FreeBSD git weekly: 2026-07-01 to 2026-09-3xi01

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

While here, remove the long-unused dash in the first line.

Reviewed by:    ziaee, olce
Fixes:          https://cgit.freebsd.org/src/commit/?id=ddf144a04b53 ("ps.1: Revamp: Explain general principles, update to match reality")
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D58038

* Modernize the markup

* Describe the comment syntax

* Drop obsolete advice

* Capitalize sentences

* Improve the language

* Replace no_tld_query with no-tld-query; both are supported, but all the
  other multi-word options use hyphens rather than underscores.

* Add missing ENVIRONMENT section

* Redo the example

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57921

MFC after:    1 week

asmc: try PIO before MMIO to avoid false T2 detection

Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.

Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57844

asmc: add system state and board identity sysctls

Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).

Each sysctl is registered only if the key exists on the hardware.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57853

asmc: deduplicate sensor converters and cause sysctls

Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57854

Book-E powerpc has 64-bit bus_addr_t but only a 32-bit bus_size_t.  Use
the right macros for maxsize and maxsegsize to fix the build.

Fixes:  https://cgit.freebsd.org/src/commit/?id=4bf8ce037 ("if_rge: initial import of if_rge driver from OpenBSD.")
Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57794

Depend on clknode_if.h in the module Makefile, so that it gets
explicitly built for the module.  Also, reduce the #if guards to only
the new clock output code, and gate them on all powerpc, not just
powerpc64.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6b77d34f ("HYM8563: Add support for clock output.")
Reviewed by:    mmel
Differential Revision:  https://reviews.freebsd.org/D57795

These were added during the DPAA driver rewrite, and should not have
gone in then.  Remove them.

Reviewed by:  mav
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58003

PR:           https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199101
MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57929

MFC after:    1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57930

Some firmware delivers the power or sleep button press that woke the
system as an ordinary button press (Notify 0x80) shortly after resume,
rather than as the wakeup notification (Notify 0x02) the ACPI
specification requires for a button that is also a wake source.

On affected machines (e.g. the Framework Laptop 12, Intel Raptor Lake-P)
the power button is a control-method device behind the embedded
controller.  The EC latches the key press that woke the system across the
sleep transition and flushes it through its normal _Qxx query path as
soon as it is reinitialized on resume.  The replayed press is
indistinguishable from a genuine one, so the kernel honors it as a fresh
suspend request and the machine suspends again immediately after waking;
it cannot be kept awake with the button.

The event cannot be filtered at its source: it arrives over the same EC
query path that also carries legitimate events (lid, AC, thermal,
battery), so suppressing the drain would lose real notifications.
Instead, record the time of resume and ignore a button-initiated suspend
that arrives within a short grace window of it.  The timestamp is taken
before DEVICE_RESUME() re-initializes the EC, so it is set before the
replay can be processed on the ACPICA notify taskqueue; otherwise the
replay can be evaluated before the timestamp is written and slip through.
Measured from that point, the replay lands at ~600 ms across many cycles
on a Framework Laptop 12, whereas a deliberate press cannot occur that
quickly -- it happens well after the display is back -- so a one-second
window separates the two without ignoring real presses for any
perceptible time.

Spec-compliant firmware reports the wake as Notify 0x02, which is handled
on a different path and never reaches this check, so there is no change
in behavior on such systems.

The replay window is a fixed compile-time constant rather than a tunable
on purpose: it tracks a hardware characteristic -- the EC's post-resume
replay latency -- not a user policy, so there is no value a user would
meaningfully choose.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296243
Reviewed by:    adrian, imp (earlier revision), olce
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D57712

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, still waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

Also, add a check in the attach method that a per-CPU structure is
provided by the bus.  This allows to remove such checks in multiple
functions.  The check cannot currently fail as all x86 CPU drivers
(ACPI, legacy) provide the CPU_IVAR_PCPU instance variable, but it is
safer to have it, especially as an example to other driver writers.

