tpm: Refactor TIS and add a SPI attachment

Summary:
Though mostly used in x86 devices, TPM can be used on others, with a
direct SPI attachment. Refactor the TPM 2.0 driver set to use an
attachment

tpm: Refactor TIS and add a SPI attachment

Summary:
Though mostly used in x86 devices, TPM can be used on others, with a
direct SPI attachment. Refactor the TPM 2.0 driver set to use an
attachment interface, and implement a SPI bus interface.

Test Plan:
Tested on a Raspberry Pi 4, with a GeeekPi TPM2.0 module (SLB9670
TPM) using security/tpm2-tools tpm2_getcaps for very light testing against the
spibus attachment.

Reviewed by: kd
Obtained from: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D45069

show more ...

nvmf: Add infrastructure kernel module for NVMe over Fabrics

nvmf_transport.ko provides routines for managing NVMeoF queue pairs
and capsules. It provides a glue layer between transports (such as
T

nvmf: Add infrastructure kernel module for NVMe over Fabrics

nvmf_transport.ko provides routines for managing NVMeoF queue pairs
and capsules. It provides a glue layer between transports (such as
TCP or RDMA) and an NVMeoF host (initiator) and controller (target).

Unlike the synchronous API exposed to the host and controller by
libnvmf, the kernel's transport layer uses an asynchronous API built
on callbacks. Upper layers provide callbacks on queue pairs that are
invoked for transport errors (error_cb) or anytime a capsule is
received (receive_cb).

Data transfers for a command are usually associated with a callback
that is invoked once a transfer has finished either due to an error
or successful completion.

For an upper layer that is a host, command capsules are allocated and
populated with an NVMe SQE by calling nvmf_allocate_command. A data
buffer (described by a struct memdesc) can be associated with a
command capsule before it is transmitted via nvmf_capsule_append_data.
This function accepts a direction (send vs receive) as well as the
data transfer callback. The host then transmits the command via
nvmf_transmit_capsule. The host must ensure that the data buffer
described by the 'struct memdesc' remains valid until the data
transfer callback is called. The queue pair's receive_cb callback
should match received response capsules up with previously transmitted
commands.

For the controller, incoming commands are received via the queue
pair's receive_cb callback. nvmf_receive_controller_data is used to
retrieve any data from a command (e.g. the data for a WRITE command).
It can be called multiple times to split the data transfer into
smaller sizes. This function accepts an I/O completion callback that
is invoked once the data transfer has completed.
nvmf_send_controller_data is used to send data to a remote host in
response to a command. In this case a callback function is not used
but the status is returned synchronously. Finally, the controller can
allocate a response capsule via nvmf_allocate_response populated with
a supplied CQE and send the response via nvmf_transmit_capsule.

Reviewed by: imp
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D44711

show more ...

linuxkpi: Add linuxkpi_video module

This contain the hdmi code and the aperture code like in linux.

Differential Revision: https://reviews.freebsd.org/D44925
Reviewed by: bz
Obtained from: drm-km

linuxkpi: Add linuxkpi_video module

This contain the hdmi code and the aperture code like in linux.

Differential Revision: https://reviews.freebsd.org/D44925
Reviewed by: bz
Obtained from: drm-kmod
Sponsored by: Beckhoff Automation GmbH & Co. KG

show more ...

accf_tls: accept filter that waits for TLS handshake header

genet: add module (if_genet.ko)

The driver already had the appropriate module macros, it just wasn't
hooked into the build system.

Since this device is specific to the Raspberry Pi 4, only build it

genet: add module (if_genet.ko)

The driver already had the appropriate module macros, it just wasn't
hooked into the build system.

Since this device is specific to the Raspberry Pi 4, only build it for
AArch64.

Reviewed by: imp, emaste (earlier version)
Pull Request: https://github.com/freebsd/freebsd-src/pull/1139

show more ...

sys: Enable NVMe drivers on all architectures

The NVMe drivers are portable and are already included statically in
GENERIC on other architectures such as aarch64 and riscv64.

Reviewed by: imp
Spons

sys: Enable NVMe drivers on all architectures

The NVMe drivers are portable and are already included statically in
GENERIC on other architectures such as aarch64 and riscv64.

Reviewed by: imp
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D44690

show more ...

vf_i2c: split up and add ACPI attachments in addition to FDT

Move the code from the arm specific to the iicbus controller directory.
Split up between general logic and bus attachment code.
Add suppo

vf_i2c: split up and add ACPI attachments in addition to FDT

Move the code from the arm specific to the iicbus controller directory.
Split up between general logic and bus attachment code.
Add support for ACPI attachment in addition to FDT.

MFC after: 7 days
Tested by: bz (LS1088a FDT), Pierre-Luc Drouin (Honeycomb, ACPI)
Based on: D24917 by Val Packett (initial early version)
Differential Revision: https://reviews.freebsd.org/D44020

show more ...

