FreeBSD git weekly: 2026-04-01 to 2026-07-31

MFC after:    2 weeks
Relnotes:       yes

geneve creates a generic network virtualization tunnel interface
for Tentant Systems over an L3 (IP/UDP) underlay network that provides
a Layer 2 (ethernet) or Layer 3 service using the geneve protocol.
This implementation is based on RFC8926.

Reviewed by:    glebius, adrian
Discussed with: zlei, kp
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D54172

Oracle's previous support is no longer available to the project.
Repeated attempts to find a sponsor within Oracle's cloud business
have not been successful.

The last published official images are from 15.0-RELEASE.

https://marketplace.oracle.com/app/freebsd-release

Relnotes:       yes
Sponsored by:   SkunkWerks, GmbH
Differential Revision:  https://reviews.freebsd.org/D56360
MFC after:      3 days

NETWORKING is the documented placeholder, while
/etc/rc.d/NETWORKING still provides the legacy alias
NETWORK.

The NETWORKING script was originally introduced to avoid
conflicts with NetBSD's lowercase network script on
case-insensitive file systems.  The NETWORK alias was
retained for compatibility with older scripts.

Following the discussion in PR 293652, remove the legacy
NETWORK alias from 16-CURRENT.  Keeping both names adds
more confusion than value now that NETWORKING is the
documented placeholder and current base system and ports
tree uses are already clean.

Add an UPDATING entry to note that local RC scripts using
REQUIRE: NETWORK should be migrated to REQUIRE: NETWORKING.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293652
Reviewed by:    michaelo, jlduran
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56300

Implement RFC 4191 by handling received Router Adverisement (RA)
packets with route information option.
For default routes, use the route information's lifetime and
preference to overwrite the RA's lifetime/preference.
Also install and update more-specific route prefixes with the
option's lifetime and expire them when their lifetime elapses.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263982
Reviewed by:    markj
Tested by:      Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D55449

This updates llvm, clang, compiler-rt, libc++, libunwind, lld, lldb and
openmp to llvm-project release/21.x llvmorg-21.1.8-0-g2078da43e25a,
a.k.a. 21.1.8 release.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292067
MFC after:      1 month

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292067
MFC after:      1 month

Import groups(7) from NetBSD, with tweaks for our system. The group
list is sorted by GID. All the group names from /usr/src/etc/group
are described, except "uucp". The FILES section was added on top of
the original manual page.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264966
Relnotes:               yes
MFC after:              3 days
Obtained from:          NetBSD
Reviewed by:            des, ziaee
Differential Revision:  https://reviews.freebsd.org/D54114

Reviewed by:  kevans
Sponsored by;   Stormshield
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D56710

Add make.conf, CHANGES, CONTRIBUTING.Md, UPDATING, and Tools/scripts.
Refactor the FILES section of the ports reference manual into a bigger
table with three sections separated by root directory. Remove preceeding
article from all but "the big Kahuna", and root dirs where reasonable.

MFC after:              3 days
Relnotes:               yes
Reported by:            adamw, arrowd, linimon
Differential Revision:  https://reviews.freebsd.org/D55441

"bsdinstall script" will now do a pkgbase installation by default.  The
system components to install can be specified in the COMPONENTS
variable, and have the same names as those used in the interactive
installer.  bsdinstall will still do a legacy distset installation if
DISTRIBUTIONS is defined in the installerconfig file.

MFC:            1 week
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290375
Sponsored by:   ConnectWise
Reviewed by:    ziaee, ivy, jduran
Differential Revision: https://reviews.freebsd.org/D56717

The EC2 "base" flavour installs the devel/py-awscli package at boot
time by default; we don't do this in the "small" flavour, so the
default behaviour was to update the FreeBSD-ports repository and
then do nothing with it.

Turn off firstboot_pkgs by default; if someone is using the "small"
flavour of AMIs and wants to install packages at instance launch
time, they simply need to add 'firstboot_pkgs_enable="YES"' to
/etc/rc.conf (which they must already be editing via user-data, in
order to provide the list of packages they want installed).

Sponsored by:   Amazon
MFC after:      3 days
MFC to:         stable/15
Relnotes:       EC2 "small" images now have firstboot_pkgs_enable="NO".

We use -xattr in our openrsync tests for convenience, and it seems like
a good addition to FreeBSD.  -xattr and -xattrname will both consult all
available namespaces by default, but -xattrname allows filtering by
namespace using a "user:" or "system:" prefix.

Inspired by:    https://github.com/apple-oss-distributions/shell_cmds
Reviewed by:    kib, rmacklem
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D55286

The default history size in bin/sh is currently 100 however POSIX.1-2024
mandates that a default greater than or equal to 128 shall be used,
therefore this increases the default history size in /bin/sh to 128.

POSIX standards reference:
https://pubs.opengroup.org/onlinepubs/9799919799/utilities/sh.html#tag_20_110_08

MFC after:      3 days
Reviewed by:    emaste, jilles, jlduran, ziaee
Signed-off-by:  Kristofer Peterson <kris@tranception.com>
Closes:         https://github.com/freebsd/freebsd-src/pull/2093

* Use xo_warn() / xo_err() instead of warn() / err().

* Add a test case for the POSIX-mandated stdout error check.

* While here, don't assume the size of off_t, address some style issues,
  and broaden the use of bool instead of int.

* Reorder SEE ALSO section.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    allanjude
Differential Revision:  https://reviews.freebsd.org/D56402

When using PART_KIND_FILE (-p type:=filename), mkimg uses a colon
to separate an optional offset (e.g., filename:offset).

strsep() was being used to split the string at the first colon.
This caused failures when the filename itself contained a colon
(e.g., "th:is").

This patch uses stat() to check if the entire string exists as a
file. If so, use it directly without splitting.

If the full string is not a valid file, fall back to splitting
at the right-most colon using strrchr().

Uses errc() to fail and exit immediately when an existing directory
is input instead of a file in PART_KIND_FILE mode.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257960
Signed-off-by: Aaditya Singh <aadityavksingh@gmail.com>
Reviewed by: jlduran
Pull Request: https://github.com/freebsd/freebsd-src/pull/2041

This usually gets bumped by re@ when the version number changes in
sys/conf/newvers.sh, but apparently we forgot for the past two major
versions.

Reviewed by:  imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55461

Format the message.
Convert category to the source name if known.

Still print the raw value for the category, and the values of the
EXTERROR() optional arguments.

Requested and reviewed by:      mckusick
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56542

This makes it consistent with libc formatting.

Requested by:   mckusick
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

ident: Clean up

* Use libcasper instead of reinventing it.

* Add long option support.

* Drop pointless use of temporary locales.

* Consistently check for stdio errors.

* Clean up the code.

* Clean up and expand the tests.

MFC after:      1 week
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D56505

ident: Fix typo in manual page

Fixes:          https://cgit.freebsd.org/src/commit/?id=394f6b1b0a65 ("ident: Clean up")

* Error out if more than one argument is given.

* Check for stdio errors.

* Clean up the code.

* Clean up and expand the tests.

MFC after:      1 week
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D56506

Set the -f flag to sh(1) to disable pathname expansion.
Also, quote the jail variable to ensure correct behavior when passed
to jexec(8).

Signed-off-by:  Nami Arjmandi <namiarjmandi@gmail.com>
Reviewed by:    pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2158

Things like `{ some_program; } >/dev/null` use vfork, so use vfork
similarly for things like `some_program >/dev/null`.

This cannot be done for command substitutions, because of two problems:

* Redirections might cause the error message for later redirections or
  for an unknown command to be sent to the pipe (to be substituted), and
  this might cause a deadlock if the message is too long.

* The assignment of the pipe needs to come before instead of after the
  redirections.

Reviewed by:    bdrewery
Differential Revision:  https://reviews.freebsd.org/D55190

Pseudo filesystems (e.g., procfs) advertise a zero file size.
Fix reverse() to handle such a case similarly as forward() so
that '-r' works on pseudo filesystems.

Signed-off-by:  Aaron LI <aly@aaronly.me>
Reviewed by:    pouria, Ricardo Branco <rbranco@suse.de>, des
Fixes:          https://cgit.freebsd.org/src/commit/?id=1fb3caee7 ("tail: Do not trust st_size if it equals zero.")
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2080

If the /sbin/init binary is broken somehow, the way out is to set the
loader environment variable init_path to something else.  The most
natural choice would be either /bin/sh or /rescue/sh.  Unfortunately,
this does not work because the init process starts withoud stdin/out
descriptors.

Make it nicer to users by teaching /bin/sh startup code to open standard
descriptors on /dev/console if the shell is run as init.

Reviewed by:    imp, jilles, zlei
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56536

stat: fix use of devname(3)

Besides being a little hard to parse through visually, this had its own
bug of inspecting st->st_mode to determine what to pass to devname(3),
which is only correct for st_rdev.

For st_dev, you're likely to be looking at files or directories and
attempting to assess what device they're located on, so the mode is
meaningless- we just have to assume that our filesystems are on
character devices and attempt to resolve st_dev as such.

Reviewed by:    des, kib (previous version)
Differential Revision:  https://reviews.freebsd.org/D56565

stat: The devname test case requires root

Fixes:          https://cgit.freebsd.org/src/commit/?id=4d4acdbfc22c ("stat: fix use of devname(3)")

We haven't pulled from upstream in over 15 years, and the codebases
have diverged so far it is unlikely that we ever will.

* Drop NetBSD and OpenBSD version control information.

* Drop support for building on non-BSD / non-POSIX platforms.

* Fix a few minor style issues.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56771

When operating on a file descriptor, acquire_lock() would ignore the
flags argument and always operate in non-blocking mode, resulting in
unnecessary busy-looping.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294832
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56722

The uses of PAGE_SIZE and roundup2() require param.h.

MFC after:      1 week

MFC after:    1 week

procctl.2: Align list indentation

Remove 81 lines of whitespace at default manual rendering width.

MFC after: 3 days

procctl.2: remove space at EOL

Fixes:  https://cgit.freebsd.org/src/commit/?id=db9bbe131c92f55e6cf03657dc030c9eea93a9fb

Sponsored by: The FreeBSD Foundation
MFC after:      3 days

Document two missing error conditions for mq_open(2):

- EINVAL: returned when mq_maxmsg exceeds kern.mqueue.maxmsg or
  mq_msgsize exceeds kern.mqueue.maxmsgsize.
- ENFILE: add kern.mqueue.maxmq sysctl name to the existing entry.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243209
Reviewed by:    mhorne
MFC after:      1 week
Signed-off-by:  Kit Dallege <xaum.io@gmail.com>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2098

Reviewed by:  dim
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D56222

libm's fmax and fmin family of functions treat +0.0 as greater than
-0.0.  This is not required by the C standard, so the user may not see
this behaviour due to compiler optimization.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294214
Reviewed by:    fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56230

Add error numbers to the exit codes so that readers can decode them
without having to use a separate utility. Organize exits by error code.
Mark up the error constants with the error constant macro, even though
this is really not very helpful because people will search for the error
code, the macro is explicitly for the constants and not the codes.

While where, align and alphabetize the options list as well, fix
misaligned padding in an example, and a one-sentance-per-line error.

MFC after:              3 days
Reported by:            Antranig Vartanian <antranigv@freebsd.am>
Differential Revision:  https://reviews.freebsd.org/D48470

MFC after:    3 days

See also:     D55834, D56236
MFC after:      1 month

Commit 8b9775912cbc added support for an NFSv4 mounted
root file system.  This patch documents how to set this
up.  It also includes some minor updates and fixes
some formatting.

This is a content change.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56317
Fixes:  https://cgit.freebsd.org/src/commit/?id=8b9775912cbc ("nfs_diskless: Add support for an NFSv4 root fs")

Reviewed by:  imp
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56362

Add geneve parameters to ifconfig manual.

Reviewed by:    ziaee
Differential Revision: https://reviews.freebsd.org/D55181

MFC after:            3 days
Reviewed by:            Aaron Li <aly@aaronly.me>, ziaee
Differential Revision:  https://reviews.freebsd.org/D56090

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285744
Reviewed by:    ziaee
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56285

Reviewed by:  emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D56384

Explain how SIGTHR is used and that it should be not touched by user
code.  Note about SIGLIBRT.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D56384

Break the examples into subsections, so that we can have multi-step
examples.

MFC after:              3 days (to 15 only)
Discussed with:         ivy
Differential Revision:  https://reviews.freebsd.org/D55526

MFC after:            3 days
Reviewed by:            ivy, emaste
Discussed with:         bapt, des, emaste, ivy, phk, pi
Differential Revision:  https://reviews.freebsd.org/D55458

MFC after:    1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=7b35b4d19630 ("sockstat: add libxo support")

Fix several incorrect sysctl.3 type and mutability descriptions so the
manpage matches the actual kern and kern.proc interfaces.

Signed-off-by: Tyler Waddell <tyler.waddell112@gmail.com>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2128

The man page used "trimmed" to describe log rotation, which is
misleading as it suggests the file is truncated to a specific
size rather than being rotated (renamed and a new file created).
Replace all instances of "trimmed" with "rotated" to match the
actual behavior and the terminology used elsewhere in the page.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=278671
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Reviewed by: imp,ziaee
Pull Request: https://github.com/freebsd/freebsd-src/pull/2099

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56225

Now that i386 kernels are deprecated, we don't really need to mention
this limitation.  It's also a bit dated since PKRU is supported with
5-level paging as well.

Reviewed by:    alc, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56415

There are cases where the kernel will be able to access memory covered
by a PKRU key which nomially prohibits accesses.  I believe regular
copyin()/copyout() are subject to the contents of PKRU, but memory
accesses via uiomove_fromphys() will not be.  This can arise when
performing fault I/O, for instance.  I didn't test, but I suspect AIO is
another case.

Update the man page to acknowledge this.

Reviewed by:    alc, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56416

+ s/ntp/ntpd/ for correctness + apropos results in document description
+ silence a linter warning by escaping a period with a zero-width space

MFC after:      3 days

The example provided puts the semicolon in the wrong place. It must
come after the file:// specification, not in it.

MFC after:      1 week

See also:     https://github.com/freebsd/virtual_oss/issues/2
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Since pdrfork will be included in FreeBSD 15.1

Reviewed by:    kib
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D56513

`pfctl -A`, `-N`, `-O`, and `-R` restrict which rule types and options
are loaded. The man page language ("Load only...") does not make it
clear that these options can be combined to (re)load multiple rule types
and/or options without reloading the entire packet filter.

Add language to make it explicitly clear that these flags combine.

Reviewed by:    kp
Signed-off-by:  Ross Williams <ross@ross-williams.net>

Reviewed by:  markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

The gpart manual says that sizes are specified in blocks, unless an SI
unit suffix is provided. This confuses new operators because GEOM uses
binary bytes, a large difference at modern storage pool sizes. Rewrite
suffixes in all GEOM manuals to consistently clarify this, matching what
we and the rest of the industry have been doing in other documentation.
While here, use non-breaking spaces between numbers and units, unless
they are already written with a hyphen.

MFC after:              3 days
Reviewed by:            fuz
Reported by:            bbaovanc <bbaovanc@bbaovanc.com>
Differential Revision:  https://reviews.freebsd.org/D56534

Some targets override the default value of DISTRIBUTIONS.
Document that in the manual page.

Reported by:    Nia Alarie <nia@NetBSD.org>
Reviewed by:    jlduran
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56528

Last time I generated this, there were many copies of WITH_CASPER for
reasons unknown.

Sponsored by:           Netflix

Previous authors appear to have prioritized brevity over clarity.  This
unfortunately resulted in a manual page that left its reader with the
false impression that Kyua is difficult to use.  Attempt to correct
this by providing more and simpler examples with longer explanations.

While here, correct outdated information about where Kyua stores its
logs and results.

MFC after:      1 week
Reviewed by:    ziaee, ngie
Differential Revision:  https://reviews.freebsd.org/D56475

Sponsored by: The FreeBSD Foundation
Reviewed by:    bapt, philip
Approved by:    philip (mentor)

build.7: Improve make delete-old example

Be more explicit that deleting old files and libraries needs to be
really after you're rebooted a third time and you're really actually
sure your applications aren't using old libs, following irc discussion.

Also adjust an example slightly to fit on 80 character console.

MFC after:              3 days
Discussed with:         emaste, fuz, jhb
Differential Revision:  https://reviews.freebsd.org/D54079

build.7: Explain packaging a custom kernel

MFC after:              3 days (to 15 only)
Requested by:           vermaden
Discussed with:         emaste, ivy, Mark Millard <markmi_dsl-only.net>
Differential Revision:  https://reviews.freebsd.org/D56217

build.7: Explain specifying multiple KERNCONFs

MFC after:              3 days
Reviewed by:            ivy, mhorne
Differential Revision:  https://reviews.freebsd.org/D56281

MFC after:            3 days (to 15)
Discussed with:         bapt, emaste, ivy
Differential Revision:  https://reviews.freebsd.org/D56389

Sponsored by:         Netflix
Differential Revision:  https://reviews.freebsd.org/D56463

- Add `.Nm` section for securelevel(7) to match corresponding MLINKS entry.
- Fix the spelling for mac(4) (the actual subsystem manpage is spelled out in
  lowercase.

MFC after:      1 week

- Rename `.Nm .rhosts` to `.Nm rhosts` to match the MLINK for the
  manpage.
- Use `.Pa` instead of `.Nm` when discussing the paths for `.rhosts` and
  `hosts.equiv.5` for explicitness and clarity.

Bump .Dd for the change.

MFC after:      1 week

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294757
Reported by:    Ulrich Eduard
MFC after:      1 week

Describe how the LoaderEnv and NextLoaderEnv variables can be used.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293054
Reviewed by:            imp
Sponsored by:           Wiesbaden Hackathon 202604
Differential Revision:  https://reviews.freebsd.org/D56633

Noted by: mckusick

Reviewed by:  imp, jilles
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56536

Reviewed by:  imp, jilles
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56536

"filedescriptors" is the odd one out when looking at other manual pages.

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264966
MFC after:      3 days

MFC after:            3 days
Reported by:            kevans
Reviewed by:            kevans, ngie
Differential Revision:  https://reviews.freebsd.org/D56607

Reviewed by:  kevans
Sponsored by;   Stormshield
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D56710

The doxygen tooling has supported ingesting markdown files for a number
of years.  Adding this option allows them to be ingested into the
subsys builds.

Reviewed by:    netchild
Differential Revision:  https://reviews.freebsd.org/D56652

Which contains only the source code file.

While here, remove trailing empty lines in the end of the page.

Reviewed by:    mhorne
Differential Revision:  https://reviews.freebsd.org/D56659

We note a reason why you might need it, but there's an equally important
reason you may need to omit it: interpreted programs.  Add a note
accordingly, along with the workaround configuration if there's reason
you can't help it.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294780
Reviewed by:    Jan Bramkamp <crest_freebsd_rlwinm.de>, kib
Differential Revision:  https://reviews.freebsd.org/D56704

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294719
MFC after:      1 month

Add make.conf, CHANGES, CONTRIBUTING.Md, UPDATING, and Tools/scripts.
Refactor the FILES section of the ports reference manual into a bigger
table with three sections separated by root directory. Remove preceeding
article from all but "the big Kahuna", and root dirs where reasonable.

MFC after:              3 days
Relnotes:               yes
Reported by:            adamw, arrowd, linimon
Differential Revision:  https://reviews.freebsd.org/D55441

MFC after:    3 days

+ more consistent document description
+ enumerate available options in synopsis in vt.4 style
+ tag spdx
+ tweak list rendering
+ cleanup HARDWARE
+ reflow excessively long lines silencing linter warnings
+ fix link macros

MFC after:              3 days
Reported by:            michaelo (hardware notes)
Differential Revision:  https://reviews.freebsd.org/D56753

The current text fails to draw the reader's attention to the fact that
VIS_SAFE essentially exempts certain characters from being encoded.

While here, fix some markup nits.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56716

MFC after:    3 days

MFC after:            1 day
Discussed with:         bcr, ivy, kevans, ngie
Differential Revision:  https://reviews.freebsd.org/D56608

While here, remove empty sections from cam.4.

MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=1a7151f79664 cam: Add probes for xpt actions

MFC after:    1 week

Update smartpqi(4) to document the dev.smartpqi.<unit>.debug_level
sysctl for runtime debug level changes, and note that device
add/remove and controller event messages always appear in dmesg
regardless of the debug_level setting.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294161
Reviewed by:    imp
Approved by:    imp
MFC after:      2 weeks

Differential Revision:  https://reviews.freebsd.org/D56832

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292147

- speaker(4) was recently modernized to lock the driver per-playback
  instead of per-open. Update the man page to explain this change.

- added a reference to MML and SMX in the historical context to make
  it easier for users to find additional documentation online.

Signed-off-by:  Raphael Poss <knz@thaumogen.net>
Reviewed by:    ziaee
Closes:         https://github.com/freebsd/freebsd-src/pull/2183

See also:     D53951, https://wiki.freebsd.org/C23
MFC after:      1 week

We now have .St -isoC-2023, so the STANDARDS section can go live.

Fixes:          https://cgit.freebsd.org/src/commit/?id=9b5d724cad10087e34165199e55f15f2df744ed5
MFC after:      1 week

"w" is a command modifier, not an argument. Use Cm.

Fixes:  https://cgit.freebsd.org/src/commit/?id=2cdff9918e79 byhve: add option to specify IP address for gdb
MFC after:      3 days

MFC after:    3 days

MFC after:    3 days

For all:
- harmonize Copyright/license section according to style.9 and used
  SPDX only.
- mention that the current generation of the driver is based on
  Linux version 7.0.
- make linuxkpi.4 and linuxkpi_wlan.4 .Xr as the man pages do exist
  these days.

iwlwifi: update the card/chipset names supported (while we still can)
iwlwififw: leave a comment only that we can no longer update the
  man page and it will be removed in the future.
rtw88: update supported chipsets and add note to BUGS sections
rtw89: update supported chipsets and add note to BUGS sections

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    ziaee
Differential Revision: https://reviews.freebsd.org/D57019

Describe `-weight` argument in the route manual.

Reviewed by: glebius, ziaee
Differential Revision: https://reviews.freebsd.org/D56246

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D57012

ELF support was added to nlist() in 1997, and a.out support was removed
in 2020.  The man page was not updated for either of these changes.

Fixes: https://cgit.freebsd.org/src/commit/?id=77909f597881 ("Initial elf nlist support, ...")
Fixes: https://cgit.freebsd.org/src/commit/?id=86cfa7e70b2b ("nlist: retire long-obsolete aout support")
Sponsored by: The FreeBSD Foundation

The condition after SYSCTL_IN was inverted: success (error == 0) returned
immediately and skipped the NVRAM write path, while failure fell through.
Return only when SYSCTL_IN fails.

Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2113

The kernel_pmap lock is a bit special: it does not need the DUPOK flag,
and it really belongs to a different lock class.  If it belongs to the
same class as regular pmap locks, then witness may report warnings when
performing UMA allocations under a regular pmap lock, if the allocation
triggers a pmap_growkernel() call.

Replace instances of PMAP_LOCK_INIT(kernel_pmap) with inline mtx_init()
calls to silence some witness warnings for harmless behaviour I see with
some uncommitted test programs.

Reviewed by:    alc, kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56185

We cannot have more than one SPMC device.

Reviewed by:    olce
Approved by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56062

Microsoft added a new function index (turn on display, 9) to their DSM
set. This revision calls this, which fixes S0ix on certain machines,
such as the Lenovo Yoga Slim 7i Aura, who's ECs use this method as a
trigger to restore power to certain devices.

See commit 229ecbaac6b3 ("ACPI: x86: s2idle: Invoke Microsoft _DSM
Function 9 (Turn On Display)") on Linux.

Also see the following:
https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9

Reviewed by:    olce
Approved by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56062

This patch changes the default value of the loader tunable
hw.virtio.pci.transitional to 1. This means, virtio uses the
modern mode for transitional devices by default.

The return values of vtpci_modern_probe() and vtpci_legacy_probei()
were chosen to prefer modern mode, but hw.virtio.pci.transitional=0
prevents modern mode.
Setting hw.virtio.pci.transitional to 1 by default seems a better fit.

Reviewed by:            tuexen
Differential Revision:  https://reviews.freebsd.org/D55894

sound: Mark some snd_fmt* functions as static

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56238

sound: Retire unused CHN_N_* defines

These still haven't been implemented by the original author, and there
doesn't seem to be much use for them anyway.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56239

sound: Simplify parts of chn_notify()

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56240

sound: De-macro array definitions in chn_calclatency()

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56263

sound: Make chn_reset() control flow clearer

I think this is cleaner than playing around with return values.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56264

sizeof(*sc->sc_ipimasks) * mp_maxid + 1 is parsed as
(sizeof(*sc->sc_ipimasks) * mp_maxid) + 1, so the buffers were one byte
short of a full (mp_maxid + 1) element count.  Multiply by (mp_maxid + 1)
for sc_ipimasks and sc_cpuids.

Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
Reviewed-by: kevans, ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2112

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D55606

Previously, when entering s2idle, we were parsing the _S255D object to
get the shallowest D-state supported by device, as
acpi_stype_to_sstate() returns -1 for s2idle.

Instead, we should read _S3D.

Relevant document:
https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/07_Power_and_Performance_Mgmt/device-power-management-objects.html#s3d-s3-device-state

Reviewed by:    olce
Tested by:      emaste, olce
Approved by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D55118

As soon as we need information from the hardware frame annotation to
make sure that checksums of the ingress frames were verified by the
DPAA2 HW, I've decided to make a preparation and extracted all of the
frame related routines into the separate dpaa2_frame.[h,c] along with
some clean up and improvements, e.g. no more dpaa2_fa, but dpaa2_swa
and dpaa2_hwa structures to describe software and hardware frame
annotations respectively, dpaa2_fa_get_swa/dpaa2_fa_get_hwa to obtain
those annotations from the frame descriptor. The next step is to
implement dpaa2_fa_get_hwa.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292006
Approved by:    tuexen
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56315

Commit c8c37141 ("virtio_blk: Use bus_dma for command/ack buffer
allocations") failed to update initialisation of the dedicated dump
request structure. This caused a panic on attempting to dump core to a
virtio_blk device.

Reviewed by:    asomers
Sponsored by:   Arm Ltd
Pull Request:   https://reviews.freebsd.org/D56156

.../sys/dev/hwpmc/hwpmc_mod.c:4640:1: warning: unused function 'pmc_is_multipart' [-Wunused-function]
 4640 | pmc_is_multipart(struct pmc_sample *ps)
      | ^~~~~~~~~~~~~~~~
1 warning generated.

Reviewed by:    mhorne
Fixes:          https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f - main - hwpmc: Initial support for AMD IBS
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56296

In ibs_stop_pmc I accidently cleared the fetch max count value rather
than the op max count value, when stopping the op counter.  This
mitigates a bug in early pre-zen processors, but breaks using both
counters simultaneously.  I also found that the max op count mask needs
to be extended for recent zen processors.

Reported by:    Andre Fernando da Silva
Reviewed by:    mhorne
Sponsored by:   Netflix
Fixes:  https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2120

Both fetch and op IBS sampling have the same problem where we need to
rewrite the control MSR to ensure sampling continues at the correct
rate.  I also like this because it resets the counter reducing the
chances that we collect a sample inside the NMI handler.

Reported by:    Aalok Agarwal
Reviewed by:    mhorne
Sponsored by:   Netflix
Fixes:  https://cgit.freebsd.org/src/commit/?id=e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2130

This is part 3 of the support for the new Intel Ethernet E610
family of devices

The ix driver now enables firmware logging on Intel E610 devices
for debugging with Customer Support. Logs are enabled by default
and generated in binary format that requires decoding by support
teams. The collected data is firmware and hardware related for
debugging purposes only.

When the driver loads, it creates a fw_log sysctl node under the
debug section. Events are organized into categories (modules) for
targeted logging, and users can adjust verbosity levels as needed.

This adds sysctl support for the firmware logging feature and
updates the ix(4) manual page with documentation.

Signed-off-by: Yogesh Bhosale <yogesh.bhosale@intel.com>
Co-developed-by: Krzysztof Galazka <krzysztof.galazka@intel.com>

Reviewed by:    ziaee, kbowling
Tested by:      Mateusz Moga <mateusz.moga@intel.com>
MFC after:      1 weeks
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D53973

We have a small buffer for pages on the stack, but if the user wants to
do an I/O larger than this we currently fail w/o a way for the user to
know the max size. It's not hard to allocate an array for the uncommon
case of very large I/Os, and the performance advantage of the array is
small in that case anyway. In addition, this allows firmware upgrades
using the full transfer size of the device as a happy accident too.

Sponsored by:           Netflix
Reviewed by:            chs, chuck
Differential Revision:  https://reviews.freebsd.org/D55638

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56330

Advertise IFCAP_WOL_MAGIC when PCI power management is available
and enable it by default.  On suspend or shutdown, rge_setwol()
enables the WOL_MAGIC and WOL_LANWAKE bits in CFG3/CFG5, disables
the RXDV gate, and enables PM so the NIC stays powered to watch
for magic packets.

Move hardware-specific WOL register configuration into
rge_wol_config() in if_rge_hw.c to keep hardware-specific
functions in sync with OpenBSD.

Update rge.4 to document WoL support.

Tested on FreeBSD 16.0-CURRENT bare metal with Realtek RTL8125
on a Gigabyte B650 Gaming X AX motherboard.

Signed-off-by: Christos Longros <chris.longros@gmail.com>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56259

* migrate the MSM8916 (snapdragon 410) support to qcom_gcc
* add the full qcom_gcc / qcom_clk list to files.arm64, replacing
  the MSM8916 stub in sys/arm64/qualcomm .

Differential Revision:  https://reviews.freebsd.org/D49706

Focus on the MRQE field of the MRQC register, which is 4 bits wide,
and we use these 3 types of values.

  - IXGBE_MRQC_RSSEN 0x1  (non VF mode)
  - IXGBE_MRQC_VMDQRSS32EN 0xA (less than 33 VFs)
  - IXGBE_MRQC_VMDQRSS64EN 0xB (less than 65 VFs)

If we always take a bitwise OR with IXGBE_MRQC_RSSEN,
IXGBE_MRQC_VMDQRSS32EN will never be chosen.
Select these 3 types of values for the proper case.

Signed-off-by: Yuichiro NAITO <naito.yuichiro@gmail.com>

MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2132

According to "HID Usage Tables FOR Universal Serial Bus (USB)"
Usage Page ID range 0x93-0xF1CF is "Reserved" and Usage Page ID range
0xFF00-0xFFFF is "Vendor-defined".

MFC after:      1 week

These devices appeared to stop sending reports via mouse USB interface
after switching to RAW mode. Fix it with changing Usage of Top Level
Collection to one found in HID report descriptor of proper interface.

MFC after:      1 week

They always report it value as zero breaking pressure-driven drivers
like moused(8) and xf86-input-synaptics.

MFC after:      1 week

They always report it value as zero breaking pressure-driven drivers
like moused(8) and xf86-input-synaptics.

MFC after:      1 week

Before this change evdev interface sent only copy of data sent through
the sysmouse interface. It worked as /dev/wsp0 device node was
automatcaly opened by devd(8) with starting of moused(8).
Starting with 15.0 moused(8) does not open sysmouse interface by default
thus making wsp(4) device dysfunctional.
Fix it with adding extra checks of interfaces state.

MFC after:      1 week

The size broke when upages was converted from array to double pointer.

Reported by:    gcc -Wsizeof-pointer-div
Reviewed by:    imp
Fixes:          https://cgit.freebsd.org/src/commit/?id=82ff1c334b97 ("nvme: Allow larger user request sizes")
Differential Revision:  https://reviews.freebsd.org/D56368

When modifying mappings in pmap we may need to perform a
break-before-make sequence. This creates an invalid mapping, then
recreates it with the changes.

