pfctl: err(3) family functions should not be used with trailing \n
Obtained from: OpenBSD, deraadt <deraadt at openbsd.org>, 3c04d8eee2
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: fix DIOCXBEING/DIOCXROLLBACK/DIOCXCOMMIT error handling
- ensure the anchor name is always 0-terminated
strlcpy() won't overflow, but will walk off the end of the provided
buffer looking for a 0.
- don't overwrite the pf_begin()/... return value with the copyout()
return value
- stop on the first copyout() error
Fixes: 2636cc0414fd (pf: have DIOCXBEGIN/DIOCXROLLBACK/DIOCXCOMMIT use the new functions, 2026-10-27)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pfsync: improve underflow check
We checked the state's expiry time to make sure it was large enough to
not underflow if we subtracted the already expired time from the remote
end, but we failed to account for the state's expiry time being in
miliseconds and the pfsync time delta being in seconds.
Take that multiplication by 1000 into account.
Fixes: 78b620b781b0 (pfsync: avoid underflow on different timeouts, 2026-10-21)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
if_pfsync: fix mbuf leaks on errors
Some of the pfsync input handlers freed the mbuf on errors, others did
not. Unify this by having the caller free the mbuf on error.
Fixes: c6a520af95b2 (pfsync: improve handling of large packets, 2026-10-30)
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf: don't leak transaction elements on error
If nlmsg_reply() or nlmsg_end() in pf_handle_trans() failed we did not
call pf_trans_free(), leaking the pf_trans_e elements in it.
Reported by: markj's Post-Commit LLM Review Service
Sponsored by: Rubicon Communications, LLC ("Netgate")
hastd: Remove pidfile on exit
Make hastd remove its pidfile before exit after catching a signal or a
stop control message, not just on failure to start.
MFC after: 1 week
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D60192
tarfs: Fix length calculation for file read
When the offset is within a block rather than at its beginning, the
length should be clamped to the remaining length of the block, not its
total length.
Reported by: n0ps1ed
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60904
tarfs: Limit file name length
When indexing the tarball on mount, fail if a file or directory name
exceeds MAXNAMLEN.
Reported by: n0ps1ed
Reported by: Franz Bettag <franz at bett.ag>
MFC after: 1 week
Reviewed by: markj, emaste
Differential Revision: https://reviews.freebsd.org/D60903
libfetch: Apply timeout to SSL handshake
When the SSL handshake cannot proceed because the server is slow to
respond, poll() with a timeout instead of spinning.
MFC after: 1 week
PR: 298962
Event: Oslo Hackathon 2026
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60975
riscv: Incoming MSI Controller support.
Support for Incoming Message Signalling Interrupt Controller (IMSIC)
defined by the RISC-V Advanced Interrupt Architecture (AIA) specification.
This is based on early work of Himanshu Chauhan on IMSIC support for
IPI delivery. This change, however, does not include IPI delivery support,
instead it provides MSI support for peripheral devices.
IMSIC is a core-local interrupt controller with non-global interrupts,
which means that interrupt identity is effectively (hart, interrupt ID).
When IMSIC present on hart, APLIC does not trap the CPU directly,
instead it delivers the interrupt to the IMSIC instance associated with
the target hart. Upon reception of interrupt, IMSIC on hart invokes APLIC
for handling. Note that PCIe devices deliver interrupt directly to IMSIC.
Apart from IMSIC support, this includes APLIC changes:
- Obtain the interrupt trigger type from FDT and configure the interrupt
[9 lines not shown]
riscv intc: convert to a bus.
Convert the RISC-V Interrupt Controller (INTC) device to a bus;
try to find and attach Incoming Message Signalling Interrupt Controller
(IMSIC) device.
This allows to establish parent-child relationships between two and
to propagate PIC_INIT_SECONDARY call from the INTC (parent) to the
IMSIC (child).
Reviewed by: mhorne, mmel
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D59813
Revert "snd_hda: Identify AMD Audio Coprocessor"
Apparently this device might need a separate driver altogether.
This reverts commit 8dac0bdb4df0815e14db219e9a7fb5d0be5737b8.
ix(4): Support Total Port Shutdown on E610
Firmware controls the physical link state on E610 adapters, similarly to
X700 and E800 adapters. As a result, running "ifconfig down" does not
disable the physical link unless Total Port Shutdown is enabled.
Read the Link Default Override TLV from NVM to detect when Total
Port Shutdown was enabled for given port in system setup. In that
case, force the link down when the interface is stopped and restore
it during link configuration. Leave link state management unchanged
when the TLV is unavailable or the feature is not enabled.
Co-authored-by: Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Co-authored-by: Tomasz Lichwala <tomasz.lichwala at intel.com>
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Tested by: Mateusz Moga <mateusz.moga at intel.com>
MFC after: 1 week
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D60643
if_bnxt: skip HW kTLS on old firmware and add a tunable to disable it
Older Thor2 firmware serves key context allocation requests very
slowly, about a second each. The driver allocates key contexts in
batches of 128, so setting up 500k sessions takes roughly 3900
requests and driver load appears to hang.
