FreeBSD git weekly: 2026-08-31 to 2026-09-06

Pushed using the RTL8723BU.

Reviewed by:    ziaee, avos, adrian
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D59205

The default on my laptop is annoyingly bright, and this is a useful
feature to mitigate that.  The backlight script is largely a copy of the
mixer service which provides the same value for mixers, but this one is
specifically dependant on kld to allow DRM drivers a chance to attach.

Note that it's off by default to avoid interference with DEs, and
document the capability in backlight(8).  Set backlight_enable=YES in
rc.conf(5) to enable save/restore.

Relnotes:       maybe
Reviewed by:    bapt, ivy, manu, ziaee
Differential Revision:  https://reviews.freebsd.org/D59296

Make the witness LOCK_CHILDCOUNT a configurable kernel option.
On machines with a very high core count the default value is too
low, leading to witness exhaustion after boot.

Relnotes:       yes
Reviewed by:    kib, ziaee
Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/2398

Add iri_rcv_tstmp to if_rxd_info so an isc_rxd_pkt_get() driver can
report a hardware RX timestamp.  Copy it into m_pkthdr.rcv_tstmp,
reusing the generic mbuf timestamp path.

Widen iri_flags from uint8_t to uint32_t and define the flags drivers
may supply.  Mask the flags before copying them into the mbuf so no
other mbuf state can leak through the driver callback.

Place the timestamp next to iri_frags to avoid an alignment hole, and
document its nanoseconds-since-boot representation and validity flags.
Bump __FreeBSD_version because changing if_rxd_info breaks KBI.

Reviewed by:    gallatin
Signed-off-by:  Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Differential Revision:  https://reviews.freebsd.org/D58638

Add NIC-specific VF status to the existing ifconfig -v output.  Fetch
the data through libifconfig using a separate native route Netlink
query.

Group optional identity, initialization, resources, VLAN policy,
administrator policy, protocol, traffic-permission, and
fault containment fields.  Omitted fields remain distinct from false or
zero.

Refer users to iovctl -L for device-neutral PCI attachment and
passthrough state.

This is a Netlink-native evolution of the original interface by Eric
Joyner.

Relnotes:       yes
Sponsored by:   Intel Corporation (initial version)
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58778

Co-authored-by: Eric Joyner <erj@FreeBSD.org>

Display top-like NFS server I/O using dtrace(1).
Also supports JSON output for time-series.

Relnotes:       yes

Reviewed by:    ziaee, bcr, adrian
Differential Revision:  https://reviews.freebsd.org/D59438

Support cat -A, -E and -T, which are commonly used by Linux shell
scripts.  -E prints a "$" at the end of each line, -T renders tabs
as ^I, and -A is equivalent to -vET.

MFC After:      1 week
Discussed with: jrtc27
Reviewed by:    jrtc27, ziaee
Differential Revision:  https://reviews.freebsd.org/D59250

Prior to FreeBSD 11, vm_cnt was named cnt.  When it was renamed, vmstat
was modified to fall back to the old name if the new name was not found.
It's time we dropped this.

Reviewed by:    kib, jhb, emaste
Differential Revision:  https://reviews.freebsd.org/D59255

Commit 50c1240ebfaf moved the offset parsing into the PART_KIND_FILE case of
the switch, leaving PART_KIND_SIZE with no offset handling.
The offset was then silently ignored, so "-p efi::$size:$start" as used by
release/${ARCH}/mkisoimages.sh packed the ESP immediately after the preceding
partition.

Parse the offset outside the switch so both forms honour it.

Add tests covering absolute and relative offsets in both forms.

Reviewed by:    jrtc27, bsdimp, jlduran
Approved by:    jlduran, bsdimp
Sponsored by:   Netflix
Assisted-by:    Claude Code (Opus 5)

Reviewed by:  ziaee
Event:          Berlin Hackathon 202609

Reviewed by:  fuz, oshogbo
Approved by:    fuz (mentor)
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1489

Respect PORTSDIR variable for those who have the ports collection in a different
place than /usr/ports. PORTSDIR is a very common variable used in the ports
framework and in /etc/make.conf among other places.

While here, remove and old reference to CVS.

Reviewed by:    delphij@, ngie@
Approved by:    ngie@
Differential Revision:  https://reviews.freebsd.org/D42156

Reported by: ziaee

Reviewed by:    ziaee
Differential Revision:  https://reviews.freebsd.org/D59242

Uggg, copied this instead of using the new style.

Sponsored by:           Netflix

While here, document WITHOUT_DEBUG_PORTS.

Approved by: dch (mentor)
Approved by: kevans
Approved by: ziaee
Closes:      https://github.com/freebsd/freebsd-src/pull/2387

 - consistently use Mt request within Aq.  This makes author
   e-mail addresses clickable in many frontends.
 - @freebsd.org -> @FreeBSD.org
 - (user@host.tld) -> Aq Mt user@host.tld

Event:          Berlin Hackathon 202609
MFC after:      3 days
Reviewed by:    ziaee
Differential Revision:  https://reviews.freebsd.org/D59410

+ wrap some long lines
+ escape some ? wildcards
+ no macros in width specifiers
+ mention the speed in HARDWARE (bumps date)
+ use the hyperlink macro for... the defunct LSI website...
+ write out a symbol heavy error message format string in mdoc

MFC after:      3 days
Event:          Berlin Hackathon 202609

While here, s/PR#2411/NetBSD PR#2411/ in the comments for clarity.
I had to go to netbsd sources to get this information.

MFC after:      3 days
Event:          Berlin Hackathon 202609

The period here is part of the literal string in the example.  Adding a
space caused the example to be quoted wrongly.  Instead, a trailing
zero-width space keeps the linter mandoc -T happy.

Reviewed by:    ziaee
Differential Revision:  https://reviews.freebsd.org/D59353

Remove a note about "data of a different type".  This was a bug that was
fixed in FreeBSD 15.  Instead put an exact quote from SUS that lists
allowed cases of a short read with MSG_WAITALL.  See discussion in D57511.

The driver used the NVM APME default as both the hardware-support
decision and the mutable filter mask.  Consequently, an NVM-disabled
but capable port did not advertise wake support, disabling a wake mode
once could keep it disabled across later suspends, and directed-unicast
wake could never be selected.

Require the PCI power management capability to report D3hot PME support
before advertising or arming wake.  A PM capability alone does not mean
the function can signal PME from the state used during system sleep.

Separate the board and port capability matrix from the NVM-selected
magic packet default.  Read the proper per function NVM word on igb
controllers, cover the newer PCH generations, and retain the documented
legacy, multi-port, and OEM restrictions.  Decode the distinct APM
Enable locations used by 82544, 82541EI/82547EI, and the later 8254x
parts.  Do not advertise wake on the 82541ER, whose power-management
logic cannot assert PME for wake events.  For I210/I211 internal iNVM,
use the hardware-loaded WUC.APME state; the shared reader does not
expose the optional Initialization Control 3 word.

Build WUFC from the enabled ifnet capabilities for each suspend.
Reconstruct RAR0, the multicast table, and the receive filter after the
stop-time reset so unicast and multicast wake use the current interface
state.  Fill the MTA on legacy PCI/PCI-X controllers and 82575 through
82580 when the address list overflows; their multicast wake matchers
require the indexed MTA bit and do not use RCTL.MPE as a substitute.

Do not access PF-only wake CSRs from the igb VF suspend and resume
paths.

Use the shared BM page access helpers and propagate every PHY receive
address and wake-register programming failure.  On resume, perform the
required LCD reset before clearing host PHY-wake ownership, report the
saved PHY or MAC wake cause, and clear PCI PME after removing the device
wake source.  Preserve management engine wake ownership throughout.
Keep WUC.APME set only when early 82545EM/82546EB manageability needs
its D3 clock-tree workaround; ordinary host wake uses PCI PME.

Keep the link powered while host wake is armed.  With no host wake,
evaluate management pass-through at each suspend.  Leave a
management-owned link untouched and keep PCI PME enabled.  Otherwise,
use the Intel shared code PHY power-down hook, or its matching SerDes
shutdown hook on igb fiber and SerDes devices.  Track that state and
restore the link without another PHY reset before hardware
initialization.  Ordinary ifconfig down behavior is unchanged.

Apply and undo the PCH Sx workarounds across their full supported range.
Use controller-specific CTRL and laser semantics, and restore RCTL when
wake setup fails.  Always run the pending PCIe-transaction drain and
bus-master-disable sequence before D3.  Suspend reports a
wake programming failure rather than sleeping without wake, shutdown
logs it and continues through the fencing sequence.

Do not apply the ICH/PCH IGP3 D3 power-down workaround to igb
controllers.  The merged driver inherited an unconditional call from the
em-only driver.  On 82575 and 82576 it asserted CTRL.PHY_RST after the
wake filters were armed, preventing the link from receiving wake
traffic.

The implementation was checked against the Intel controller data
sheets, the Intel Linux e1000, e1000e, and igb lifecycle code, DPDK,
and the Intel FreeBSD em-7.7.8 and igb-2.5.31 drivers.  The 8254x audit
also covered the PCI/PCI-X Software Developer's Manual, the 82541/82547
NVM guide, and the 82544, 82545, and 82546 specification updates.  The
out of tree drivers carry the family-specific power down and reset block
hooks but do not call them from suspend.  DPDK supplies the stop/start
pairing.

On PCH controllers including an 82579LM, I217-LM, and various I219s,
device-only D3 tests observed PME and BM_WUS.MAG for a magic packet, no
PME with every host filter disabled, and BM_WUS.EX with only
directed-unicast wake enabled.  With dev.em.0.wake enabled, ACPI S3
slept until a delayed magic packet and resumed with the interface
operational.  After wake traffic stopped and resume completed, a second
cycle again waited for a newly delayed magic packet.  Traffic restored
after both host and firmware wake were enabled.

An 82574L woke from S3 after one magic packet, reported MAC wakeup
status, and returned with link and traffic operational.

On 82571EB and 82573L adapters, device-only D3 tests observed WUS.MAG
and PCI PME status after a magic packet, then returned to D0 with link
and traffic operational.  Full S3 did not wake either add-in card.
The positive device tests and negative S3 isolate the remaining failure
outside the MAC filter programming and my cards may lack aux power
wiring because the link was off in S3.

On 82575EB and 82576 adapters, pre-fix device only D3 tests left PMCSR
at 0x2103 despite ten verified magic packets, and the handoff showed
CTRL.PHY_RST asserted.  With the em-family gate, identical tests changed
PMCSR from 0x2103 to 0xa103, resume reported WUS.MAG, and both links
returned operational.  S3 testing on these separated controller from
board behavior.  An Intel 82576 card retained link in S3 and woke the
system from a delayed magic packet, reported WUS.MAG, and returned with
interface operational.  The tested 82575 add-in card lost its
link LED in S3 and retained no WUS cause after manual resume, although
its identical D3hot test passed.   That points the 82575 S3 result to
card aux power wiring as well.

