vmm: Emulate CPUID leaf 1Fh for guests
On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.
A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a94d it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher. bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path. x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim. The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads. Hosts whose maximum basic leaf is below
[13 lines not shown]
libc: Restore prior C23 include guards
To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them. This is to close off whole class of possible breakage,
rather than patching it case by case.
Reported by: dim
Reviewed by: dim, dteske, fuz
Approved by: dim, dteske (mentor), fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58911
contrib/netbsd-tests: lib/libc/c063: sync with NetBSD
This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
with ATF 0.22+ [1].
- Brings in some new test coverage.
Obtained from: NetBSD (date tag: `20260818UTC`)
MFC after: 2 weeks
1. https://github.com/freebsd/atf/pull/72
libexpat: update AUTHORS section of libbsdxml.3
The eXpat project has changed maintainers since this section was written
in 2002. Update it to reflect reality.
Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by: bcr
Differential Revision: https://reviews.freebsd.org/D58835
(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
net80211: migrate the ioctl API to a 128 bit specific API + use key API
* Begin migrating the ioctl code to use the key management APIs.
Not all of it has been migrated (notably the WEP API hasn't.)
* Take special care to copy the TKIP MIC in and out correctly.
* Note that some of the defines used as sizes are actually the ioctl
sizes, they'll need to be fixed before I push this into a review.
* Document this current API as a specific 128 bit key + 128 bit
TKIP MIC API.
The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.
Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP
[6 lines not shown]
net80211: add key get/set methods
Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.
Differential Revision: https://reviews.freebsd.org/D58705
net80211: fix WEP transmit
This was broken in 2022 with a security fix (61605e0ae5d8f) which
disallowed defaulting to the default TX key if there's no unicast
key. Unfortunately this path was also used by WEP transmit.
To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.
Fixes: 61605e0ae5d8f
Locally tested:
* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured
Differential Revision: https://reviews.freebsd.org/D58854
libexpat: update AUTHORS section of libbsdxml.3
The eXpat project has changed maintainers since this section was written
in 2002. Update it to reflect reality.
Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by: bcr
Differential Revision: https://reviews.freebsd.org/D58835
(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
linux: add dma-buf and sync_file ioctl handlers
drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback(). Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.
Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)
bcm2835_audio: Comment out vchi_service_release()
bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.
In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.
vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.
PR: 297187
MFC after: 2 weeks
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58921
bhyve: Add SPDX-License-Identifier tag
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 499d0f04f55e52327d624d27ead3a0d16e3b465a)
sound: Use unsigned long instead of legacy u_long
No functional change intended.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
(cherry picked from commit afe56ee24679d6584acf02dd17f6ed52c052abe7)
New version of jng (9.0)
Changes for jng 2.0 -> 9.0 include:
+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
mapping table stays small (first hook is uplink; unknown unicast
goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026
See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.
MFC after: 1 week
Reviewed by: kfv, jlduran
Differential Revision: https://reviews.freebsd.org/D58903
stand: set st_dev/st_ino in the loader's ZFS stat for veriexec
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
[14 lines not shown]
ipfilter: Fix checksum update for NAT_DIVERTOUT
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4) and the gzero(4) MLINK are not USB things, but they
were in the .if ${MK_USB} != "no" block. So if we build with
WITHOUT_USB, these man pages are lost. Move them out of the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
share/man/man4: Move non-USB man pages out of MK_USB block
uart(4), unix(4), veriexec(4) and the gzero(4) MLINK are not USB
things, but they were in the .if ${MK_USB} != "no" block. So if we
build with WITHOUT_USB, these man pages are lost. Move them out of
the block.
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1100d9eca9cb2860c58633a9176dd11a30850da4)
fts: add fts_capsicum_test.c
Add three test cases verifying fts(3) Capsicum capability mode:
- fts_dirfd_valid: verifies fts_dirfd is set for all non-root
entries and openat(fts_dirfd, fts_name) identifies the same
inode as fts_accpath
- fts_dirfd_capsicum: verifies complete fts traversal works in
Capsicum capability mode using fts_openat() and fts_dirfd
- fts_dirfd_deep_tree: verifies fts_dirfd + fts_name is correct
at all directory depths (7 non-root entries)
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2332
vtnet: move offload functions to virtio_net.h to share them
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