When modifying DMAP mappings we may be changing the mapping that
contains its own page table then after breaking the old entry we are
unable to create the new entry.

To fix this create a map that can be used & won't be affected by the
break-before-make sequence.

Reviewed by:    kib
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56306

Support changing the property of a DMAP page that holds it's own page
table entry.

Because we need to perform a break-before-make sequence to change the
properties of pages a page that also holds it's own page table entry
will fault in the make part of the sequence.

Handle this by mapping the page with a temporary mapping as we already
do when demoting a superpage.

Reviewed by:    kib
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55943

arm64: mte: cleanup cache register definitions

Cleanup the definitions in armreg.h for the CSSIDR_EL1, CLIDR_EL1 and
CSSELR_EL1 system register to prepare for additional bitfeilds for
Memory Tagging Extension (MTE).

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Signed-off-by:  Harry Moulton <harry.moulton@arm.com>
Differential Revision:  https://reviews.freebsd.org/D55944

arm64: mte: add system register definitions

Add system register and bit field definitions for Memory Tagging
Extension (MTE) in ARMv8.5.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Signed-off-by:  Harry Moulton <harry.moulton@arm.com>
Co-authored-by: Andrew Turner <andrew@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D55945

arm64: mte: configure initial state for system registers

The fields in SCTLR_EL1 and HCR_EL2 for enabling MTE are set, and if the
ID_AA64PFR1_EL1 register shows MTE is present, the GCR_EL1 register is
also configured, and the two TFSR registers which hold pending tag check
faults are cleared.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Signed-off-by:  Harry Moulton <harry.moulton@arm.com>
Differential Revision:  https://reviews.freebsd.org/D55946

Noticed by: jhb
Sponsored by: Netflix

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294468
Reported by:    dan.kotowski@a9development.com
Tested by:      dan.kotowski@a9development.com
Discussed with: kib
Fixes:  https://cgit.freebsd.org/src/commit/?id=9289df1949cd ("x86: Add zen identifier helper function")
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56377

This example opens separate OSS capture and playback channels in mmap
mode, places them into a sync group, and starts them together so both
ring buffers advance on the same device timeline. It then monitors the
capture mmap pointer with SNDCTL_DSP_GETIPTR, converts that pointer into
monotonic absolute progress using the reported block count, and copies
newly recorded audio from the input ring to the matching region of the
output ring.

The main loop is driven by an absolute monotonic frame clock rather than
a fixed relative usleep delay. Wakeups are scheduled from the sample
rate using a small frame step similar to the SOSSO timing model, while
the audio path itself stays intentionally simple: just copy input to
output, with no explicit xrun recovery or processing beyond ring
wraparound handling.

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D53749

The lock is already held by the caller since it is used as the knlist
lock.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293901
Reported by:    Jiaming Zhang <r772577952@gmail.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=cc2715cf1f86 ("acpi_apm: Narrow scope of ACPI_LOCK")

This patch adds a debugging interface to read and write arbitrary
Apple SMC keys by name through sysctl, enabling hardware exploration
 and control of undocumented features.

The interface provides four sysctls under dev.asmc.0.raw.*:
  - key - Set the 4-character SMC key name (e.g., "AUPO")
  - value - Read/write key value as a hex string
  - len - Auto-detected key value length (can be overridden)
  - type - Read-only 4-character type string (e.g., "ui8", "flt")

Implementation includes a new asmc_key_getinfo() function using SMC
command 0x13 to query key metadata. The interface automatically
detects key lengths and types, uses hex string encoding for
arbitrary binary values, and is safe for concurrent access via
CTLFLAG_NEEDGIANT.

This interface was essential for discovering that the AUPO key
enables Wake-on-LAN from S5 state, and for mapping all 297 SMC keys
on Mac Mini 5,1.

Reviewed by:    ngie, adrian, markj
Differential Revision:  https://reviews.freebsd.org/D54441

Check a PCI device's class, subclass, and progif to figure out if it is
a USB4 NHI. nhi_identifiers is completely removed as only these generic
USB4 NHIs are supported anyway, and all remnants of ICM-supporting code
are removed too. All devices now use the HCM.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290827
Reviewed by:    jhb, ngie
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D52861

This commit adds support for the MacBookPro13,1 (late 2016, 13-inch). The SMC
keys were collected from https://logi.wiki/index.php/SMC_Sensor_Codes. Two
temperature keys are omitted because they fail to be read: TI0P (IO Proximity)
and Ta0P (Ambient Air).

Note that the with this model the `dev.asmc.0.fan.0.minspeed` setting only
applies when the fans have been activated by the system. In my testing, the fans
did not spin up until CPU temperatures hit about 80C. At lower temperatures, the
fans will happily ignore the minimum speed and remain at 0 rpm.

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2137

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2137

If you use the FreeBSD pre-build Raspberry Pi image, it does not include
the specific .dtb file for the Raspberry Pi 400. On this hardware, it
will fall back to attempting to load the Raspberry Pi 4 .dtb file
instead.

The Pi 4 .dtb file reports the board compatible name as
"raspberrypi,4-model-b" The Pi 400 .dtb file reports the board
compatible name as "raspberrypi,400" However, it's even better to
use the generic name.

When using the official Pi 400 .dtb file from the Raspberry Pi Firmware
collection, the FreeBSD xhci driver currently fails to recognize this,
and thus fails to initialize the xhci device. This means no external
USB, or internal USB (which feeds the build-in keyboard)

The official Raspberry Pi FreeBSD image has been working on the Pi 400
"on accident" simply because it didn't include the Pi 400 .dtb file
prior to this. But the Stratipi Builder uses the full Raspberry Pi
firmware suite and hit this bug.

As a note: this is probably also a bug on the Compute Module 4 (CM4),
but I don't own one of these devices in order to test/validate it.

MFC After: 5 days
Reviewed by: imp, Ali Mashtizadeh
Pull Request: https://github.com/freebsd/freebsd-src/pull/2115

The switch fell through from the supported B150–B115200 cases into default
and returned EINVAL for every speed.  Break out before default so valid
rates return success, matching uvscom_cfg_param().

Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
Reviewed by: imp,aokblast
Pull Request: https://github.com/freebsd/freebsd-src/pull/2110

The pmclog record header carries the raw TSC for each event. Export it
in struct pmclog_ev, fix JSON output to emit it unsigned, and preserve
the installed header ABI by overlaying pl_tsc with the legacy pl_ts
storage.

Update pmclog(3) to document the TSC semantics and the legacy alias.

Sponsored by: AMD
Signed-off-by: Andre Silva <andasilv@amd.com>
Reviewed by: imp, mhorne, Ali Mashtizadeh
Pull Request: https://github.com/freebsd/freebsd-src/pull/2085

Some ACPI debugging prints call acpi_d_state_to_str() on unset D-states
(i.e. ACPI_STATE_UNKNOWN), so return a string explicitly saying "unknown
D-state" instead of just panicking.

Fixes:          https://cgit.freebsd.org/src/commit/?id=84bbfc32a3f4 ("acpi_powerres: D3cold support")
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56305

ofw: bool-ify OF_hasprop()

Adjust the function signature and the few callers that don't treat it
this way already.

This is style only; no functional change intended.

Reviewed by:    andrew
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56203

OF_getprop.9: update OF_hasprop() signature

The return type has been converted to a bool.

Reported by:    manu
Sponsored by:   The FreeBSD Foundation
Fixes:          https://cgit.freebsd.org/src/commit/?id=b60cd486a652 ("ofw: bool-ify OF_hasprop()")

raspberry_virtgpio: fix OF_hasprop() usage

The function returns a bool. This driver was merged recently (by me) and
I missed this instance.

While here, adjust the ofw_bus_status_okay() call similarly. This
function still returns an int, but this usage is more widely used in our
drivers.

No functional change intended.

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Fixes:          https://cgit.freebsd.org/src/commit/?id=b60cd486a652 ("ofw: bool-ify OF_hasprop()")

Frequently there are some unused/unspecified fixed clocks present in a
device tree. Each one emits a warning before it fails to attach, which
results in (sometimes many) repeated messages which are not
user-actionable.

Put this warning behind the bootverbose flag.

MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56204

Add the Normal-Tagged memory attribute introduced with MTE.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55948

The clock calibration routine currently can result in rx timestamps
jumping backwards, which can confuse the TCP stack.
Ensure they are monotonically increasing by estimating what
we'd calculate as the next timestamp and clamp the calibration
so new timestamps are no earlier in time.

Reviewed by: kib, nickbanks_netflix.com
Tested by: nickbanks_netflix.com
Differential Revision: https://reviews.freebsd.org/D56427
Sponsored by: Netflix

etherswitch: Add minimal support for mv88e6170 switch

e6000sw.4: Mention MV88E6171

Fixes:  https://cgit.freebsd.org/src/commit/?id=680e6e30c020 (etherswitch: Add minimal support for mv88e6170)
Reviewed by:            jhibbits
Differential Revision:  https://reviews.freebsd.org/D56455

Instead of trying to parse a bogus node, just skip it if marked
disabled.

E6500 cores (MMUv2) support all powers-of-2 page sizes from 4k to 1TB,
not just powers of 4.  By using the other page sizes (8k, 32k, etc) we
can save on TLB1 space, saving up to ~1/3 of used TLB1 entries.

Freescale T-series QorIQ devices use a different register to twiddle the
timebase enable.

Since whether or not the irq is an IPI is passed into
powerpc_setup_intr_int(), use this as the check for IPI instead of
checking the name string.

Apple SMCs contain numerous undocumented voltage, current, power,
and ambient light sensors. This change adds automatic detection
and registration of these sensors as sysctls.

New sysctl trees:
  dev.asmc.0.voltage.*  - Voltage sensors (millivolts)
  dev.asmc.0.current.*  - Current sensors (milliamps)
  dev.asmc.0.power.*    - Power sensors (milliwatts)
  dev.asmc.0.ambient.*  - Ambient light sensors

Implementation:
- Scans all SMC keys at attach time via asmc_key_dump_by_index()
- Identifies sensors by key prefix patterns:
  - Voltage: VC*, VD*, VG*, VP*, VI*
  - Current: I{C,D,G,M,N,O,H,P,B,A,L}*
  - Power:   P{C,D,N,S,T,H,F,Z,z}*
  - Light:   ALV*, ALS*
- Dynamically creates sysctls for detected sensors
- Supports 8 fixed-point SMC data types:
  - sp78, sp87, sp4b, sp5a, sp69, sp96, sp2d, ui16
- Auto-converts all values to milli-units (mV, mA, mW)

On Mac Mini 5,1, detects:
- 7 voltage sensors
- 18 current sensors
- 27 power sensors
- 2 ambient light sensors

Enables power consumption monitoring, voltage rail debugging,
and ambient light detection without hardcoding model-specific
sensor lists.

Tested on:
  - Mac Mini 5,1 (2011) running FreeBSD 15.0-RELEASE
  - 54 sensors auto-detected and exposed via sysctl
  - All sensor types verified with multimeter readings
  - Fixed-point conversions validated against known values
  - Memory management tested (malloc/free on detach)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D55807

Add a per-interface loader tunable dev.rge.%d.disable_aspm to
disable PCIe ASPM (L0s/L1) and ECPM on the RTL8125/8126/8127.

Disabling ASPM reduces latency at the cost of higher power
consumption. Default is off (ASPM left as configured by BIOS).

Signed-off-by: Christos Longros <chris.longros@gmail.com>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56103

Each MDIO transfer takes 8ms, and all of that is spent in a set
of DELAY() calls, which is consuming a LOT of CPU.

* Change the timeout in ixgbe_hic_unlocked() - doing IPC to the
  on-chip firmware - to a 1uS delay and bump timeout appropriately.
  This seems to finish in a couple of microseconds on my local
  test devices.

* Change the 2ms sleep in ixgbe_release_swfw_sync_X540() to 2ms
  for EEPROM/flash, and 10uS otherwise.  10uS seems to work fine
  on my local testing, but the config EEPROM doesn't read right
  without this extra delay.

The first change shouldn't change the driver behaviour, but the
latter change is more intrusive and needs some wider testing.
(My guess here is that there SHOULD have been some completion
check somewhere in the EEPROM/flash IO path, and these sleeps
are masking them.)

Locally tested:

* C3558 (Denverton) w/ X553 backplane

Reviewed by:    kbowling
Differential Revision:  https://reviews.freebsd.org/D50295

Oops, I missed 'device ix' in here, and it now requires mdio.

When the Alder Lake Serial-over-LAN device is put into loopback mode and
repeated writes are performed to the data register it results in the device
ending up in a non-functional state afterwards.

Recovering the device to a working state requires re-writing the LCR
register with it's current value (no effective change).  This should be
harmless on all other devices.

Sponsored by: Citrix Systems R&D
Differential revision: https://reviews.freebsd.org/D56107
Reviewed by: imp

For PCI devices listed in pci_ns8250_ids return BUS_PROBE_SPECIFIC, while
for generic UART devices not explicitly listed in pci_ns8250_ids return
BUS_PROBE_GENERIC.  This allows more specific drivers to take over those
devices, and the generic UART PCI driver will only be used as a fallback.

This fixes an issue where the UART PCI driver would attach to multiport PCI
UART devices, that instead need to use the puc(4) driver to multiplex the
device.

Reported by: markj
Sponsored by: Citrix Systems R&D
Differential revision: https://reviews.freebsd.org/D56467
Reviewed by: markj imp

acpi_spmc(4): Small probe improvements/fixes

Remove the test on presence of an ACPI handle, this is implied by
ACPI_ID_PROBE() succeeding.

Set 'sc->dev' early, so that acpi_spmc_check_dsm_set() using
device_printf() will print the driver name.

Add a missing newline after printing that more DSM functions are
implemented then expected.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56483

acpi_spmc(4): Remove redundant setting of 'sc->dev' on attach

Should have been part of the previous commit (but PEBCAK).

Reviewed by:    obiwac
Fixes:          https://cgit.freebsd.org/src/commit/?id=bd05b47fbd8b ("acpi_spmc(4): Small probe improvements/fixes")
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56483

In order to enable RX checksum offloading we need to check the
meta-information for the (good) frames to see if the L3/4 checksums
were calculated and if there was an error.

The way the buffere are setup, the needed frame meta-information is
already requested. All we have to do is make sure it is really part
of the RX frame, that it is valid, and if the respective bits are set.

Also do not forget to set the (dummy) csum_data as otherwise upper
layers will just be cranky. An artefact of the past which likely
should disappear.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292006
Reviewed by:    bz, tuexen
Tested by:      bz, tuexen
Approved by:    tuexen
Obtained from:  bz (initial version, D55320)
MFC after:      3 days
Sponsored by:   Traverse Technologies (providing Ten64 HW for testing)
Differential Revision:  https://reviews.freebsd.org/D56383

If soreserve() or sosetopt() (to set TCP_NODELAY) fails after claiming
the socket from the file descriptor, explicitly close the socket
before returning failure.

Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D55493

AMD64 Architecture Programmer's Manual Volume 3 says the following:

> ECX[15:0] contains a count of the number of sequential pages to
> invalidate in addition to the original virtual address, starting from
> the virtual address specified in rAX. A count of 0 invalidates a
> single page. ECX[31]=0 indicates to increment the virtual address at
> the 4K boundary. ECX[31]=1 indicates to increment the virtual address
> at the 2M boundary. The maximum count supported is reported in
> CPUID function 8000_0008h, EDX[15:0].

ECX[31] being what we call INVLPGB_2M_CNT, signaling to increment the
VA by 2M.

> This instruction invalidates the TLB entry or entries, regardless of
> the page size (4 Kbytes, 2 Mbytes, 4 Mbytes, or 1 Gbyte). [...]

Combined with this, my interpretation of the current code is: if
<va> is aligned on a PDE boundary, we'll use INVLPGB_2M_CNT to try and
invalidate <cnt> PDEs with a single call, but that only works if <va> is
the start of at least <cnt> 2M pages.  Otherwise, if <va> or any of the
subsequent PDEs isn't actually a superpage, then we would actually only
invalidate the *first* page within the PDE before skipping to the next
PDE, leaving the remainder of the 4K pages in between as they were.

The implication would seem to be that we would need to inspect the range
that we're trying to invalidate if we're planning on using
INVLPGB_2M_CNT at all, so this patch just simplifies it to a series of
4K invalidations.  My gut feeling is that we likely still come out on
top vs. the TLB shootdown we're avoiding.

This seems to explain some issues we've seen lately with fdgrowtable()
and kqueue on recent Zen4/Zen5 EPYC hardware, where we'd experience
corruption that we can't explain.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293382
Reviewed by:    alc, kib, markj
Differential Revision:  https://reviews.freebsd.org/D56458

In addition to the locally generated statistics counters, dpaa2 ni
provides a larger set of counters than we currently export via
sysctl.  Add (most of) the missing counters and descriptions.
Around Page 3/4 there are some things left to do if we want.
Also the manual was not clear on the descriptions of 3/0 and 3/1.

The second half of the change adds another sysctl note which exports
the link-state, speed, and capabilities set as a text-blob.  This is
especially interesting in case the "ni" stops passing packets.
From what I have found in that case the (internal) link state of the
ni goes DOWN but we do not see an interrupt for a link-state change.

Being able to diagnose the state helps to (manually) fix it for now
by changing the media status to 10BaseT or none and then back to auto.
That usually brings the internal link state back UP.

MFC after:      3 days
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279352
Reviewed by:    dsl, tuexen
Differential Revision: https://reviews.freebsd.org/D55321

This change enables process-wide sampling to work with IBS by ensuring
that read/write only gets or sets the current counter.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2131

Add device IDs for several USB Ethernet adapters that use
RTL8152 and RTL8153 chips but are not yet recognized by ure(4).
This includes adapters from Cisco/Linksys, D-Link, Lenovo,
Microsoft Surface, Realtek, Samsung, and TP-Link.

All added devices use chip revisions already handled by
ure_read_chipver().

Signed-off-by: Christos Longros <chris.longros@gmail.com>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D55748

FreeBSD and NetBSD has copied these lines from the x86 architecture when
porting to other machines and forgetting to delete them.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2154

Regenerate linux syscall prototypes for membarrier(2).

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281691
Reviewed by:    kib, pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2147

Many applications, desktop environments, window managers & text editors
favor the usage of Alt or Ctrl over Super (Cmd). On a Macbook it is
quite annoying that the Super (Cmd) key gets pride of place by the spacebar.

The standard MacBook Cmd key location only really makes sense for macOS
or maybe in some tiling wm if Mod4/Super is your main modifier.
For most mainstream desktops and window managers, having Alt or Ctrl
in that location makes much much more sense.

This patch adds two sysctls for swapping either Opt(Alt) or Ctrl with Cmd(Super).

Linux has similar sysctls to this; allowing a user to make an Apple
keyboard more "orthodox"/useful at a level that takes effect independent
of typing context - ie) tty, Xorg and/or wayland.

Having a sysctl to do these swaps means that a user doesn't have to faff
about with both creating a custom vt keymap AND figure out which magic
setxkbmap incantation one needs to make one's keyboard behave as desired
across environments.

Signed-off-by: ~Not Toby <0x2b@0xff.art>

Reviewed by:    wulf
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2141

It is allocated with M_WAITOK in ac97_create().

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/17

pmap_init always uses 16-bit VMIDs when supported, but we never enable
them in VTCR_EL2 (for ASIDs, locore enables them in TCR_EL1 and
pmap_init keys off whether they've been enabled, but the order in which
pmap_init and vmmops_modinit run is reversed). As a result, although the
full 16-bit value can be stored to VTTBR_EL2 and read back, the upper 8
bits are treated as 0, and so VMIDs that our VMID allocation believes
are distinct end up aliasing.

In future this interface may change such that vmm decides on the VMID
width and tells the pmap to use that, with appropriate support for
unloading and reloading vmm, but that can come as a follow-up change, as
this is a more minimal bug fix.

Reviewed by:    markj
Obtained from:  CheriBSD
Fixes:          https://cgit.freebsd.org/src/commit/?id=47e073941f4e ("Import the kernel parts of bhyve/arm64")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55860

This was encountered on a Gigabyte GA-P55A-UD4 motherboard identifying itself
as:
ahci0@pci0:2:0:0:       class=0x01018f rev=0x11 hdr=0x00 vendor=0x1b4b device=0x91a3 subvendor=0x1458 subdevice=0xb000
    vendor     = 'Marvell Technology Group Ltd.'
    class      = mass storage
    subclass   = ATA

The physical chip has "88SE9128-NAA2" printed on it.

Similar code has been in Linux for a long time:
https://github.com/torvalds/linux/commit/50be5e3657cd2851a297dc0b3fd459f25829d29b

Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288526
Reviewed by:    jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56464

No functional change, but this is friendlier for CHERI.

Effort:         CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Consistently use vm_paddr_t for the type returned from
moea64_bootstrap_alloc and avoid temporarily smuggling it via a
pointer.  Instead, be explicit in the places that assume a 1:1
mapping.

Effort:         CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

This should fix dhcp on an unitialized interface.  This solution was
found while comparing against another driver, SIOCSIFFLAGS is used by
dhclient to force the interface up before it has an IP address.
However, all setup work is done in llan_init(), so the interface would
not be enabled if configured via only the SIOCSIFFLAGS ioctl.  By
running llan_init() when the interface is forced up via SIOCSIFFLAGS,
the interface is initialized properly.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292164

Ensure that the optional MSRs and the user flags are guarded by the
cpuid feature flags.  This prevents the user from triggering undefined
behavior or crashes on AMD processors where some of these features are
not present.  As part of this, I added the branch target and DATA4 MSRs
to the IBS op state as those are only present on a subset of the Zen
chips that I have tested.

Reviewed by:    mhorne
Sponsored by:   Netflix
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2133

The comments in tone() were referring to pre-2000 logic that does not
exist any more. This patch updates them.

Signed-off-by: Raphael Poss <knz@thaumogen.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

When the frequency configuration logic was moved to clock.c in 2008, a
mutex lock was added there (timer_spkr_setfreq) to serialize accesses
to the I/O register.

Since then, no more calls to disable/enable_intr were needed in spkr.c
than they were needed in the other callers to the same timer_spkr
functions in syscons / kern_cons, that is, not at all. This is because
there are no other accesses remaining in the kernel to the i8254
timers after boot than through clock.c.

For context, see commits
e46598588587b4897f6604489364f83fffd4d033
and
93f5134aaf829826dbcbea457bfeb27389761854.

Signed-off-by: Raphael Poss <knz@thaumogen.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

Signed-off-by: Raphael Poss <knz@thaumogen.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

If two processes are holding a spkr fd, we want orderly access to the
allocated tone buffer and the speaker itself.

Signed-off-by: Raphael Poss <knz@thaumogen.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

Prior to this patch, a thread would get EBUSY on open(2) if another
thread had the speaker open.

With this patch, two or more threads/processes can use the speaker
device at the same time. When two or more threads write to the speaker
concurrently, individual melodies--single strings, as written by
write(2) or ioctl(2) with command SPKRTONE/SPKRTUNE--are played
atomically.

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

Make this data const (it doesn't change) which will also move it to
a text section.

Signed-off-by: Raphael Poss <knz@thaumogen.net>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1922

The ena_[rt]x_cleanup functions are limited internally to a maximum
number of packets; this ensures that TX doesn't starve RX (or vice
versa) and also attempts to ensure that we get a chance to refill
the RX buffer ring before the device runs out of buffers and starts
dropping packets.

Historically these functions have returned the number of packets which
they processed which ena_cleanup compares to their respective budgets
to decide whether to reinvoke them.  This is unnecessary complication;
since the precise number of packets processed is never used, adjust
the APIs of those functions to return a bool indicating if they want
to be reinvoked (aka if they hit their limits).

Since ena_tx_cleanup now only uses work_done if diagnostics are
enabled (ena_log_io macros to nothing otherwise) eliminate that
variable and pass its value (ENA_TX_BUDGET - budget) to ena_log_io
directly.

No functional change intended; this will simplify a future commit.

Reviewed by:    akiyano
Sponsored by:   Amazon
MFC after:      6 days
Differential Revision:  https://reviews.freebsd.org/D56478

We had ENA_RX_BUDGET = 256 in order to allow up to 256 received
packets to be processed before we do other cleanups (handling tx
packets and, critically, refilling the rx buffer ring).  Since the
ring holds 1024 buffers by default, this was fine for normal packets:
We refill the ring when it falls below 7/8 full, and even with a large
burst of incoming packets allowing it to fall by another 1/4 before we
consider refilling the ring still leaves it at 7/8 - 1/4 = 5/8 full.

With jumbos, the story is different: A 9k jumbo (as is used by default
within the EC2 network) consumes 3 descriptors, so a single rx cleanup
pass can consume 3/4 of the default-sized rx ring; if the rx buffer
ring wasn't completely full before a packet burst arrives, this puts
us perilously close to running out of rx buffers.

This precise failure mode has been observed on some EC2 instance types
within a Cluster Placement Group, resulting in the nominal 10 Gbps
single-flow throughput between instances dropping to ~100 Mbps as a
result of repeated rx overruns causing packet loss and ultimately
retransmission timeouts.

To correct this, switch from processing up to ENA_RX_BUDGET (256)
packets to processing up to ENA_RX_DESC_BUDGET (256) descriptors (or
slightly more, if we hit the limit in the middle of a packet).  This
ensures that, even with jumbos, we refill the ring before processing
most of a ring worth of descriptors, and returns the throughput to
expected levels.

Note that theoretically up to ENA_PKT_MAX_BUFS (19) descriptors can be
used for a single packet, in which case even 54 packets would exhaust
the default rx buffer ring; it's not clear if this ever occurs in
practice, but this fix will address that case as well.

Reviewed by:    akiyano
Sponsored by:   Amazon
MFC after:      6 days
Differential Revision:  https://reviews.freebsd.org/D56479

Even though the functions are currently executed in the correct order,
there's no garuntee that this will always be the case.

Reported by:    kevans
Discussed with: kevans
Fixes:          https://cgit.freebsd.org/src/commit/?id=4b862c713ac5556ab4bd1828b47c5eb9cb28e067
MFC after:      3 days

These are NULL if they're not implemented. Make sure all the functions
we need are there before doing anything.

Also invert the first if statment to lessen the indentation a bit.

Reported by:    Quentin Thébault <quentin.thebault@defenso.fr>
MFC after:      3 days

Removes the deprecated loader tunable fixup_needs_csum. Removes also
the sysctl counter rx_csum_bad_offset that is no longer in use.

Reviewed by:            tuexen
Event:                  Wiesbaden Hackathon 2026
Differential Revision:  https://reviews.freebsd.org/D55588

This fixes the case where selected_size is never set to anything
in the loop.  Whilst here, also set selected_fw to NULL so the case
of "no firmware" correctly sets everything to NULL/0.

```
  --- ucode_subr.o ---
  /workspace/src/sys/x86/x86/ucode_subr.c: In function 'ucode_amd_find':
  /workspace/src/sys/x86/x86/ucode_subr.c:237:25: warning: 'selected_size' may be used uninitialized [-Wmaybe-uninitialized]
    237 |         *selected_sizep = selected_size;
        |         ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
/  workspace/src/sys/x86/x86/ucode_subr.c:105:16: note: 'selected_size' was declared here
    105 |         size_t selected_size;
        |                ^~~~~~~~~~~~~
```

Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D55439

Whatever params pointer is, it does not matter.  copyin() handles any
values.  In fact, params cannot be ever NULL.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56630

64bit processes can issue INT $0x80 instruction, and get the syscall
dispatched through ia32_syscall().  This works because syscall argument
fetch and result return are selected from the process sysent.

But, ia32_syscall() does not verify some conditions and does not perform
some actions which are considered unnecessary because the caller is
supposed to only access lower 4G.  The INT syscall path breaks this
assumption.

We never supported such hack, so disable it.  Send the offending thread
SIGBUS as if #GP was issued by hardware due to IDT vector 0x80 having
not numerically high enough DPL value.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56630

The function awg_poll() was missing a prototype, which causes the build
to fail if DEVICE_POLLING is enabled, which it is in the ARMADAXP config.

MFC after:      2 weeks
Reviewed by:    tuexen, mmel, adrian
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56651

While the majority of virtio platforms will be fully coherent, some may
require cache maintenance or other specific device memory handling (eg for
secure partitioning). Using bus_dma allows for these usecases.

The virtio buffers are marked as coherent; this should ensure that sync
calls are no-ops in the common cases.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55492

While the majority of virtio platforms will be fully coherent, some may
require cache maintenance or other specific device memory handling (eg for
secure partitioning). Using bus_dma allows for these usecases.

The virtio buffers are marked as coherent; this should ensure that sync
calls are no-ops in the common cases.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55564

It will be removed soon & replaces with pmap_s1_invalidate_all_kernel.
This allows us to handle errata that cpu_tlb_flushID is missing
workarounds for.

Sponsored by:   Arm Ltd

Reviewed by:  alc
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D52185

The current arm64 PCPU implementation uses a global register asm
variable to use x18, which we reserve with -ffixed-x18, from C. Inside a
critical_enter() or sched_pin(), it is vital that any PCPU reads use the
right PCPU pointer, as often the whole point of the critical_enter() or
sched_pin() is to ensure consistent PCPU use (e.g. for SMR it relies on
zpcpu giving the same SMR state). critical_enter() and sched_pin() both
include atomic_interrupt_fence(), i.e. asm volatile("" ::: "memory"),
barriers to ensure that memory accesses don't get moved by the compiler
outside the critical section, which on most architectures will also
order the read of the PCPU pointer itself (whether due to the read being
another asm volatile statement, or due to using a segment-relative
memory access as on x86). However, this approach on arm64 is in no sense
a memory access, and therefore the register access is not ordered with
respect to the the critical_enter() or sched_pin(), or more specifically
the curthread->td_critnest++ / curthread->td_pinned++ within.

In practice upstream today this works out ok because the read of x18 is
inlined into the actual PCPU_GET/ADD/SET memory accesses (i.e. you will
get something like ldr xN, [x18, #imm-or-xM] for PCPU_GET, etc.), and
since *that* instruction is ordered properly due to being a memory
access, the x18 ends up being read in the right place. However, that is
not in any way guaranteed, it just relies on the hope that compiler
optimisations will be perfect at inlining the use. Moreover, PCPU_PTR is
definitely not a memory access in this world, it's just pointer
arithmetic on x18, and so that has nothing ordering it. This can be
observed with the following test function compiled into the kernel:

    void
    pcpu_test(void)
    {
            extern void __weak_symbol use_pcpu_ptr(void *);
            critical_enter();
            use_pcpu_ptr(PCPU_PTR(curthread));
            critical_exit();
    }

Obviously, this is a bit contrived as you could just read curthread
directly via its atomic definition that bypasses any worries about PCPU
atomicity, but it illustrates the point. With the in-tree LLVM*, this
ends up being compiled for me to:

    paciasp
    stp     x29, x30, [sp, #-0x10]!
    mov     x29, sp
    ldr     x8, [x18]
    ldr     w9, [x8, #0x4fc]
    mov     x0, x18
    add     w9, w9, #0x1
    str     w9, [x8, #0x4fc]
    bl      use_pcpu_ptr
    ...

Note that, although the PCPU_PTR was within the critical section in the
C source, the read of x18 into x0, the argument register passed to
use_pcpu_ptr, has been hoisted to before the str, which is storing the
new, incremented, value of td_critnest to curthread, and so there is a
window within which we have to hope the thread is not preempted and
migrated to a different CPU, otherwise it will pass a pointer to the
wrong CPU's pc_curthread PCPU member.