D3 tests were performed on I210 and I350 but S3 has not yet been
attempted on them.

lem(4) testing has not been attempted yet.

Community reports of success and failure are welcome.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=232708, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238411, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295443, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296675
MFC after:      2 weeks
Sponsored by:   BBOX.io

The PCH suspend path kept a wake link fully powered and did not restore
the negotiated EEE modes after its stop-time reset.  Intel provides the
ULP entry and exit machinery in the shared code, but FreeBSD did not
invoke its Sx policy.

Enter ULP on LPT and newer PCH controllers when wake is armed without
directed-unicast, multicast, or broadcast filters, which ULP cannot
preserve.  For a link retained by host wake or management, restore the
100BASE-TX and 1000BASE-T LPI controls selected by the local
advertisement and the cached link-partner ability.

Keep these power reductions best-effort: wake filters and PME are
already configured independently, and a ULP or EEE failure is logged
without converting an optional power optimization into a suspend
failure.  The existing PCH resume workaround forcibly exits ULP and
clears automatic Sx LPI state before normal initialization.

Validated on a ThinkPad T440p with an I217-LM.  FBT confirmed that the
helper received the magic-wake mask during device suspend.  The shared
ULP helper returned its documented no-op for the initial I217 device ID.
A full S3 cycle resumed cleanly.

On a ThinkPad P51 with an I219, full S3 waited for a magic packet and
then resumed with the 1-Gbps link and traffic restored.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The 82576 and I350 retain VF queue enable and DMA address state
across VFLR.  iflib enables PCI bus mastering before driver attach, so
stale state left by a previous owner can otherwise issue DMA before
igbvf has completed its first reset and queue sanitization.

Disable PCI bus mastering immediately after mapping the VF BAR.  Keep
it disabled until reset and queue sanitization succeed, verify both
disable and enable through PCI command-register readback, and wait for
pending transactions before treating the fence as complete.
Resanitize on stop before iflib releases queue mappings.

The sanitizer and recovery were exercised on I350 and 82576 VFs.  Forced
queue-disable failure left the VF down, and a later administrative
down/up recovered it; successful I350 VFs passed bidirectional traffic
with no errors or drops.

Sponsored by:   BBOX.io

FreeBSD's bxe hardwires CNIC_SUPPORT() to 0, so bxe_ilt_set_info()
never enters the block that initializes the SRC and TM ILT clients.
Those two clients are left zeroed (page_size 0, flags 0), yet
ecore_ilt_init_page_size() calls ecore_ilt_init_client_psz() for all
four clients unconditionally. For SRC and TM that evaluates
ILOG2(page_size >> 12), i.e. ilog2(0). On an INVARIANTS kernel ilog2()
asserts "ilog argument must be nonzero" and panics the machine the
first time the interface is brought up (bxe_init -> bxe_nic_load ->
bxe_init_hw -> ecore_ilt_init_page_size). On a non-INVARIANTS kernel
it silently programs a bogus page-size register instead.

Restore the else branch that upstream Linux bnx2x carries: when CNIC
is not supported, mark the SRC and TM clients with ILT_CLIENT_SKIP_INIT
and ILT_CLIENT_SKIP_MEM so ecore_ilt_init_client_psz() skips them.

Root-caused from a crash dump on a BCM57810 (device 0x168e): the ILT
clients showed CDU and QM populated and SRC and TM zeroed with no skip
flag set.

Reviewed by:    adrian
Approved by:    adrian (mentor)
Differential Revision:  https://reviews.freebsd.org/D58587
Signed-off-by: Nick Price <nprice@FreeBSD.org>

clk_cpll_div_333m_div, clk_cpll_div_125m_div, clk_cpll_div_50m_div,
clk_cpll_div_25m_div, clk_cpll_div_100m_div, clk_osc0_div_750k_div
did not respond Rockchip RK3568 TRM Part1 V1.1-20210301.pdf
documentation page 79. I changed them correctly.

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2287

tpm: Correct the TPM 1.2 suspend transaction

The legacy driver wrote TPM_ORD_SaveState directly to the command
FIFO, but used ordinal 156 instead of the TPM 1.2 ordinal 152 and
never completed the transaction through the transport start and end
methods.  On a TIS device this omitted TPM_STS_GO, and the response
read used the header length as flags instead of requesting the complete
parameter size.  The legacy Atmel reader would also dereference the
null byte-count pointer.

Send the header-only command through the normal transport lifecycle,
validate the response header and TPM result, and retry TPM_WARN_RETRY
for a bounded five seconds.  Fail suspend rather than enter S3 after
an unsuccessful state save.

This follows the TPM 1.2 SaveState command definition and the bounded
retry policy used by other TPM 1.2 implementations.

The stock driver failed to resume a ThinkPad T440p with its STMicro
TPM 1.2 Security Chip enabled; disabling the chip made S3 reliable.
With this change and the following TIS resume restoration, the enabled
TPM completed two consecutive S3 cycles.  PCR 0 was readable with the
same value before and after each cycle, and no TPM errors were logged.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291067
Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59192

tpm: Restore TPM 1.2 TIS state after resume

Firmware restores the state saved by TPM_ORD_SaveState, but the TIS
interrupt, locality, and command FIFO state are not guaranteed to
survive S3.  The legacy driver previously treated resume as a no-op.

Revalidate the interface and device identity, disable and acknowledge
stale interrupts, restore the configured interrupt vector, reacquire
locality zero, and return the FIFO to command-ready state.  Also disable
TIS interrupts during initial setup when the device uses polling so
firmware settings cannot leave an unhandled interrupt enabled.

TIS 1.3 Table 22 makes the interrupt control registers locality
protected.  Acquire locality before disabling or programming them during
initial setup and resume rather than relying on probe retaining
locality.

Keep TPM self-test outside the resume critical path.  It can take
minutes on some TPM 1.2 devices and is not required to restore the
transport state.

The two-commit suspend and resume series completed two consecutive S3
cycles on a ThinkPad T440p with its STMicro TPM 1.2 Security Chip
enabled.  PCR 0 was readable with the same value before and after each
cycle, and no SaveState or TIS restoration errors were logged.

The locality ordering completed another two consecutive S3 cycles on a
ThinkPad T430 with the same STMicro TPM in polling mode.  PCR 0 again
remained stable, and TPM access recovered without errors after each
resume.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291067
Reviewed by:    kevans
Sponsored by:   BBOX.io
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D59193

tpm: Remove Giant from the TPM 1.2 driver

Serialize TPM 1.2 commands, character-device methods, and power
transitions with an sx lock, following the command ownership model used
by the TPM 2.0 driver.  Reject new operations once detach starts and
drain the character device before releasing transport resources.

Giant also closed the interrupt race between the final TIS status check
and tsleep.  Replace that implicit dependency with a mutex and condition
variable, use an absolute deadline across unrelated wakeups, and make
the interrupt handler MPSAFE.

Create the device node atomically with its softc and finish failed write
transactions so every command path releases its transport state.

The polling path was validated on ThinkPad T430 and T440p systems with
their STMicro TPM 1.2 devices enabled.  Exclusive-open behavior, 100
consecutive PCR reads, and module unload and reload completed without
errors on both systems.  Two consecutive S3 cycles on each system
preserved PCR values and command access, including another 100 PCR reads
after resume, without lock or TPM diagnostics.

Reviewed by:    kevans, seuros
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59211

tpm: Bound TPM 1.2 locality ownership

A TIS locality must remain active while a command is in flight, but
should be relinquished once the command completes or is abandoned.  The
driver retained locality zero after probe, initialization, and resume,
and several transaction error paths returned without releasing it.
Closing the device after writing a command without reading its response
had the same effect.

Track locality ownership and whether a command is awaiting its response.
Release locality after probe, initialization, and resume; retain it only
across a successful command write and its matching response read.  Abort
and release on errors, replacement commands, close, and detach.

Wait for locality during ISA probe instead of assuming an immediate
grant, release locality acquired by the probe, and stop treating the
command-style TPM_ACCESS register as restorable state.

On a ThinkPad T440p with an STMicro TPM 1.2, the old driver left
TPM_ACCESS at 0xa1 immediately after attach.  The new driver left it at
0x81 after attach, completed PCR reads, and closing with an unread
response.  PCR reads also survived an unload and reload without TPM or
locking diagnostics.

Reviewed by:    kevants
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59237

tpm: Move user copies outside the TPM 1.2 lock

The character-device paths held the transaction and lifecycle lock while
uiomove() accessed user memory.  A user page fault could therefore delay
suspend or detach, and a copyout failure occurred while the TPM response
was still active.

Copy commands into the bounded stack buffer before taking the lock.  For
reads, validate the response header, buffer the complete response while
the lock is held, finish the TPM transaction, and copy it to userspace
after unlocking.  Use a non-blocking allocation so memory pressure
cannot turn response buffering into another lifecycle wait.

NetBSD uses the same separation but limits responses to its fixed 1 KiB
buffer.  Allocate the TPM-advertised response length to preserve the
existing FreeBSD support for larger streamed responses.

On a ThinkPad T440p with an STMicro TPM 1.2, a PCR read into a 4 KiB
userspace buffer returned the expected 30-byte response.  A deliberately
short five-byte read failed cleanly, relinquished locality zero, and the
next PCR read succeeded.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59238

mmu_radix_sync_icache() walked the page tables with an unlocked
pmap_extract() and passed the result straight to PHYS_TO_DMAP(),
checking only that it was non-zero.  Nothing keeps the mapping - or the
page table page holding it - alive across that window: if another thread
of the same process tears a mapping down concurrently, the page table
page can be freed and reused, so pmap_extract() reads arbitrary memory
and returns a bogus physical address.  __syncicache() then dereferences
an unmapped direct map address and the kernel takes a data storage
interrupt:

  fatal kernel trap:
     exception       = 0x300 (data storage interrupt)
     virtual address = 0xc003317ca6022a00
     dsisr           = 0x40000000
     srr0            = 0xc000000000f59460 (__syncicache)
     lr              = 0xc000000000f23588 (mmu_radix_sync_icache)
            pid = 23878, comm = skyframe-evaluator-
  panic: data storage interrupt trap

The faulting addresses decode to physical addresses far beyond installed
memory (~140 TB and ~900 TB on a 256 GB machine), i.e. translations that
never existed.

The hash MMU implementation of the same method, moea64_sync_icache(),
already holds PMAP_LOCK() across the loop; do the same here.
mmu_radix_extract() does not acquire the pmap lock itself, so this
introduces no recursion.

