FreeBSD/src b8ec492sys/kern kern_timeout.c

callout: ddb: resolve symbol of callout function

In the ddb show callout function try to resolve the symbol of the
callout function to improve debugging.  In my case I went through
various callouts from show ktr to check what they were and this saved
me opening lldb/gdb next to it (and still having the old kernel as
the panic to debug was upon reboot).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    rlibby
Differential Revision: https://reviews.freebsd.org/D57521
DeltaFile
+3-1sys/kern/kern_timeout.c
+3-11 files

FreeBSD/src 84008e3sys/compat/lindebugfs lindebugfs.c

lindebugfs: improve an error message

In case the fill function fails do not report (read/write) but the
actual operation only given we can easily determine it.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Reviewed by:    dumbbell, emaste
Differential Revision: https://reviews.freebsd.org/D57523
DeltaFile
+2-2sys/compat/lindebugfs/lindebugfs.c
+2-21 files

FreeBSD/src 31ded41sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: force update of net80211 crypto key flags

Several drivers (rtw8x, mt76) do not announce the supported ciphers suites
in the wiphy instance.  This means we never populate net80211 ic_cryptocaps
on device creation and thus not announcing any supported hw crypto
offload forcing a fallback to software crypto.

However when the mac80211 (*set_key) succeeds we know we can offload
crypto.  At that point the net80211 key flags have IEEE80211_KEY_SWCRYPT
set which we want to clear.  Historically the net80211 API does not
allow this though there should be no ill side effects (base on a
quick code inspection).  We thus have to DECONST the key argument
for now.  It is expected that with MFP support this will need to
become a common operation and the API will need to change as we
will only get the information of some details from the driver on a
per-cipher case when the (*set_key) downcall returns.

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+15-4sys/compat/linuxkpi/common/src/linux_80211.c
+15-41 files

FreeBSD/src 009d92bsys/contrib/dev/mediatek/mt76/mt7921 pci.c

mt76: mt7921: prevent PM from scheduling another delayed work on detach

Amongst others mt76_connac_pm_unref() is calling mt76_connac_power_save_sched()
which will (normaly) re-schedule the pm_work.
In various parts we also cancel that work, also during PCI detach ("shutdown",
"remove" in LinuxKPI terms).
However we also keep calling mt76_connac_pm_unref() in the detach path and thus
we get to a point where we re-scheduled the work but then the device goes away.
At that point LinuxKPI delayed work has a callput pending which is embedded in
the work structure (pm_work).  The moment we free the device that structure
and callout is gone but the callout is still on the list and once that list
is walked we panic.

Simply prevent mt76_connac_power_save_sched() from getting to the point of
possibly re-scheduling the pm_work by setting pm->enable to false in the
beginning of the detach path.

The are likely more paths which will need the same treatment as the code
is by far anything from "symmetric" (that is the attach path is highly

    [6 lines not shown]
DeltaFile
+11-0sys/contrib/dev/mediatek/mt76/mt7921/pci.c
+11-01 files

FreeBSD/src 3fa40c5sys/compat/linuxkpi/common/src linux_simple_attr.c

linudebugfs: fix simple_attr_write_common() kernel buffer

With 2cf15144daf7e we added a kernel buffer for parsing input copying the
user buffer into that.  The problem is that we only copy exactly as many
bytes as the user supplied.  printf 1 would have a write_size of 1, while
echo 1 would have a write_size of 2 (1\n).  But in order to check and
parse we need a terminating '\0'.

Overallocate the kernel buffer by 1 and make sure it is always '\0'
terminated.

Remove the check that the string needs to be of different length than
the write_size as this will always fail unless the user passes in, e.g.,
"1\02\n\0" somehow in which case we won't bother as kstrto*ll() will
not only handle the '\n' but also stop at '\0' and should be fine or
it will fail and we will error.

In theory we could use a static buffer here as well as we know a maximum
possible length of digits plus \n and \0 and take a min of that buffer

    [8 lines not shown]
DeltaFile
+2-5sys/compat/linuxkpi/common/src/linux_simple_attr.c
+2-51 files

FreeBSD/src ff6c95dsys/compat/linuxkpi/common/src linux_80211_macops.c

LinuxKPI: 802.11: improve hw_crypto key operations

mt7921 would happily receive traffic (MC/BC) and decrypt it correctly
when hw_crypto was used but TX would only have garbled data in frames.

