The reader can hand off its first buffer before the writer sets
CAMDD_DEV_FLAG_ACTIVE. camdd_queue_peer_buf() then mistakes the writer
for an exited peer and releases the buffer instead of queueing it. This
can make a copy fail with bytes read but nothing written, without an
error message.
Mark both devices active before creating either worker, leaving the
workers to clear the flag on exit. The work queues and EVFILT_USER
events are already initialized, so queued buffers and their notification
can wait for the writer to start without a startup barrier.
Treat pthread_create() failure as fatal. Returning through the normal
cleanup path can free devices that an already-started worker is still
using, and an unstarted peer cannot consume any queued buffers.
Reviewed by: imp, markj, ken
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61277
Support per-session configurable ping (SCSI NOP) and login timeouts
similar to what is supported in the Linux iSCSI initiator configuration file.
Reduce iscsi timer granularity to 0.1 sec.
For backwards compatibility, when all timers are selected on integer numbers,
all status messages are unchanged. If the higher granularity is used, the
log messages include sub-second granularity.
The sysctl(3) interface has changed from pure int to string, in order to
support fractional seconds in a human-readable, dotted notation.
Reviewed By: #netapp, #manpages, jhb, pauamma_chezdork.com, siderop1_netapp.com
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D32540
cmd_pmc_stat allocated the event descriptor with malloc and then set
only some of its fields, so the rest held whatever was on the heap.
Use calloc() instead.
Reviewed by: mhorne
MFC after: 3 days
Sponsored by: AMD
Signed-off-by: Andre Silva <[email protected]>
Differential Revision: https://reviews.freebsd.org/D59364
A restore set the addresses in the BARs and the command register to
those of the snapshot, but left the regions registered where
pci_emul_alloc_bar() had put them when bhyve started. That is only
right for a guest that kept bhyve's addresses. The UEFI firmware moves
64-bit BARs above 4 GB, and after a restore every access to such a BAR
went nowhere:
Emulating access to non-existent address to 0x800001014
Before the devices are restored, unregister the regions of all of them;
when a device is restored, register its regions at the restored
addresses, if the restored command register enables them. All devices
go first because a restored BAR may be where another device's BAR is
before the restore.
Signed-off-by: Wanpeng Qian <[email protected]>
Sponsored by: keelos.dev
Reviewed by: bnovkov
Differential Revision: https://reviews.freebsd.org/D60235
MFC after: 2 weeks
Tested by: bnovkov
_vq_record() stored the result of paddr_guest2host() without checking for
NULL. A guest descriptor with an invalid address causes a NULL dereference
in every virtio driver. Return early on failure; the caller sees zero
descriptors and discards the chain.
The indirect path already performs this check (line 357).
Reviewed by: bnovkov
Differential Revision: https://reviews.freebsd.org/D60870
MFC after: 1 week
libusb has one speed for all SSP links, so print "SUPER+ (>=10Gbps)".
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57196
Enable the FreeBSD-base repository in all of the /etc/pkg/FreeBSD.conf
variants, and remove code from various install paths which enabled the
repository via /usr/local/etc/pkg/repos/FreeBSD.conf.
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D60946
The NULL return is used by the following memcpy()
call. Fail the request instead.
Unlikely to happen in practice, since the rpc.tlsservd
daemon runs as root and does not allocate a lot or memory.
Reviewed by: rmacklem
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60927
hccontrol(8) lists "LE_Set_Scan_Parameters" as a subcommand, but it does
not work on recent releases. Use the LE_Set_Scan_Param instead as that
seems to be the new name according to the source file. Update the man
page accordingly.
PR: 300178
Event: Oslo Hackathon 2026
For a software built on top of bhyve(8) and/or managing bhyve(8),
it is very convenient to know what specific features the given binary supports.
Currently, bhyve(8) provides some of this information, and it could be
retrieved by parsing `bhyve -h`, `bhyve -s help`, `bhyve -l help`.