Event:          Halifax Hackathon 202606
Location:       Seat 25A in AF0349, before leaving Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation

This fixes associating to various APs.

It worked fine to a FreeBSD AP (which is a wholly separate problem
I'm going to need to dive into) but not to my tplink AX1800 Wifi-6
router.

PR: kern/https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296503

Locally tested:

* STA: Intel Centrino Advanced-N 6205 (iwn), Lenovo T420
* AP: TP-Link AX1800 wifi-6 router

M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.

xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.

Reviewed by:    zlei, adrian
Differential Revision:  https://reviews.freebsd.org/D57495

Use kn->kn_sdata to track the last bs->total value for each knote
attached to an mmaped channel. An event is delivered only when the total
byte counter has advanced by at least c->lw since the last delivery.
After delivery kn_sdata is updated to the current total.

Each knote tracks its own watermark independently, so multiple knotes
attached to the same mmaped channel all receive events correctly.

Non-mmap channels keep the existing level-triggered behavior via
chn_polltrigger().

MFC after:      1 week
Reviewed by:    christos
Differential Revision:  https://reviews.freebsd.org/D57833

arm64/vmm: Add FEAT_NV2 definitions

Add the definitions for the VNCR_EL2 register and all of the offsets
to registers in memory relative to the page stored in VNCR_EL2.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56550

arm64/vmm: Use the VNCR_EL2 memory page to store guest registers

Wherever possible, move the storage space for guest register values from
the hypctx struct into a preallocated memory page matching the layout of
the page pointed to by VNCR_EL2.
This will streamline implementing support for nested virtualization, but
the implementation itself is not reliant on the presence of nested
virtualization architecture features.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56551

arm64/vmm: Store non-VNCR registers in an array

Move non-VNCR EL0 and EL1 registers into a dedicated array inside of
hypctx. This enables uniform accesses to both VNCR and non-VNCR guest
register state through hypctx_[read|write]_sys_reg().

The accessors are _not_ used for non-VNCR EL2 registers in order to
create a clear separation between guest-visible and guest-invisible
register state.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56552

arm64/vmm: Refactor vmm_hyp.c

Refactor vmm_hyp.c to split register reload logic by type of register,
streamline the implementation and improve readability.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56553

arm64/vmm: Move vttbr_el2 & vtimer into struct hypctx

Move vttbr_el2 & vtimer from struct hyp into struct hypctx to streamline
the logic and handle them in the same way as other *_el2 registers are
already being handled.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56554

arm64/vmm: Move host-side EL2 regs into sys_regs

Move EL2 host registers that are not visible to the guest into
hypctx->sys_regs. Prefix them with HOST_ to distinguish from EL2
registers which are part of the guest's own state (e.g. in VNCR).

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56555

arm64/vmm: Make remaining registers use hypctx_*_sys_reg

Move vgic, timer and trapframe registers into sys_regs to handle them
in the same way as all the other registers.

Signed-off-by:  Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D56556

Update ieee80211_crypto_init_aad() to do what 802.11-2020 says -
only mask fc[0] bits 4-6 on data frames, not on management frames.
This (with other diffs to actually negotiate MFP and configure
ath(4) for MFP + software keys) allows the CCMP path to decrypt
CCMP MFP frames in the software path.

Differential Revision:  https://reviews.freebsd.org/D57799

There is no visible bug fixed as in current tree masks are the same.

Fixes:  https://cgit.freebsd.org/src/commit/?id=6883b120c53735ff1681ef96d257f376731f56b3

Add const-qualified versions of the NLA iteration helpers to allow
walking immutable netlink attribute buffers without discarding const
qualifiers.

This introduces NLA_NEXT_CONST(), _NLA_END_CONST(), and
NLA_FOREACH_CONST() in netlink_snl.h.

Signed-off-by: Ishan Agrawal <iagrawal9990@gmail.com>
Sponsored-by : Google LLC (GSoC 2026)

Unloading if_ovpn while it's in use by other vnets causes
memory leaks and panics.
Fix this by reverting VNET_SYSUNINIT and adjusting the SI_SUB
initialization order.