Initially it would seem as though the solution to this would be to add
an additional barrier to critical_enter() / sched_pin() to ensure the
register reads could not be hoisted like this. However, I have not been
able to find a sequence that works reliably across both GCC and Clang,
independent of optimisation level. Using inline asm with x18 marked as a
clobber, using "=r"(pcpup), and using "+r"(pcpup) all run into various
issues; some combinations don't actually seem to be a barrier, and for
Clang at -O0 some combinations will actually generate writes to x18**,
at which point you then have to hope that the kernel is compiled with
optimisations, and that the redundant writes are optimised away such
that x18 is just passed through. But that just gets us back to hoping
optimisation works, which isn't a solution to the problem, it just
trades one point of fragility for another.

In talking to GCC developers, who seemed rather horrified by the
implications of trying to do this (which is effectively "register
volatile", a combination that's explicitly forbidden), we could not find
a solution to this, and so I have concluded that the only reliable to
have a sound PCPU implementation is to ditch this optimisation and
follow other non-x86 architectures in using inline asm in one form or
another; specifically, this adopts riscv's approach of just calling
get_pcpu(), which, curiously, was already implemented in inline asm here
on arm64, rather than reading pcpup.

Anyone who feels strongly enough about PCPU performance is welcome to
try to find a working approach, but such proposals should be heavily
scrutinised to be certain that they won't come back to bite us in
future. In particular, this caused a lot of problems downstream in
CheriBSD's experimental compartmentalised kernel, which is trialling
interposing on PCPU accesses in order to restrict access within
compartments. As a result, even PCPU_GET/SET/ADD can look like PCPU_PTR,
as they pass an opaque PCPU reference to wrapper functions, and so this
case gets hit all over the kernel, giving highly-confusing panics with
locks that aren't owned by the current thread or SMR use allegedly not
within an smr_enter().

The ia64 port encountered the same issue and reached the same conclusion
in e31ece45b7a4 ("Fix the PCPU access macros."), though went to the
trouble of trying to fold the offset into the inline assembly (assuming
it fit, with no fallback if not, since it's using the add pseudo-op that
will be expanded to either adds with a 14-bit immediate or, if somehow
that doesn't fit, addl with a 22-bit immediate). Curiously though it
left pcpup around as a footgun. sparc64 had similar code but was never
fixed. It also defined a curpcb in the same manner which was presumably
similarly broken, but looks to have been entirely unreferenced from C,
only referenced in actual assembly files. Alpha also had the same
design, but it was removed whilst critical_enter() was extern rather
than static inline so uses of the pointer could not have been hoisted,
and whilst sched_pin() didn't have any form of atomic_interrupt_fence()
to even try to make PCPU well-ordered.

 * At time of writing, when that was LLVM 19, not verified at time of
   commit with LLVM 21.

** For "+r"(pcpup), Clang's initial code generation is to do:

       mov xTtmp1, x18
       mov x18, xTmp1
       /* asm (empty) */
       mov xTmp2, x18
       mov x18, xTmp2

   since its interpretation of what that means is "read the value of
   pcpup, and make sure that value is in x18 for the duration of the
   assembly due to the asm("x18") on pcpup", and similarly for the output
   side.

Reviewed by:    andrew, jhb
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56601

qcom_tlmm: prepare for supporting multiple TLMM platforms

* Create a set of callbacks implementing the hardware specific
  GPIO bus operations
* Migrate the IPQ4018 TLMM setup code into qcom_tlmm_ip4018.c

Differential Revision:  https://reviews.freebsd.org/D56349

qcom_tlmm: extend the IPQ4018 pinmux function mask to 4 bits

It's 4 bits, not 3. Oops.

Differential Revision:  https://reviews.freebsd.org/D56350

qcom_tlmm: add i2c pull up strength config option

The X1E and others have a separate configuration bit to increase the
pull-up drive strength for i2c busses.

Add the plumbing; it doesn't do anything just yet.

Differential Revision:  https://reviews.freebsd.org/D56351

Extract rx_overruns from the keep alive descriptor reported by
the device and expose it via sysctl hw stats.

RX overrun errors occur when a packet arrives but there are not
enough free buffers in the RX ring to receive it.

MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Differential Revision: https://reviews.freebsd.org/D56640

Features:
* Report RX overrun errors via sysctl hw stats

Bug Fixes:
* Budget rx descriptors, not packets, to fix jumbo frame throughput

Minor Changes:
* pmap_change_attr void * API change for FreeBSD 16.0+
* Adjust ena_[rt]x_cleanup to return bool

MFC after: 2 weeks
Sponsored by: Amazon, Inc.
Differential Revision: https://reviews.freebsd.org/D56641

bnxt_en: Add core SR-IOV infrastructure

Introduce the foundational building blocks for SR-IOV Virtual Function
support on Broadcom NetXtreme-C/E adapters.

* Add bnxt_sriov.h: defines the extended bnxt_vf_info structure (per-VF
  firmware FID, MAC addresses, VLAN, flags, DMA command buffers, resource
  counts), the bnxt_resc_map helper, flag macros (BNXT_VF_TRUST,
  BNXT_VF_SPOOFCHK, etc.), and prototypes for all SR-IOV functions.

* Add bnxt_sriov.c: implements the SR-IOV attachment sequence
  (bnxt_sriov_attach), the iflib IOV callbacks (bnxt_iov_init,
  bnxt_iov_uninit, bnxt_iov_vf_add), VF resource allocation and
  firmware configuration helpers (bnxt_alloc_vf_resources,
  bnxt_cfg_hw_sriov, bnxt_hwrm_func_vf_resc_cfg, bnxt_hwrm_func_buf_rgtr,
  bnxt_hwrm_func_vf_resource_free), and the per-VF parameter helper.

* Extend bnxt.h: include bnxt_sriov.h; extend bnxt_pf_info with VF-
  tracking fields (vf array, firmware FID/MAC, resource-reservation
  strategy, DMA page management, sysctl context); replace the upstream
  bnxt_vf_info stub with the full definition from bnxt_sriov.h; extend
  bnxt_func_qcfg with allocation counters required by the VF resource
  configuration path; add vf_resc_cfg_input and sriov_lock to bnxt_softc.

* Update Makefile to build bnxt_sriov.c and include bnxt_sriov.h.

* Wire up PCI-IOV device methods (pci_iov_init / pci_iov_uninit /
  pci_iov_add_vf) and iflib IOV callbacks (ifdi_iov_init / ifdi_iov_uninit
  / ifdi_iov_vf_add) in if_bnxt.c; call bnxt_sriov_attach() from
  bnxt_attach_post() on P5+ Physical Functions.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56197

bnxt_en: Add VF load path and PF/VF context differentiation

Teach the driver to distinguish a Physical Function from a Virtual
Function at probe time and configure each appropriately.

* Introduce bnxt_is_vf_device() to identify all known VF device IDs
  (NetXtreme-C/E Gen1-3, Thor1/2, Hyper-V variants).  Add corresponding
  PVID entries to bnxt_vendor_info_array.

* Refactor the iflib shared context: rename bnxt_sctx_init to
  bnxt_sctx_template, add a Thor2-specific bnxt_sctx_template_p7, and
  build per-call PF/VF instances via bnxt_init_sctx_variants(); the VF
  instance carries IFLIB_IS_VF.  bnxt_register() selects the correct sctx.

* bnxt_attach_pre(): replace the hard-coded NPAR/VF switch with
  bnxt_set_flags_by_devid(); on a VF call bnxt_approve_mac() to request
  PF approval for the firmware-assigned MAC address.

* bnxt_hwrm_func_qcaps(): populate fw_fid and MAC for PF and VF contexts
  separately; for PF call iflib_set_mac() and record max_msix_vfs; for VF
  handle the case where the PF has not yet assigned a MAC.

* bnxt_hwrm_func_qcfg(): populate the new alloc_* counters used by the VF
  resource configuration path; record registered_vfs for PF and VLAN/trust
  state for VF.

* bnxt_init(): call bnxt_update_vf_mac() on VFs after each bring-up.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56198

bnxt_en: Add VF forwarded HWRM request handling

Enable the Physical Function to proxy HWRM commands issued by Virtual
Functions through the firmware forwarded-request mechanism.

When a VF issues a command that requires PF arbitration, the firmware
delivers a CMPL_BASE_TYPE_HWRM_FWD_REQ completion to the PF async ring.

* bnxt_process_async_msg() recognises CMPL_BASE_TYPE_HWRM_FWD_REQ,
  identifies the originating VF by its firmware function ID, sets the
  corresponding bit in pf.vf_event_bmap, and raises
  BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT to schedule deferred processing.

* bnxt_sp_task() dispatches to bnxt_hwrm_exec_fwd_req(), which iterates
  over all pending VF bits and calls bnxt_vf_req_validate_snd() for each.

* bnxt_vf_req_validate_snd() inspects the encapsulated request type:
  HWRM_FUNC_VF_CFG (MAC change) is handled by bnxt_vf_configure_mac()
  which enforces trust/existing-MAC rules; HWRM_CFA_L2_FILTER_ALLOC is
  handled by bnxt_vf_validate_set_mac(); HWRM_FUNC_CFG is forwarded
  as-is; all other commands are rejected.

All forwarded-request code is guarded by #ifdef PCI_IOV.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56199

bnxt_en: Add per-VF trust, spoof-check and promiscuous controls

Expose per-VF policy knobs via the FreeBSD sysctl tree and enforce
them at the data-path level.

Trust (dev.bnxt.<unit>.vfN.trusted):
  bnxt_set_vf_trust() sets/clears BNXT_VF_TRUST and sends
  HWRM_FUNC_CFG with FLAGS_TRUSTED_VF_ENABLE/DISABLE.
  bnxt_create_trusted_vf_sysctls() / bnxt_destroy_trusted_vf_sysctls()
  manage the sysctl lifetime with VF creation/teardown.

Spoof-check (dev.bnxt.<unit>.vfN.spoofchk):
  bnxt_set_vf_spoofchk() issues HWRM_FUNC_CFG with
  SRC_MAC_ADDR_CHECK_ENABLE/DISABLE.

Promiscuous gating:
  bnxt_is_trusted_vf() queries firmware via HWRM_FUNC_QCFG.
  bnxt_promisc_ok() returns false for untrusted VFs, preventing them
  from entering promiscuous mode.  bnxt_promisc_set() is updated to
  gate the PROMISCUOUS and ANYVLAN_NONVLAN mask bits on bnxt_promisc_ok().

bnxt_iov_vf_add() applies the initial trust/spoof-check policy from the
nvlist schema.  bnxt_iov_init() creates the sysctl trees after
bnxt_cfg_hw_sriov() succeeds.  bnxt_iov_uninit() tears them down.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56200

bnxt_en: Re-enable SR-IOV after firmware reset

When the firmware undergoes a hot-reset and the driver re-opens the
device, previously active Virtual Functions lose their resource
configuration.  bnxt_reenable_sriov() restores that configuration by
replaying bnxt_cfg_hw_sriov() with the saved resource parameters.

The function is called from bnxt_fw_reset_task() in the
BNXT_FW_RESET_STATE_OPENING state, guarded by #ifdef PCI_IOV.
Because bnxt_cfg_hw_sriov() is a no-op when active_vfs is zero the
call is safe on any PF regardless of whether VFs were ever created.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56201

bnxt_en: VF ring reservation, HWRM registration, and PF-only operation guards

VFs require separate HWRM commands for ring reservation and async
completion ring setup, so a common PF/VF dispatcher is introduced and
the async CR path is extended to handle both.  The PF must populate the
VF request forwarding bitmap during driver registration so the firmware
correctly forwards VF-originated HWRM commands.  VF reservation strategy
and min-guaranteed capability flags are now parsed for correct resource
partitioning, and PF-only operations (DCB, NVM, package version sysctl)
are guarded against VF invocation.

The short command buffer allocation is also reordered before the function
reset to ensure extended HWRM messages are available when needed, a
prerequisite uncovered during VF bring-up.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56232

bnxt_en: Address review comments for core SR-IOV support

This patch addresses the code review comments provided for:
https://reviews.freebsd.org/D56197

* P7 VF PCI ID: rename NETXTREME_E_P7_VF to E_P7_VF (P7/Thor2 line drops the
  Netxtreme name in product strings; other VF device IDs are unchanged).
* Use the return value of bnxt_vf_parse_schema() in bnxt_iov_vf_add() to
  decide when to call bnxt_set_vf_admin_mac(); make parse_schema() return
  bool and remove the has_admin_mac field.
* In bnxt_free_vf_resources(), fix indentation after dma_free_coherent() so
  the NULL assignment is clearly separate from the call.
* In bnxt_hwrm_func_vf_resource_free(), use first_vf_id/last_vf_id in the
  HWRM_FUNC_VF_RESC_FREE loop.

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56644

bnxt_en: add bnxt_sriov.c to sys/conf/files for built-in kernel builds

The SR-IOV series added bnxt_sriov.c and listed it in sys/modules/bnxt/bnxt_en/Makefile,
but kernels that build bnxt into the image only compile sources named in sys/conf/files.
Add bnxt_sriov.c next to the other bnxt_en entries so built-in bnxt (including LINT)
links the SR-IOV implementation and avoids undefined symbols referenced from if_bnxt.c.

Fixes: https://cgit.freebsd.org/src/commit/?id=f2f831b2c151 ("bnxt_en: Add core SR-IOV infrastructure")

MFC after:      1 month
Reviewed by:    ssaxena
Differential Revision: https://reviews.freebsd.org/D56688

EFI runtime faults may be mistaken for kernel panics, and do not
necessarily represent actual problems.  Try to differentiate them some
more by printing "EFI runtime trap" rather than "Fatal trap".

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291193
Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56309

Reject unsupported AMD IBS and PMU control bits before programming the
MSRs.

Initialize IBS fetch/op allow masks from CPUID feature bits and validate
user-provided IBS control values against those masks. Keep the
load-latency filter dependency on L3MissOnly, but avoid decoding fields
that are already constrained by the mask.

Apply the same reserved-bit policy to the AMD PMU raw-config path by
checking core, L3, and data fabric configs against subclass-specific
masks.

Fix the IBS CPUID feature bit definitions used by the policy.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Signed-off-by:  Andre Silva <andasilv@amd.com>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2140

Expose kern.hwpmc.{ibs_fetch,ibs_op,amd_core,amd_l3,amd_df}_extra_mask
as RWTUN uint64s that OR into the CPUID-derived allow mask at
validation time. Default 0, so the strict policy applies unless an
administrator opts bits back in — intended for testing the wrmsr_safe
path in PR #2157.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   AMD
Signed-off-by:  Andre Silva <andasilv@amd.com>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2140

This will be used to enable MTE from userspace.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D55950

It should be for FEAT_MTE2 as the registers aren't implemented for
FEAT_MTE.

While here fix the style of the comment explaining the check.

Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=58de79153622 ("arm64: mte: configure initial state for system registers")
Sponsored by:   Arm Ltd

Submitted by: hari.thirusangu@sophos.com
MFC after:      2 weeks

powerpc/pic: Add a PIC_AP_INIT() to set up AP PIC info

pc_cpuid may not match the PIC's idea of a given CPU.  Since openpic
has a WHOAMI register, we can use that to get the PIC's idea of the CPU.
This needs to be done on each AP, so add a PIC_AP_INIT device method so
the PIC can perform any AP-specific initialization at AP bootstrap time.

This fixes SMP on e6500, which is still lacking SMT support.

Differential Revision:  https://reviews.freebsd.org/D56421

powerpc/pic: fix the openpic CPU logic to work on powermac

Earlier work (40bcad56f - powerpc/pic: Add a PIC_AP_INIT() to
set up AP PIC info) broke booting my dual G5 powermac.

After much digging, jhibbits@ and I discovered that the openpic
implementation for the memory/bus controller used in the G5 CPUs
doesn't implement /all/ of the openpic specification.
Notably it sticks the WHOAMI register in a different location.
This is reading 0x0 back for all the PICs which is .. very not great.

So to restore the previous behaviour, use a quick for now that jhibbits@
can set appropriately to trust WHOAMI.

I've tested this on my dual G5 PPC and it boots/runs fine.

Fixes: https://cgit.freebsd.org/src/commit/?id=40bcad56f

Reviewed by:    jhibbits
Differential Revision:  https://reviews.freebsd.org/D56751

The Freescale MPIC supports up to 2048 IRQs, but since we only build an
array of 768 interrupts in intr_machdep, clamp the max at 512.  The most
any Freescale PowerPC chip actually supports is 452 on the T4240, so 512
is sufficient.

As part of this, increase the vector mask to the full openpic vector
mask, and use this limit as the terminator for the dispatch loop,
instead of a hard-coded 255.

Differential Revision:  https://reviews.freebsd.org/D56422

I2C subsystem errors belong in the IIC_* error space.  It's pretty clear
this is what is intended in the code.

Probe SMC keys at attach time to detect hardware capabilities,
supporting all Intel Apple machines without per-model entries.

Sensors are discovered by scanning sorted SMC key ranges for
known prefixes and types. Capabilities such as SMS, fan safe
speed, and ambient light are detected by key presence.

A global key description table provides human-readable names
for well-known temperature sensors.

Tested on:
 - MacBook Pro (Early 2007, Mid 2014, Mid 2015)
 - MacBook Air (Early 2015, Mid 2017)
 - iMac (Mid 2011, Late 2013)
 - Mac mini (Mid 2011)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56405

In order to improve the efficiency of block read/write calls, Intel has
introduced a block buffer. Instead of generating an interrupt after
receiving/sending a single byte, the data is buffered in the block buffer. It
allows the SMBus controller to generate a single interrupt for the whole
transfer. At the moment, we don't support that and don't expect the SMBus
controller to behave in that way. Unfortunately, BIOS code can also access the
SMBus controller and may enable the block buffer. Poorly written BIOS code may
also keep the block buffer enabled breaking our driver. Therefore, we should
check if the device supports a block buffer and disable it for every request
because we don't know if some BIOS code has reconfigured the SMBus controller
in between.

Reviewed by:            emaste
MFC after:              1 week
Sponsored by:           Beckhoff Automation GmbH & Co. KG
Pull Request:           https://github.com/freebsd/freebsd-src/pull/2161

Apply the appropriate quirk. Also, introduce a new uaudio_vendor_audio
table, similar to uaudio_vendor_midi, which includes non-standard USB
audio devices. The Roland UA-33 needs this, bceause it comes with
bInterfaceClass = 0xff (vendor-specific), so snd_uaudio(4) doesn't
detect it.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294814
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    emaste
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/24

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Instead of printing the driver version over and over again if multiple
controllers are used, set a sysctl name for the used driver version.

Approved by:    imp, ziaee
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56110

Reviewed by:  obiwac, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56619

MFC after:    3 days

Similar to glibc, define all the stdint.h macros such as `SIZE_MAX`,
`UINT64_C`, etc unconditionally. I.e. no longer check whether
`__STDC_CONSTANT_MACROS` or `__STDC_LIMIT_MACROS` are defined. See also
<https://sourceware.org/bugzilla/show_bug.cgi?id=15366>.

This is part of reverting base 00bee6fcd77f, which reverted an upstream
libc++ commit that eliminated libc++'s stdint.h wrapper header.

Submitted by:   Nikolas Klauser <nikolasklauser@berlin.de>
MFC after:      1 week
Reviewed by:    imp
Differential Revision: https://reviews.freebsd.org/D56746

powerpc: initial straight port of busdma_machdep.c -> busdma_bounce.c

This is a straight port of the code and doesn't yet handle
different implementations (which will be in a subsequent commit.)

Locally tested:

* G5 SMP (2x PPC970mp)
* power8 / power9 pseries QEMU VM
* power8 powernv

Differential Revision:  https://reviews.freebsd.org/D55313

powerpc: create a tag with the parents implementation if supplied

If a parent tag is supplied then use its implementation.

Differential Revision:  https://reviews.freebsd.org/D55314

powerpc: add in some busdma domain setup

* Implement the basic tag domain set routine
* Set the domain to the parent domain if provided

This is just plumbing for eventual work to re-allocate things into
the currently configured domain.

Differential Revision:  https://reviews.freebsd.org/D55315

powerpc: refactor common busdma tag setup

Refactor the common busdma tag setup code into busdma_machdep.c

Locally tested:

* qemu VM, pseries-9 / power9
* qemu VM, pseries-8 / power8

Differential Revision:  https://reviews.freebsd.org/D55340

powerpc: use local flags for bounce buffers instead of common flags

Migrate to using local flags for bounce buffers instead of the
common flag field.

Differential Revision: https://reviews.freebsd.org/D56208

powerpc: busdma declaration shuffling

Shuffle some of the declarations around to match other implementations.
Expected to be a no-op.

Differential Revision: https://reviews.freebsd.org/D56243

powerpc: refactor dmamap setup; free dmamap in error paths

* refactor the dmamap allocation / setup path for future code changes
  to align with arm64 busdma code;
* free the dmamap allocation if the dma segment list can't be allocated;
* free the dmamap allocation during the busdma dmamem allocation path
  if the actual memory allocation itself fails.

Locally tested:

* POWER9 ppc64le native boot, Raptor Engineering Blackbird
* POWER8 ppc6le, IBM POWER S822LC

https://reviews.freebsd.org/D56244

The shutdown splash draws over all the useful info if ddb(4) is
disabled. Don't draw the splash screen if we're rebooting because of a
panic.

MFC after:      3 days

This RTC chip supports 2 alarm timers in addition to RTC functionality,
but this driver only supports the RTC at this time.

dpaa: Migrate from NCSW base to a home-grown driver

The NCSW reference base requires tuning for each target, and currently
is configured for FMANv2.  This doesn't readily work on FMANv3 devices,
such as the T-series powerpc, or the LS1043 ARM.  Since Freescale/NXP
abandoned the NCSW driver a decade ago, it makes sense to abandon it
ourselves as well.  This new driver uses a combination of the NCSW
driver and the Linux driver (BSD/GPL dual licensed) as a reference, but
contains no actual code from them.

The DPAA (Data Path Acceleration Architecture) subsystem consists of the
following components:

* BMan -- Buffer Manager.  Manages buffer pools of different sizes (one
  size per pool, up to 64 pools)
* QMan -- Queue Manager.  Manages the interfaces between DPAA-based
  components and the CPU(s).
* FMan -- Frame Manager.  Responsible for all ethernet-related
  processing.  Consists itself of the following components:
  * Ports -- interfaces to the QMan.  An ethernet interface consists of
    2 ports.
    Ports use "Next-invoked action" (NIA) descriptors to form a pipeline
    for processing on receive and transmit.
  * Parser -- performs protocol header parsing and validation.  Both
    hardware and software parsers are available.
  * KeyGen -- Key generator, used to start the classification process
    (for the Policer), generating FQIDs and other keys based on the
    frame input.
  * Policer -- performs traffic shaping and classification
* MAC -- SoC specific ethernet MAC (dTSEC, TGEC, mEMAC).  Currently
  supports dTSEC and mEMAC, along with their MDIO blocks.

Additional components not yet handled:
SEC -- Security engine (crypto)
RE -- RAID engine
RapidIO
DCE -- Decompression/Compression engine, supports ZLIB, DEFLATE, and
GZIP, as well as base64 encoding and decoding.

BMan and QMan are accessed via cache-coherent portals, using ring
buffers as I/O.  The intent is for portals to be per-CPU (core/thread)
to reduce locking contention and improve performance.  This driver pins
interrupt handlers to the CPU "owning" a given portal, and uses critical
sections to prevent switching while accessing the portal.

dpaa: Enable checksum offloading for IPv4 and IPv6

Enable the FMan hardware parser to take advantage of some offloading.
This enables receive and transmit checksum offloading for both IPv4 and
IPv6.

Additional offloading capabilities the DPAA supports include:
* vlan parsing
* Transmit rate limiting
* IEEE-1588 timestamps
* Soft parsing for custom protocol checking
* Congestion handling

dpaa: Support jumbo frames as multi-buffer frames

Reported by:  ziaee@
Fixes:  https://cgit.freebsd.org/src/commit/?id=fd8d34ce27 ("dpaa: Migrate from NCSW base to a home-grown driver")

Reported by:  ziaee@
Fixes:  https://cgit.freebsd.org/src/commit/?id=d22051b18 ("iicbus/rtc: Add driver for the Ricoh rs5c372 RTC")

Older SMC firmware exposed AUPO as a Wake-on-LAN control. On updated
firmware, the key controls automatic power-on when AC power is restored
after a power loss; WoL is handled by the GBE controller instead.
Rename the sysctl to reflect the current semantics. No compatibility
alias is provided as the sysctl has not appeared in any release.

Reviewed by:    ziaee, adrian
Differential Revision:  https://reviews.freebsd.org/D56747

The LAN8700 / LAN8710 PHYs were Standard Microsystems Corporation (SMSC)
parts.  I presume SMC was chosen as an abbreviation, but the company
always used SMSC as its short name.

SMSC was acquired by Microchip in 2012.  I kept the pre-acquisition
name, as NetBSD (from where we obtained miidevs) uses SMSC.

Reviewed by:    adrian
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56819

acpi_panasonic_shutdown() calls hkey_sound_mute() without holding
the ACPI serial lock. Every other call site holds
`ACPI_SERIAL_BEGIN(panasonic)` before calling it, as the locking
model is caller-owned.

This seems to affect the whole Panasonic Toughtbook lineup btw.

Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D56718

Add PCI device IDs for two Ice Lake PCH SMBus controller variants:
- 0x34a3 (Ice Lake-LP), previously listed as the generic "Ice Lake" entry (ID_ICELAKE), renamed to ID_ICELAKELP for clarity.
- 0x38a3 (Ice Lake-N), a separate PCH variant not previously supported.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56732

Reorder the TLS RX teardown sequence so the TIR is destroyed before
the DEK.  DESTROY_TIR for a TLS-enabled TIR issues a TRA RX fence
that drains all in-flight packets from the crypto pipeline.  If the
DEK is destroyed first, packets still in flight hit a TPT encryption
error (vendor syndrome 0x55) because the key they reference is
already gone.

Reviewed by:    kib
Sponsored by:   Nvidia networking
MFC after:      1 week

The virtio_p9fs module event handler can be invoked multiple times.
Previously, this caused p9_init_zones() and p9_register_trans() to be
executed multiple times, leaking UMA zones and corrupting the transport
list. During module unload, p9_destroy_zones() was also called multiple
times on the same zone pointers, triggering a duplicate free kernel panic
in uma_zdestroy().

This patch introduces a static reference counter in vt9p_modevent() to
ensure the zones and transports are only initialized and destroyed exactly
once, aligning with the approach used by other virtio drivers like vtnet.

Reviewed by:    kib, markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D56497

The smartpqi driver did not log device add/remove or controller events
to syslog, and hw.smartpqi.debug_level could only be set at boot via
loader.conf with no runtime sysctl interface.

Add a read-write sysctl at dev.smartpqi.N.debug_level for runtime
debug level changes. Add device_printf calls for device addition,
removal, and controller events (hotplug, hardware, physical/logical
device, AIO state/config changes) so state changes always appear in
dmesg. Add DBG_DISC logging for discovery state transitions. Fix
spelling errors in strings and comments across the driver.

Bump driver version to 14.4691.1.2000 / 15.2.1.2000.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294161
Reviewed by:    imp
Approved by:    imp
MFC after:      2 weeks

Differential Revision:  https://reviews.freebsd.org/D56832

MFC after:    1 week
Sponsored by:   Chelsio Communications

Assign the driver type instead of preserving uninitialized stack data

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294899
Reviewed by:    aokblast

eecp holds the extended capability offset. If that offset is larger
than 0xff, storing it in uint8_t truncates it, which can make the
early EHCI/XHCI capability walk read the wrong location and loop during
boot.

Seen on AMD device 1022:151e, where HCCPARAMS1 = 0x0118ffc5 and the
first xHCI extended capability offset is 0x460. Widen eecp to uint32_t
in xhci_early_takeover(), matching xhci_pci_take_controller().

Signed-off-by: Gisle Nes <gisle@gisle.net>
Reviewed by:    zlei, aokblast
MFC after:      3 days
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2127
Closes:         https://github.com/freebsd/freebsd-src/pull/2127

This and the E3000 are both handled by the r8169 driver in Linux, and
reportedly this is infact just a straight re-brand of the RTL8126.

Tested by:      "Sinetek" on Discord
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56917

riscv: IOMMU support

Support for RISC-V IOMMU spec v1.0.1 (ratified)
  https://github.com/riscv-non-isa/riscv-iommu

Supports translation for PCI devices only.
Supports 1 or 2-level device-directory-table (DDT).
Supports SV39 and SV48 virtual memory system (on per-device basis).
Supports both "standard" and "extended" device-context (DC) structure.
Supports "bypass" mode to disable translation for a particular device.
Supports WSI (Wire-Signalled Interrupts) only.

This includes both PCI-bus and FDT attachment drivers.

Note in case of PCI-bus attachment, interrupts are not available. In this
case no error report is provided in case of translation fault. Otherwise
interrupts are not needed.

Differential Revision:  https://reviews.freebsd.org/D55922

riscv: Add IOMMU to NOTES

Reported by:    bz, ivy
Fixes:          https://cgit.freebsd.org/src/commit/?id=bcecad2c24aa ("riscv: IOMMU support")

u-boot/opensbi determines the ethernet MAC address from ROM and passes
it to the OS in the device tree. This change sets the correct MAC
address from this source. This prevents the eqos class driver from
generating random MAC addresses at each boot.

Tested on Starfive VisionFive 2, riscv64 SBC.

Reviewed by:    mhorne
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56782

g_part,mkimg: Add additional GPT partition types

Add the hifive-fsbl, hifive-bbl, and xbootldr aliases to mkimg(1).
Add the xbootldr alias to geom(4), and thus gpart(8).

The "hifive" partition types are defined and used by various RISC-V SBCs
for locating firmware.

"xbootldr", or the Extended Boot Loader Partition is defined here:
https://uapi-group.org/specifications/specs/boot_loader_specification/

Reviewed by:    emaste, markj, mhorne
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56784

gpart.8: add entry for xbootldr partition type

Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
Fixes:  https://cgit.freebsd.org/src/commit/?id=dab8138e13de ("g_part,mkimg: Add additional GPT partition types")
Differential Revision:  https://reviews.freebsd.org/D56969

* cut-paste buffer stays unchanged

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260069
Reported by:    emaste

Reviewed by:    imp
Approved by:    imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D56922

arm64: Add RSI detection for CCA

Detect the presence of the Realm Services Interface (RSI). This detection is
performed early in bootup; PSCI initialisation has been moved to initarm() to
faciliate this.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56598

arm64: Fix the includes for rsi.c

This depended on header pollution only present when FDT is defined. As
FDT isn't check for in this file we can remove opt_platform.h and
include the correct set of vm header files.

Reported by:    ivy
Fixes:  https://cgit.freebsd.org/src/commit/?id=76a2904c352b ("arm64: Add RSI detection for CCA")
Sponsored by:   Arm Ltd

When EARLY_PRINTK is used in a realm environment, the UART physical
address must be in the unprotected address space. The resulting
physical address will not generally fit in an immediate, so use a
literal instead.

Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56600

The patch in the PR failed to apply, so I manually applied the same
changes.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295231
Submitted by:   Mike Tancsa <mike@sentex.net>
Reviewed by:    emaste

acpi_spmc(4): Fix comments on constraints storage

The fields themselves are not unused, we actually fill them, but once
filled we indeed do not use their values (yet).  See the '#ifdef notyet'
section in acpi_spmc_check_constraints().

No functional change.