JIT workloads reach this path constantly: ppc_instr_emulate() calls
pmap_sync_icache() on the faulting address for the SIGILL "second
chance" retry, so a multithreaded JVM executing freshly written code
races against its own threads' mmap/munmap.  Every panic observed here
was in a JVM thread.

Tested on POWER9 (radix MMU) with a bazel/JVM build loop that previously
panicked the machine twice within ten minutes: afterwards 13 consecutive
builds and more than 10 hours of uptime with no panic, on both
15.1-RELEASE and 16.0-CURRENT.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59311
Reviewed by:    jhibbits, adrian

ufshci: fix the Snapdragon X Elite reference clock

The driver's ACPI table set bRefClkFreq to 19.2 MHz. The
Snapdragon X Elite feeds the device 38.4 MHz from its CXO. The
firmware has no property for it. The device ran its PLL from
the wrong base. Every HS mode failed. PWM still worked. The
attribute is persistent. The wrong value survived reboots.

Set 38.4 MHz in the table. Read the attribute first. Write it
only when the value differs or the read fails. Log a changed
value and a failed read. Verified on the Galaxy Book 4 Edge.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59297

ufshci: set HS series per platform and adapt type per gear

The driver always asked for Rate-B. It never set the adaptation
type. The Snapdragon X Elite firmware tunes the PHY for Rate-A.
A Rate-B link dies at every gear there. HS-G4 and above need
initial adaptation. This is a UniPro rule. It applies to
every host.

Add an hs_series field to the device tables. Use Rate-A on the
Snapdragon X Elite. Keep Rate-B on the PCI hosts. A table entry
without an HS series fails to attach. Set PA_TxHsAdaptType to
initial adaptation at HS-G4 and above. Leave it alone below
that. Hosts before UniPro 1.8 do not have it. The Galaxy Book
4 Edge now links at HS-G5 Rate-A.

fio results (128k sequential, 4k random, posixaio):

QD  | SEQ_R(MiB/s) | SEQ_W(MiB/s) | RND_R(kIOPS) | RND_W(kIOPS)
----+--------------+--------------+--------------+-------------
1   |         1357 |         1221 |         12.1 |         27.2
4   |         3103 |         3234 |         46.5 |         92.9
32  |         3508 |         3238 |        176.4 |        125.0

Sequential writes land in the WriteBooster buffer. Sustained
writes drop to 556 MiB/s once the buffer runs out.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59298

ufshci: skip the reinit when the new link works

UFSHCI_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH always rebuilt the
link after the gear switch. It threw away a working HS link and
ended up in PWM. The reinit is only needed for a dead link.
There the local side reports HS and the peer never answers. A
local readback cannot tell the two apart. Peer traffic can.

Probe the peer with DME_PEER_GET after the switch. Skip the
reinit when the probe succeeds. Log it when the probe fails.

Reviewed by:            imp (mentor)
Sponsored by:           Samsung Electronics
Differential Revision:  https://reviews.freebsd.org/D59299

As noted in the comment, some headsets with a hardware sidetone are
incredibly sensitive and emit immediate feedback upon attach with the
current system-wide default of 75%.  Drop it down just for snd_uaudio(4)
to avoid incredibly unpleasant surprises.

MFC after:      3 days
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D59199

pmc_save_user_callchain() emits the pc it just loaded before checking
whether fp is the ABI's zero frame-chain terminator. At the bottom of
a well-formed chain under _start, fp comes back 0 as expected, but the
paired pc is stale rtld data left on the stack -- a legal userspace VA
that still passes PMC_IN_USERSPACE(), so it gets emitted as a bogus
extra frame. This shows up in flame graphs as a spurious hex-valued
root frame below _start.

Check fp == 0 alongside the existing checks before emitting, matching
how arm/arm64/powerpc already load the next fp before their check.

Measured via 1kHz hwpmc sampling on an OCA: stacks with any unresolved
hex frame drop from 23.9% to 1.3%, and stacks with hex at the root drop
from 5.5% to 0.3%.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>, gallatin
MFC after:      3 days
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D59229

Reviewed by:  fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59293

Mark the driver stopped after attach so its first IFDI_STOP() call
does not repeat hardware shutdown.

Defer error interrupt recovery through iflib instead of calling
driver stop and init methods from interrupt context.  Let iflib own
the stop and restart around MTU changes as well, avoiding duplicate
lifecycle operations.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Register the standard iflib device methods for shutdown, suspend, and
resume.  This gives axgbe the framework managed reinitialization used by
other iflib drivers after a power transition.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Register the iflib device suspend and resume methods so the existing
driver callbacks run during system power transitions.  This stops
mailbox retry work before suspend and lets iflib reinitialize the
datapath after resume.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Register the standard iflib device suspend and resume methods so the
framework reinitializes the VF datapath after a system power
transition.

MFC after:      2 weeks
Sponsored by:   BBOX.io

Register the iflib device suspend and resume methods.  Remove the
direct initialization from the driver resume callback because
iflib_device_resume() performs the datapath restart after the callback
returns.

MFC after:      2 weeks
Sponsored by:   BBOX.io

The internal TPM2_Shutdown and TPM2_Startup paths ignored both transport
failures and the TPM response.  Suspend could therefore enter S3 without
saved TPM state, while resume could restart entropy harvesting after a
failed state restoration.

Build both commands through one helper, validate their response framing
and TPM return codes, and propagate failures.  Retry the standard RETRY
and TESTING responses with bounded exponential backoff.  Accept
TPM_RC_INITIALIZE from Startup because firmware may already have started
the TPM during resume.

Do not enter S3 after an unsuccessful state save, and do not restart the
entropy task when TPM state restoration failed.  If Shutdown fails after
the entropy task was drained, requeue it before returning so an aborted
suspend does not permanently stop harvesting.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59195

The TIS attach path tested its interrupt by transmitting GetRandom
before tpm20_init() allocated the internal command buffer.  A TPM2 FIFO
device with a usable IRQ could therefore dereference a null
internal_priv.

Initialize the common TPM2 state before running the interrupt test.
Make common cleanup safe for partially initialized devices and leave
cleanup to the attachment after tpm20_init() fails, avoiding duplicate
release of the lock, command buffer, and random-source state.

Clear the IRQ resource pointer after releasing it when interrupt handler
setup fails so the later polling-mode detach does not release it twice.

Free the internal command allocation through its object pointer rather
than relying on its embedded buffer being the first structure member.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59196

TIS interrupt routing and enable registers may lose their state across
S3, while the driver retains its software indication that interrupts
work.  A subsequent locality or command wait can then sleep for an
interrupt that cannot arrive.

Remember whether interrupts worked before suspend and restore the
vector, pending status, and enable mask before TPM2_Startup.  Put the
transport in polling mode first; the interrupt handler promotes it back
to interrupt waits only after observing an interrupt from the restored
configuration.  If register restoration fails, Startup and subsequent
commands continue using polling.

Preserve the initial interrupt-enable mask, including the firmware's
trigger and polarity selection proven by the attach time interrupt test,
and restore that exact mask rather than accepting post-S3 defaults.

Program the same safe baseline for polling devices during attach and
resume.  Acquire locality, disable global interrupt delivery, and
acknowledge pending status so firmware cannot leave interrupts armed
without a handler.

Use the same register programming helper during attach and resume, and
stop trying to configure interrupts after a locality acquisition
failure.

Three consecutive device suspend and resume cycles completed on a Lenovo
TPM2 FIFO device without an IRQ resource.  GetRandom succeeded after
each resume, and module detach completed without errors.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59197

Mark the device as dying before teardown and destroy the character
device before freeing its private state or lock.  This prevents cdev
methods from entering with a freed internal buffer or a destroyed sx.

Check the teardown state in command paths, honor failures from the cdev
private data interface, and publish teardown before waiting for the
lifecycle lock.  Keep that lock across TPM retry delays so commands
cannot interpose and private state remains pinned, but abort before the
next retry once teardown begins.

Block new cdev operations after a successful Shutdown(STATE).  Keep the
suspend gate and the TPM command under the same lock so a userspace
command cannot invalidate the saved state before S3 entry.  Clear the
gate only after Startup(STATE) succeeds.

Keep entropy harvesting scheduled after a transient command or suspend
failure, but stop it while suspended or once teardown begins.  Queue the
next timeout while holding the lifecycle lock so release cannot miss a
concurrent requeue.

Validated on two TPM 2.0 FIFO systems.  Each completed five device
suspend/resume cycles, rejected both new and already-open cdev
operations with EBUSY while suspended, completed 200 concurrent PCR
reads, and detached cleanly while four PCR readers were active.  A
ThinkPad P51 also completed a full S3 cycle with PCR 0 unchanged and
50 successful reads after resume.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59240

The TIS interrupt handler can acknowledge and signal an event after
the waiter checks the device status but before it enters tsleep().
Since the handler is MPSAFE, the command lock does not close this
window.  A lost wakeup can delay a completed command for its full
timeout, up to 40 seconds for long TPM 2.0 operations.

Publish the expected event under an interrupt mutex and use a generation
counter to record matching interrupts.  Recheck the device predicate
without the mutex because register access may sleep on a SPI transport,
then compare the generation before atomically waiting on a condition
variable.  This closes the check-to-sleep race without placing sleeping
bus operations under a mutex.

Use an absolute deadline while retrying the predicate after wakeups.
Apply the same scheme to locality acquisition, which had an equivalent
race.  Leave the expected event published while polling so the
attach-time test can still prove that an advertised interrupt arrived.

Regression-tested the polling fallback on two TPM 2.0 FIFO systems with
200 concurrent PCR reads per system and repeated device suspend/resume.
Neither ACPI device exposes an IRQ, so the interrupt-mode path remains
hardware unvalidated.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59241

tpm20: Release transport state after command failures

Once a transport acquires locality, several TIS and CRB error paths
return without relinquishing it.  They can also leave a partial FIFO
transaction or an active CRB command for the next operation to inherit.

Route post-locality exits through common cleanup.  Reset the TIS command
state on every attempt.  For CRB, cancel an active failed command when
necessary, request the idle state, and relinquish locality even when the
state transition itself fails.

Successful command handling is unchanged apart from sharing the same
cleanup path.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59243

tpm20: Correct 32-bit register helpers

OR4() reads only the low byte before writing the complete 32-bit
register.  Preserve all register bits by using a matching 32-bit read.

Make BIT() produce an unsigned value so masks containing bit 31 do not
rely on a signed left shift into the sign bit.  OpenBSD carries the
same change.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59244

tpm20: Move user copies outside the lifecycle lock

The TPM 2.0 character-device methods held the global device lock
while uiomove() accessed user memory.  User page faults could therefore
delay suspend or detach even though the read response was already
buffered.