Reviewed by:    markj
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D54175

The same variable was used as a counter for an inner and out loop.
Add a new one for the inner loop.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283934
Reported by:    crest at rlwinm.de

Fixes:        https://cgit.freebsd.org/src/commit/?id=255538cd906045095d0c2113ae6c4731ce36c0cf
Differential Revision: https://reviews.freebsd.org/D57850
Reviewed by:    adrian

MFC after:    1 week
Fixes:          https://cgit.freebsd.org/src/commit/?id=c3276e02beab ("sockets: make shutdown(2) how argument a enum")
Reviewed by:    glebius
Differential Revision:  https://reviews.freebsd.org/D57915

PR:   https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296410
Submitted by:   Tomas Vondra <tomas@vondra.me>
MFC after:      1 week

libsysdecode: decode Generic Netlink controller messages

Decode Generic Netlink controller (GENL_ID_CTRL) messages in
Netlink payloads. Display the Generic Netlink header along with
the CTRL_CMD_GETFAMILY attributes, including the family ID and
family name.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: cache Generic Netlink family IDs

Record Generic Netlink family IDs learned from
CTRL_CMD_GETFAMILY responses and use them to decode subsequent
Generic Netlink messages using symbolic family names instead of
numeric IDs.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libsysdecode: decode PF Generic Netlink commands

Decode the Generic Netlink command header for messages
belonging to the PF Generic Netlink family. Display the
command name using the PF Generic Netlink command decoder.

Signed-off-by:  Ishan Agrawal <iagrawal9990@gmail.com>
Reviewed by:    kp
Sponsored-by:   Google LLC (GSoC 2026)

libc/resolv: Drop Solaris 2 compatibility

MFC after:      1 week
Reviewed by:    kevans, markj
Differential Revision:  https://reviews.freebsd.org/D57922

libc/resolv: Refactor the option parser

Start the loop by finding the end of the option name, the name-value
separator (if any), and the end of the option.  Use those pointers to
simplify matching the option name and parsing the option value, and
validate option names and values more strictly.  This means that:

* We no longer accept trailing garbage in an option name or value.  For
  instance, we would previously interpret “edns0123” as “edns0” and
  “timeout:3xyz” as “timeout:3”.  This was actually quite lucky because
  we also failed to recognize the newline at the end of the option line
  as a whitespace character.

* For options that take a numerical argument, we would previously accept
  negative values and treat non-numerical arguments as 0, while large
  numerical arguments would be capped to the option's maximum permitted
  value.  Now, any failure to parse the argument, including overflow,
  results in the option being left unchanged.

MFC after:      1 week
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57923

libc/resolv: Refactor the configuration parser

This was previously all a single loop in res_init(), apart from option
parsing which we cleaned up in a previous commit.  Break it out into
separate functions for reading the configuration line by line, setting
the default domain, setting the search list, and adding a nameserver
to the nameserver list.  Sprinkle bounds checks and code comments all
around.

The sortlist code, which has been disabled for the past 20 years, will
be dealt with in a separate commit.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57924

libc/resolv: Reimplement the sortlist parser

When we switched from the BIND4 resolver to the BIND9 resolver, the
sortlist parser was inadvertently disabled due to a missing #define, and
nobody seemed to notice.  The sorting code remained enabled in the
resolver, but there was no way to set a sort order.

Reimplement the sortlist parser, but correctly, and update the manual
accordingly.  The new parser accepts IPv4 and IPv6 addresses with or
without a mask or prefix length, just like the old one, except IPv6
support was a bit wonky in the original code.

Fixes:          https://cgit.freebsd.org/src/commit/?id=5342d17f09a8 ("Update the resolver in libc to BIND9's one.")
Relnotes:       yes
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57925

libc/resolv: Add no-debug and no-rotate options

These are simply the reverse of the debug and rotate options.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D57926

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57927

Rename am_lock description from autofslk -> autfsm.