Import the kernel parts of bhyve/arm64

To support virtual machines on arm64 add the vmm code. This is based on
earlier work by Mihai Carabas and Alexandru Elisei at University
Politehnica of Buchare

Import the kernel parts of bhyve/arm64

To support virtual machines on arm64 add the vmm code. This is based on
earlier work by Mihai Carabas and Alexandru Elisei at University
Politehnica of Bucharest, with further work by myself and Mark Johnston.

All AArch64 CPUs should work, however only the GICv3 interrupt
controller is supported. There is initial support to allow the GICv2
to be supported in the future. Only pure Armv8.0 virtualisation is
supported, the Virtualization Host Extensions are not currently used.

With a separate userspace patch and U-Boot port FreeBSD guests are able
to boot to multiuser mode, and the hypervisor can be tested with the
kvm unit tests. Linux partially boots, but hangs before entering
userspace. Other operating systems are untested.

Sponsored by: Arm Ltd
Sponsored by: Innovate UK
Sponsored by: The FreeBSD Foundation
Sponsored by: University Politehnica of Bucharest
Differential Revision: https://reviews.freebsd.org/D37428

show more ...

pflow: import from OpenBSD

pflow is a pseudo device to export flow accounting data over UDP.
It's compatible with netflow version 5 and IPFIX (10).

The data is extracted from the pf state table. St

pflow: import from OpenBSD

pflow is a pseudo device to export flow accounting data over UDP.
It's compatible with netflow version 5 and IPFIX (10).

The data is extracted from the pf state table. States are exported once
they are removed.

Reviewed by: melifaro
Obtained from: OpenBSD
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D43106

show more ...

Revert "Don't try and run kldxref for arm kernels"

Now that kldxref supports arm this should not be needed.

This reverts commit 0840bdbf2a07b68e29267bc49057ca6df2351360.

Don't try and run kldxref for arm kernels

Surprisingly, kldxref does not currently support arm, and unhelpfully
this means it silently does nothing rather than give an error, so the
linker.hints ent

Don't try and run kldxref for arm kernels

Surprisingly, kldxref does not currently support arm, and unhelpfully
this means it silently does nothing rather than give an error, so the
linker.hints entry added to the METALOG for -DNO_ROOT builds (and
pkgbase ones) refers to a file that doesn't exist. Ideally it would be
supported (and ideally the METALOG handling would be less fragile, but
without integrating it into kldxref the only real option would be to
just run find(1) to get the list of linker.hints files, which feels a
little backwards), but for now just paper over this by skipping the
build step on arm.

Reported by: bapt
Fixes: ff7c12c1f17e ("Make kldxref a bootstrap tool and use unconditionally")

show more ...

Make kldxref a bootstrap tool and use unconditionally

Now that kldxref is a generic cross tool and can be built on non-FreeBSD
we can bootstrap it during the build and thus remove the condition for

Make kldxref a bootstrap tool and use unconditionally

Now that kldxref is a generic cross tool and can be built on non-FreeBSD
we can bootstrap it during the build and thus remove the condition for
whether it exists. We also need to make sure to add it to the METALOG
for -DNO_ROOT builds.

Reviewed by: brooks, imp
Differential Revision: https://reviews.freebsd.org/D43051

show more ...

ossl: Add support for armv7

OpenSSL provides implementations of several AES modes which use
bitslicing and can be accelerated on CPUs which support the NEON
extension. This patch adds arm platform

ossl: Add support for armv7

OpenSSL provides implementations of several AES modes which use
bitslicing and can be accelerated on CPUs which support the NEON
extension. This patch adds arm platform support to ossl(4) and provides
an AES-CBC implementation, though bsaes_cbc_encrypt() only implements
decryption. The real goal is to provide an accelerated AES-GCM
implementation; this will be added in a subsequent patch.

Initially derived from https://reviews.freebsd.org/D37420.

Reviewed by: jhb
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
MFC after: 3 months
Differential Revision: https://reviews.freebsd.org/D41304

show more ...

Add an Armv8 rndr random number provider

Armv8.5 adds an optional random number generator. This is implemented
as two special registers one to read a random number, the other to
re-seed the entropy

Add an Armv8 rndr random number provider

Armv8.5 adds an optional random number generator. This is implemented
as two special registers one to read a random number, the other to
re-seed the entropy pool before reading a random number. Both registers
will set the condition flags to tell the caller they can't produce a
random number in a reasonable amount of time.

Without a signal to reseed the entropy pool use the latter register
to provide random numbers to the kernel pool. If at a later time we
had a way to tell the provider if it needs to reseed or not we could
use the former.

On an Amazon AWS Graviton3 VM this never failed, however this may not
be the case on low end CPUs so retry reading the random number 10 times
before returning an error.

Reviewed by: imp, delphij (csprng)
Sponsored by: The FreeBSD Foundation
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D35411

show more ...

rtw88: re-connect to the build

This adds the (updated) rtw88 driver back to the build.
Functionality has not been tested (much) so might not currently
work but people offered to test.

Firmware is p

rtw88: re-connect to the build

This adds the (updated) rtw88 driver back to the build.
Functionality has not been tested (much) so might not currently
work but people offered to test.

