diff options
58 files changed, 781 insertions, 333 deletions
@@ -27,6 +27,9 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 16.x IS SLOW: world, or to merely disable the most expensive debugging functionality at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".) +20251105: + pf(4) now supports nat64 via the af-to keyword. + 20251102: Commit e5aa60d06958 changed the internal KAPI between the NFS modules. As such, they all need to be rebuilt diff --git a/bin/date/date.1 b/bin/date/date.1 index b86a660a924d..f68892bd408d 100644 --- a/bin/date/date.1 +++ b/bin/date/date.1 @@ -29,7 +29,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd September 1, 2025 +.Dd November 5, 2025 .Dt DATE 1 .Os .Sh NAME @@ -143,7 +143,8 @@ values are .Cm minutes , .Cm seconds , and -.Cm ns No Pq for nanoseconds . +.Cm ns +.Pq for nanoseconds . The date and time is formatted to the specified precision. When .Ar FMT @@ -172,7 +173,7 @@ Obsolete flag, accepted and ignored for compatibility. .It Fl R Use RFC 2822 date and time output format. This is equivalent to using -.Dq Li %a, %d %b %Y \&%T %z +.Ql %a, %d %b %Y \&%T %z as .Ar output_fmt while @@ -194,9 +195,7 @@ and can be specified in decimal, octal, or hex. Print the date and time of the last modification of .Ar filename . .It Fl u -Display or set the date in -.Tn UTC -(Coordinated Universal) time. +Display or set the date in UTC (Coordinated Universal) time. By default .Nm displays the time in the time zone described by @@ -328,7 +327,7 @@ The format string may contain any of the conversion specifications described in the .Xr strftime 3 manual page and -.Ql %N +.Ql \&%N for nanoseconds, as well as any arbitrary text. A newline .Pq Ql \en @@ -468,7 +467,7 @@ will display: .Dl "Sun Jan 4 04:15:24 GMT 1998" .Pp where it is currently -.Li "Mon Aug 4 04:15:24 BST 1997" . +.Ql "Mon Aug 4 04:15:24 BST 1997" . .Pp The command: .Pp @@ -493,29 +492,31 @@ will display the last Friday of the month: .Dl "Fri Aug 29 04:31:11 BST 1997" .Pp where it is currently -.Li "Mon Aug 4 04:31:11 BST 1997" . +.Ql "Mon Aug 4 04:31:11 BST 1997" . .Pp The command: .Pp .Dl "date 8506131627" .Pp sets the date to -.Dq Li "June 13, 1985, 4:27 PM" . +.Ql "June 13, 1985, 4:27 PM" . .Pp .Dl "date ""+%Y%m%d%H%M.%S""" .Pp may be used on one machine to print out the date suitable for setting on another. -.Qq ( Li "+%m%d%H%M%Y.%S" -for use on -.Tn Linux . ) +.Po Use +.Ql "+%m%d%H%M%Y.%S" +with GNU date on +Linux . +.Pc .Pp The command: .Pp .Dl "date 1432" .Pp sets the time to -.Li "2:32 PM" , +.Ql "2:32 PM" , without modifying the date. .Pp The command @@ -591,10 +592,10 @@ flag is compatible with .St -iso8601 . .Pp The -.Ql %N +.Ql \&%N conversion specification for nanoseconds is a non-standard extension. It is compatible with GNU date's -.Ql %N . +.Ql \&%N . .Sh HISTORY A .Nm @@ -615,6 +616,6 @@ flag was added in .Fx 12.0 . .Pp The -.Ql %N +.Ql \&%N conversion specification was added in .Fx 14.1 . diff --git a/cddl/lib/libdtrace/io.d b/cddl/lib/libdtrace/io.d index d576f57476ce..484e6416bac7 100644 --- a/cddl/lib/libdtrace/io.d +++ b/cddl/lib/libdtrace/io.d @@ -73,7 +73,7 @@ translator bufinfo_t < struct bio *B > { b_lblkno = 0; b_resid = B->bio_resid; b_bufsize = 0; /* XXX gnn */ - b_error = B->bio_error; + b_error = B->bio_exterr.error; }; /* diff --git a/etc/mtree/BSD.include.dist b/etc/mtree/BSD.include.dist index ea333a38d889..97f2194a3fa1 100644 --- a/etc/mtree/BSD.include.dist +++ b/etc/mtree/BSD.include.dist @@ -2,17 +2,17 @@ # Please see the file src/etc/mtree/README before making changes to this file. # -/set type=dir uname=root gname=wheel mode=0755 +/set type=dir uname=root gname=wheel mode=0755 tags=package=clibs-dev . arpa .. - atf-c + atf-c tags=package=atf-dev .. - atf-c++ + atf-c++ tags=package=atf-dev .. - bsm + bsm tags=package=audit-dev .. - bsnmp + bsnmp tags=package=bsnmp-dev .. c++ v1 @@ -118,7 +118,7 @@ scsi .. .. - casper + casper tags=package=libcasper-dev .. crypto .. @@ -190,10 +190,10 @@ wg .. .. - devdctl + devdctl tags=package=utilities-dev .. - edit - readline + edit tags=package=runtime-dev + readline tags=package=runtime-dev .. .. fs @@ -252,39 +252,39 @@ virstor .. .. - gssapi + gssapi tags=package=kerberos-dev .. - gssrpc + gssrpc tags=package=kerberos-dev .. - infiniband - complib + infiniband tags=package=utilities-dev + complib tags=package=utilities-dev .. - iba + iba tags=package=utilities-dev .. - opensm + opensm tags=package=utilities-dev .. - vendor + vendor tags=package=utilities-dev .. .. isofs cd9660 .. .. - kadm5 + kadm5 tags=package=kerberos-dev .. krb5 tags=package=kerberos-dev .. - lib80211 + lib80211 tags=package=runtime-dev .. - lib9p + lib9p tags=package=lib9p-dev .. - libipt + libipt tags=package=libipt-dev .. - libmilter + libmilter tags=package=libmilter-dev .. - libxo + libxo tags=package=runtime-dev .. - lzma + lzma tags=package=xz-dev .. machine pc @@ -323,7 +323,7 @@ .. .. netpfil - pf + pf tags=package=pf-dev .. .. netsmb @@ -348,20 +348,20 @@ stm .. .. - openssl + openssl tags=package=openssl-dev .. - pcap + pcap tags=package=utilities-dev .. protocols .. - rdma + rdma tags=package=utilities-dev .. rpc .. rpcsvc .. security - audit + audit tags=package=audit-dev .. mac_biba .. diff --git a/etc/mtree/BSD.usr.dist b/etc/mtree/BSD.usr.dist index 6a8c155e5e73..54d408865fa5 100644 --- a/etc/mtree/BSD.usr.dist +++ b/etc/mtree/BSD.usr.dist @@ -6,35 +6,35 @@ . bin .. - include - private - bsddialog + include tags=package=clibs-dev + private tags=package=clibs-dev + bsddialog tags=package=utilities-dev .. - bsdstat + bsdstat tags=package=libbsdstat-dev .. - event1 + event1 tags=package=libevent1-dev .. - gmock - internal - custom + gmock tags=package=utilities-dev + internal tags=package=utilities-dev + custom tags=package=utilities-dev .. .. .. - gtest - internal - custom + gtest tags=package=utilities-dev + internal tags=package=utilities-dev + custom tags=package=utilities-dev .. .. .. - samplerate + samplerate tags=package=sound-dev .. - sqlite3 + sqlite3 tags=package=libsqlite3-dev .. - ucl + ucl tags=package=libucl-dev .. - yaml + yaml tags=package=libyaml-dev .. - zstd + zstd tags=package=runtime-dev .. .. .. diff --git a/krb5/lib/kadm5clnt/Makefile b/krb5/lib/kadm5clnt/Makefile index 52a7187cf9bb..ef01a5f779e3 100644 --- a/krb5/lib/kadm5clnt/Makefile +++ b/krb5/lib/kadm5clnt/Makefile @@ -86,7 +86,8 @@ ${CHPASS_UTIL_STRINGS_ERR_C}: ${CHPASS_UTIL_STRINGS_ERR} rm -f et-c-${.PREFIX}.et et-c-${.PREFIX}.c afterinstall: - ${INSTALL_LIBSYMLINK} ${SHLIB_LINK} ${DESTDIR}${LIBDIR}/libkadm5clnt.so + ${INSTALL_LIBSYMLINK} ${DEV_TAG_ARGS} ${SHLIB_LINK} \ + ${DESTDIR}${LIBDIR}/libkadm5clnt.so .include <bsd.lib.mk> diff --git a/lib/atf/Makefile.inc b/lib/atf/Makefile.inc index bebed0280596..af176036f136 100644 --- a/lib/atf/Makefile.inc +++ b/lib/atf/Makefile.inc @@ -24,7 +24,7 @@ # SUCH DAMAGE. # -PACKAGE= atf +PACKAGE?= atf LIB_PACKAGE= CFLAGS+= -DHAVE_CONFIG_H diff --git a/lib/atf/libatf-c++/tests/Makefile b/lib/atf/libatf-c++/tests/Makefile index 839c6902d6b1..dc052c19df67 100644 --- a/lib/atf/libatf-c++/tests/Makefile +++ b/lib/atf/libatf-c++/tests/Makefile @@ -1,5 +1,7 @@ .include <bsd.init.mk> +PACKAGE= tests + TESTS_SUBDIRS= detail ATF= ${SRCTOP}/contrib/atf diff --git a/lib/atf/libatf-c++/tests/detail/Makefile b/lib/atf/libatf-c++/tests/detail/Makefile index 4b95f8dbd663..55cefe524068 100644 --- a/lib/atf/libatf-c++/tests/detail/Makefile +++ b/lib/atf/libatf-c++/tests/detail/Makefile @@ -1,5 +1,7 @@ .include <bsd.init.mk> +PACKAGE= tests + TESTSDIR= ${TESTSBASE}/lib/atf/libatf-c++/detail ATF= ${SRCTOP}/contrib/atf diff --git a/lib/atf/libatf-c/tests/Makefile b/lib/atf/libatf-c/tests/Makefile index 5647e7b9fcbe..c81c18a91f00 100644 --- a/lib/atf/libatf-c/tests/Makefile +++ b/lib/atf/libatf-c/tests/Makefile @@ -1,5 +1,7 @@ .include <bsd.init.mk> +PACKAGE= tests + TESTS_SUBDIRS= detail ATF= ${SRCTOP}/contrib/atf diff --git a/lib/atf/libatf-c/tests/detail/Makefile b/lib/atf/libatf-c/tests/detail/Makefile index 5123f6f4d796..3fa2919b98b9 100644 --- a/lib/atf/libatf-c/tests/detail/Makefile +++ b/lib/atf/libatf-c/tests/detail/Makefile @@ -1,5 +1,7 @@ .include <bsd.init.mk> +PACKAGE= tests + TESTSDIR= ${TESTSBASE}/lib/atf/libatf-c/detail ATF= ${SRCTOP}/contrib/atf diff --git a/lib/atf/tests/Makefile b/lib/atf/tests/Makefile index 500ff0f20c3b..2609bb593d57 100644 --- a/lib/atf/tests/Makefile +++ b/lib/atf/tests/Makefile @@ -1,4 +1,7 @@ .PATH: ${SRCTOP}/tests + +PACKAGE= tests + KYUAFILE= yes SUBDIR= test-programs diff --git a/lib/libcasper/Makefile.inc b/lib/libcasper/Makefile.inc index 00bd221feb27..73a761ba4ce3 100644 --- a/lib/libcasper/Makefile.inc +++ b/lib/libcasper/Makefile.inc @@ -1,5 +1,7 @@ .include <src.opts.mk> +PACKAGE?= libcasper + .if ${MK_CASPER} != "no" CFLAGS+=-DWITH_CASPER .endif diff --git a/lib/libcasper/libcasper/Makefile b/lib/libcasper/libcasper/Makefile index 4db26f665f19..1a794791570f 100644 --- a/lib/libcasper/libcasper/Makefile +++ b/lib/libcasper/libcasper/Makefile @@ -1,5 +1,3 @@ -PACKAGE= runtime - SHLIBDIR?