Reviewed by:    emaste, obiwac, imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56798

acpi_spmc(4): Remove XXX from a comment about retrieving constraints

There is really nothing we can do about a DSM function that works on
first call but fails on subsequent calls, except calling it only once,
which we already do.

While here, soften the comment message, as failure was observed with
some specific machines only.

No functional change.

Reviewed by:    emaste, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56799

acpi_spmc(4): Constraints: Rename the Intel-format parser

...from acpi_spmc_get_constraints_spec() to
acpi_spmc_get_constraints_intel(), as really there is no ACPI
specification proper and parsing the constraints is done according to
some *Intel* specification (even if it is true that, by contrast, AMD
has none).

No functional change (intended).

Reviewed by:    obiwac, imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56800

acpi_spmc(4): Factor out code to test for a DSM's presence

...through a new function has_dsm(), which slightly simplifies reading.

No functional change (intended).

Reviewed by:    obiwac, imp
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56801

acpi_spmc(4): Clear confusion between DSMs and their functions

Stick to the ACPI specification's terminology where DSM means "device
specific method", but is in fact a set of multiple functions (actually,
there is one set of functions per DSM revision, with the set for some
revision in theory including those of the previous revisions), by
renaming some of the fields of 'struct acpi_spmc_softc' and local
variables accordingly.

To this end, rename appropriate structures, fields, parameters and
variables, mechanically.

No functional change (intended).

Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56802

acpi_spmc(4): Introduce supports_function()

For better readability and because this stance will be used in many
more places in a subsequent commit.

No functional change (intended).

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56803

acpi_spmc(4): softc: Remove unused 'obj'

No functional change (intended).

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56804

acpi_spmc(4): Factor out printing DSM call error, delineate function

Introduce failed_to_call_dsm(), which prepends "function" before the
function index for better clarity.  For now, it prints the function
number, as before, but will soon print a human-readable name.

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56805

acpi_spmc(4): Human-readably print supported DSMs and their functions

To this end, revamp how DSMs and their functions are represented.
Replace enumerations, which only bring minimal advantages, with plain
macros, allowing to get rid of 'union dsm_index' and in passing the associated bug
that an underlying type smaller than 'int' is aliased to an 'int', which
assumes little-endian architectures.  Associate to each function
a printable name, in the form of a per-DSM array that maps a function
index into a string.  Make sure that every used array and their number
of items are sized at compile-time and are declared constant, and that
as little code as possible depends on the particular set of present DSMs
and associated functions.

Since the set of DSMs and sets of per-DSM functions are represented as
bitsets, introduce print_bit_field() to print such sets.  This new
function is akin to printf("%b", ...) but with more flexibility.  It
takes a function associating a name to some bit index and an opaque
pointer, allowing to leverage existing structures containing names
instead of imposing the use of a separate string containing all names to
be printed.  It also provides a default name to bits without an explicit
name, composed of a common prefix and the bit index as a suffix.

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56756

acpi_spmc(4): Rename functions parsing constraints

Rename acpi_spmc_get_constraints_intel() and
acpi_spmc_get_constraints_amd() ("get" => "parse") to reflect that they
are actually just parsing the constraints passed by
acpi_spmc_get_constraints().

No functional change (intended).

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56806

acpi_spmc(4): Constraints: Simplify some assertions

While here, capitalize their messages.

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56807

acpi_spmc(4): Constraints: Clearer message on handle retrieve error

Currently, the "failed to get handle for ..." log messages on attach are
a bit alarming and no context is provided.  Print out that these are
retrieved when trying to match constraints and that such failures are
ignored, which should make administrators worry less.

While here, remove duplicated handle retrieving code in
acpi_spmc_check_constraints() because:
1. As is, it is dead code: We 'continue' if the handle is NULL, i.e.,
   not already resolved, before trying to resolve it again.
2. This code is called after device suspension, which might make some
   objects disappear from the ACPI namespace.  In any case, it seems
   unlikely that, suddenly, new objects would appear.

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56808

acpi_spmc(4): Stop pretending that all constraints are verified

We do not check these constraints (yet), so stop printing that they are
verified.

While here, make the (not compiled in at the moment) "constraint
violated" message more terse, and move the warning it contains to
outside of the loop (no need to print it repeatedly if multiple
constraints are violated).

While here, bail out early if there are no constraints to avoid printing
(in the future) that constraints are respected even when there are none.

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56809

acpi_spmc(4): Check DSMs only on attach, do not return 0 on probe

Once we have recognized a device by PNP ID, declare support
unconditionally on probe, and only check for DSMs in attach.

We do this for these reasons:
1. PNP0D80 is de-facto a device supposed to hold DSMs related to
   suspend-to-idle, so we assume it cannot be used for other purposes.
   And if that changes, we need another architecture anyway (e.g., have
   a new driver claiming those devices and behaving like a bus, to which
   this driver would be a sub-driver).
2. If there are no DSMs that we support on such a device, then a new DSM
   was added that the driver does not know about and which "replaces"
   (in terms of functionality) the known ones, or the firmware is buggy.
   In both cases, failing the attach instead of the probe is reasonable,
   as that leads to printing some error which we (and probably users
   too) would like to know about.
3. This is a step to enable multiple instances of this driver (just to
   be a good citizen, and also to be future proof against weird
   firmwares that would, e.g., implement the Microsoft DSM on another
   device than the Intel one).

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56810

acpi_spmc(4): Print supported functions after DSMs

This makes things more top-down, as expected when probing devices.

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56811

acpi_spmc(4): INVARIANTS: Do not panic on getting constraints failure

Just continue without constraints checking in this case.

To this end, remove the 'constraints_populated' field from 'struct
acpi_spmc_softc' and any reference to it.

However, we introduce another boolean, 'sc->get_constraints_succeeded',
in order to check (under INVARIANTS) that acpi_spmc_get_constraints() is
called only once on success.  Calling that function another time after
a success would leak memory.  It would be easy to change that function
to support multiple calls (e.g., by adding a call to
acpi_spmc_free_constraints() near its start), however trying to retrieve
the constraints again simply looks like wasted time as the same results
are expected to be returned on each call.

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56812

acpi_spmc(4): Gracefully support a standalone Microsoft DSM

In acpi_spmc_get_constraints(), stop assuming that if there is no AMD
DSM, then the Intel one is present.  Although this is likely to be the
overwhelming majority of cases on amd64, there is no technical reason
nor constraint in our code that really needs assuming that.  On (so far
hypothetical) machines with only the Microsoft DSM, this assumption
would cause a cryptic and irrelevant error message (and, prior to the
previous commit, a panic on INVARIANTS).

Warn the user if both the Intel and AMD DSMs are present, and use the
constraints reported by the Intel one (see the comment for why).

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56813

acpi_spmc(4): In-kernel strdup() cannot fail, remove dead code

No functional change (intended).

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56814

acpi_spmc(4): Constraint parsing: Clearer error messages

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56815

acpi_spmc(4): Global message on constraints parsing failure

...in order to indicate to users that power state constraints will not
be checked at all.

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56816

acpi_spmc(4): Enable multiple instances

Support the (so far hypothetical) case of a machine with multiple
instances of the PNP0D80 device (e.g., if multiple DSMs are not
implemented on the same device), by allowing multiple instances of the
device to co-exist.

This is achieved by moving 'supported_functions' from 'struct dsm' into
the softc, so each instance has its own view of which functions are
supported.

Consequently, the check on the instance unit on probe can be removed.

Reviewed by:    imp (older version), obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56817

acpi_spmc(4): acpi_spmc_probe_dsm(): Remove passing superfluous handle

The handle is already held by the softc, which is also passed.

No functional change (intended).

Reviewed by:    imp, obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56818

acpi_spmc(4): Add a sysctl knob to request verbosity

The driver will be more verbose on this knob being non-zero or
'bootverbose' being set.  The corresponding variable is typed as an
integer to leave room for expansion.  To be used in subsequent commits.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56875

acpi_spmc(4): Be less verbose by default

Do not print by default details of failures that are unlikely to help
a normal user and to have a crucial influence on whether suspension
works correctly.  Do so only on a verbose boot or if requested
explicitly by the user via 'debug.acpi.spmc.verbose'.

In particular:
- On an Intel Framework laptop, the Microsoft DSM only reports the
  SLEEP_ENTRY and SLEEP_EXIT functions.  That makes some sense since,
  according to its specification, all functions of a Microsoft DSM
  except these two are in fact redundant with Intel DSM's ones (also,
  that of AMD DSM's ones).  Those functions being missing are only
  a potential problem if there is no other DSM than Microsoft's (yet to
  be observed in the field).
- The details of malformed/unapplicable constraints or ones with a newer
  format the driver does not know about are not readily actionable
  pieces of information, but rather debug/developer-oriented ones.  When
  verbosity is not requested, only print the details of the first such
  failure to encourage reporting and at the same time avoid cluttering
  the output.
- Detecting and printing unknown DSM functions is not directly
  actionable either, and the driver not using these functions may not
  prevent suspending (but might, e.g., prevent reaching deeper sleep
  states).

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56876

acpi_spmc(4): acpi_spmc_run_dsm(): Rename, rename parameters, constify

This function actually runs a function of a given DSM.  Remove the
'_dsm' suffix to remove the inaccuracy and make things simpler.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56877

acpi_spmc(4): Factor out testing for present DSMs/functions

Since we are now keeping in the softc the information about which DSM
functions are available (in supported_functions[]), the 'dsms' field
there is somewhat redundant.

Make it completely redundant by keeping the bit representing the
enumeration function itself in each element of supported_functions[],
and then remove the field.

As a result, convert has_dsm() to rely on supports_function().

Adapt acpi_spmc_dsm_check_functions() so that it does not take into
account the enumeration function bit.

While here, use the self-explanatory stance
IDX_TO_BIT(DSM_ENUM_FUNCTIONS) instead of a hardcoded 1.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56878

acpi_spmc(4): Only run DSM functions reported present

Examination of the DSDT in a Framework laptop generally hints at
firmware designers sometimes providing ACPI methods for convenience
(e.g., same firmware for multiple models) but not using them (or not
expecting them to be used) depending on tweaks or the actual hardware
platform.

On an Intel Framework laptop, we specifically observe the presence of
a Microsoft DSM that just reports availability of the SLEEP_ENTRY and
SLEEP_EXIT (7 and 8) functions although the Microsoft specification
requires other functions, whose purpose is similar to corresponding
Intel DSM's ones (such as DISPLAY_OFF).  However, we currently always
call the latter even on the Microsoft DSM.  On that laptop, fortunately,
the way the code is structured in the _DSM method leads to nothing being
executed on this call.

Given the similarity of intent between most functions from the Microsoft
DSM on one side and those of ADM and Intel on the other, it is
imaginable that other firmware developers could use a strategy where
functions are in fact aliased, in which case insisting on calling the
Microsoft's DSM function even if not enumerated would cause the action
to be performed twice (because we also call the corresponding function
on the Intel/AMD DSM), which may or may not cause other problems and in
any case seems a waste.

So, by default, do not try to run any function that is not enumerated,
as that looks like the safest approach.  Add a debug sysctl(8) knob to
revert to the previous behavior, just in case
('debug.acpi.spmc.force_call_expected_functions').

acpi_spmc_run() now checks if a DSM/function combination has been
enumerated, and skips the actual call if it does not.  This allows to
remove all checks from the acpi_spmc_*_notif() functions, making the
code much more compact.

acpi_spmc_get_constraints() now checks whether
DSM_GET_DEVICE_CONSTRAINTS is supported in order to determine which DSM
to use and whether to call the function at all.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56879

acpi_spmc(4): softc: Move supported functions into a DSM info structure

This is in preparation to adding the revision as a probed information.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56880

acpi_spmc(4): Trivial simplification in detach function

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56881

acpi_spmc(4): Auto-detect DSM revisions by default

Which revisions to use for the Intel and AMD DSMs is unclear.  For the
Intel one, the written specification indicates only 0, but Linux uses
1 (possibly an oversight).  For the AMD one, for which there is no
specification, Linux uses 0, but at least on the Framework 13 AMD 7040
series, the "enumerate functions" function only returns a mask that
covers all the functions we expect when called with revision 2.

Introduce an auto-detection strategy where each revision starting from
0 is tried in turn up to some limit (included; default: 15).  As soon as
a revision implements all expected functions, we stop the loop and use
that one, in effect selecting the minimum revision that implements all
we need, which should avoid potential backwards-compatibility problems.
If no revision implements all expected functions, the highest available
revision in the checked range is selected, but higher revisions that do
not bring new functions are discarded (see the explanatory comment in
acpi_spmc_probe_dsm()).

The revision policy is still tunable using the same existing sysctl(8)
knobs 'debug.acpi.spmc.intel_dsm_revision' and
'debug.acpi.spmc.amd_dsm_revision'.  They have been extended so that
a negative value indicates to use the auto-detection mechanism up to
a revision of minus the value.  As before, a 0 or positive value
requests a specific revision.  A new knob is introduced for the
Microsoft DSM just in case ('debug.acpi.spmc.ms_dsm_revision').

Since now the revision can be auto-detected, and thus depends on
a particular device instance, move it into 'struct dsm_info' on the
softc.  This also enables finishing the split between static and
dynamic/tunable information, allowing to constify all the DSM
descriptors.

Print the revision eventually used along with the supported functions.

Tested on an Intel Framework laptop.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56882

acpi_spmc(4): If verbose, print called functions

...as a debugging aid, in order to be able to check that some functions
are effectively called and to identify them quickly if they cause
a hang.

Reviewed by:    obiwac
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56883

acpi_spmc(4): Update copyright

Sponsored by:   The FreeBSD Foundation

MFC after:    2 weeks
Sponsored by:   Chelsio Communications

Exception entry does not include an implicit, architectural data
barrier.

Reported by:    Ben Simner <ben.simner@cl.cam.ac.uk>
Reviewed by:    andrew
Fixes:          https://cgit.freebsd.org/src/commit/?id=5577bb2f67ff ("arm64/vmm: Support tlbi from VHE")
Differential Revision:  https://reviews.freebsd.org/D56855

This device is not yet supported.

Unfortunately some recently purchased UB400 dongles also contain this
Realtek IC.

Sponsored by:   The FreeBSD Foundation

chn_poll() may hold both rdch and wrch channel locks while calling
chn_trigger(rdch).  chn_trigger() switches the lock order from
"channel -> dsp dev" to "dsp dev -> channel" by temporarily dropping
the channel lock before acquiring the dsp lock.

However, only rdch was unlocked during the transition while wrch
remained locked. Since wrch is also a channel lock and witness had
already established the lock order requirement:

    dsp dev -> channel

witness reports a lock order reversal when pcm_lock() is acquired while
wrch is still held.

Avoid holding rdch and wrch simultaneously during chn_trigger()
lock-order switching by only keeping the channel locks when needed.

The issue can be reliably reproduced by starting pipewire,
pipewire-pulse, and pavucontrol.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57009

- Reject PROT_EXEC in all cases when Linux support is not compiled in.
- Define sysctl only when Linux support is compiled in.
- Document better.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    emaste
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/29

Eventually this hack will be removed, so start by disabling it by
default.

Sponsored by:   The FreeBSD Foundation
MFC after:      12 months
Reviewed by:    emaste
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/29

Adjust the rssi and nf arguments to typed int8_t and adjust the maths
for rssi to be consistant with what net80211 expects.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    lwhsu, adrian
Differential Revision: https://reviews.freebsd.org/D57020

This change modifies code paths and uses `__diagused` to address `-Wunused`
issues that occur when `THUNDERBOLT_DEBUG` == `0`.

MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D55575

Reported by:  bz

The header is not needed, and causes some issues with build because it
requires vnode_if.h generated due to transient dependency from vnode.h.

While there, remove unneeded explicit sys/cdefs.h and sys/param.h usage.

Reported and tested by:         thierry
Fixes:  https://cgit.freebsd.org/src/commit/?id=1d5e4020e36e ("vnode: add VIRF_KNOTE flag")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by: Minsoo Choo <minsoo@minsoo.io>
Differential Revision: https://reviews.freebsd.org/D56919

Yes this printf is for local debugging and not required at all on anything.

Pointed out by: andrew@

ip6_mroute: Fix the type name in sysctl_mfctable()

No functional change since apparently it's fine to compute the size of
a pointer type when the base type is undefined.

Fixes:  https://cgit.freebsd.org/src/commit/?id=0bb9c2b665d9 ("ip6_mroute: FIBify")

The result of IN6_ARE_MASKED_ADDR_EQUAL() macro is not an integer, so
threat it as a boolean value.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294114
Reported by:    Peter Much <pmc citylink dinoex sub org>
MFC after:      1 week

Delayed proxy addresses need special handling, since
they can use link-local ifa as their source address and
have different link-layer data in their response.

Fixes:          https://cgit.freebsd.org/src/commit/?id=f37fbe30f559
Reviewed by:    glebius, markj
Differential Revision: https://reviews.freebsd.org/D55850

This TF_-flag is only used in the RACK stack and not really needed.
So replace it, since glebius@ needs a TF_ flag and right now all
of them are taken.
No functional change intended.

Reviewed by:            rrs, glebius, rscheff, Nick Banks
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D56025

Fix nooptions VIMAGE build

The recent FIBify commits deref struct thread without including
sys/proc.h, which can result in a compiler error.  This becomes
apparent when building with LINT-NOVIMAGE, as net/vnet.h includes
sys/proc.h.  Fix this by directly including sys/proc.h

Fixes: https://cgit.freebsd.org/src/commit/?id=4c486fe40267 ("ip_mroute: FIBify"), https://cgit.freebsd.org/src/commit/?id=0bb9c2b665d9 ("ip6_mroute: FIBify")

To be more robust since the checking is now performed where the
interface is referenced.

While here, remove a redundant check from if_vmove_loan().

Reviewed by:    kp, glebius, pouria
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D55875

Recurring banners except the first are printed just after the latest
interval's statistics line, giving the false impression that the latter
are omitted.  It is also better to print a new banner only if it is
going to be followed by a new line of statistics, in case netstat(1) is
interrupted or we have reached the number of iterations specified by
'-q'.

Fix this by pushing printing these banners inside the loop producing
statistics lines, after having waited for the next interval.

The first banner is printed before the loop, as we want it to be printed
immediately at launch, even if at this point we do not have statistics
to display (we have to wait for an interval to compute these, as they
are based on a difference).

While here, remove the 'goto' spaghetti by putting banner printing into
its own private function and using a proper infinite loop in
sidewaysintpr().

While here, document the why of the 21 statistics line span between two
banners.

While here, check for the number of output lines of statistics once such
a line has effectively been printed.  This allows to remove the internal
incrementation performed when reading '-w''s argument, which was a hack
to compensate the misplaced check.

While here, in the manual page, simplify the description of the '-w'
mode and mention that passing 0 to '-q' means "no count limit".

Reviewed by:    glebius
Fixes:          https://cgit.freebsd.org/src/commit/?id=84c1edcbad7d ("Rewrite netstat/if.c to use ...")
Fixes:          https://cgit.freebsd.org/src/commit/?id=bf10ffe1d3a9 ("Add a new option, -q howmany, ...")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56227

This change adds the ability to examine the contents of multicast
routing tables for other FIBs without the need for executing
`netstat` with `setfib(1)`.

MFC after:      3 days
Sponsored by:   Klara, Inc.
Sponsored by:   Stormshield
Differential Revision:  https://reviews.freebsd.org/D56205
Reviewed by:    glebius, markj, zlei

Commit a223d6c489c7 made most of the ip6_mroute state per-VNET, but
failed to do this for a couple of counter structures.  Make them
per-VNET too.

Reported by:    zlei
Reviewed by:    pouria, zlei
Fixes:          https://cgit.freebsd.org/src/commit/?id=a223d6c489c7 ("ip6_mroute: Start putting global variables into a structure")
Differential Revision:  https://reviews.freebsd.org/D56253

While here remove ipi_lbgrouphashmask, as it is always has the same value
as ipi_porthashmask.

Differential Revision:  https://reviews.freebsd.org/D56174

While here, slightly restyle ip_vnet_init() and use sparse initializer for
pfil_head_args.  There is no functional change wrt to pfil(9) hook
registration.

Differential Revision:  https://reviews.freebsd.org/D56175

Functional change is that on destruction INVARIANTS checks will run.  Also
the mask is no longer hardcoded, so makes it easier to make hash size a
tunable.

Reviewed by:            ae
Differential Revision:  https://reviews.freebsd.org/D56176

Reviewed by:          tuexen, rrs
Differential Revision:  https://reviews.freebsd.org/D56177

Reviewed by:          kp
Differential Revision:  https://reviews.freebsd.org/D56113

inpcb: apply smr_advance(9)/smr_wait(9) trick only to reusable sockets

The protocols marked with PR_CONNREQUIRED can never go through pr_connect
after being disconnected.  This is a tiny improvement of fdb987bebddf0.

While here push clearing of the addresses under the same condition.
Although this clearing originates from pre-FreeBSD times, it actually
makes sense only for protocols that can reconnect.

Reviewed by:            pouria, markj
Differential Revision:  https://reviews.freebsd.org/D55661

inpcb: retire the inpcbinfo list lock

With the SMR locking of inpcbs the use of this lock reduced down to the
global list and generation number.  It was used only on an inpcb creation
and destruction.  Use the inpcbinfo hash lock for this purpose.

Reviewed by:            pouria, rrs, markj
Differential Revision:  https://reviews.freebsd.org/D55966

inpcb: retire the inpcb global list

The iteration over all pcbs is possible without the global list. The
newborn inpcbs are put on a global list of unconnected inpcbs, then after
connect(2) or bind(2) they move to respective hash slot list.

This adds a bit of complexity to inp_next(), but the storage scheme is
actually simplified.

One potential problem before this change was that a couple of pcbs fall
into the same hash slot and are linked A->B there, but they also sit next
to each other in the global list, linked as B->A.  This can deadlock of
course.  The problem was never observed in the wild, but I was able to
instrument it with lots of effort: just few pcbs in the system, hash size
reduced down to 2 and a lot of repetitive calls into two kinds of
iterators.

However the main motivation is not the above problem, but make a step
towards splitting the big hash lock into per-slot locks.

Differential Revision:  https://reviews.freebsd.org/D55967

inpcb: make in_pcbdisconnect() acquire the hash lock internally

Should be no functional change.

Reviewed by:            pouria, markj
Differential Revision:  https://reviews.freebsd.org/D55968

The INP_DROPPED is going to become an internal flag for inpcb.  As of now
it means a TCP pcb that is in TCPS_CLOSED.  There is nothing wrong with
calling setsockopt(2) on such socket, although has no practical use.

This deletes a piece of code from 56713d16a06c5 / D16201.  There is no
description of the panic fixed, but I will speculate that the panic was
about in6p->in6p_outputopts being NULL as the inpcb already went through
in_pcbfree_deferred().  This also can be related to compressed TIME-WAIT,
that is also gone now.

With current locking this shouldn't be possible.  An inpcb goes through
in_pcbfree() only with pr_detach method, which is called from sofree(),
and the latter is called on losing the very last socket reference.  So, at
the point when in_pcbfree() is called, the socket has lost its file
descriptor reference and there can not be any running setsockopt() on it.

Leave the call to ip6_pcbopt() still embraced with INP_WLOCK(), since we
are modifying inpcb contents.

NB: the IPv6 setsockopt(2) definitely has room for improvement.  Several
memory allocations should be moved out of lock and made M_WAITOK.
Covering large piece of setsockopt(2) code with epoch(9) just because
ip6_setpktopts() calls ifnet_byindex() isn't correct either.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56169

inpcb: make in_pcbbind() acquire the hash lock internally

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D55970

inpcb: make in_pcbconnect() acquire the hash lock internally

Reviewed by:            pouria, rrs, markj
Differential Revision:  https://reviews.freebsd.org/D55971

inpcb: make in6_pcbsetport() acquire the hash lock internally

Reviewed by:            pouria, rrs, markj
Differential Revision:  https://reviews.freebsd.org/D55972

Reviewed by:          pouria, rrs, markj
Differential Revision:  https://reviews.freebsd.org/D55973

No functional change.

The SOCK_RAW socket is a multiple receiver socket by its definition.  An
incoming packet may be copied to multiple sockets.  Thus, incoming packet
handling is expensive.  Systems with many thousands of raw sockets usually
have them connect(2)-ed to different destinations.  This allows for some
improvement of the input handling, which was introduced by 9ed324c9a588
back in 2008.  This optimization was made specifically for L2TP/PPTP VPN
concentrators based on ports/net/mpd5.

This change generalizes the idea of 9ed324c9a588, so that it potentially
can be used with IPv6 raw sockets.  This also eliminates last use of the
pcbinfo hash lock outside of in_pcb.c.

While here make a speculative design decision: put into the hash table
sockets that did only connect(2).  Previously, we were indexing only
sockets that were protocol bound, did bind(2) and did connect(2).  My
speculation is that only the remote IP provides some real entropy into the
hash and local address and proto are expected to be the same for majority
of the sockets.  My other speculation is that VPN concentrators other than
mpd5 may not bind(2) their sockets, thus not getting any use of the hash.

Differential Revision:  https://reviews.freebsd.org/D56172

vnet_if_return() will be invocked by vnet_sysuninit() on vnet destructing,
while the lock ifnet_detach_sxlock has been acquired in vnet_destroy()
already.

With this change the order of locking is more clear. There should be no
functional change.

Reviewed by:    pouria
Fixes:          https://cgit.freebsd.org/src/commit/?id=868bf82153e8 if: avoid interface destroy race
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56288

SIOCSIFVNET is not a hardware ioctl. Move it to where it belongs.

Where here, rewrite the logic of checking whether we are moving the
interface from and to the same vnet or not, since it is obviously not
stable to access the interface's vnet, given the current thread may
race with other threads those running if_vmove().

MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D55880

The change e133271fc1b5e introduced ifnet_detach_sxlock, and change
6d2a10d96fb5 widened its coverage, but there are still consumers,
net80211 and tuntap e.g., want it. Instead of sprinkling it everywhere,
make it opaque to consumers.

Out of tree drivers shall also benefit from this change.

Reviewed by:    kp
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56298

ifconfig: Add support for geneve (netlink)

This implementation is netlink only

Differential Revision: https://reviews.freebsd.org/D55184

ifconfig: Fix printf on geneve for 32-bit architectures

Replace uint64_t type with uintmax_t in printf to fix warnings
on 32-bit architectures.

Reported by:    Jenkins
Fixes:          https://cgit.freebsd.org/src/commit/?id=688e289ee904 ("ifconfig: Add support for geneve")
Differential Revision: https://reviews.freebsd.org/D55184

ifconfig: Do not build geneve with WITHOUT_NETLINK_SUPPORT

geneve(4) is netlink-only, therefore, don't build it with
WITHOUT_NETLINK_SUPPORT=1 set.

Reported by:    kp
Fixes:          https://cgit.freebsd.org/src/commit/?id=688e289ee904 ("ifconfig: Add support for geneve (netlink)")
Differential Revision: https://reviews.freebsd.org/D55184

Observed below kernel panic calltrace while performing sysctl -a
operation while unloading the if_bnxt driver,

Fatal trap 9: general protection fault while in kernel mode

KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02a7569940
vpanic() at vpanic+0x136/frame 0xfffffe02a7569a70
panic() at panic+0x43/frame 0xfffffe02a7569ad0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe02a7569af0
calltrap() at calltrap+0x8/frame 0xfffffe02a7569af0

trap 0x9, rip = 0xffffffff80c0b411, rsp = 0xfffffe02a7569bc0, rbp = 0xfffffe02a7569be0 ---
sysctl_handle_counter_u64() at sysctl_handle_counter_u64+0x61/frame 0xfffffe02a7569be0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02a7569c30
sysctl_root() at sysctl_root+0x22f/frame 0xfffffe02a7569cb0
userland_sysctl() at userland_sysctl+0x196/frame 0xfffffe02a7569d50
sys___sysctl() at sys___sysctl+0x65/frame 0xfffffe02a7569e00
amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe02a7569f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe02a7569f30

Root Cause:
iflib adds per-device sysctl nodes under the device tree using the device
sysctl context. Some of those nodes are counter sysctl that point at fields
inside txq→ift_br. When the if_bnxt driver is unloaded, iflib_device_deregister
runs and calls iflib_tx_structures_free, which frees the txqs ift_br. The device
sysctl tree is only freed when the device is destroyed. If sysctl -a runs during
unload, it can still traverse the device tree and call sysctl_handle_counter_u64
for those nodes. The handler does counter_u64_fetch(*(counter_u64_t *)arg1).
By then arg1 can point into freed memory and leads to use after free type kernel panic.

Fix:
flib now uses its own sysctl context for all iflib-related nodes
instead of using device’s context. And iflib sysctl context is now
removed before any queue/ring memory is freed.

MFC after:      2 weeks
Reviewed by:    gallatin, ssaxena, #iflib
Differential Revision: https://reviews.freebsd.org/D55981

When IFDI_ATTACH_POST() fails (or netmap attach fails), iflib tears down with
ether_ifdetach(), taskqueue_free(ifc_tq), and IFDI_DETACH(). CTX_LOCK is still
held after ether_ifattach. ether_ifdetach() and taskqueue_drain(admin) must not
run under CTX_LOCK.

Teardown ordering (match iflib_device_deregister):

- Free the per-interface admin taskqueue after IFDI_DETACH / IFDI_QUEUES_FREE, not before.
- Drop IFNET_WLOCK() across IFDI_DETACH / IFDI_QUEUES_FREE so driver detach can sleep in
LinuxKPI workqueue drain, then retake IFNET_WLOCK() before iflib_free_intr_mem and fail_unlock.

MFC after:      2 weeks
Reviewed by:    gallatin, kgalazka, #iflib
Differential Revision: https://reviews.freebsd.org/D56316

FIB_NH_LOG calls the `nhop_get_upper_family(nh)` to read
`nh->nh_priv->nh_upper_family` for failure logging.
Call FIB_NH_LOG before freeing nh so failures are logged
without causing a panic.

MFC after: 3 days

tcp_close: Use in6_pcbdisconnect for INET6 sockets

This also fixes the LINT-NOINET builds.

Fixes:          https://cgit.freebsd.org/src/commit/?id=40dbb06fa73c ("inpcb: retire INP_DROPPED and in_pcbdrop()")

inpcb: make in6_pcbdisconnect() just like in_pcbdisconnect()

Allow to be passed with already unconnected inpcb.

Fixes:  https://cgit.freebsd.org/src/commit/?id=4fadf2466468dd6dcb6cf9e3739ed696a18c1bb4

Only use hashes for protocols that are enabled in the kernel
configuration.

Fixes:          https://cgit.freebsd.org/src/commit/?id=ece716c5d347 ("raw ip: move hash table manipulation to inpcb layer")

lro: move pkt rejection checks to leafs to avoid queueing non-LRO'able pkts

When lro mbuf queuing is enabled, we should not queue easily
reject-able packets. Queuing them does a bit of extra work (sorting,
timestamps) and can potentially delay urgent packets such as LACP
PDUs. This change moves simple rejection tests from lro_rx_common()
into lro_rx and (more importantly) into tcp_lro_queue_mbuf().

Note this change only moves the easy checks on forwarding and packet
metadata, where the rejection criteria is already hot in cache. It
does not move parsing and looking inside the packet to verify the
ether protocol, ip protocol, etc. This could be done, but we risk
essentially doubling the cache misses per-packet by doing so.