Sometimes it is not enough, for example, the recently added
"oemstrings" feature cannot be fully probed using these commands.
Over time, some workarounds were suggested. Specifically:
- Mapping features to __FreeBSD_version. I see at least two issues with
that:
* __FreeBSD_version does not directly map to bhyve(8) features,
so this is simply not accurate.
* bhyve(8) might be updated separately from the system, which
is not so uncommon, especially for development purposes.
Then such a probing will be inaccurate.
- Manual pages parsing. I see more disadvantages with that:
* Manual pages are meant to be read by a human. Extracting
information from it by a machine is not the most convenient thing.
Especially understanding side notes like: "Note, feature 'foo'
is arm64-only!".
* Manual pages might be inaccurate, they might miss options.
* bhyve(8) could be used in an environment where manual pages
are not installed.
This commit attempts to close this gap by introducing the "bhyve -o
help" command which prints all the supported configuration variables.
In my opinion, it is, in combination with the other commands mentioned
above, sufficient to retrieve most of the capabilities of the given
bhyve(8) binary.
The current implementation defines a simple configuration schema for
common and machdep code and prints out a list of supported configuration
variables for the current architecture.
The next step as I see it would be extending set_config*() functions
to validate the user provided values against the schema, so users get
notified early on incorrect or misspelled configuration variables.
It would also be nice to allow users to only validate their
configuration, think of 'nginx configtest / -t'.
Reviewed by: chuck (previous revision), bnovkov
MFC after: 1 month
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58419
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60748
inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60879
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
Use the new array size when calling realloc(). Note that this queue
stores events read from a host evdev device, i.e., it is not
guest-controlled.
While here, use the cdefs.h __unused macro and use them correctly, i.e.,
don't mark "arg" as unused when it isn't.
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Fixes: 054accac71 ("Add a virtio-input device emulation.")
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60679
This will make it easier to port bhyveload's functionality into the main
bhyve executable.
No functional change intended.
Reviewed by: novel
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60481
The GPT layout already labels the swap partition swapN, but fstab
named the disk device. That name changes when disks are added or
reordered, and swap does not come up until fstab is edited. Write
/dev/gpt/swapN instead, appending .eli when swap encryption is on.
Mirrored swap still uses /dev/mirror/swap, with the same suffix.
Submitted by: Wanpeng Qian <[email protected]>
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D32936
snprintf(3) returns the length that would have been written, so an
ambiguous prefix can fill the match buffer with no sign that names
were cut off. Append " (truncated)" when that happens. Drop the
empty statement when scanning option arguments: only a separate
argument consumes the next argv entry.
Bump sysconf(8) to 2.2.1.
Suggested by: fuz
Reviewed by: fuz
Differential Revision: https://reviews.freebsd.org/D60815
Make it easier for the rc group to facilitate having an option to fully
boot muted (à la OmniOS) without resorting to /dev/null redirections.
Reviewed by: imp, dteske
Differential Revision: https://reviews.freebsd.org/D46120
The rfb code maintains an array of CRCs for 32x32 tiles in the
framebuffer. This array is sized statically based on the rfb code's
notion of the maximum framebuffer size, which changed in commit
fb51ddb20d without updating the rfb code.
Morever, writes to the framebuffer BAR can modify the recorded height
and width of the framebuffer. These values were not validated against
the maximum at all, unlike the parameters set via bhyve config.
Fix these problems:
- Define the maximum width and height in a shared header file so that
they do not get out of sync again.
- In pci_fbuf_render(), don't resize the console if the new dimensions
are too large.
- Add a mutex to synchronize framebuffer BAR I/O with the rfb thread.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101311
Fixes: fb51ddb20d ("bhyve: increase fbuf display resolution limit")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60680
The length of each block in the stream must be non-zero. This is
assumed in hda_transfer(), otherwise an out-of-bounds read or write is
possible.