= /lib .include <src.opts.mk> diff --git a/lib/libcasper/services/cap_dns/Makefile b/lib/libcasper/services/cap_dns/Makefile index 4b11c97d29e5..b090c553bd28 100644 --- a/lib/libcasper/services/cap_dns/Makefile +++ b/lib/libcasper/services/cap_dns/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 2 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_fileargs/Makefile b/lib/libcasper/services/cap_fileargs/Makefile index 2c52d0887a48..9d70d0ab9237 100644 --- a/lib/libcasper/services/cap_fileargs/Makefile +++ b/lib/libcasper/services/cap_fileargs/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_grp/Makefile b/lib/libcasper/services/cap_grp/Makefile index a921dfa87e7c..13e695813bcf 100644 --- a/lib/libcasper/services/cap_grp/Makefile +++ b/lib/libcasper/services/cap_grp/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_net/Makefile b/lib/libcasper/services/cap_net/Makefile index 1ba35a674a05..4e9814118c41 100644 --- a/lib/libcasper/services/cap_net/Makefile +++ b/lib/libcasper/services/cap_net/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE=libcasper - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_netdb/Makefile b/lib/libcasper/services/cap_netdb/Makefile index 853052e78d04..a330eeedeb11 100644 --- a/lib/libcasper/services/cap_netdb/Makefile +++ b/lib/libcasper/services/cap_netdb/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_pwd/Makefile b/lib/libcasper/services/cap_pwd/Makefile index a1e97845c736..ba8df80d5ad7 100644 --- a/lib/libcasper/services/cap_pwd/Makefile +++ b/lib/libcasper/services/cap_pwd/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_sysctl/Makefile b/lib/libcasper/services/cap_sysctl/Makefile index 522313df4ffc..4408bad4efb4 100644 --- a/lib/libcasper/services/cap_sysctl/Makefile +++ b/lib/libcasper/services/cap_sysctl/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 2 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/cap_syslog/Makefile b/lib/libcasper/services/cap_syslog/Makefile index 88979d8bed23..d18ad6d76ede 100644 --- a/lib/libcasper/services/cap_syslog/Makefile +++ b/lib/libcasper/services/cap_syslog/Makefile @@ -2,8 +2,6 @@ SHLIBDIR?= /lib .include <src.opts.mk> -PACKAGE= runtime - SHLIB_MAJOR= 1 INCSDIR?= ${INCLUDEDIR}/casper diff --git a/lib/libcasper/services/tests/Makefile b/lib/libcasper/services/tests/Makefile index 29b1b564beca..4b6c72fd86e8 100644 --- a/lib/libcasper/services/tests/Makefile +++ b/lib/libcasper/services/tests/Makefile @@ -1,4 +1,6 @@ .PATH: ${SRCTOP}/tests + +PACKAGE= tests KYUAFILE= yes .include <bsd.test.mk> diff --git a/lib/libcasper/tests/Makefile b/lib/libcasper/tests/Makefile index 29b1b564beca..4b6c72fd86e8 100644 --- a/lib/libcasper/tests/Makefile +++ b/lib/libcasper/tests/Makefile @@ -1,4 +1,6 @@ .PATH: ${SRCTOP}/tests + +PACKAGE= tests KYUAFILE= yes .include <bsd.test.mk> diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index e739e55033e2..e747763ae6ef 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -1491,7 +1491,7 @@ snl_attr_get_pf_rule_labels(struct snl_state *ss, struct nlattr *nla, bool ret; if (l->i >= PF_RULE_MAX_LABEL_COUNT) - return (E2BIG); + return (false); ret = snl_attr_copy_string(ss, nla, (void *)PF_RULE_LABEL_SIZE, l->labels[l->i]); @@ -1561,7 +1561,7 @@ snl_attr_get_pf_timeout(struct snl_state *ss, struct nlattr *nla, bool ret; if (t->i >= PFTM_MAX) - return (E2BIG); + return (false); ret = snl_attr_get_uint32(ss, nla, NULL, &t->timeouts[t->i]); if (ret) @@ -2742,6 +2742,88 @@ int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, return (0); } +struct nl_addrs { + size_t max; + struct pfr_addr *addrs; + size_t count; + size_t total_count; +}; + +#define _OUT(_field) offsetof(struct pfr_addr, _field) +static const struct snl_attr_parser ap_pfr_addr[] = { + { .type = PFR_A_AF, .off = _OUT(pfra_af), .cb = snl_attr_get_uint32 }, + { .type = PFR_A_NET, .off = _OUT(pfra_net), .cb = snl_attr_get_uint8 }, + { .type = PFR_A_NOT, .off = _OUT(pfra_not), .cb = snl_attr_get_bool }, + { .type = PFR_A_ADDR, .off = _OUT(pfra_ip6addr), .cb = snl_attr_get_in6_addr }, +}; +#undef _OUT +SNL_DECLARE_ATTR_PARSER(pfr_addr_parser, ap_pfr_addr); + +static bool +snl_attr_get_pfr_addrs(struct snl_state *ss, struct nlattr *nla, + const void *arg __unused, void *target) +{ + struct nl_addrs *a = (struct nl_addrs *)target; + bool ret; + + if (a->count >= a->max) + return (false); + + ret = snl_parse_header(ss, NLA_DATA(nla), NLA_DATA_LEN(nla), + &pfr_addr_parser, &a->addrs[a->count]); + if (ret) + a->count++; + + return (ret); +} + +#define _OUT(_field) offsetof(struct nl_addrs, _field) +static struct snl_attr_parser ap_table_get_addr[] = { + { .type = PF_TA_ADDR, .off = 0, .cb = snl_attr_get_pfr_addrs }, + { .type = PF_TA_ADDR_COUNT, .off = _OUT(total_count), .cb = snl_attr_get_uint32 }, +}; +#undef _OUT +SNL_DECLARE_PARSER(table_get_addr_parser, struct genlmsghdr, snl_f_p_empty, ap_table_get_addr); +int +pfctl_table_get_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, + struct pfr_addr *addr, int *size, int flags) +{ + struct nl_addrs addrs = { 0 }; + struct snl_writer nw; + struct snl_errmsg_data e = {}; + struct nlmsghdr *hdr; + uint32_t seq_id; + int family_id; + + family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME); + if (family_id == 0) + return (ENOTSUP); + + snl_init_writer(&h->ss, &nw); + hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_TABLE_GET_ADDR); + + snl_add_msg_attr_table(&nw, PF_TA_TABLE, tbl); + snl_add_msg_attr_u32(&nw, PF_TA_FLAGS, flags); + + if ((hdr = snl_finalize_msg(&nw)) == NULL) + return (ENXIO); + + seq_id = hdr->nlmsg_seq; + if (! snl_send_message(&h->ss, hdr)) + return (ENXIO); + + addrs.addrs = addr; + addrs.max = *size; + while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) { + if (! snl_parse_nlmsg(&h->ss, hdr, &table_get_addr_parser, &addrs)) + continue; + } + + *size = addrs.total_count; + + return (e.error); +} + int pfctl_set_statusif(struct pfctl_handle *h, const char *ifname) { diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index ae4b18dabe75..a5b7e1c23bd0 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -529,6 +529,8 @@ int pfctl_table_set_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int size, int *size2, int *nadd, int *ndel, int *nchange, int flags); +int pfctl_table_get_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr *addr, + int *size, int flags); int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr *addr, int *size, int flags); int pfctl_set_statusif(struct pfctl_handle *h, const char *ifname); diff --git a/lib/libsys/posix_fallocate.2 b/lib/libsys/posix_fallocate.2 index 8be075b41331..94858c4a0f90 100644 --- a/lib/libsys/posix_fallocate.2 +++ b/lib/libsys/posix_fallocate.2 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 30, 2020 +.Dd November 2, 2025 .Dt POSIX_FALLOCATE 2 .Os .Sh NAME @@ -105,8 +105,7 @@ The .Fa len argument was less than or equal to zero, the .Fa offset -argument was less than zero, -or the operation is not supported by the file system. +argument was less than zero. .It Bq Er EIO An I/O error occurred while reading from or writing to a file system. .It Bq Er EINTEGRITY @@ -123,6 +122,8 @@ media. The file descriptor .Fa fd has insufficient rights. +.It Bq Er EOPNOTSUPP +The operation is not supported by the file system. .It Bq Er ESPIPE The .Fa fd @@ -137,12 +138,29 @@ argument is associated with a pipe or FIFO. The .Fn posix_fallocate system call conforms to -.St -p1003.1-2004 . +.St -p1003.1-2024 . .Sh HISTORY The .Fn posix_fallocate function appeared in .Fx 9.0 . +.Pp +Previous versions of +.Nm +used +.Er EINVAL +to indicate that the operation is not supported by the file system, as specified +in +.St -p1003.1 +Base Specifications, Issue 7. +.St -p1003.1 +Base Specifications, Issue 8 switched to requiring +.Er EOPNOTSUPP +for this error case. +ZFS adopted the latter convention in +.Fx 15.0 , +and the remaining filesystems in base adopted it in +.Fx 15.1 . .Sh AUTHORS .Fn posix_fallocate and this manual page were initially written by diff --git a/libexec/atf/Makefile.inc b/libexec/atf/Makefile.inc index e40827fa0b69..5fd06c35cd09 100644 --- a/libexec/atf/Makefile.inc +++ b/libexec/atf/Makefile.inc @@ -24,7 +24,7 @@ # SUCH DAMAGE. # -PACKAGE= atf +PACKAGE?