The problem came from the fact with keys for which we do not have an
address the driver will pick the "sta" information from different places
(driver view of sta or vif).
In the downcall this is signalled by the sta argument being NULL as
the linux keyconf has no address field.

Us passing the sta for first the pairwise key and then also for the
group key likely overwrote the pairwise key on the sta and allowed
the MC/BC RX operations to succeed anyway (the observed behaviour).

Software crypto was fully fine for mt7921 and showed no problems.

Looking some other drivers:
- iwlwifi/mld picks the ap_sta if the sta argument is NULL; thus it

    [11 lines not shown]
DeltaFile
+16-0sys/compat/linuxkpi/common/src/linux_80211_macops.c
+16-01 files

FreeBSD/src f54e9d1sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: set undefined link in TX control info

We are not doing MLO yet so set the undefined link bit in the
TX info control message in case a driver checks if the TX would be
link specific.

Sposnored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+4-0sys/compat/linuxkpi/common/src/linux_80211.c
+4-01 files

FreeBSD/src 0cb3b92sys/compat/linuxkpi/common/include/linux ieee80211.h, sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: add print masks for tx status flags

Add print masks for tx status flags and use them in the TX tracing
in order to more easily debug TX problems.

As a result it was easier to determine that some dirver like the mt7921
(or mt76) do not always zero the status bits of the tx status information
(it is a union with the control bits passed on TX) and thus we get bogus
values back (rather than having flags in a different place than we thought).

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+11-0sys/compat/linuxkpi/common/include/linux/ieee80211.h
+4-4sys/compat/linuxkpi/common/src/linux_80211.c
+15-42 files

FreeBSD/src 142cba9sys/dev/bge if_bge.c

bge: read MAC from loader hint for boards without NVRAM/EEPROM

BCM57766 on Apple T2 Macs (Macmini8,1) has no dedicated EEPROM and the
chip firmware handshake fails (the T2 intercepts PCI config space),
leaving the SRAM mailbox unpopulated.  All four existing MAC retrieval
paths (SRAM mailbox, NVRAM, EEPROM, firmware stub) fail, causing bge to
abort attach with "failed to read station address".

Work around this with two changes:

  1. Tolerate EEPROM read failure on BCM57766.  The chip is copper-only
     so hwcfg=0 is correct; skip the fatal error that aborts attach
     before bge_get_eaddr() is ever called.

  2. Implement bge_get_eaddr_fw() to read a "hint.bge.N.mac" string
     (e.g. "f0:18:98:f4:1e:2f") from loader(8) tunable / kenv.

This is a workaround until the T2 BCE API is understood well enough to
either poke the chip firmware into completing its handshake or read the

    [4 lines not shown]
DeltaFile
+36-6sys/dev/bge/if_bge.c
+36-61 files

FreeBSD/src e37e49bsys/dev/asmc asmc.c

asmc: fix asmc_key_dump() page fault on T2 MMIO backend

asmc_key_dump() used I/O port macros (ASMC_DATAPORT_WRITE/READ,
asmc_command()) unconditionally. On T2 Macs, sc_ioport is NULL
(MMIO backend is used instead), causing a page fault when
ASMC_DEBUG triggers asmc_dumpall() during attach.

Add an MMIO guard at the top of asmc_key_dump(): delegate to
asmc_key_dump_by_index() + asmc_key_read() for MMIO devices,
consistent with the rest of the T2 code paths.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D56748
DeltaFile
+31-5sys/dev/asmc/asmc.c
+31-51 files

FreeBSD/src 9f90536sys/dev/apple_bce apple_bce_vhci.c apple_bce_vhci.h, sys/modules/apple_bce Makefile

apple_bce/vhci: add T2 virtual USB host controller

Implements a VHCI driver on top of the BCE transport:
- Virtual USB bus registration via usb_controller
- Port discovery and device enumeration
- Control, interrupt, and bulk endpoint support
- Firmware event handling with taskqueue
- Suspend/resume via BCE mailbox

Provides keyboard, trackpad, and Touch Bar access on T2 Macs.

