reaches this whenever a knote is
still registered on it.

Released the knlist lock around the drop and restart the walk.
The knote stays valid while the lock is released.

MFC: 1 week

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58681

iflib counts resets initiated by its transmit watchdog in 69c3e0de01c1.

Export the counter in the per-device iflib sysctl tree so every
driver provides the diagnostic without a driver callback or duplicate
storage.

A watchdog reset does not establish how many packets failed.  It can
recover a hardware stall involving several queued packets or a missed
completion involving no packet loss.  Stop adding one output error per
watchdog event in em(4), igb(4), and igc(4).

Remove the redundant driver counters and move the diagnostic to
dev.<driver>.<unit>.iflib.tx_watchdog_events.

MFC after:      1 month
Relnotes:       yes

pci: Add SR-IOV status reporting

Add a generic packed-nvlist status query to each /dev/iov/<PF>
control device.  Report the live VF Enable state, configured and total
VF counts, and one record for each configured VF.

Each VF record contains its PF-local index, computed PCI location,
newbus attachment state, attached driver, and ppt binding.  Construct
records for hardware VFs whose newbus child is absent so attachment
failures remain visible.

Version the extensible schema in sys/iov.h.  Use fixed-width request
fields so the ioctl command and layout are identical for 32-bit callers.
Serialize the topology snapshot with Giant, then pack and copy it after
releasing Giant.

pci_iov: Use native types for status ioctl

IOV_CONFIG and IOV_GET_SCHEMA expose native pointers and size_t
lengths, and pci_iov has no compat32 ioctl translation.  Using
fixed-width fields for IOV_GET_STATUS alone does not make the
interface usable by 32-bit binaries on a 64-bit kernel.  It instead
complicates otherwise ordinary pointer and length handling.

Use void * and size_t like the existing ioctls.  This also makes the
%zu diagnostic in iovctl correct on ILP32 and removes the unneeded
PTRIN conversion.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6f8b3be1fbd6 ("pci: Add SR-IOV status reporting")

Google Cloud recommends migrating from gsutil to gcloud storage CLI.
Update gce-do-upload target to use `gcloud storage buckets create` and
`gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands.

PR:             conf/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297016
Reviewed by:    lwhsu
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D58464

pdwait's capsicum/enotcap and procdesc's pdopenpid_capmode enter capability mode.
Require security_capability_mode (and security_capabilities for enotcap) so the
cases skip cleanly on kernels built without CAPABILITIES instead of failing.

Approved by:    asomers, gallatin
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58545

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

manuals: Fix Fx and nearby mechanical typos

Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.

The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Another, FreeBSD Foundation
was misrepresented as an operating system version instead of an author.
Two more had other parts of the sentence supplied as an argument to Fx.

While I had those open, fix the other mechancial typos visible on those
specific screenfulls. Fix a list width glitch, correct section typo
AUTHOR to AUTHORS, and switch AUTHORS sections containing prose to
prose-mode so that they wrap freely when rendered.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297248
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=d39e310c7d6a ("man/man3: add stdbit.3")
Fixes:          https://cgit.freebsd.org/src/commit/?id=d790b16bbf0c ("add man pages for stdbit functions")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b61850c4e6f6 ("net.link.bridge.member_ifaddrs to false")
Reported by:    wosch (groff is complaining about incorrect Fx usage)

manuals: Fix more Fx and nearby mechanical typos

Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.

The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Others had other parts of
the sentence supplied as an argument to Fx.

While here, fix the other mechanical typos visible on those specific
screenfulls. Correct section typo AUTHOR to AUTHORS, markup utilities
with Sy, and apply line break after the end of a sentence.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297248
MFC after:      3 days
Reported by:    wosch (are you sure that's all of the broken Fx'es?)
Fixes:          https://cgit.freebsd.org/src/commit/?id=ff2bc641599a ("Fix Fx and nearby mechanical typos")
Fixes:          https://cgit.freebsd.org/src/commit/?id=d790b16bbf0c ("add man pages for stdbit functions")
Fixes:          https://cgit.freebsd.org/src/commit/?id=6c57e368eb17 ("implement C23 memalignment()")
Fixes:          https://cgit.freebsd.org/src/commit/?id=b06338167d64 ("ROUTE_MPATH and FIB_ALGO")
Fixes:          https://cgit.freebsd.org/src/commit/?id=7e1affa242ca ("revise divert-to and divert-reply")

MFC after:    1 week

Release notes at
        https://community.nlnetlabs.nl/t/unbound-1-26-0-released

Merge commit '84ffc29dc8ddb0c946db5cb3b3c1310bec6a9e6c'

Reviewed by:  markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58634

Found with:   clang -Werror=assign-enum

This was a good idea, but we don't build metapackages in the kmods
repo so it ends up breaking the release build.  I might resurrect this
change if/when the kmods repo includes the wifi-firmware-kmod
metapackage.

This reverts commit bda8028146694ee490543b35e3349e060936fde4.

MFC after:      1 second