= atf LIB_PACKAGE= CFLAGS+= -DHAVE_CONFIG_H diff --git a/libexec/atf/atf-check/tests/Makefile b/libexec/atf/atf-check/tests/Makefile index e98f82d941cd..6e21e4ede211 100644 --- a/libexec/atf/atf-check/tests/Makefile +++ b/libexec/atf/atf-check/tests/Makefile @@ -1,6 +1,8 @@ ATF= ${SRCTOP}/contrib/atf .PATH: ${ATF}/atf-sh +PACKAGE= tests + ATF_TESTS_SH= atf-check_test .include <bsd.test.mk> diff --git a/libexec/atf/tests/Makefile b/libexec/atf/tests/Makefile index 29b1b564beca..ad9431e75a63 100644 --- a/libexec/atf/tests/Makefile +++ b/libexec/atf/tests/Makefile @@ -1,4 +1,7 @@ .PATH: ${SRCTOP}/tests + +PACKAGE= tests + KYUAFILE= yes .include <bsd.test.mk> diff --git a/release/packages/sets/base-dbg.ucl b/release/packages/sets/base-dbg.ucl index 79e5de22522e..c96b10416dcb 100644 --- a/release/packages/sets/base-dbg.ucl +++ b/release/packages/sets/base-dbg.ucl @@ -28,5 +28,8 @@ deps { }, "set-devel-dbg" { version = "${VERSION}" + }, + "set-optional-dbg" { + version = "${VERSION}" } } diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c index 981823ca6bb9..a8dc3be2d5d1 100644 --- a/sbin/ipf/libipf/interror.c +++ b/sbin/ipf/libipf/interror.c @@ -17,7 +17,7 @@ typedef struct { static ipf_error_entry_t *find_error(int); -#define IPF_NUM_ERRORS 477 +#define IPF_NUM_ERRORS sizeof(ipf_errors) / sizeof(ipf_error_entry_t) /* * NO REUSE OF NUMBERS! @@ -25,7 +25,7 @@ static ipf_error_entry_t *find_error(int); * IF YOU WANT TO ADD AN ERROR TO THIS TABLE, _ADD_ A NEW NUMBER. * DO _NOT_ USE AN EMPTY NUMBER OR FILL IN A GAP. */ -static ipf_error_entry_t ipf_errors[IPF_NUM_ERRORS] = { +static ipf_error_entry_t ipf_errors[] = { { 1, "auth table locked/full" }, { 2, "" }, { 3, "copyinptr received bad address" }, @@ -228,6 +228,8 @@ static ipf_error_entry_t ipf_errors[IPF_NUM_ERRORS] = { { 30024, "object size incorrect for hash table" }, { 30025, "hash table size must be at least 1"}, { 30026, "cannot allocate memory for hash table context" }, + { 30027, "hash table larger than maximum allowed" }, + { 30028, "hash table multiplication overflow" }, /* -------------------------------------------------------------------------- */ { 40001, "invalid minor device number for log read" }, { 40002, "read size too small" }, diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index 3b7161420e33..823921953eaf 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -182,7 +182,7 @@ pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, { int ret; - ret = pfctl_table_get_addrs(dev, tbl, addr, size, flags); + ret = pfctl_table_get_addrs_h(pfh, tbl, addr, size, flags); if (ret) { errno = ret; return (-1); diff --git a/secure/lib/libcrypto/Makefile.inc b/secure/lib/libcrypto/Makefile.inc index 5b281166df61..73c650d590ff 100644 --- a/secure/lib/libcrypto/Makefile.inc +++ b/secure/lib/libcrypto/Makefile.inc @@ -1,6 +1,6 @@ .include <bsd.own.mk> -PACKAGE= openssl +PACKAGE?= openssl LIB_PACKAGE= LCRYPTO_SRC= ${SRCTOP}/crypto/openssl diff --git a/share/man/man4/ice.4 b/share/man/man4/ice.4 index c7675e627726..a54a6b3fd6f3 100644 --- a/share/man/man4/ice.4 +++ b/share/man/man4/ice.4 @@ -32,12 +32,12 @@ .\" .\" * Other names and brands may be claimed as the property of others. .\" -.Dd October 3, 2025 +.Dd November 5, 2025 .Dt ICE 4 .Os .Sh NAME .Nm ice -.Nd Intel Ethernet 800 Series Driver +.Nd Intel Ethernet 800 Series 1GbE to 200GbE driver .Sh SYNOPSIS .Cd device iflib .Cd device ice @@ -62,42 +62,75 @@ or .Cd dev.ice.#.pba_number .Cd dev.ice.#.hw.mac.* .Sh DESCRIPTION -.Ss Features The .Nm driver provides support for any PCI Express adapter or LOM -(LAN On Motherboard) -in the Intel\(rg Ethernet 800 Series. -As of this writing, the series includes devices with these model numbers: +.Pq LAN On Motherboard +in the Intel Ethernet 800 Series. +.Pp +The following topics are covered in this manual: .Pp .Bl -bullet -compact .It -Intel\(rg Ethernet Controller E810\-C +.Sx Features +.It +.Sx Dynamic Device Personalization +.It +.Sx Jumbo Frames +.It +.Sx Remote Direct Memory Access +.It +.Sx RDMA Monitoring +.It +.Sx Data Center Bridging +.It +.Sx L3 QoS Mode +.It +.Sx Firmware Link Layer Discovery Protocol Agent +.It +.Sx Link-Level Flow Control +.It +.Sx Forward Error Correction +.It +.Sx Speed and Duplex Configuration +.It +.Sx Disabling physical link when the interface is brought down +.It +.Sx Firmware Logging +.It +.Sx Debug Dump +.It +.Sx Debugging PHY Statistics .It -Intel\(rg Ethernet Controller E810\-XXV +.Sx Transmit Balancing .It -Intel\(rg Ethernet Connection E822\-C +.Sx Thermal Monitoring .It -Intel\(rg Ethernet Connection E822\-L +.Sx Network Memory Buffer Allocation .It -Intel\(rg Ethernet Connection E823\-C +.Sx Additional Utilities .It -Intel\(rg Ethernet Connection E823\-L +.Sx Optics and auto-negotiation .It -Intel\(rg Ethernet Connection E825\-C +.Sx PCI-Express Slot Bandwidth .It -Intel\(rg Ethernet Connection E830\-C +.Sx HARDWARE .It -Intel\(rg Ethernet Connection E830\-CC +.Sx LOADER TUNABLES .It -Intel\(rg Ethernet Connection E830\-L +.Sx SYSCTL VARIABLES .It -Intel\(rg Ethernet Connection E830\-XXV +.Sx INTERRUPT STORMS +.It +.Sx IOVCTL OPTIONS +.It +.Sx SUPPORT +.It +.Sx SEE ALSO +.It +.Sx HISTORY .El -.Pp -For questions related to hardware requirements, refer to the documentation -supplied with the adapter. -.Pp +.Ss Features Support for Jumbo Frames is provided via the interface MTU setting. Selecting an MTU larger than 1500 bytes with the .Xr ifconfig 8 @@ -141,7 +174,7 @@ downloading a new driver or DDP package. Safe Mode only applies to the affected physical function and does not impact any other PFs. See the -.Dq Intel\(rg Ethernet Adapters and Devices User Guide +.Dq Intel Ethernet Adapters and Devices User Guide for more details on DDP and Safe Mode. .Pp If issues are encountered with the DDP package file, an updated driver or @@ -153,8 +186,8 @@ The DDP package cannot be updated if any PF drivers are already loaded. To overwrite a package, unload all PFs and then reload the driver with the new package. .Pp -Only one DDP package can be used per driver, even if more than one -device installed that uses the driver. +Only one DDP package can be used per driver, +even if more than one installed device uses the driver. .Pp Only the first loaded PF per device can download a package for that device. .Ss Jumbo Frames @@ -187,7 +220,7 @@ RoCEv2 (RDMA over Converged Ethernet) protocols. The major difference is that iWARP performs RDMA over TCP, while RoCEv2 uses UDP. .Pp -Devices based on the Intel\(rg Ethernet 800 Series do not support RDMA when +Devices based on the Intel Ethernet 800 Series do not support RDMA when operating in multiport mode with more than 4 ports. .Pp For detailed installation and configuration information for RDMA, see @@ -200,7 +233,7 @@ analysis tools like .Xr tcpdump 1 . This mirroring may impact performance. .Pp -To use RDMA monitoring, more MSI\-X interrupts may need to be reserved. +To use RDMA monitoring, more MSI-X interrupts may need to be reserved. Before the .Nm driver loads, configure the following tunable provided by @@ -209,7 +242,7 @@ driver loads, configure the following tunable provided by dev.ice.<interface #>.iflib.use_extra_msix_vectors=4 .Ed .Pp -The number of extra MSI\-X interrupt vectors may need to be adjusted. +The number of extra MSI-X interrupt vectors may need to be adjusted. .Pp To create/delete the interface: .Bd -literal -offset indent @@ -245,14 +278,15 @@ DCB is normally configured on the network using the DCBX protocol (802.1Qaz), a specialization of LLDP (802.1AB). The .Nm driver supports the following mutually exclusive variants of DCBX support: +.Pp .Bl -bullet -compact .It -Firmware\-based LLDP Agent +Firmware-based LLDP Agent .It -Software\-based LLDP Agent +Software-based LLDP Agent .El .Pp -In firmware\-based mode, firmware intercepts all LLDP traffic and handles DCBX +In firmware-based mode, firmware intercepts all LLDP traffic and handles DCBX negotiation transparently for the user. In this mode, the adapter operates in .Dq willing @@ -262,25 +296,25 @@ The local user can only query the negotiated DCB configuration. For information on configuring DCBX parameters on a switch, please consult the switch manufacturer'ss documentation. .Pp -In software\-based mode, LLDP traffic is forwarded to the network stack and user +In software-based mode, LLDP traffic is forwarded to the network stack and user space, where a software agent can handle it. In this mode, the adapter can operate in .Dq nonwilling DCBX mode and DCB configuration can be both queried and set locally. -This mode requires the FW\-based LLDP Agent to be disabled. +This mode requires the FW-based LLDP Agent to be disabled. .Pp -Firmware\-based mode and software\-based mode are controlled by the +Firmware-based mode and software-based mode are controlled by the .Dq fw_lldp_agent sysctl. Refer to the Firmware Link Layer Discovery Protocol Agent section for more information. .Pp -Link\-level flow control and priority flow control are mutually exclusive. +Link-level flow control and priority flow control are mutually exclusive. The ice driver will disable link flow control when priority flow control is enabled on any traffic class (TC). It will disable priority flow control when link flow control is enabled. .Pp -To enable/disable priority flow control in software\-based DCBX mode: +To enable/disable priority flow control in software-based DCBX mode: .Bd -literal -offset indent sysctl dev.ice.<interface #>.pfc=1 (or 0 to disable) .Ed @@ -307,10 +341,10 @@ For example, to map UP 0 and 1 to TC 0, UP 2 and 3 to TC 1, UP 4 and .Bd -literal -offset indent sysctl dev.ice.