Tested-on: MacBookPro16,2 (A2251), Mac mini 8,1 (A1993)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57089
DeltaFile
+4,821-0sys/dev/apple_bce/apple_bce_vhci.c
+251-0sys/dev/apple_bce/apple_bce_vhci.h
+87-0sys/dev/apple_bce/apple_bce.c
+5-0sys/dev/apple_bce/apple_bce_mailbox.c
+2-1sys/dev/apple_bce/apple_bce.h
+2-0sys/modules/apple_bce/Makefile
+5,168-12 files not shown
+5,170-18 files

FreeBSD/src 6fd2ad9sys/dev/apple_bce apple_bce.c apple_bce_queue.c

apple_bce: add Apple T2 Buffer Copy Engine driver

DMA ring transport between the host and the T2 coprocessor.
Provides mailbox handshake, queue setup, and firmware keepalive
for higher-level T2 services (VHCI, audio, etc.).

Tested-on: MacBookPro16,2 (A2251), Mac mini 8,1 (A1993)

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D57088
DeltaFile
+642-0sys/dev/apple_bce/apple_bce.c
+492-0sys/dev/apple_bce/apple_bce_queue.c
+304-0sys/dev/apple_bce/apple_bce.h
+108-0sys/dev/apple_bce/apple_bce_mailbox.c
+52-0sys/dev/apple_bce/apple_bce_queue.h
+20-0sys/dev/apple_bce/apple_bce_mailbox.h
+1,618-03 files not shown
+1,630-09 files

FreeBSD/src 5e0ba47sys/dev/nvme nvme_qpair.c nvme_pci.c

nvme: add Apple T2 ANS2 NVMe quirks

The Apple T2 (ANS2, PCI 106b:2005) requires several quirks:

- 128-byte submission queue entries (CC.IOSQES = 7)
- Single MSI vector, one IO queue
- Admin and IO queues share a CID table; IO CIDs offset by
  adminq.num_trackers to avoid overlap
- No async event support
- IDENTIFY CNS >= 2 rejected to avoid firmware confusion

Tested-on:
- MacBookPro16,2 (A2251)
- Mac mini 8,1 (A1993)
- Multiple Non-Apple computers

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D57087
DeltaFile
+23-9sys/dev/nvme/nvme_qpair.c
+15-0sys/dev/nvme/nvme_pci.c
+14-0sys/dev/nvme/nvme_private.h
+13-0sys/dev/nvme/nvme_ctrlr.c
+9-0sys/dev/nvme/nvme_sim.c
+1-1sys/dev/nvme/nvme_sysctl.c
+75-106 files

FreeBSD/src b5cb273sys/kern tty.c

tty: Add sysctl knob to globally disable TIOCSTI

Reviewed by:    markj
PR:             293485
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57233

(cherry picked from commit c289291a6736c01dd68fb8459ec3801859b0a59a)
(cherry picked from commit c94b8eee5bcb5f9d116cce9c831933115cfeeb19)
(cherry picked from commit 16532b220c9cbd9fb0365a80a23cc435003e9986)
DeltaFile
+8-0sys/kern/tty.c
+8-01 files

FreeBSD/src 16532b2sys/kern tty.c

tty: Add sysctl knob to globally disable TIOCSTI

Reviewed by:    markj
PR:             293485
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57233

(cherry picked from commit c289291a6736c01dd68fb8459ec3801859b0a59a)
(cherry picked from commit c94b8eee5bcb5f9d116cce9c831933115cfeeb19)
DeltaFile
+8-0sys/kern/tty.c
+8-01 files

FreeBSD/src a74c77cusr.bin/grep util.c

grep(1): optimize -w/--word-regexp word boundary check

The -w option checks word boundaries before and after each potential
match by decoding the adjacent character.  This was done via the
heavyweight sscanf(3) with "%lc", which goes through the full scanf
parser and locale-aware mbrtowc(3) machinery even for simple ASCII.

