FreeBSD git weekly: 2026-07-01 to 2026-09-3xi01

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

Unlike its GNU counterpart, our tail(1) has always errored out if given
repetitive or contradictory options, even prior to Keith Bostic's 1991
reimplementation.  There is no good reason to continue to do so, not
even tradition, since many other commands (including head(1)) simply
apply the rightmost option in cases like this.

MFC after:      1 week
Reviewed by:    allanjude, markj
Differential Revision:  https://reviews.freebsd.org/D58192

Now that fetchTimeout works reliably, setting an alarm is not only no
longer necessary but counterproductive, as it will trigger even if the
connection is not actually stalled but merely slow.

While here, improve the wording of the manual page's description of the
various options for setting a timeout.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57911

While preparing GPT-schemed RaspberryPi images for the NanoBSD
Reimagined GSoC 2026 project, a discrepancy was identified between
mkimg(1) and gpart(8) regarding Microsoft Basic Data partitions (GUID
!ebd0a0a2-b9e5-4433-87c0-68b6b72699c7).

Currently, mkimg(1) relies on the MBR-centric name "ntfs" to identify
this partition type under the GPT scheme.  Conversely, gpart(8)
identifies this type as "ms-basic-data".

To allow automation scripts (such as those consuming from gpart backup)
to use a common partition type across tools, add ALIAS_MS_BASIC_DATA as
a valid alias.

This is part of a larger effort to avoid a custom, MBR-based image
generation logic for embedded SoCs like the Raspberry Pi, standardizing
on GPT layouts across all supported FreeBSD embedded devices.

Reviewed by:    imp
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58198

While here, remove the long-unused dash in the first line.

Reviewed by:    ziaee, olce
Fixes:          https://cgit.freebsd.org/src/commit/?id=ddf144a04b53 ("ps.1: Revamp: Explain general principles, update to match reality")
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D58038

* Modernize the markup

* Describe the comment syntax

* Drop obsolete advice

* Capitalize sentences

* Improve the language

* Replace no_tld_query with no-tld-query; both are supported, but all the
  other multi-word options use hyphens rather than underscores.

* Add missing ENVIRONMENT section

* Redo the example

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57921

MFC after:    1 week

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Also do not start a new list for each flag item.

Reviewed by:    markj
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential revision:  https://reviews.freebsd.org/D57124

Submitted by: des
MFC after:      1 week

Submitted by: des
MFC after:      1 week

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Commit 74654ba3b1b3 added and new chflags(1) flag called
"udontcache" or "dontcache".  This patch documents this flag.

This is a content change.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58181

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58123

Document the global fetchTimeout variable, now that it works reliably.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57910

asmc: try PIO before MMIO to avoid false T2 detection

Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.

Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57844

asmc: add system state and board identity sysctls

Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).

Each sysctl is registered only if the key exists on the hardware.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57853

asmc: deduplicate sensor converters and cause sysctls

Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57854

Book-E powerpc has 64-bit bus_addr_t but only a 32-bit bus_size_t.  Use
the right macros for maxsize and maxsegsize to fix the build.

Fixes:  https://cgit.freebsd.org/src/commit/?id=4bf8ce037 ("if_rge: initial import of if_rge driver from OpenBSD.")
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57794

Depend on clknode_if.h in the module Makefile, so that it gets
explicitly built for the module.  Also, reduce the #if guards to only
the new clock output code, and gate them on all powerpc, not just
powerpc64.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6b77d34f ("HYM8563: Add support for clock output.")
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D57795

These were added during the DPAA driver rewrite, and should not have
gone in then.  Remove them.

Reviewed by:  mav
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58003

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199101
MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57929

MFC after:    1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57930

Some firmware delivers the power or sleep button press that woke the
system as an ordinary button press (Notify 0x80) shortly after resume,
rather than as the wakeup notification (Notify 0x02) the ACPI
specification requires for a button that is also a wake source.

On affected machines (e.g. the Framework Laptop 12, Intel Raptor Lake-P)
the power button is a control-method device behind the embedded
controller.  The EC latches the key press that woke the system across the
sleep transition and flushes it through its normal _Qxx query path as
soon as it is reinitialized on resume.  The replayed press is
indistinguishable from a genuine one, so the kernel honors it as a fresh
suspend request and the machine suspends again immediately after waking;
it cannot be kept awake with the button.

The event cannot be filtered at its source: it arrives over the same EC
query path that also carries legitimate events (lid, AC, thermal,
battery), so suppressing the drain would lose real notifications.
Instead, record the time of resume and ignore a button-initiated suspend
that arrives within a short grace window of it.  The timestamp is taken
before DEVICE_RESUME() re-initializes the EC, so it is set before the
replay can be processed on the ACPICA notify taskqueue; otherwise the
replay can be evaluated before the timestamp is written and slip through.
Measured from that point, the replay lands at ~600 ms across many cycles
on a Framework Laptop 12, whereas a deliberate press cannot occur that
quickly -- it happens well after the display is back -- so a one-second
window separates the two without ignoring real presses for any
perceptible time.

Spec-compliant firmware reports the wake as Notify 0x02, which is handled
on a different path and never reaches this check, so there is no change
in behavior on such systems.

The replay window is a fixed compile-time constant rather than a tunable
on purpose: it tracks a hardware characteristic -- the EC's post-resume
replay latency -- not a user policy, so there is no value a user would
meaningfully choose.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296243
Reviewed by:    adrian, imp (earlier revision), olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57712

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, still waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 25A in AF0349, before leaving Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

This fixes associating to various APs.

It worked fine to a FreeBSD AP (which is a wholly separate problem
I'm going to need to dive into) but not to my tplink AX1800 Wifi-6
router.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296503

Locally tested:

* STA: Intel Centrino Advanced-N 6205 (iwn), Lenovo T420
* AP: TP-Link AX1800 wifi-6 router

M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.

xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.

Reviewed by:    zlei, adrian
Differential Revision:  https://reviews.freebsd.org/D57495

Use kn->kn_sdata to track the last bs->total value for each knote
attached to an mmaped channel. An event is delivered only when the total
byte counter has advanced by at least c->lw since the last delivery.
After delivery kn_sdata is updated to the current total.

Each knote tracks its own watermark independently, so multiple knotes
attached to the same mmaped channel all receive events correctly.

Non-mmap channels keep the existing level-triggered behavior via
chn_polltrigger().

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D57833

arm64/vmm: Add FEAT_NV2 definitions

Add the definitions for the VNCR_EL2 register and all of the offsets
to registers in memory relative to the page stored in VNCR_EL2.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56550

arm64/vmm: Use the VNCR_EL2 memory page to store guest registers

Wherever possible, move the storage space for guest register values from
the hypctx struct into a preallocated memory page matching the layout of
the page pointed to by VNCR_EL2.
This will streamline implementing support for nested virtualization, but
the implementation itself is not reliant on the presence of nested
virtualization architecture features.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56551

arm64/vmm: Store non-VNCR registers in an array

Move non-VNCR EL0 and EL1 registers into a dedicated array inside of
hypctx. This enables uniform accesses to both VNCR and non-VNCR guest
register state through hypctx_[read|write]_sys_reg().

The accessors are _not_ used for non-VNCR EL2 registers in order to
create a clear separation between guest-visible and guest-invisible
register state.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56552

arm64/vmm: Refactor vmm_hyp.c

Refactor vmm_hyp.c to split register reload logic by type of register,
streamline the implementation and improve readability.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56553

arm64/vmm: Move vttbr_el2 & vtimer into struct hypctx

Move vttbr_el2 & vtimer from struct hyp into struct hypctx to streamline
the logic and handle them in the same way as other *_el2 registers are
already being handled.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56554

arm64/vmm: Move host-side EL2 regs into sys_regs

Move EL2 host registers that are not visible to the guest into
hypctx->sys_regs. Prefix them with HOST_ to distinguish from EL2
registers which are part of the guest's own state (e.g. in VNCR).

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56555

arm64/vmm: Make remaining registers use hypctx_*_sys_reg

Move vgic, timer and trapframe registers into sys_regs to handle them
in the same way as all the other registers.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56556

Fix tid_set_busy() for when `pmap` is NULL. Obviously a NULL pointer
cannot be correctly used, so I'm not sure how it worked in testing on
64-bit.

When the TID rolls over on a given CPU, simply flash-invalidate the
TLB instead of walking the TLB to only invalidate the repurposed TID.
Walking 256 entries is expensive, and we'll likely be inserting a bunch
new ones anyway in the new environment, since 256 really only handles
1MB of storage, so the likelihood of other mappings continuing to exist
in the TLB when their thread owner is scheduled again is very very
small.

DEVX event notifier returned true for the command-completion and
page-request events. This is causing mlx5_eq_int() to skip the core EQ
handler, so the firmware command interface and the page supply stop
being serviced and the device wedges.