Add a per-open sleepable lock to serialize operations on each response
buffer.  Stage commands under that lock before acquiring the device
lock, and copy them into the response buffer only after the lifecycle
checks succeed.  This preserves an unread response when suspend or
detach rejects a write.  Release the device lock before copying buffered
responses out.  Also advance the response offset by the bytes actually
copied when uiomove() returns after a partial transfer.

Validated on an Intel TPM 2.0 TIS device.  PCR reads and GetRandom
passed under 16-process mixed command load.  A response was consumed
correctly in 5-byte, 7-byte, and remainder reads.  Module unload/reload
recreated the device and entropy source without lock diagnostics.
Source inspection confirmed rejected writes preserve unread responses.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59245

Move the dtrace_trap hook at the start of the abort handler to exit
early when a trap is handled by DTrace.

Fix the type argument to be the actual fault type instead of the value
of the FAR. The latter will need to be added to the trapframe, until
then DTrace will report unmapped addresses as the null address.

Correct the comment of the PUSHFRAMEINSVC assembler macro to reflect
that coming from SVC32 mode is expected for DTrace traps.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298064
MFC after:      1 month
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59279

bus_dmamap_load_mem() reports most mapping failures, including EFBIG,
only through its callback and then returns zero. nvme_payload_map()
logged the error without telling the submission path, so the tracker
stayed on the outstanding list with no command submitted and no
timeout armed, stalling all later I/O on the queue behind it.

Approved by: ngie (co-mentor)
MFC after:      1 week

Reviewed by:    ngie, imp
Differential Revision:  https://reviews.freebsd.org/D59151

The namespace character device does not initialize si_iosize_max, so
physio falls back to DFLTPHYS and can produce a bio larger than the
qpair payload DMA tag on a controller whose maximum transfer size is
below 64KB. Such a bio fails DMA mapping and is never submitted.

Approved by: ngie (co-mentor)
MFC after:      1 week

Reviewed by:    ngie, imp
Differential Revision:  https://reviews.freebsd.org/D59152

This change adds support for AMD's UMC performance counters.  It is a
bit more complicated than existing counters because the enable bit has
moved.  This supports Zen 4 through most Zen 6 chips as UMC counters are
per-node, where a node does not necessarily translate to a NUMA domain.
A few follow up changes to PMC will address this limitation.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2368

The initial statistics update runs before the PF VSI has obtained its
firmware-assigned statistics counter index.  Discard that provisional
VSI baseline so the first update after initialization records the
correct hardware counter.

Without this reset, subtracting a larger provisional value from a newly
selected counter can be mistaken for a 32-bit wrap and report nearly
UINT32_MAX receive drops immediately after boot.

Reported by:    Daniel Braniss <danny@cs.huji.ac.il>
Tested by:      Daniel Braniss <danny@cs.huji.ac.il>
Obtained from:  Intel ixl 1.14.2
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59336

Whenever we create a user-space mapping, we always set ATTR_S1_PXN in
the PTE, which blocks execution of user-space code while running in
kernel mode.  However, when seeking to determine whether we need to
perform an icache flush before installing the new PTE, we test whether
sometimes the old PTE or other times the new PTE has ATTR_S1_XN set.
The trouble is that ATTR_S1_XN is defined as the bitwise OR of
ATTR_S1_PXN and ATTR_S1_UXN, and so the test for whether ATTR_S1_XN is
set is satisfied if either of its constituent bits is set, i.e., we
write (l3e & ATTR_S1_XN) != 0.  Consequently, the test is always true.

In practice, I believe that the ill effects of this bug are limited:
In pmap_enter(), in rare circumstances, e.g., wiring a code page, an
unnecessary icache flush will be performed.  In pmap_enter_l2() and
pmap_enter_l3c(), no icache flush will be performed.  However,
typically an icache flush would have already been performed on each of
the constituent base pages.

Reviewed by:    kib, markj
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D59265

Wake-on-LAN capability was inferred from NVM bits on every MAC even
though 82599 support is board and sometimes port specific.  Private
sysctls formed a second policy interface, and the driver neither
coordinated the controller wake source with PCI PME nor reliably
rebuilt address filters erased by the stop-time reset.

Use the standard ifconfig wake capabilities.  Derive support from the
82599 board and port matrix or the X540-and-newer NVM capability.
Require D3hot PME support, and use the NVM APME bit only to select the
initial magic-packet policy after initializing the LAN function number.

Snapshot requested filters before the terminal stop so shared reset and
PHY code sees the active wake policy.  After reset, restore RAR0, the
multicast table, receive filtering, and the optical laser before arming
WUFC, WUC, and PCI PME.  Remove device wake sources before clearing PCI
PME on detach, resume, and when wake is disabled.  Clear autonomous APM
so ifconfig remains authoritative.

Treat X550EM low-power-link-up failure as best effort and allow shutdown
to continue after a wake-programming error.

The 82599, X540, X550, and E610 datasheets document the standard ACPI
wake filters used here; the E610 ACPI path includes magic-packet wake.

Validated on a dual-port E610.  Both ports completed three direct-D3
cycles covering wake disabled and magic-packet wake armed.  A system S3
cycle woke through ix0 with WUS 0x00000002 (magic packet).  Link and
traffic recovered after each transition.

Note that many add-in cards in this family do not support WoL; LOM and
OCP cards are more likely.  The E610 as tested does.

MFC after:      2 weeks
Sponsored by:   Dirk-Willem van Gulik from Web Weaving (E610 hardware)
Sponsored by:   BBOX.io

Reported by:  Andrew Griffiths <andrew@calif.io>
Reported by:    Chris Jarrett-Davies <chrisjd@openai.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

There are 4 options for e500 watchdog timeout, which may be core- or
even SoC- specific.  Add support to tune the behavior via a tunable
(machdep.watchdog_mode).  The tunable value is an integer 0-3.

A critical exception, such as a watchdog, can trigger at any time,
including the middle of a standard exception prologue or epilogue, so
GPRs, including %r1 (the stack pointer) cannot be trusted at all.
Instead, use a private stack pointer for critical interrupts.  Each CPU
now has its own critical exception stack, with the boot stack in the
bss.

There's a small window between when the SRR* registers are restore and
the exception returns, in which a TLB miss exception may be triggered.
Since there are not special SRR* registers for TLB miss exceptions, the
registers from the frame will be ovwritten, and the FRAME_LEAVE block
will effectively be re-entered on exit, leading to a very hard to
diagnose panic or wedge.

Minimize this chance by pushing the SRR* restore to the last possible
moments, caching them in a PCPU save area instead until the end.  This
matches what the AIM side already does.

If a pmap is freed and its memory is reused before its TID reference is
taken, then arbitrary memory will be clobbered.  Avoid this by never
dereferencing the pmap pointer in the tidbusy array, and instead using
it as a compare sentinel.

When a TLB miss exception occurs the exception handler must walk the
page table from the root.  When the root is allocated from KVA the TLB
miss exception may take another exception if the root page(s) aren't in
the TLB.

The 64-bit page table is modeled after the AIM radix page table, with a
64kB root "page", so 16 pages.  This makes regular use of UMA
allocations unable to refer back to the DMAP, which itself is mapped in
TLB1.  Now we take another page from the radix pmap driver and grab
contiguous pages from the VM system, so that we can simply refer
directly to DMAP and avoid more nested TLB misses.  We can still take a
nested miss, though, because the pmap itself may be in KVA, but this
reduces the nesting.

Add a new CPU-family `show pcpu` handler, cpu_db_show_mdpcpu() to dump
CPU-specific PCPU data.  Only Book-E is populated for now, but AIM may
be populated later.

These new field prints: save areas, TLB miss nesting, the new critical
stack pointer.  All of them have been very useful for debugging very
esoteric bugs, so make them easier to see from DDB, instead of having to
rummage through hex dumps.

The initializer just needs working malloc(9) and two constants that
are set at hammer_time().

Fixes:  https://cgit.freebsd.org/src/commit/?id=648fa3558c161a1d8564626d21047710c3fbfdf6

Reviewed by:            avg, markj
Differential Revision:  https://reviews.freebsd.org/D58714

When debugging the D59463 review, it is very handy to be able
to change the software portal holdoff time without recompiling
the kernel. This commit makes the holdoff time a sysctl tunable,
so it can be changed at runtime.

Tested by:              dsl
Obtained from:          flo_purplekraken.com
MFC after:              3 weeks
Differential Revision:  https://reviews.freebsd.org/D59461
Event:                  Berlin Hackathon 202609

Expose cached per-VF configuration through the iflib VF status method.
Report mailbox handshake state, MAC address, access or trunk VLAN mode,
hardware transmit and receive queue counts, administrator policy, and
fault-containment state.

The query does not issue mailbox requests or read hardware registers.

Sponsored by:   BBOX.io

Expose cached VF configuration, policy, and runtime state through the
iflib VF status method.  Include access or trunk VLAN mode, transmit and
receive queue counts selected by the current virtualization mode,
negotiated mailbox API, PF traffic permission, fault containment, and
quarantine state.

Initialize every cached API version before VF enumeration so an
unconfigured slot cannot be mistaken for API 1.0.

The query does not issue mailbox requests or read hardware registers.

Sponsored by:   BBOX.io

Expose cached per-VF configuration through the iflib VF status method.
Report mailbox initialization and the negotiated virtual-channel API, MAC
address, access or trunk VLAN mode, queue resources, administrator policy,
PF traffic permission, and fault containment.

Expose per-VF malicious-driver isolation and cumulative transmit and
receive event counts through a versioned driver.ixl extension.

Track successful PCI IOV attachment separately from hardware capability.
This lets a successfully attached but unconfigured PF return an empty
snapshot without claiming support when PCI IOV registration was
unavailable.

The query uses driver-cached state and does not issue AdminQ requests or
read device registers.

Sponsored by:   BBOX.io

Add dev.asmc.0.sil sysctl to control the SIL LED via SMC keys
MSLD (duty/brightness) and MSLS (state latch, must be set
before re-enabling).