Differential Revision: https://reviews.freebsd.org/D56337
Reviewed by: rrs, tuexen
Sponsored by: Netflix

tcp lro: fix vnet handling

Reported by:            Shawn Webb
Reviewed by:            glebius, rrs
Fixes:                  https://cgit.freebsd.org/src/commit/?id=f707cc00ed12 ("lro: move pkt rejection checks to leafs to avoid queueing")
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D56420

Make loopback packet drops more obvious by reporting them
in interface stats visable via netstat -ni
Since loopback uses netisr, packets can be dropped if the
netisr queue overflows.  These drops are visible via
netisr -Q, but its not an obvious place to look.

Differential Revision: https://reviews.freebsd.org/D56356
Reviewed by: glebius, tuexen
Sponsored by: Netflix

`ip_tryforward()` and `ip6_tryforward()` checks whether the destination
address is local or not without considering if it belongs to the current FIB.
If the destination is local but not in our FIB, forward it instead
of returning it to ip_input().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292319
Reviewed by:    zlei
MFC after:      1 week
MFC to:         stable/15
Differential Revision: https://reviews.freebsd.org/D56353

If a FIB does not have a router configured, X_ip_mforward() would leak a
lock.  Plug the leak.

The IPv6 counterpart did not have such a check.  It wouldn't send an
upcall to a non-existent router anyway due to the router_ver check, but
we should verify that a router is present anyway.

Add regression test cases to exercise these code paths.

Reported by:    Claude Opus 4.6
Fixes:          https://cgit.freebsd.org/src/commit/?id=0bb9c2b665d9 ("ip6_mroute: FIBify")
Sponsored by:   Klara, Inc.
Sponsored by:   Stormshield

On platforms other than amd64, BIOCSRTIMEOUT is equal to
BIOCSRTIMEOUT32. Therefore, running the COMPAT_FREEBSD32 code
basically clears tv_usec on big endian platforms. When tcpdump is
used, the timeout requested is 100ms, which gets cleared to 0 on
ppc64 platforms. This results in tcpdump showing the packets only
when the read buffer is full.
Thanks to kib for guiding me to the correct fix.

Reported by:            ivy
Reviewed by:            adrian, kib
MFC after:              3 days
Differential Revision:  https://reviews.freebsd.org/D56399

Implement RFC 4191 by handling received Router Adverisement (RA)
packets with route information option.
For default routes, use the route information's lifetime and
preference to overwrite the RA's lifetime/preference.
Also install and update more-specific route prefixes with the
option's lifetime and expire them when their lifetime elapses.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263982
Reviewed by:    markj
Tested by:      Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D55449

MFC after:    3 days
Reported by:    Claude Opus 4.6

Implement the criteria specified in RFC 6191 for recycling TCP
connections in TIME-WAIT.

Reviewed by:            rscheff, Marius Halden
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D56321

pf: fix error handling in pf_sourcelim_add()

There are two issues in pf_sourcelim_add() error path:
  - stale pointers are left in pf_sourcelim_id_tree_inactive when
    duplicate source limiter instance is found in pf_sourcelim_nm_tree

  - overload table may leak when insertion of new source limiter instance
    fails.

Both issues reported and patch submitted by:
    Renaud Allard <renaud () allard ! it>

OK sashan@

Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 32063577ec
Sponsored by:   Rubicon Communications, LLC ("Netgate")

pf: pf_frag_compare() should not be using subtraction to compare fragment IDs

Issues reported and patch submitted by:
    Renaud Allard <renaud () allard ! it>

OK sashan@

Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 747740863c
Sponsored by:   Rubicon Communications, LLC ("Netgate")

pf: use correct address family in pfr_pool_get()

pfr_pool_get() in call to pfr_prepare_network()must use af
instead of hardcoded AF_INET

Issues reported and patch submitted by:
    Renaud Allard <renaud () allard ! it>

OK sashan@

Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 8e156a5ebe
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Wiring a virtual address range may require the thread to sleep, and this
is not permitted in an epoch section.

MFC after:      1 week

If we are low on TX descriptors, bypass iflib_txq_can_reclaim()
and force a reclaim. This is intended to reduce the number of
output drops under heavy load when using simple transmit.

Differential Revision: https://reviews.freebsd.org/D56339
Sponsored by: Netflix

iflib: accurately count bytes/segments for TSO

When using software based ifnet counters, iflib has not factored
TSO into account when reporting the segments and bytes sent.
So it will underreport NIC bandwidth by a small percent,
and will undercount sent segments by a large factor.
Fix this by calculating the number of added segments the NIC
will send, and add header size multiplied by that number
to arrive at a correct accounting of segments and bytes sent.
This makes these software counters directly comparable to
hardware counters.

Doing this requires moving the calculation into iflib_encap() where
we have already parsed the packet and know the header size, MSS, etc.

Differential Revision: https://reviews.freebsd.org/D56338
Sponsored by: Netflix

iflib: fix book keeping

iflib_txq_drain() returns the number of consumed entries. In the case
of TSO, a single entry can contain multiple TCP packets.

Reported by:            Ricardo Branco, David Wolfskill
Reviewed by:            gallatin
Fixes:                  https://cgit.freebsd.org/src/commit/?id=3fade68cfdf9 ("iflib: accurately count bytes/segments for TSO")
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D56509

Replace the bare 7 with a named constant.

nd6: Break nd6_prefix_update out of prelist_update

if PI exists, call prefix_update, instead of doing it inside
the prelist_update.
no functional change intended.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56130

nd6: Break pfxrtr_add out of nd6_prelist_add

Updating defrouter only required by `prelist_update()`.
since `nd6_prelist_add()` is a public function, exclude unsed
dr logic from it.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56131

nd6: Change prelist_update return type to void

The return value of `prelist_update()` is unused.

Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D56132

nd6: Ignore entire PI if violates RFC 4862 section 5.5.3

Ignore prefix information update earlier in `prelist_update()`.
If PI is invalid or autonomous bit is unset, we better to let our
SLAAC address expire and if we don't have any previous matching
prefix, better not to create new one.
Because either our router don't want us to have one anymore, or
the very RA is malicious.

Reviewed by: ae
Differential Revision: https://reviews.freebsd.org/D56133

nd6: Remove anycast check in prelist_update

RFC 2462 is obsoleted by RFC 4862 and it made statements more
clear than before.
Considering SLAAC can't create anycast addresses by itself, remove
its check.
While here, update comments based on RFC 4862.

Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D56134

nd6: Break nd6_prefix_lifetime_update out of prelist_update

Logic of updating prefix lifetime is big enough that deserves
its own function.
While here, fix style.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56135

nd6: Remove goto and unused condition in prelist_update

While here, style it.

Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D56136

Add the struct for VHT information and flags for the known and flag
field as documented on radiotap.org.  iwlwifi has started filling in
these details.

While here, add Copyright information for all the additions in the
last years.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

V_rt_numfibs can be set at compile time (with the ROUTETABLES kernel
config option) or boot time (with the net.fibs tunable).
vnet_rtables_init(), running during SI_PROTO_DOMAIN, was checking the
tunable and updating V_rt_numfibs accordingly, but that means that
earlier SYSINITs, such as vnet_mroute_init(), see the compile-time value
for V_rt_numfibs before it gets corrected in vnet_rtables_init().

Fix this by initializing V_rt_numfibs earlier, so that SYSINITs are less
likely to use the wrong value.

Add a comment describing the weird, preexisting semantic of resetting
rt_numfibs to 1 in VNET jails.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294510
Reviewed by:    glebius, zlei, pouria
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56473

ENOTCAPABLE is for capsicum and its use here is inappropriate.  In
particular, note that syscallret() treats this value specially.

Reviewed by:    glebius, pouria, zlei
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56481

When TCP_REQUEST_TRK is enabled, the tcb grows by 600 bytes
to accommodate the t_tcpreq_info[MAX_TCP_TRK_REQ] array.
Even when the option is enabled, not every connection is using
this feature.  So let's allocate it on-demand, and save 600
bytes in the common case.

Sponsored by: Netflix
Reviewed by: rrs, tuexen
Differential Revision: https://reviews.freebsd.org/D56484

If we take an early goto out_unlocked inp is uninitialized and then
may be used in SCTP_LTRACE_ERR_RET().  Initialize inp to NULL
to avoid warnings.

Found with:     gcc15 tinderbox build
MFC after:      3 days
Reviewed by:    tuexen, pouria
Differential Revision: https://reviews.freebsd.org/D56503

pf assumes that interface names are unique (and share a namespace with
interface group names).
Unfortunately the FreeBSD network stack has a few edge cases where this
assumption can be violated. Try to be more robust against this: rather
than changing the association between a kif and ifp just ignore the next
interface with the same name.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

pf_udp_mapping_insert() may lock more than one row at a time.

Fixes:          https://cgit.freebsd.org/src/commit/?id=cd5ff4e841fb ("pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes")
Reviewed by:    kp
Differential Revision:  https://reviews.freebsd.org/D56501

Signed-off-by:        Peter Ganzhorn <peter.ganzhorn@gmail.com>
Reviewed by:    zlei
Fixes:          https://cgit.freebsd.org/src/commit/?id=6d49b41ee84b iflib: Add pfil hooks
MFC after:      3 days
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2150

This ensures that child processes are reaped in the outer loop in
main().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294035
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=66b107e82b2f ("ctld: Use kevent(2) for socket events rather than select(2)")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56525

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293076
Reported by:    Ken J. Thomson <thomsonk@yandex.com>
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=969876fcee57 ("ctld: parse config file independently of getting kernel info")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D55767

This results in slightly less duplicated code.

Reviewed by:    asomers
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56526

With securelevel set (for pf that means >= 3) we're expected to reject
rule changes. However, we allowed interface flags to be changed, which
would allow 'set skip on X' to be changed.

Remove DIOCSETIFFLAG and DIOCCLRIFFLAG from the securelevel whitelist.

MFC after:      1 week
Reported by:    cyberkittens
Sponsored by:   Rubicon Communications, LLC ("Netgate")

pf: only allow a subset of netlink calls when securelevel is set

Extend the genl_cmd struct to allow calls to also carry a securelevel.
If that's set compare the current securelevel to only allow the call if
the level is lower than that.

If no value is specified continue to allow calls in any securelevel,
as before.

This allows us to easily implement the same securelevel restrictions for
pf as we have for the corresponding ioctls.

Reviewed by:    glebius
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D56390

netlink: fix LINT-NOVIMAGE build

Include the required header for securelevel_ge()

Fixes:          https://cgit.freebsd.org/src/commit/?id=9933bdcb1264 ("pf: only allow a subset of netlink calls when securelevel is set")
Sponsored by:   Rubicon Communications, LLC ("Netgate")

Once we hand an mbuf over to netisr_queue() we may no longer access it.
Save the length before the call so we can use it to increment counters
afterwards.

Fixes:          https://cgit.freebsd.org/src/commit/?id=956acdce0505 ("loopback: Account for packet drops")
Sponsored by:   Rubicon Communications, LLC ("Netgate")

We are searching through the hash that has only wildcard bindings.
This was missed by fdb987bebddf05e15a5af840379c7715a94aec1c.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56488

After commit 9b76228006d8, tcp_hptsi() dereferences inp_socket in order
to get the inpcb's VNET.  This means that mock inpcbs created by the
HPTS test fixture must set inp_socket.  Also set the current VNET there;
previously, it was NULL, and this was not noticed since VNET_DEBUG is
disabled even in debug kernels.

Fixes:  https://cgit.freebsd.org/src/commit/?id=9b76228006d8 ("inpcb: retire inp_vnet")

We should look at the table name for automatic tables as well. These
are different tables, so the rules using them are (or can be) different
as well.

MFC after:      3 days
Reported by:    Michael Sinatra <michael@burnttofu.net>
Sponsored by:   Rubicon Communications, LLC ("Netgate")

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293076
Reviewed by:    asomers
Fixes:          https://cgit.freebsd.org/src/commit/?id=969876fcee57 ("ctld: parse config file independently of getting kernel info")
Differential Revision:  https://reviews.freebsd.org/D56523

The default implementation of is_dummy should return false.  Only
portal group ports should possibly return true.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293076
Reported by:    Ken J. Thomson <thomsonk@yandex.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=6acc7afa34aa ("ctld: Convert struct port to a hierarchy of C++ classes")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56524

This ensures it will be destroyed (removing the associated pidfile)
anytime the process exits, including from exit(3) calls.  This fixes
a few places that would "leak" the pidfile on certain errors.

This also removes the need for some convoluted logic where
configuration objects would hand-off ownership of the pidfile handle
from the old configuration to the new configuration.

Reviewed by:    asomers
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56527

pf_route() and pf_route6() forward broadcast and multicast traffic
when a route-to rule matches, without any check against the output
interface's broadcast domain. This is a deliberate property of the
route option code path, but it is not documented and the workaround
is non-obvious.

Document the behavior in pf.conf(5) with example block-out rules on
the target interface, scoped with the received-on qualifier so that
only forwarded traffic is dropped while the router's own broadcast
and multicast traffic continues to pass.

Add regression tests covering the full broadcast/multicast and
forwarded/local matrix on both IPv4 and IPv6.

Reviewed by:    glebius, kp
Approved by:    kp (mentor)
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D56559

Case-insensitive TargetName matching on logins was accidentally removed,
let's fix that by normalizing TargetName again according to RFC 3722.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294522
Fixes:                  https://cgit.freebsd.org/src/commit/?id=4b1aac931465f39c5c26bfa1d5539a428d340f20
Sponsored by:           ConnectWise
MFC after:              1 week
Reviewed by:            asomers, jhb
Approved by:            asomers (mentor)
Differential Revision:  https://reviews.freebsd.org/D56469

Reported by:  KMSAN
MFC after:      1 week

Make it more obvious that this field is not used.
No functional change.

Event:  Wiesbaden Hackathon 202604

The rationality is that the driver private data holds a strong reference
to the interface, and the detach operation shall never fail. Given the
vmove operation, if_vmove_loan(), if_vmove_reclaim() or vnet_if_return()
is not atomic and spans multiple steps, acquire ifnet_detach_sxlock only
for if_detach_internal() and if_vmove() is not sufficient. It is possible
that the thread running if_detach() sees stale vnet, or the vmoving is
in progress, then if_unlink_ifnet() will fail.

Fix that by extending coverage of ifnet_detach_sxlock a bit to also
cover if_unlink_ifnet(), so that the entire detach and vmove operation
is serialized.

Given it is an error when the if_unlink_ifnet() fails, and if_detach()
is a public KPI, prefer panic() over assertion on failure, to indicate
explicitly that bad thing happens. That shall also prevent potential
corrupted status of the interface, which is a bit hard to diagnose.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292993
Reviewed by:    glebius
MFC after:      5 days
Differential Revision:  https://reviews.freebsd.org/D56374

Add SIOCGIFCAP ioctl-command for tun/tap character device to be used
by bhyve for offloading in the future.
Add SIOCSIFCAP for symmetry.

Reviewed by:            markj, pouria, tuexen
MFC after:              1 week
Event:                  Wiesbaden Hackathon 2026
Differential Revision:  https://reviews.freebsd.org/D51289

When a KTEST_EQUAL assertion fails, the test function returns, but this
can cause it to leak locks, which can trigger a panic under witness.
Add a variant which causes control flow to jump to a label in case of
failure, and use that to prevent this problem.

Reviewed by:    Nick Banks <nickbanks@netflix.com>, tuexen
MFC after:      1 weeks
Differential Revision:  https://reviews.freebsd.org/D56647

When processing an ASCONF chunk we failed to verify that the chunk
length was at least 8 bytes. As a result we might end up passing a
negative length to pf_multihome_scan(). Fortunately this merely meant
the function did nothing, but we should discard such invalid packets, so
explicitly check for this.

MFC after:      1 week
Reported by:    Mark Johnston
Sponsored by:   Orange Business Services

The current and historical versions of ctld would flag our initial set
of kernel ports as dummies, because their portal groups were empty since
portals come from the configuration on-disk.

As a result, we would never try to remove a kernel port at startup that
didn't exist in the configuration (possibly a feature if you wanted
concurrent ctld(8)), and we would always try to port->kernel_add() on
ports in the configuration (even if they actually did have an existing
kernel port).

Flag these portal groups as kernel groups so that we avoid trying to add
ports that already exist.  It may be the case that the kernel_remove()
loop in conf::apply() needs to do something other than the current
`oldport->is_dummy()` to avoid removing ports that it isn't supposed to
be managing, but that wuld also seem to apply to LUNs that would be
removed today.

Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D51782

As per RFC5061 "4.2.  New Parameter Types" the add/delete IP address
parameters (0xc001, 0xc002) may not be present in an INIT or INIT-ACK
chunk. They are only allowed to be present in an ASCONF chunk.

This also prevents unbounded recursion while parsing an SCTP packet.

Approved by:    so
Security:       FreeBSD-SA-26:14.pf
Security:       CVE-2026-7164
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294799
Reported by:    Igor Gabriel Sousa e Souza
Sponsored by:   Orange Business Services

The 'hash' subword doesn't bring any additional information.  All inpcb
lookup functions operate on hashes.

For lookup functions that work on either exact hash or wild hash just
perform s/hash_//.  Rename in_pcblookup_hash() into
in_pcblookup_with_lock(), emphasizing its difference to
in_pcblookup_smr().  Rename in_pcblookup_hash_locked() to
in_pcblookup_internal(), as it doesn't return a locked inpcb and is used
only for internal purposes.  Note that the IPv6 sibling of this function
already lives by name in6_pcblookup_internal().  Some future changes will
make such naming more justified.

No functional change.

Reviewed by:            pouria, markj
Differential Revision:  https://reviews.freebsd.org/D56482

Understand zero size as instruction to not allocate the hash.  Do not
allocate both hashes for rawip(4).  There are no functional changes to TCP
or UDP.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56705

Fix stack overflow by passing in_aliasreq instead of ifr
during netlink dump.

Fixes:  https://cgit.freebsd.org/src/commit/?id=e1e18cc12e68 ("if_gre: Add netlink support with tests")

Routing subsystem allows creating new multipath routes by
nexthop groups (e.g RTA_MULTIPATH in netlink), in case of
a second nexthop group on the same route, don't panic and
merge the existing nhgrp with new one.

Reviewed by: melifaro (except one comment)
Differential Revision: https://reviews.freebsd.org/D56187

Before this patch, netlink never returned RTA_MULTIPATH.
Also, add RTA_MULTIPATH attribute in way that don't confuse
non-mpath support consumers.

Differential Revision: https://reviews.freebsd.org/D56188

Fix route expiration of nhops that exists inside a nhgrp.

Differential Revision: https://reviews.freebsd.org/D56189

krb5: import MIT 1.22.2

Merge commit '90c687295e2d62f9411fc5b571f5af4e8ee187a7'

krb5: Adjust version to 1.22.2

Fixes:          https://cgit.freebsd.org/src/commit/?id=736e411a737b

krb5: Adjust additional version strings

Fixes:          https://cgit.freebsd.org/src/commit/?id=736e411a737b

Bring in upstream commit 2e75f0d93 fixing two CVEs. Upstream commit
log is:

 In parse_nego_message(), check the result of the second call to
 vector_base() before dereferencing it.  In parse_message(), check for
 a short header_len to prevent an integer underflow when calculating
 the remaining message length.

 Reported by Cem Onat Karagun.

 CVE-2026-40355:

 In MIT krb5 release 1.18 and later, if an application calls
 gss_accept_sec_context() on a system with a NegoEx mechanism
 registered in /etc/gss/mech, an unauthenticated remote attacker can
 trigger a null pointer dereference, causing the process to terminate.

 CVE-2026-40356:

 In MIT krb5 release 1.18 and later, if an application calls
 gss_accept_sec_context() on a system with a NegoEx mechanism
 registered in /etc/gss/mech, an unauthenticated remote attacker can
 trigger a read overrun of up to 52 bytes, possibly causing the process
 to terminate.  Exfiltration of the bytes read does not appear
 possible.

SCTP states should always have a src scrub object associated with them.
Crafted pfsync packets might not have this, leading to us derferencing a
NULL pointer on cleanup.

Validate the pfsync state insertion packet to make sure this is correct.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294989
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

We insert rules in pf_krule_global solely for the benefit of the
'keepcounters' feature. Failing to insert (beause the rule hash
collides, or an identical rule already exists) would be worse than
restoring counts to the wrong rule (or failing to restore them at all).

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282863, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294860, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294859, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294858
MFC after:      3 days
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D56745

Running sys/net tests in parallel reveals some panics which look like
the one below:

```
shared lock of (sx) vlan_sx @ /home/markj/sb/main/src/sys/net/if_vlan.c:2395
while exclusively locked from /home/markj/sb/main/src/sys/net/if_vlan.c:1850
panic: excl->share
cpuid = 9
time = 1776467219
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00d84e0780
vpanic() at vpanic+0x136/frame 0xfffffe00d84e08b0
panic() at panic+0x43/frame 0xfffffe00d84e0910
witness_checkorder() at witness_checkorder+0xdb1/frame 0xfffffe00d84e0ad0
_sx_slock_int() at _sx_slock_int+0x64/frame 0xfffffe00d84e0b10
vlan_ioctl() at vlan_ioctl+0x25c/frame 0xfffffe00d84e0b70
if_setflag() at if_setflag+0xdc/frame 0xfffffe00d84e0be0
ifpromisc() at ifpromisc+0x27/frame 0xfffffe00d84e0c00
vlan_setflags() at vlan_setflags+0x64/frame 0xfffffe00d84e0c30
vlan_unconfig_locked() at vlan_unconfig_locked+0xb7/frame 0xfffffe00d84e0c70
vlan_clone_destroy() at vlan_clone_destroy+0x5d/frame 0xfffffe00d84e0cb0
if_clone_destroyif_flags() at if_clone_destroyif_flags+0x8c/frame 0xfffffe00d84e0cf0
if_clone_detach() at if_clone_detach+0x106/frame 0xfffffe00d84e0d20
vnet_destroy() at vnet_destroy+0x154/frame 0xfffffe00d84e0d50
prison_deref() at prison_deref+0xaf5/frame 0xfffffe00d84e0dc0
sys_jail_remove() at sys_jail_remove+0x1a7/frame 0xfffffe00d84e0e00
amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe00d84e0f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d84e0f30
--- syscall (508, FreeBSD ELF64, jail_remove), rip = 0x25bd44705ca, rsp = 0x25bcfe72ab8, rbp = 0x25bcfe72b40 ---
```

All vlan interfaces are locked by a single recursive global lock.  There
are cases, like in the panic above where vlans are stacked on top of
each other, where the driver tries to acquire an exclusive lock while
holding a shared lock, and vice versa.

With longer-term goals of making the networking regression test suites
stable when run in parallel, and simplifying network control plane
locking, which I find is quite complex and buggy, let's change if_vlan
to use the exclusive lock everywhere.

Reviewed by:    pouria, zlei, kp, glebius
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56778

Set the ifp variable as soon as soft_c becomes available
so that interface statistics can be incremented.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295129
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Fixes:          https://cgit.freebsd.org/src/commit/?id=e44d2e941e8e ("if_geneve: Add Support for Geneve ...")

These are two single-pair Ethernet (SPE) variants that run at 10 Mbps.
10BASE-T1S has automotive origins and supports multiple nodes on up to
25m of cable.  10BASE-T1L is intended for building and industrial
automation and supports long-distance point to point links of over 1km.

Reviewed by:    kbowling
Differential Revision: https://reviews.freebsd.org/D56952

* do not require just only ip6 proto for flow-id opcode in ipfw(8).
  ipv6-icmp, tcp, udp should be fine too.
* fix off-by-one bug leading to out-of-bounds read.
* apply IPV6_FLOWLABEL_MASK before comparison in flow6id_match(),
  so flow-id opcode will match a specified flow label. No need to
  take protocol version and traffic class into account.
* add the test to verify that opcode is working correctly.

Reviewed by:    pouria
Obtained from:  Yandex LLC
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56869

When we have multiple aggregators, the link state should reflect the
state of the active aggregator.

This change was prompted by a script pruning 10GbE interfaces from an
lacp bundle with 100GbE interfaces. Mixing speeds like this creates multiple
aggregators.  When the last 10GbE interface was removed, lagg0 would loose
link because the current aggregator's port count would drop to 0, even
though the 100GbE aggregator had active ports. This left the system in a
hard to diagnose state where lagg0 reported "active", but all outgoing
IP traffic was dropped, due to the RT_LINK_IS_UP() check noticing lagg0's
if_link_state was marked as down.

Reviewed by: zlei
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D56579

Address leaks that I missed in commit f7bf9fd6199c
("tests/tcp_hpts_test: Fix resource leaks").

Reviewed by:    Nick Banks <nickbanks@netflix.com>, tuexen
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56943

vxlan_input()'s caller is supposed to free *m0 if it is non-NULL after
the function returns.  vxlan_input() failed to update *m0 after the
pullup however, so if it hits an error case after the pullup, we'll free
the mbuf twice.  Currently this can happen only if the interface is
brought down or due to a packet loop.

Reported by:    Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai
Reviewed by:    pouria, zlei
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56944

Check for alloction failure on `npt_alloc()` for RTA_MULTIPATH
attributes in `nlattr_get_multipath()`.
Also, add tests for maximum number of rtnexthop in rtnetlink.

Reported by:    Joshua Rogers of AISLE Research Team
Reviewed by:    markj
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D56954

Fix length validation of RTA_MULTIPATH attributes in
nlattr_get_multipath() by making sure the user request is align.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295102
Reported by:    Robert Morris <rtm@lcs.mit.edu>
Reviewed by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=7e5bf68495cc ("netlink: add netlink support")
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D56963

A bug fix was committed locally and submitted upstream.  Document it in
our upgrade instructions, as these sometimes take a long time before
getting merged.

Sponsored by:   The FreeBSD Foundation

Sponsored by: The FreeBSD Foundation
Reviewed by:    jlduran
Differential Revision: https://reviews.freebsd.org/D57053

Fixes: https://cgit.freebsd.org/src/commit/?id=2574974648c6 ("OpenSSH: Update to 10.3p1")
Sponsored by:   The FreeBSD Foundation

tcp: Make RFC 6191 support configurable

Add a default-on per-VIMAGE sysctl for RFC 6191 connection recycling.
This makes it possible to merge the change to older branches where it
can be switched off by default to minimize risk.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   Modirum MDPay
Reviewed by:    pouria, marius.h_lden.org, tuexen
Differential Revision:  https://reviews.freebsd.org/D57045

tcp: Fix typo in RFC 6191 sysctl

Fixes:          https://cgit.freebsd.org/src/commit/?id=2af70d7a3849 ("tcp: Make RFC 6191 support configurable")
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   Modirum MDPay

MFC after:    1 week

Reviewed by: zlei, markj
Differential Revision: https://reviews.freebsd.org/D56202

It's a bit silly to have iov_to_buf() and buf_to_iov() return a ssize_t
to begin with, just to be able to return -1 for error. Change this to
size_t and use 0 as an error indicator, which won't require any changes
to the code using these functions.

While here, switch iov_to_buf() to use reallocf() instead of realloc().

Reviewed by: jhb
Fixes: https://cgit.freebsd.org/src/commit/?id=2a514d377b37 ("bhyve/virtio-scsi: Preallocate all I/O requests")
Differential Revision: https://reviews.freebsd.org/D55800

When a specially formatted path is passed to dlopen(), of the form
  #number/path
and the number is the valid dirfd file descriptor listed in the
LD_LIBRARY_FDS, interpret it as a relative path name against dirfd
number.

This complements the result returned from dladdr() for such objects
in dli_fname.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56152

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:   https://reviews.freebsd.org/D56152

tunefs: Don't lower WARNS

Use casts to silence the alignment warnings instead of potentially
suppressing other legitimate warnings.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56033

tunefs: Fix alignment warning on arm64

MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=c5e79c7e93dd ("tunefs: Don't lower WARNS")
Reviewed by:    bakul
Differential Revision:  https://reviews.freebsd.org/D56229

MFC after:    1 week
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D56034

tunefs: Better fix for arm64 alignment issues

Rather than trust that the compiler will lay out the stack frame the
way we expect it to, use a union to force the correct alignment.

MFC after:      1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=616f47f176c3 ("tunefs: Fix alignment warning on arm64")
Reviewed by:    kevans, mckusick
Differential Revision:  https://reviews.freebsd.org/D56245

tunefs: Fix pointer arithmetic

While here, remove a bogus const which has been there for years.

MFC after:      1 week
Reported by:    ivy@
Fixes:          https://cgit.freebsd.org/src/commit/?id=1b83e8a3f840 ("Constify string pointers.")
Fixes:          https://cgit.freebsd.org/src/commit/?id=8244dd326265 ("tunefs: Better fix for arm64 alignment issues")
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D56343

This allows something like the following local.lua to install a filter
to implement its own notion of hidden BEs using a naming convention of
a leading dot to hide them:

-- file: /boot/lua/local.lua
local core = require("core")

local function be_hide(be)
    if core.isSingleUserBoot() then
        -- All BEs are accepted for single-user
        return true
    end

    local name = be:match("/([^/]+)$")
    if not name then
        -- Accept malformed BEs, for whatever reason
        return true
    end

    return name:match("^%.") == nil
end

if core.bootenvFilter then
    -- Just in case we need to be compatible with older versions of
    -- core.lua without the filtering functionality.
    core.bootenvFilter(be_hide)
end
-- EOF

Requested by:   Marek Zarychta
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55359

arm64: Add arm64 SVE tests

Add the tests/sys/arch directory for architecture-specific tests and
use it to add arm64 SVE tests. These test the kernel is managing the
SVE state in a way we expect.

These tests require SVE hardware support to run so will skip when they
can't detect it.

Reviewed by:    markj
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D43311

test/sys/arch: Fix arch without test/sys/arch/${MACHINE_ARCH}

Fixes:          https://cgit.freebsd.org/src/commit/?id=0ddaa4c86d68 ("arm64: Add arm64 SVE tests")
Sponsored by:   The FreeBSD Foundation

download.freebsd.org is backed by project mirrors and a CDN, which
should benefit most users.

Sponsored by:   The FreeBSD Foundation
Reviewed by:    delphij (releng)
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D54849

In case the user did input, we should put newline
on screen to avoid possible error messages to get
mixed with user input.

Because panic() does provide mechanism to have architecture specific
panic call, we can instruct it to print out stack trace too
(in hope we actually can print). While there, also implement simple
check to detect loop in trace.

illumos issue: https://www.illumos.org/issues/17887

This allows safe_set to be leveraged in other contexts
where additional chars like '*' or '!' or even '\[\]' need to
be preserved in the result.

hccontrol LE_Set_Advertising_Data does not currently allow construction
of manufacturer-specific type 0xFF AdvData.  Fixed by a new data-entry
option -b "b1,b2,b3,...,bn" where b's are 8-bit byte strings (octets).

Signed-off-by: F. Duncanh <fduncanh@gmail.com>
Reviewed by: takawata, pouria
Pull Request: https://github.com/freebsd/freebsd-src/pull/2082

Both (U)EFI and BIOS are completely different things, be precise and don't use
them together.

Reviewed by:    imp
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56329

Improve mfi_pd_inq_string() by
* Reusing buffer sizes from cam/cam.h according to SCSI specification + NULL byte
* Don't truncate vendor-specific information by escaping into a too small buffer
* Use cam_strvis() from libcam instead of old, outdated local copy
* Recaculate size of inq_string based on the reused buffer sizes and
  format statements

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294354
Reviewed by:    imp
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56328

This is the small internal doc fix from https://reviews.freebsd.org/D46313

Reviewed by:    michaelo
Approved by:    (blanket; comment fix)
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D55325

rather than on VID/PID. Later is not reliable for some types.
VID/PID identification can be restored by specifying of -p option.

Tested by:      arrowd, wulf
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290639
MFC after:      1 week

MFC after:    3 days

NETWORKING is the documented placeholder, while
/etc/rc.d/NETWORKING still provides the legacy alias
NETWORK.