<interface #>.up2tc_map=0,0,1,1,2,2,3,3 .Ed -.Ss L3 QoS mode +.Ss L3 QoS Mode The .Nm -driver supports setting DSCP\-based Layer 3 Quality of Service (L3 QoS) +driver supports setting DSCP-based Layer 3 Quality of Service (L3 QoS) in the PF driver. The driver initializes in L2 QoS mode by default; L3 QoS is disabled by default. @@ -319,13 +353,13 @@ Use the following sysctl to enable or disable L3 QoS: sysctl dev.ice.<interface #>.pfc_mode=1 (or 0 to disable) .Ed .Pp -If the L3 QoS mode is disabled, it returns to L2 QoS mode. +If L3 QoS mode is disabled, it returns to L2 QoS mode. .Pp To map a DSCP value to a traffic class, separate the values by commas. -For example, to map DSCPs 0\-3 and DSCP 8 to DCB TCs 0\-3 and 4, respectively: +For example, to map DSCPs 0-3 and DSCP 8 to DCB TCs 0-3 and 4, respectively: .Bd -literal -offset indent -sysctl dev.ice.<interface #>.dscp2tc_map.0\-7=0,1,2,3,0,0,0,0 -sysctl dev.ice.<interface #>.dscp2tc_map.8\-15=4,0,0,0,0,0,0,0 +sysctl dev.ice.<interface #>.dscp2tc_map.0-7=0,1,2,3,0,0,0,0 +sysctl dev.ice.<interface #>.dscp2tc_map.8-15=4,0,0,0,0,0,0,0 .Ed .Pp To change the DSCP mapping back to the default traffic class, set all the @@ -336,25 +370,25 @@ To view the currently configured mappings, use the following: sysctl dev.ice.<interface #>.dscp2tc_map .Ed .Pp -L3 QoS mode is not available when FW\-LLDP is enabled. +L3 QoS mode is not available when FW-LLDP is enabled. .Pp -FW\-LLDP cannot be enabled if L3 QoS mode is active. +FW-LLDP cannot be enabled if L3 QoS mode is active. .Pp -Disable FW\-LLDP before switching to L3 QoS mode. +Disable FW-LLDP before switching to L3 QoS mode. .Pp Refer to the .Sx Firmware Link Layer Discovery Protocol Agent -section in this README for more information on disabling FW\-LLDP. +section in this README for more information on disabling FW-LLDP. .Ss Firmware Link Layer Discovery Protocol Agent -Use sysctl to change FW\-LLDP settings. -The FW\-LLDP setting is per port and persists across boots. +Use sysctl to change FW-LLDP settings. +The FW-LLDP setting is per port and persists across boots. .Pp -To enable the FW\-LLDP Agent: +To enable the FW-LLDP Agent: .Bd -literal -offset indent sysctl dev.ice.<interface #>.fw_lldp_agent=1 .Ed .Pp -To disable the FW\-LLDP Agebt: +To disable the FW-LLDP Agebt: .Bd -literal -offset indent sysctl dev.ice.<interface #>.fw_lldp_agent=0 .Ed @@ -368,11 +402,14 @@ The UEFI HII LLDP Agent attribute must be enabled for this setting to take effect. If the .Dq LLDP AGENT -attribute is set to disabled, the FW\-LLDP Agent cannot be enabled from the +attribute is set to disabled, the FW-LLDP Agent cannot be enabled from the driver. -.Ss Link\-Level Flow Control (LFC) -Ethernet Flow Control (IEEE 802.3x) can be configured with sysctl to enable -receiving and transmitting pause frames for +.Ss Link-Level Flow Control +Ethernet Flow Control +.Pq IEEE 802.3x or LFC +can be configured with +.Xr sysctl 8 +to enable receiving and transmitting pause frames for .Nm . When transmit is enabled, pause frames are generated when the receive packet buffer crosses a predefined threshold. @@ -434,7 +471,7 @@ in case the link partner does not have FEC enabled or is not FEC capable: sysctl dev.ice.<interface #>.allow_no_fec_modules_in_auto=1 .Ed .Pp -NOTE: This flag is currently not supported on the Intel\(rg Ethernet 830 +NOTE: This flag is currently not supported on the Intel Ethernet 830 Series. .Pp To show the current FEC settings that are negotiated on the link: @@ -449,7 +486,7 @@ sysctl dev.ice.<interface #>.requested_fec .Pp To see the valid FEC modes for the link: .Bd -literal -offset indent -sysctl \-d dev.ice.<interface #>.requested_fec +sysctl -d dev.ice.<interface #>.requested_fec .Ed .Ss Speed and Duplex Configuration The speed and duplex settings cannot be hard set. @@ -464,17 +501,17 @@ Supported speeds will vary by device. Depending on the speeds the device supports, valid bits used in a speed mask could include: .Bd -literal -offset indent -0x0 \- Auto -0x2 \- 100 Mbps -0x4 \- 1 Gbps -0x8 \- 2.5 Gbps -0x10 \- 5 Gbps -0x20 \- 10 Gbps -0x80 \- 25 Gbps -0x100 \- 40 Gbps -0x200 \- 50 Gbps -0x400 \- 100 Gbps -0x800 \- 200 Gbps +0x0 - Auto +0x2 - 100 Mbps +0x4 - 1 Gbps +0x8 - 2.5 Gbps +0x10 - 5 Gbps +0x20 - 10 Gbps +0x80 - 25 Gbps +0x100 - 40 Gbps +0x200 - 50 Gbps +0x400 - 100 Gbps +0x800 - 200 Gbps .Ed .Ss Disabling physical link when the interface is brought down When the @@ -494,7 +531,7 @@ The driver allows for the generation of firmware logs for supported categories of events, to help debug issues with Customer Support. Refer to the -.Dq Intel\(rg Ethernet Adapters and Devices User Guide +.Dq Intel Ethernet Adapters and Devices User Guide for an overview of this feature and additional tips. .Pp At a high level, to capture a firmware log: @@ -553,7 +590,7 @@ DCBx (Bit 11) .It Va dcb DCB (Bit 12) .It Va xlr -XLR (function\-level resets; Bit 13) +XLR (function-level resets; Bit 13) .It Va nvm NVM (Bit 14) .It Va auth @@ -561,7 +598,7 @@ Authentication (Bit 15) .It Va vpd Vital Product Data (Bit 16) .It Va iosf -Intel On\-Chip System Fabric (Bit 17) +Intel On-Chip System Fabric (Bit 17) .It Va parser Parser (Bit 18) .It Va sw @@ -649,8 +686,8 @@ dmesg > log_output NOTE: Logging a large number of modules or too high of a verbosity level will add extraneous messages to dmesg and could hinder debug efforts. .Ss Debug Dump -Intel\(rg Ethernet 800 Series devices support debug dump, which allows -gathering of runtime register values from the firmware for +Intel Ethernet 800 Series devices support debug dump, +which allows gathering of runtime register values from the firmware for .Dq clusters of events and then write the results to a single dump file, for debugging complicated issues in the field. @@ -662,7 +699,7 @@ Debug dump captures the current state of the specified cluster(s) and is a stateless snapshot of the whole device. .Pp NOTE: Like with firmware logs, the contents of the debug dump are not -human\-readable. +human-readable. Work with Customer Support to decode the file. .Pp Debug dump is per device, not per PF. @@ -685,7 +722,7 @@ pass the argument. For example: .Bd -literal -offset indent -sysctl \-d dev.ice.0.debug.dump.clusters +sysctl -d dev.ice.0.debug.dump.clusters .Ed .Pp Possible bitmask values for @@ -693,24 +730,24 @@ Possible bitmask values for are: .Bl -bullet -compact .It -0 \- Dump all clusters (only supported on Intel\(rg Ethernet E810 Series and -Intel\(rg Ethernet E830 Series) +0 - Dump all clusters (only supported on Intel Ethernet E810 Series and +Intel Ethernet E830 Series) .It -0x1 \- Switch +0x1 - Switch .It -0x2 \- ACL +0x2 - ACL .It -0x4 \- Tx Scheduler +0x4 - Tx Scheduler .It -0x8 \- Profile Configuration +0x8 - Profile Configuration .It -0x20 \- Link +0x20 - Link .It -0x80 \- DCB +0x80 - DCB .It -0x100 \- L2P +0x100 - L2P .It -0x400000 \- Manageability Transactions (only supported on Intel\(rg Ethernet +0x400000 - Manageability Transactions (only supported on Intel Ethernet E810 Series) .El .Pp @@ -726,11 +763,11 @@ sysctl dev.ice.0.debug.dump.clusters=0 .Pp NOTE: Using 0 will skip Manageability Transactions data. .Pp -If a single cluster is not specified, the driver will dump all clusters to a -single file. +If a single cluster is not specified, +the driver will dump all clusters to a single file. Issue the debug dump command, using the following: .Bd -literal -offset indent -sysctl \-b dev.ice.<interface #>.debug.dump.dump=1 > dump.bin +sysctl -b dev.ice.<interface #>.debug.dump.dump=1 > dump.bin .Ed .Pp NOTE: The driver will not receive the command if the sysctl is not set to @@ -765,13 +802,13 @@ Use the following sysctl to read the PHY registers: sysctl dev.ice.<interface #>.debug.phy_statistics .Ed .Pp -NOTE: The contents of the registers are not human\-readable. +NOTE: The contents of the registers are not human-readable. Like with firmware logs and debug dump, work with Customer Support to decode the file. .Ss Transmit Balancing Some Intel(R) Ethernet 800 Series devices allow for enabling a transmit balancing feature to improve transmit performance under certain conditions. -When enabled, the feature should provide more consistent transmit +When enabled, this feature should provide more consistent transmit performance across queues and/or PFs and VFs. .Pp By default, transmit balancing is disabled in the NVM. @@ -809,7 +846,7 @@ sysctl dev.ice.