This is a display of mostly-automatically-classified git commits from 2026-08-03 to 2026-08-09.
Table of contents and commits per category:
| (8) | Highlighted commits (these are copies, not in stats) | |
| 2 | 1.4% | Userland programs |
| 7 | 5.1% | Documentation |
| 74 | 53.6% | Hardware support |
| 11 | 8.0% | Networking |
| 11 | 8.0% | System administration |
| 4 | 2.9% | Libraries |
| 6 | 4.3% | Filesystems |
| 12 | 8.7% | Kernel |
| 1 | 0.7% | Build system |
| 0 | 0.0% | Internal organizational stuff |
| 3 | 2.2% | Testing |
| 3 | 2.2% | Style, typos, and comments |
| 3 | 2.2% | Contrib code |
| 1 | 0.7% | Reverted commits |
| 0 | 0.0% | Unclassified commits |
| 138 | 100% | total |
| Technical notes about this page |
For extra visibility, these are copies of commits found in
other sections. Most (if not all) come from the commit message
containing "Relnotes:", or commits modifying
UPDATING.
The SR-IOV schema advertises MAC anti-spoofing and enables it by default, but the VF configuration was never consumed and the hardware policy remained disabled. Record the configured policy and apply MAC and VLAN anti-spoofing throughout VF initialization and reset. On X550-family devices, also protect the LLDP and flow-control Ethertypes and enable per-VF spoof-event accounting. Remove the driver-owned state during SR-IOV teardown. Adapt the anti-spoof configuration lifecycle used by igb(4) in a2ed165f0049 to the ixgbe hardware controls. MFC after: 1 week Relnotes: yes
The VF VLAN capability is checked but never granted, and no SR-IOV configuration property exposes the existing default-VLAN support. PF VLAN updates also replace VFTA registers from a PF-only shadow, erasing live VF filters. Expose access VLAN and trunk policy through the IOV schema. Track each VF VLAN as desired state, restore the administrative VLAN after reset, and use the native VLVF helper for incremental PF and VF ownership changes. Keep VLAN filtering enabled while SR-IOV is active. When PF hardware filtering is disabled, admit every VLAN to the PF without bypassing per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and VF desired state after reset or a filtering-mode transition, and restore PF-only state on teardown. When the last VF leaves a VLAN still owned by the PF, free its VLVF slot while retaining the shared VFTA bit. This prevents a trunk VF from exhausting the 64-entry VLVF table by cycling VLAN memberships. Adapt the VLAN ownership model introduced for igb(4) in a2ed165f0049 to ixgbe's native VLVF machinery. Match Linux receive semantics by exposing a stripped VLAN tag only when that VID was registered by the VF. A PF-assigned port VLAN is an administrative tag and must be delivered to the VF as untagged traffic; otherwise the stack dispatches it to a nonexistent VLAN interface and access-VLAN receive traffic is blackholed. MFC after: 1 week Relnotes: yes
The allow-promisc IOV property is advertised but ignored, and the PF rejects the xcast request used by modern VFs. Negotiate mailbox APIs 1.2 and 1.3, implement pool-scoped xcast modes, and require allow-promisc for requested all-multicast or unicast-promiscuous modes. The VF mailbox can carry only 30 multicast hashes. When ixv has a larger list, request the API 1.2 all-multicast xcast mode instead of extending the legacy SET_MULTICAST message. The PF grants that fallback only to VFs configured with allow-promisc; otherwise ixv reports that only the first 30 addresses are active. Reset xcast state with the VF and have ixv replay the mode implied by its interface flags after multicast updates. Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc policy adapted from igb(4) in a2ed165f0049. MFC after: 1 week Relnotes: yes
The PF advertises the legacy SET_MACVLAN mailbox request but always rejects it. The request installs secondary unicast addresses. Allocate an owned RAR pool for VF secondary addresses, reserve low entries for PF filters, and place VF-primary addresses at the top of the usable RAR range. Reject address collisions and cap each VF at three secondary filters so one guest cannot exhaust the shared table. Clear secondary filters on VF or PF reset and on SR-IOV teardown. This hardware can anti-spoof only the VF primary source address. Reject secondary filters while MAC anti-spoofing is configured, so installing them requires an explicit administrative policy choice. Report optional filter-table allocation failure without disabling SR-IOV. Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in a2ed165f0049 to DPDK's ixgbe SET_MACVLAN mailbox semantics. MFC after: 1 week Relnotes: yes
The shared X550 code provides malicious-driver detection, event decoding, and per-pool recovery operations, but the PF never enables or services them. A malformed VF descriptor can therefore go undetected and avoid the per-pool recovery path supplied by the MAC. Configure IOV state while VF DMA remains disabled, then enable MDD and activate the VFs only after PF queue initialization is complete. On an MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset epoch; PFVFTE can still permit descriptor fetches into the internal queue, so releasing WQBR early would allow a hostile VF to retrigger MDD before it resets. Send the non-CTS reset notification after servicing the VF mailbox. Let a posted VF request win mailbox arbitration, defer notification if the pass produced a response, and retry failed notifications from the periodic admin pass. Poll WQBR so recovery does not depend on another mailbox interrupt edge, while suppressing already-fenced pools. Latch a PF reset request until the next hardware initialization. The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS, which has reserved-zero bits, also reads as all ones and confirms dead MMIO. Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates, which hardware otherwise reports as queue-context changes. Serialize that window with the iflib context lock and resample pending work after MDD is restored. Apply the per-pool recovery model used by igb(4) in a2ed165f0049 to the existing DPDK-derived X550 hooks. The same register interface is documented for X552 and X553, so cover the entire X550 family. Document that VF traffic remains disabled until the reset handshake completes. MFC after: 2 weeks Relnotes: yes
iflib counts resets initiated by its transmit watchdog in 69c3e0de01c1. Export the counter in the per-device iflib sysctl tree so every driver provides the diagnostic without a driver callback or duplicate storage. A watchdog reset does not establish how many packets failed. It can recover a hardware stall involving several queued packets or a missed completion involving no packet loss. Stop adding one output error per watchdog event in em(4), igb(4), and igc(4). Remove the redundant driver counters and move the diagnostic to dev.<driver>.<unit>.iflib.tx_watchdog_events. MFC after: 1 month Relnotes: yes
- Adds SR-IOV VF status to the existing ifconfig "-v" output - Adds ioctl command for reporting VF status info from drivers - Adds support to iflib for drivers to handle this new ioctl - Add support for ioctl in ixl(4) Signed-off-by: Eric Joyner <erj@freebsd.org> Relnotes: yes Differential Revision: https://reviews.freebsd.org/D19647
Add -L to query the generic packed-nvlist IOV_GET_STATUS interface. Report PF enable state and configured and total VF counts. For each VF, print its PCI address, newbus attachment, bound driver, and ppt state. Retry size negotiation if the topology changes between ioctls and reject malformed or incompatible status records. Keep NIC-specific operational state in ifconfig -v; iovctl owns the device-neutral PCI topology and applies to any SR-IOV device class. Relnotes: yes
Commits about commands found in man section 1 (other than networking).
* On SIGINFO, print the current path to stderr rather than stdout. * Do so immediately, instead of the next time we finish a directory. * Document this behavior in the manual page. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296861 MFC after: 1 week Fixes: https://cgit.freebsd.org/src/commit/?id=d1588599c024 ("Report the next directory being scanned ...") Reviewed by: wollman Differential Revision: https://reviews.freebsd.org/D58702
Reviewed by: fuz, ngie Co-authored-by: Robert Clausecker <fuz@FreeBSD.org> Differential Revision: https://reviews.freebsd.org/D58727
Man pages, release notes, etc.
The CTL High Availablity clustering feature allows a pair of hosts to implement transparent failover. The implementation uses a TCP connection to exchange messages. There is no authentication mechanism and the protocol itself embeds kernel pointers in the messages exchanged between HA hosts. This property (of CTL_MSG_DATAMOVE messages specifically), as well as insufficient validation of inbound messages, mean that anyone able to access a CTL HA port is able to remotely execute code on that host. Provide a warning to this effect in the CTL man page. Reported by: Ryan of Calif.io Reviewed by: ziaee, ken, mav MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58622
Noted and reviewed by: lwhsu Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58666
Reviewed by: ziaee Differential Revision: https://reviews.freebsd.org/D58565
- Remove `\(em` from .Nm section as it's not valid mandoc markup. - Remove the section from the .Nm directive (it's handled under the .Dt directive). MFC after: 1 week Reported by: make manlint
Add missing commas after .Nm entries. MFC after: 1 week Reported by: make manlint
MFC after: 1 week Reported by: make manlint
MFC after: 1 week Reported by: make manlint
Hardware drivers and architecture-specific code.