This commit also make notifier registration and dispatch safe against
the EQ interrupt running concurrently: publish the table pointer before
the callback and load it with acquire semantics. run the callback under
RCU, and drain it with synchronize_rcu() on teardown. Otherwise the
interrupt handler could observe a half-initialized notifier or race with
cleanup.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commits a8b92ca1b0e5ce620e425e9d2f89ce44f1a82a82
and c59450c463695a016e823175bac421cff219935d.

The DEVX object and method definitions were already present, but nothing
pointed ib_device.driver_def at them.  ibcore therefore never merged
them into the uverbs uapi tree and every DEVX ioctl came back as
EPROTONOSUPPORT.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 342ee59de98a2ecdf15a46849a2534e7c808eb1f.

The dynamic UAR object was declared in the ABI headers but had no handler,
so the ioctl was rejected and dynamic-UAR contexts could not allocate a
doorbell UAR at all.

Implement the alloc and destroy methods following the upstream driver:
grab a UAR stamped with the caller's DEVX uid, expose it to user space
through an rdma_user_mmap entry (write-combining or non-cached as
requested), and free it on destroy.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

A firmware object owned by a DEVX uid may only reference resources owned
by the same uid or ones explicitly marked as shared.  Completion EQs
were created with uid 0, so a CQ owned by a DEVX uid could not attach to
its EQ and CREATE_CQ failed with "bad resource".

Create completion EQs with MLX5_SHARED_RESOURCE_UID on devices that
support user contexts, so uid-owned CQs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: allocate IB queue counters as a shared resource

A QP owned by a DEVX uid references the port's queue counter.  The
counter was allocated with uid 0, so RST2INIT_QP on a uid-owned QP
failed with "bad resource state".

Allocate and free the IB queue counters directly and, on devices that
support user contexts, stamp them with MLX5_SHARED_RESOURCE_UID so
uid-owned QPs can use them.

The code follows the Linux commit d2c8a1554c10d5e0443b1f97f480d7dacd55cf55
("IB/mlx5: Enable UAR to have DevX UID").

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: encode dynamic UAR mmap offsets in the reserved command range

The UAR ioctl handed user space a raw mmap offset, so the first dynamic
UAR landed at page offset 0.  mlx5_ib_mmap() decodes offset 0 as the
legacy regular-page command and routed the mapping through the old bfreg
path, which rejects dynamic-UAR contexts, so mmap() failed with EINVAL
and mlx5dv_devx_alloc_uar() returned NULL.

Follow the upstream scheme: reserve the mmap command range [9, 255] for
rdma_user_mmap entries and return command-encoded offsets, so the
dynamic-UAR mappings decode to the intended mlx5_ib_mmap() path.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5ib: advertise write-combining support for dynamic BlueFlame UARs

Import Linux upstream commit 1f3db161881b7e21efb149e0ae8152b79a571a8f.

dev->wc_support was never set, so it was always false and the UAR ioctl
refused BlueFlame (write-combining) UAR allocations with EOPNOTSUPP.
That breaks QP creation in pure dynamic-UAR mode, where user space asks
for a BF doorbell UAR.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: pass the full EQE to the DEVX event notifier

The DEVX event notifier and its helpers expect a full struct mlx5_eqe
and read eqe->data from it, but mlx5_eq_int() passed &eqe->data, so the
data offset was applied twice.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: guard against a NULL CQ event handler in mlx5_cq_event()

DEVX and mlx5en created CQs are registered without an asynchronous
event handler (mcq.event is NULL).  An asynchronous CQ_ERROR event for
such a CQ made mlx5_cq_event() call through a NULL pointer and panic.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

mlx5: propagate the DEVX uid through SRQ create and destroy

The SRQ command builders never stamped the owning DEVX uid into the
firmware CREATE_SRQ/CREATE_RMP/CREATE_XRC_SRQ commands, so a basic SRQ
was always created with uid 0.  Every modern libmlx5 context runs with a
DEVX uid, and the QPs that reference the SRQ carry that uid, so firmware
rejected CREATE_QP with "bad resource": a uid-owned QP may not reference
a uid-0 SRQ.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

The thermal interrupt is initially masked.

Thermal interrupt handling is enabled by calling lapic_enable_thermal(),
which installs a (single) handler.

[olce: Wrote the commit message.]

Reviewed by:    kib, olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D44454

acpi: Add a pseudo-bus for APEI devices to manage resources

Different APEI tables can reuse the same registers (and sometimes
different views of the same register, e.g. 32- vs 64-bit mappings of
the same register).  To enable this sharing, apei0 now acts as a bus
device managing a pool of allocated resources and handing out mappings
to child devices which handle individual tables.

Most of the previous apei(4) driver has been moved into a new
hest0 device that is a child of apei0.

Reviewed by:    gallatin
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58024

acpi: fix instant panic in hest_attach()

Since now there is a pseudo-bus between our device and acpi0, we need to
go deeper.

Fixes:  https://cgit.freebsd.org/src/commit/?id=9313f6b01485ad9a0b7cc59b459f5714533587c3

Fixed the post-LPS delay from 500us to the IEEE 1394a-2000 s6.1 mandated
10ms ceiling. Handled PHY_INT by clearing W1C status bits in register 5
(masked ISBR to avoid spurious bus resets). Added a SID timeout callout
that recovers the state machine when a remote device fails to complete
self-ID. Fixed FW_PHY_SPD operator precedence and gated noisy messages
behind bootverbose/firewire_debug.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58033

fwcam: add dynamic resolution and frame rate support

Read V_MODE_INQ and V_RATE_INQ registers for all supported formats
during probe, caching the camera's actual capabilities.  Use these
to validate SMODE ioctl requests before writing to the camera.

Writing an unsupported combination caused the camera to
stop responding, requiring a physical power cycle.

Tested with: Apple iSight (external FireWire)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58090

fwcam: set ISO speed from device link speed

iso_speed was never initialized, defaulting to S100 regardless of the
camera's actual link speed. Some cameras firmwares reject ISO_EN
when the speed field in the ISO_CHANNEL register
does not match their capabilities.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58091

fwcam: write video mode registers before enabling ISO streaming

The IIDC spec (s3.1) requires the video mode to be programmed before ISO
enable. Without this, cameras that power up with invalid default
mode/rate combinations reject the ISO_EN write.

This can happen when the firmware of teh camera is outdated or
vendor never updated it.

Differential Revision:  https://reviews.freebsd.org/D58092

Sponsored by; The FreeBSD Foundation
MFC after:      1 week

Sponsored by: The FreeBSD Foundation
MFC after:      1 week

Moved ISO start to first usage. Opening the device now
only validates state and increments the open count, allowing info
queries and mode changes without starting the camera. ISO streaming
begins on demand when userland first reads frame data.
This avoid the camera led to turn-on at attach.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58100

Some IIDC cameras power down the sensor when inactive (e.g. lens
cover closed) and reject ISO enable with EIO. Re-power the camera
and retry once before failing.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58101

MFC after:    1 week
Sponsored by:   The FreeBSD Foundation

USB vendor:product 184f:0051

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56794

This can't be a loadable module, so add it to MINIMAL

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58067

This makes the code slightly more compact and easier to read.

No functional change intended.

Reviewed by:    bnovkov
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58110

The thermal LVT slot does not necessarily exist.

According to Intel's Software Developers Manual, for Intel processors
supporting 64-bit operation (amd64), probably even the earliest ones
should have a local APIC with such a slot (the slot was introduced with
Pentium 4 and Xeon processors according to the manual, and the 64-bit
implementation in some later versions of them).  AMD's Architecture
Programmer's Manual also seems to imply that all AMD processors
supporting amd64 should have the slot too.  So this change may not be
needed when i386's code is dropped, but it does not hurt to have it, and
it might ease possible MFCs.

Change the signature of lapic_enable_thermal() so that it can report
failure (if there is no local APIC or if there is no thermal LVT slot).

Reviewed by:    bnovkov, kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58086

Differential Revision:        https://reviews.freebsd.org/D56923
Reviewed by:    mhorne

This change implements the equivalent of the amd64-specific
'show pte' ddb command used to dump the page table entries
associated with a specific virtual address.

Differential Revision:  https://reviews.freebsd.org/D56924
Reviewed by:    mhorne

Spurious page faults caused by cached invalid entries may occur when
starting APs and potentially panic the kernel if we're running in
a non-sleepable context.

Fix this avoidable panic by flushing the TLB after the AP is released.

Differential Revision:  https://reviews.freebsd.org/D57003
Reviewed by:    markj

The Privileged ISA specification permits caching of invalid PTEs
12.2.1. Supervisor Memory-Management Fence Instruction), which may
result in a spurious page fault. Such faults are handled by 'pmap_fault'
which locks the kernel pmap before inspecting and possibly updating the
offending L2 entry.
Unfortunately, spurious faults may also occur when we're already holding
the kernel_pmap lock or running in a critical section, where any attempt
to grab the pmap lock will result in a kernel panic.

Fix this avoidable panic by performing a lockless lookup to determine
whether a valid kernel mapping exits and flushing appropriate TLB entry.