Use atomic loads to access stream descriptor fields, since they are
guest-controlled. Make sure that the descriptor array is suitably
aligned so that we can drop the __packed annotation from the structure
definition; per section 3.3.42 of the HDA spec the BDL pointer is
supposed to be 128-byte aligned, in fact.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101310
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Reviewed by: christos
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60678
rts->erst_p and rts->erstba_p are pointers to guest-controlled memory
which describe the event rings and pending event array, respectively.
The device model was not validating the size nor saving the value.
As a result, the bounds checks in pci_xhci_insert_event() were
susceptible to TOCTOU races.
Fix pci_xhci_rtsregs_write() to save the ring size in a softc field.
Validate that the size isn't larger than the maximum allowed by the XHCI
specification (64KB, or 4096 TRBs).
When processing TRBs, make sure we don't load fields more than once.
Make sure that pci_xhci_trb_next() doesn't return a pointer to host
memory. When handling ERDP writes, make sure that the guest-supplied
address is actually a pointer into the TRB array, and ignore the write
if not.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101309
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Differential Revision: https://reviews.freebsd.org/D60677
The root directory of a dataset is populated from an fsnode that is the
"." entry of the staging directory, and its children are the siblings of
that node, so the loop that computes the link count and the size of the
directory (which expects "." among the children, as the nodes of the
other directories have) never counts it. The link count of the root of
every dataset is one less than it should be (1 for an empty dataset
instead of 2, 19 instead of 20 for a root with 18 subdirectories), and
so is its size.
fts(3) trusts the link count of the directories of ZFS when called with
FTS_NOSTAT and FTS_PHYSICAL: it stops looking for subdirectories once it
has seen as many as the link count says, and does not descend into the
ones it did not look at. As a result find(1), and rm(1) when it does
not need to stat the entries, silently skip directories of a pool made
by makefs. On a root filesystem made by makefs, find / does not list
/etc at all.
Start the loop at the "." node itself for the roots of datasets, so that
it is counted the same way as in every other directory. Add a test that
checks the link counts and the sizes of the dataset roots and of the
other directories, with nested datasets and a dataset whose mountpoint
is not in the staging tree, and that find(1) sees the whole tree.
Fixes: 240afd8c1f ("makefs: Add ZFS support")
MFC after: 1 week
Approved by: markj
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60439
poudriere.conf is handed to sysrc(8), including the jail, tree, and
set overlays poudriere(8) consults. make, src, and src-env are
sub-targets over the matching make(1) files under poudriere.d. -l
and -L list one path per line; -L includes overlays that do not exist
yet. A bare -- ends the sub-target so the next word is a variable.
Bump sysconf(8) to 2.2.
Reviewed by: fuz, kfv, bcr
Differential Revision: https://reviews.freebsd.org/D59943
Exact match still wins. An ambiguous prefix is rejected with the
list of matches. Move keyword selection and the rc pass-through
into sysconf-targets.c. Bump sysconf(8) to 2.1.
Reviewed by: kfv
Differential Revision: https://reviews.freebsd.org/D59924
NVMe namespace IDs are 1-based, but CTL LUN IDs are 0-based. The
in-kernel NVMe ctl(4) target accounts for this by adding one to the
LUN ID to compute a namespace ID. ctld was attempting to handle this
by translating namespace IDs from config files to internal LUN IDs,
but it did this incorrectly resulting in the namespace configured for
as namespace N actually showing up as namespace N + 1.
Fixes: 66b5296f1b ("ctld: Add support for NVMe over Fabrics")
Sponsored by: Chelsio Communications
This is a kernel-only header for /dev/io. The user-facing header
defining the ioctl commands is <dev/io/iodev.h>.
Reviewed by: bnovkov, imp
Differential Revision: https://reviews.freebsd.org/D60399
Add an "autotrim" option taking "on" or "off". The value is stored in
the pool properties object alongside "bootfs", so the imported pool
starts trimming freed space automatically without a separate
"zpool set" step. When the option is omitted nothing is written and
the pool keeps the default ("off"), exactly as before.