Request the reset through iflib and let the admin task perform the stop/init under the context lock, matching what the VF and SR-IOV paths already do. The assertion is compiled out without INVARIANTS, where the same write instead resets the MAC and takes the ICH software flag while the queues stay live and an ioctl or the admin task may be running. While here also remove unnecessary em_if_init uses: iflib_if_init_locked() already runs after IFDI_RESUME and IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped IFDI_INIT that the following iflib_stop() undoes. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D58628
igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly. Request the reset through iflib instead, and skipping while the interface is down; the new value is picked up by the next init. Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag path, so the defect is silent here rather than an assertion failure. While here also remove unnecessary igc_if_init uses: iflib_if_init_locked() already runs after IFDI_RESUME and IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped IFDI_INIT that the following iflib_stop() undoes. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D58629
gpio: add generic Intel GPIO pin controller framework Add a platform-independent driver framework for Intel GPIO pin controllers found on modern Intel SoCs. The driver accesses GPIO pad registers through ACPI-provided memory-mapped resources and implements the gpio interface [1] including pin enumeration, capability reporting, configuration, and read/write/toggle operations. A common data model of communities and pad groups allows individual SoC-specific drivers to supply their own pad tables and ACPI hardware IDs while sharing all register-level logic. [1] https://wiki.freebsd.org/GPIO Reviewed by: vexeduxr MFC after: 1 week Sponsored by: Beckhoff Automation GmbH & Co. KG Pull Request: https://github.com/freebsd/freebsd-src/pull/2205
gpio: add Intel Alder Lake-N GPIO driver Add a GPIO driver for the Intel Alder Lake-N platform based on the generic intelgpio framework. The driver provides pad group definitions for four GPIO communities covering groups GPP_A through GPP_T, vGPIO and HVCMOS, and matches ACPI hardware IDs INTC1056, INTC1057 and INTC1085. The kernel module build infrastructure and the wiring into files.x86 are included. Reviewed by: vexeduxr MFC after: 1 week Sponsored by: Beckhoff Automation GmbH & Co. KG Pull Request: https://github.com/freebsd/freebsd-src/pull/2205
gpio: add Intel Tiger Lake-H GPIO driver Add a GPIO driver for the Intel Tiger Lake-H platform based on the generic intelgpio framework. The driver defines five GPIO communities with pad groups GPP_A through GPP_K, vGPIO and JTAG, and matches ACPI hardware ID INT34C6. The kernel module build infrastructure and the wiring into files.x86 are included. Reviewed by: vexeduxr MFC after: 1 week Sponsored by: Beckhoff Automation GmbH & Co. KG Pull Request: https://github.com/freebsd/freebsd-src/pull/2205
The VF admin vector carries both link and PF mailbox causes, but the filter schedules the admin task only for link-status changes. Defer administration for every interrupt so reset and control notifications are serviced promptly. MFC after: 1 week
The shared VF set-RAR helper restores hw.mac.addr when the PF rejects a requested address, but ixv ignores the error and leaves the interface link-layer address unchanged. Subsequent initialization repeats the rejected request while the interface appears to use an address the PF will not deliver. Refresh the permanent address returned by the PF after every successful reset handshake. Copy the resulting PF-approved address back to the interface and emit the normal link-layer address notification without re-entering the driver initialization path. This also recovers from a prior mailbox transport failure or a PF-side reassignment. Adapt the igb VF address reconciliation added in a6bb3850e7c6. MFC after: 1 week
The MTA is shared by the PF and all VFs. The VF mailbox handler only ORs new bits, so hashes survive list removal and VF reset. Conversely, PF multicast updates replace the whole table with PF-only state and discard live VF filters. Rebuild the table from the PF list and every active VF whenever either changes. Clear VF multicast state during reset and PF reinitialization, and remove all VF hashes on SR-IOV teardown. Keep the software shadow and multicast control state synchronized, and avoid writes to unchanged MTA registers. Adapt the aggregate desired-state rebuild introduced for igb(4) in a2ed165f0049 and its write-elision scheme from 350211ab1782 to ixgbe's shared MTA. MFC after: 1 week
ixgbe: enforce configured VF anti-spoofing The SR-IOV schema advertises MAC anti-spoofing and enables it by default, but the VF configuration was never consumed and the hardware policy remained disabled. Record the configured policy and apply MAC and VLAN anti-spoofing throughout VF initialization and reset. On X550-family devices, also protect the LLDP and flow-control Ethertypes and enable per-VF spoof-event accounting. Remove the driver-owned state during SR-IOV teardown. Adapt the anti-spoof configuration lifecycle used by igb(4) in a2ed165f0049 to the ixgbe hardware controls. MFC after: 1 week Relnotes: yes
ixgbe: preserve VLAN ownership with SR-IOV The VF VLAN capability is checked but never granted, and no SR-IOV configuration property exposes the existing default-VLAN support. PF VLAN updates also replace VFTA registers from a PF-only shadow, erasing live VF filters. Expose access VLAN and trunk policy through the IOV schema. Track each VF VLAN as desired state, restore the administrative VLAN after reset, and use the native VLVF helper for incremental PF and VF ownership changes. Keep VLAN filtering enabled while SR-IOV is active. When PF hardware filtering is disabled, admit every VLAN to the PF without bypassing per-pool VF isolation. Reconstruct VLVF and the shared VFTA from PF and VF desired state after reset or a filtering-mode transition, and restore PF-only state on teardown. When the last VF leaves a VLAN still owned by the PF, free its VLVF slot while retaining the shared VFTA bit. This prevents a trunk VF from exhausting the 64-entry VLVF table by cycling VLAN memberships. Adapt the VLAN ownership model introduced for igb(4) in a2ed165f0049 to ixgbe's native VLVF machinery. Match Linux receive semantics by exposing a stripped VLAN tag only when that VID was registered by the VF. A PF-assigned port VLAN is an administrative tag and must be delivered to the VF as untagged traffic; otherwise the stack dispatches it to a nonexistent VLAN interface and access-VLAN receive traffic is blackholed. MFC after: 1 week Relnotes: yes
ixgbe: Preserve priority-tagged traffic with SR-IOV VID 0 carries only 802.1p priority and does not identify VLAN membership. Keep VFTA bit zero in the persistent PF shadow table so reset and SR-IOV replay admit priority-tagged frames while VLAN filtering is enabled. In virtualization mode, also reserve VLVF slot zero and restore PF and eligible VF pool memberships. A VFTA hit alone admits the tag globally but does not deliver it to the correct pools. This matches the priority-tag treatment in em/igb. MFC after: 1 week
ixgbe: enforce VF promiscuity and multicast policy The allow-promisc IOV property is advertised but ignored, and the PF rejects the xcast request used by modern VFs. Negotiate mailbox APIs 1.2 and 1.3, implement pool-scoped xcast modes, and require allow-promisc for requested all-multicast or unicast-promiscuous modes. The VF mailbox can carry only 30 multicast hashes. When ixv has a larger list, request the API 1.2 all-multicast xcast mode instead of extending the legacy SET_MULTICAST message. The PF grants that fallback only to VFs configured with allow-promisc; otherwise ixv reports that only the first 30 addresses are active. Reset xcast state with the VF and have ixv replay the mode implied by its interface flags after multicast updates. Follow DPDK's ixgbe API 1.2/1.3 xcast contract, with allow-promisc policy adapted from igb(4) in a2ed165f0049. MFC after: 1 week Relnotes: yes
ixgbe: implement VF secondary MAC filters The PF advertises the legacy SET_MACVLAN mailbox request but always rejects it. The request installs secondary unicast addresses. Allocate an owned RAR pool for VF secondary addresses, reserve low entries for PF filters, and place VF-primary addresses at the top of the usable RAR range. Reject address collisions and cap each VF at three secondary filters so one guest cannot exhaust the shared table. Clear secondary filters on VF or PF reset and on SR-IOV teardown. This hardware can anti-spoof only the VF primary source address. Reject secondary filters while MAC anti-spoofing is configured, so installing them requires an explicit administrative policy choice. Report optional filter-table allocation failure without disabling SR-IOV. Adapt the owned-RAR allocation and reset-cleanup model from igb(4) in a2ed165f0049 to DPDK's ixgbe SET_MACVLAN mailbox semantics. MFC after: 1 week Relnotes: yes
In preparation of increasing the KVA on powerpc64 to 2TB to mirror amd64's, rework the 64-bit Book-E pmap to not allocate all page table pages at boot time, since that would be a waste of a lot of memory. Instead, allocate all page table pages for the higher levels, leaving the leaves (page directories) for dynamic allocation. This cuts the boot-time page table size down from ~64MB to ~8MB with the current 32GB KVA size, and bumping to 2TB KVA the boot-time page table is still ~8MB instead of ballooning to ~4GB of mostly wasted space.
This reflects what amd64 has, and is needed for using GPUs with large VRAM.