The NETWORKING script was originally introduced to avoid
conflicts with NetBSD's lowercase network script on
case-insensitive file systems.  The NETWORK alias was
retained for compatibility with older scripts.

Following the discussion in PR 293652, remove the legacy
NETWORK alias from 16-CURRENT.  Keeping both names adds
more confusion than value now that NETWORKING is the
documented placeholder and current base system and ports
tree uses are already clean.

Add an UPDATING entry to note that local RC scripts using
REQUIRE: NETWORK should be migrated to REQUIRE: NETWORKING.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293652
Reviewed by:    michaelo, jlduran
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56300

When zpool status -x reports errors, the output only shows basic error
counts without identifying which files are affected. Replace the
unconditional echo of the brief status with verbose output (zpool
status -v) in the error path so administrators can see exactly which
files have been damaged.

The healthy/no-pools path still shows the brief status.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=223243
Signed-off-by: Po Han Chen <hypery11@gmail.com>
Reviewed by: imp, jlduran, asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2089

Extend pmcstat -R output to include the raw TSC for each decoded record
and print tsc_freq from the initialize record so TSC deltas can be
converted to elapsed time.

Update the pmcstat documentation to describe the decoded output and the
architecture-specific TSC behavior.

Sponsored by: AMD
Signed-off-by: Andre Silva <andasilv@amd.com>
Reviewed by: imp, mhorne, Ali Mashtizadeh
Pull Request: https://github.com/freebsd/freebsd-src/pull/2085

The -t option gives the user the ability to create a control device for
a given virtual_oss(8) instance, so that the instance's configuration
can be manipulated during runtime with virtual_oss_cmd(8). As is
expected, the control device's name is not known, since it is specified
by the user.

This patch introduces a virtual_oss_default_control_device rc variable,
which defaults to "vdsp.ctl". The goal of this is that third-party
programs and scripts can access the control device of the default
virtual_oss(8) configuration without guessing. This is especially useful
for sbin/devd/snd.conf which deals with hot-swapping sound devices using
virtual_oss(8).

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55670

Currently it is only needed by powerpc ofwfdt.c, and defined statically
there. Make it available as part of libofw, mirroring what we have in
the kernel.

Two small tweaks are made to the implementation:
  1. Return type is changed to bool
  2. Return 'true' when OF_getproplen() == 0. This matches the expected
     semantics of the kernel version, described in OF_hasprop(9).

Reviewed by:    manu, imp, adrian
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D56429

RFC 4191 section 3.1: if the received route's lifetime
is zero, the route is removed from the Routing Table if present.
Also, do not tell route information option is unknown.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263982
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D55448

i messed up when we added support for names on these things. the
id and names are each supposed to be unique, which is checked by
putting the one limiter into an rb tree based on their id and another
based on their name. unfortunately i used the same RBT_ENTRY fields
for both trees, which meant using both trees on the same limiter
corrupted the topology, which goes badly when you want to use
multiple limiters.

found by, tested, and ok dgl@ (who is not me, this is not a typo)
ok jmatthew@

Obtained from:  OpenBSD, dlg <dlg@openbsd.org>, f951d642cc
Sponsored by:   Rubicon Communications, LLC ("Netgate")

bi_load itself loads various things into the staging area which can
cause it to grow, which may result in the staging area moving, including
the kernel. Therefore the address we get for the kernel entry point
prior to bi_load may not be correct afterwards when we actually call it,
and so we must defer the translation.

On arm and riscv (but not arm64, which predates both of them in
loader.efi and did not gain a copy of arm's added printf when arm
support was added) we also printf this entry point to the console, which
we can no longer do since bi_load calls ExitBootServices, so remove this
printf that, in practice, seems to not be so useful, given nobody ever
felt the need to add it to arm64. If anyone really feels this is an
important printf to have then bi_load will need to be split so we can
call printf after all the loading and potential reallocation of the
staging area, but before ExitBootServices is called.

We may also want to make this code more uniform and shared between the
three architectures here, since there isn't much architecture-specific
about this (and something like the RISC-V boot hart protocol could
easily be made an MD hook).

Reviewed by:    imp
Fixes:          https://cgit.freebsd.org/src/commit/?id=0cafabf97fae ("Add support for arm64 to loader.efi and boot1.efi")
Fixes:          https://cgit.freebsd.org/src/commit/?id=ea7796a9ae6b ("EFI: don't call printf after ExitBootServices, since it uses Boot Services")
Fixes:          https://cgit.freebsd.org/src/commit/?id=2192efc03bc4 ("RISC-V boot1.efi and loader.efi support")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56431

Since this original comment was written, the actual issue in SLOF
was diagnosed and documented in commit 424089a0fc, which fixed it
for loader(8).  Update the comment in boot1 to be more informative
to future readers.

MFC after:      3 days
Reviewed by:    jhibbits, adrian
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56470

ping6 needs IPV6_RECVPKTINFO and IPV6_RECVHOPLIMIT to process
incoming replies. When these options fail, replies are silently
dropped and ping6 appears to hang. Use err(3) instead of warn(3)
so the user gets a clear error and immediate exit.

Signed-off-by: Christos Longros <chris.longros@gmail.com>

Reviewed by:    pouria, jlduran, glebius
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56237

reloc_ptr() skips relocations for the kernel module, because on most
platforms the kernel is ET_EXEC and this is not required.  On PPC,
the kernel is ET_DYN and we need to relocate here, otherwise the
module metadata will not be loaded properly and the kernel module
will have an incorrect version, preventing module dependencies from
resolving.

This fixes loading kernel modules from loader.conf on powerpc.

Diagnosed by:   jrtc27
Reviewed by:    jrtc27, adrian
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56457

The -d option was indented with spaces instead of tabs, and this broke
formatting.

Before:

-d                Enable debugging of rc.d scripts
-j              Perform actions within the named jail

After:

-d              Enable debugging of rc.d scripts
-j              Perform actions within the named jail

MFC after:      1 week

The `pfctl -S` flag was added to disable DNS resolution in
<https://reviews.freebsd.org/D50724> but documentation and error
messages refer to a `pfctl -N` flag for the same purpose. The `pfctl -N`
flag performs an unrelated function, so the docs and error messages need
to be changed. Caught this when revising documentation for the `-N`
flag.

Reviewed by:    kp
Signed-off-by:  Ross Williams <ross@ross-williams.net>

After we found some preloaded z_initfirst object, we must process till
the end of the preload list still, not stopping on the first found
object.

Reported by:    des
Reviewed by:    des, markj, siderop1@netapp.com
Fixes:  https://cgit.freebsd.org/src/commit/?id=78aaab9f1cf359f3b7325e4369653f6b50593393
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56466

Initialize nla_geneve_link structure to zero to prevent
segfault when a TLV is not received by the netlink parser.

Reported by:    Seth Hoffert <seth.hoffert@gmail.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=688e289ee904 ("ifconfig: Add support for geneve (netlink)")

Also treate ':' at the start of a line as for '#'
ie. a comment.

Treat '#' as a comment anywhere,
but ':' only at start of line.

rather than with read() to alleviate concerns about partial reads.

Use "read -r" to set the root password in "bsdinstall rootpass" to
prevent issues with passwords containing one or more backslash
characters.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294781
Discussed with: tuexen, crest
Approved by:    khorben
MFC after:      3 days
Event:          Wiesbaden Hackathon 202604

mixer(8): Deprecate some unintuitive control values

This is a follow-up to cc7479d7dc9b ("mixer(8): Improve mute and recsrc
controls"). These deprecated values will be completely removed on
2026-06-15.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    0mp
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/21

mixer(8) tests: Remove tests for deprecated control values

Fixes:          https://cgit.freebsd.org/src/commit/?id=a28bb575c89c ("mixer(8): Deprecate some unintuitive control values")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  emaste
Sponsored by:   The FreeBSD Foundation

Manually tuning ZFS for systems with <8GB ram hasn't been necessary at
least since the switch to OpenZFS. We have users reporting using 1GB RAM
with no manual tuning/issues. Further, the page this links to is a stale
wiki page, which is causing complaints. Remove this misleading note and
replace it with a similar message for UFS. While here, reword that note
to be a bit clearer.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=287719
MFC after:              3 days
Differential Revision:  https://reviews.freebsd.org/D50971

Also rework a bit the way device path are displayed for consistency.

Signed-off-by:  stephane.rochoy@stormshield.eu
Reviewed by:    imp
Sponsored by:   Stormshield
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2167

Log via syslog when snprintf truncates the crontab path, instead of
silently skipping the entry.

Signed-off-by:  Christos Longros <chris.longros@gmail.com>
Reviewed by:    bcr, kevans
Differential Revision:  https://reviews.freebsd.org/D56235

dhclient: Check for unexpected characters in some DHCP server options

Some options are written directly to the lease file, which may be parsed
by subsequent dhclient invocations.  We must make sure that a malicious
server can't control the "medium" field of a lease definition, otherwise
they can achieve RCE by injecting one into the lease file, whereupon it
will be passed to dhclient-script, which passes it through eval.

Approved by:    so
Security:       FreeBSD-SA-26:12.dhclient
Security:       CVE-2026-42511
Reported by:    Joshua Rogers of AISLE Research Team (https://aisle.com/)

dhclient: Improve server and filename validation

* Don't iterate over each string three times; once is enough.

* Reject control characters (anything below space) in addition to the
  double quote and backslash.

* If an unsafe character is encountered, discard the string instead of
  rejecting the entire lease.

* If backslashes are encountered in the file name option, convert them
  to forward slashes instead of rejecting the option.

* Tweak the warning messages a bit.  Looking through the rest of the
  code, it seems to me that notes generally end with a period while
  warnings generally don't.

Fixes:          https://cgit.freebsd.org/src/commit/?id=8008e4b88daf ("dhclient: Check for unexpected characters in some DHCP server options")
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294886
MFC after:      1 week
Reviewed by:    brooks, markj
Differential Revision:  https://reviews.freebsd.org/D56740

When the number of DHCP options exceeds a threshold, script_set_env()
will reallocate the environment, stored as an array of pointers.  The
calculation of the array size failed to multiply by the pointer size,
resulting in a smaller than expected buffer which admits out-of-bounds
writes.

Approved by:    so
Security:       FreeBSD-SA-26:15.dhclient
Security:       CVE-2026-42511
Reported by:    Joshua Rogers of AISLE Research Team (https://aisle.com/)

Encode filenames in the VIS_CSTYLE | VIS_OCTAL style regardless of
output mode.  When reading filenames from a checksum file, attempt to
decode them, and use the decoded name unless the decoded name does not
exist but the undecoded one does.

This breaks compatibility with GNU coreutils, which unfortunately uses
a non-reversible encoding when outputting filenames containing
non-printable characters.

While here, drop a sentence about preimage attacks against MD5 and SHA1
from the manual page, as I no longer trust it to be true.

MFC after:      1 week
Reviewed by:    bcr, markj
Differential Revision:  https://reviews.freebsd.org/D56615

For some reason, we've incorrectly calculated the size of the CRB data buffer
register. There's no need to divide the CRB data buffer size by 4. We should
allow access to the whole buffer instead.

Reviewed by:            markj
MFC after:              1 week
Sponsored by:           Beckhoff Automation GmbH & Co. KG
Pull Request:           https://github.com/freebsd/freebsd-src/pull/2169

Due to misplacement of the second -L argument of diff command, it is
treated by getopt_long as an error.

Also add -l option for a diff command that alters the way it shows
differences. Instead of printing full diff, it reports changed file
the same way as added/removed files are reported.

Reviewed by:    imp
Obtained from:  Yandex LLC
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56708

Kernel timestamps are relative to kern.boottime.
With -t, kern.boottime is added and converted to either
a default format or the one specified using the -f option.

Signed-off-by:  Andre Albsmeier <mail@ghub.e4m.org>
Reviewed by:    kib, pouria
Discussed with: imp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/1985

Add an example for allowing members of the network group to read from
bpf devices. In particular, this allows members of the network group
to monitor traffic without running with root privileges.

Reviewed by:            markj, glebius
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D56742

Get the next hops of the specified route.
route.8 manual will be updated when other actions for
this option are implemented.

Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D56191

ping: use CLOCK_REALTIME for ICMP Originate Timestamp

RFC 792 defines the ICMP Originate Timestamp field as milliseconds
since midnight UTC.  However, ping(8) currently derives this value
from CLOCK_MONOTONIC, which represents time since an unspecified
starting point and is not related to UTC.

The issue was introduced by commit 1ad76f1b6047, which replaced
gettimeofday(2) with clock_gettime(CLOCK_MONOTONIC) for timekeeping
in ping(8).

Fix this by using CLOCK_REALTIME when generating the ICMP originate
timestamp.

Before:

$ ping -Mt -c1 127.0.0.1
ICMP_TSTAMP
PING 127.0.0.1 (127.0.0.1): 56 data bytes
<...> time=0.061 ms tso=16:50:31 tsr=17:38:28 tst=17:38:28

(note the tso is off)

After:

$ ping -Mt -c1 127.0.0.1
ICMP_TSTAMP
PING 127.0.0.1 (127.0.0.1): 56 data bytes
<...> time=0.038 ms tso=17:42:09 tsr=17:42:09 tst=17:42:09

Reviewed by:            asomers, glebius
Fixes:                  https://cgit.freebsd.org/src/commit/?id=1ad76f1b6047
MFC after:              1 month
Differential Revision:  https://reviews.freebsd.org/D56759

tests/ping: Fix date(1) invocations

Fixes:  https://cgit.freebsd.org/src/commit/?id=069681afd58a ("ping: use CLOCK_REALTIME for ICMP Originate Timestamp")

The FreeBSD-base bits are accessible via pkg.FreeBSD.org, even for
releases, so there is no need to point at pkgbase.FreeBSD.org.

MFC after:      3 days

This is useful for testing alternative service managers
without modifying /etc/rc

MFC After:      1 weeks
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56828

Ever since certctl was rewritten in C, the rehash command has reingested
TRUSTDESTDIR / UNTRUSTDESTDIR in addition to TRUSTPATH / UNTRUSTPATH.
This seemed like a good idea at the time but was, in retrospect, a
mistake, as it means a (un)trusted certificate remains (un)trusted
forever (or at least until it expires) even if it is removed from
(UN)TRUSTPATH.  Among other issues, it causes ports QA to fail for any
port that either installs certificates or depends on a port that does.

Although this behavior was undocumented, the change may surprise users
who have added certificates manually, so update the manual page to point
it out and add prominent warnings to the trust and untrust commands.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290078
MFC after:      1 week
Reviewed by:    kevans, bcr
Differential Revision:  https://reviews.freebsd.org/D56617

Previously, devmatch would stop at the first linker.hints file
found in kern.module_path. This meant modules installed in
/boot/modules/ were invisible to devmatch if /boot/kernel/
contained a linker.hints file (which it always does).

Merge hints from all directories in kern.module_path.
This allows third-party or out-of-tree kernel modules in
/boot/modules/ to be auto-loaded by devmatch just like
built-in modules.

Reviewed by:            imp
Differential Revivion:  https://reviews.freebsd.org/D56847

If anyone would build bhyve with -DNDEBUG, any code in the expression
in assert() won't be executed.  Instead put the return value in a
temporary variable to assert that it has the expected value.

Reviewed by: emaste, markj (earlier version)
Fixes: https://cgit.freebsd.org/src/commit/?id=2a514d377b37 ("bhyve/virtio-scsi: Preallocate all I/O requests")
Differential Revision: https://reviews.freebsd.org/D55803

Currently rtadvd ignores interface pltime/vltime specifications
unless the (static) address range is also included in the config file.
This extends the validity of a pltime and/or vltime stanza in
the config file for an interface to delegated addresses from
an upstream provider.

Signed-off-by:  tickerguy <karl@denninger.net>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288426
Reviewed by:    pouria
Pull Request:   https://github.com/freebsd/freebsd-src/pull/1863

This fixes a regression introduced in cae280931c9e which prevents
user_data as a shell script to be used

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295062
Reported by:    Ross McKelvie <ross@exitzero.uk>
MFC After:      1 day

Ensure the script used is invalid when parsed by libyaml which
highlight the issue revealed in PR295062

while at here validate the mode of the file is properly changed

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295062
MFC After:      1 day

The jail(8) command must not leave parsed configuration files open
since the file descriptors will be leaked to child processes
including the untrusted exec.start or exec.stop hooks.

While fopen() doesn't provide direct access to O_CLOEXEC, it does
provide access to FD_CLOEXEC via "e" in the mode string which
provides the desired defense in depth against leaking file descriptors
into exec.* hooks since those always execve() into a shell.

Jail configuration is potentially sensitive and some hooks execute from
within the jail context, leaving some opening for the jail to exfiltrate
information about the host environment.

(Commit message wordsmithed by kevans)

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295052
Reviewed by:    kevans
MFC after:      3 days

This protects against accidentally leaking them past fork()+exec()
in future refactorings.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295052
Reviewed by:    kevans

Avoid dependency on INET (IPv4) by using PF_LOCAL,
allowing media check to work on systems without INET support.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295045
Reviewed by:    kevans
MFC after:      1 week

The FreeBSD network stack, for better or worse, does not impose any
requirements on interface names. As such it's valid for an interface
name to start with a number (or indeed, be something like '⭐').

Allow this in pfctl, and add a test case for the specific case of
interface names starting with a number.

Note that we don't support UTF-8 names fully, so those may still fail.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295064
MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

When fsck_msdosfs runs with FAT32 cache mode (used for large
filesystems that cannot be mmap'd), a detected FAT header correction
was written into the in-memory buffer but the corresponding cache
entry (fat32_cache_allentries[0]) was never marked dirty.  As a
result, fat_flush_fat32_cache_entry() skipped it, the corrected
bytes were never written to disk, and copyfat() propagated the
uncorrected on-disk data to all backup FAT copies.  Every subsequent
fsck run would repeat the same "FAT starts with odd byte sequence /
FIXED" cycle indefinitely.

Fix by marking fat32_cache_allentries[0].dirty = true after applying
the in-memory correction, ensuring the chunk is flushed before
copyfat() runs.

Obtained from:  https://android-review.googlesource.com/c/platform/external/fsck_msdos/+/4047981
MFC after:      3 days

This is only used by rc.subr and belongs in rc, not runtime.

Fixes:          https://cgit.freebsd.org/src/commit/?id=fa6d67cd16b5 ("BSD.root.dist: Add package tag for all directories")
MFC after:      3 days
Reviewed by:    ivy
Differential Revision:  https://reviews.freebsd.org/D56900

Reviewed by:  imp, kib
Differential Revision:  https://reviews.freebsd.org/D56908

nuageinit: add decode_base64 tests

nuageinit: add addsudo tests

nuageinit: add adddoas tests

nuageinit: add update_sshd_config tests

- Add shell_escape() helper to safely escape shell arguments
- Apply shell_escape to all user-controlled values in shell commands:
  adduser (usershow, useradd, lock, primary_group, groups)
  addgroup (groupshow, groupadd, members)
  exec_change_password (usermod)
  settimezone (tzsetup root and timezone)
  install_package (pkg package names)
- Escape double quotes in hostname when writing rc.conf.d/hostname
- Add missing 'local' declaration for resolvconf_command in nameservers()
- Escape interface name in resolvconf -a command
- Change open_resolvconf_conf() from 'w' to 'a' mode to prevent
  data loss when nameservers() is called multiple times
- Clean up stale resolvconf.conf at the start of each boot
  (skip on postnet to preserve config written by first call)

MFC After: 1 day

"bsdinstall script" will now do a pkgbase installation by default.  The
system components to install can be specified in the COMPONENTS
variable, and have the same names as those used in the interactive
installer.  bsdinstall will still do a legacy distset installation if
DISTRIBUTIONS is defined in the installerconfig file.

MFC:            1 week
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290375
Sponsored by:   ConnectWise
Reviewed by:    ziaee, ivy, jduran
Differential Revision: https://reviews.freebsd.org/D56717

This is needed at least for MAX() and PATH_MAX.

MFC after:      1 week

Required for MAXPATHLEN and MAXLOGNAME.

MFC after:      1 week

MFC after:    1 week

- gjournal.c needs param.h to get a definition of isclr().
- fsck.h needs signal.h for sig_atomic_t.

Sort includes while here.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56858

Make the behaviour similar for both IPv4 and IPv6. Also add
the corresponding tests.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294733
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56618

For Realtek we only add new entries.

For Intel the old way of extracting IDs from the driver no longer
works.  The new list is shortened as we drop more specific entries
which were already covered by wildcard entries.  The new lists are
also sorted within the groups.
There are 4 entries the new driver no longer carries but are still
present in older versions, so we keep them manually.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

We already run `certctl rehash` at the end, there is no point in asking
users upgrading from 15.0 to 15.1 to manually merge the trust store.

MFC after:      3 days
Reviewed by:    cperciva
Differential Revision:  https://reviews.freebsd.org/D57028

Starting from the existing fmax{,f,l} functions I've added the fmaximum
family, which handles NaN according to the newest standard (propagating
it).

This commit is a PoC for GSoC 2026.

Reviewed by:    fuz, kargl
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D55834

Reported and tested by:       fluffy
Reviewed by:    emaste
Fixes:  https://cgit.freebsd.org/src/commit/?id=3a01e1e1a50cb9a9594aac2148dc920a6b295428
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56283

We've compiled it since the LLVM 13 import in 2021, but for some reason
never exported it.  A user of CheriBSD recently caused Morello LLVM to
emit a reference to it so finish the job and export it.

Reviewed by:    dim, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=6e75b2fbf9a0 ("Merge llvm-project release/13.x llvmorg-13.0.0-rc1-97-g23ba3732246a")
MFC after:      1 week
Sponsored by:   DARPA, AFRL
See also:       https://github.com/CTSRD-CHERI/cheribsd/issues/2614
Differential Revision:  https://reviews.freebsd.org/D56310

The 'simplification' commit referenced below actually broke one aspect
of MFD_HUGETLB: the caller isn't supposed to be required to specify a
size.  MFD_HUGETLB by itself without a shift mask just requests a large
page, so we revert that part of memfd_create() back.

While we're here, fix up the related parts of the manpages a little bit,
since MFD_HUGETLB is actually supported.  The manpage claims that we
would return ENOSYS if forced mappings weren't supported, but this was
actually not true.  However, that seems like a very important
distinction to make between ENOSYS and EOPNOTSUPP, so fix the
implementation to match the docs.

Fixes:  https://cgit.freebsd.org/src/commit/?id=8b8cf4ece660f ("memfd_create: simplify HUGETLB support [...]")
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56114

Added support for the f{maximum,minimum}_{mag,num} families, the new
C23 standard functions for maximum magnitude and number-preferring
maximum.  This includes modifying fmax.3, on top of D56230, to
recommend the use of fmaximum_num and fminimum_num.

Reviewed by:    fuz, kargl
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D56236

Reviewed by:  imp
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56362

libarchive 3.8.7

Important bugfixes:
 #2871 libarchive: fix handling of option failures
 #2897 iso9660: fix undefined behavior
 #2898 RAR: fix LZSS window size mismatch after PPMd block
 #2900 CAB: fix NULL pointer dereference during skip
 #2911 libarchive: do not continue with truncated numbers
 #2919 CAB: Fix Heap OOB Write in CAB LZX decoder
 #2934 iso9660: fix posibble heap buffer overflow on 32-bit systems
 #2939 cpio: Fix -R memory leak
 #2947 libarchive: lzop and grzip filter support

Important bugfixes between 3.8.5 and 3.8.6:
 #2860 bsdunzip: fix ISO week year and Gregorian year confusion
 #2864 7zip: ix SEGV in check_7zip_header_in_sfx via ELF offset validation
 #2875 7zip: fix out-of-bounds access on ELF 64-bit header
 #2877 RAR5 reader: fix infinite loop in rar5 decompression
 #2878 mtree reader: Fix file descriptor leak in mtree parser cleanup
       (CWE-775)
 #2892 RAR5 reader: fix potential memory leak
 #2893 RAR5: fix SIGSEGV when archive_read_support_format_rar5 is called
       twice
 #2895 CAB reader: fix memory leak on repeated calls to
       archive_read_support_format_cab

Obtained from:  libarchive
Vendor commit:  ded82291ab41d5e355831b96b0e1ff49e24d8939
MFC after:      1 week

Fix all pointer-sign warnings generated when compiling libifconfig.

One of these warnings comes from the misuse of snl_add_msg_attr_string
for a byte array.  Though userland treats carpr_key as a string, it is
actually an array of bytes.  Handle it as such in libifconfig.

While here, fix a small consistency nit in ifconfig_sfp_get_sfp_dump.

Signed-off-by: Ryan Moeller <rmoeller.dev@gmail.com>
Reviewed by: imp, zlei
Pull Request: https://github.com/freebsd/freebsd-src/pull/1850

When processing the return data from these calls pass the limiter
pointer, not the limiter pointer pointer.

Sponsored by:   Rubicon Communications, LLC ("Netgate")

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294577
MFC after:      1 week
Reviewed by:    mm
Differential Revision:  https://reviews.freebsd.org/D56468

No functional change intended.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

vm_vcpu_open() really should check the value returned from malloc() and
return NULL on failure. Also, all users of vm_vcpu_open() need to check
the returned value for NULL, too.

Reviewed by:    corvink, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56346

Prior to the change 4f809ffec69c, the sizes are formated by
humanize_number(3) with the flag HN_DECIMAL, which displays the result
using one decimal place when it is less than 10. That is more accurate
and useful. Add equivalent field modifier hn-decimal to xo_emit() to
restore the previous behavior.

Reported by:    Mark Millard
Reviewed by:    js
Fixes:          https://cgit.freebsd.org/src/commit/?id=4f809ffec69c gpart: add libxo support for "show" subcommand + man page updates
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56514

The maximum and minimum functions, as well as nextafter and nexttoward,
were using manual NaN checks instead of the isnan() macro.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294692
Reviewed by:    fuz, kargl
MFC after:      1 month

Makes the code easier to understand.

MFC after:      1 week

This is because contrib/llvm-project/llvm/lib/Support/Unix/Threading.inc
attempts to use pthread_get_name_np(3) and pthread_set_name_np(3), which
are not defined on Linux.

Reported by:    ivy
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292067
MFC after:      1 month

When using outline atomics on arm64 the compiler will create a call to
a function that performs the atomic operation. This allows us to use
the fastest operation depending on the hardware.

As these functions are implemented in libgcc create a linker script
so libraries that link against libgcc_s will include libgcc to pull
them in.

Reviewed by:    imp, jhb
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D45268

Various calls in the implementation can clobber errno; preserve it for
the caller since none of these will bubble up pass/fail to simplify
some future error handling in ctld.

Reviewed by:    jhb
Differential Revision:  https://reviews.freebsd.org/D56539

bridge(4) doesn't support BRDGGIFVLANSET for span members, which
means if a span interface is configured, libifconfig will fail to
fetch bridge members.  Skip this for IFBIF_SPAN members.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292634
MFC after:      3 days
Reported by:    Emrion <kmachine@free.fr>
Reviewed by:    pouria, zlei
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56694

The previous implementation used FD_SET() on a stack-allocated fd_set,
which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE
(1024).

Approved by:    so
Security:       FreeBSD-SA-26:16.libnv
Security:       CVE-2026-39457
Reported by:    Joshua Rogers of AISLE Research Team (https://aisle.com/)
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56689

Annex K specifies an interface for handling constraint violations from
gets_s, but we previously broke this for some classes of get_s misuse.

Provide a more nuanced version that tries to dodge errors that would
trigger a constraint handler while still providing value.  Notably, we
don't want to trigger a failure unless the passed-in length reasonably
fits within an RSIZE_MAX, because gets_s will immediately call larger
lengths bogus and fail.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294881
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56734

The getgroups test is a NetBSD tests, so just apply our larger hammer
and disable the feature entirely.  The audit test can take a more
surgical approach and use __ssp_real() appropriately, since it's a local
one.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294881
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56735

Fixes:                https://cgit.freebsd.org/src/commit/?id=770cf0a5f02d ("Fixups after llvm-project main llvmorg-21-init-19288-gface93e724f4 merge")
MFC after:      1 month

Added the fmaximum_mag_num{,f,l} and fminimum_mag_num{,f,l} functions.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294719
Reviewed by:    fuz, kargl
MFC after:      1 month

Replaced the old pattern of using a ternary to force addition
(raising exceptions for sNaN's) with a new one using a volatile
variable. The _mag_num family was already implemented with this pattern

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294719
Reviewed by:    fuz, kargl
MFC after:      1 month

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56365

MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation

Reviewed by:    lwhsu, markj
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D51736

The return value of posix_spawn_file_actions_init() is an error number.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56911

Sponsored by: The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56365

From the PR:
The attached diff implements the inverse square root function, i.e,
rsqrt(x) = 1 / sqrt(x).  Exhaustive testing of the float version
suggests that it is correctly rounded in round-to-nearest for all
test values in the range [0x1p-127,0x1p126].
Exhaustive testing of rsqrt and rsqrtl cannot be done, but 1100M
values of x for rsqrt and 400M values for rsqrtl were tested.  All
tested values were correctly rounded.

I do not have access to LD128 (i.e., IEEE 128-bit floating point)
hardware, so the implementation of rsqrtl() is untested.

The following is a summary of changes to source code.

* lib/msun/Makefile:
  . Add s_rsqrt.c and s_rsqrtf.c to COMMON_SRCS.
  . For non-53-bit long double targets, add s_rsqrtl.c to COMMON_SRCS.
  . Add MLINKS for rsqrt.3, rsqrtf.3, and rsqrtl.3 to sqrt.3.

* lib/msun/Symbol.map:
  . Add rsqrt, rsqrtf, and rsqrtl to the Symbol map for shared libm.so.

* lib/msun/man/sqrt.3:
  . Update the sqrt.3 manual page to include information for rsqrt[fl].
  . Note, these function come from ISO C23 (and IEEE-754 2008).

* lib/msun/src/math.h:
  . Add prototypes for new functions.

* lib/msun/src/math_private.h:
  . Add _SPLIT, _FAST2SUM, _SLOW2SUM, _XADD, _MUL, and _XMUL
    macros to perform type-type arthimetic (i.e., float-float).

* src/s_rsqrt.c:
  . New file with the implementation of 'double rsqrt(double)'.
  . For 53-bit long double targets, add a weak reference for rsqrtl.

* src/s_rsqrtf.c:
  . New file with the implementation of 'float rsqrt(float)'.

* src/s_rsqrtl.c
  . New file with the implementation of 'long double rsqrt(long double)'.
    Note, the LD80 version uses bit twiddling and LD128 version is a
    straight C language implementation.  The LD128 is untested due to
    lack of hardware.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295089
MFC after:      1 week

Required for MAXPATHLEN.

MFC after:      1 week

MAXBSIZE is defined in param.h, which defines many other things.  To
avoid forcing all consumers of libufs.h to include param.h, let's
instead redefine it and verify the definition in inode.c.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56859

Fixes:                https://cgit.freebsd.org/src/commit/?id=b60053fde172 ("libcasper: Fix inconsistent error codes of cap_get{addr,name}info()")

If the old limit had family/hosts/sockaddr set, the new limit must
have them too. Before, a missing key in the new limit was treated as
"allow any", which let a caller silently extend their limits.

Reported by:    Joshua Rogers of AISLE Research Team
Reviewed by:    markj
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D56991

* cd9660_rrip_slink() did not check that the lengths of individual
  entries do not exceed the length of the overall record.

* cd9660_rrip_altname() did not check that the length of the record
  was at least 5 before subtracting 5 from it.