Replace with a three-tier fast path:

1. ASCII bytes (< 0x80): simple isalnum(3) / '_' comparison
2. UTF-8 continuation bytes (0x80-0xBF): interior bytes of a multi-byte
   character are always word characters -> no further decoding needed
3. Multi-byte start bytes (>= 0xC0): decode with mbrtowc(3) directly
   instead of sscanf(3)/%lc, avoiding scanf parser overhead

Benchmark with ministat(1) (10 runs each):

Worst-case ASCII (100k lines of 100 'a' chars, -w 'a'):
    Difference at 95.0% confidence: -15.3% +/- 3.1%

    [14 lines not shown]
DeltaFile
+34-10usr.bin/grep/util.c
+34-101 files

FreeBSD/src b4af6a4sys/fs/fuse fuse_vnops.c, tests/sys/fs/fusefs default_permissions.cc

fusefs: fix error handling when reading a directory's sticky bit

When trying to delete or rename a file, fuse_vnop_lookup must check
whether its parent directory's sticky bit is set.  Realistically, the
parent directory's attributes will almost always be cached.  But it's
possible that they won't be, and in that case we must send a new
FUSE_GETATTR request to the server.  If that request fails for some
reason, then we must fail the lookup.  Prior to this change fusefs would
ignore failure of that request.

Reported by:    Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
                and Ke Xu of Tsinghua University
MFC after:      2 weeks
Reviewed by:    markj
Differential Revision: https://reviews.freebsd.org/D57588
DeltaFile
+53-0tests/sys/fs/fusefs/default_permissions.cc
+6-4sys/fs/fuse/fuse_vnops.c
+59-42 files

FreeBSD/src 836d0d3sys/arm/broadcom/bcm2835 bcm2835_mbox.c

arm/bcm2835: Release mailbox resources on attach failure

Also remove the rid variable since it was unused.

Signed-off-by:  Haoxiang Li <lihaoxiang at isrc.iscas.ac.cn>
Reviewed-by:    vexeduxr
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2255
DeltaFile
+13-8sys/arm/broadcom/bcm2835/bcm2835_mbox.c
+13-81 files

FreeBSD/src 39217ebsys/arm/allwinner/a10 a10_intc.c

arm: allwinner: Fix A10 INTC MMIO resource cleanup

Do not jump to the resource release path when bus_alloc_resource_any()
fails, since no MMIO resource was allocated. If a10_intr_pic_attach()
fails after the MMIO resource has been allocated, release it before
returning.

Signed-off-by:  Haoxiang Li <lihaoxiang at isrc.iscas.ac.cn>
Reviewed-by:    vexeduxr
Pull-Request:   https://github.com/freebsd/freebsd-src/pull/2253
DeltaFile
+2-2sys/arm/allwinner/a10/a10_intc.c
+2-21 files

FreeBSD/src 746c374sys/dev/evdev evdev.c evdev_private.h

evdev: add devnum sysctl

Add a sysctl entry for the evdev device number (devnum) to allow
libudev-devd to populate the corresponding device information
fields (MAJOR and MINOR) when running in a jail with no input devices
exposed through devfs.

Signed-off-by: Quentin Thébault <quentin.thebault at defenso.fr>

Reviewed by:    wulf
Sponsored by:   Defenso
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D56968
DeltaFile
+6-0sys/dev/evdev/evdev.c
+1-0sys/dev/evdev/evdev_private.h
+7-02 files

FreeBSD/src 2e1f5b7stand/man loader.efi.8

loader.efi(8): document the ia32 loader

Reviewed by:    kib
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57569
DeltaFile
+12-0stand/man/loader.efi.8
+12-01 files

FreeBSD/src f771debstand/man loader.efi.8

loader.efi(8): the amd64 loader doesn't do protected mode

The amd64 UEFI loader executes in long mode, not protected mode.

Reviewed by:    kib
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D57568
DeltaFile
+2-2stand/man/loader.efi.8
+2-21 files

FreeBSD/src ffe47c4usr.bin/grep util.c

grep: periodic timer-based fflush instead of unconditional per-line flush

Replace the unconditional fflush(stdout) in grep_printline and
procmatches with a periodic timer that flushes at most once every
100ms.  This preserves interactive responsiveness (grep | tee,
grep | tail -f) while avoiding 1M+ write(2) syscalls when
processing large inputs.