VLAN registration callbacks only update the software shadow, leaving the PF unaware until a later full initialization. Initialization then retries each failed request in a tight loop, while skipping replay entirely when local hardware filtering is disabled. Send additions and removals as soon as the desired state changes, independent of the VF local-filter capability. Replay the desired memberships after reset and retry a bounded batch per timer tick. Stop after the first failure so a silent PF can consume only one mailbox timeout per pass, while a responsive PF can drain several requests. Treat the retry window as a no-progress deadline: advance it when pending work succeeds so a large backlog can drain, but leave entries dormant after a sustained failure. A successful mailbox request wakes a dormant backlog. Dispatch timer-driven retries only while iflib marks the VF running, so a stale timer tick cannot restore PF VLAN state after the stop path resets the VF. Because the callbacks now update the PF or retain failed work for retry, do not restart the VF for VLAN configuration changes. This avoids resetting and flapping the interface for every VLAN addition or removal. Also keep receive VLAN stripping synchronized in both the enabled and disabled cases. Adapt the bounded VLAN reconciliation scheme from igb VF commit fdce3830d9a6 to the ixgbe VF mailbox. MFC after: 1 week
pci: Ignore SR-IOV VFs when tuning MPS The VF Device Control MPS and MRRS fields are reserved and preserved. VF transactions use the PF MPS, so a hardwired VF value must not be used to retune the shared PCIe hierarchy. Document the previously undocumented tuning knob and clarify why a VF may continue to display its reserved hardwired value. This fixes an instant crash/reboot on my Zen3 system with 82599 VFs. MFC after: 1 week
pci: Preserve adjusted PCIe control state The PCI bus changes live capability registers after the initial configuration snapshot has been saved. A later driver reprobe restores that snapshot and can silently undo the adjustment. Update the cached Device Control and Root Control bits together with pcie_adjust_config() writes. Route the persistent Maximum Read Request setter and the bus-owned AER control changes through that helper as well, so they share the same restore semantics as MPS reconciliation. Document the persistent-write contract. Merge only explicitly adjusted bits into the saved image so unrelated or transient bits observed during the hardware read-modify-write cannot become persistent. MFC after: 2 weeks
pci: Reconcile MPS before attaching PCIe devices Reconcile each newly enumerated link as a unit before child drivers attach. Firmware may leave Bus Master Enable set after handoff, so use the bus attachment state rather than that bit to identify the cold phase. Preserve an established hierarchy during rescan and hot-add. Refuse a reduction below a switch because recursive enumeration may already have made a sibling subtree live; lowering only the local port or Root Port would produce an inconsistent path. Report capability and active-use conflicts distinctly. Handle OFW PCI buses that clone the generic enumeration path. MFC after: 2 weeks
pci: Add a hierarchy-wide MPS limit Add a boot-time ceiling for MPS reconciliation. Apply it only while an entire cold-enumerated link can be configured consistently, and leave an established active path unchanged. MFC after: 2 weeks
pci: Optionally disable endpoints with unsafe MPS Keep warn-only behavior as the default. Add an opt-in policy that clears endpoint decoding and bus mastering when a newly discovered function cannot match its active path, while never disabling bridge functions and their subtrees. MFC after: 2 weeks
pci: Permit function-level reset of 82599 VFs Intel 82599 supports FLR on VFs but reports FLR support only in the PF Device Capabilities register. The VF register therefore leaves the FLR Capable bit clear, and pcie_flr() rejects the reset. Intel documents the zeroed VF PCIe capability structure as erratum 35 in the 82599 Specification Update (B0=Yes; NoFix). Add a positive FLR quirk for the 82599 VF. Keep the capability check for every other function, so an unknown nonconforming VF cannot make pcie_flr() report success when its reset request was ignored. SR-IOV requires VFs to support FLR, but a clear capability bit cannot distinguish the 82599's misadvertisement from a VF that fails to implement it. MFC after: 1 week
The IOV callback changes the PF pool, virtualization mode, and hardware queue indices while iflib still considers the old queue layout live. Teardown likewise leaves the software pool and mode at their SR-IOV values. Use iflib stop/mutate/restart transactions for both transitions. Disable VF DMA and PCI VF Enable before queue reuse, let outstanding transactions drain, and restore the non-IOV pool and queue indices on teardown. Remove the redundant driver-local pci_iov_detach() wrapper; iflib already performs that check centrally before the driver detach callback. It may be possible to avoid some restart in the future on this hardware pausing DMA and remapping rings but not pursued yet. MFC after: 2 weeks
A deterministic IOV configuration error currently reaches the driver only after iflib has stopped the PF. The required cleanup restart then causes an avoidable carrier flap. Follow the igb pattern and validate the request in the PCI IOV method before entering the restart transaction. Reject queue layouts wider than the selected virtualization pool before they can alias unrelated 82599 registers. MFC after: 2 weeks
ixgbe: complete PF cleanup after VF FLR The 82599, X540, and X550 documentation identifies VF registers which retain state across VFLR and must be reconfigured before a VF is reused. The VF reset path already initializes its queue-owned registers, but the PF only cleared VF mailbox memory and transmit head write-back addresses after a cooperative mailbox reset. A bare hardware VFLR therefore left both behind on affected devices. Move TDWBA cleanup into the common reset path. Clear CTS when VFLR invalidates the mailbox session, and accept only VF_RESET during the reset pass before restoring VF traffic. Clear VFMBMEM through the PFU/VFU semaphore. Recheck VFREQ while holding PFU so a reset event cannot erase a request posted between the initial mailbox check and the clear. Dispatch an already-read message even if the residual clear fails, but keep cleanup pending until a synchronized clear succeeds. Retry cleanup in the same admin pass after a failed message read or clear. The 82599 also retains VFMAILBOX.VFU across VFLR. Leave a VF-owned mailbox intact initially so a live post-reset writer can finish. Retry cleanup from the admin timer and, after a two-second grace period, use PFMAILBOX.RVFU only when VFU remains set and no request has been posted. Clear the mailbox under PFU afterward. This recovers an abandoned pre-reset owner without sleeping under the iflib context lock or immediately stealing from a new reset request. Suppress mailbox dispatch once iflib has cleared IFF_DRV_RUNNING so a pending reset request cannot re-enable VF traffic inside the PF stop path. Periodically sample aggregate VFREQ, VFACK, and VFLR registers, masked to active VFs, so work suppressed across a stop/restart and a bare 82599 VFLR without EICR_MAILBOX are both discovered without another interrupt edge. MFC after: 2 weeks
ixgbe: recover from X550 malicious-driver events The shared X550 code provides malicious-driver detection, event decoding, and per-pool recovery operations, but the PF never enables or services them. A malformed VF descriptor can therefore go undetected and avoid the per-pool recovery path supplied by the MAC. Configure IOV state while VF DMA remains disabled, then enable MDD and activate the VFs only after PF queue initialization is complete. On an MDD event, withdraw mailbox CTS and gate the VF pool through PFVFTE and PFVFRE. Retain the per-queue WQBR blocks until the VF enters a new reset epoch; PFVFTE can still permit descriptor fetches into the internal queue, so releasing WQBR early would allow a hostile VF to retrigger MDD before it resets. Send the non-CTS reset notification after servicing the VF mailbox. Let a posted VF request win mailbox arbitration, defer notification if the pass produced a response, and retry failed notifications from the periodic admin pass. Poll WQBR so recovery does not depend on another mailbox interrupt edge, while suppressing already-fenced pools. Latch a PF reset request until the next hardware initialization. The X550 datasheet defines every bit of WQBR_RX and WQBR_TX as a queue bit, so an all-ones value is valid. Reject it only when IXGBE_STATUS, which has reserved-zero bits, also reads as all ones and confirms dead MMIO. Temporarily disable MDD around live multiqueue SRRCTL drop-mode updates, which hardware otherwise reports as queue-context changes. Serialize that window with the iflib context lock and resample pending work after MDD is restored. Apply the per-pool recovery model used by igb(4) in a2ed165f0049 to the existing DPDK-derived X550 hooks. The same register interface is documented for X552 and X553, so cover the entire X550 family. Document that VF traffic remains disabled until the reset handshake completes. MFC after: 2 weeks Relnotes: yes
ixgbe: force receive drops on every VF queue PFQDE is indexed by absolute receive queue, but the driver programs one index per VF. Only the first quarter or half of the VF queues therefore have queue-drop isolation, depending on the virtualization mode. The flow-control path can also clear those bits even though SR-IOV requires them independently of the PF pause policy. Program every queue in a VF pool before enabling receive for that VF. For an X550-family VF with an administrative port VLAN, also hide the VLAN tag as the hardware requires. Keep PF flow-control changes confined to the PF SRRCTL registers, and clear the VF queue settings when SR-IOV is torn down and the queues can be reassigned to the PF. MFC after: 2 weeks