Differential Revision:  https://reviews.freebsd.org/D56925
Reviewed by:    jrtc27, mhorne, markj

Using cpu_get_pcpuid() directly or having a CPU ID cache does not really
make any significant difference.  With cache: Less function calls, less
space on stack, but an additional allocation in the softc, who stays
permanently.  Without cache: Some function calls, but one less slot in
the softc, and no data duplication (but that info never changes).

The main reason for this change is to reduce conflicts with some
work-in-progress by aokblast@.

While here, move the check that a per-CPU structure is provided by the
bus from the attach to the probe method, as it is already used by
hwpstate_probe_pstate() there.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

To minimize the diff with hwpstate_intel(4).  See previous commit there
for the rationale.

Reviewed by:    aokblast
Sponsored by:   The FreeBSD Foundation

KVM does not always use 0x40000000 as its CPUID base. For example, QEMU
adds a 0x100 offset when nested virtualization is detected and the host
exposes Hyper-V enlightenment hints. To accommodate this behavior,
switch the detection logic to use the CPUID leaf returned by do_cpuid(),
making the implementation more flexible.

See:
https://github.com/qemu/qemu/blob/master/target/i386/kvm/kvm.c#L2300

Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58146

Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
triggering SSP when ntpd set the time on the RockPro64, at the very
least.  A minor oops meant that the weeks mask was getting tossed into
the wrong field, and the mask was never populated.  The mask is 0x7 for
all three of these, thus overflowing the `data` array in settime by one
byte.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296719
Reported by:    jsm, "Tenkawa" on Discord
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D58182

Using if_getflags() to check IFF_DRV_RUNNING is wrong;
if_getdrvflags() is required.  This issue resulted in the
multicast filter not being updated.

This was an oversight by me in my initial port.

Thanks to danilo@ for reporting it and Oleg <oleglelchuk@gmail.com>
for the fix.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295176

Currently, devd emits events for external adapters only.

Send Netgraph init/disconnect events to devd so the internal adapter's
state could be asserted from userland.

(adrian - indentation changes.)

Signed-off-by: Kirill Orlov (-k) <slowdive@me.com>
Reviewed-by: adrian, imp
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2196

Matches tcpdump naming, but without getting more intense as you add more
-t.  This slightly reduces the post-processing needed on usbdump output
to diff two transactions.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D58196

Introduce fdt_ether_get_addr() in fdt_common.c/h that tries standard
DT properties in the correct order and falls back to a random address
when needed. This should be used by ethernet drivers instead of open-coding
the same logic.

MFC after:      2 weeks

Reviewed by:    mhorne, adrian, bz, jrtc27
Differential Revision:  https://reviews.freebsd.org/D58104

Update ieee80211_crypto_init_aad() to do what 802.11-2020 says -
only mask fc[0] bits 4-6 on data frames, not on management frames.
This (with other diffs to actually negotiate MFP and configure
ath(4) for MFP + software keys) allows the CCMP path to decrypt
CCMP MFP frames in the software path.

Differential Revision:  https://reviews.freebsd.org/D57799

There is no visible bug fixed as in current tree masks are the same.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6883b120c53735ff1681ef96d257f376731f56b3

Add const-qualified versions of the NLA iteration helpers to allow
walking immutable netlink attribute buffers without discarding const
qualifiers.

This introduces NLA_NEXT_CONST(), _NLA_END_CONST(), and
NLA_FOREACH_CONST() in netlink_snl.h.

Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by : Google LLC (GSoC 2026)

Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.

Reviewed by:    markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D54175

Revert pf_nl.h part of 017690e50913 and use new libsysdecode build glue
that parses enums.

Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D57866

The historical design of sockets is that on a re-connect the disconnect is
performed at the socket layer in soconnectat().  Since SMP times this is
known to be racy and the function has appopriate comment.  I missed that
in the recent change.  The pr_connect method should normally expect the
socket to be already disconnected, however should be able to handle a race
where socket is actually connected.  Convert the check that incorrectly
tried to handle normal path of re-connect into check that handles the
race.

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ece716c5d34728a170f1dfe1b3389c267d6ddd1e

The ```int disable``` parameter is included in the bridge_stop function
signature but is not used in the function body.

I had noticed this when tracing the driver's path while learning more
about the ifnet library.

This parameter originally appeared when importing the driver from NetBSD.
However, the FreeBSD ifnet library no longer requires an if_stop function.
Meaning that the function signature can be changed to only contain needed
parameters for our bridge driver.

Discussed with: freebsd-net@ mailing list
Signed-off-by:  Acesp25 <acesp25@freebsd.org>
Reviewed by:    kp
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2290

A mistake from 90ea8e89d9b7 is that in6_pcblookup_internal() was skipped
for an inpcb that had unspecified local address.  This is incorrect, as
such inpcb could have already have a port set, and in_pcb_lport_dest()
shall not be called on such inpcb.  That could lead to creation of an
alised connection in the database.

This makes the function almost identical to in_pcbconnect().  While here,
fix minor bug of missing INP_ANONPORT.  This flag has no use in kernel,
but affects netstat(1) output in certain mode.

Fixes:  https://cgit.freebsd.org/src/commit/?id=90ea8e89d9b751e8b5ae90ef3397883b035788e5
Reviewed by:            pouria
Differential Revision:  https://reviews.freebsd.org/D57987

And make net.inet.ip.portrange.randomized boolean.

Reviewed by:            pouria, tuexen, markj
Differential Revision:  https://reviews.freebsd.org/D57291

Enable IFCAP_MEXTPG by default, which may bring performance benefits.
Allow it to be disabled, and when disabled assert that we do not receive
any mbufs with M_EXTPG set. This is useful for testing.
Default the tests to disabling MEXTPG support.

Reviewed by:    zlei
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D58054

The network layer must not pass unmapped (M_EXTPG) mbufs to if_output()
of network interfaces without IFCAP_MEXTPG. pf should convert these
mbufs by mb_unmapped_to_ext() for such interfaces but it didn't.
The problem had occurred on sendfile because sendfile system call
uses unmapped mbufs for the file data.

Reported by:    feld
Reviewed by:    kp, glebius
Differential Revision:  https://reviews.freebsd.org/D58021

Some nic drivers (including iflib) do not initialize if_hwassist
until after the interface is brought up.  If a lagg member is included
in a lagg when its not yet been brought up, that will cause lagg to see
if_hwassist=0 and will disable all checksum offload, etc, on the interface.
This is almost impossible to debug without kgdb or dtrace, as ifconfig does
not surface if_hwassist.

Fix this by re-calculating lagg caps (including if_hwassist) after adding a port.

I encountered this problem when I had a commented-out if_foo1=up entry in
my rc.conf that i neglected to uncomment when I was re-configuring a lagg.

Sponsored by: Netflix
Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D58062

RFC 4391 (IP over InfiniBand), section 9.3, lays the ND source/target
link-layer address option out as type, length (3), two reserved zero
octets, then the 20-octet IPoIB link-layer address.
The ND code assumed the Ethernet layout (RFC 4861, section 4.6.1)
everywhere and read/wrote the address directly after the option
header, i.e. two octets early.
The option-length sanity check computes 24 for both layouts for
a 20-octet address, so the mismatch was silent.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296585
Reviewed by:    adrian, pouria
Sponsored by:   VersatusHPC
Differential Revision: https://reviews.freebsd.org/D58096

From openssh-portable commit c14709356563.

Reported by:    cy

Fixes:        https://cgit.freebsd.org/src/commit/?id=e7d02be19d40063783d6b8f1ff2bc4c7170fd434
Signed-off-by:  Yusuke Ichiki <public@yusuke.pub>

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295434

Update nexthop flags with interface link status events and
instead of checking link status of interface for every packet
only check the reachability flag of the final nexthop.

Reviewed by:    glebius
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D57375

If a nhop gets an interface event, revalidate the nhops and
immediately try to recompile existing nexthop groups by
replacing unreachable nexthops with reachable ones.
If none are available, recompile them back to
their normal position in nexthop group slots.

Reviewed by:    glebius
Discussed with: markj
Relnotes:       yes
Differential Revision: https://reviews.freebsd.org/D57389

Provide a name for SCTP sockets.

Fixes:          https://cgit.freebsd.org/src/commit/?id=8b2b62b49d88 ("sockstat: consolidate unix(4) protocols in the array of protocols")

The same variable was used as a counter for an inner and out loop.
Add a new one for the inner loop.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283934
Reported by:    crest at rlwinm.de

This tool supports two commands.  The list command outputs a summary
of injectable errors supported by the current system.  The inject
command injects the requested error.

Reviewed by:    gallatin, imp
Sponsored by:   Netflix
Differential Revision:  https://reviews.freebsd.org/D58026

LOG_CONS was OR'd into the facility argument instead of logopt, leaving
logopt as 0.  The correct call is openlog(ident, LOG_CONS, LOG_AUTH),
as shutdown(8) and init(8) already do.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296315
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, des
Pull Request: https://github.com/freebsd/freebsd-src/pull/2300

By default bhyve(8) creates a snapshot socket in
"/var/run/bhyve/" (BHYVE_RUN_DIR).
As this is a system directory not writable by users,
this does not work when bhyve(8) is being started
as a non-root user.