A string option is used rather than makefs's boolean option type since
the latter ignores its value, which would make "autotrim=off" enable
the feature.
Define the spa_autotrim_t enumeration in the boot zfsimpl.h, copied
from OpenZFS's sys/spa.h, so that makefs can refer to SPA_AUTOTRIM_OFF
and SPA_AUTOTRIM_ON by name. The loader does not use it.
Document the option in makefs(8) and add a regression test.
Reviewed by: markj
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60420
Add a note that UEFI VMs using TPM devices should be configured
to use a varfile. Some UEFI boot loaders, such as shim, update
persistent boot variables and then reset the system when a TPM is
present. Without a writable varfile, the VM may be reset repeatedly.
Add a TPM device example to the examples list.
While here, add a missing "\" to the "uefivm" example, and add ".Pp"
before the vCPU pinning examples for consistency with other examples.
PR: 287326
Reviewed by: michaelo, ziaee
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D60181
Drop support for queries and commands that are not supported by ACPI's
/dev/apm interface. This includes dropping support for
enabling/disabling APM BIOS used by /etc/rc.d/apm.
Reviewed by: ziaee, imp
Differential Revision: https://reviews.freebsd.org/D59941
The original purpose of this daemon was to route power management
requests to userspace, e.g. when the suspend button was pressed, the
APM driver posted an event read by apmd(8) that would invoke zzz(8) to
suspend. However, on ACPI systems this is handled by devd(8) events
instead and running apmd(8) in addition just adds extra complexity.
This probably should have been axed when the APM BIOS support was
retired in commit 8c576a279e.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D59937
paddr_guest2host() returns NULL when a range does not fit within guest
RAM. An unmappable queue address previously left the queue marked
allocated with ring pointers computed from the failed mapping. Check
the legacy virtqueue ring mapping before updating the queue state, and
ignore an unmappable PFN write after printing a diagnostic. This leaves
an unallocated queue unallocated and preserves an existing queue's PFN,
ring pointers, flags, and indices.
Also check the indirect descriptor table mapping before dereferencing
it, returning an error if the table is unmappable, and ignore guest
queue notifications for unallocated queues.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59904
pci_vtcon_announce_port() sends VIRTIO_CONSOLE_PORT_NAME immediately
after VIRTIO_CONSOLE_DEVICE_ADD, without waiting for the guest to
initialize the port. The Windows virtio-serial driver ignores the
name if the port is not yet available, which can prevent the QEMU
guest agent from finding org.qemu.guest_agent.0.
Send the name after the guest reports successful port initialization
with VIRTIO_CONSOLE_PORT_READY, as QEMU does.
While here, validate the guest-supplied port ID before forming a
pointer into vsc_ports[].
This ports the PORT_NAME ordering fix from illumos change 18082.
Obtained from: illumos 643ee887be44404b690eeaff14f20a27ad3c715c
Reviewed by: markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59847
There is no need at all to load the cuse module to just access the tool help.
kldload always checks for permissions first returning -EPERM if the user can't
load modules and -EEXIST if the user can, but the module is already loaded.
Approved by: christos@
Differential Revision: https://reviews.freebsd.org/D59844
MFC after: 2 weeks
Merge the nearly identical level 1 and level 2 filename conversion
functions and add output buffer bounds checking.
Always NUL-terminate the converted filename, allowing the redundant
memset() in cd9660_translate_node_common() to be removed.
Signed-off-by: Manuel Einfalt <[email protected]>
Reviewed by: emaste
Pull request: https://github.com/freebsd/freebsd-src/pull/2443
Added nvme_ns_data_format_index() in the nvme, nda, and nvmf
host paths as well as nvmecontrol and camdd.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D59627
Hayzam Sherif