MFC After: 1 week

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58865

apple_bce: kick USB explore thread after VHCI attach

Call usb_needs_explore() after attach so the hub explore thread
enumerates all initially connected ports instead of only the first.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58870

apple_bce: fix cold boot panic in mailbox send

Poll mailbox reply registers with DELAY() when the system is still
cold, falling back to the interrupt-driven
sema_timedwait path once timers are available.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58871

apple_bce: ignore duplicate TRANSFER_REQUEST in STATUS state

Since the host initiates IN data transfers, the
firmware's own TRANSFER_REQUEST for the same phase arrives after
we've already moved to STATUS state. Ignoring  instead of failing
the transfer with USB_ERR_IOERROR.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58873

apple_bce: fix C_CONNECT_STATUS during port reset

Only set the port change bit when the corresponding status bit
actually transitioned, instead of unconditionally flagging
C_CONNECT_STATUS on every port change event. Also clear any
flaky C_CONNECT_STATUS that the port change taskqueue may have
set while the bus lock was dropped during a successful port reset.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58875

apple_bce: initiate IN data phase for control transfers

For IN control transfers, the firmware does
not send TRANSFER_REQUEST for the data phase
the host must send BCE_VHCI_CMD_TRANSFER_REQUEST
with an IN DMA buffer once the setup phase completes.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58872

For non listening TCP endpoints, increment the tcps_sig_err_sigopt
counter when TCP MD5 is not enabled in the TCP connection, but a
segment containing a TCP MD5 option is received.
Also increment the counter when using the RACK or BBR stack.

Reported by:            Hannes Elfert
Reviewed by:            rrs
MFC after:              1 week
MFC to:                 stable/14
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D59249

When _task_fn_admin() is active, it will regularly call
IFDI_UPDATE_ADMIN_STATUS(). So there is no need to do it in
iflib_media_status. This can be fairly expensive on some drivers (long
DELAY busywait loops waiting for a NIC command), and there is no need
to pause a userspace app in this DELAY() if it is happening
asynchronously anyway.

Note the logic to detect if _task_fn_admin() is regularly calling
IFDI_UPDATE_ADMIN_STATUS() was copied from that function.

Reviewed by: erj, kbowling
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D54096

ng_bridge(4) says the node does not learn MAC addresses on uplink
hooks. However, learnMac was only checked when inserting a new
host. A host already known on a link hook was still moved if a
packet with that source address arrived on an uplink hook.

The nature of this is that inbound unicast to that host then
never arrives (the destination is known on the incoming hook).
Unknown unicast after timeout is still sent only to uplink, so
the host is not re-learned. The interface stays up and outbound
may still work. This can last minutes or weeks until reboot or
NGM_BRIDGE_MOVE_HOST.

Connecting ng_ether(4) lower to an uplink hook is enough: the
host's own transmit can appear on the uplink and the table entry
moves.

Use the same learnMac test for data-path move as for insert.
NGM_BRIDGE_MOVE_HOST from userland is unchanged.

MFC after:      1 week
Reviewed by:    jlduran
Differential Revision:  https://reviews.freebsd.org/D58902

The restored watchdog arms when the outstanding descriptor count
grows, but then continues counting based only on the queue remaining
frozen.  A single growth sample can therefore leave a quiet, nearly
empty queue armed until the watchdog resets the interface.  Lockless
sampling of the queue counters can also manufacture the initial growth
sample.

This matches watchdog reports from I354 queues with 979 or 980 of
1022 usable descriptors still available.  Neither queue was under
transmit backpressure when the reset flapped its link.

Keep the watchdog armed only while the outstanding count continues
to grow, the software ring is stalled, or the hardware ring is at
iflib's backpressure threshold.  The last condition preserves hang
detection with simple-TX, which bypasses the software ring.  A busy hang
still reaches the verdict while a frozen but quiet tail disarms.  Retain
the final driver completion peek so a missed completion interrupt
schedules the queue task instead of resetting it.

Validated on an 82580 with one and four queue sets in the default
mp_ring and simple-TX modes.  Sustained traffic and repeated burst/idle
cycles produced no false resets.  Sixteen-flow runs exercised all four
queues in both modes.  Clearing TCTL.EN under load in each configuration
filled the rings; the reset counter advanced once per injection, reset
restored TCTL and the link, and traffic recovered.

Tested by:      glebius
Reviewed by:    iflib (gallatin), manpages (ziaee)
Fixes:          https://cgit.freebsd.org/src/commit/?id=69c3e0de01c1 ("iflib: restore TX watchdog functionality")
MFC after:      6 days (after 69c3e0de01c1)
Sponsored by:   BBOX.io

iflib_device_register() acquired IFNET_WLOCK to preserve lock order
when ether_ifattach() was called with the context lock held.  The context
lock is now released around ether_ifattach(), making registration-wide
ifnet serialization unnecessary.

Keeping IFNET_WLOCK across driver attachment also allows synchronous
interface event handlers to recurse on it.  The rtnetlink interface-group
dump does so through if_foreach_group() while handling the interface
attachment event.

Remove the outer lock and the corresponding failure-path unlock and
relock transitions.  Continue to drop the context lock around
ether_ifattach() and taskqueue drains, and preserve context-lock coverage
for driver attach and detach.

Validated under WITNESS on 82576 and I226 controllers.  Multiple VF
attach and detach cycles, netmap control operations, and every iflib
registration failure injection point completed without lock or cleanup
errors.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298121
Reported by:    glebius, netchild, Yuichiro NAITO <naito.yuichiro@gmail.com>
Reviewed by:    gallatin, glebius
Fixes:          https://cgit.freebsd.org/src/commit/?id=e0e12405285b ("netmap: fix LOR in iflib_netmap_register")
Fixes:          https://cgit.freebsd.org/src/commit/?id=2f8f892ca344 ("rtnetlink: Add FreeBSD-specific IFLAF_GROUP support")
Fixes:          https://cgit.freebsd.org/src/commit/?id=90e7dbe5e2ca ("iflib: Add registration failure injection points")
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59294

The new watchdog code triggers spurious watchdog resets on
NICs doing KTLS offload.  Fix this by using the actual segments
consumed by the NIC driver's isc_txd_encap.

The issue is that rs_pending is updated using an estimate of
the  descriptors that will be used for the current packet,
based on what bus_dma produced. However, NICs which support
ktls offload may do extra  DMAs (and consume extra
descriptors) to derive crypto state when re-transmitting
TLS segments.  This is the reason for allowing drivers to control
ift_pad.  When this happens, the estimated rs_pending may undercount.
This may also happen if NIC drivers consume extra descriptors for
other reasons. (eg, hw errata handling on e1000)

Reviewed by: kbowling
Differential Revision:  https://reviews.freebsd.org/D59321
Sponsored-by: Netflix

When receiving a SYN segment with an MD5 option on a listening socket,
which has not enabled TCP MD5 support, increment the counter for
unexpected signatures (tcps_sig_err_sigopt).

Reviewed by:            rscheff
MFC after:              1 week
MFC to:                 stable/14
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D59303

When processing the ACK of the initial TCP handshake using the
SYN cookie, don't increment the counter for unexpected
signatures (tcps_sig_err_sigopt). The correct
counter (tcps_sig_rcvbadsig) for bad signatures is already
incremented in TCPMD5_INPUT().

Reported by:            Hannes Elfert
Reviewed by:            rscheff
MFC after:              1 week
MFC to:                 stable/14
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D59302

All other usages of SCF_SIGNATURE are protected by IPSEC_SUPPORT
or TCP_SIGNATURE.
No functional change intended.

Reported by:    Hannes Elfert
MFC after:      1 week
MFC to:         stable/14
MFC to:         stable/15

Approved by:  kp
Sponsored by:   InnoGames GmbH
Differential Revision:  https://reviews.freebsd.org/D58755

Add a transport neutral kernel snapshot for NIC-specific SR-IOV VF
status and an optional iflib provider method.  Providers gather state
under driver defined synchronization.

Honor RTEXT_FILTER_VF on RTM_GETLINK requests and encode the status as
native typed route Netlink attributes.  Represent VFs, driver
namespaces, and namespace fields as directly repeated nested attributes.
Presence masks in consumers can distinguish omission from false or zero.

Drivers may add custom status under stable, versioned namespaces.  The
named, typed representation lets generic transports and consumers carry
or display fields without knowing their driver-specific schemas, while
the driver retains ownership of their names and meanings.

Document the ABI and add parser and RTM_GETLINK coverage.

Reviewed by:    melifaro, iflib (gallatin), kgalazka (previous version)
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58776

Since the struct inpcb in embedded in the struct tcpcb, the
relationship can't change. So there is no need to reassign the tp
anymore.
No functional change intended.

Reported by:            Hannes Elfert
Reviewed by:            glebius
MFC after:              1 week
MFC to:                 stable/15
Differential Revision:  https://reviews.freebsd.org/D59384

In a WITHOUT_INET6 build the only assignment to netid2 is compiled out and
the non-INET6 arm returns early, so netid2 is unconditionally NULL and the
rpcb_set() call guarded by it is dead code. clang does not prove it dead
and reports nbuf2 as uninitialized where it is passed as a const pointer,

No functional change.

MFC after:      1 week
Reported by:    clang (-Wuninitialized-const-pointer)
Suggested by:   dim
Approved by: ngie (co-mentor)

Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D59277

The strtoul function sets errno on error, but does not clear it on
success; when using strtoul and checking errno (as one should) for
ERANGE / EINVAL afterwards, it's important to zero errno first.

While here, remove a dead store.

Reviewed by:    phk
Fixes:  https://cgit.freebsd.org/src/commit/?id=4fe8c1b67be0 ("Add error and range checking ... ")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59270

Pandaboard (sys/arm/ti/omap4) is removed due to lack of HW.
Remove the pandaboard config file for nanobsd aswell.

Approved by: imp, jlduran, manu(mentor)
Diffrential revision: https://reviews.freebsd.org/D54319

Signed-off-by: Aryan Arora <aryanarora.w1@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2359

"Qualcomm Atheros Communications Dell Wireless 1802 Bluetooth 4.0 LE"
(0cf3:e006) is a wifi-bluetooth combo. The bluetooth chip is confirmed
to be AR3012 compatible. That's what the Linux ath3k driver loads as
well. It has been tested with the firmware files from the
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
repository as the comms/ath3k-firmware port appears to be discontinued.

Signed-off-by: Robin Haberkorn <rhaberkorn@fmsbw.de>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2280

The default on my laptop is annoyingly bright, and this is a useful
feature to mitigate that.  The backlight script is largely a copy of the
mixer service which provides the same value for mixers, but this one is
specifically dependant on kld to allow DRM drivers a chance to attach.

Note that it's off by default to avoid interference with DEs, and
document the capability in backlight(8).  Set backlight_enable=YES in
rc.conf(5) to enable save/restore.

Relnotes:       maybe
Reviewed by:    bapt, ivy, manu, ziaee
Differential Revision:  https://reviews.freebsd.org/D59296

On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running.  close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue.  When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.

Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.