Currently, the FreeBSD driver configures and destroys queues sequentially by issuing individual Admin Queue (AQ) commands. During queue teardown (e.g., interface reset), disabling queues one by one leaves the device in a partially configured state. Because the device does not yet know that the driver is in the process of fully unconfiguring all queues, this intermediate state can trigger transient error logs (such as when queue 0 is disabled while other queues are still active). Modify the driver to use Admin Queue batching for both the creation and destruction of TX and RX queues. Commands are now queued and kicked together, ensuring the queue configuration changes are applied atomically and preventing transient errors from being logged. Signed-off-by: Sujithra Periasamy <sujithra@google.com> Reviewed by: markj MFC after: 1 week Sponsored by: Google Differential Revision: https://reviews.freebsd.org/D58696
A VF's pci_devinfo references its PF's pcicfg_iov for resource bookkeeping, but only the PF implements the SR-IOV capability. pci_cfg_save() and pci_cfg_restore() treated any non-NULL cfg.iov as an owned capability and accessed the PF capability offset in VF configuration space. Saving a VF could therefore replace the shared PF settings with unrelated VF register values. Skip SR-IOV capability save and restore for PCICFG_VF children. The generic PCI and PCIe state of the VF remains preserved. This is also required by drivers that save VF state around a PF-driven function-level reset. MFC after: 2 weeks
ixgbe: Recover legacy VFs from invalid DMA targets 82599 and X540 lack the X550 malicious-driver detector. Detect a VF whose PCI status reports a received master abort while its transmit ring has outstanding descriptors and makes no progress across consecutive samples. Consume the accepted PCI status latch, gate that VF I/O, and recover one pending VF per task pass with round-robin selection. This prevents an unreadable function from starving detection or recovery of other VFs. Save the complete writable VF PCI configuration before FLR, restore it afterward, and verify the hardware-backed Command state. Preserve the first good snapshot and pending state across reset events until restore and verification succeed. Introduce a common I/O-disabled policy bitmask so later quarantine policy can extend traffic gating without duplicating fault-state checks. MFC after: 2 weeks
ixgbe: quarantine repeatedly faulting legacy VFs A guest can reinitialize after a VF function-level reset and repeatedly strand an 82599 or X540 PF with invalid descriptor DMA targets. Count only distinct Received Master Abort events accepted by the qualified transmit-stall detector and quarantine the VF after five events. Preserve quarantine across PF reinitialization, reject reset mailbox requests, and keep transmit, receive, and clear-to-send disabled. Recreating SR-IOV clears quarantine. Expose the affected pools through a read-only bitmap. After a successful quarantine FLR, leave the function in post-FLR configuration, explicitly keep decode and bus mastering disabled, verify the Command register, and refresh its PCI-layer cache so a later restore cannot re-enable the function. This addresses CVE-2021-33061 on 82599. Apply the same bounded-failure policy to X540 as defense in depth; the CVE does not list X540. Intel documents the 82599 issue in: http://iommu.com/datasheets/ethernet/controllers-nics/intel/ixgbe/Intel_82599_Application_Note_655276.pdf MFC after: 2 weeks Security: CVE-2021-33061
ixgbe: Re-enable the SFP laser during initialization ixgbe_if_stop() disables the transmit laser on every 82599 SFP fiber port, but the iflib initialization path did not re-enable it. Re-enable the laser before deferred SFP module setup so interface reinitialization cannot leave either single-speed or multispeed optics dark. The hardware wrapper is a no-op when laser control is unavailable. The placement follows Intel ix-3.4.39; this version deliberately applies to every SFP port affected by the stop path. MFC after: 1 week
When link polling loses mailbox clear-to-send or times out, request an iflib reset instead of continuing with stale VF state. The driver callback runs after iflib samples reset requests, so requeue the admin task to make iflib consume the request on its next pass rather than waiting for an unrelated timer or interrupt. MFC after: 2 weeks
ixgbe: Apply the 82599 D3 link workaround only for D3 ixgbe_stop_mac_link_on_d3_82599() implements the workaround for 82599 erratum 33. It forces incompatible auto-negotiation settings before the device enters D3, and reset clears them when returning to D0. ixgbe_if_stop() is also used for ordinary interface reconfiguration and recovery. Those paths do not enter D3 and should not program this power-management workaround. They continue to stop the adapter and disable the transmit laser. Move the call to ixgbe_setup_low_power_mode(), after ixgbe_if_stop(). This preserves the required ordering for detach, shutdown, and suspend while avoiding the D3 settings during ordinary restarts. MFC after: 2 weeks
ixgbe: Use PF MTU for 82599 VF jumbo policy The shared maximum frame size is raised by VF LPE requests, so it cannot describe the PF MTU when enforcing the 82599 PF/VF jumbo restriction. Consult the PF ifnet MTU instead. Also correct the API 1.1 and later comparison so a jumbo VF is enabled when, and only when, the PF itself uses a jumbo MTU. This matches the policy implemented by DPDK. MFC after: 2 weeks
ixgbe: Quiesce VFs across PF reset Stop VF transmit and receive in hardware, clear PF-side mailbox CTS, and notify active VFs before resetting a PF. A PF reset invalidates VF queue state, so the no-CTS control message makes cooperative VFs discard stale state and renegotiate after the PF returns. The hardware queue gates synchronously prevent further VF DMA. Do not hold the exclusive iflib context lock for a fixed VF-watchdog interval after the reset. Report the PF link transition directly instead of dispatching mailbox work from the stop path, which could otherwise re-enable VF I/O mid-reset. The CTS, PF-control, and VF queue controls follow the reset mechanisms used by DPDK. MFC after: 2 weeks
netmap: Fix driver name handling if_initname() requires the caller to ensure that the lifetime of the interface's name buffer contains that of the ifnet itself. netmap_vi_create() wasn't respecting that; we were instead passing the stack-allocated buffer provided by the ioctl handler. While here, add a check to avoid assuming that the caller-provided buffer is nul-terminated. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58676
netmap: Fix a race in kqueue registration We need to acquire the netmap global lock earlier, to avoid racing with the NETMAP_REQ_REGISTER ioctl handler. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58677
netmap: Handle overflow when computing ring sizes PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297300 Reported by: Robert Morris Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58678
Found with: clang -Werror=assign-enum
Found with: clang -Werror=assign-enum
No functional change, as current callers either don't check the return value or check it against OCS_HW_RTN_SUCCESS only. Found with: clang -Werror=assign-enum
DMA channels are allocated by attach_pre but released by queues_free. When iflib fails after attach_pre and before queue allocation, neither the old detach nor queues_free path releases them. Allocate channels with the TX queue state and make queues_free tolerate partially allocated rings. Use it to unwind allocation failures so TX rings are also released when RX allocation fails. An early detach can also precede PHY initialization and interrupt assignment. Skip absent PHY and channel state, and release the locks owned by attach_pre on both failure and detach. MFC after: 2 weeks
Completion queues are allocated by attach_pre but released by queues_free. An iflib failure between those stages leaks the allocation, while the original size expression also underallocates the array. Move completion queue allocation into the TX queue callback, correct its size, and unwind it with TX state if RX allocation fails. Make interrupt cleanup tolerate an unavailable array and reuse the array allocated during device initialization instead of replacing and leaking it. Release the DMA, multicast, and lock resources owned by a successful attach_pre during detach. Avoid allocating the statistics DMA area a second time near the end of attach_pre. MFC after: 2 weeks
A PF can be resetting, handling a slow link event, or deliberately withholding mailbox CTS while its VFs enumerate. Keep the VF attached when the reset handshake is temporarily unavailable so a later if_init can retry. Never leave VF hardware running without a negotiated mailbox API: start hardware only after reset succeeds, stop it when negotiation fails in attach or init, and defer later recovery through iflib. This prevents a tight reset loop while preserving recovery when the PF returns. MFC after: 2 weeks
The iflib conversion records link-status interrupts in the administrative request mask, but the administrative task did not consume them. Timer polling usually hid the omission; frequent mailbox interrupts could continually rearm that timer and leave cached link state down after hardware recovered. Claim request batches atomically, process link-setup dependencies, and sample hardware before publishing link state. Bound each invocation to eight batches and requeue residual work so a continuous producer cannot monopolize the admin taskqueue. Queue every link-related request from the legacy interrupt path. Unlike MSI-X, its threaded continuation services RX and does not enqueue the admin task. This restores the event-driven behavior of ix-3.4.39. Fixes: https://cgit.freebsd.org/src/commit/?id=b2c1e8e62049 ("ix(4): Run {mod,msf,mbx,fdir,phy}_task in if_update_admin_status") MFC after: 2 weeks
The aggregate VF mailbox poll includes only VFs whose driver configuration completed. A configured VF slot whose vf_add callback failed can nevertheless report reset, request, or acknowledgement events. Because the mailbox handler skips inactive entries, such an event remains latched and can retrigger administrative work indefinitely. Build the poll masks from every configured VF index and consume reset, message, and acknowledgement events for inactive entries without treating them as usable VFs. Use the index rather than the pool because early vf_add errors precede pool initialization. Also include E610 PFVFLREC in aggregate reset sampling. MFC after: 2 weeks
Register the vmm module handler after both the bundled device drivers and SMP. On platforms without EARLY_AP_STARTUP, SI_SUB_SMP follows SI_SUB_DRIVERS; using the later subsystem preserves the smp_rendezvous() requirement. The resulting reverse unload order performs IOMMU cleanup while every IVHD softc remains valid. Refuse an independent IVHD detach while translation state remains initialized. MFC after: 2 weeks