<interface #>.temp may have a low number of network memory buffers (mbufs) by default. If the number of mbufs available is too low, it may cause the driver to fail to initialize and/or cause the system to become unresponsive. -Check to see if the system is mbuf\-starved by running +Check to see if the system is mbuf-starved by running .Ic netstat Fl m . Increase the number of mbufs by editing the lines below in .Pa /etc/sysctl.conf : @@ -821,8 +858,8 @@ kern.ipc.nmbjumbo16 kern.ipc.nmbufs .Ed .Pp -The amount of memory that should be allocated is system specific, and may require some -trial and error. +The amount of memory that should be allocated is system specific, +and may require some trial and error. Also, increasing the following in .Pa /etc/sysctl.conf could help increase network performance: @@ -847,13 +884,91 @@ To change the behavior of the QSFP28 ports on E810-C adapters, use the Intel To update the firmware on an adapter, use the Intel .Sy Non-Volatile Memory (NVM) Update Utility for Intel Ethernet Network Adapters E810 series - FreeBSD .El +.Ss Optics and auto-negotiation +Modules based on 100GBASE-SR4, +active optical cable (AOC), and active copper cable (ACC) +do not support auto-negotiation per the IEEE specification. +To obtain link with these modules, +auto-negotiation must be turned off on the link partner's switch ports. +.Pp +Note that adapters also support +all passive and active limiting direct attach cables +that comply with SFF-8431 v4.1 and SFF-8472 v10.4 specifications. +.Ss PCI-Express Slot Bandwidth +Some PCIe x8 slots are actually configured as x4 slots. +These slots have insufficient bandwidth +for full line rate with dual port and quad port devices. +In addition, +if a PCIe v4.0 or v3.0-capable adapter is placed into into a PCIe v2.x +slot, full bandwidth will not be possible. +.Pp +The driver detects this situation and +writes the following message in the system log: +.Bd -ragged -offset indent +PCI-Express bandwidth available for this device +may be insufficient for optimal performance. +Please move the device to a different PCI-e link +with more lanes and/or higher transfer rate. +.Ed +.Pp +If this error occurs, +moving the adapter to a true PCIe x8 or x16 slot will resolve the issue. +For best performance, install devices in the following PCI slots: +.Bl -bullet +.It +Any 100Gbps-capable Intel(R) Ethernet 800 Series device: Install in a +PCIe v4.0 x8 or v3.0 x16 slot +.It +A 200Gbps-capable Intel(R) Ethernet 830 Series device: Install in a +PCIe v5.0 x8 or v4.0 x16 slot +.El +.Pp +For questions related to hardware requirements, +refer to the documentation supplied with the adapter. .Sh HARDWARE The .Nm -driver supports the Intel Ethernet 800 series. -Some adapters in this series with SFP28/QSFP28 cages -have firmware that requires that Intel qualified modules are used; these -qualified modules are listed below. +driver supports the following +Intel 800 series 1Gb to 200Gb Ethernet controllers: +.Pp +.Bl -bullet -compact +.It +Intel Ethernet Controller E810-C +.It +Intel Ethernet Controller E810-XXV +.It +Intel Ethernet Connection E822-C +.It +Intel Ethernet Connection E822-L +.It +Intel Ethernet Connection E823-C +.It +Intel Ethernet Connection E823-L +.It +Intel Ethernet Connection E825-C +.It +Intel Ethernet Connection E830-C +.It +Intel Ethernet Connection E830-CC +.It +Intel Ethernet Connection E830-L +.It +Intel Ethernet Connection E830-XXV +.It +Intel Ethernet Connection E835-C +.It +Intel Ethernet Connection E835-CC +.It +Intel Ethernet Connection E835-L +.It +Intel Ethernet Connection E835-XXV +.El +.Pp +The +.Nm +driver supports some adapters in this series with SFP28/QSFP28 cages +which have firmware that requires that Intel qualified modules are used; +these qualified modules are listed below. This qualification check cannot be disabled by the driver. .Pp The @@ -862,13 +977,13 @@ driver supports 100Gb Ethernet adapters with these QSFP28 modules: .Pp .Bl -bullet -compact .It -Intel\(rg 100G QSFP28 100GBASE-SR4 E100GQSFPSR28SRX +Intel 100G QSFP28 100GBASE-SR4 E100GQSFPSR28SRX .It -Intel\(rg 100G QSFP28 100GBASE-SR4 SPTMBP1PMCDF +Intel 100G QSFP28 100GBASE-SR4 SPTMBP1PMCDF .It -Intel\(rg 100G QSFP28 100GBASE-CWDM4 SPTSBP3CLCCO +Intel 100G QSFP28 100GBASE-CWDM4 SPTSBP3CLCCO .It -Intel\(rg 100G QSFP28 100GBASE-DR SPTSLP2SLCDF +Intel 100G QSFP28 100GBASE-DR SPTSLP2SLCDF .El .Pp The @@ -877,11 +992,11 @@ driver supports 25Gb and 10Gb Ethernet adapters with these SFP28 modules: .Pp .Bl -bullet -compact .It -Intel\(rg 10G/25G SFP28 25GBASE-SR E25GSFP28SR +Intel 10G/25G SFP28 25GBASE-SR E25GSFP28SR .It -Intel\(rg 25G SFP28 25GBASE-SR E25GSFP28SRX (Extended Temp) +Intel 25G SFP28 25GBASE-SR E25GSFP28SRX (Extended Temp) .It -Intel\(rg 25G SFP28 25GBASE-LR E25GSFP28LRX (Extended Temp) +Intel 25G SFP28 25GBASE-LR E25GSFP28LRX (Extended Temp) .El .Pp The @@ -890,54 +1005,15 @@ driver supports 10Gb and 1Gb Ethernet adapters with these SFP+ modules: .Pp .Bl -bullet -compact .It -Intel\(rg 1G/10G SFP+ 10GBASE-SR E10GSFPSR +Intel 1G/10G SFP+ 10GBASE-SR E10GSFPSR .It -Intel\(rg 1G/10G SFP+ 10GBASE-SR E10GSFPSRG1P5 +Intel 1G/10G SFP+ 10GBASE-SR E10GSFPSRG1P5 .It -Intel\(rg 1G/10G SFP+ 10GBASE-SR E10GSFPSRG2P5 +Intel 1G/10G SFP+ 10GBASE-SR E10GSFPSRG2P5 .It -Intel\(rg 10G SFP+ 10GBASE-SR E10GSFPSRX (Extended Temp) +Intel 10G SFP+ 10GBASE-SR E10GSFPSRX (Extended Temp) .It -Intel\(rg 1G/10G SFP+ 10GBASE-LR E10GSFPLR -.El -.Pp -Note that adapters also support all passive and active -limiting direct attach cables that comply with SFF-8431 v4.1 and -SFF-8472 v10.4 specifications. -.Pp -This is not an exhaustive list; please consult product documentation for an -up-to-date list of supported media. -.Ss Fiber optics and auto\-negotiation -Modules based on 100GBASE\-SR4, active optical cable (AOC), and active copper -cable (ACC) do not support auto\-negotiation per the IEEE specification. -To obtain link with these modules, auto\-negotiation must be turned off on the -link partner's switch ports. -.Ss PCI-Express Slot Bandwidth -Some PCIe x8 slots are actually configured as x4 slots. -These slots have insufficient bandwidth for full line rate with dual port and -quad port devices. -In addition, if a PCIe v4.0 or v3.0\-capable adapter is placed into a PCIe v2.x -slot, full bandwidth will not be possible. -.Pp -The driver detects this situation and writes the following message in the -system log: -.Bd -literal -offset indent -PCI\-Express bandwidth available for this device may be insufficient for -optimal performance. -Please move the device to a different PCI\-e link with more lanes and/or -higher transfer rate. -.Ed -.Pp -If this error occurs, moving the adapter to a true PCIe x8 or x16 slot will -resolve the issue. -For best performance, install devices in the following PCI slots: -.Bl -bullet -.It -Any 100Gbps\-capable Intel(R) Ethernet 800 Series device: Install in a -PCIe v4.0 x8 or v3.0 x16 slot -.It -A 200Gbps\-capable Intel(R) Ethernet 830 Series device: Install in a -PCIe v5.0 x8 or v4.0 x16 slot +Intel 1G/10G SFP+ 10GBASE-LR E10GSFPLR .El .Sh LOADER TUNABLES Tunables can be set at the @@ -1035,11 +1111,11 @@ on. Disabled by default. .It num-queues Pq uint16_t Specify the number of queues the VF will have. -By default, this is set to the number of MSI\-X vectors supported by the VF +By default, this is set to the number of MSI-X vectors supported by the VF minus one. .It mirror-src-vsi Pq uint16_t Specify which VSI the VF will mirror traffic from by setting this to a value -other than \-1. +other than -1. All traffic from that VSI will be mirrored to this VF. Can be used as an alternative method to mirror RDMA traffic to another interface than the method described in the diff --git a/share/man/man4/mpr.4 b/share/man/man4/mpr.4 index cce21113e5c2..8de46e4f9272 100644 --- a/share/man/man4/mpr.4 +++ b/share/man/man4/mpr.4 @@ -37,7 +37,7 @@ .\" .\" $Id$ .\" -.Dd June 1, 2019 +.Dd September 28, 2025 .Dt MPR 4 .Os .Sh NAME @@ -99,8 +99,12 @@ Broadcom Ltd./Avago Tech (LSI) SAS 3708 (8 Port SAS/PCIe) .It Broadcom Ltd./Avago Tech (LSI) SAS 3716 (16 Port SAS/PCIe) .It +Broadcom Ltd./Avago Tech (LSI) SAS 3808 (8 Port SAS/PCIe) +.It Broadcom Ltd./Avago Tech (LSI) SAS 3816 (16 Port SAS/PCIe) .It +Broadcom Ltd./Avago Tech (LSI) SAS 3908 (8 Port SAS/PCIe) +.It Broadcom Ltd./Avago Tech (LSI) SAS 3916 (16 Port SAS/PCIe) .El .Sh CONFIGURATION diff --git a/share/man/man9/make_dev.9 b/share/man/man9/make_dev.9 index de56f350faa5..9f2c36fb39a4 100644 --- a/share/man/man9/make_dev.9 +++ b/share/man/man9/make_dev.9 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd January 19, 2025 +.Dd November 4, 2025 .Dt MAKE_DEV 9 .Os .Sh NAME @@ -387,14 +387,18 @@ function is the same as: destroy_dev_sched_cb(cdev, NULL, NULL); .Ed .Pp -The +Neither the .Fn d_close -driver method cannot call +driver method, nor a +.Xr devfs_cdevpriv 9 +.Fa dtr +method can .Fn destroy_dev directly. Doing so causes deadlock when .Fn destroy_dev -waits for all threads to leave the driver methods. +waits for all threads to leave the driver methods and finish executing any +per-open destructors. Also, because .Fn destroy_dev sleeps, no non-sleepable locks may be held over the call. diff --git a/sys/dev/mlx5/mlx5_en/en_hw_tls.h b/sys/dev/mlx5/mlx5_en/en_hw_tls.h index d637314e040e..cd57d2ac5f72 100644 --- a/sys/dev/mlx5/mlx5_en/en_hw_tls.h +++ b/sys/dev/mlx5/mlx5_en/en_hw_tls.h @@ -82,6 +82,8 @@ struct mlx5e_tls { struct sysctl_ctx_list ctx; struct mlx5e_tls_stats stats; struct workqueue_struct *wq; + struct workqueue_struct *prealloc_wq; + struct work_struct prealloc_work; uma_zone_t zone; uint32_t max_resources; /* max number of resources */ int zone_max; @@ -92,6 +94,7 @@ struct mlx5e_tls { int mlx5e_tls_init(struct mlx5e_priv *); void