The lock description, autofslk, is used as the description for
autofs_softc->sc_lock, which is used to protect autofs requests and the
like as opposed to am_lock which protects autofs nodes for a given
mount.

This change allows witness to distinguish different lock orders for each
lock.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57972

The OpenZFS merge 80aae8a3f8aa introduced HAVE_SIMD() which checks for
HAVE_TOOLCHAIN_* defines via simd_config.h.  The kernel module Makefile
was updated, but kern.pre.mk (static kernel build) and the libzpool/libzfs
Makefiles were missed, still using the old HAVE_SSE2 etc. names.  This
caused all vectorized raidz, fletcher, and blake3 implementations to be
compiled out.

The consequences are:
- for nfs exports and fhopen(2), unlinked but still referenced inodes
  are accessible
- for ffs_vput_pair() with unlock_vp = false, spurious ESTALE is not
  returned when the inode is still alive but unlinked

Note that tmpfs does not return ESTALE for the unlinked nodes.
The same behavior is claimed for Linux in
https://github.com/openzfs/zfs/issues/18699

Reviewed by:    rmacklem
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D57982

Fix two locking violations that could happen during execve, while
executing a file stored on fusefs.  Both would cause panics on an
INVARIANTS kernel after 15.0, or a DEBUG_VFS_LOCKS kernel prior to that.
Neither is likely to be noticeable on a release kernel.

* Don't assume that the vnode is exclusively locked during VOP_CLOSE.
  It usually is thanks to !MNTK_LOOKUP_SHARED, but isn't during execve,
  which locks the vnode outside of the lookup path.

* Totally rewrite fuse_io_invalbuf.  It's had a number of problems ever
  since its original introduction[^1]:

  - Don't assume that the vnode is exclusively locked.  That assumption
    failed during execve just like the assumption in fuse_vnop_close.

  - Don't livelock forever if vinvalbuf returns ENOSPC or EDQUOT.

  - Don't attempt to handle multiple threads calling this function at
    the same time.  That would be impossible if the vnode truly were
    exclusively locked.  So the code was dead.  Or it would've been, if
    the assumption hadn't been wrong.  Furthermore, both vinvalbuf and
    vnode_pager_clean_sync only require a shared vnode lock, and are
    already capable of dealing with multiple simultaneous callers.

  - Using fvdat->flag in this way would require some sort of mutex
    protection, if the vnode weren't exclusively locked.

 * Add new test cases that trigger both of the aforementioned panics.

[^1]: https://github.com/glk/fuse-freebsd/commit/efe6eb3005e7633b4e31d5e453eacbaa0cba42fa

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295957
Reported by:    dan.kotowski@a9development.com
MFC after:      2 weeks
Sponsored by:   ConnectWise
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D57536

Previously, an_vnode_lock was initialized with SX_NOWITNESS to silence
lock order reversals. The reversals would occur when autofs_node_vn()
was called with the directory vnode lock held, then lock an_vnode_lock,
then lock the vnode attached to the autofs node. It looked like:

    directory vnode -> an_vnode_lock -> vnode attached to autofs node

The established lock order is now vnode -> an_vnode_lock

Currently, we don't have to worry about losing an autofs node during the
unlock/lock as autofs nodes are only removed during an unmount() after
vflush(). When autofs_node_vn() is called, the mountpoint has either
been busied (preventing unmount) or a directory vnode is locked which
prevents vflush() from finishing until the directory vnode is unlocked.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D57857

Commit 016570c4463d modified the client to handle
the upgrade of a read delegation to a write delegation,
where the server provides the same delegation stateid
to the client.  However, it failed to check if the
delegation structure was currently in use.  Without this
patch, if the structure was in use, a use after free
could occur.

This patch handles the "in use" case by copying the
necessary fields into the current/old structure and
free's the new one instead of the old one that is
"in use".