Note that in both cases, a better solution would be to check the length
of the data before calling the handler, or immediately upon entry of
the handler, but this would require significant refactoring.

MFC after:      1 week
Reported by:    Calif.io in collaboration with Claude and Anthropic Research
Reported by:    Adam Crosser, Praetorian
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56215

Compiling a LINT-NOIP kernel (assumingly also a NOINET) port and ip
are set but not used in nfsrv_getclientipaddr().

Hide the variables behind #ifdef checks and do likewise for the parsing
results.  Admittingly the code probably wants to be rewritten one day.

Found with:     gcc15 tinderbox build
MFC after:      3 days
Reviewed by:    rmacklem
Differential Revision: https://reviews.freebsd.org/D56502

Under conditions of low memory, getblk can fail.  fusefs was not
handling those failures very systematically.  It was always using
PCATCH, which appears to have been originally copy/pasted from the NFS
client code, but isn't always appropriate:

* During fuse_vnode_setsize_immediate, which can be called from many
  different VOPs and from the vn_delayed_setsize mechanism, remove
  PCATCH.  Some of these callers cannot tolerate allocate failure.

* In fuse_inval_buf_range, don't assume that getblk will always succeed.

* When calling fuse_inval_buf_range from VOP_ALLOCATE,
  VOP_COPY_FILE_RANGE, or VOP_WRITE (with IO_DIRECT), return EINTR if
  the allocation fails.

* When calling fuse_inval_buf_range from VOP_DEALLOCATE, remove PCATCH.
  This VOP must not fail with EINTR.

No new tests, because I can't force any particular getblk call to fail.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293957
Sponsored by:   ConnectWise
Reported by:    zjk7@wp.pl
MFC after:      1 week

The only use for callbacks for NFSv4.0 is delegations
and delegations rarely work well for NFSv4.0 anyhow.

Therefore, this patch disables callbacks for the
NFSv4.0 client.  This is the same behavior as
occurred when the nfscbd(8) daemon was not running.

This change allowed a function called nfscl_getmyip()
to be removed from the kernel, which is nice since
maintaining this function was bothersome, due to its
use of routing, etc.

MFC after:      2 weeks

When the nfsd was vnet'd, the VNET macros were hidden
behind macros that had the NFSD_ prefix on them.
This was done because, at the time, it was thought
that something other than vnet might be used for this.
That has not happened and probably will not happen,
so this patch replaces these obscuring macros with
the regular vnet ones.

There should be no semantics change caused by
this commit.

Discussed with: bz, glebius
MFC after:      1 month

There is no point to do it.  The VNON type is good enough for fdescfs
operations, and changing the type on stat(2) is arbitrary and does not
serve much purpose, because we recalculate the returned file type on
each stat(2) anyway.

But setting the type to VLNK has undesired consequence of namei()
trying VOP_READLINK() there, which might fail since it defer the
calculation of path to vn_fullpath().

Submitted by:   Mike <mmpestorich@gmail.com>
PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294768
MFC after:      2 weeks

Commit 71ac1ec5c9d9 disabled callbacks for the NFS
client for NFSv4.0.  This patch does the same for
the NFSv4.0 server.

The only use for callbacks for NFSv4.0 is delegations
and delegations rarely work well for NFSv4.0 anyhow.

Therefore, this patch disables callbacks for the
NFSv4.0 server.  This is the same behavior as
occurs when vfs.nfsd.issue_delegations is 0.

This change allowed the functions called
nfsrv_getclientipaddr() and nfsrv_getipnumber() to be
removed from the kernel.

MFC after:      2 weeks

The client tells the server how many callback slots
it can handle in the callback session.  However, the
NFSv4.1/4.2 server can only handle a maximum of
NFSV4_SLOTS slots.  This patch clips the client's
value to that, to avoid using too high a slot#
for a callback.

Fortunately, I do not know of an extant client that
specifies a value greater than NFSV4_SLOTS, so this
patch is not really needed, as yet.  Also, the client
rarely uses a slot# above 0 when doing callbacks.

MFC after:      2 weeks

In ncl_getcookie(), a very large value for "off" for
a directory can result in "pos" being set to a bogus
value (including a negative one), due to truncation.
When "pos" is negative, is can skip past the
while (pos >= NFSNUMCOOKIES) loop and return a
bogus pointer instead of NULL.

This patch changes the type to u_int and also adds
a sanity check for a very large "off" to ensure that
a NULL pointer is returned for this case.

This bug has been in the code for decades and I am
not aware of any report of it causing a problem for
users.

Reviewed by:    markj
Reported by:    Joshua Rogers of AISLE Research Team
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D56779

This is needed for various pjdfstest tests which fail with syntax errors
if pathconf _PC_NAME_MAX/_PC_PATH_MAX return -1. For NAME_MAX we can use
the 9P2000.L Tstatfs call to get namelen from the host. While this could
theoretically be different for nested filesystems in the shared mount it
is a much better guess than just returning 255.
There does not seem to be a way to get the host PATH_MAX, so we just
return the conservative kernel default.

Found while fixing https://github.com/CTSRD-CHERI/cheribsd/issues/2617.

Reviewed by:    markj, kib
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D56493

When a file is created via p9fs with restrictive permissions (like 000),
the 9P TCREATE request successfully creates and natively opens the file,
returning an open, writable file descriptor. Previously, p9fs would
attempt a subsequent TOPEN. That TOPEN would fail with EACCES due to the
restrictive mode, leaving a 0-byte file and causing operations like 'mv'
to abort.

We now preserve the writable descriptor returned by TCREATE so that the
subsequent VOP_OPEN can use it directly, avoiding the failing TOPEN.
Additionally, p9fs_compatible_mode now appropriately isolates the base
access intent when matching fids, preventing extended flags from
breaking the match.

A test case for this behavior has been submitted to pjdfstest:
https://github.com/pjd/pjdfstest/pull/87

Resolves: https://github.com/CTSRD-CHERI/cheribsd/issues/2617

Reviewed by:    markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D56494

ufs: support unmapped bufs for indirect blocks in bmap

Use unmapped bufs for indirect block buffers in bmap, and use sf_bufs
for transient mapping them when we need to read the specific pointer.

[kib note: I changed the original patch to use sf_buf instead of
explicit DMAP utilization, making the change MI].

Tested by:      pho
Reviewed by:    kib
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D53424

ufs: ufs_bmap_seekdata() needs mapped buffer for scan

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295348
Reported and tested by:  Alastair Hogge <agh@riseup.net>
Reviewed by:    mckusick
Fixes:  https://cgit.freebsd.org/src/commit/?id=bab04ddf1fd4 ("ufs: support unmapped bufs for indirect blocks in bmap")
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57036

This causes recursion in VFS that is not worth handling.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275570
Reported by:    Alex S <iwtcex@gmail.com>
Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57043

The new PRIV_VMM_CREATE and DESTROY permissions should be allowed by
jails, so need to be added to the list in prison_priv_check().  Then,
modify vmmdev_create() to verify that the jail was created with the
allow.vmm flag.  This is already verified when opening /dev/vmmctl, but
checking again doesn't hurt and ensures that one can't pass the
allow.vmm policy by passing a vmmctl fd along a unix domain socket from
outside the jail.

Rename vmm_priv_check() to vmm_jail_priv_check() to make the function's
purpose more clear.

Reported by:    novel
Reviewed by:    bnovkov
Fixes:          https://cgit.freebsd.org/src/commit/?id=d4c05edd410e ("vmm: Add privilege checks to vmmctl operations")
Differential Revision:  https://reviews.freebsd.org/D56119

For instance, this is used by DRM drivers to declare the EDID property
of an GPU output connector:

    sysctl -b sys.device.drmn1.card0.card0-DP-1.edid | edid-decode

    ...
    Block 0, Base EDID:
      EDID Structure Version & Revision: 1.4
      Vendor & Product Identification:
        Manufacturer: SAM
        Model: 29814
        Serial Number: 810635354 (0x3051505a)
        Made in: week 15 of 2025
    ...

Reviewed by:    bz, emaste, wulf
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55176

After reading both manual pages, our TCP_MAXUNACKTIME is fairly
similar to the TCP_USER_TIMEOUT, the only considerable difference
is ours is in seconds and linux's in milliseconds.

Round up linux's in setsockopt(2) to a next whole second and
clamp ours getter to UINT_MAX ms.

Reviewed by:    tuexen, glebius
Differential Revision: https://reviews.freebsd.org/D56168
MFC after:      2 weeks
Sponsored by:   Sippy Software, Inc.

kqueue: compare against the size in kqueue_expand

This is a cosmetic change, rather than a functional one: comparing the
knlistsize against the fd requires a little bit of mental gymnastics to
confirm that this is fine and not doing unnecessary work in some cases.

Notably, one must consider that kq_knlistsize only grows in KQEXTENT
chunks, which means that concurrent threads trying to grow the kqueue
to consecutive fds will usually not result in the list being replaced
twice.  One can also more clearly rule out classes of arithmetic
problems in the final `else` branch.

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56209

kqueue: avoid a possible fork-deadlock

kqueue_fork_copy() is likely to have transitioned at least one knote
through a flux state, so we should check whether we need to wake
anything up on the way out to avoid a possible deadlock.

This was a part of D56210, but we'll close the review with the next
commit.

Fixes:  https://cgit.freebsd.org/src/commit/?id=b11289f87123f ("kqueuex(2): add KQUEUE_CPONFORK")
Reviewed by:    kib, markj

kqueue: simplify knote_fdclose()

The influx logic in knote_fdclose() is a little misguided, the resulting
wakeup() call should always be redundant: knote_drop_detached() will
always issue a wakeup before it returns, so anything waiting on *that*
knote that had entered fluxwait should have been woken up then.  This is
the obvious divergence from the other influx/wakeup pattern in the
implementation, which will kn_influx-- and then issue the wakeup after
it has processed all of the knotes it can make progress on.

While we're here, the kq_knlist cannot shrink, so we can avoid that
condition in the loop and avoid potentially excessive wakeups from
fluxwait on kqueues that we didn't touch.

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56210

kqueue: add some kn_knlist assertions around knlist_(add|remove)

We currently assert that kn_status is accurate, but there's more room
for error.  Neither of these are very likely, but currently we'd blow up
in SLIST*() macros instead of providing more obvious diagnostics.  It's
perhaps only worth testing these because knlist_remove() requires
getting logic across both f_attach() and f_detach() correct.

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56211

kqueue_fork_copy_knote(): zero kn_knlist for the copy before calling knlist_add()

Reported by:    pho, dhw
Fixes:  https://cgit.freebsd.org/src/commit/?id=306c9049c642da6a59a5dc088589605a9aa38b87
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  kevans, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56212

Fixes:                https://cgit.freebsd.org/src/commit/?id=b538d4911004ca541507166b8ec9689d2e87d1aa
MFC after:      2 weeks

Without this patch, diskless root NFS file systems
could only be mounted via NFSv3 (or NFSv2).
This patch adds the basic support needed to mount
a root fs via NFSv4.

At this time, the NFSv4 mount will only work if
the following is done on the NFS server configuration:
- The root directory specified in the "V4:" line in
  /etc/exports must be "/".  This is needed since the
  path to mount must be the same for NFSv3 and NFSv4.
- The NFS server must be configured to do both NFSv3
  and NFSv4, since the bootstrap code still uses NFSv3.
- The NFSv4 server must be configured with:
  vfs.nfs.enable_uidtostring=1
  vfs.nfsd.enable_stringtouid=1
  since the NFSv4 root fs cannot be running nfsuserd(8)
  when it is booting.  (This limitation may be removed
  in a future commit by hard-wiring enough id<-->name
  mapping entries to handle things until the nfsuserd(8)
  is running.)

To enable the root fs to be mounted via NFSv4, it needs:
- in the root file system's /boot/loader.conf
  boot.nfsroot.options="nfsv4"
  (Additional options like rsize=65536,wsize=65536 can
   also be specified.)
- in the root file system's /etc/sysctl.conf
  vfs.nfs.enable_uidtostring=1

Requested by:   Dan Shelton <dan.f.dhelton@gmail.com>
MFC after:      1 week

This commit adds page & bank fields to ifi2creq in preparation
for adding CMIS support for 400g optics to ifconfig.
The new ioctl SIOCGI2CPB is added, so that drivers can distinguish
between callers asking for page/bank selection and legacy callers
that simply failed to zero out all ifi2creq fields.

The mlx5en(4) driver and iflib(4) driver frameork have been updated
to use this new SIOCGI2CPB ioctl and support page/bank operations.
A follow-on patchset will add support to ifconfig for reporting
data from CMIS optics.

This has been tested on Nvidia ConnectX-7 and Broadcom Thor2 (using
out of tree driver) based NICs.

Differential Revision: https://reviews.freebsd.org/D55912
Sponsored by: Netflix Inc.
Reviewed by: kib

linuxkpi: Add `strtomem()` and `strtomem_pad()`

The DRM generic code started to use `strtomem_pad()` in Linux 6.11.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55729

linuxkpi: Move `_RET_IP_` to <linux/instruction_pointer.h>

This matches the declaration on Linux.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55730

linuxkpi: Define `_THIS_IP_`

For now, the macro is not implemented and it returns 0.

The DRM generic code started to use it in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55731

linuxkpi: Add mising functions in <linux/kmsg_dump.h>

The DRM generic code started to use `kmsg_dump_get_buffer()` and
`kmsg_dump_rewind()` in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55732

linuxkpi: Define `CONFIG_PGTABLE_LEVELS`

This is a kernel configuration constant that is expected to be defined.

The DRM generic code started to use it in Linux 6.11.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55733

linuxkpi: Define `PMD_SHIFT`

For now, only define it for x86 architectures.

The DRM generic code started to use it in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55734

linuxkpi: Add <linux/linux_logo.h>

It only defines the `struct linux_logo` structure for now. It does not
define any actual logo.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55735

linuxkpi: Add <linux/mfd/core.h>

To be exact, there was a dummy file with no content before. This commit
defines `struct mfd_cell` and adds two function stubs.

The function stubs are not implemented but still return success. They
log a message to indicate they need to be implemented.

Also, unlike Linux, <linux/mfd/core.h> includes <linux/ioport.h>. This
works around the fact that we can't include <linux/ioport.h> from
<linux/pci.h>, due to a conflict with the FreeBSD-native `struct
resource`.

The amdgpu DRM driver started to use it in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55736

linuxkpi: Add field `flags` to `struct resource`

This in the Linux version of `struct resource`, not the FreeBSD native
structure.

The amdgpu DRM driver started to use it in Linux 6.11.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55737

linuxkpi: Document why <linux/pci.h> can't include <linux/ioport.h>

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55738

linuxkpi: Define `MIN_T()` and `MAX_T()`

There are the same as `MIN()` and `MAX()` except that they take a type
to cast both arguments to compare.

The DRM generic code started to use it in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55739

linuxkpi: Define missing `SZ_*` below 1 kib

The amdgpu DRM driver started to use it in Linux 6.11.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55740

linuxkpi: Add <linux/ascii85.h>

This is used by the i915 DRM driver for some time to log more details
about a GPU error, but the code was commented out.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56282

linuxkpi: Define diagnostic macros like `might_resched()` or `cant_sleep()`

They are no-ops on FreeBSD.

While here, move the already defined `might_sleep*()` macros from
<linux/wait.h> to <linux/kernel.h> where they belong.

The DRM generic code started to use `might_fault()` in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56434

linuxkpi: Define `dev_err_probe*()`

They differ from other `dev_*()` logging functions by returning the
passed error code. The error code is also used to determine if the
message should be logged in the first place and at which log level.

The DRM generic code started to use it in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56435

linuxkpi: Define `__GFP_THISNODE`

It is used to force the NUMA node to allocate from. This flag is
unimplemented for now because we don't have an implementation of
`alloc_pages_node()` yet.

The DRM TTM code started to use this flag in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56436

linuxkpi: Define `sort_r()`

Like Linux `sort()` and FreeBSD `qsort()`, `sort_r()` is a wrapper
around FreeBSD `qsort_r()`.

The i915 DRM driver started to use it in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56437

linuxkpi: Define `MINORBITS`

We can't really define a proper value for this constant because minor
and major are encoded in a complex way on FreeBSD which cannot be
represented with a simple shift.

The DRM generic code started to use it in Linux 6.12.

In this context, `MINORBITS` is used to define an upper limit passed to
`xa_alloc()`. Therefore it is not used to encode or decode minors. It is
used as an arbitrary value. Therefore, we define the constant to 20,
like on Linux.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56447

linuxkpi: Add several `guid_*()` functions

The DRM generic code and the amdgpu DRM driver started to use several of
these functions in Linux 6.12. Likewise for `UUID_SIZE`.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56448

linuxkpi: Include <linux/uuid.h> from <linux/mod_devicetable.h>

The DRM generic code started to deppend on this indirect include of
<linux/uuid.h> in Linux 6.12.

Reviewed by:    bz, emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56449

linuxkpi: Add `fop_flags` to `struct file_operations`

... along with the `FOP_*` flag constants.

Note that this `fop_flags` field is not used on FreeBSD. It is added to
make the DRM drivers compile out of the box.

The DRM generic code and drivers started this in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56450

linuxkpi: Pass a `const void *` to `krealloc()`

This matches the API on Linux.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56451

linuxkpi: Passing a size of zero to `krealloc()` frees the pointer

This matches the API on Linux.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56452

linuxkpi: Add `struct xa_limit` support to xarray

The `xa_alloc*()` functions family takes a `struct xa_limit` to describe
the range of IDs the caller wants to allocate. We were using a single
mask to qualify a maximum ID only.

This commit changes that to use the same `struct xa_limit`. The logic
did not change, except it now supports a minimum ID as well.

The definition of `XA_LIMIT()` macro is adapted, as well as the
definitions of `xa_limit_*` (only `xa_limit_32b` existed, the other two
are added with this commit).

The DRM generic code started to use this `struct xa_limit` in Linux
6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56445

linuxkpi: Define `DEFINE_XARRAY*()` macros

The `DEFINE_XARRAY*()` macros are used to declare a static xarray.

As the structure embeds a mutex(9), we also need to declare the static
mutex after the `struct xarray`. Thus the slightly awkward definition
of `DEFINE_XARRAY_FLAGS()`.

The DRM generic code started to use `DEFINE_XARRAY_ALLOC()` in Linux
6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56446

linuxkpi: Add `copy_from_user_inatomic_nontemporal()` function

In Linux 7.1, `__copy_from_user_inatomic_nocache()` was renamed to
`copy_from_user_inatomic_nontemporal()`. This change was backported to
several LTS branches.

This includes Linux 6.12.x and the i915 DRM driver started to use it in
that version.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56719

As of this commit, all changes to linuxkpi required by the DRM drivers
from Linux 6.11 were committed.

Sponsored by:   The FreeBSD Foundation

Commit 8b9775912cbc added support for an NFSv4 mounted
root file system, but only if the NFSv4 configuration
used id numbers in the strings.

This patch adds support for the case where the NFSv4
configuration uses name<-->id mappings via nfsuserd(8)
by priming the mapping cache with just enough entries
so that it works until the nfsuserd(8) is running.
They are listed in nfs_prime_userd[] in
sys/fs/nfs/nfs_commonsubs.c.

The entries in nfs_prime_userd[] are also wired into
the kernel's cache for name<-->id mappings when nfsuserd(8)
starts up.  This is necessary, since an upcall to the
nfsuserd(8) daemon for a mapping when looking up the
path to the passwd/group database files (/etc) will
hang the system, due to a vnode lock being held on
the entry in the path which blocks nfsuserd(8) from
accessing files.

To enable this case, the following must be put in the
NFS root file system's /boot/loader.conf:
boot.nfsroot.options="nfsv4"
boot.nfsroot.user_domain="<user.domain>"
where <user.domain> must be the same as nfsuserd
uses (usually set via the -domain flag).
If boot.nfsroot.user_domain does not exist or is
the empty string, ids is strings is configured.

MFC after:      1 week
Requested by:   Dan Shelton <dan.f.shelton@gmail.com>
Fixes:  https://cgit.freebsd.org/src/commit/?id=8b9775912cbc ("nfs_diskless: Add support for an NFSv4 root fs")

In the sb == NULL case, we are computing the size of the note using a
dummy sbuf drain handler which counts bytes and discards the contents of
the buffer, so the fact that "structsize" is uninitialized doesn't
matter.  But, the compiler may complain about this, so we might as well
just initialize it unconditionally to silence the warning, as other
handlers already do.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292811
MFC after:      1 week

- When allocating a page, we should only consider the PG_ZERO flag when
  handling the top-level page.
- Unconditionally reset the flag when restarting the fault handler.
  Previously, vm_fault_busy_sleep() would fail to reset it.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294039
Reviewed by:    kib
Tested by:      Peter Much <pmc@citylink.dinoex.sub.org>
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=cff67bc43df1 ("vm_fault: only rely on PG_ZERO when the page was newly allocated")
Differential Revision:  https://reviews.freebsd.org/D56234

linprocfs_doauxv() allocates an automatic sbuf before validating
whether the requested read can be satisfied.

When the computed auxv read length exceeds IOSIZE_MAX, or when the
buffer length is too big, the function returns early without
releasing the sbuf.

Route these early exits through a shared cleanup path so the sbuf is
always deleted after sbuf_new_auto() succeeds.

Signed-off-by:  Shunchao Hu <ankohuu@gmail.com>
Reviewed by:    des, spmzt, zlei, aokblast
MFC after:      2 weeks
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2118

This is motivated by the following race in the ZFS zvol code.

When a zvol is created, we create a GEOM-backed zvol, which results in a
/dev/zvol/<zvol path> device file, created by GEOM::dev.  If volmode=dev
is specified, zvol_set_volmode_impl() will wither the GEOM, then create
a device file with the same name.  This sometimes fails because
g_wither_geom() is asynchronous, so we end up trying to create a device
file while the old one still exists.  I want to fix this by adding a
g_waitidle() call to zvol_os_remove_minor().

g_waitidle() is not sufficient: GEOM::dev does not destroy the device
until g_dev_orphan() is called.  (In fact the device destruction is
asynchronous too, but the delist_dev() call is sufficient to address
this race.)  So, I propose modifying g_waitidle() to block until
orphaned providers are processed.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258766
Reviewed by:    mav, imp, kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D55049

We'll subsequently just knote_free() since the knote is barely
constructed, but that bypasses any logic that might release references
on owned files/fops.  Defer clearing those until the knote actually owns
them and update the comment to draw the line more clearly.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56318

This is purely a cosmetic change to make it a little easier on the eyes,
rather than jumping back to the else branch up top.  Re-flow it to use
another loop on the outside and just inline the re-lock before we repeat
after awaking from fluxwait.

The !killkn path should maybe issue a wakeup if there's a thread in
KQ_SLEEP so that userland can observe the EOF, but this isn't a
practical problem today: pretty much every case of knlist_clear is tied
to a file descriptor and called in the close(2) path.  As a consequence,
potentially affected knotes are almost always destroyed before we even
get to knlist_clear().

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56226

This is not a functional change, but it makes it more clear upon
inspection of the definition that the mapping property described is
preserved.  Maybe more importantly, if one ends up getting an index
wrong or punching a hole in the name array unexpectedly, then it'll
hopefully manifest more clearly as a (null) or nullptr deref rather than
potentially just emitting the wrong namespace name.

It's noted that this almost certainly invalidates its use in C++, but
there aren't really any known C++ consumers of it- let's just cross
that bridge if we get there.

Reviewed by:    kib, mckusick, rmacklem
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D55323

freebsd11_freebsd32_nstat() invoked copyout(2) when
freebsd11_cvtnstat32() failed and skipped copyout on success. This is
backwards.

Fix this to match freebsd11_freebsd32_nlstat() and freebsd11_nstat(),
and only copy the nstat32 result to userspace when conversion succeeds.

Signed-off-by:  Weixie Cui <cuiweixie@gmail.com>
Reviewed by:    mhorne
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2109

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

If a knote belongs to the list, there is no reason to check for the list
emptiness.  On the other hand, if the knote does not belong to the list,
then checking for emptiness is not enough since there might be a
different knote there.

Reviewed bu:    kevans, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56341

Linux /proc/partitions reports the major/minor pair, the device size in
1K blocks, and the device name.  linprocfs still printed obsolete
statistics columns and reported the size in bytes.

Update linprocfs_dopartitions() to emit the Linux-style header and
report provider sizes in 1K blocks.

Signed-off-by: Shunchao Hu <ankohuu@gmail.com>
Reviewed by:    des
MFC after:      2 weeks
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2126
Closes:         https://github.com/freebsd/freebsd-src/pull/2126

zstd's tracing API (zstd_trace.h) declares ZSTD_trace_compress_begin()
and friends as __attribute__((weak)) externals, gated on the
ZSTD_HAVE_WEAK_SYMBOLS compile-time probe.  That probe has covered
x86_64 and i386 since at least zstd 1.5.6, and was extended to aarch64
and riscv in 1.5.7.

In a static kernel image there is no dynamic linker to patch the PLT GOT
entries at runtime.  On amd64 the undefined weak symbols resolve directly
to NULL, so the "!= NULL" guard in the zstd source correctly suppresses
every call through the stubs.  On aarch64 and riscv the ABI requires
GOT-based indirection for external calls: the PLT stub address is
non-NULL, the guard passes, and the call lands in an uninitialized GOT
slot.  Because this happens before exception handlers are in place the
machine resets silently, making the kernel unbootable after the zstd
1.5.7 import.

The upstream-supported suppression is ZSTD_NO_TRACE (zstd_internal.h),
which skips inclusion of zstd_trace.h entirely and forces ZSTD_TRACE=0.
Add it to ZSTD_C alongside the existing ZSTD_* defines, and while here
group all three -DZSTD_* flags onto a single line in alphabetical order
with ${.IMPSRC} on its own line.

Reported by:    many
Tested by:      lwhsu
X-MFC-with:     c0d9a07101a1

hash(9): introduce hashalloc()/hashfree() KPI

This is a more extendable version than traditional hashinit(9).  It allows
different kinds of slot headers with optional locks.

Implement traditional hashinit()/hashdestroy() on top of it.

Reviewed by:            pouria, gallatin
Differential Revision:  https://reviews.freebsd.org/D55904

hash(9): fix my stupid off-by-one

Fixes:  https://cgit.freebsd.org/src/commit/?id=abf68d1cf02550c3c0341f5bb90be0d34f655a15

inpcb: retire INP_DROPPED and in_pcbdrop()

The inpcb flag INP_DROPPED served two purposes.

It was used by TCP and subsystems running on top of TCP as a flag that
marks a connection that is now in TCPS_CLOSED, but was in some other state
before (not a new-born connection). Create a new TCP flag TF_DISCONNECTED
for this purpose.

The in_pcbdrop() was a TCP's version of in_pcbdisconnect() that also sets
INP_DROPPED.  Use in_pcbdisconnect() instead.

Second purpose of INP_DROPPED was a negative lookup mask in
inp_smr_lock(), as SMR-protected lookup may see inpcbs that had been
removed from the hash.  We already have had INP_INHASHLIST that marks
inpcb that is in hash.  Convert it into INP_UNCONNECTED with the opposite
meaning.  This allows to combine it with INP_FREED for the negative lookup
mask.

The Chelsio/ToE and kTLS changes are done with some style refactoring,
like moving inp/tp assignments up and using macros for that.  However, no
deep thinking was taken to check if those checks are really needed, it
could be that some are not.

Reviewed by:            rrs
Differential Revision:  https://reviews.freebsd.org/D56186

tcp: fix !INVARIANTS build

Fixes:  https://cgit.freebsd.org/src/commit/?id=40dbb06fa73cac37d57563c07e55efd0cabbd488

Implement Linux I2C ioctl translation in the Linux compatibility layer
and wire iicbus cdevs up for in-kernel rdwr handling.
Support common i2c-dev requests including SLAVE, FUNCS, and RDWR,
while rejecting unsupported 10-bit and SMBus operations.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Reviewed by:    imp, adrian, pouria
Differential Revision: https://reviews.freebsd.org/D56251

geneve creates a generic network virtualization tunnel interface
for Tentant Systems over an L3 (IP/UDP) underlay network that provides
a Layer 2 (ethernet) or Layer 3 service using the geneve protocol.
This implementation is based on RFC8926.

Reviewed by:    glebius, adrian
Discussed with: zlei, kp
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D54172

Added MAGIC number below and map to linsysfs in bsd_to_linux_ftype()

This maps:
  - `linsysfs` -> `LINUX_SYSFS_MAGIC` (`0x62656572`)

Signed-off-by: YAO, Xin <mr.yaoxin@outlook.com>

Reviewed by:    emaste
Pull request:   https://github.com/freebsd/freebsd-src/pull/2119

Now that a functional inpcb can not outlive its socket, just use socket's
vnet pointer.

This fixes the build of the LINT-ACPI kernel.

Fixes:          https://cgit.freebsd.org/src/commit/?id=4e3fdced7f78 ("qcom_gcc: migrate the MSM8916 support to qcom_gcc")

In environments where time_t is 32 bits, including the 32-bit library
build on amd64, the overflow being tested for cannot happen, and gcc
complains with -Wtype-limits, causing the gcc build to fail.  Work
around this by ifdef'ing out the saturation code on i386.

Reviewed by:    imp, jfree
Discussed with: markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=e3799530b3ba ("sys/time: Add saturating sbt conversions")
Differential Revision:  https://reviews.freebsd.org/D56369

"total" is the number of slots in the array, so wraparound needs to be
done when "first" or "last" is greater than or equal to the number of
slots.

Note that no consumers of the code are currently connected to the kernel
build.

Reported by:    Stanislav Fort <stanislav.fort@aisle.com>
Reviewed by:    bz, emaste
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56371

Ensure that the .plt and .ipld sections are in the executable memory segment.

MFC after:      1 week
Reviewed by:    andrew
Differential Revision: https://reviews.freebsd.org/D56403

John points out that this probably should have been removed in commit
472888018ce, which removed a special case where we'd set desired=0 if
the target process has P_INMEM clear.  It's not obvious to me that the
desired=0 case can't arise by setting an RSS limit to 0, but I'm not
sure why we'd try to go the extra mile in that case anyway.

Reported by:    jhb
Reviewed by:    kib
MFC after:      2 weeks
Fixes:          https://cgit.freebsd.org/src/commit/?id=472888018ce1 ("proc: Remove kernel stack swapping support, part 6")
Differential Revision:  https://reviews.freebsd.org/D56140

Remove the duplicate (incorrect) name.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294542
Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56400

kern_descrip.c: Clarify allocation and freeing of fd map in fdgrowtable()

When expanding a file table, the condition for allocating a new map
is NDSLOTS(nnfiles) > NDSLOTS(onfiles) whereas for freeing the old map
is NDSLOTS(onfiles) > NDSLOTS(NDFILE).

If a previously expanded file table were to be expanded slightly again
such that the map did not need to be increased, then fdgrowtable could
still free the current map.

This does not happen currently as nnfiles is rounded up to a multiple of
NDENTRIES at the beginning of fdgrowtable() so that every enlargement
after the first enlargement will always require a larger map.

Though the logic is currently correct, it is unclear and should the
earlier rounding up of nnfiles be relaxed or remove, the logic would
be incorrect. This patch therefore adds comments and invariants checking
the size of the table and map, and updates the map free condition so
that it is absolutely clear that the old map will only be deallocated
if a new map has been allocated.

