This is ABI-breaking change that could be considered as the bug fix.
Requested by: David Timber <[email protected]>
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
Relnotes: yes
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58942
37bd69d43c gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>. Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS. Both headers are self-contained; stage them alongside
stdckdint.h.
Fixes: 37bd69d43c ("sys: Add sys/ckdint.h")
Reviewed by: rpaulo, markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58943
On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.
A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a9 it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher. bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path. x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim. The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads. Hosts whose maximum basic leaf is below
1Fh are unaffected, as the request is clamped to cpu_high before the
switch statement.
Leaf 1Fh uses the same level encoding as leaf 0Bh for the SMT and the
core level, so handle both leaves in the same case. The module, tile
and die levels are not emulated and terminate the enumeration, exactly
as they already do for leaf 0Bh.
PR: 297475
MFC after: 1 week
Reported by: Richard Straka <[email protected]>
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58885
To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them. This is to close off whole class of possible breakage,
rather than patching it case by case.
Reported by: dim
Reviewed by: dim, dteske, fuz
Approved by: dim, dteske (mentor), fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58911
This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
with ATF 0.22+ [1].
- Brings in some new test coverage.
Obtained from: NetBSD (date tag: `20260818UTC`)
MFC after: 2 weeks
1. https://github.com/freebsd/atf/pull/72
* Begin migrating the ioctl code to use the key management APIs.
Not all of it has been migrated (notably the WEP API hasn't.)
* Take special care to copy the TKIP MIC in and out correctly.
* Note that some of the defines used as sizes are actually the ioctl
sizes, they'll need to be fixed before I push this into a review.
* Document this current API as a specific 128 bit key + 128 bit
TKIP MIC API.
The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.
Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP
stuff in the /end/ of the key buffer. They happen to be equivalent
when ioctl key buffer size == net80211 key buffer size, but as I learnt
the last couple times I tried this, they're not always going to be
equivalent.
Differential Revision: https://reviews.freebsd.org/D58384
Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.
Differential Revision: https://reviews.freebsd.org/D58705
This was broken in 2022 with a security fix (61605e0ae5) which
disallowed defaulting to the default TX key if there's no unicast
key. Unfortunately this path was also used by WEP transmit.
To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.
Fixes: 61605e0ae5
Locally tested:
* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured
Differential Revision: https://reviews.freebsd.org/D58854
drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback(). Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.
Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <[email protected]>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)
bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.
In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.
vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.
PR: 297187
MFC after: 2 weeks
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58921
Changes for jng 2.0 -> 9.0 include:
+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
mapping table stays small (first hook is uplink; unknown unicast
goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026
See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.
MFC after: 1 week
Reviewed by: kfv, jlduran
Differential Revision: https://reviews.freebsd.org/D58903
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
with no hashing. A memset() at the top of zfs_dnode_stat() zeroes the
remaining fields so they no longer hold stack garbage.
Tested on 16.0-CURRENT (amd64), ZFS-on-GELI root: rebuilt and re-signed
the EFI loader; the system boots under UEFI Secure Boot with
mac_veriexec active.
(boot1 segment was modified by kevans)
PR: 295935
Sponsored by: Defenso
Reviewed-by: kevans
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2271
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
Add three test cases verifying fts(3) Capsicum capability mode:
- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
entries and openat(fts_dirfd, fts_name) identifies the same
inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
at all directory depths (7 non-root entries)
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2332
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.
Signed-off-by: Pawel Sobczyk <[email protected]>
Reviewed by: kbowling, erj, milosz.linkiewicz_intel.com
Tested by: Mateusz Moga <[email protected]>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57642
At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable(). So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().
Reviewed by: kib, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58859
cpi->max_lun is an inclusive upper bound, but the driver reported the
LUN count (8 or 32), so CAM probed one nonexistent LUN past the end.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58820
The reserved array after CCAP must be 508, but it was 511.
This pushed the config, MCQ config, and ESI registers from 0x300 and
0x380 up to 0x900. None of these registers are used yet, so nothing
broke.
Also fix the HCMID bank index field. The spec places it at bits
[23:16], but it was defined on top of the manufacturer code at [15:0].
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58819
The six query helpers duplicated the same submit, error check, poll,
and status check sequence. Move it into ufshci_dev_send_query() so
future changes to the query flow are made in one place. This also
unifies the failure log message format.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58818
The CDB pointer and length checks depend only on the CCB, so perform
them before allocating and initializing the request. This avoids a
wasted allocation for invalid CCBs on the I/O path and removes one
request-free error path.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58817
ufshci_req_sdb_destroy() hardcoded &ctrlr->transfer_req_queue when
destroying command descriptors instead of using its req_queue argument.