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296224
MFC after:      2 weeks

Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.

Reviewed by:    gallatin, markj
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D57973

TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload.  In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.

Reviewed by:    ziaee, gallatin, markj
Relnotes:       yes
Sponsored by:   Netflix
Sponsored by:   Chelsio Communications
Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D57974

linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)

LTP open13 expects these operations to fail with EBADF, matching
Linux behavior, but FreeBSD currently returns EOPNOTSUPP
for fgetxattr() on an O_PATH fd

Look up Linux fd-based xattr descriptors with getvnode()
and route the operations through shared kern_extattr_*_fp()
helpers so the O_PATH check and the extattr operation use the
same referenced file.

Apply the same EBADF handling to fsetxattr(), fremovexattr(), and
flistxattr() so the xattr paths stay consistent.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295537
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

linuxulator: Fix operator precedence for LINUX_XATTR_FLAGS in setxattr()

The LINUX_XATTR_FLAGS macro expands to (LINUX_XATTR_CREATE|LINUX_XATTR_REPLACE).
Without parentheses around the macro expansion, the bitwise & operator has
higher precedence than |, causing incorrect flag evaluation and a compiler
warning.

Add the missing parentheses around LINUX_XATTR_FLAGS to ensure correct
operator grouping, matching the existing usage in getxattr().

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Fixes:          https://cgit.freebsd.org/src/commit/?id=2c905456312b ("linuxulator: Fix O_PATH file descriptors errno for f*xattr(2)")
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2306

Move the atomic size-probe-and-read logic into a new
linux_extattr_get_vp() function in linux_xattr.c instead of
modifying the generic extattr_get_vp() in vfs_extattr.c.
This keeps Linux-specific getxattr semantics (ERANGE on
too-small buffer, EOPNOTSUPP to ENOATTR mapping)
self-contained within the linuxulator.

The function probes the attribute size and reads the data
under a single vnode lock, preventing a TOCTOU race between
the size probe and data read.

Signed-off-by:  YAO, Xin <mr.yaoxin@outlook.com>
Reviewed by:    kib
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2263

CHERI: declare mem{cpy,move}_data

Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices).  On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance.  This reduces the risk of accidental spread of
pointers on CHERI systems.

Document that bcopy preserves pointer provenance.

Reviewed by:    ziaee, kib, adrian, markj
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57662

CHERI: add sooptcopyinptr to preserve pointer provenance

Most socket options don't involve pointers so make the default
sooptcopyin discard provenance and add a sooptcopyinptr that preserves.

Reviewed by:    markj, emaste
Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57665

CHERI: make mem{cpy,move}(9) CHERI compatible

- Use intptr_t in place of long as the word type in the core copying
  loop where aligned words a copied.  This preserved the provenance of
  any copied pointers.
- When working with the address of src or dst use ptraddr_t rather than
  uintptr_t.  This avoid ambigious provenance in expressions involving
  multiple addresses.

As a minor tweak, rename the function to memmove since that is the
interface it implements (overlapping src and dst are permitted) and make
memcpy the alias rather than the other way around.

Reviewed by:    kib, markj
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Differential Revision:  https://reviews.freebsd.org/D57965

fetch.9: fix a typo

Fixes:          https://cgit.freebsd.org/src/commit/?id=a1c52e05f571 ("CHERI: declare fueptr and suptr")
Effort:         CHERI upstreaming
Sponsored by:   Innovate UK

Fixes:                https://cgit.freebsd.org/src/commit/?id=d15792780760 ("unix: new implementation of unix/stream & unix/seqpacket")
Reviewed by:    glebius
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D57967

Attaching to a jail changes its root directory and its process
credentials. These operations both require unlocking the jail, and also
need allprison_lock unlocked. That means that if two threads are trying
to attach to different jails at the same time, it's possible for the
process to end up with one jail's root directory but the other jail's
credentials.

Solve this by forcing the process into single-threaded mode during
system calls that attach to a jail (jail_attach, jail_attach_jd, and
sometimes jail_set).