Do not instantiate an interrupt-remapping context for a unit whose IRTE support is disabled. In that mode the caller must retain the ordinary interrupt path. Reviewed by: kib MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D58725
The iflib Flow Director path does not assign filters using the absolute queue and pool identifiers required by SR-IOV. Reject the combination during preflight validation rather than allowing an unsupported configuration to alter the PF receive path. The loader tunable is fixed before VFs can be created, so validation also prevents the reverse ordering of this combination. MFC after: 2 weeks
The flow_control and hdr_split variables have never been read. VF flow control is controlled by the PF, while implementing header split would require receive-path support that ixv does not provide. MFC after: 2 weeks
The shared ixgbe transmit path already creates SCTP context descriptors, and the hardware exposes the same checksum capability to VFs. Advertise it through iflib as the PF driver does. MFC after: 2 weeks
TXDCTL programming is family dependent. 82543 erratum 35 and 82544 erratum 20 require WTHRESH to remain zero; a nonzero value can corrupt descriptor writebacks and hang the controller. Leave all descriptor-control thresholds at their reset values on 82542, 82543, and 82544. On the remaining em controllers, retain the established PTHRESH=31, HTHRESH=1, WTHRESH=1, and descriptor granularity policy. Several legacy specification updates identify full descriptor writeback as a workaround for transmit descriptor-queue errata. TXDCTL bit 22 is also family dependent. It is COUNT_DESC on the 82571 family and 80003ES2LAN. Intel shared initialization explicitly sets raw bit 22 on both transmit queues of every supported ICH/PCH generation, although the integrated public documentation marks it reserved. Preserve that required setting when iflib programs the thresholds, as DPDK does. Clearing it caused a persistent I219 transmit stall under descriptor pressure. The combined em/igb setup also wrote LWTHRESH=1 on every em controller. The driver does not enable the TXD_LOW interrupt controlled by that field. Enumerate every supported em MAC type and leave the unused low-water threshold disabled. This keeps the legacy descriptor-writeback safety policies separate from igb sparse-RS operation while programming only the fields appropriate to each family. MFC after: 2 weeks
Jumbo receive tuning on integrated controllers enabled PTHRESH without a nonzero HTHRESH, contrary to the hardware programming requirements. It also covered only the integrated MAC generations present when the workaround was added. Enumerate every jumbo-capable ICH and PCH type and program PTHRESH=3 with HTHRESH=1. Linux fixed the same HTHRESH omission in b701cacdbcfb. The 82574 path combined threshold values with the reset values using bitwise OR. Requesting WTHRESH=4 while the reset value was one thus programmed five. Clear the complete threshold fields before installing the established PTHRESH=32, HTHRESH=4, WTHRESH=4 descriptor-granularity policy. MFC after: 2 weeks
iflib requests transmit completion status only on selected descriptors. Program a zero writeback threshold so igb hardware honors those sparse RS bits instead of writing back every descriptor in threshold-sized batches. Use the existing family specific prefetch threshold: eight descriptors on most controllers and 20 on I354, with a host threshold of one. These values match the Intel-derived Linux and DPDK drivers. Their nonzero writeback settings are not appropriate here because those drivers set RS on every packet. A zero writeback threshold also avoids depending on interrupt timer flushes affected by 82576 specification update erratum 26. Remove the old IGB_TX_WTHRESH macro as well. It has had no callers since the iflib conversion, so its 82575 conditional no longer implements any policy. MFC after: 2 weeks
82576 specification-update erratum 26 says MSI-X EITR expiration can fail to trigger receive descriptor writeback. A WTHRESH above one can therefore leave received packets invisible until the threshold fills. The shared threshold macros selected policy by enum ordering, so an 82576 VF fell into the generic WTHRESH=4 case. VFs always use MSI-X and require the same WTHRESH=1 workaround as the PF. Use PTHRESH=8 for 82575 and 82576 PFs and VFs, matching DPDK and the current Linux PF driver. The legacy FreeBSD PF and Linux igbvf value of 16 thrashes limited descriptor cache; no specification or erratum requires it. Retain the i354 PTHRESH=12 exception. Enumerate every supported igb PF and VF MAC type so each receives its intended policy. Also clear every threshold bit before installing the new values. The old mask retained the high WTHRESH bit, and 82575 uses six-bit fields while later controllers use five-bit fields. MFC after: 2 weeks
The transmit-ring setup was copied from the e1000 path. On I225 and I226, bits 22 through 24 are reserved and bit 25 enables the queue; it is not a legacy low-water threshold. Correct the field masks, remove the nonapplicable legacy definitions, and program only defined fields. Use PTHRESH=8 and HTHRESH=1. Keep WTHRESH at zero so the hardware honors sparse RS descriptors issued by iflib. Linux and DPDK use a writeback threshold of 16, but request status on every packet. A nonzero threshold makes hardware ignore individual RS bits and is unsuitable for the iflib completion model. The receive-ring setup likewise used a magic mask that left bit 20 of the five-bit WTHRESH field untouched. Define the receive threshold fields and replace them exactly before installing the established PTHRESH=8, HTHRESH=8, WTHRESH=4 policy. MFC after: 2 weeks
PTHRESH controls when the device prefetches transmit descriptors, HTHRESH controls how many host descriptors must be ready, and WTHRESH controls completion writeback batching. iflib places RS on selected descriptors and reclaims through those checkpoints. The data sheets require WTHRESH to be zero when software uses RS. Clear WTHRESH while retaining the established PTHRESH 32 and HTHRESH 1 fetch policy. This also follows DPDK in pairing sparse RS descriptors with WTHRESH zero. DPDK defaults to 32/0/0, while Linux ixgbevf uses 32/1/8. The 32/1/0 setting preserves FreeBSD's prefetch policy and the data-sheet requirement that HTHRESH be nonzero when PTHRESH is used. MFC after: 2 weeks
ixv uses one queue set on 82599 and X540 VFs and assumes two on X550-family VFs. The PF reports the queues assigned to each VF with GET_QUEUES after mailbox API 1.1 negotiation. Query the PF during attach. Bound symmetric iflib queue sets by the PF grant and available MSI-X data vectors. Retain one queue set per data vector: ixgbe VFs expose at most three vectors and one is reserved for the mailbox. The hardware permits each pool to use a subset of its RSS queues, so a two-queue ceiling is valid when the PF assigns four. This enables the second data vector on 82599 and X540 while avoiding an assumed second queue when an X550-family VF is granted only one. Keep the existing family limits if the mailbox is unavailable or the PF uses an older API. MFC after: 2 weeks
iflib clears IFF_DRV_RUNNING before the driver stop callback but leaves IFF_DRV_OACTIVE set. Consequently, an already queued admin task can run after the VF reset. If that task consumes a pending timer sample, it can retry failed VLAN mailbox operations and restore PF filters for the stopped VF. Continue sampling statistics, but only run the VLAN retry worker while the interface is running.
Expose the cached per-VF configuration through the iflib VF status method. Report mailbox handshake state, MAC address, access or trunk VLAN mode, hardware queue count, administrator policy, and MDD blocking state without issuing mailbox requests or reading hardware registers.
ixgbe: Report SR-IOV VF status Expose cached VF configuration, policy, and runtime state through the iflib VF status method. Include access or trunk VLAN mode, the queue count selected by the current virtualization mode, negotiated mailbox API, whether traffic is enabled, and the MDD-blocked and quarantine state. The query runs under the iflib context lock and does not issue mailbox requests or read hardware registers.
ixgbe: Add missing mailbox API 1.6 definition The SR-IOV status change reports mailbox API 1.6 but omitted its enum definition, leaving main unable to compile. API 1.6 is an established ixgbe mailbox wire revision. Add it at the end of the revision enum, before the unknown sentinel as required by the stable numbering contract. Naming the revision does not enable negotiation or operations which will come with the E610 support. Reported by: Herbert J. Skuhra <herbert@gojira.at> Fixes: https://cgit.freebsd.org/src/commit/?id=c30021fe0df9 ("ixgbe: Report SR-IOV VF status")
video: add generic video(4) capture framework Add a new video(4) framework that provides /dev/videoN, buffer management, mmap lifetime, and V4L2 ioctl dispatch for video capture drivers. Hardware drivers implement struct video_hw_ops callbacks and use video_buf_acquire/write/done to deliver frames. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58367
video: disable the static assertions for now The previous version of this work included the definitions but not the static asserts. It's tripping up in some CI builds, likely due to compat API building. Since this isn't any more or less broken than before, disable the static assertions until we figure out a proper path for this. Fixes: https://cgit.freebsd.org/src/commit/?id=9c9428825f4c55e3cb37412c661bb9d385db4c68 (video: add generic video(4) capture framework)
Replaced the monolithic cdevsw implementation with the video(4) framework. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58368
Replaced the monolithic cdevsw implementation with the video(4) framework. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58369
fwcam(4) no longer creates its own character device or implements the FWCAM_* ioctls; it registers with video(4) and is driven through the standard V4L2 interface on /dev/videoN. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58500
Raising UVIDEO_NFRAMES_MAX from 40 to 128 in 3b6f833c95eb improved
throughput on xhci but made every camera on an ehci bus fail to
stream. Integrated webcams became unusable.