Address that by allowing to override this directory.
In bhyve(8) it is done by setting 'rundir' option
with '-o rundir=<path>'.

In bhyvectl(8) it is done with '--rundir=<path>'.

MFC after:              1 month
Reviewed by:            bcr (manpages), bnovkov
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57494

The download protocol calls download_data with FileOffset and
BufferLength of 0 first to start the download (no data yet
available). Calls it again with BufferLength == 0 and FileOffset the
size of the download (again, no data). It then starts calling with
BufferLength != 0 and FileOffset == 0 to start the download. The
heuristic I used to detect the start was wrong, so we'd allocate the
buffer twice. Fix that by being more explicit and not using the
heuristic that was bogus.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D58068

The end address is the final byte in the array, not one byte past the
end of the array, so we need to add 1 to get the full length.

Fixes: https://cgit.freebsd.org/src/commit/?id=59219fc76a4b ("loader.efi: efiblk_memdisk_preload passes the VirtualDisks to FreeBSD")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58069

This code is simpler when we spell it the Unix way. Also, add sanity
checks to make sure the offset is where we think it is.

Fixes: https://cgit.freebsd.org/src/commit/?id=afee781523e4 ("loader.efi: Recognize new memdisk=<url> and memcd=<url> options")
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58070

kldxref -m <file> will print the same data that the '-d' flag produces,
except restrict the output to one file. This should be the full path to
the file, and the directory name to process is omitted.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D57902

Reviewed by:  jfree, kib
MFC after:      3 weeks
Differential Revision:  https://reviews.freebsd.org/D58160

loader: Add xzfs, like gzipfs but with xz.

This is just like gzipfs or bzipfs, except done with the newer xz
program. This is off by default for the moment.

Sponsored by:           Netflix

loader: zstd based filesystem, zstdfs like gzipfs

Off by default.

Sponsored by:           Netflix

loader: Add forgotten xz.c and zstdfs.c

These were overlooked when I added compression support.

Fixes: https://cgit.freebsd.org/src/commit/?id=86d719ae68aa ("loader: Add xzfs, like gzipfs but with xz.")
Fixes: https://cgit.freebsd.org/src/commit/?id=c61ee49cd06a ("loader: zstd based filesystem, zstdfs like gzipfs")
Sponsored by:           Netflix

zonectl's Report Zones subcommand displays a tabular list of zones.  A
conventional zone's WP column is displayed as 0xffffffffffffffff , the
literal value that the HDD reports.  But that's too wide for the column,
causing the text to be misaligned.  It's also not really meaningful,
because the Write Pointer isn't really defined for a Conventional zone.
Change it to "-1" to fix the text misalignment.

MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    fuz
Differential Revision: https://reviews.freebsd.org/D57512

This allows pkg(7) to be used to bootstrap a jail or chroot, and to
recognize the -j and -r options and pass them through to pkg(8) if
already bootstrapped.

Note that this does not address the issue of repository keys.  If using
a signed package repository, you will still need to copy /usr/share/keys
into the target environment before or after bootstrapping, or pkg will
be unable to verify package signatures.

MFC after:      1 week
Reviewed by:    imp, bapt
Differential Revision:  https://reviews.freebsd.org/D58165

Fixes:        https://cgit.freebsd.org/src/commit/?id=255538cd906045095d0c2113ae6c4731ce36c0cf
Differential Revision: https://reviews.freebsd.org/D57850
Reviewed by:    adrian

MFC after:    1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=c3276e02beab ("sockets: make shutdown(2) how argument a enum")
Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D57915

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296410
Submitted by:   Tomas Vondra <tomas@vondra.me>
MFC after:      1 week

libsysdecode: decode Generic Netlink controller messages

Decode Generic Netlink controller (GENL_ID_CTRL) messages in
Netlink payloads. Display the Generic Netlink header along with
the CTRL_CMD_GETFAMILY attributes, including the family ID and
family name.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: cache Generic Netlink family IDs

Record Generic Netlink family IDs learned from
CTRL_CMD_GETFAMILY responses and use them to decode subsequent
Generic Netlink messages using symbolic family names instead of
numeric IDs.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: decode PF Generic Netlink commands

Decode the Generic Netlink command header for messages
belonging to the PF Generic Netlink family. Display the
command name using the PF Generic Netlink command decoder.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libc/resolv: Drop Solaris 2 compatibility

MFC after:      1 week
Reviewed by:    kevans, markj
Differential Revision:  https://reviews.freebsd.org/D57922

libc/resolv: Refactor the option parser

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

libc/resolv: Refactor the configuration parser

This was previously all a single loop in res_init(), apart from option
parsing which we cleaned up in a previous commit.  Break it out into
separate functions for reading the configuration line by line, setting
the default domain, setting the search list, and adding a nameserver
to the nameserver list.  Sprinkle bounds checks and code comments all
around.

The sortlist code, which has been disabled for the past 20 years, will
be dealt with in a separate commit.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57924

libc/resolv: Reimplement the sortlist parser

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

libc/resolv: Add no-debug and no-rotate options

These are simply the reverse of the debug and rotate options.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57926

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57927

getfacl / acl_to_text() incorrectly prints uid/gid numbers as signed integers.
This causes uid / gid numbers larger than 2G (2147483648) to print as
negative numbers.
The libc acl_from_text() function does not handle negative numbers.
This diff adds a backwards compatiblity fix to allow negative numbers...

Reviewed by:    rmacklem
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57180

While here, clean up and simplify the existing code.

MFC after:      1 week
Reviewed by:    glebius, jhb
Differential Revision:  https://reviews.freebsd.org/D57993

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

libfetch: Overhaul socket read / write

* Make fetch_ssl_read() and fetch_ssl_write() behave more like read(2)
  and write(2), and drop fetch_socket_read() in favor of read(2).

* Don't request POLLERR, it's implied.

* Don't needlessly set errno, it's relatively costly.

* Always check for EAGAIN from writev(2), otherwise we will abort on a
  short write instead of proceeding to poll(2).

* Always check for EAGAIN from poll(2) even though it can't happen on
  FreeBSD; POSIX says it can, and it might in the future.

* Rewrite fetch_read() and fetch_writev() to be more similar to each
  other.  The main difference is that a partial read is treated as
  success while a partial write is treated as failure.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296316
MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57906

libfetch: Add read buffering

Previously, we would read FTP control connection messages and HTTP
reponse headers one character at a time.  Now, we read as much as will
fit in our buffer and look for a newline.  If there is data left over,
it will be reused by the next fetch_getln() call.  This also requires
the addition of a fetch_bufread() which takes the buffer into account,
otherwise the start of the HTTP response body will be stuck in the
buffer after we read the last line of the header.

This should noticeably improve HTTP performance, especially for small
transfers.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57907

libfetch: Apply timeout to connection attempts

Mark the socket non-blocking before connecting and poll for completion,
applying fetchTimeout if set.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57909

Make fetch_ref() an inline and provide a fetch_deref().

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D57944

Reduce the amount of copying we do when performing buffered reads.

MFC after:      1 week
Reviewed by:    op
Differential Revision:  https://reviews.freebsd.org/D58113

Reviewed by:  zlei, vmaffione
Obtained from:  https://github.com/luigirizzo/netmap/commit/b52a2bcae35e56548acfb0849b248a1e4b0c0c3b
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58150

Reviewed by:  zlei, vmaffione
Obtained from:  https://github.com/luigirizzo/netmap/commit/7d9177ed9a121e66bf4eaa0acb5d574e408297da
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58151

Rename am_lock description from autofslk -> autfsm.

The lock description, autofslk, is used as the description for
autofs_softc->sc_lock, which is used to protect autofs requests and the
like as opposed to am_lock which protects autofs nodes for a given
mount.

This change allows witness to distinguish different lock orders for each
lock.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57972

The OpenZFS merge 80aae8a3f8aa introduced HAVE_SIMD() which checks for
HAVE_TOOLCHAIN_* defines via simd_config.h.  The kernel module Makefile
was updated, but kern.pre.mk (static kernel build) and the libzpool/libzfs
Makefiles were missed, still using the old HAVE_SSE2 etc. names.  This
caused all vectorized raidz, fletcher, and blake3 implementations to be
compiled out.

The consequences are:
- for nfs exports and fhopen(2), unlinked but still referenced inodes
  are accessible
- for ffs_vput_pair() with unlock_vp = false, spurious ESTALE is not
  returned when the inode is still alive but unlinked

Note that tmpfs does not return ESTALE for the unlinked nodes.
The same behavior is claimed for Linux in
https://github.com/openzfs/zfs/issues/18699

Reviewed by:    rmacklem
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57982

Fix two locking violations that could happen during execve, while
executing a file stored on fusefs.  Both would cause panics on an
INVARIANTS kernel after 15.0, or a DEBUG_VFS_LOCKS kernel prior to that.
Neither is likely to be noticeable on a release kernel.