Reviewed by:    kib, markj
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57858

If git is installed and .git exists but git rev-parse failed to report a
hash we previously produced just "-dirty" as the git revision.  Gate the
git commit count and -dirty check on the rev-parse passing.

Reviewed by:    jlduran
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57995

It is a handy shortcut that will be used extensively in
hwpstate_intel(4) and hwpstate_amd(4).

Warn users that it panics if the parent bus does not provide the
CPU_IVAR_PCPU instance variable.  That condition should be tested by
callers (doing so once is enough).  Suggest to do that in driver's
attach method.

Reviewed by:    jhb (code)
Event:          Halifax Hackathon 202606
Location:       Seat 36K in AC667, waiting for a gate at Montréal-Trudeau
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57897

This makes the header more self-contained.
The symbol is needed only on 32bit arches, but the include file is
provided unconditionally to make the namespace population predictable.

PR:     https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296489
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week

When a GID table entry is empty or not yet present in the cache,
show_port_gid() falls back to printing a zero GID.  Use the existing
GID_PRINT_FMT/GID_PRINT_ARGS helpers instead of Linux's %pI6 format,
which FreeBSD printf treats as a pointer followed by "I6".
This makes empty GID sysctl entries consistently report
0000:0000:0000:0000:0000:0000:0000:0000.

Tested by:      Wafa Hamzah <wafah@nvidia.com> (mlx5_ib)
Reviewed by:    jhb, kib
Sponsored by:   NVIDIA Networking
Fixes:  https://cgit.freebsd.org/src/commit/?id=6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential Revision:  https://reviews.freebsd.org/D58042

The implementation previously only generated an IN_IGNORED event for a
deleted watched file if the watch explicitly requested IN_DELETE_SELF.
This is not correct, IN_IGNORED should always be raised when the watched
subject is deleted.  Adjust the implementation of inotify_log_one()
accordingly.

This also fixes a problem where a deleted watched file's watch
would not be removed if IN_DELETE_SELF was not in the watch's event
mask, in which case the unlinked vnode would linger until the inotify
descriptor itself is closed.

Add a regression test.

Reported by:    jrtc27
Reviewed by:    jrtc27
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58050

jaildesc_alloc() finishes initializing the file structure only after it
is made visible from the file descriptor table via finit().  In that
window, other threads could try to perform operations on the descriptor
and thus access an incompletely initialized jaildesc.

Defer the finit() call until locks are initialized.  While here,
simplify the error path for falloc_caps().

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    jamie
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58049

dtrace: Improve DOF section size validation

The loop which validates each DOF section assumes that the section
header is present, so the section size must be at least as large as the
header, otherwise a small OOB access is possible.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57975

dtrace: Fix DOF section bounds validation

We must ensure that each DOF section does not overlap with the DOF
header or section table.  Otherwise the relocations processed in the
second pass over sections can manipulate DOF metadata, leading to OOB
writes.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57976

dtrace: Improve DOF string table validation

The check for a nul terminator implicitly assumes that the section size
is positive.  Make the assumption explicit.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57977

dtrace: Fix DOF section-specific validation

The entry size of the probe section is assumed to be at least
sizeof(dof_probe_t) by the loop further below.

enoff_sec->dofs_entsize was not being validated at all.

When multiplying an index by a table entry size, make sure the
multiplication can't overflow.

Fix an off-by-one when validating the translated probe argument array.

Make sure that the probe argument argvs are valid string offsets
even if the argument count is zero.