Measured on a MacBookPro9,2 with two ehci(4) FaceTime HD cameras and an
xhci(4) Logitech C920:
128 32
ehci, 12 captures 0 ok 12 ok
xhci 1920x1080 5 fps 5 fps
xhci 1280x720 10 fps 10 fps
Fixes: https://cgit.freebsd.org/src/commit/?id=3b6f833c95eb
Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D58501
Disabled the IR DMA channel on the error path, which clears the flag and frees the descriptor blocks before the chunks go away. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58502
Reviewed by: adrian, bapt Differential Revision: https://reviews.freebsd.org/D58503
Fix two small bugs affecting the event parsing of AMD L3 counters. AMD's manual and JSON disagree about the naming scheme on recent processors. I use the naming scheme present in the recent PPRs to be consistent, so in the JSON parser we rename 'allslices' to 'allsources' just as we already do with sliceid and sourceid. Also ensure that we parse the 0x prefix present in the newer JSON files. Reviewed by: mhorne Sponsored by: Netflix MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2180
A link flap left nothing in the log to work from. Both the link up and link down messages were gated on bootverbose while the message for a speed change that keeps carrier was not, so a default kernel was silent about a flap yet loud about a downshift -- the inverse of what an operator wants. The generic message from if_link_state_change() carries no speed, so gating the driver's own left the negotiated rate unrecorded. Report both transitions unconditionally. Say more than the rate. aq_hw_get_link_state() already negotiates flow control and throws it away, and Atlantic 2 reports duplex and EEE in the same link status word the rate comes from; decode them through a new get_link_info firmware op and name all of it on the up transition. EEE matters for a flap: low power idle transitions are a common source of marginal link trouble on multi-gigabit copper, and whether it was active is otherwise invisible. Give the down transition a cause. The PHY global fault code was only consulted from the thermal state machine, so an ordinary link loss reported nothing at all. Read the fault code, the firmware link state and the PHY temperature once per transition and append whatever is available. The firmware raises a fault one poll after it drops the link, so a thermal trip usually shows only its temperature here and aq_thermal_poll() names it on the following poll; the temperature alone is enough to separate a hot PHY from a cable event. Warn before the PHY trips rather than only after. The Atlantic 2 health monitor word carries a hot warning bit next to the ready and fault bits that nothing decoded. Report both edges of it from the thermal poll, so an adapter that is approaching its shutdown threshold says so while the link is still up. Expose the firmware's own link transition counters. The Atlantic 2 A0 statistics layout opens with link_up and link_down, which were read out of the firmware on every statistics poll and discarded. Publish them as dev.aq.N.fw_link_up and fw_link_down so a single flap can be told from a link that has been flapping all night. The B0 layout has no equivalent, so the op reports ENOTSUP there and the nodes are not created, matching how the temperature node is handled. Stop announcing a link state that was never read. The return value of aq_hw_get_link_state() was discarded, so a failed read would have been announced as link down. No firmware backend can fail that call today -- all three decode a register with no error path -- but the caller no longer depends on that, and it says so once if it ever starts failing. Report the hardware failures that were being discarded. The driver already reports the errors it keeps, so what stayed quiet was the set of calls whose result was never examined at all. None of these are expected to fail, which is precisely why a failure needs to say so: each one leaves the interface running but misconfigured in a way that presents as a network problem rather than a driver problem. aq_if_init() discarded aq_hw_start(), aq_hw_rss_hash_set(), aq_hw_rss_set() and aq_hw_udp_rss_enable(), so a datapath that never started or an indirection table that was never programmed showed up only as an interface that passes no traffic or delivers every flow to one queue. aq_mc_filter_apply() discarded aq_hw_mac_addr_set(), so a multicast address the stack believes is programmed could silently not be; report the address that failed and leave the filter slot for the next one instead of burning it. aq_update_vlan_filters() reported only the last of its three register writes. aq_if_stop() discarded both ring stop calls and the MAC reset, and a MAC that did not reset can still be mastering the bus. aq_if_detach() and aq_if_suspend() discarded aq_hw_deinit(). The interrupt moderation update on a link speed change was dropped as well; it runs only on a transition, so reporting it cannot become noisy. aq_if_attach_pre() discarded aq_hw_capabilities(), which is the only behavioral change here: it now fails the attach rather than continuing with an unset media type and an empty link speed mask, which would attach an interface that can never negotiate a link. It returns an error only for a device the probe table does not cover, so it is not reachable in practice. Document the resulting sysctls, along with the existing temperature and tracing nodes, which had no manual page coverage. Tested on an AQC113C (Atlantic 2 B0, firmware 1.5.38). Link up reports "speed=10000, full-duplex, flowcontrol none, EEE off", and "speed=1000" after a forced renegotiation, so the rate and duplex are read rather than assumed. A cable pull reports "link DOWN, F/W link state 0, temp 59 C" with the PHY fault clause correctly absent, which is what separates a cable event from a thermal trip. The B0 interface reports ENOTSUP for the link counters, so those two nodes are correctly not created. Traffic is unaffected: ten flows spread over all eight RX queues with no errors and no drops. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D58749 Signed-off-by: Nick Price <nprice@FreeBSD.org>
A VF reset can sanitize its retained queue registers even when the PF does not complete the cooperative mailbox handshake. Keep those two states separate. Do not program or enable the rings until both queue sanitation and mailbox initialization have succeeded. Report either initialization failure to iflib so the interface remains stopped. Stopped admin and media-status passes now publish cached link-down state without polling the mailbox. While the VF remains administratively up, retry complete initialization after 250 ms, one second, four seconds, and then at a capped eight-second interval. Conditional iflib reset requests ensure an intervening administrative down cancels a queued retry. Avoid a redundant mailbox reset in the stop half of an immediate iflib reinitialization; the following init performs the required reset. Preserve the reset on an ordinary administrative stop and keep the existing bounded queue-sanitation retry policy independent from mailbox liveness recovery.
Network-related commands, library, and kernel.
iflib: restore TX watchdog functionality Since f6afed726b00 the TX-hang check in iflib_timer() has required a queue state other than IFLIB_QUEUE_IDLE, but nothing ever sets IFLIB_QUEUE_WORKING, so IFLIB_QUEUE_HUNG has been unreachable ever since: stalled TX queues are not detected, not reported, and not reset - the TX watchdog of every iflib(4) driver has been dead code. Instead of resurrecting the queue-state machine, detect the hang directly. A transmit queue is frozen while it holds descriptors the hardware has not reported as completed and none were reclaimed over a timer period. Being frozen is not a fault: the hardware may defer marking descriptors as completed indefinitely. The check therefore arms only when a frozen queue also takes on new work, while the link is up, no pause frames were received and no doorbell is pending; and it acts only after the queue has stayed frozen for net.iflib.tx_watchdog_periods consecutive periods. It then asks the hardware through the driver's read-only credits peek (isc_txd_credits_update with clear=false, the same call the mp_ring can_drain callback makes routinely): if completions are ready but were not harvested for this long, the completion interrupt went missing - kick the queue's task instead of resetting; if the hardware reports nothing although the queue kept receiving work, it is hung and the existing watchdog reset machinery takes over. Neither software counters alone nor mere persistence of unharvested work can make this decision. iflib reclaims lazily (up to isc_tx_nsegments completed descriptors stay unharvested indefinitely) and defers report-status requests, so "descriptors in use" and "no cleaning progress" are normal states of an idle healthy queue. And hardware that coalesces completion reports (e.g. 8254x, TXDCTL.WTHRESH) legitimately withholds the last one of a quiet queue indefinitely, so a zero credits peek is a normal idle state, not a hang indicator: arming on persistence alone reset healthy interfaces on every traffic lull (field-tested on 82541PI). Only growth across frozen periods separates a wedged queue from a coalescing one. The threshold is a threshold in time, not in device work: a period is one iflib_timer interval (hz/2 by default), so at the default of four periods the verdict falls after roughly two seconds. It was calibrated from counter traces on that old and slow hardware, where healthy coalescing always cleared within two periods; newer hardware reports completions far sooner and leaves the frozen state earlier, so the default needs no recalibration for more modern devices. Setting the sysctl to zero disables the check. A queue whose link is down is never flagged - preserving what f6afed726b00 fixed. The new per-queue state goes into padding the transmit queue structure already had, rather than next to the counters it is derived from: that region is packed, so an insertion there would grow the structure. What is left of that padding is now spelled out instead of being implicit. The size of the structure is unchanged on amd64, arm64, riscv64, i386 and armv7. The IFLIB_QUEUE_* states no longer participate in the watchdog decision; they will be removed in a followup commit. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220997, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239240 Fixes: https://cgit.freebsd.org/src/commit/?id=f6afed726b00 ("iflib: Prevent watchdog from resetting idle queues") Suggested by: gallatin (mxge-style detection) Reviewed by: adrian, markj MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D58266 Assisted-by: Claude Code (Fable 5, Opus 5)
iflib: remove the unused TX queue state machine The previous commit stopped using ift_qstatus and the IFLIB_QUEUE_* states for the TX watchdog decision, leaving only dead stores. Remove the field, the states, and all assignments. The byte the field frees stays behind as explicit padding. No functional change. Reviewed by: gallatin, markj MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D58282 Assisted-by: Claude Code (Fable 5, Opus 5)
iflib: clear the deferred TX descriptor state when a queue is stopped Stopping an interface frees the queued mbufs and zeroes a transmit queue's descriptor accounting, but the three counters that track descriptors deferred to a later doorbell write or report-status request are not cleared there: they only reach zero when the code that acts on them runs. After a reset they therefore describe descriptors that no longer exist, until enough new traffic flushes them. The consequences are small - one doorbell written from a stale count, and a report-status request on the first packet after the reset - but the state is simply wrong, and the transmit-hang check in iflib_timer() reads one of them. MFC after: 1 week Assisted-by: Claude Code (Opus 5)
A v6 raw socket may ask the kernel to validate the checksum of an inbound packet. If it does, and the validation fails, we discard the packet, but this isn't really right: other raw sockets may wish to receive a copy of the packet anyway. Rework checksum handling to address this problem, and use a flag to avoid computing the checksum more than once for a given packet. Fixes: https://cgit.freebsd.org/src/commit/?id=de2d47842e880281 ("SMR protection for inpcbs") Reviewed by: pouria, glebius Reported by: Yunzhi Ke MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58559
pfsync interfaces do not have ifp->if_inet6 set, so when we update the
MTU for those interfaces we panicked.
Add an explicit check for this. This should be temporary, until pfsync
is no longer a struct ifnet (as we've already done for pflog).
Reviewed by: glebius
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D58701
pfsync packets were allocated with m_get2(), which can't return packets larger than MJUMPAGESIZE. As a result 9k MTU pfsync interfaces simply didn't work. Use m_get3(), which can allocate sufficiently large mbufs. Extend the pfsync:bulk test case to provoke this problem. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297307 MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
ifconfig: Add SR-IOV VF status output - Adds SR-IOV VF status to the existing ifconfig "-v" output - Adds ioctl command for reporting VF status info from drivers - Adds support to iflib for drivers to handle this new ioctl - Add support for ioctl in ixl(4) Signed-off-by: Eric Joyner <erj@freebsd.org> Relnotes: yes Differential Revision: https://reviews.freebsd.org/D19647
iflib: Avoid locking for unsupported VF status queries ifconfig -v requests SR-IOV VF status from every interface. iflib previously acquired the context lock before dispatching the request even for VFs and drivers using the default unsupported method. Mailbox work on a VF could therefore delay the complete interface listing. VF status describes the children of an SR-IOV PF. Reject requests on VF contexts and classes using the default method without taking the context lock. Keep the lock for actual PF status providers. Fixes: https://cgit.freebsd.org/src/commit/?id=1ccf543b21ef ("ifconfig: Add SR-IOV VF status output")
Replace the records with a versioned nvlist transported through struct ifreq, following SIOCGIFCAPNV. The network stack now packs and copies results, supports bounded retry for larger results, and handles native and 32-bit callers centrally. Drivers only populate a kernel nvlist while their state is locked. Define optional common fields for identity, configuration and handshake state, VLAN policy, queue resources, runtime blocks, PF link state, and namespaced driver extensions. Document the extension and versioning contract and require providers to omit values they cannot observe. Improve the ixl provider to track its mailbox handshake and report the expanded common policy. Render the expanded status as grouped output under ifconfig -v.