Signed-off-by: Kristofer Peterson <kris@tranception.com>
Reviewed by: kib, kevans
Pull Request: https://github.com/freebsd/freebsd-src/pull/2029

file: Fix a format string assertion

Reported by:    Jenkins
Fixes:          https://cgit.freebsd.org/src/commit/?id=e75b324c93a1 ("kern_descrip.c: Clarify allocation and freeing of fd map in fdgrowtable()")

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56365

The Memory Tagging Extension supports both Synchronous and Asynchronous
faults, called Tag Check Faults, which are configurable via
SCTLR_EL1.TCF0 for userspace and SCTLR_EL1.TCF for the kernel.

This commit adds support for handling synchronous tag check faults at
EL0 and EL1, although these are only enabled on a per-process basis in
userspace, kernel space does not enable tag check faults. A TCF in the
kernel will cause a kernel panic like any other virtual memory fault,
and a TCF in userspace will result in a SIGSEGV

Reviewed by:    kib
Sponsored by:   Arm Ltd
Signed-off-by:  Harry Moulton <harry.moulton@arm.com>
Differential Revision:  https://reviews.freebsd.org/D55947

Reviewed by:  gallatin
Reported by:    Claude Sonnet 4.6
Fixes:          https://cgit.freebsd.org/src/commit/?id=1000cc4a0d39 ("so_splice: Disallow splicing with KTLS-enabled sockets")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56385

Sponsored by:         Netflix
Reviewed by:            jhb
Differential Revision:  https://reviews.freebsd.org/D56411

Lightly parse and preserve the attributes of the args as attributes.

Sponsored by:           Netflix
Reviewed by:            brooks
Differential Revision:  https://reviews.freebsd.org/D56407

Create a script to export the parsed data as json. Include the
annotations for the system call arguments, since they are helpful to
downstream uses.

Sponsored by:           Netflix
Reviewed by:            brooks
Differential Revision:  https://reviews.freebsd.org/D56408

linux: Support ICMP6_FILTER socket option translation

Handle Linux IPPROTO_ICMPV6 socket options in the Linuxulator and map
ICMP6_FILTER for both getsockopt(2) and setsockopt(2).

Linux and FreeBSD use inverted bit semantics for struct icmp6_filter, so
invert the filter contents before/after calling setsockopt/getsockopt.

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294434
Reviewed by:    pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2138

linux: Support IPPROTO_RAW socket option translation

Handle Linux IPPROTO_RAW socket options in the Linuxulator for both
getsockopt(2) and setsockopt(2). Detect the socket family and remap
the level to IPPROTO_IPV6 for AF_INET6, reusing the existing option
translators.

This fixes IPV6_CHECKSUM for IPv6 raw sockets, which Linux programs
set at level IPPROTO_RAW rather than IPPROTO_IPV6.

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294434
Reviewed by:    pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2138

linux: Translate IPv6 hoplimit ancillary data for recvmsg

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
Reviewed by:    pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2138

Provide intuitive log search keywords and increased system consistency.

MFC after:              2 weeks
Reported by:            mav
Reviewed by:            0mp, dteske
OpenZFS change:         d45c8d648 (Improve dmesg kernel message prefix)
Differential Revision:  https://reviews.freebsd.org/D55765

This works enough to let me see the marvell switch on the MDIO bus.

It uses clause 22, which ixgbe's existing MDIO code doesn't currently
support, so it's implemented in a new source file.

Since mdio(4) is now required, add it where appropriate to GENERIC kernels.

Reviewed by:    kbowling
Differential Revision:  https://reviews.freebsd.org/D50128

LinuxKPI: 802.11: factor out chandef/chanctx initialization

Factor out chandef and chanctx initialization from lkpi_sta_scan_to_auth().
This makes the code a lot more readable and prepares for the next steps
that will re-use some of this.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: save the default channel

Add a field to struct lkpi_hw to save the default channel for later
reuse.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: keep chanctx on a reserved list

Keep the chanctx around as we may swap them.

In the future (11be) these lists likely need to be (a) limited to
maximum number of chanctx possible (see struct ieee80211_iface_limit),
and (b) with that also by radio.

For the moment keep this simple and start with a single chanctx
and build up from there when we get there.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: factor out getting and setting a chanctx

Further factor out acquiring the chanctx (either set or new),
as well as populating a chanctx with information.
This further simplifies lkpi_sta_scan_to_auth() and gives us
more reusable function blocks.

Sponsored by:   The FreeBSD Foundation
MFC after;      3 days

LinuxKPI: 802.11: rework lkpi_ic_set_channel()

We are called by net80211 when channel changes are happening and
we have to map this to LinuxKPI 802.11.  There are multiple cases:
(1) it is a hardware scan and net80211 still changes the channel;
    we do not need to;
(2) it is a software scan (the magic fallback case) in which case
    we let net80211 drive the scan channel and we need to keep
    a copy of the scan_chandef (see follow-up commit);
(3) no scanning but a normal channel change triggerd by net80211;
    in that case we could (should?) setup the full flags right away
    but deferred LinuxKPI logic currently handle this for us as not
    in all cases the information was fully available from net80211
    in times we would have needed it.  We only do this in order
    to handle the emulate chanctx cases but do not change the
    channel otherwise; scan_to_auth will set the correct chanctx.
(3a) we have no (active) chanctx for that, create/set one,
(3b) we do have an (active) chanctx for this, use it but reset to
     defaults.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: improve emulate chanctx implementation

Now that all dependencies are implemented improve our chanctx emulation.
Some drivers still rely on chandef information for channel work.

In order to only do chanctx updates within mac80211 in Linux and
likewise in the LinuxKPI 802.11 compat layer, emulation functions
were introduced which claim to support chanctx driver operation but
in reality convert these to chandef field updates and (*config)
downcalls.

This is relevant to several mt76 chipsets (at least 7615, 7915),
and rtw88 and certain rtw89 chipsets (8851b, and the ones not supporting
SCAN_OFFLOAD or BEACON_FILTER) for us.

Migrate the logic out of the header and improve it.

Make use of the introduced dflt_chandef and scan_chandef fields,
add comparison of chandefs to see if we have to update, etc.

Also add strict checks for driver settings in linuxkpi_ieee80211_alloc_hw()
to make sure all preconditions are correctly met.  Store the result
if we are using the emulation functions in a field, so we can later
check on it and also leave a note to the users if emulation is used
in order to improve debugging on possible problem reports.

Use the new field that we use emulation in lkpi_ic_set_channel() instead
of a hand crafted check.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=ac1d519c01ca8 ("LinuxKPI: 802.11: adjustments for v6.11..")

LinuxKPI: 802.11: add chandef tracing

Add chandef tracing so we can follow what is set and unset in the
chanctx emulation for drivers still needing this.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: start filling vif->cfg.ap_addr

vif->cfg.ap_addr is used by various drivers now and is the BSSID for
non-MLO or the AP addr for MLO configurations.

If this is unset rtw89 gets cranky and certain packets are likely not
going out correctly (also for iwlwifi).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: make sure dtim_period is set

When going from ASSOC to RUN LinuxKPI based wireless drivers have
certian expectations written in various ways.  I believe mac80211
waits to see a beacon before setting the vif to assoc (or the sta
to AUTHORIZED).  We have some comments in lkpi_update_dtim_tsf()
for that.
In practice we can filter out the beacons already and know when
they came in as we count them but it is hard to split up the
state machine and defer the work.

So we make sure that dtim_period is set to at least 1 before
calling the (*vif_cfg_change) after setting assoc to true;
0 is a reserved value according to the standards.

We will update it once we see a beacon and in case the value
differs from 1 shortly afterwards from the recv_mgmt callback.

While iwlwifi seems to have coped with our initial implementation,
rtw89 may hit a DIV 0 if dtim_period is 0 depending on how well
the rx path races with our unlocking in assoc_to_run.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: move hex2bin() from kernel.h to new hex.h

New Linux v7.0 drivers include hex.h.  Rather than adding a dummy
header, migrate the kernel.h hex2bin() into hex.h, where it belongs.
Care needs to be taken as the _h2b() helper function is still used by
other bits in kernel.h.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    emaste, dumbbell
Differential Revision: https://reviews.freebsd.org/D56391

LinuxKPI: add default_gfp()

Various new allocation macros can take an optional gfp_t argument.
If the argument is not given we need to set the GFP_KERNEL default.
While this is only internally used and I initialy called it differently,
should this spread elsewhere having the same name as in Linux will be
good.

Sponsored by:   The FreeBSD Foundaton
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D56392

LinuxKPI: conditionally add __flex_counter()

__flex_counter() is used by overflow.h and needed for "flex allocations".
It is either a void * typed 0 (NULL) (like this for _Generic checks),
or uses __builtin_counted_by_ref.

The latter was added to gcc and llvm fairly recently and while for gcc
the __has_builtin() check suffices, clang had parts broken until recently
so needs an extra check for the next major version.  The fixed hash is
currently not part of any tag to use, so we play it save (and hope 23
will have it).  It will be a while until we will see the builting to be
used but at least we will be prepared for it.  See inline comments for
the commit hashes and versions which added the feature.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D56393

LinuxKPI: sync overflow.h from Linux v7.0

overflow.h was imported directly from Linux in 3208d4ad2b8320a.
Update the file to the newer version as needed for v7.0 driver updates.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Obtained from:  git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
                028ef9c96e96197026887c0f092424679298aae8 (tag: v7.0)
Reviewed by:    emaste, dumbbell
Differential Revision: https://reviews.freebsd.org/D56394

LinuxKPI: add kmalloc_obj[s], kzalloc_obj[s], and kzalloc_flex

Drivers in Linux v7.0 seem to have changed to the new allocation
macros using a sweep.  Add the ones I encountered with wireless
drivers so far.  They all take an optional argument for a gfp_t,
which default_gfp() deals with.

The plural version "objs" takes an extra nitems argument in addition
to the size.  We use size_mul() to possibly detect overflows.

The "flex" version uses an extra variable to track the variable sized
array allocations and if supported by the compiler will use
__builtin_counted_by_ref() to properly track bounds.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D56395

LinuxKPI: implement devm_kmemdup_array()

Implement devm_kmemdup_array() using devm_kmemdup() in order to
prepare for Linux v7.0 based drivers.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D56396

LinuxKPI: 802.11: set IEEE80211_MIN_ACTION_SIZE according to struct

IEEE80211_MIN_ACTION_SIZE came up in the mt76 vendor subtree merge
as one of the non-mechanical changes which made me look.
Rather than (incorrectly) hand counting the offset from the beginning
of a frame, use the offset from the beginning of struct ieee80211_mgmt.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: Add structures and functions for NAN support

In Linux v7.0 iwlwifi(4) started to add support for Wi-Fi Aware(tm)
also known as Neighbor Awareness Networking (NAN).

Add structures and fields for this as needed so far to keep the driver
compiling.  net80211 has no support for it as a new mode.

We may consider a dedicated header file for these parts in the future
depending on how much more is to come.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

LinuxKPI: 802.11: add struct/fields and functions for v7.0

Add 802.11 struct fields and functions support for Linux v7.0 based
wireless drivers (at least iwlwifi, rtw88, rtw89).

While here cleanup some other bits.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

MFC after:    1 week

Reviewed by:  markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

Reported by:  Ricardo Branco <rbranco@suse.com>
Reviewed by:    markj, Ricardo Branco <rbranco@suse.com>
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56507

- kaudit_to_bsm: Log IPv6 as well as IPv4 and unix addrs
- au_to_sock_inet128: Treat ports the same way as au_to_sock_inet32() as
  just pushing a uint16 causes byte ordering problems on little endian.

Differential Revision: https://reviews.freebsd.org/D39633
Sponsored by: Netflix
Reviewed by: csjp

The TIOCNOTTY handler detaches the calling process from its controlling
terminal.  It clears the link from the session to the tty, but not the
pointers from the tty to the session and process group.  This means that
sess_release() doesn't call tty_rel_sess(), and that pgdelete() doesn't
call tty_rel_pgrp(), so the pointers are left dangling.

Fix this by clearing pointers in tty_drop_ctty().  Add a standalone
regression test.

Approved by:    so
Security:       FreeBSD-SA-26:10.tty
Security:       CVE-2026-5398
Reported by:    Nicholas Carlini <npc@anthropic.com>
Reviewed by:    kib, kevans
Fixes:          https://cgit.freebsd.org/src/commit/?id=1b50b999f9b5 ("tty: implement TIOCNOTTY")
Differential Revision:  https://reviews.freebsd.org/D56046

pkru: Fix handling of 1GB largepage mappings

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set.  More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not check whether the request covers a "boundary" vm
map entry.  Fix this, add the missing PG_PS test, and add some tests.

Approved by:    so
Security:       FreeBSD-SA-26:11.amd64
Security:       CVE-2026-6386
Reported by:    Nicholas Carlini <npc@anthropic.com>
Reviewed by:    kib, alc
Differential Revision:  https://reviews.freebsd.org/D56184

tests/posixshm: Check for hardware support in largepage_pkru

MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=ca87c0b8e396 ("pkru: Fix handling of 1GB largepage mappings")

The epoch(9) subsystem implements per-CPU queues of object destructors
which get invoked once it is safe to do so.  These queues are polled via
hardclock().

When a CPU is about to go idle, we reduce the hardclock frequency to 1Hz
by default, to avoid unneeded wakeups.  This means that if there is any
garbage in these destructor queues, it won't be cleared for at least 1s
(and possibly longer) even if it would otherwise be safe to do so.

epoch_drain_callbacks() is used in some places to provide a barrier,
ensuring that all garbage present in the destructor queues is cleaned up
before returning.  It's implemented by adding a fake destructor in the
queues and blocking until it gets run on all CPUs.  The above-described
phenomenon means that it can take a long time for these calls to return,
even (especially) when some CPUs are idle.  This causes long delays when
destroying VNET jails, for instance, as epoch_drain_callbacks() is
invoked each time a network interface is destroyed.

Work around this problem by not disabling the hardclock timer if there
is garbage present in the destructor queues.  The implementation of
epoch_drain_callbacks() has other problems, but this small change on its
own gives a good improvement, especially when running networking
regression tests.  Moreover, we should aim to invoke destructors in a
timely manner, so the change is generally beneficial.

Reviewed by:    glebius
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D56508

linux: Support PR_GET_CHILD_SUBREAPER prctl(2)

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294651
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: kib, pouria
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2151

linux: Fix a typo in a header comment

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294651
Reported by:    Dmitry Lukhtionov <dmitryluhtionov@gmail.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=50ff71e956b6 ("linux: Support PR_GET_CHILD_SUBREAPER prctl(2)")
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2151

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294651
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: kib, pouria
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2151

kexec_load() + reboot is intended to be equivalent to a system reboot.
However kexec_load() can load arbitrary data as the target kernel,
leading to execution of arbitrary code, even though it's effectively in
a new context.  Rather than being equivalent to a system reboot, it's
also equivalent to kldload(), which loads arbitrary code into the
running kernel.  Since kldload() is blocked at securelevel 1, also block
kexec_load().

Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=e02c57ff3 ("kern: Introduce kexec system feature (MI)")
Sponsored by:   Hewlett Packard Enterprise
Differential Revision:  https://reviews.freebsd.org/D56580

linuxkpi: Add `struct kmsg_dump_detail`

This structure is used in a modified definition of `struct kmsg_dumper`
field `dump` in Linux 6.12. Therefore this field has two definitions put
behind the values of `LINUXKPI_VERSION`.

The DRM generic code started to use it in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56433

linuxkpi: Add more `struct folio`-related functions

The i915 DRM driver started to replace the use of `struct page` by
`struct folio` in its GEM shmem code in Linux 6.12.

linuxkpi were missing a few more functions: `kmap_local_folio()`,
`memcpy_to_folio()` and `offset_in_folio()`. They are equivalent of
their `struct page` counterparts.

One difference is that `kmap_local_folio()` takes an offset argument and
the returned address takes this offset into account.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56438

linuxkpi: Define `fd_file()`

This macro simply returns the `file` field of the `struct fd`.

The DRM generic code and the amdgpu driver started to use it in
Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56440

linuxkpi: Add `mem_is_zero()`

The DRM generic code and the i915 DRM driver started to replace the use
of `memchr_inv()` by a `mem_is_zero()` in Linux 6.12. We reuse the
previous use of `memchr_inv()` to implement `mem_is_zero()`.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56442

linuxkpi: Add `kmemdup_array()`

It is similar to `kmemdup()` but takes a number of elements to duplicate
and their size.

The i915 DRM driver started to use it in Linux 6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56444

linuxkpi: <asm/unaligned.h> is moved to <linux/unaligned.h> in Linux 6.12

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56454

linuxkpi: Define a guard for the `mutex` type

The amdgpu DRM driver started to use `guard(mutex)` in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56571

linuxkpi: Add `register_pm_notifier()` and `unregister_pm_notifier()`

They are empty stub returning success for now, like the previously
defined stubs in this header.

Several constant are also defined in the process.

The amdgpu DRM driver started to use them in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56572

linuxkpi: Add `atomic_read_acquire()`

This function calls `raw_atomic_read_acquire()` which is also added.

They are located in <linux/atomic/*.h> headers, both included from
<linux/atomic.h>.

The amdgpu DRM driver started to use this in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56573

linuxkpi: Define `system_state`

This is a global variable used to track the state of the system, like
booting, running, halting and so on.

This variable is based on the `enum system_states` enumeration.

For now, always set `system_state` to `SYSTEM_RUNNING`.

The amdgpu DRM driver started to use this in Linux 6.12.x.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56575

linuxkpi: Define `DIV_U64_ROUND_UP()`

It is the same as `DIV64_U64_ROUND_UP()` but takes a 32-bit integer as
the divisor.

The amdgpu DRM driver started to use this in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56576

linuxkpi: Add `rb_add()`

It is the same as `rb_add_cached()` but it works on `struct rb_root`, not
a `struc rb_root_cached`. It also does not return anything.

The DRM generic code started to use this in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56577

FreeBSD has a native membarrier(2) syscall which is mostly compatible
with Linux. This is a thin wrapper around kern_membarrier() that
translates all available commands and flags.

Also update the syscalls.master prototypes to match the Linux 5.10+
three-argument form.  Pre-5.10 binaries using the two-argument form
continue to work: cpu_id is only consulted for RSEQ commands, which
FreeBSD does not support and which kern_membarrier() rejects with
EINVAL, matching Linux semantics.

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281691
Reviewed by:    kib, pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2147

linuxkpi: Move {lower,upper}_32_bits macros to <linux/wordpart.h>

... from <linux/compiler.h>.

<linux/wordpart.h> is the header defining them on Linux 6.12 (I didn't
check older versions).

<linux/wordpart.h> is also included from <linux/kernel.h>.

The DRM generic code started to depend on <linux/wordpart.h> in Linux
6.12.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56441

linuxkpi: Add Linux 6.12 variant of `kvrealloc()`

In Linux 6.12, the API changed to be closer to `krealloc()`:
* The function does not take the old size anymore
* The function becomes a wrapper around `krealloc()` with a fallback
  mechanism.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56453

linuxkpi: Move `ARRAY_SIZE` to <linux/array_size.h>

The DRM generic code started to import this header directly in Linux
6.12.x. Let's move the definition of `ARRAY_SIZE()` (the only thing that
<linux/array_size.h> defines) to this header.

Also, include <linux/array_size.h> from the same headers as Linux. This
includes <linux/kernel.h>, so the change should not break anything.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56570

linuxkpi: Add `memdup_array_user()`

The amdgpu DRM driver started this in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56574

linuxkpi: Define `min_array()` and `max_array()`

They are macros that return the minimum or maximum values of an array of
integers. They assume that the array contains elements.

The i915 DRM driver started to use `min_array()` in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56583

linuxkpi: Add `pci_dev_is_disconnected()`

For now, it is an empty stub that always return false. On Linux, it
looks at an internal error state of the device to determine if it is
disconnected.

The amdgpu DRM driver started this in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56582

linuxkpi: Move `GENMASK()` to <linux/bits.h>

... from <linux/bitops.h>.

This matches the location on Linux.

<linux/bits.h> is also included from <linux/bitops.h>. Therefore it will
not break anything.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56584

`sizeof(*ndev->name)` is `sizeof(char)`, not IFNAMSIZ, so
the interface name was effectively limited to a single byte.
Use `sizeof(ndev->name)` for the `char name[IFNAMSIZ]` member.

Signed-off-by:  Weixie Cui <cuiweixie@gmail.com>
Reviewed by:    pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2111

Add missing directories and fix alphabetical ordering

Signed-off-by:  Minsoo Choo <minsoo@minsoo.io>
Sponsored by:   FreeBSD Foundation
Reviewed by:    imp, mhorne, pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2146

This flag combines `GFP_KERNEL` and `__GFP_ACCOUNT`. The latter is also
defined in this commit. It is defined as a no-op flag as it is not
implemented.

The DRM generic code started to use it in Linux 6.12.x.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56587

It indicates to `alloc_pages()` to allocate the pages from the current
NUMA domain. If it couldn't, it should not retry elsewhere and return
failure.

Reviewed by:    bz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56590

The seq_file.rst documentation in the Linux kernel documents the
iterator interface for the seq_file structure.  In particular, the
ppos passed to seq_read is a logical offset into a seq_file managed by
the iterator interface, not an offset into the generated data.  For
example, if a seq_file outputs state for each node in a linked-list or
array, *ppos might be used as the index of the node to output, not a
byte offset.

Rewrite seq_read to honor this contract which fixes a few bugs:

- Treat *ppos as a logical iterator offset that is only updated by the
  next callback after outputting a single item via the show method.

- Use a loop to permit outputting descriptions of multiple items if
  the user buffer is large enough.

- Always invoke the stop method after terminating the loop to cleanup
  any state setup by start (e.g. if start allocated a buffer or
  obtained a lock, the stop method is called to cleanup).

While here, implement support for SEQ_SKIP as documented in the Linux
documentation even though it is not currently used in the tree.

Reviewed by:    bz
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D55899

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

This removes the need for several casts to pointer in callers.

Effort:         CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Add explicit uintptr_t casts to the arguments to these macros so that
the work both with virtual addresses (e.g. vm_offset_t) and pointers.

Drop no-longer-needed casts in various invocations of DMAP_TO_PHYS.

Effort:         CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Add a new PHYS_TO_DMAP_ADDR that still returns an address for use in
places that only need an address and not a pointer.

Effort:         CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Suggested by:   kib
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Reviewed by:    kib
Sponsored by:   AFRL, DARPA
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2068

Effort:               CHERI upstreaming
Sponsored by:   AFRL, DARPA

kern: vfs: add MAC checks for mount/unmount/update

The unmount check is straightforward and only really needs the
struct mount and flags used, in case a MAC policy wants to reject
force-unmounts or do special handling for FSID-based unmounts.

The mount check offers as much information as I think might be of
interest to a MAC policy: the vnode to be mounted on, vfsconf, and
applicable mount options.   XNU also has a later version that just takes
a struct mount for everything that VFS_MOUNT() has to offer, but my
draft policy doesn't need any of that.  It also doesn't really need the
unmount check, but it seems reasonable to add it while I'm here.

The update check similarly passes the flags/options for the operation,
along with the struct mount and label.

Reviewed by:    kib, olce
Differential Revision:  https://reviews.freebsd.org/D55601

kern: mac: sprinkle a bit of const correctness

mpc_name and mpc_fullname are string literals in correct usage, so they
should really be const instead.

mpc_ops aren't typically const, but the framework shouldn't be doing
anything to clobber it; thus, good to constify it as a reminder.

Switch to using a slightly more semantically correct `void **` in the
fastpath bits while we're here, since we only do arithmetic on the outer
layer of pointer and compare the inner to a pointer-typed (NULL).

Reviewed by:    bapt
Differential Revision:  https://reviews.freebsd.org/D55702

kern: mac: bump the MAC_VERSION for 16.x

Reviewed by:    bapt
Differential Revision:  https://reviews.freebsd.org/D55703

The specificgid functionality has historically allowed only a single
group to be exempt, but in practice one might want a few services to
be exempt for reasons.  From a security perspective, we probably don't
want to encourage unrelated users to be grouped together solely for
this purpose, as that creates one point of shared access that could be
used for nefarious purposes.

Normalize the group list as we do cr_groups to allow for linear matching
rather than quadratic, we just need to account for the differences in
FreeBSD 15.0+ where cr_groups is entirely supplementary groups vs.
earlier versions, where cr_groups[0] is the egid and the rest is
sorted.

Reviewed by:    csjp, des (earlier version)
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D56592

The pass(4) driver's CAMIOCOMMAND and CAMIOQUEUE ioctls accept arbitrary
CCBs from userland.  This device requires root to open, and thus send
these commands. Previously, the only func_code filter was a blocklist
check against the XPT_FC_XPT_ONLY flag.  This missed several dangerous
func_codes that lack that flag:

 - XPT_ABORT: the abort_ccb field is a raw kernel pointer from the
   user CCB payload.  xpt_action_default() dereferences it without
   validation, leading to kernel crashes or worse.

 - XPT_SASYNC_CB: the callback and callback_arg fields come directly
   from the user CCB payload and get registered as a kernel async
   callback, allowing arbitrary kernel code execution.

 - Target mode CCBs (XPT_EN_LUN, XPT_TARGET_IO, etc.) fall through
   directly to the SIM with user-controlled payloads.

Replace the XPT_FC_XPT_ONLY blocklist with an explicit allowlist of CCB
function codes that are known to be safe for userland to submit: I/O
operations (SCSI, ATA, NVMe, SMP, MMC), device queries, transport
settings, and a handful of safe control operations (NOOP, REL_SIMQ,
RESET_DEV, DEBUG). Normally, the /dev/pass* permissions only allow root
to access them, so this is only a safety issue by default.

Also reject CAM_DATA_PADDR and CAM_DATA_SG_PADDR, since these pass
user-supplied physical addresses directly to DMA with no validation,
which on systems without an IOMMU allows arbitrary host memory access.
Add `options PASS_UNSAFE_PADDR` to allow the old behavior.

Verified that camdd, camcontrol, smartmontools, and cdrtools use only
func_codes on the allowlist (XPT_SCSI_IO, XPT_ATA_IO, XPT_NVME_IO,
XPT_NVME_ADMIN, XPT_PATH_INQ, XPT_GDEV_TYPE, XPT_GET_TRAN_SETTINGS,
XPT_SET_TRAN_SETTINGS, XPT_RESET_DEV, XPT_DEBUG) and none use
CAM_DATA_PADDR.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293888, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293890
Assisted-By:            Claude Opus 4.6 (1M context)
Sponsored by:           Netflix
Reviewed by:            jhb
Differential Revision:  https://reviews.freebsd.org/D56486

XPT_GDEVLIST in xpt_action_default has two early-return paths (list
changed and index not found) that set cgdl->status but not ccb_h.status.
Since xpt_action sets ccb_h.status to CAM_REQ_INPROG before dispatching,
and XPT_GDEVLIST is an non-queued CCB, cam_periph_ccbwait skips the
sleep loop and immediately hits the KASSERT checking that status !=
CAM_REQ_INPROG, causing a panic.

Set ccb_h.status = CAM_REQ_CMP at the top of the code rather than the
bottom. Any future error paths will be right (since this command can't
fail at the command level, just in the status of the data level).

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293899
Assisted-By:            Claude Opus 4.6 (1M context)
Sponsored by:           Netflix
Reviewed by:            jhb
Differential Revision:  https://reviews.freebsd.org/D56487

Create a tunable for the maxinum number of 'high power' commands to
schedule, kern.cam.max_high_power.  Default remains at 4.

Differential Revision:  https://reviews.freebsd.org/D56462

It turns out interface ioctls are defined not just in sockio.h, but are
spread among many files.  When I added SIOCGI2CPB at the bottom of the
file, the next number (160) collided with an ioctl (IPSECGREQID) that
I was unaware of in another file.  Fix this by moving to a number that
is unclaimed.

Fixes: https://cgit.freebsd.org/src/commit/?id=cf1f21572897 (net: Add SIOCGI2CPB ioctl & add page/bank fields to ifi2creq)
Reported by: dhw
Reviewed by: imp

kgss: remove KGSS_VNET_* macros family

The original idea was that something else than VNET(9) might be used for
kgss in jails, but that is very unlikely to happen.

Mechanical change done with sed+grep.  No functional change.

Reviewed by:            rmacklem
Differential Revision:  https://reviews.freebsd.org/D56560

kgss: remove unnecessary CURVNET_SET() and kgss_gssd_handle checks

These RPC methods correctly acquire the kgss_gssd_handle later with call
to kgss_gssd_client().

Reviewed by:            rmacklem
Differential Revision:  https://reviews.freebsd.org/D56561

kgss: de-virtualize kgss_gssd_handle

The RPC client is more of a class rather than an instance.  RPCs from
different VNETs are served by the same client.  This makes the kgss layer
fully transparent to VIMAGE and not even required to be aware of it.

It is responsibility of the rpcsec_gss module to have curvnet set on the
calling thread when doing RPC calls via kgssapi.

This change should enable proper operation of an NFS server with gssd(8)
in a VIMAGE jail.

PR:                     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294501
Reviewed by:            rmacklem
Differential Revision:  https://reviews.freebsd.org/D56562

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292067
MFC after:      1 month

The inotify flags are copied from the lower vnode into the nullfs vnode
so that the INOTIFY() macro will invoke VOP_INOTIFY on the nullfs vnode;
this is then bypassed to the lower vnode.  However, when a nullfs vnode
is reclaimed we should clear these flags, as the vnode is now doomed and
no longer forwards VOPs to the lower vnode.

Add regression tests.  Remove a test in vn_inotify_revoke() which is no
longer needed after this change.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292495
Reviewed by:    kib
Reported by:    Jed Laundry <jlaundry@jlaundry.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=f1f230439fa4 ("vfs: Initial revision of inotify")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D56639

MFC after:    1 week
Sponsored by:   The FreeBSD Foundation

Add following sys/fs entries to linprocfs(4):
* proc/sys/fs/file-max
* proc/sys/fs/file-nr
* proc/sys/fs/nr_open
* proc/sys/fs/overflowuid
* proc/sys/fs/overflowgid
* proc/sys/fs/suid_dumpable
* proc/sys/fs/protected_hardlinks
Also, add /proc/sys/kernel/threads-max

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294713
Reviewed by:    markj, pouria
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2159

Reviewed by:  imp, jilles
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D56536

SA_UNSUPPORTED was introduced in Linux 5.11 to probe support
for other flags such as SA_EXPOSE_TAGBITS, introduced
at the same time. Ignore both.

Signed-off-by:  Ricardo Branco <rbranco@suse.de>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289285
Reviewed by:    pouria, kib
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2163

The buggy version allowed userspace to overflow the copy into adjacent
execve KVA regions, which enables, among other things, injecting
environment variables into privileged processes.

Approved by:    so
Security:       FreeBSD-SA-26:13.exec
Security:       CVE-2026-7270
Reported by:    Ryan Austin of Calif.io
Reviewed by:    brooks, kib
Fixes:          https://cgit.freebsd.org/src/commit/?id=f373437a01a3 ("Add helper functions to copy strings into struct image_args.")
Differential Revision:  https://reviews.freebsd.org/D56665

When under heavy load or churn, inline ktls offload NICs may run out
of hardware resources described by ktls send tags.  Rather than
waiting for connections to pass through the time_wait state, reclaim
the ktls send tags early, at entry to time_wait. By preventing
potentially tens or hundreds of thousands of sessions from holding
send tags in time_wait, this allows more ktls sessions to be offloaded
to hardware.

Reviewed by: glebius, kib, nickbanks_netflix.com, rrs, tuexen
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D56610

preload: add "show preload" DDB command

This is the DDB equivalent of the debug.dump_modinfo sysctl which
outputs pretty-printed bootloader metadata.

Move sbuf_db_printf_drain to subr_prf.c and expose it for general use.

Reviewed By: jmg
Differential Revision: https://reviews.freebsd.org/D53763