* Don't assume that the vnode is exclusively locked during VOP_CLOSE.
  It usually is thanks to !MNTK_LOOKUP_SHARED, but isn't during execve,
  which locks the vnode outside of the lookup path.

* Totally rewrite fuse_io_invalbuf.  It's had a number of problems ever
  since its original introduction[^1]:

  - Don't assume that the vnode is exclusively locked.  That assumption
    failed during execve just like the assumption in fuse_vnop_close.

  - Don't livelock forever if vinvalbuf returns ENOSPC or EDQUOT.

  - Don't attempt to handle multiple threads calling this function at
    the same time.  That would be impossible if the vnode truly were
    exclusively locked.  So the code was dead.  Or it would've been, if
    the assumption hadn't been wrong.  Furthermore, both vinvalbuf and
    vnode_pager_clean_sync only require a shared vnode lock, and are
    already capable of dealing with multiple simultaneous callers.

  - Using fvdat->flag in this way would require some sort of mutex
    protection, if the vnode weren't exclusively locked.

 * Add new test cases that trigger both of the aforementioned panics.

[^1]: https://github.com/glk/fuse-freebsd/commit/efe6eb3005e7633b4e31d5e453eacbaa0cba42fa

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295957
Reported by:    dan.kotowski@a9development.com
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D57536

Previously, an_vnode_lock was initialized with SX_NOWITNESS to silence
lock order reversals. The reversals would occur when autofs_node_vn()
was called with the directory vnode lock held, then lock an_vnode_lock,
then lock the vnode attached to the autofs node. It looked like:

    directory vnode -> an_vnode_lock -> vnode attached to autofs node

The established lock order is now vnode -> an_vnode_lock

Currently, we don't have to worry about losing an autofs node during the
unlock/lock as autofs nodes are only removed during an unmount() after
vflush(). When autofs_node_vn() is called, the mountpoint has either
been busied (preventing unmount) or a directory vnode is locked which
prevents vflush() from finishing until the directory vnode is unlocked.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57857

Commit 016570c4463d modified the client to handle
the upgrade of a read delegation to a write delegation,
where the server provides the same delegation stateid
to the client.  However, it failed to check if the
delegation structure was currently in use.  Without this
patch, if the structure was in use, a use after free
could occur.

This patch handles the "in use" case by copying the
necessary fields into the current/old structure and
free's the new one instead of the old one that is
"in use".

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296224
MFC after:      2 weeks

Skip UFS2 fs_metaspace upper-bound validation that rejects NetBSD FFSv2
WAPBL filesystems due to differing superblock layouts.

Detect the condition during mount instead and permit read-only mounts
while rejecting read-write mounts with EROFS.  This follows NetBSD's
recommendation for systems without WAPBL support and avoids modifying
unsupported journal metadata.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296022
Signed-off-by: Ricardo Branco <rbranco@suse.de>
Reviewed by: imp, kirk
Pull Request: https://github.com/freebsd/freebsd-src/pull/2279

nfsd: Garbage collect stray NFSv4 state

When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.

This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.

While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.

Reported by:    Richard Purdie <richard.purdie@linuxfoundation.org>
Tested by:      Michael Halstead <mhalstead@linuxfoundation.org>
MFC after:      2 weeks

nfsd: Commit missing patches for c52bcd09c2a6

Oops, I missed the other files for the commit.

This should fix the build.

Pointy hat goes on me.

MFC after:      2 weeks
Fixes:  https://cgit.freebsd.org/src/commit/?id=c52bcd09c2a6 ("nfsd: Garbage collect stray NFSv4 state")

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.

Reviewed by:    gallatin, markj
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D57973

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)

LTP open13 expects these operations to fail with EBADF, matching
Linux behavior, but FreeBSD currently returns EOPNOTSUPP
for fgetxattr() on an O_PATH fd

Look up Linux fd-based xattr descriptors with getvnode()
and route the operations through shared kern_extattr_*_fp()
helpers so the O_PATH check and the extattr operation use the
same referenced file.

Apply the same EBADF handling to fsetxattr(), fremovexattr(), and
flistxattr() so the xattr paths stay consistent.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295537
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

linuxulator: Fix operator precedence for LINUX_XATTR_FLAGS in setxattr()

The LINUX_XATTR_FLAGS macro expands to (LINUX_XATTR_CREATE|LINUX_XATTR_REPLACE).
Without parentheses around the macro expansion, the bitwise & operator has
higher precedence than |, causing incorrect flag evaluation and a compiler
warning.

Add the missing parentheses around LINUX_XATTR_FLAGS to ensure correct
operator grouping, matching the existing usage in getxattr().

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=2c905456312b ("linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)")
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2306

Move the atomic size-probe-and-read logic into a new
linux_extattr_get_vp() function in linux_xattr.c instead of
modifying the generic extattr_get_vp() in vfs_extattr.c.
This keeps Linux-specific getxattr semantics (ERANGE on
too-small buffer, EOPNOTSUPP to ENOATTR mapping)
self-contained within the linuxulator.

The function probes the attribute size and reads the data
under a single vnode lock, preventing a TOCTOU race between
the size probe and data read.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

CHERI: declare mem{cpy,move}_data

Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices).  On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance.  This reduces the risk of accidental spread of
pointers on CHERI systems.

Document that bcopy preserves pointer provenance.

Reviewed by:    ziaee, kib, adrian, markj
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57662

CHERI: add sooptcopyinptr to preserve pointer provenance

Most socket options don't involve pointers so make the default
sooptcopyin discard provenance and add a sooptcopyinptr that preserves.

Reviewed by:    markj, emaste
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57665

CHERI: make mem{cpy,move}(9) CHERI compatible

- Use intptr_t in place of long as the word type in the core copying
  loop where aligned words a copied.  This preserved the provenance of
  any copied pointers.
- When working with the address of src or dst use ptraddr_t rather than
  uintptr_t.  This avoid ambigious provenance in expressions involving
  multiple addresses.

As a minor tweak, rename the function to memmove since that is the
interface it implements (overlapping src and dst are permitted) and make
memcpy the alias rather than the other way around.

Reviewed by:    kib, markj
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57965

fetch.9: fix a typo

Fixes:          https://cgit.freebsd.org/src/commit/?id=a1c52e05f571 ("CHERI: declare fueptr and suptr")
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK

Fixes:                https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by:    glebius
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57967

Attaching to a jail changes its root directory and its process
credentials. These operations both require unlocking the jail, and also
need allprison_lock unlocked. That means that if two threads are trying
to attach to different jails at the same time, it's possible for the
process to end up with one jail's root directory but the other jail's
credentials.

Solve this by forcing the process into single-threaded mode during
system calls that attach to a jail (jail_attach, jail_attach_jd, and
sometimes jail_set).

Reviewed by:    kib, markj
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57858

If git is installed and .git exists but git rev-parse failed to report a
hash we previously produced just "-dirty" as the git revision.  Gate the
git commit count and -dirty check on the rev-parse passing.

Reviewed by:    jlduran
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57995

It is a handy shortcut that will be used extensively in
hwpstate_intel(4) and hwpstate_amd(4).

Warn users that it panics if the parent bus does not provide the
CPU_IVAR_PCPU instance variable.  That condition should be tested by
callers (doing so once is enough).  Suggest to do that in driver's
attach method.

Reviewed by:    jhb (code)
Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57897

This makes the header more self-contained.
The symbol is needed only on 32bit arches, but the include file is
provided unconditionally to make the namespace population predictable.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296489
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

When a GID table entry is empty or not yet present in the cache,
show_port_gid() falls back to printing a zero GID.  Use the existing
GID_PRINT_FMT/GID_PRINT_ARGS helpers instead of Linux's %pI6 format,
which FreeBSD printf treats as a pointer followed by "I6".
This makes empty GID sysctl entries consistently report
0000:0000:0000:0000:0000:0000:0000:0000.

Tested by:      Wafa Hamzah <wafah@nvidia.com> (mlx5_ib)
Reviewed by:    jhb, kib
Sponsored by:   NVIDIA Networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential Revision:  https://reviews.freebsd.org/D58042

inotify: Unconditionally generate IN_IGNORED events for files/dirs

The implementation previously only generated an IN_IGNORED event for a
deleted watched file if the watch explicitly requested IN_DELETE_SELF.
This is not correct, IN_IGNORED should always be raised when the watched
subject is deleted.  Adjust the implementation of inotify_log_one()
accordingly.

This also fixes a problem where a deleted watched file's watch
would not be removed if IN_DELETE_SELF was not in the watch's event
mask, in which case the unlinked vnode would linger until the inotify
descriptor itself is closed.

Add a regression test.