Enable hardware kTLS only when the firmware's HWRM interface version
is 1.10.3.99 or newer. Keep the full four-part version in
hwrm_spec_code_ext for the comparison.
Also add a disable_hw_ktls loader tunable that turns hardware kTLS off
for a device without unloading kTLS support, which helps isolate kTLS
problems in the field.
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60977
if_bnxt: size MRAV from the AV split entry for backing store V2
On RoCE-capable Thor2, attach fails with
HWRM_FUNC_BACKING_STORE_CFG_V2 returning INVALID_PARAMS, as MRAV is
sized the pre-V2 way and the firmware's AV split value is sent as is.
Size MRAV from the AV split entry, and move the legacy entry-count
packing into bnxt_hwrm_func_backing_store_cfg().
Fixes: d5ce906da7c5 ("bnxt_en: Add backing store V2 support")
Reviewed by: gallatin
Sponsored by: Broadcom Inc
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60976
ice(4): Do not leave device non-functional if Tx scheduler config fails
The ice_cfg_tx_topo function attempts to apply Tx scheduler topology
configuration based on NVM parameters, selecting either a 5 or 9 layer
topology. As part of this flow, the driver acquires the "Global Configuration Lock",
which is a hardware resource associated with programming the DDP package
to the device. This "lock" is implemented by firmware as a way to
guarantee that only one PF can program the DDP for a device. Unlike a
traditional lock, once a PF has acquired this lock, no other PF will be
able to acquire it again (including that PF) until a CORER of the device.
However, if configuration of the Tx topology fails, (i.e.
ice_get_set_tx_topo returns an error code), the driver exits
ice_cfg_tx_topo() immediately, and fails to trigger CORER.
While the global configuration lock is held, the firmware rejects most
AdminQ commands, as it is waiting for the DDP package download (or Tx
scheduler topology programming) to occur.
Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the
global lock, regardless of success or failure of the topology
configuration.
[14 lines not shown]
acpi_panasonic: Clear wireless RF_KILL on boot and resume
On Panasonic FZ-Y1 and similar models, the EC latches RF_KILL on
shutdown and suspend when battery is at certain level, causing wireless
to boot with hard block.
Call WLSW.SHRF during attach and resume to clear the block.
Tested on Panasonic FZ-Y1 with Intel Wireless 7265.
Reviewed by: adrian, obiwac
Approved by: adrian, obiwac
Differential Revision: https://reviews.freebsd.org/D55265
(cherry picked from commit 16822dac32ab8955539ffa4eda05145df8638154)
acpi_panasonic: acquire serial lock before calling hkey_sound_mute in shutdown
acpi_panasonic_shutdown() calls hkey_sound_mute() without holding
the ACPI serial lock. Every other call site holds
`ACPI_SERIAL_BEGIN(panasonic)` before calling it, as the locking
model is caller-owned.
This seems to affect the whole Panasonic Toughtbook lineup btw.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D56718
(cherry picked from commit 7619d14d08a0036a07dce670f55b9568f8133b38)
acpi_panasonic: Clear wireless RF_KILL on boot and resume
On Panasonic FZ-Y1 and similar models, the EC latches RF_KILL on
shutdown and suspend when battery is at certain level, causing wireless
to boot with hard block.
Call WLSW.SHRF during attach and resume to clear the block.
Tested on Panasonic FZ-Y1 with Intel Wireless 7265.
Reviewed by: adrian, obiwac
Approved by: adrian, obiwac
Differential Revision: https://reviews.freebsd.org/D55265
(cherry picked from commit 16822dac32ab8955539ffa4eda05145df8638154)
acpi_panasonic: acquire serial lock before calling hkey_sound_mute in shutdown
acpi_panasonic_shutdown() calls hkey_sound_mute() without holding
the ACPI serial lock. Every other call site holds
`ACPI_SERIAL_BEGIN(panasonic)` before calling it, as the locking
model is caller-owned.
This seems to affect the whole Panasonic Toughtbook lineup btw.
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D56718
(cherry picked from commit 7619d14d08a0036a07dce670f55b9568f8133b38)
usb: support SSP and SSPx2 xHCI
Only the default PSI IDs are supported, other controllers fall back to
USB 3.0. Record the speed IDs the controller has: the root hub BOS
lists those, and a link without one uses the closest lower ID.
Per xHCI 6.2.2, take the parent hub slot ID and port number of SS and
SSP devices from the closest higher-rank hub.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52347
usb: Add support for SSP and SSPx2 hubs
An SSP hub reports its sublink speeds in the BOS descriptor, and
Extended Port Status tells which one each port uses. Read it based on
bcdUSB, since the ports of a hub can be faster than its upstream link.
Without it, the ports are treated as SuperSpeed.
Read the speed again in usbd_req_re_enumerate(), since a link can come
back at another speed.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57204
usb: Implement usbd_req_get_bos_descriptor helper
Get the header or the complete BOS descriptor of SS+ devices.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57202
usb: Add get_ext_port_status helper function
usbd_req_get_ext_port_status() wraps the Get Extended Port Status
request.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57201
usb: Add usbd_bos_foreach helper
Iterate the capabilities of a BOS descriptor.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57199