Reviewed by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=95381c0139d6 (syslogd: Use process descriptors)
Differential Revision:  https://reviews.freebsd.org/D59319

While here, use caph_rights_limit(), as syslogd already uses
caph_enter().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298104
Reported by:    mi
Fixes:          https://cgit.freebsd.org/src/commit/?id=24816abb8740 ("syslogd: Limit rights on procdescs")
MFC after:      3 days

checklost() scans for lost cluster chains and attempts to
repair each one, first by reconnecting it to LOST.DIR,
and falling back to clearing it if reconnection fails.
However, checklost() incorrectly updates the modification
status flags (mod), which checkfilesys() relies on to
determine whether to write back changes and what exit
status to return.

The current code have three issues:

1. A reconnect() failure immediately sets FSERROR in mod
   via "mod |= ret = reconnect(...)".  If reconnect() failed
   (e.g., because LOST.DIR is missing, or full) but the
   fallback clear operation succeeds, clearchain() frees the
   chain and sets FSFATMOD.  However, the leftover FSERROR
   remains in mod: checkfilesys() skips marking the file system
   clean and exits with status 8, even though the file system was
   fully repaired and a subsequent run finds nothing left to do.
   This can happen with "fsck_msdosfs -y" on a volume without
   LOST.DIR.

2. The same assignment overwrites checkchain()'s return value
   before it can be recorded in mod.  When checkchain()
   truncates a chain (e.g., one whose tail points to a free
   cluster), its FSFATMOD status is lost, causing checkfilesys()
   to skip updating the FAT and discard the truncation.
   With LOST.DIR present so that reconnect() succeeds,
   "fsck_msdosfs -y" reports "Truncate? yes" and "FILE SYSTEM WAS
   MODIFIED", exits 0, but leaves the identical damage on disk
   to be found again on every subsequent run.  Similarly, an
   FSFATAL return value from checkchain() is dropped, defeating
   the "if (mod & FSFATAL) break" guard that follows.

3. When checkchain() returns FSERROR and clearing the chain is
   declined, no error status is recorded in mod, causing fsck_msdosfs
   to report a clean exit despite leaving un-repaired damage.

Fix these issues by:

 - Merge checkchain()'s status into mod before calling reconnect(),
   and skip reconnect() if checkchain() returned a fatal error.
 - Defer recording FSERROR from a failed reconnect() until after the
   Clear fallback attempt, setting FSERROR only if the chain remains
   unhandled.

MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2251

Add an ATF test suite covering Phase 3 ("Checking for Lost Files")
error accounting.  Test images are created using newfs_msdos(8),
and lost cluster chains are injected directly into FAT copies at
offsets derived from the BPB.  The LOST.DIR directory required by
reconnect() is constructed similarly: a root directory entry with
ATTR_DIRECTORY set and its first cluster pointing to a zero-filled
cluster containing "." and ".." entries.

The lost_chain_cleared and corrupted_lost_chain_reconnected test
cases provide regression coverage for the preceding commit:
 - lost_chain_cleared verifies that clearing a lost chain (the fallback
   taken when LOST.DIR is absent) exits with status 0 rather than 8
   (unrecovered error).
 - corrupted_lost_chain_reconnected verifies that FAT modifications
   from a chain truncated by checkchain() prior to reconnection are
   written back to disk, requiring "Update FATs? yes" and ensuring a
   clean second pass.

Additionally, lost_chain_left_alone, lost_chain_preen, and
corrupted_lost_chain_left_alone cover scenarios that must continue to
report unrecovered errors: read-only mode (-n), which performs no
repairs and leaves the image byte-for-byte unchanged, and preen mode
(-p), which attempts reconnection but does not clear lost chains.

MFC after:      1 week

Invoke releasefat(fat) in checkfilesys() prior to free(fat) on exit paths
so that fatbuf, headbitmap.map, and fat32_cache entries are properly freed.

MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2351

readboot() decoded the 32-bit little-endian BIOS Parameter Block and
FSInfo fields by shifting the individual bytes of a u_char array into
place.  The u_char operands are promoted to signed int, so shifting a
most significant byte of 0x80 or greater left by 24 overflows int, which
is undefined behavior.  Use le32dec() from <sys/endian.h> instead, which
is both well defined and easier to read.

No functional change intended.

MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2350

reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit
arithmetic and widened the result only on assignment:

        lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
            + boot->FirstCluster * boot->bpbBytesPerSec;

cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo
2**32.  Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases
the offset exactly 4 GiB below it, which on such a volume is ordinary
file data.

That offset is used for both the read and the write: reconnect() reads a
cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY
or SLOT_DELETED byte, which arbitrary data readily provides, stores the
new directory entry in that slot, and writes the cluster back to the
same wrong place.  Thirty-two bytes of an unrelated file are silently
replaced by a directory entry, and since that entry never reaches the
real LOST.DIR the chain stays lost, so the next run damages another
slot.

Cast to off_t before multiplying.  This was the only cluster-to-offset
conversion multiplying a cluster number by the cluster size; the others
in dir.c and fat.c compute a 32-bit sector number first and widen that,
which cannot overflow because the sector count is itself 32-bit.

The bug was observed in the field on a FAT32 stick where LOST.DIR had
been created after a multi-gigabyte file was copied onto it, corrupting
that file every time the volume was checked.

MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2347

A HAST message can be empty, in which case ebuf_add_tail() does nothing
and ebuf_data() returns NULL because the size of the ebuf is zero, but
hast_proto_recv_hdr() asserts that the return value is not NULL,
resulting in an immediate crash if hastctl or hastd receive an empty
message.  This is trivially reproducable by running `hastctl status` or
`hastctl role init` (as the rc script does prior to stopping hastd).

To avoid this, don't try to grow the ebuf or receive additional data
if the header size is zero.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298085
MFC after:      3 days
Reviewed by:    kevans, gjb
Differential Revision:  https://reviews.freebsd.org/D59306

hastd: Clean up the ebuf code

Rename the members of struct ebuf to match their function, replace
bcopy() with memcpy(), add comments explaining what each function does.

Reviewed by:    kevans, emaste
Differential Revision:  https://reviews.freebsd.org/D59310

hastd: Clean up the ebuf code

Missed an instance of bcopy().

Fixes:          https://cgit.freebsd.org/src/commit/?id=48c0fc0171a1 ("hastd: Clean up the ebuf code")

pw_checkfd() returned the character "-" (45) for the "-" argument,
which was ambiguous with a real file descriptor.

MFC After:      1 week

MFC After: 1 week

pw: cleanup

No functional change intended.

MFC After:      1 week

pw: fix at job removal when deleting a user

rmat() used stat() with a path relative to the current working
directory, so it never found the job files in /var/at/jobs and the
at(1) jobs of a deleted user were never removed.

ef7d0eb9489f also broke it by introducing a typo: /usr/sbin/atrm instead
of /usr/bin/artm.

Use fstatat() with the directory fd to stat the job files relative to
the at jobs directory, and unlinkat() them directly instead of spawning
atrm.

Those changes allow us to make it works with pw -R.

MFC After:      1 week

pw: remove crontab with unlinkat instead of spawning crontab

crontab -r only unlinks the crontab file, so spawn it directly with
unlinkat() relative to conf.rootfd.  This also makes the crontab
removal work with pw -R.

MFC After:      1 week

pw: remove mail file with unlinkat instead of building a path

This is consistent with how at jobs and crontabs are removed.

MFC After:      1 week

pw: fix error message in grp_set_passwd to use correct fd

MFC After:      1 week

MFC After:    1 week

hastd: Ensure nvpair padding is initialized

The proto-libnv implementation embedded in hastd pads names and values
out to the nearest multiple of eight bytes, but leaves the padding
uninitialized, leaking up to 14 bytes of recycled heap per pair in a
message.

While here, switch from bcopy() to memcpy().

MFC after:      3 days
Reviewed by:    kevans, emaste
Differential Revision:  https://reviews.freebsd.org/D59343

hastd: Add a stop control message

Add a stop control message which causes hastd to clean up and terminate.

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D59344

hastd: Add rudimentary tests

Test that we can start and stop hastd with an empty configuration.

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D59345

Discussed with:       jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59269

Discussed with:       jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59269

Discussed with:       jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59269

Discussed with:       jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59269

Discussed with:       jrtc27
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59269

Also print the vendor/device and subvendor/subdevice IDs in addition
to any strings from the database found if the -v flag is given more
than once.
This helps with device identification if the strings resolve to
identical values for entire product families as well as when the
exact card cannot be determined from the string.
In theory a second call to pciconf could present that information in
non-tree mode but that kind-of defeats the purpose.

Reviewed by:    jhb
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D56248

Remove struct pmchdr_cpuidinfo which was just a wrapper around a
flexible array member of uint32_t.  Flexible array members are
non-standard in C++, and even in C are not allowed as the only member
of a struct.

GCC errored out on pmchdr_cpuidinfo, but did not complain about
pmchdr_pmcinfo, so I left it alone here, though it is also non-standard.

Fixes:  https://cgit.freebsd.org/src/commit/?id=93da997ef759 ("pmc: new pmc log processing framework")
Reviewed by:    Ali Mashtizadeh <ali@mashtizadeh.com>
Differential Revision:  https://reviews.freebsd.org/D59355

Add NIC-specific VF status to the existing ifconfig -v output.  Fetch
the data through libifconfig using a separate native route Netlink
query.

Group optional identity, initialization, resources, VLAN policy,
administrator policy, protocol, traffic-permission, and
fault containment fields.  Omitted fields remain distinct from false or
zero.

Refer users to iovctl -L for device-neutral PCI attachment and
passthrough state.

This is a Netlink-native evolution of the original interface by Eric
Joyner.

Relnotes:       yes
Sponsored by:   Intel Corporation (initial version)
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58778

Co-authored-by: Eric Joyner <erj@FreeBSD.org>

Display top-like NFS server I/O using dtrace(1).
Also supports JSON output for time-series.

Relnotes:       yes

Reviewed by:    ziaee, bcr, adrian
Differential Revision:  https://reviews.freebsd.org/D59438

lib9p was imported to add a 9p server to bhyve (and I believe this was
the original motivation for writing it in the first place).  Its
external interfaces are kind of strange (from first-hand experience
using it to implement an inetd-based 9p server) and undocumented.
Moreover, upstream has been inactive for over five years.

I suspect there are no third-party consumers.  Let's make it a private
library for now, so as to make it easier to rework external interfaces.
If we get more code written against it, symbol versioning, and some
documentation, we can revisit this decision.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297499
Reviewed by:    jhb, emaste
Differential Revision:  https://reviews.freebsd.org/D58828

Reviewed by:  kargl, kib
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59288

Reported and tested by:       bapt
Reviewed by:    bapt, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59348

Define __STDC_VERSION_INTTYPES_H__ now that the header fully
conforms to C23.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59382

Define __WCHAR_WIDTH in sys/_types.h and derive WCHAR_WIDTH from
that, the same way as WCHAR_MIN and WCHAR_MAX, in both <wchar.h>
and <stdint.h> as per C23 §7.31.1 and §7.22.3.4, respectively.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59385

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290099
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

Request RTEXT_FILTER_VF through route Netlink and parse the common VF
status schema into typed public structures.  Preserve per-field
presence using IFLAF_VF_* attribute numbers as mask bit indices so
callers can distinguish omitted values from false or zero.