Reported by:    jrtc27
Reviewed by:    jrtc27
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58050

inotify: Ensure that "allocfail" is initialized in inotify_log_one()

Fixes:  https://cgit.freebsd.org/src/commit/?id=b70997c8c75a ("inotify: Unconditionally generate IN_IGNORED events for files/dirs")

jaildesc_alloc() finishes initializing the file structure only after it
is made visible from the file descriptor table via finit().  In that
window, other threads could try to perform operations on the descriptor
and thus access an incompletely initialized jaildesc.

Defer the finit() call until locks are initialized.  While here,
simplify the error path for falloc_caps().

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58049

dtrace: Improve DOF section size validation

The loop which validates each DOF section assumes that the section
header is present, so the section size must be at least as large as the
header, otherwise a small OOB access is possible.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57975

dtrace: Fix DOF section bounds validation

We must ensure that each DOF section does not overlap with the DOF
header or section table.  Otherwise the relocations processed in the
second pass over sections can manipulate DOF metadata, leading to OOB
writes.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57976

dtrace: Improve DOF string table validation

The check for a nul terminator implicitly assumes that the section size
is positive.  Make the assumption explicit.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57977

dtrace: Fix DOF section-specific validation

The entry size of the probe section is assumed to be at least
sizeof(dof_probe_t) by the loop further below.

enoff_sec->dofs_entsize was not being validated at all.

When multiplying an index by a table entry size, make sure the
multiplication can't overflow.

Fix an off-by-one when validating the translated probe argument array.

Make sure that the probe argument argvs are valid string offsets
even if the argument count is zero.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57979

Fixes:                https://cgit.freebsd.org/src/commit/?id=2ec2ba7e232d ("vfs: Add VFS/syscall support for Solaris style extended attributes")
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    rmacklem, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58053

A test site determined that, for a Mellanox NIC which can handle
M_EXTPG mbufs, an improvement of 5-15% for read rate could be
achieved if the read reply was in M_EXTPG mbufs.

A patch that tried to determine if the outbound NIC supported
M_EXTPG mbufs (IFCAP_MEXTPG) did not pass review.
However, it does appear that this can be useful for NFS-over-RDMA.
(Which just happen to use NICs that do support M_EXTPG mbufs.)

As such, this patch enables them is xp_extpg is set to true,
which is never for now, but might be set true for RDMA or
when vfs.nfsd.enable_mextpg is set non-zero. (It is 0 by
default, so this is never enabled by default at this time.)

Tested by:      Greg Becker <becker.greg@att.net>
MFC after:      2 weeks

Check that the P_WEXIT flag is set.

Requested by:   markj
Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_alloc()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract pdtofdflags()

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

sys_procdesc: extract procdesc_destroy()

Reviewed byL    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Introduce pd_fpcount that counts the number of file references to the
procdesc.  Remove the PDF_CLOSED flag, now it is expressed as
pd_fpcount == 0.

Only send SIGKILL and clear pointers when we are closing the last file
referencing procdesc.

This should be nop until the next commit.

Reviewed by:    markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

This is backward ABI-compatible, because the only place in kernel that
uses the structure, namely the mlx5_ib_cq.c:mlx5_ib_create_cq()
function, copies in as much structure members as provided by userspace.

Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Import Linux upstream commit 3411f9f01b76bd88aa6e0e013847ab6479cb4f24.

rdma_umap_priv_init() takes a reference on the rdma_user_mmap entry for
every VMA it maps, but rdma_umap_close() never dropped it.  The entry
was therefore never freed and lingered in ucontext->mmap_xa, tripping
WARN_ON(!xa_empty(&ucontext->mmap_xa)) at context teardown and leaking
the firmware UAR on every context close.

Reviewed by:    kib
Tested by:      Wafa Hamzah <wafah@nvidia.com>
Sponsored by:   Nvidia networking
MFC after:      1 month

Modern Linuxes don't use ethX for almost 15 years already, see [1] and
[2].  The translation logic has always been a source of bugs and PITA.
Switch default to not translate (long due!) and schedule removal of the
code for FreeBSD 17.

[1] https://systemd.io/PREDICTABLE_INTERFACE_NAMES/
[2] https://www.freedesktop.org/software/systemd/man/latest/systemd.net-naming-scheme.html

Reviewed by:            iwtcex_gmail.com, vvd, melifaro, dchagin
Differential Revision:  https://reviews.freebsd.org/D57852

sendfile: stop abusing kern_writev()

Provide convenient wrapper kern_filewrite() around fo_write().
Switch to use it in vn_sendfile().  This allows to avoid duplicate
fget() when we already have the reference to the file, which creates a
correctness race with the userspace.  Also td_retval[0] clearing hack
can be removed.

Reviewed by:    glebius, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58035

kern_filewrite(): unconditionally calculate cnt, it is used by callers

Reported by:    dhw, madpilot
Tested by:      dhw
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")

kern_writefile(): fix several regressions

sendfile(): for trailers uio, set uio_rw to UIO_WRITE instead of checking it
kern_filewrite(): remove unused argument offset
kern_writev(): the check should compare cnt against zero, not uio_resid

Reported by:    markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=dfad790c8cca ("sendfile: stop abusing kern_writev()")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

Order them alphabetically.
Remove redundand sys/param.h.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

linux_sys_futex() does not copyin a timespec for the timeout if the
operation is LINUX_FUTEX_TRYLOCK_PI, presumably because it doesn't make
sense to specify a timeout for a try-lock operation.  However, this
means that we pass a userspace timespec pointer to
linux_umtx_abs_timeout_init().

Modify linux_futex_lock_pi() to not initialize the timeout if we're
try-locking.

Reviewed by:    kib, dchagin
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58061

This is a mask, so the new value should have taken the next bit to avoid
breaking a shell script that's interpreted by a binmisc-activated
interpreter.

Add a brief note that the new value is only used within the ELF
activator.

Fixes:  https://cgit.freebsd.org/src/commit/?id=389c124fecb0 ("imgact_elf.c indicate that interpreter [...]")
Reported by:    "polyduekes" on discord, madpilot
Reviewed by:    kib, sjg (both previous version)
Differential Revision:  https://reviews.freebsd.org/D58063

pm_runtime_resume_and_get is used by new versions of amdgpu, and began
use between Linux kernel version 6.12, and 6.14.

Reviewed by:    dumbbell
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57463

This catches up with 692b0ef1506ba which added CAPENABLED to
clock_nanosleep(). Curiously recent additions of the pdopenpid(2) and
pddupfd(2) were done before the cited commit, and that regen did not
included the change.

Sponsored by:   The FreeBSD Foundation

Reviewed by:  jfree
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58084

The taskqueue thread loop tries to avoid entering and exiting net epoch
read sections for every task.  This reduces the overhead of net epoch
integration, but the implementation wasn't bounding the length of the
read section, so a busy taskqueue thread could hold an epoch open for an
unbounded period.  This is easy to achieve with the epair task, for
instance.

Bound the number of tasks that we'll execute without observing the
global epoch, and provide a sysctl to control it.  Let the default bound
be eight.

Reviewed by:    glebius
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58031

This function is supposed to wait until all pending callbacks have been
executed.  This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.

The implementation schedules a callback on each CPU and waits for them
all to run.  This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed.  This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.

Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order.  However,
ck_epoch_poll_deferred() may determine that it is safe to execute
callbacks from epoch - 1 (or even from the current epoch if there are
no active readers), and in this case it will push those callbacks onto
the returned stack.  This means that epoch_call_task() will invoke those
newer destructors before the older ones, which means that
epoch_drain_callbacks() may return early.

Fix the correctness problem by simply doing all of this twice: once the
first callback is invoked, we know that all of the callbacks that were
pending at the time that epoch_drain_callbacks() was called are
scheduled to be executed, so when the second callback is executed we
know that they must be finished.  This is slow, but it is already slow,
and the slowness is less noticeable after commit dce56594991.

I note that in an ideal world, this function would not exist, and all of
the teardown would happen asynchronously, rather than the current
mismash of synchronous and asynchronous cleanup.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290201
Reviewed by:    glebius
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D58030

The former is called by the latter. We return NULL because linuxkpi does
not implement ACPI (pseudo?) devices associated to regular devices.

The amdgpu DRM driver started to use `ACPI_COMPANION()` in Linux 6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57577

It takes a task state as its last argument. We enforce that this state
is `TASK_UNINTERRUPTIBLE` for the time being because other states are
not interpreted.

Change `usleep_range()` to call `usleep_range_state()` with the state
set to `TASK_UNINTERRUPTIBLE`, which is what Linux does too.

The amdgpu DRM driver starte to use `usleep_range_state()` in Linux
6.13.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57579

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58147

Currently no filesystems support it.

Reviewed by:    mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

On amd64 there was 4 bytes of padding between the 20-byte p_comm and
(for LP64) 8-byte p_sysent, so the addition of p_execblock just caused
that padding to be eaten up. However, on i386, there was no such
padding, and so the addition of p_execblock rippled through to
p_emuldata.