mlx5e_tls_cleanup(struct mlx5e_priv *); int mlx5e_sq_tls_xmit(struct mlx5e_sq *, struct mlx5e_xmit_args *, struct mbuf **); +void mlx5e_tls_prealloc_tags(struct mlx5e_priv *priv); if_snd_tag_alloc_t mlx5e_tls_snd_tag_alloc; diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c b/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c index 6c83de5f3580..851316ccfcd7 100644 --- a/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c +++ b/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c @@ -80,23 +80,39 @@ static const char *mlx5e_tls_stats_desc[] = { }; static void mlx5e_tls_work(struct work_struct *); +static void mlx5e_tls_prealloc_work(struct work_struct *); /* - * Expand the tls tag UMA zone in a sleepable context + * Expand the tls tag UMA zone in an async context */ static void -mlx5e_prealloc_tags(struct mlx5e_priv *priv, int nitems) +mlx5e_tls_prealloc_work(struct work_struct *work) { + struct mlx5e_priv *priv; + struct mlx5e_tls *ptls; struct mlx5e_tls_tag **tags; - int i; + int i, nitems; + + ptls = container_of(work, struct mlx5e_tls, prealloc_work); + priv = container_of(ptls, struct mlx5e_priv, tls); + nitems = ptls->zone_max; tags = malloc(sizeof(tags[0]) * nitems, - M_MLX5E_TLS, M_WAITOK); - for (i = 0; i < nitems; i++) - tags[i] = uma_zalloc(priv->tls.zone, M_WAITOK); + M_MLX5E_TLS, M_WAITOK | M_ZERO); + for (i = 0; i < nitems; i++) { + tags[i] = uma_zalloc(priv->tls.zone, M_NOWAIT); + /* + * If the allocation fails, its likely we are competing + * with real consumers of tags and the zone is full, + * so exit the loop, and release the tags like we would + * if we allocated all "nitems" + */ + if (tags[i] == NULL) + break; + } __compiler_membar(); - for (i = 0; i < nitems; i++) + for (i = 0; i < nitems && tags[i] != NULL; i++) uma_zfree(priv->tls.zone, tags[i]); free(tags, M_MLX5E_TLS); } @@ -244,8 +260,6 @@ mlx5e_tls_init(struct mlx5e_priv *priv) } uma_zone_set_max(ptls->zone, ptls->zone_max); - if (prealloc_tags != 0) - mlx5e_prealloc_tags(priv, ptls->zone_max); for (x = 0; x != MLX5E_TLS_STATS_NUM; x++) ptls->stats.arg[x] = counter_u64_alloc(M_WAITOK); @@ -271,6 +285,23 @@ mlx5e_tls_init(struct mlx5e_priv *priv) } void +mlx5e_tls_prealloc_tags(struct mlx5e_priv *priv) +{ + struct mlx5e_tls *ptls = &priv->tls; + int prealloc_tags = 0; + + if (ptls->prealloc_wq != NULL) + return; + + TUNABLE_INT_FETCH("hw.mlx5.tls_prealloc_tags", &prealloc_tags); + if (prealloc_tags == 0) + return; + ptls->prealloc_wq = create_singlethread_workqueue("mlx5-tls-prealloc_wq"); + INIT_WORK(&ptls->prealloc_work, mlx5e_tls_prealloc_work); + queue_work(ptls->prealloc_wq, &ptls->prealloc_work); +} + +void mlx5e_tls_cleanup(struct mlx5e_priv *priv) { struct mlx5e_tls *ptls = &priv->tls; @@ -280,6 +311,10 @@ mlx5e_tls_cleanup(struct mlx5e_priv *priv) return; ptls->init = 0; + if (ptls->prealloc_wq != NULL) { + flush_workqueue(ptls->prealloc_wq); + destroy_workqueue(ptls->prealloc_wq); + } flush_workqueue(ptls->wq); sysctl_ctx_free(&ptls->ctx); uma_zdestroy(ptls->zone); diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c index f83506bda1aa..ee9c53bb0a60 100644 --- a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c +++ b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c @@ -3335,6 +3335,9 @@ mlx5e_open_locked(if_t ifp) mlx5e_update_carrier(priv); + if ((if_getcapenable(ifp) & (IFCAP_TXTLS4 | IFCAP_TXTLS6)) != 0) + mlx5e_tls_prealloc_tags(priv); + return (0); err_close_channels: diff --git a/sys/dev/mmc/mmc_fdt_helpers.c b/sys/dev/mmc/mmc_fdt_helpers.c index aed85dab55f4..980785464a00 100644 --- a/sys/dev/mmc/mmc_fdt_helpers.c +++ b/sys/dev/mmc/mmc_fdt_helpers.c @@ -160,6 +160,17 @@ cd_setup(struct mmc_helper *helper, phandle_t node) } /* + * If the device has no card-detection, treat it as non-removable. + * This could be improved by polling for detection. + */ + if (helper->props & MMC_PROP_BROKEN_CD) { + helper->cd_disabled = true; + if (bootverbose) + device_printf(dev, "Broken card-detect\n"); + return; + } + + /* * If there is no cd-gpios property, then presumably the hardware * PRESENT_STATE register and interrupts will reflect card state * properly, and there's nothing more for us to do. Our get_present() diff --git a/sys/fs/fuse/fuse_vnops.c b/sys/fs/fuse/fuse_vnops.c index 6c79e646d2f3..ef5aee5de34c 100644 --- a/sys/fs/fuse/fuse_vnops.c +++ b/sys/fs/fuse/fuse_vnops.c @@ -625,7 +625,7 @@ fuse_vnop_allocate(struct vop_allocate_args *ap) return (EROFS); if (fsess_not_impl(mp, FUSE_FALLOCATE)) - return (EXTERROR(EINVAL, "This server does not implement " + return (EXTERROR(EOPNOTSUPP, "This server does not implement " "FUSE_FALLOCATE")); io.uio_offset = *offset; @@ -656,14 +656,14 @@ fuse_vnop_allocate(struct vop_allocate_args *ap) if (err == ENOSYS) { fsess_set_notimpl(mp, FUSE_FALLOCATE); - err = EXTERROR(EINVAL, "This server does not implement " + err = EXTERROR(EOPNOTSUPP, "This server does not implement " "FUSE_ALLOCATE"); } else if (err == EOPNOTSUPP) { /* * The file system server does not support FUSE_FALLOCATE with * the supplied mode for this particular file. */ - err = EXTERROR(EINVAL, "This file can't be pre-allocated"); + err = EXTERROR(EOPNOTSUPP, "This file can't be pre-allocated"); } else if (!err) { *offset += *len; *len = 0; diff --git a/sys/fs/nfsclient/nfs_clvnops.c b/sys/fs/nfsclient/nfs_clvnops.c index 795a8d106051..193d8b6cd5eb 100644 --- a/sys/fs/nfsclient/nfs_clvnops.c +++ b/sys/fs/nfsclient/nfs_clvnops.c @@ -3896,11 +3896,15 @@ nfs_allocate(struct vop_allocate_args *ap) mtx_lock(&nmp->nm_mtx); nmp->nm_privflag |= NFSMNTP_NOALLOCATE; mtx_unlock(&nmp->nm_mtx); - error = EINVAL; + error = EOPNOTSUPP; } } else { + /* + * Pre-v4.2 NFS server that doesn't support it, or a newer + * NFS server that has indicated that it doesn't support it. + */ mtx_unlock(&nmp->nm_mtx); - error = EINVAL; + error = EOPNOTSUPP; } if (attrflag != 0) { ret = nfscl_loadattrcache(&vp, &nfsva, NULL, 0, 1); diff --git a/sys/geom/geom_subr.c b/sys/geom/geom_subr.c index c70d55c6c321..c5dce730da79 100644 --- a/sys/geom/geom_subr.c +++ b/sys/geom/geom_subr.c @@ -38,9 +38,11 @@ #include <sys/cdefs.h> #include "opt_ddb.h" +#define EXTERR_CATEGORY EXTERR_CAT_GEOM #include <sys/param.h> #include <sys/systm.h> #include <sys/devicestat.h> +#include <sys/exterrvar.h> #include <sys/kernel.h> #include <sys/malloc.h> #include <sys/bio.h> @@ -1674,6 +1676,8 @@ DB_SHOW_COMMAND(bio, db_show_bio) db_printf(" caller2: %p\n", bp->bio_caller2); db_printf(" bio_from: %p\n", bp->bio_from); db_printf(" bio_to: %p\n", bp->bio_to); + if ((bp->bio_flags & BIO_EXTERR) != 0) + exterr_db_print(&bp->bio_exterr); #if defined(BUF_TRACKING) || defined(FULL_BUF_TRACKING) db_printf(" bio_track_bp: %p\n", bp->bio_track_bp); diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 523b7e314a10..1b9bd4cf62d5 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -3043,14 +3043,19 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) PROC_LOCK(p); oldcred = crcopysafe(p, newcred); newcred->cr_prison = pr; - proc_set_cred(p, newcred); - setsugid(p); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); #endif #ifdef RCTL crhold(newcred); #endif + /* + * Takes over 'newcred''s reference, so 'newcred' must not be used + * besides this point except on RCTL where we took an additional + * reference above. + */ + proc_set_cred(p, newcred); + setsugid(p); PROC_UNLOCK(p); #ifdef RCTL rctl_proc_ucred_changed(p, newcred); diff --git a/sys/kern/kern_loginclass.c b/sys/kern/kern_loginclass.c index 0c111c4f78d8..07d388f18f8d 100644 --- a/sys/kern/kern_loginclass.c +++ b/sys/kern/kern_loginclass.c @@ -222,13 +222,18 @@ sys_setloginclass(struct thread *td, struct setloginclass_args *uap) PROC_LOCK(p); oldcred = crcopysafe(p, newcred); newcred->cr_loginclass = newlc; - proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); #endif #ifdef RCTL crhold(newcred); #endif + /* + * Takes over 'newcred''s reference, so 'newcred' must not be used + * besides this point except on RCTL where we took an additional + * reference above. + */ + proc_set_cred(p, newcred); PROC_UNLOCK(p); #ifdef RCTL rctl_proc_ucred_changed(p, newcred); diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index 3c145851b683..f93cee6d7698 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -832,22 +832,31 @@ kern_setcred(struct thread *const td, const u_int flags, if (error != 0) goto unlock_finish; +#ifdef RACCT /* - * Set the new credentials, noting that they have changed. + * Hold a reference to 'new_cred', as we need to call some functions on + * it after proc_set_cred_enforce_proc_lim(). */ + crhold(new_cred); +#endif + + /* Set the new credentials. */ cred_set = proc_set_cred_enforce_proc_lim(p, new_cred); if (cred_set) { setsugid(p); - to_free_cred = old_cred; #ifdef RACCT + /* Adjust RACCT counters. */ racct_proc_ucred_changed(p, old_cred, new_cred); #endif -#ifdef RCTL - crhold(new_cred); -#endif + to_free_cred = old_cred; MPASS(error == 0); - } else + } else { +#ifdef RACCT + /* Matches the crhold() just before the containing 'if'. */ + crfree(new_cred); +#endif error = EAGAIN; + } unlock_finish: PROC_UNLOCK(p); @@ -857,10 +866,12 @@ unlock_finish: * finishing operations. */ -#ifdef RCTL +#ifdef RACCT if (cred_set) { +#ifdef RCTL rctl_proc_ucred_changed(p, new_cred); - /* Paired with the crhold() just above. */ +#endif + /* Paired with the crhold() above. */ crfree(new_cred); } #endif @@ -991,16 +1002,19 @@ sys_setuid(struct thread *td, struct setuid_args *uap) change_euid(newcred, uip); setsugid(p); } - /* - * This also transfers the proc count to the new user. - */ - proc_set_cred(p, newcred); + #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); #endif #ifdef RCTL crhold(newcred); #endif + /* + * Takes over 'newcred''s reference, so 'newcred' must not be used + * besides this point except on RCTL where we took an additional + * reference above. + */ + proc_set_cred(p, newcred); PROC_UNLOCK(p); #ifdef RCTL rctl_proc_ucred_changed(p, newcred); @@ -1404,13 +1418,18 @@ sys_setreuid(struct thread *td, struct setreuid_args *uap) change_svuid(newcred, newcred->cr_uid); setsugid(p); } - proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); #endif #ifdef RCTL crhold(newcred); #endif + /* + * Takes over 'newcred''s reference, so 'newcred' must not be used + * besides this point except on RCTL where we took an additional + * reference above. + */ + proc_set_cred(p, newcred); PROC_UNLOCK(p); #ifdef RCTL rctl_proc_ucred_changed(p, newcred); @@ -1552,13 +1571,18 @@ sys_setresuid(struct thread *td, struct setresuid_args *uap) change_svuid(newcred, suid); setsugid(p); } - proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); #endif #ifdef RCTL crhold(newcred); #endif + /* + * Takes over 'newcred''s reference, so 'newcred' must not be used + * besides this point except on RCTL where we took an additional + * reference above. + */ + proc_set_cred(p, newcred); PROC_UNLOCK(p); #ifdef RCTL rctl_proc_ucred_changed(p, newcred); @@ -2783,7 +2807,7 @@ cru2xt(struct thread *td, struct xucred *xcr) * 'enforce_proc_lim' being true and if no new process can be accounted to the * new real UID because of the current limit (see the inner comment for more * details) and the caller does not have privilege (PRIV_PROC_LIMIT) to override - * that. + * that. In this case, the reference to 'newcred' is not taken over. */ static bool _proc_set_cred(struct proc *p, struct ucred *newcred, bool enforce_proc_lim) diff --git a/sys/kern/kern_racct.c b/sys/kern/kern_racct.c index 17b64ad00bb5..d1324935bdc3 100644 --- a/sys/kern/kern_racct.c +++ b/sys/kern/kern_racct.c @@ -949,8 +949,10 @@ racct_proc_exit(struct proc *p) } /* - * Called after credentials change, to move resource utilisation - * between raccts. + * Called to signal credentials change, to move resource utilisation + * between raccts. Must be called with the proc lock held, in the same span as + * the credentials change itself (i.e., without the proc lock being unlocked + * between the two), but the order does not matter. */ void racct_proc_ucred_changed(struct proc *p, struct ucred *oldcred, diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c index 22b7fe8d059a..880cc6b99951 100644 --- a/sys/kern/vfs_bio.c +++ b/sys/kern/vfs_bio.c @@ -5529,6 +5529,8 @@ DB_SHOW_COMMAND(buffer, db_show_buffer) db_printf("\n"); } BUF_LOCKPRINTINFO(bp); + if ((bp->b_ioflags & BIO_EXTERR) != 0) + exterr_db_print(&bp->b_exterr); #if defined(FULL_BUF_TRACKING) db_printf("b_io_tracking: b_io_tcnt = %u\n", bp->b_io_tcnt); diff --git a/sys/net/if_tuntap.c b/sys/net/if_tuntap.c index 56bb90cce9bc..0dc3a58f6ae6 100644 --- a/sys/net/if_tuntap.c +++ b/sys/net/if_tuntap.c @@ -138,6 +138,7 @@ struct tuntap_softc { #define TUN_READY (TUN_OPEN | TUN_INITED) pid_t tun_pid; /* owning pid */ + struct epoch_context tun_epoch_ctx; struct ifnet *tun_ifp; /* the interface */ struct sigio *tun_sigio; /* async I/O info */ struct tuntap_driver *tun_drv; /* appropriate driver */ @@ -630,6 +631,18 @@ out: CURVNET_RESTORE(); } +static void +tunfree(struct epoch_context *ctx) +{ + struct tuntap_softc *tp; + + tp = __containerof(ctx, struct tuntap_softc, tun_epoch_ctx); + + /* Any remaining resources that would be needed by a concurrent open. */ + mtx_destroy(&tp->tun_mtx); + free(tp, M_TUN); +} + static int tun_destroy(struct tuntap_softc *tp, bool may_intr) { @@ -649,7 +662,7 @@ tun_destroy(struct tuntap_softc *tp, bool may_intr) error = cv_wait_sig(&tp->tun_cv, &tp->tun_mtx); else cv_wait(&tp->tun_cv, &tp->tun_mtx); - if (error != 0) { + if (error != 0 && tp->tun_busy != 0) { tp->tun_flags &= ~TUN_DYING; TUN_UNLOCK(tp); return (error); @@ -663,8 +676,18 @@ tun_destroy(struct tuntap_softc *tp, bool may_intr) TAILQ_REMOVE(&tunhead, tp, tun_list); mtx_unlock(&tunmtx); - /* destroy_dev will take care of any alias. */ - destroy_dev(tp->tun_dev); + /* + * destroy_dev will take care of any alias. For transient tunnels, + * we're being called from close(2) so we can't destroy it ourselves + * without deadlocking, but we already know that we can cleanup + * everything else and just continue to prevent it from being reopened. + */ + if ((tp->tun_flags & TUN_TRANSIENT) != 0) { + atomic_store_ptr(&tp->tun_dev->si_drv1, tp->tun_dev); + destroy_dev_sched(tp->tun_dev); + } else { + destroy_dev(tp->tun_dev); + } seldrain(&tp->tun_rsel); knlist_clear(&tp->tun_rsel.si_note, 0); knlist_destroy(&tp->tun_rsel.si_note); @@ -679,9 +702,8 @@ tun_destroy(struct tuntap_softc *tp, bool may_intr) sx_xunlock(&tun_ioctl_sx); free_unr(tp->tun_drv->unrhdr, TUN2IFP(tp)->if_dunit); if_free(TUN2IFP(tp)); - mtx_destroy(&tp->tun_mtx); cv_destroy(&tp->tun_cv); - free(tp, M_TUN); + NET_EPOCH_CALL(tunfree, &tp->tun_epoch_ctx); CURVNET_RESTORE(); return (0); @@ -742,9 +764,11 @@ tun_uninit(const void *unused __unused) mtx_unlock(&tunmtx); for (i = 0; i < nitems(tuntap_drivers); ++i) { drv = &tuntap_drivers[i]; + destroy_dev_drain(&drv->cdevsw); delete_unrhdr(drv->unrhdr); clone_cleanup(&drv->clones); } + NET_EPOCH_DRAIN_CALLBACKS(); mtx_destroy(&tunmtx); } SYSUNINIT(tun_uninit, SI_SUB_PROTO_IF, SI_ORDER_ANY, tun_uninit, NULL); @@ -1104,19 +1128,43 @@ out: static int tunopen(struct cdev *dev, int flag, int mode, struct thread *td) { + struct epoch_tracker et; struct ifnet *ifp; struct tuntap_softc *tp; + void *p; int error __diagused, tunflags; + /* + * Transient tunnels do deferred destroy of the tun device but want + * to immediately cleanup state, so they clobber si_drv1 to avoid a + * use-after-free in case someone does happen to open it in the interim. + * We avoid using NULL to be able to distinguish from an uninitialized + * cdev. + * + * We use the net epoch here to let a concurrent tun_destroy() schedule + * freeing our tuntap_softc, in case we entered here and loaded si_drv1 + * before it was swapped out. If we managed to load this while it was + * still a softc, then the concurrent tun_destroy() hasn't yet scheduled + * it to be free- that will take place sometime after the epoch we just + * entered, so we can safely use it. + */ + NET_EPOCH_ENTER(et); + p = atomic_load_ptr(&dev->si_drv1); + if (p == dev) { + NET_EPOCH_EXIT(et); + return (ENXIO); + } + tunflags = 0; CURVNET_SET(TD_TO_VNET(td)); error = tuntap_name2info(dev->si_name, NULL, &tunflags); if (error != 0) { CURVNET_RESTORE(); + NET_EPOCH_EXIT(et); return (error); /* Shouldn't happen */ } - tp = dev->si_drv1; + tp = p; KASSERT(tp != NULL, ("si_drv1 should have been initialized at creation")); @@ -1124,14 +1172,17 @@ tunopen(struct cdev *dev, int flag, int mode, struct thread *td) if ((tp->tun_flags & TUN_INITED) == 0) { TUN_UNLOCK(tp); CURVNET_RESTORE(); + NET_EPOCH_EXIT(et); return (ENXIO); } if ((tp->tun_flags & (TUN_OPEN | TUN_DYING)) != 0) { TUN_UNLOCK(tp); CURVNET_RESTORE(); + NET_EPOCH_EXIT(et); return (EBUSY); } + NET_EPOCH_EXIT(et); error = tun_busy_locked(tp); KASSERT(error == 0, ("Must be able to busy an unopen tunnel")); ifp = TUN2IFP(tp); diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.c b/sys/netpfil/ipfilter/netinet/ip_htable.c index 3f765cfab947..5f5c04732d69 100644 --- a/sys/netpfil/ipfilter/netinet/ip_htable.c +++ b/sys/netpfil/ipfilter/netinet/ip_htable.c @@ -96,6 +96,8 @@ typedef struct ipf_htable_softc_s { u_long ipf_nhtnodes[LOOKUP_POOL_SZ]; iphtable_t *ipf_htables[LOOKUP_POOL_SZ]; iphtent_t *ipf_node_explist; + ipftuneable_t *ipf_htable_tune; + u_int ipf_htable_size_max; } ipf_htable_softc_t; ipf_lookup_t ipf_htable_backend = { @@ -122,6 +124,18 @@ ipf_lookup_t ipf_htable_backend = { }; +static ipftuneable_t ipf_htable_tuneables[] = { + { { (void *)offsetof(ipf_htable_softc_t, ipf_htable_size_max) }, + "htable_size_max", 1, 0x7fffffff, + stsizeof(ipf_htable_softc_t, ipf_htable_size_max), + 0, NULL, NULL }, + { { NULL }, + NULL, 0, 0, + 0, + 0, NULL, NULL } +}; + + /* ------------------------------------------------------------------------ */ /* Function: ipf_htable_soft_create */ /* Returns: void * - NULL = failure, else pointer to local context */ @@ -142,6 +156,18 @@ ipf_htable_soft_create(ipf_main_softc_t *softc) bzero((char *)softh, sizeof(*softh)); + softh->ipf_htable_tune = ipf_tune_array_copy(softh, + sizeof(ipf_htable_tuneables), + ipf_htable_tuneables); + if (softh->ipf_htable_tune == NULL) { + ipf_htable_soft_destroy(softc, softh); + return (NULL); + } + if (ipf_tune_array_link(softc, softh->ipf_htable_tune) == -1) { + ipf_htable_soft_destroy(softc, softh); + return (NULL); + } + return (softh); } @@ -160,6 +186,12 @@ ipf_htable_soft_destroy(ipf_main_softc_t *softc, void *arg) { ipf_htable_softc_t *softh = arg; + if (softh->ipf_htable_tune != NULL) { + ipf_tune_array_unlink(softc, softh->ipf_htable_tune); + KFREES(softh->ipf_htable_tune, sizeof(ipf_htable_tuneables)); + softh->ipf_htable_tune = NULL; + } + KFREE(softh); } @@ -179,6 +211,8 @@ ipf_htable_soft_init(ipf_main_softc_t *softc, void *arg) bzero((char *)softh, sizeof(*softh)); + softh->ipf_htable_size_max = IPHTABLE_MAX_SIZE; + return (0); } @@ -327,6 +361,15 @@ ipf_htable_create(ipf_main_softc_t *softc, void *arg, iplookupop_t *op) iph->iph_name[sizeof(iph->iph_name) - 1] = '\0'; } + if ((iph->iph_size == 0) || + (iph->iph_size > softh->ipf_htable_size_max)) { + IPFERROR(30027); + return (EINVAL); + } + if (iph->iph_size > ( SIZE_MAX / sizeof(*iph->iph_table))) { + IPFERROR(30028); + return (EINVAL); + } KMALLOCS(iph->iph_table, iphtent_t **, iph->iph_size * sizeof(*iph->iph_table)); if (iph->iph_table == NULL) { diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.h b/sys/netpfil/ipfilter/netinet/ip_htable.h index 55c289e57ff6..3a8782ccd4b2 100644 --- a/sys/netpfil/ipfilter/netinet/ip_htable.h +++ b/sys/netpfil/ipfilter/netinet/ip_htable.h @@ -55,6 +55,8 @@ typedef struct iphtable_s { char iph_name[FR_GROUPLEN]; /* hash table number */ } iphtable_t; +#define IPHTABLE_MAX_SIZE 1024 + /* iph_type */ #define IPHASH_LOOKUP 0 #define IPHASH_GROUPMAP 1 diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 21d4db1b8478..993981a9c0de 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2246,6 +2246,87 @@ pf_handle_table_set_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) return (error); } +static int +nlattr_add_pfr_addr(struct nl_writer *nw, int attr, const struct pfr_addr *a) +{ + int off = nlattr_add_nested(nw, attr); + if (off == 0) + return (false); + + nlattr_add_u32(nw, PFR_A_AF, a->pfra_af); + nlattr_add_u8(nw, PFR_A_NET, a->pfra_net); + nlattr_add_bool(nw, PFR_A_NOT, a->pfra_not); + nlattr_add_in6_addr(nw, PFR_A_ADDR, &a->pfra_u._pfra_ip6addr); + + nlattr_set_len(nw, off); + + return (true); +} + +static int +pf_handle_table_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt) +{ + struct pfioc_table attrs = { 0 }; + struct pfr_addr *pfras; + struct nl_writer *nw = npt->nw; + struct genlmsghdr *ghdr_new; + int size = 0; + int error; + + PF_RULES_RLOCK_TRACKER; + + error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs); + if (error != 0) + return (error); + + PF_RULES_RLOCK(); + /* Get required size. */ + error = pfr_get_addrs(&attrs.pfrio_table, NULL, + &size, attrs.pfrio_flags | PFR_FLAG_USERIOCTL); + if (error != 0) { + PF_RULES_RUNLOCK(); + return (error); + } + pfras = mallocarray(size, sizeof(struct pfr_addr), M_PF, + M_NOWAIT | M_ZERO); + if (pfras == NULL) { + PF_RULES_RUNLOCK(); + return (ENOMEM); + } + /* Now get the addresses. */ + error = pfr_get_addrs(&attrs.pfrio_table, pfras, + &size, attrs.pfrio_flags | PFR_FLAG_USERIOCTL); + PF_RULES_RUNLOCK(); + if (error != 0) + goto out; + + for (int i = 0; i < size; i++) { + if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { + nlmsg_abort(nw); + error = ENOMEM; + goto out; + } + ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); + ghdr_new->cmd = PFNL_CMD_TABLE_GET_ADDR; + ghdr_new->version = 0; + ghdr_new->reserved = 0; + + if (i == 0) + nlattr_add_u32(nw, PF_TA_ADDR_COUNT, size); + + nlattr_add_pfr_addr(nw, PF_TA_ADDR, &pfras[i]); + if (!nlmsg_end(nw)) { + nlmsg_abort(nw); + error = ENOMEM; + goto out; + } + } + +out: + free(pfras, M_PF); + return (error); +} + static const struct nlhdr_parser *all_parsers[] = { &state_parser, &addrule_parser, @@ -2504,6 +2585,13 @@ static const struct genl_cmd pf_cmds[] = { .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, }, + { + .cmd_num = PFNL_CMD_TABLE_GET_ADDR, + .cmd_name = "TABLE_GET_ADDRS", + .cmd_cb = pf_handle_table_get_addrs, + .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, + .cmd_priv = PRIV_NETINET_PF, + }, }; void diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h index d1538ab4ff5b..e1eb3e628df5 100644 --- a/sys/netpfil/pf/pf_nl.h +++ b/sys/netpfil/pf/pf_nl.h @@ -70,6 +70,7 @@ enum { PFNL_CMD_TABLE_ADD_ADDR = 32, PFNL_CMD_TABLE_DEL_ADDR = 33, PFNL_CMD_TABLE_SET_ADDR = 34, + PFNL_CMD_TABLE_GET_ADDR = 35, __PFNL_CMD_MAX, }; #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) @@ -485,6 +486,7 @@ enum pf_table_addrs_t { PF_TA_NBR_ADDED = 4, /* u32 */ PF_TA_NBR_DELETED = 5, /* u32 */ PF_TA_NBR_CHANGED = 6, /* u32 */ + PF_TA_ADDR_COUNT = 7, /* u32 */ }; #ifdef _KERNEL diff --git a/sys/sys/exterr_cat.h b/sys/sys/exterr_cat.h index 34a4b9f86694..318e774542ca 100644 --- a/sys/sys/exterr_cat.h +++ b/sys/sys/exterr_cat.h @@ -23,6 +23,7 @@ #define EXTERR_CAT_VFSSYSCALL 9 #define EXTERR_CAT_VFSBIO 10 #define EXTERR_CAT_GEOMVFS 11 +#define EXTERR_CAT_GEOM 12 #endif diff --git a/tests/sys/fs/fusefs/fallocate.cc b/tests/sys/fs/fusefs/fallocate.cc index 4e5b047b78b7..1a3a0af36236 100644 --- a/tests/sys/fs/fusefs/fallocate.cc +++ b/tests/sys/fs/fusefs/fallocate.cc @@ -205,7 +205,7 @@ TEST_F(Fspacectl, enosys) EXPECT_EQ(0, fspacectl(fd, SPACECTL_DEALLOC, &rqsr, 0, NULL)); /* Neither should posix_fallocate query the daemon */ - EXPECT_EQ(EINVAL, posix_fallocate(fd, off1, len1)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, off1, len1)); leak(fd); } @@ -548,7 +548,7 @@ INSTANTIATE_TEST_SUITE_P(FspacectlCache, FspacectlCache, /* * If the server returns ENOSYS, it indicates that the server does not support - * FUSE_FALLOCATE. This and future calls should return EINVAL. + * FUSE_FALLOCATE. This and future calls should return EOPNOTSUPP. */ TEST_F(PosixFallocate, enosys) { @@ -570,10 +570,10 @@ TEST_F(PosixFallocate, enosys) fd = open(FULLPATH, O_RDWR); ASSERT_LE(0, fd) << strerror(errno); - EXPECT_EQ(EINVAL, posix_fallocate(fd, off0, len0)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, off0, len0)); /* Subsequent calls shouldn't query the daemon*/ - EXPECT_EQ(EINVAL, posix_fallocate(fd, off0, len0)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, off0, len0)); /* Neither should VOP_DEALLOCATE query the daemon */ EXPECT_EQ(0, fspacectl(fd, SPACECTL_DEALLOC, &rqsr, 0, NULL)); @@ -607,10 +607,10 @@ TEST_F(PosixFallocate, eopnotsupp) fd = open(FULLPATH, O_RDWR); ASSERT_LE(0, fd) << strerror(errno); - EXPECT_EQ(EINVAL, posix_fallocate(fd, fsize, length)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, fsize, length)); /* Subsequent calls should still query the daemon*/ - EXPECT_EQ(EINVAL, posix_fallocate(fd, offset, length)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, offset, length)); /* And subsequent VOP_DEALLOCATE calls should also query the daemon */ rqsr.r_len = length; @@ -759,7 +759,7 @@ TEST_F(PosixFallocate, rlimit_fsize) } /* With older servers, no FUSE_FALLOCATE should be attempted */ -TEST_F(PosixFallocate_7_18, einval) +TEST_F(PosixFallocate_7_18, eopnotsupp) { const char FULLPATH[] = "mountpoint/some_file.txt"; const char RELPATH[] = "some_file.txt"; @@ -773,7 +773,7 @@ TEST_F(PosixFallocate_7_18, einval) fd = open(FULLPATH, O_RDWR); ASSERT_LE(0, fd) << strerror(errno); - EXPECT_EQ(EINVAL, posix_fallocate(fd, offset, length)); + EXPECT_EQ(EOPNOTSUPP, posix_fallocate(fd, offset, length)); leak(fd); } diff --git a/usr.bin/ktrace/subr.c b/usr.bin/ktrace/subr.c index 422a37bb413d..fac335948f46 100644 --- a/usr.bin/ktrace/subr.c +++ b/usr.bin/ktrace/subr.c @@ -89,6 +89,7 @@ getpoints(char *s) break; case 'x': facs |= KTRFAC_EXTERR; + break; case '+': facs |= DEF_POINTS; break; diff --git a/usr.sbin/inetd/inetd.8 b/usr.sbin/inetd/inetd.8 index d2a4331bb79c..189415caa711 100644 --- a/usr.sbin/inetd/inetd.8 +++ b/usr.sbin/inetd/inetd.8 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd September 25, 2025 +.Dd November 5, 2025 .Dt INETD 8 .Os .Sh NAME @@ -787,44 +787,6 @@ the pid of the currently running .Sh "EXAMPLES" Examples for a variety of services are available in .Pa /etc/inetd.conf . -.Pp -It includes examples for -.Nm bootpd , -.Nm comsat , -.Nm cvs , -.Nm date , -.Nm fingerd , -.Nm ftpd , -.Nm imapd , -.Nm nc , -.Nm nmbd , -.Nm nntpd , -.Nm rlogind , -.Nm rpc.rquotad , -.Nm rpc.rusersd , -.Nm rpc.rwalld , -.Nm rpc.statd , -.Nm rpc.sprayd , -.Nm rshd , -.Nm prometheus_sysctl_exporter , -.Nm smtpd , -.Nm smbd , -.Nm swat -.Nm talkd , -.Nm telnetd , -.Nm tftpd , -.Nm uucpd . -.Pp -The internal services provided by -.Nm -for daytime, time, echo, discard and chargen are also -included, as well as chargen for -.Nm ipsec -Authentication Headers -.Pp -Examples for handling auth requests via -.Nm identd , -are similarly included. .Sh "ERROR MESSAGES" The .Nm |