Validate required VF indices, repeated driver namespaces, and their
versioned typed fields while allowing unknown optional attributes.

Return VF records through a pointer vector so append-only growth of the
public VF structure does not change the array stride seen by existing
consumers.

Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58777

MFC after:    3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

The OFED code checks for a vnet argument, but it is
is not defined.

Reported by:    glebius
MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

There seems to be another possible race with net80211 state machine
changing the bss from under us (another lvif_bss_synched case).
Just do the != NULL check to avoid a NULL pointer deref in
ieee80211_ratectl_rate().

(bz extended the original comment and wrote the commit message).

Sponosred by:   The FreeBSD Foundation (commit)
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297184
MFC after:      3 days

lkpi_cfg80211_calculate_bitrate_vht() was constantly showing up
in my debug traces as a TODO with rtw89 so I went ahead and implemented
the HT and VHT versions.  Realtek seems to limit amsdu sizes based
on the value and ask for it whether needed or not.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

  umtxq_hash() multiplies the key by 0x9E370001 and keeps the high bits.  That
  constant is 0x9E37 * 2^16 + 1, so it degenerates for keys whose spacing carries
  trailing zero bits: at a 64 KiB stride it puts 128 of 512 parked waiters onto a
  single chain mutex, and at 16 KiB and up it uses only a handful of the 512
  chains.  Base-system consumers never hit this because libthr places its own wait
  words 128 bytes apart, but a Linux-ABI runtime waiting on addresses it allocates
  itself lands squarely on the floor.  Switch to 0x61C88647, which leaves at most 3
  waiters per chain at the same stride; Linux made this exact change in 2016, after
  judging the sparse constants "actively bad for hashing".

Approved by:    adrian (mentor)
Reviewed by:    kib, adrian, emaste
Differential Revision:  https://reviews.freebsd.org/D58337

Signed-off-by: Nick Price <nprice@FreeBSD.org>

to not leak information about unused pids or system processes' pids.

Reviewed by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=73c92a978cce ("pdopenpid(2): allow in capability mode with restrictions")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59252

There were a couple of problems detected w.r.t. the
"glue" for the nfsclrdma.ko module.
- When the NFS server has a small reply for a read,
  it can choose to not use the reduction chunk
  (separate memory area for the read data).  I did
  not realize this was the case.
- There was a bug in rpc_copy_uio_pages() function
  that caused intermittent crashes in memcpy().

This patch fixes the above cases.  It uses M_PROTO6
to mark that an RPC reply has used a reduction chunk,
so that read can handle it correctly.  Read also now
provides a reduction chunk for all read sizes, since
the worst case for the rest of the read RPC reply is
close to the 1024 byte limit.  (NFSv4 uses strings
instead of uid/gid in the attributes and these name
strings can be rather large.)

I wanted to get the "glue" into main so that others
could test the module more easily.  Avaliability of
the module will be announced on freebsd-current@ soon.

It should not affect non-RDMA operation.

I've specified a long MFC, since the module still
requires extensive testing and, hopefully, a review.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

 - Add unmapped I/O support.  The only case when the code needs data
access is BIO_READ returning zeroes for unallocated space.
 - Add BIO_FLUSH support.  Just send it to all allocated components.
 - Add BIO_DELETE support.  While current design does not allow
freeing allocated blocks, at least pass it to underlying providers.
 - Add direct I/O completion support.
 - Add rotation rate reporting.
 - Fix few minor issues.

Pushed using the RTL8723BU.

Reviewed by:    ziaee, avos, adrian
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D59205

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59317

The 16-byte "device_name" field was not zero-filled, so could contain
uninitialized stack data.  Zero the whole struct, as that's the
prevailing pattern for this kind of conversion code, and it's more
robust in the face of future revisions to struct devstat.

Reviewed by:    olce, kib
Reported by:    Reo Shiseki
Fixes:          https://cgit.freebsd.org/src/commit/?id=a11d132f6c62 ("devstat: Provide 32-bit compatibility")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59309

Make the witness LOCK_CHILDCOUNT a configurable kernel option.
On machines with a very high core count the default value is too
low, leading to witness exhaustion after boot.

Relnotes:       yes
Reviewed by:    kib, ziaee
Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/2398

Add iri_rcv_tstmp to if_rxd_info so an isc_rxd_pkt_get() driver can
report a hardware RX timestamp.  Copy it into m_pkthdr.rcv_tstmp,
reusing the generic mbuf timestamp path.

Widen iri_flags from uint8_t to uint32_t and define the flags drivers
may supply.  Mask the flags before copying them into the mbuf so no
other mbuf state can leak through the driver callback.

Place the timestamp next to iri_frags to avoid an alignment hole, and
document its nanoseconds-since-boot representation and validity flags.
Bump __FreeBSD_version because changing if_rxd_info breaks KBI.

Reviewed by:    gallatin
Signed-off-by:  Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Differential Revision:  https://reviews.freebsd.org/D58638

A couple of additional fixes for the NFS client side RDMA glue:
- For Readdirplus, the reply needs to be a large chunk, so set
  M_PROTO9 instead of M_PROTO8.
- The nfsclrdma.ko module now uses xprt_rdma_unmap_chunk()
  instead of xprt_rdma_rekey_chunk().

Hopefully, this is it for the NFS over RDMA client glue changes.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")

Use an unprivileged load to access user memory from dtrace_copy, which
is running in SVC mode.

Abort the loop if the load is trapped, as it is useless, hence
wasteful, to keep faulting on successive addresses. I believe that
this de-pessimization should also be done on aarch64 and riscv.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298064
MFC after:      1 month
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59280

Fix the constant case label to properly handle translation faults
caused by DTrace probes. Alignment errors are not expected to be
generated, so stop handling them.

While at it, correct an amd64-specific comment and add a comment
regarding the missing faulting address which could be addressed by a
later improvement.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298064
MFC after:      1 month
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59281

On ll/sc architectures casueword32() may report a spurious
store-conditional failure (reservation lost to an interrupt, preemption,
or another CPU touching the same reservation granule), and this is
indistinguishable from a genuine comparison mismatch: both return 1.
That is intentional since D20772 and documented in casueword(9) ("The
store can fail on load-linked/store-conditional architectures."), so
callers must cope.

do_lock_normal() does not fully cope.  When the initial
UMUTEX_UNOWNED -> id acquire CAS fails spuriously, the observed owner is
still UMUTEX_UNOWNED, so neither the UMUTEX_CONTESTED branch nor the
real-owner case applies, and execution falls through past the "rv == 1
but not contested, likely store failure" comment into the sleep path.
There, the contested-bit CAS (expecting the observed owner, i.e.
UMUTEX_UNOWNED) succeeds because the mutex really is unowned, stamping
m_owner = UMUTEX_CONTESTED with no owner tid, and the thread sleeps on
"umtxn" forever: nobody owns the mutex, so no unlock and no wakeup ever
arrive.  In _UMUTEX_TRY mode the same situation returns a false EBUSY
for a free mutex.

Treat an observed owner of UMUTEX_UNOWNED like UMUTEX_CONTESTED: try to
acquire the mutex, setting the contested bit, instead of falling through
to the sleep path.  rv == 1 with the observed value equal to the
expected value can only mean a spurious store failure, so the mutex is
free.  If the acquire CAS fails again, the outer loop restarts and
re-evaluates ownership.  The contested bit set with no waiters present
only costs the matching unlock one trip through the kernel.

This was hit in practice on powerpc64le (POWER9): the Swift runtime's
Synchronization.Mutex issues _umtx_op(UMTX_OP_MUTEX_LOCK) directly with
no userspace fast path, so an uncontended lock of an unowned mutex runs
the kernel CAS exactly where a spurious failure deadlocks
(single-threaded process parked on "umtxn" with m_owner == 0x80000000,
observed as Foundation.Process.run() hanging).  libthr mostly masks the
bug because pthread_mutex_lock() enters the kernel only when there is a
real owner that will eventually issue a wakeup.

The mechanism was confirmed with an experimental powerpc kernel that
instead retried the ll/sc sequence inside casueword32()/casueword();
that also eliminated the hang, but is not proposed here since the
single-attempt semantics of casueword(9) are intentional.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D59338

bufinit() inserts newly initialized bufs into the QUEUE_EMPTY queue, at
which point they haven't yet been assigned a domain.  Thus, bufdomain()
returns &bdomain[-1], which trips the array-bounds sanitizer.

This is harmless since we don't use the result in that case, but let's
avoid the invalid access to begin with.  This is sufficient to let an
amd64 kernel boot to a login prompt with -fsanitize=array-bounds
configured.

Reported by:    Andrew Griffiths <andrew@calif.io>
Reviewed by:    rlibby, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59381

But only if debug.bootverbose=1.

MFC after:      2 weeks
Sponsored by:   ConnectWise

In dma_sync_single_for_cpu(), the DMA_BIDIRECTIONAL direction currently
performs BUS_DMASYNC_POSTREAD followed by BUS_DMASYNC_PREREAD. This
patch corrects the mapping to use BUS_DMASYNC_POSTREAD |
BUS_DMASYNC_POSTWRITE.

When ownership of the DMA area is transferred to the CPU, we must assume
the previous device access was bidirectional. Both POST operations are
necessary to ensure the CPU sees a consistent view of memory after
potential device reads and writes. A PREREAD is unnecessary here because
the device will no longer access the memory since ownership has been
transferred to the CPU.

Conversely, for dma_sync_single_for_device(), ownership is being
transferred back to the hardware. The buffer must be prepared for
potential bidirectional access by the device, requiring
BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293381, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297155
Reported by:    Zishun Yi <zishun.yi.dev@gmail.com>
Reported by:    Kim Shrier (fbsdbugs westryn.net)
Fixes:          https://cgit.freebsd.org/src/commit/?id=95edb10b47fc ("LinuxKPI: implement dma_sync_single_for_*, apply to (un)map single/sg")
Signed-off-by:  Zishun Yi <zishun.yi.dev@gmail.com>
Reviewed by:    aokblast, bz
Differential Revision: https://reviews.freebsd.org/D55497

Both kern_renameat() and kern_dup() had arguments named `new`.  Rename
their arguments to match their respecitve manual pages.

Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59386

The entropy will be collected in intr_event_schedule_thread() for event
handlers that are marked as entropy sources.  The quality of entropy
provided by SWI wasn't great anyway.