Fixes:  https://cgit.freebsd.org/src/commit/?id=e1a84b7708c2 ("execve_block(): a mechanism for mutual exclusion with execve() on the process")

The note type wakes up when there is something for pdwait(2) to report
on the process descriptor.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58123

We need to wake up the pdwait(2) waiters when procdesc event is
reported.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58172

Convert several callers to use fget_procdesc().
Eliminate procdesc_find() and directly use fget_procdesc() in
sys_pdkill().  Previous code structure required to fdrop() procdesc
while the process is locked.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58117

LinuxKPI: add system_percpu_wq

In Linux v6.17 system_wq was replaced (renamed to) system_percpu_wq,
with the old name still present.

We just alias system_percpu_wq to linux_system_short_wq like we do
for system_wq to keep both around for the forseeable future.

Note: the original system_wq was a per-cpu queue upstream as well
based on my understanding but we never implemented it as such.
That means we are still lacking a per-cpu implementation for
system_percpu_wq but at least we do not change the status-quo
of the LinuxKPI implementation with this.

Note2: we should add a check somewhere for LINUXKPI_VESION >=
61700 to print a warning if anyone still uses the system_wq
to detect any possible sami-native or out-of-tree drivers
relying on this and not properly updating.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell; emaste (comments on previous review)
Differential Revision: https://reviews.freebsd.org/D57730

LinuxKPI: fix lkpi_pci_get_device() reference counting on device

In case we are passed an "odev" (a device to start the search from),
that device would have an extra reference.  The best way to illustrate
this is to look at for_each_pci_dev(), which will return one device
after the other.  Upon first return we return a pdev with a reference.
That pdev is then passed in as odev on the next call.  If we do not
clear the reference it will be leaked.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=910cf345d0ee9 ("LinuxKPI: pci: implement ...")
Reviewed by:    dumbbell, emaste
Differential Revision: https://reviews.freebsd.org/D57428

LinuxKPI: pci detach: implement a proper detach (release) path

There are two paths in the LinuxKPI PCI code to instantiate a "pdev"
(LinuxKPI pci_dev).  One is using the FreeBSD bus framework and the
pdev will be the softc.
This commit starts cleaning up the detach path for just that case
to the best possible.

So far we did a lot of the work in linux_pci_detach_device(), which is
the internal handler of the detach function and little in the
(*release) callback (devres cleanup only).
The problem with that is, that we tear down resources which later in the
devres cleanup are needed.  With them not being there anymore we panic, e.g.,
in lkpi_dma_unmap < lkpi_dmam_free_coherent < lkpi_devres_release_free_list.
The solution is to migrate most of the cleanup work into the (*release)
callback, which will automatically be called when the device (kobj) reference
drops to zero.  The only work which should be done immediately is to let the
dirver do its cleanup;  this has to happen before we try to teardown the
resources, but also we do want this to happen when detach is called
(the first time).
One problem we have with the deferred cleanup of the remaining parts is
that we do not know upon calling pci_dev_put() whether this cleared
the last reference and triggered the cleanup or not but we cannot return
from the detach function with pending resources and dangling pointers,
which then may be used.  In order to work around this, we clear the
(*release) callback function when it is run and check for that in the
detach routine.  If the (*release) callback was not run, we refuse to
detach (force would be needed) as we'd rather keep the device than
risk a follow-up panic on leaked resources.  Given this should not happen
in a well programmed world, I believe it is fine to take that and log it
to let the user know.

Try to leave a few comments behind to help with understanding in the
future.

With this we can unload the mt7921 driver (or shutdown the system)
without panic.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell
Differential Revision: https://reviews.freebsd.org/D57429

LinuxKPI: 802.11: lkpi_80211_txq_tx_one() only pass sta if added to drv

If we are doing a direct (*tx) downcall, only pass sta as meta data
if it was added to the driver (via the state machine).  This prevents
us passing a sta not known to the driver leading to possible follow-up
complications/errors.  This will usually happen if (a) we are doing
software scanning, or (b) if net80211 decides to change the ni from
under us and sends a packet with the new ni.

Adjust a debug statement before to also have the added_to_drv field
in it to ease debugging.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

We have separate ports for Ccache 3 and 4.  Suggest both, rather than
only the Ccache 3 port.  Rearrange the text somewhat to avoid an
excessively ragged edge on a standard 80-column terminal.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58005

On most architectures we end up not needing ABIBreak.cpp as, although
some of the sources here do reference EnableABIBreakingChecks (or, if
assertions are disabled, DisableABIBreakingChecks) at a source level, we
compile with -ffunction-sections and -fdata-sections, and link with
--gc-sections, and it happens to be the case that all references can be
GC'ed. However, prior to LLVM 21, the RISC-V backend did not apply
-fdata-sections to .sdata, where references to these symbols end up, and
for some files we're building with such references we end up not being
able to GC .sdata due to the other unrelated data in it, meaning that we
do in fact need to build ABIBreak.cpp.

Whilst we could make this conditional on the architecture, it's a tiny
file, and it's a bit fragile to rely on GC behaviour, so just include it
unconditionally.

Reviewed by:    dim, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=770cf0a5f02d ("Fixups after llvm-project main llvmorg-21-init-19288-gface93e724f4 merge")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58044

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57124

Retire the GNU subtree

With GNU diff and cdialog gone, this is now an empty shell.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55425

Add a few missed files to ObsoleteFiles.inc

There were still some left-over files under usr/tests/gnu/usr.bin/diff,
causing the directory to not be fully removed. Add these to OLD_FILES.

Fixes:          https://cgit.freebsd.org/src/commit/?id=134a4c78d070

Reviewed by:  markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

-I${SRCTOP}/sys/contrib/xz-embedded/linux/lib/xz isn't used, and
.PATH: ${SRCTOP}/sys/contrib/xz-embedded/freebsd isn't used either.
Remove them both to simplify things a little.

Sponsored by:           Netflix

The new world may use system calls that are not in the currently-running
kernel, so we cannot chroot into the new environment to run `make
installworld`, `etcupdate`, etc.  Partially revert commit 16702050ac95
("beinstall: perform pre-installworld steps") and switch back to using
DESTDIR for installworld and so on.

Reported by:    olivier
Reviewed by:    olivier
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D50682

I introduced it in commit 1b49115a40ad ("Promote llvm-cov to a
standalone option").  llvm-cov was previously enabled as part of the
CLANG_EXTRAS option.  I made it a standalone, default-enabled option for
parity with the tools provided by the GCC-based toolchain.

We no longer provide an in-tree GCC toolchain.  Now, just build llvm-cov
along with Clang to simplify build infrastructure.

Reviewed by:    dim
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58155

RANLIB is not used by our build, so there is no need to set it.

Reviewed by:    imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58156

For the BIOS, add xzfs support. This is a tiny increase in the loader
size, but allows us to fetch compressed files from any of the
filesystems we support, including over the network.

For EFI, also add gzipfs and bzip2fs support we well. The increment for
these files is tiny.

Sponsored by:           Netflix

Sponsored by:         Netflix

The tcp_bblog facility provides structured logging of TCP stack activity
for debugging and performance analysis. It is implemented in the kernel
and allows per-connection tracing of TCP events with low overhead.

Reviewed by:    tuexen, ziaee
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D56252

sbintime.9 is a manual page that documents the usage of sbintime_t and
its helper functions.

MFC after:      1 week
Reviewed by:    ziaee, markj
Differential Revision:  https://reviews.freebsd.org/D57931

The debugfs options between the various modules (core and chipsets)
are not 100% de-coupled.  This means we may run into unresolveable
symbols at load time of the modules if we enable certain options
generally or for core but not for the chipset.
For now: always build the core module with debugfs support.
Migrate the CONFIG_MAC80211_DEBUGFS flag into the Makefile of each
chipset so we can individually turn it on.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days

This is included via acpivar.h so needs to be in SRCS to be generated.

Reported by:    bz
Fixes:  https://cgit.freebsd.org/src/commit/?id=bc49842769bd ("acpi_einj: Support for ACPI error injection")
Sponsored by:   Arm Ltd

This completes step 5 from Committer's Guide.

Approved by:            jbo (mentor)
Differential Revision:  https://reviews.freebsd.org/D57934

In order to merge merge commits (such as vendor imports), we need to
tell git cherry-pick which of the two branches referenced in the commit
is the mainline.  In our case, it is always the first.

Approved by:    markj

Previously we searched commits based on the author email address, but
this isn't really right: if I commit something from a contributor, I'm
still responsible for MFCing it, so really we should be filtering on the
committer.

Add a new --committer option to filter results by committer email
address, defaulting to the user.email value in the git config.

Keep the --author option, but don't filter by author unless the option
is explicitly specified.

Reported by:    des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58126

This allows one to resume from a conflict with a plain
`git cherry-pick --continue`, whereas before one would have to re-run
the original git-mfc command after resolving the conflict and running
`git cherry-pick --continue`.