Firmware is provided by the wifi-firmware-rtw88-kmod port/package.

This reverts commit 712468443df1130db8f893a5e2ce5c6a8dbf5cde.

show more ...

iwlwifi: re-attach to build after updates

While the build-breaking changes were only in the window of
the two commits, 3e1f5cc9a81a..9af1bba44e1c, further updates
restored some functionality as well

iwlwifi: re-attach to build after updates

While the build-breaking changes were only in the window of
the two commits, 3e1f5cc9a81a..9af1bba44e1c, further updates
restored some functionality as well. Now that we are done,
add iwlwifi back to the build.

This reverts commit b75d1ce6c10652fc4bfbf509deeae0e05c3d1356.

Sponsored by: The FreeBSD Foundation
MFC after: 3 days

show more ...

iwlwifi: temporary disable build for updates

Disconnect iwlwifi from the build for a few commits which, due to
incompatible LinuxKPI 802.11 changes would break the build for a
revision. It will be

iwlwifi: temporary disable build for updates

Disconnect iwlwifi from the build for a few commits which, due to
incompatible LinuxKPI 802.11 changes would break the build for a
revision. It will be re-enabled "instantly".

Sponsored by: The FreeBSD Foundation
MFC after: 3 days

show more ...

rtw88: temporary disconnect from build

As announced on freebsd-wireless [1] disconnect rtw88 from the build.
Add a note to the man page about the current state but leave the man
page in place for no

rtw88: temporary disconnect from build

As announced on freebsd-wireless [1] disconnect rtw88 from the build.
Add a note to the man page about the current state but leave the man
page in place for now as this is supposed to be temporary.

[1] https://lists.freebsd.org/archives/freebsd-wireless/2023-September/001377.html

MFC after: 20 days
X-MFC: will see about 14/13

show more ...

rtw88: detach firmware from build

Firmware is kept in ports now and fwget will find the right one to
install.

MFC after: 20 days
X-MFC: will see about 14/13

sff: Add SFP driver (fdt-based draft)

This basic version of the driver obtains properties of the "sff,sfp"
compatible devices and implements a simple interface to provide an I2C
bus device for the r

sff: Add SFP driver (fdt-based draft)

This basic version of the driver obtains properties of the "sff,sfp"
compatible devices and implements a simple interface to provide an I2C
bus device for the rest of the drivers (e.g. to implement SIOCGI2C).

Both of the interface and driver are subjects for a further
generalization to be used in case of non-FDT and non-arm64 platforms.

Reviewed by: bz, manu
Approved by: bz (mentor)
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D41440

show more ...

sys: Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

ath(4): Remove MIPS AHB frontend and join PCI one w/ main support again

Following the removal of general MIPS support, there's no longer a need
to have the AHB bus-frontend in place, which according

ath(4): Remove MIPS AHB frontend and join PCI one w/ main support again

Following the removal of general MIPS support, there's no longer a need
to have the AHB bus-frontend in place, which according to Linux sources
also isn't used with any non-MIPS SoCs. For simplicity, PCI bus support
is only made conditional on the main one again, i. e. device ath_pci is
removed, and built into the main module, i. e. if_ath_pci.ko obsoleted,
respectively.
Effectively, this reverts the following commits and associated changes:
dba9c8597747c6c9bf3d2ec68f7eb90552878dc7
e849bb3ecbb1963344a22ae77fc96f89fbebf40c

Approved by: adrian
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D41354

show more ...

modules: Use MACHINE_CPUARCH more

Replace two cases of MACHINE_ARCH with MACHINE_CPUARCH and also use
`aarch64` instead of the improper `arm64` for that test.

Noticed by: Mark Millard
Sponsored by

modules: Use MACHINE_CPUARCH more

Replace two cases of MACHINE_ARCH with MACHINE_CPUARCH and also use
`aarch64` instead of the improper `arm64` for that test.

Noticed by: Mark Millard
Sponsored by: Netflix

show more ...

mac_ipacl: new MAC policy module to limit jail/vnet IP configuration

The mac_ipacl policy module enables fine-grained control over IP address
configuration within VNET jails from the base system.
It

mac_ipacl: new MAC policy module to limit jail/vnet IP configuration

The mac_ipacl policy module enables fine-grained control over IP address
configuration within VNET jails from the base system.
It allows the root user to define rules governing IP addresses for
jails and their interfaces using the sysctl interface.

Requested by: multiple
Sponsored by: Google, Inc. (GSoC 2019)
MFC after: 2 months
Reviewed by: bz, dch (both earlier versions)
Differential Revision: https://reviews.freebsd.org/D20967

show more ...

superio+ncthwm: Add hardware monitoring support

Add support for the following chips:
- Nuvoton NCT6779D
- Nuvoton NCT6796D-E

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pu

superio+ncthwm: Add hardware monitoring support

Add support for the following chips:
- Nuvoton NCT6779D
- Nuvoton NCT6796D-E

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/719

show more ...