Reviewed by:            cem, ngie
Differential Revision:  https://reviews.freebsd.org/D58829

Renumbered the camera class to match the reference ABI and added the
constants ported applications expect:

Reviewed by:    thierry
Differential Revision:  https://reviews.freebsd.org/D59459

The camera control IDs in videoio.h changed numeric values; ports
consuming V4L2 camera controls need to be rebuilt.

Reviewed by:    thierry
Differential Revision:  https://reviews.freebsd.org/D59460

Implement dma_sync_sg_for_{cpu, device}() and
dma_sync_sgtable_for_device().
These functions are useful for my GSoC 2026 project, udmabuf.

Reviewed by:    bz
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D57766

According to Linux documentation the nents argument to dma_unmap_sg()
must be the number one passed in, not the number of DMA addresses.

In LinuxKPI this means orig_nents and not nents, so adjust this.

Given nents and orig_nents should always be the same in LinuxKPI,
this should only be a NOP for correctness.

Reviewed by:    bz, aokblast (LGTM)
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D57842

Bump for the new ifnet and iflib VF-status provider KBI and the
rtnetlink VF-status interface.

nfsd: Clean up the "glue" for the nfsrdma.ko module

Move svc_reg() calls into a helper function so that the nfsrdma.ko
can call that.  Create a new nfs_extern.h as a place to put the
nfs stuff that server side NFS over RDMA needs to access, with a
prototype for the helper function and a couple of definitions that
probably shouldn't be in svc.h.

No semantics change.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=7144a1d58c5c ("nfsd: Add glue for the nfsrdma.ko module")

nfsd: Add nfs_extern.h

Oops, forgot to add the new .h file.

MFC after:      3 months
Fixes:  https://cgit.freebsd.org/src/commit/?id=407d7177057d ("nfsd: Clean up the "glue" for the nfsrdma.ko module")

Sponsored by:         Netflix

- Remove trailing whitespace
- Fix typo with variable referenced adding sources for `test_fuzz`.

MFC after:      2 weeks

This test has not passed since 185becb1e1bd2657c156f78aeb52edac05ba5fb5
(the libarchive 3.8.9 upgrade).

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273732
MFC after:      1 week
Reviewed by:    siva
Differential Revision:  https://reviews.freebsd.org/D59314

In 16.0/15.1, the PAM modules were split from FreeBSD-runtime into a
new FreeBSD-pam package.  FreeBSD-runtime does not install FreeBSD-pam,
which means if a user starts from runtime, then installs sshd, sshd will
fail to authenticate users because of missing PAM modules.

Since FreeBSD-pam is relatively small (about 230kB on amd64), and is
already part of FreeBSD-set-minimal, add it to the runtime image as
well.  Users who absolutely don't want this can still build their
own images without it.

MFC after:      1 week
Reviewed by:    dfr
Reported by:    Michael Johnson <ahze@ahze.net>
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59194

By default, makefs uses the host environment's user and group databases
when creating filesystems.  This causes makefs to fail when trying to
create files owned by users or groups which don't exist in the host
environment, for example when creating a VM with packages pre-installed
which added their own users/groups.

Pass "-N ${DESTDIR}/etc" to makefs to point it at the user and group
databases from the image being created.

MFC after:      1 week
Sponsored by:   Amazon

That function was removed in commit 98549e2dc6fb0.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288081
Fixes:  https://cgit.freebsd.org/src/commit/?id=98549e2dc6fb ("Centralize the logic in vfs_vmio_unwire() and sendfile_free_page().")

ATF_TESTS_C automatically adds the appropriate library to LDADD --
there's no need to manually append the same library.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59411

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D59162

Quote LOCALBASE and ARC_CMD default assignments so a poisoned
value cannot glob into :'s argv.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59130

The variable is written in the child process which shares the address
space with the parent.  The data flow must not be optimized by a compiler.

Reviewed by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ddf62c83fc0a ("sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59282

Cast the size_t quantity used in a comparison to off_t to mute a
`-Wsign-compare` complaint that now occurs after ATF 0.22 [1].

MFC after:      2 weeks
Reported by:    clang
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D59285
[1]: https://github.com/freebsd/atf/pull/72

Confirm that creating clients/sockets was successful by testing the
result separate from the assignment and test that the return value is
not -1 instead of testing that the value returned is non-zero.

This fixes the build with [ATF 0.22+][1].

MFC after:      2 weeks
Reported by:    clang (-Wparenthesis)
Reviewed by:    tuexen, cc
Differential Revision:  https://reviews.freebsd.org/D59284
[1]: https://github.com/freebsd/atf/pull/72

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296944
Reviewed by:    cy
MFC after:      3 days
MFC to:         stable/15
Sponsored by:   The FreeBSD Foundation

This serves to catch the regression fixed by commit
1a669b66ddb4 ("syslogd: reap pipe children on config reload").

MFC after:      1 week

Exercise each of the 32-bit BIOS Parameter Block and FSInfo fields that
readboot() decodes, using values whose most significant byte has its high
bit set.  Each case checks two things: that fsck_msdosfs(8) reports the
full unsigned 32-bit value back on stdout, and that nothing writes a
sanitizer runtime error to stderr.

The second check is what catches a byte-at-a-time decode.  Shifting such
a byte left by 24 is undefined, but every compiler we use wraps it into
the same bit pattern, so the decoded value alone cannot tell a correct
decode from an overflowing one.  In a WITH_UBSAN build bsd.sanitizer.mk
compiles with -fsanitize=undefined and -fsanitize-recover=undefined, so
the shift is reported on stderr and execution continues, which the test
can then assert on.  Against the byte-at-a-time decode these cases fail
in a WITH_UBSAN build and pass without it.

Note that the stderr check also fails on unrelated undefined behavior
that these images reach anywhere in fsck_msdosfs(8), which is intended.

MFC after:      1 week

Build a 4.5 GiB FAT32 image whose LOST.DIR cluster sits exactly 4 GiB above
the single cluster of a PAYLOAD.BIN, so that truncating the offset of the
former to 32 bits yields the offset of the latter, then inject a lost cluster
chain and let fsck_msdosfs(8) reconnect it.

The test asserts both halves of the bug fixed in the previous commit: that
PAYLOAD.BIN's cluster is unchanged, and that a second pass no longer reports
the chain as lost, which it only stops doing once the directory entry reaches
the real LOST.DIR.

newfs_msdos(8) -C only calls ftruncate(2) and nothing outside the reserved
area, the FATs and a handful of clusters is ever written, so the image stays
sparse and costs about 2 MiB on disk.

The geometry is read back out of the BPB rather than assumed, so
newfs_msdos(8) stays free to lay the file system out differently; the test
fails with a clear message if the volume ever becomes too small to hold a
cluster a full 4 GiB beyond the data area.

MFC after:      1 week

hwpmc: Add ATF regression tests for hwpmc EXTERROR diagnostics

Root-only ATF program hitting negative allocate/attach/read-write paths
and asserting the exterr(3) text. AMD/IBS cases skip without the PMC
class; program skips without hwpmc.

Additional changes by mhorne@:
- Move and rename to the established test directory tests/sys/pmc
- Remove broken test amd_missing_pmu_flag; fixed by recent change
  6c4d9b9af1a3
- Add ATF_REQUIRE_FEATURE("exterr_strings") to skip the tests on kernels
  compiled without the strings
- Remove arch-conditional compilation; tests are properly gated by PMC
  class check
- Fix copyright formatting

Reviewed by:    Ali Mashtizadeh <ali@mashtizadeh.com>
Signed-off-by:  Andre Silva <andasilv@amd.com>
Co-authored-by: mhorne
Sponsored by:   AMD
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2180

pmc_exterr_test: add MACHINE_ARCH check

The tests manipulate MD structure fields directly. Build these tests for
amd64 only.

Fixes:  https://cgit.freebsd.org/src/commit/?id=e555692d1bb ("hwpmc: Add ATF regression tests for hwpmc EXTERROR diagnostics")

The previous pattern is cited as an issue with ATF 0.22+ when using
clang/gcc after [1].

MFC after:      2 weeks
Reported by:    clang (-Wparenthesis)
Differential Revision:  https://reviews.freebsd.org/D59274

[1]: https://github.com/freebsd/atf/pull/72

Code that assigned variables as part of ATF_\* are no longer
permitted due to changes introduced in [ATF 0.22][1].

MFC after:      2 weeks
Reported by:    clang/gcc (-Wparenthesis)
Differential Revision:  https://reviews.freebsd.org/D59286

[1]: https://github.com/freebsd/atf/pull/72

Fixes:        https://cgit.freebsd.org/src/commit/?id=7f3b46fe54f1 ("ndp: Add support for Gratuitous Neighbor...")

Reported by:  ngie@
Differential Revision:  https://reviews.freebsd.org/D42156

More information about what's included in the new release can be found
[here](https://github.com/freebsd/lutok/compare/lutok-0.4...lutok-0.6.2).

MFC after:      1 week
Merge commit '447d4fe61d8bf55ffa21698ecee0ac51010a9a0f'

The extra DELAY seems to no longer be needed and the dump_stack()
is definitively a problem now.  Remove all this.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Changes: https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes

Security:       CVE-2026-66046
Security:       CVE-2026-76641
Security:       CVE-2026-76957
Security:       CVE-2026-76956
MFC after:      1 week

MFV: file 5.48

MFC after:      1 week

libmagic: Add swap.c and magic.h to SRCS.

file 5.48 added swap.c and swap.h for byte-swapping operations, which are
required on hosts that lack <byteswap.h> or <sys/bswap.h> (e.g. macOS cross-building
or older FreeBSD bootstrap environments).

Also add magic.h to SRCS so object files depend on the generated header
before compiling, avoiding falling back to the host's /usr/include/magic.h
during parallel builds.

Reported by:    wosch
MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=7af41682a96b ("MFV: file 5.48")

This fixes the build with gcc 14:

/usr/src/contrib/kyua/engine/prepare/prepare_all.cpp:56:16: error: declaration of 'handler' shadows a member of 'engine::prepare::prepare_all' [-Werror=shadow]
   56 |     for (auto& handler : prepare::handlers()) {
      |                ^~~~~~~
In file included from /usr/src/contrib/kyua/engine/prepare/prepare_all.hpp:35,
                 from /usr/src/contrib/kyua/engine/prepare/prepare_all.cpp:29:
/usr/src/contrib/kyua/engine/prepare/prepare.hpp:51:15: note: shadowed declaration is here
   51 | class handler {
      |               ^

Fixes:  https://cgit.freebsd.org/src/commit/?id=edb230c4af499203d7a6894b3711fe6574b26040

Reviewed by:    igoro, rlibby, ngie
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59346