Reviewed by:    christos
MFC after:      2 weeks
Sponsored by:   CHERI Research Centre
Differential Revision:  https://reviews.freebsd.org/D57979

Fixes:                https://cgit.freebsd.org/src/commit/?id=2ec2ba7e232d ("vfs: Add VFS/syscall support for Solaris style extended attributes")
Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:    rmacklem, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58053

We have separate ports for Ccache 3 and 4.  Suggest both, rather than
only the Ccache 3 port.  Rearrange the text somewhat to avoid an
excessively ragged edge on a standard 80-column terminal.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58005

On most architectures we end up not needing ABIBreak.cpp as, although
some of the sources here do reference EnableABIBreakingChecks (or, if
assertions are disabled, DisableABIBreakingChecks) at a source level, we
compile with -ffunction-sections and -fdata-sections, and link with
--gc-sections, and it happens to be the case that all references can be
GC'ed. However, prior to LLVM 21, the RISC-V backend did not apply
-fdata-sections to .sdata, where references to these symbols end up, and
for some files we're building with such references we end up not being
able to GC .sdata due to the other unrelated data in it, meaning that we
do in fact need to build ABIBreak.cpp.

Whilst we could make this conditional on the architecture, it's a tiny
file, and it's a bit fragile to rely on GC behaviour, so just include it
unconditionally.

Reviewed by:    dim, emaste
Fixes:          https://cgit.freebsd.org/src/commit/?id=770cf0a5f02d ("Fixups after llvm-project main llvmorg-21-init-19288-gface93e724f4 merge")
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58044

This completes step 5 from Committer's Guide.

Approved by:            jbo (mentor)
Differential Revision:  https://reviews.freebsd.org/D57934

There is no functional change for existing tests, but allows to write a test
that would expect an immediate success of bind(2).

- Test SOCK_DGRAM (UDP) sockets.
- Test binding to 0:port and to a addr:port in presence of connected socket
  using the port.

Differential Revision:  https://reviews.freebsd.org/D56707

Just avoid repeating the test program name in every test case name.
No functional change.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D56727

This fixes an endianness bug in sys/netinet/ip_reass_test.
Just use the code from RFC 1071.

Reported by:            glebius
Reviewed by:            glebius, Timo Völker
MFC after:              1 week
Sponsored by:           Netflix, Inc.
Differential Revision:  https://reviews.freebsd.org/D57988

/sbin/ping and /sbin/ping6 are hard-linked, and the vmmap sysctl handler
doesn't know which name was used to launch the process.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296116
MFC after:      3 days
Fixes:          https://cgit.freebsd.org/src/commit/?id=080a4087014e ("tests: Fix race condition in aslr_setuid")

MFC after:    1 week

The flag is -D, but it was written as a second -d. Add a period too.

MFC after:      3 days

Reviewed by:  markj
Differential Revision:  https://reviews.freebsd.org/D57928

Fixes:          https://cgit.freebsd.org/src/commit/?id=c3c8f4d9e662 ("cpu: New cpu_get_pcpuid(), retrieves internal CPU ID")
Sponsored by:   The FreeBSD Foundation

Merge commit 'e988c5eab5231646c612d35ff5b16122cebfbf6a'

In delete(), when copying the deleted character to the d_char buffer,
don't assume that it fits.  utf8_prev() may return a sequence of more
than 5 bytes.

In insert_utf8(), fix the copy-up of the line.  We extended the line by
"len" bytes, so "temp" has to be repositioned accordingly.  Compare with
plain insert().

Use sizeof when copying to buffers instead of hard-coding buffer sizes.

Don't dynamically allocate d_char, there is no need.

Fixes:          https://cgit.freebsd.org/src/commit/?id=62fba0054d9e ("ee: add unicode support")
Reported by:    Sayono Hiragi (overflow in delete())
Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57996

Otherwise one can't easily attach gdb to ee.

Reviewed by:    bapt
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57997

zfs: Wire sha512 offload to the build

FreeBSD main just got the CPUID_STDEXT4_SHA512 define.

OpenZFS PR #18732

Revert "zfs: Wire sha512 offload to the build"

This reverts commit cd61eb4f6681b13d98b6a7be252500ad30f05f74.

Some people report module load failure due to undefined symbol.
I don't have those problems myself, so it might be a question of
full rebuild.  But I don't have time right now, so just revert.