The flush interval is tracked via clock_gettime(CLOCK_MONOTONIC)
and a static timespec.  --line-buffered continues to flush
immediately via setlinebuf(3), as before.

Benchmark on 1M lines (37MB output to file):
  unconditional fflush:  1.90s  (sys 1.22s)
  periodic 100ms timer:   0.49s  (sys 0.007s)

Reviewed by:            kevans
Differential Revision:  https://reviews.freebsd.org/D57528
DeltaFile
+29-4usr.bin/grep/util.c
+29-41 files

FreeBSD/src 8a13adfshare/man/man7 d.7

d.7: Correct a few typos in the manual page

- s/occurance/occurrence/
- s/Univeristy/University/

MFC after:      5 days
DeltaFile
+3-3share/man/man7/d.7
+3-31 files

FreeBSD/src 9e9303alib/libc/stdlib merge.c

libc: Guard mergesort() allocation size arithmetic

Signed-off-by:  Faraz Vahedi <kfv at kfv.io>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2243
Reviewed by:    fuz
MFC after:      1 week

(cherry picked from commit 3501eec9dd39b527a46e82de53480968d283b90e)
DeltaFile
+11-5lib/libc/stdlib/merge.c
+11-51 files

FreeBSD/src 87466b1lib/msun/src s_rsqrtf.c s_rsqrtl.c

msun: Fix up for recent rsqrt[fl] functions

Paul Zimmermann (of Core-Math and MPFR fame) graciously tested
the recently committed rsqrt[fl]() functions.  He identified 127
incorrectly rounded values for rsqrtf() in round-to-nearest mode.
This patch fixes the rounding in RN.  Exhaustive testing now shows
that rsqrtf() is corrected rounded for RN.  He also tested rsqrt()
and rsqrtl() in the interval [1,4).  Both appear to be correctly
rounded.  Finally, the patch includes small changes to comments.

A concise list of changes is

* lib/msun/src/s_rsqrt.c:
  . Fix comments.

* lib/msun/src/s_rsqrtf.c
  . Fix comments.
  . Exhaustive testing by Paul Zimmermann found 127 incorrectly
    rounded values in round-to-nearests.  These gave have the

    [12 lines not shown]
DeltaFile
+22-15lib/msun/src/s_rsqrtf.c
+3-5lib/msun/src/s_rsqrtl.c
+2-2lib/msun/src/s_rsqrt.c
+27-223 files

FreeBSD/src 48a47c0lib/libc/stdlib qsort.3

qsort.3: Document mergesort() behaviour on size overflow

Signed-off-by:  Faraz Vahedi <kfv at kfv.io>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2243
Reviewed by:    fuz
MFC after:      1 week

(cherry picked from commit 26a1180cd1521e4c438ac95a57b134e27ea0a72d)
DeltaFile
+11-3lib/libc/stdlib/qsort.3
+11-31 files

FreeBSD/src d7d2290tools/build depend-cleanup.sh

depend-cleanup.sh: rebuild strrchr.o on riscv64 if it came from strrchr.S

We have to switch back to the previous rule once the temporary
build fix has been replaced with a permanent fix.

PR:             295823
See also:       4996ebdb720042239a197ebec2d265cdfdf1bbf3
Reported by:    siva
MFC after:      1 week

(cherry picked from commit 93221c277608d2612511eaabbf2bfc1f4b4250f7)
DeltaFile
+5-2tools/build/depend-cleanup.sh
+5-21 files

FreeBSD/src 808241elib/libc/riscv/string Makefile.inc

libc/riscv64: temporarily unhook strrchr() from the build

A bug was discovered in the riscv64 assembly implementation of
this function.  Fall back to the generic implementation until a
fix can be developed.

PR:             295823
Reported by:    siva
MFC after:      1 week

(cherry picked from commit 4996ebdb720042239a197ebec2d265cdfdf1bbf3)
DeltaFile
+1-2lib/libc/riscv/string/Makefile.inc
+1-21 files

FreeBSD/src 89234ffshare/man/man4 umass.4

umass.4: Correct a typo in the manual page

- s/Sotrage/Storage/

MFC after:      5 days
DeltaFile
+1-1share/man/man4/umass.4
+1-11 files