Honor RTEXT_FILTER_VF on RTM_GETLINK requests and expose the versioned SR-IOV VF status through typed nested FreeBSD attributes. Report IFLA_NUM_VF with a successful requested query and preserve per-provider errors in the status container. Map the common nvlist schema to native integer, boolean, string, and binary attributes. Carry namespaced driver extensions as packed versioned nvlists so adding a driver-specific field does not expand the common netlink ABI. Add SNL parsers, parser verification, a constructed nested-status test, and an RTM_GETLINK test for an interface without SR-IOV support. Document the query contract and every attribute.
The ifdi_init method cannot report an error, so iflib always marks an interface running and enables its interrupts after the callback returns. Drivers whose hardware initialization depends on an unavailable peer can only return early and leave a falsely running interface. Add iflib_init_failed() so a callback can leave the interface stopped. Also add a conditional reset request for asynchronous recovery: it is discarded if the interface is administratively down when the admin task runs, preventing a queued retry from resurrecting a stopped interface. Do not restore saved driver flags after an MTU or capability change when initialization failed. Restoring the pre-init flags would overwrite the stopped result with stale RUNNING state. Document that reset requests require the caller to schedule the admin task, that output remains blocked during recovery, and that iflib rather than the driver owns the driver flags. MFC after: 2 weeks
Stuff in man section 8 (other than networking).
Populate stand/libsa/bootp.c's bootp_response global from the UEFI PXE Base Code Protocol's cached DhcpAck, so bootp() can enter RFC 2131 INIT-REBOOT and skip DISCOVER/OFFER instead of running a fresh DHCP transaction after the firmware has already done one.
It should give DHCP servers more information for proper responses.
During flag inconsistency report, we handle rai->rai_otherflg as a bool, but the value is 0x40. Make it a simple number comparison. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295995 Reviewed by: markj, Faraz Vahedi <kfv@kfv.io> MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D58672
niov2 returns the number of entries in the iovec starting at offset "offset". Here we are unconditionally setting it to 1, which of course isn't right. Fixes: https://cgit.freebsd.org/src/commit/?id=a28cf86c4171 ("bhyve/virtio: Rework iovec handling functions for efficiency and clarity") Reported by: Claude and Ada Logics Reviewed by: Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org> MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58625
bsdinstall: add a hardening knob for unprivileged kenv access It makes sense. Reviewed by: zleei Differental Revision: https://reviews.freebsd.org/D57755
kern: fix oversight in security.bsd.unprivileged_kenv_read It was intended that one could close the hole back in loader, but the sysctl was actually not marked TUNABLE. The hardening menu option thus did nothing, because we wouldn't read the value from kenv. Reported by: markj Fixes: https://cgit.freebsd.org/src/commit/?id=6e81fbf5833d ("bsdinstall: add a hardening knob [...]") Fixes: https://cgit.freebsd.org/src/commit/?id=4fd518fcb2bb ("kern: add a security knob to disable [...]")
We can probaby consider these kernel bugs, in which case asserting is not the most helpful thing we can do. Let's emit the necessary details to stderr and exit non-zero to aid debugging these without completely blocking the ability to export all of the well-formed metrics. Reviewed by: rew Differential Revision: https://reviews.freebsd.org/D57983
PeriphID and CellID values are determined by macros which take an index. They currently receive a bus offset which has a stride of 4 bytes. This causes the ID1-3 registers to report incorrect values. Scale the offset before passing it to the macro to fix this. Tested with kvm-unit-tests/arm/pl031. Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com> Reviewed by: jrtc27 Fixes: https://cgit.freebsd.org/src/commit/?id=014d7082a239 ("bhyve: Implement a PL031 RTC on arm64") MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2358 Closes: https://github.com/freebsd/freebsd-src/pull/2358
Add -L to query the generic packed-nvlist IOV_GET_STATUS interface. Report PF enable state and configured and total VF counts. For each VF, print its PCI address, newbus attachment, bound driver, and ppt state. Retry size negotiation if the topology changes between ioctls and reject malformed or incompatible status records. Keep NIC-specific operational state in ifconfig -v; iovctl owns the device-neutral PCI topology and applies to any SR-IOV device class. Relnotes: yes
- Prefix all structs with the struct keyword to avoid collisions between the types and variables with the same "name". - Use `_` suffixed variables in initializers to distinguish input parameters from public members [1]. Resolve some trailing whitespace issues while here. NOTE: this doesn't resolve the -pedantic issue reported by g++ with `pmchdr_cpuidinfo::cpuid` about the field being a flexible array in an otherwise empty struct. 1. I generally do this the other way around, i.e., suffix private/protected members with `_`, but these are public members in structs and I don't want to introduce a lot of churn in calling code. Reported by: g++14 with FreeBSD CI (powerpc64 tinderbox) Fixes: https://cgit.freebsd.org/src/commit/?id=ce6ab51f ("pmc: enable the new pmc commands")
This mutes a number of complains from g++ about needing specific headers for functionality related to C strings and other function prototypes. Reported by: g++ 14
When fts_children() is called, sp->fts_child is set. On the next fts_read() call, fts_safe_changedir() was incorrectly passed p->fts_dirfd (pointing to the parent directory) instead of -1. This caused fts to fchdir to the parent instead of the child directory, silently skipping the contents of 3rd-level subdirectories. This was observed as a failure in nmtree_test:mtree_create which calls fts_children() internally. Add regression test accpath_correct_after_descent that calls fts_children() on each directory entry and verifies files at depth 3 are still visited correctly. The test fails with the unfixed libc and passes with the fix. Reported by: Herbert J. Skuhra <herbert@gojira.at> Sponsored by: Google LLC (GSoC 2026) Reviewed by: asomers Fixes: https://cgit.freebsd.org/src/commit/?id=4bd01d6ae01 ("fts: refactor to use fd-relative") Pull Request: https://github.com/freebsd/freebsd-src/pull/2354
libifconfig: Add an SR-IOV VF status query Provide a public helper which retrieves, unpacks, and validates the versioned VF status nvlist. Validate the required VF indices and the shape and version of driver-specific extension namespaces while allowing unknown optional fields. The ioctl argument is not copied back when the command returns EFBIG. Start with a practical buffer and grow it geometrically rather than relying on the required length being observable. Use the helper in ifconfig so other consumers share the same transport and validation behavior.
rescue: Satisfy libifconfig's libnv dependency in crunched links libifconfig now calls nv(9) routines for the SR-IOV VF status query, so crunched builds that link the static library must also provide libnv. The per-program CRUNCH_LIBS_ifconfig hook cannot do this: crunchgen partially links per-program libraries into the program object and crunchide then localizes every symbol except the stub entry, so members absorbed there cannot satisfy references from another archive on the final link's library list. List libnv globally next to libifconfig.a in rescue(8) and bsdbox. This also makes the existing per-program libnv links redundant; remove them to avoid embedding private localized copies in the crunched binary. Fixes: https://cgit.freebsd.org/src/commit/?id=2d6114f6d26b ("libifconfig: Add an SR-IOV VF status query")
On powerpc64le with IEEE-128 long double, the long-double compiler-runtime helpers are the *kf* soft-float functions (built from the tf sources, renamed via -D in lib/libcompiler_rt/Makefile.inc) plus the complex multc3/__divtc3. They are compiled into libgcc_s.so by the powerpc64le SRCF block, but were never added to Symbol.map, so they stayed local and unexported. Every other IEEE-128 architecture already exports its scalar long-double runtime -- aarch64 and riscv list the tf helpers in GCC_4.6.0. powerpc64le was simply missed. Because the helpers are unexported, any clang-built shared library that uses long double leaves them undefined (permitted in a DSO), and linking an executable against that DSO then fails under lld's default --no-allow-shlib-undefined. For example science/harminv fails to link its binary against its own libharminv.so with undefined multc3/divtc3; at -O0, mulkf3/addkf3/__subkf3/__unordkf2 appear as well. Export the full runtime, gated on the PowerPC-specific LONG_DOUBLE_IEEE128 predefine so no other architecture is affected: complex multc3/divtc3 in GCC_4.0.0 (beside the other complex mul*c3), and the 28 scalar *kf* functions in GCC_7.0.0. Node placement follows glibc/gcc symbol-versioning history. Differential Revision: https://reviews.freebsd.org/D58248
Commit 4d80d4913e79 added a check for nfsess_defunct already being set. This was incorrect because, once set, nfsess_defunct remains set and an additional recovery might be needed. This patch reverts this part of 4d80d4913e79. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297252 Suggested by: olivier MFC after: 3 days Fixes: https://cgit.freebsd.org/src/commit/?id=4d80d4913e79 ("nfs: Fix argument typo to avoid a crash")
Delegations in NFSv4.0 never worked well and, since the NFSv4.0 protocol is now deprecated, use of delegations for NFSv4.0 is disabled as far as the client can do so. It turns out that some Illumos NFSv4.0 server issues delegations anyhow (even when the callback path is specified as 0.0.0.0) and this can cause use after free problems. This patch deleted some cruft that did an nfsrpc_openrpc() call recursively when an NFSv4.0 server failed to issue a delegation when it had previously done so. This code was only meant to be an optimization and would have been rarely exercised. Since this recursive call of nfsrpc_openrpc() is in some of the backtraces in the bugzilla PR, getting rid of the cruft makes sense. It is not known if this helps w.r.t. the use after free problems at this time. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297233 MFC after: 3 days
This addresses a race when two vnodes attempt to call vfs_hash_insert(), but only one succeeds. Also, in case of an error from p9fs_reload_stats_dotl(), it marks the vnode for deletion. Reviewed by: kib MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58632
Since autofs_lookup() calls into autofs_trigger_vn() to perform automounting, and autofs_trigger_vn() unlocks the vnode, it is possible for the unmount to start meantime. Then autofs_trigger() accesses freed memory. At this point, busy can be only done unblocking, and the transient failure must abort the trigger operation. This would cause spurious automounter errors, but at least should prevent accesses to the freed memory. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294361 Reviewed by: markj, rew Tested by: rew Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58626
This is a waste of time and results in a use-after-free if linsysfs is loaded and a USB network interface is in use, since USB devices are disconnected at shutdown, which triggers a call into linsysfs, which then tries to destroy a pseudofs node which has already been purged. MFC after: 1 week Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D58359
Do the advisory aborts of the in-flight requests before flushing the vnodes. It should mostly eliminate the waits due to requests busying the mp. Reported and reviewed by: rew Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58637
Kernel stuff (other than networking, filesystems, and drivers).