No functional change: the branch only runs for the transfer queue, so
the two pointers are always the same today. Using the argument keeps
the function queue-agnostic for when more transfer queues exist (MCQ).
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58816
ufshci_req_sdb_cmd_desc_construct() and ufshci_req_sdb_construct()
returned ENOMEM for every failure, so an EINVAL from bus_dma_tag_create()
was reported as a memory shortage. Capture and return the real errno,
and drop the cmd descriptor construct's now pointless out label.
No functional change: no caller inspects the value beyond propagating
it, so this only improves the diagnostics on an attach failure.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58815
Expose the firmware-controlled physical port identification LED
through /dev/led/ice*. Use the AdminQ port-identification command to
select blinking mode and restore the netlist-selected original mode
before the interface is stopped.
MFC after: 2 weeks
Sponsored by: BBOX.io
Add fts_openat() as a new entry point for fts(3).
When dirfd is AT_FDCWD the behaviour is identical to fts_open().
Passing a pre-opened directory fd allows fts traversal inside
Capsicum capability mode where path-based operations are not
permitted.
Capability mode users should use fts_parent->fts_dirfd + fts_name with
openat(2) to access files.
Reviewed by: asomers
Relnotes: yes
Sponsored by: Google LLC (GSoC 2026)
Pull Request: https://github.com/freebsd/freebsd-src/pull/2273
fts_build() stores a dup'd file descriptor in each directory
entry's fts_dirfd. When a traversal is abandoned before
completion and fts_close() is called, the cleanup loop freed
each pending entry with free() without first closing its
fts_dirfd, leaking one descriptor per pending directory.
Close fts_dirfd before freeing each entry in the cleanup loop,
matching the handling already applied to the dummy parent entry
after the loop.
Add a regression test that descends a couple of levels, abandons
the traversal, closes, and asserts the open descriptor count is
unchanged.
PR: 297557
Reported by: asomers
Fixes: 4bd01d6ae0
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2373
Since the kernel environment has its own dependencies, lurking at the end
of the SI_SUB_KMEM sequence appeared to be fragile. Provide own subsystem
for it. The init_dynamic_kenv() goes SI_ORDER_FIRST, and two modules that
depend on it go SI_ORDER_ANY.
PR: 297492
Reviewed by: imp, markj, emaste
Differential Revision: https://reviews.freebsd.org/D58836
This serves to demonstrate some usage of the ckdint.h helpers. The new
version also generates better machine code on amd64 and arm64.
Reviewed by: kib, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
We have a C23 stdckdint.h header for userspace, which provides checked
addition, subtraction and multiplication. We lack similar helpers in
the kernel, where they are regularly needed.
Let's just adopt the C23 macros. For bonus points, I added a wrapper to
ensure that ignored an return value is raised as an error by the
compiler.
Reviewed by: kib, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58773
Cache PCM children and drain interrupt callbacks before detach.
Allocate the parent softc by its actual size.
Reviewed by: br
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58370
Standardize driver manuals on the style used for 12 years in vt(4).
This brings SYNOPSIS across all FreeBSD manual sections into harmony
of meaning where where SYNOPSIS lists available options, and does not
contain prose. Adjust mdoc(7) to reflect the established convention.
Reviewed by: jhb
Discussed with: arch@ (marc.info/?l=freebsd-arch&m=176782215606871)
Differential Revision: https://reviews.freebsd.org/D54586
Our buffer is half a megabyte, but we are only initializing the first
two bytes. Switching from static to dynamic initialization moves it
from .data to .bss, greatly reducing the size of the binary.
Fixes: cf74b63d61 ("yes: Completely overengineer")
MFC after: 1 week
Sponsored by: Klara, Inc.
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D58890
Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.
Signed-off-by: Krzysztof Galazka <[email protected]>
Reviewed by: erj
Tested by: Mateusz Moga <[email protected]>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57337
This reverts commit 45645518ea.
Although this changed looks like it should just be a harmless change to
bookkeeping, it turns out that it changes the termination condition of
the initial device scan, resulting in it never finishing. This causes
the boot to hang forever coming up. Since I don't have good access to
hardware, I'm reverting until the exact details can be sorted out.
Reported by: Edward Scroop
Sponsored by: Netflix
MFC After: 1 week
The problem observed on X550 adapters with 2.5 and 5 Gbps speeds
negotiation on some switches is not affecting E610 adapters.
Remove workaround, which omitted those speeds in the list
of initially advertised speeds and advertise all speeds
supported by adapter.
Signed-off-by: Krzysztof Galazka <[email protected]>
Reviewed by: kbowling
Tested by: Mateusz Moga <[email protected]>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57339
Konstantin Belousov