Suggested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58129

Commit hashes listed in ~/.git-mfc-ignore are not listed in output of
git-mfc --dangling or --pending.  This is handy for silencing output
about commits that are tagged for MFC or as fixing another commit, but
which were not MFCed for some reason or other.

Requested by:   des
Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58161

This silences warnings when running git-mfc --pending against stable/13,
14 and 15.

Reviewed by:    des
Differential Revision:  https://reviews.freebsd.org/D58162

There is no functional change for existing tests, but allows to write a test
that would expect an immediate success of bind(2).

- Test SOCK_DGRAM (UDP) sockets.
- Test binding to 0:port and to a addr:port in presence of connected socket
  using the port.

Differential Revision:  https://reviews.freebsd.org/D56707

Just avoid repeating the test program name in every test case name.
No functional change.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56727

This fixes an endianness bug in sys/netinet/ip_reass_test.
Just use the code from RFC 1071.

Reported by:            glebius
Reviewed by:            glebius, Timo Völker
MFC after:              1 week
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D57988

/sbin/ping and /sbin/ping6 are hard-linked, and the vmmap sysctl handler
doesn't know which name was used to launch the process.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296116
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=080a4087014e ("tests: Fix race condition in aslr_setuid")

MFC after:    1 week

Reviewed by:  kib
MFC with:       5c32aa785184 ("kern: add pdopenpid(2)")
Differential Revision:  https://reviews.freebsd.org/D58023

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57163

In order to reuse the sendfile_helper program in pf tests, move it
to tests/sys/common directory, indicatint that it is also used from
another places than sys/kern.
Also make the readlen variable static.

Reviewed by:    gelbius, kp
Differential Revision:  https://reviews.freebsd.org/D58040

In order to use the sendfile_helper program in a pf test script that
requires non-loopback interfaces, add functionality to sendfile with a
TCP socket that is connected to a remote host.
The behavior for unix sockets and TCP loopback sockets is unchanged.

Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D58041

MFC after:    3 days

Reported by:  gcc -Werror=shadow
Reviewed by:    asomers, markj
Fixes:  https://cgit.freebsd.org/src/commit/?id=ee1c3d38a26a ("fusefs: fix vnode locking violations during execve")
Differential Revision:  https://reviews.freebsd.org/D58130

Make sure we have reachability when one of our nexthops
gets down without deleting the route.

Differential Revision: https://reviews.freebsd.org/D57552

The flag is -D, but it was written as a second -d. Add a period too.

MFC after:      3 days

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57928

Fixes:          https://cgit.freebsd.org/src/commit/?id=c3c8f4d9e662 ("cpu: New cpu_get_pcpuid(), retrieves internal CPU ID")
Sponsored by:   The FreeBSD Foundation

Rename handler function type 'lapic_thermal_handle_function' to the
shorter 'lapic_thermal_handler_t'.  Move it closer to the function
declaration block where it is used.  Make it a true function type (no
pointer) and add explicit pointer marks on usage.

Rename 'lapic_thermal_function_value' to the more immediately clear
'lapic_thermal_function_arg'.  In lapic_thermal_enable(), use 'func_arg'
as the argument name for the handler argument, which at least refers to
function 'func', rather than the generic 'value'.

Finally, rename the global handler variable from
'lapic_thermal_function_ptr' to the shorter 'lapic_thermal_function'
(dynamic functions can be referenced only through a pointer).

MFC with:       87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Sponsored by:   The FreeBSD Foundation

MFC after:    1 week

We should exit the net epoch instead of acquiring one more entry.

Reported by:    Wafa Hamzah <wafah@nvidia.com>
Reviewed by:    jhb
Sponsored by:   Nvidia networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=4726b80d9379 ("OFED: Various changes from Linux 4.20")
Differential revision:  https://reviews.freebsd.org/D58127

Reviewed by:  mckusick
Discussed with: markj
Tested by:      pho
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57658

Merge commit 'e988c5eab5231646c612d35ff5b16122cebfbf6a'

In delete(), when copying the deleted character to the d_char buffer,
don't assume that it fits.  utf8_prev() may return a sequence of more
than 5 bytes.

In insert_utf8(), fix the copy-up of the line.  We extended the line by
"len" bytes, so "temp" has to be repositioned accordingly.  Compare with
plain insert().

Use sizeof when copying to buffers instead of hard-coding buffer sizes.

Don't dynamically allocate d_char, there is no need.

Fixes:          https://cgit.freebsd.org/src/commit/?id=62fba0054d9e ("ee: add unicode support")
Reported by:    Sayono Hiragi (overflow in delete())
Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57996

Otherwise one can't easily attach gdb to ee.

Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57997

When looking up self process we can use `ps -p $$` directly rather
than grep which may find other processes ending in the expected PID.

Sponsored by:   Dell Inc.
Reviewed by:    markj, vangyzen
Differential Revision: https://reviews.freebsd.org/D58019

Changes: https://github.com/eggert/tz/blob/2026c/NEWS

MFC after:      3 days

MFC after:    1 week

Full release notes are available at
https://www.openssh.com/txt/release-10.4

Selected highlights from the release notes:

Potentially-incompatible changes
--------------------------------

 * sshd(8): configuration dump mode ("sshd -G") now writes directives
   in mixed case (e.g. "PubkeyAuthentication") whereas previously it
   emitted only lower-case names.

 * ssh(1), sshd(8): make the transport protocol stricter by
   disconnecting if the peer sends non-KEX messages during a post-
   authentication key re-exchange. Previously a malicious peer could
   continue sending non-key exchange messages without penalty. These
   would be buffered, causing memory to be wasted up until the
   connection terminated or the server/client hit a memory limit.
   Implementations that do not restrict messages sent during key
   exchange as per RFC4253 section 7.1 may be disconnected.
   Reported by Marko Jevtic.

Changes since OpenSSH 10.3
==========================

This release contains a number of security fixes as well as general
bugfixes and a couple of new features.

Security
========

 * sftp(1): when downloading files on the command-line using
   "sftp host:/path .", a malicious server could cause the file to
   be downloaded to an unexpected location. This issue was identified
   by the Swival Security Scanner.

 * scp(1): when copying files between two remote destinations, do
   not allow a malicious server to write files to the parent
   directory of the intended target directory.  This issue was
   identified by the Swival Security Scanner.

 * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
   as it was documented to do. Note that PermitTunnel is not enabled
   by default. Reported independently by Huzaifa Sidhpurwala of
   Redhat and Marko Jevtic.

 * sshd(8): avoid a potential pre-authentication denial of service
   when GSSAPIAuthentication was enabled (this feature is off by
   default). This was not mitigated by MaxAuthTries, but would be
   penalised by PerSourcePenalties. This was reported by Manfred
   Kaiser of the milCERT AT (Austrian Ministry of Defence).

 * sshd(8): fix a number of cases where the minimum authentication
   delay was not being enforced. Reported by the Orange Cyberdefense
   Vulnerability Team.

 * ssh(1): fix a possible client-side use-after-free if the server
   changes its host key during a key reexchange. This was reported by
   Zhenpeng (Leo) Lin of Depthfirst.

New features
------------

 * All: add experimental support for a composite post-quantum
   signature scheme that combines ML-DSA 44 and Ed25519 as specified
   in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

   This scheme is not enabled by default. To use it, you'll need
   to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
   Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

Bugfixes
--------

 * sshd(8): avoid sending observably different messages for valid vs
   invalid users in GSSAPIAuthentication (disabled by default).

 * ssh(1), sshd(8): fix several bugs that incorrectly
   classified bulk traffic as interactive. bz3972, bz3958

 * ssh-keygen(1), ssh-add(1): skip unsupported key types when
   downloading resident keys from a FIDO token. Previously, downloads
   would abort when one was encountered. GHPR657

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58083

We don't use this note type today, but as a general purpose ELF
diagnostic tool readelf(1) ought to decode it.

References:
https://fedoraproject.org/wiki/Changes/Package_information_on_ELF_objects
https://systemd.io/ELF_PACKAGE_METADATA/

Reviewed by:    fuz
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D47524

zfs: Wire sha512 offload to the build

FreeBSD main just got the CPUID_STDEXT4_SHA512 define.

OpenZFS PR #18732

Revert "zfs: Wire sha512 offload to the build"

This reverts commit cd61eb4f6681b13d98b6a7be252500ad30f05f74.

Some people report module load failure due to undefined symbol.
I don't have those problems myself, so it might be a question of
full rebuild.  But I don't have time right now, so just revert.

This reverts commit 3e3fd1fde8e168910edc538966111c0b5f03cd5f.

This appears to break chainbooting with boot1.efi and similar scenarios
with Root-on-ZFS scenarios. Revert until it's better understood.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296309
Sponsored by: Netflix
Differential Revision:  https://reviews.freebsd.org/D58071

This reverts commit 74654ba3b1b3bcf6ba8870a54310accbb6adbf0b.

Apparently it breaks cross building from Linux for some
reason.  I'll admit I didn't even know we supported cross
building from Linux.