AF_MAX was always intended to be one more than the greatest allocated value. Jeff broke this in 2013. Unfortunately, a bunch of people then decided to adapt to the mistake instead of correcting it. Fixes: https://cgit.freebsd.org/src/commit/?id=863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.") MFC after: 3 days Sponsored by: Klara, Inc. Sponsored by: NetApp, Inc. Reviewed by: kevans, glebius Differential Revision: https://reviews.freebsd.org/D58597
Approved by: kib Pull Request: https://github.com/freebsd/freebsd-src/pull/2349
For pdwait(2) and pddupfd(2), the returned error is kept EINVAL. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297293 Reviewed by: lwhsu, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58666
Drivers which remap PF queues need a stop/mutate/restart transaction only when the interface has live queues. Permit their IOV initialization callback while the interface is administratively down and leave it down afterward. This restores the standard boot-time iovctl.conf workflow for igb and lets other opt-in drivers configure VFs before netif brings the PF up. MFC after: 1 week
Also add vnode locking wrappers for lockcanrecurse(9) and lockdisablerecurse(9). Reviewed by: jah Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58567
For some complex nullfs mount configurations, it is possible to get the covered vnode lock for the mount shared with some inside-mount vnode lock. Then at unmount time, vflush() would recurse on the covered vnode lock when reclaiming the vnode. Work around it, by temprorarily allowing recursion on the covered vnode lock. Disable recursion after the unmount if it was not enabled before. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297174 Reviewed by: jah Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58567
Fixes: https://cgit.freebsd.org/src/commit/?id=ed85203fb7a0 ("vmm: Deduplicate VM and vCPU state management code") Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D58697
It matches our IEEE80211_ELEMID_HTINFO, that is already in use. Found with: clang -Werror=assign-enum
Killing a knote releases its file reference, and releasing the last one runs the close path inline. panic: _mtx_lock_sleep: recursed on non-recursive mutex ttymtx Revoking a controlling tty during exit reaches this whenever a knote is still registered on it. Released the knlist lock around the drop and restart the walk. The knote stays valid while the lock is released. MFC: 1 week Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D58681
iflib counts resets initiated by its transmit watchdog in 69c3e0de01c1. Export the counter in the per-device iflib sysctl tree so every driver provides the diagnostic without a driver callback or duplicate storage. A watchdog reset does not establish how many packets failed. It can recover a hardware stall involving several queued packets or a missed completion involving no packet loss. Stop adding one output error per watchdog event in em(4), igb(4), and igc(4). Remove the redundant driver counters and move the diagnostic to dev.<driver>.<unit>.iflib.tx_watchdog_events. MFC after: 1 month Relnotes: yes
pci: Add SR-IOV status reporting Add a generic packed-nvlist status query to each /dev/iov/<PF> control device. Report the live VF Enable state, configured and total VF counts, and one record for each configured VF. Each VF record contains its PF-local index, computed PCI location, newbus attachment state, attached driver, and ppt binding. Construct records for hardware VFs whose newbus child is absent so attachment failures remain visible. Version the extensible schema in sys/iov.h. Use fixed-width request fields so the ioctl command and layout are identical for 32-bit callers. Serialize the topology snapshot with Giant, then pack and copy it after releasing Giant.
pci_iov: Use native types for status ioctl IOV_CONFIG and IOV_GET_SCHEMA expose native pointers and size_t lengths, and pci_iov has no compat32 ioctl translation. Using fixed-width fields for IOV_GET_STATUS alone does not make the interface usable by 32-bit binaries on a 64-bit kernel. It instead complicates otherwise ordinary pointer and length handling. Use void * and size_t like the existing ioctls. This also makes the %zu diagnostic in iovctl correct on ILP32 and removes the unneeded PTRIN conversion. Fixes: https://cgit.freebsd.org/src/commit/?id=6f8b3be1fbd6 ("pci: Add SR-IOV status reporting")
Google Cloud recommends migrating from gsutil to gcloud storage CLI. Update gce-do-upload target to use `gcloud storage buckets create` and `gcloud storage cp` instead of `gsutil mb` and `gsutil cp` commands. PR: conf/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297016 Reviewed by: lwhsu MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D58464
-- no commits in this category this week --
pdwait's capsicum/enotcap and procdesc's pdopenpid_capmode enter capability mode. Require security_capability_mode (and security_capabilities for enotcap) so the cases skip cleanly on kernels built without CAPABILITIES instead of failing. Approved by: asomers, gallatin Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D58545
Sponsored by: The FreeBSD Foundation MFC after: 1 week
These could go in other categories, but it's more clear if they're here instead.
manuals: Fix Fx and nearby mechanical typos Fix compiler warnings related to the Fx macro, as well as all other mechanical typos that were visible within one screenful of them. These cause rendering glitches on various toolchains with various of the five and a half decades of rich output formats and tooling manpages scale to. The *x macro set specifies operating systems. These macros take the rest of the line as an argument. Sometimes, a space was not used to separate the argument of Fx and the trailing period. Another, FreeBSD Foundation was misrepresented as an operating system version instead of an author. Two more had other parts of the sentence supplied as an argument to Fx. While I had those open, fix the other mechancial typos visible on those specific screenfulls. Fix a list width glitch, correct section typo AUTHOR to AUTHORS, and switch AUTHORS sections containing prose to prose-mode so that they wrap freely when rendered. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297248 MFC after: 3 days Fixes: https://cgit.freebsd.org/src/commit/?id=d39e310c7d6a ("man/man3: add stdbit.3") Fixes: https://cgit.freebsd.org/src/commit/?id=d790b16bbf0c ("add man pages for stdbit functions") Fixes: https://cgit.freebsd.org/src/commit/?id=b61850c4e6f6 ("net.link.bridge.member_ifaddrs to false") Reported by: wosch (groff is complaining about incorrect Fx usage)
manuals: Fix more Fx and nearby mechanical typos Fix compiler warnings related to the Fx macro, as well as all other mechanical typos that were visible within one screenful of them. These cause rendering glitches on various toolchains with various of the five and a half decades of rich output formats and tooling manpages scale to. The *x macro set specifies operating systems. These macros take the rest of the line as an argument. Sometimes, a space was not used to separate the argument of Fx and the trailing period. Others had other parts of the sentence supplied as an argument to Fx. While here, fix the other mechanical typos visible on those specific screenfulls. Correct section typo AUTHOR to AUTHORS, markup utilities with Sy, and apply line break after the end of a sentence. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297248 MFC after: 3 days Reported by: wosch (are you sure that's all of the broken Fx'es?) Fixes: https://cgit.freebsd.org/src/commit/?id=ff2bc641599a ("Fix Fx and nearby mechanical typos") Fixes: https://cgit.freebsd.org/src/commit/?id=d790b16bbf0c ("add man pages for stdbit functions") Fixes: https://cgit.freebsd.org/src/commit/?id=6c57e368eb17 ("implement C23 memalignment()") Fixes: https://cgit.freebsd.org/src/commit/?id=b06338167d64 ("ROUTE_MPATH and FIB_ALGO") Fixes: https://cgit.freebsd.org/src/commit/?id=7e1affa242ca ("revise divert-to and divert-reply")
MFC after: 1 week
Release notes at
https://community.nlnetlabs.nl/t/unbound-1-26-0-released
Merge commit '84ffc29dc8ddb0c946db5cb3b3c1310bec6a9e6c'
Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D58634
Found with: clang -Werror=assign-enum
This was a good idea, but we don't build metapackages in the kmods repo so it ends up breaking the release build. I might resurrect this change if/when the kmods repo includes the wifi-firmware-kmod metapackage. This reverts commit bda8028146694ee490543b35e3349e060936fde4. MFC after: 1 second
Not classified automatically, and waiting for manual attention.
-- no commits in this category this week --
Dates:
cgit.freebsd.org/src. Git accurately records the
order of commits, but not their dates.Automatic grouping:
This reverts commit \\b([0-9a-fA-F]{40})\\b
and the hash was found in this week's commits.
Automatic categories:
Source code:
Generated with commits-periodical 0.21 at 2026-09-14 17:37:20+00:00.
This work is supported by Tarsnap Backup Inc.
Alternate version: 2026-08-03 (debug) (contains info about the classification)