This is a display of mostly-automatically-classified git commits from 2025-09-15 to 2025-09-21.
In the future, these reports might include summaries or additional information, but for now our focus is figuring out what type of classification would be most useful.
Table of contents and commits per category:
| (5) | Highlighted commits (these are copies, not in stats) | |
| 1 | 0.5% | Userland programs |
| 18 | 8.9% | Documentation |
| 31 | 15.3% | Hardware support |
| 12 | 5.9% | Networking |
| 27 | 13.4% | System administration |
| 6 | 3.0% | Libraries |
| 3 | 1.5% | Filesystems |
| 29 | 14.4% | Kernel |
| 33 | 16.3% | Build system |
| 1 | 0.5% | Internal organizational stuff |
| 15 | 7.4% | Testing |
| 5 | 2.5% | Style, typos, and comments |
| 8 | 4.0% | Contrib code |
| 13 | 6.4% | Reverted commits |
| 0 | 0.0% | Unclassified commits |
| 202 | 100% | total |
| Technical notes about this page |
For extra visibility, these are copies of commits found in
other sections. Most (if not all) come from the commit message
containing "Relnotes:", or commits modifying
UPDATING.
Enabled qat driver support for 402xx device with ID 0x4944/0x4945. This is an additional device supported under the existing qat_4xxx driver. Firmwares specific to the 402xx device are added. Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com> Relnotes: yes Sponsored by: Intel Corporation MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D52488
When starting single-user mode, use the home directory from user root as current directory and for the HOME environment variable. If the directory does not exist, set HOME=/. Also adjust /root/.profile to stop setting HOME, since it should always have been set now. This is intended to keep shell startup files working in single-user mode after /.profile has been removed. Reviewed by: emaste, ivy, kevans MFC after: 1 week Relnotes: yes Differential Revision: https://reviews.freebsd.org/D52527
We don't want a tests-dev package, because this means set-devel depends on tests-dev, which transitively depends on tests, which means you can't install set-devel without also getting tests. The only real "dev" files in tests-dev are from ATF (libprivateatf), so move that to its own package and add a dependency from tests. Also move Kyua to its own package, since this might be useful for running tests even when the user doesn't want the whole set of base tests installed. Add a dependency from -tests to both -atf and -kyua, and a dependency on -set-base, since the tests won't work without the full base system installed. The remaining "dev" files in tests are actually test artifacts, not real development libraries. Add a new NO_DEV_PACKAGE option to bsd.lib.mk, which causes dev files to be installed in the base package instead of creating a -dev package, and set this option for everything that installs test libraries. While here, add a slightly more informative description for the tests package. MFC after: 3 seconds Reviewed by: bapt, emaste Differential Revision: https://reviews.freebsd.org/D52597
Move mandoc to its own package so users can install it independently of -utilities. Put the package in the minimal set, since we also ship manpages in minimal and "man" is a basic Unix utility. Add a pkg-triggers(5) hook to run makewhatis when new manpages are installed, so that apropos(1) works. This depends on a new pkg(8) feature expected to be in in the upcoming 2.3.2 release; in the mean time, this is a no-op (i.e., having an older pkg doesn't break anything, it just won't run the trigger). MFC after: 3 seconds Reviewed by: bapt Differential Revision: https://reviews.freebsd.org/D52564
Implement RFC 7217 (A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)) in our IPv6 stack. A new ifconfig `stableaddr` flag is added to enable the feature on interfaces, which defaults to on or off for new interfaces based on the sysctl `net.inet6.ip6.use_stableaddr` (off by default, so this commit causes no change in behavior with default settings). The algorithm follows the RFC in its logic, using SHA256-HMAC as the algorithm to derive addresses so as to provide code that can be leveraged by future implentations of RFC 8981, leveraging the `hostuuid` as the secret. The source of the hostidentifier can be configured using the sysctl `net.inet6.ip6.stableaddr_netifsource`, while the number of retries generating a new address in case of collision can be configured using the `net.inet6.ip6.stableaddr_maxretries` sysctl (default 3). Documentation about all these flags is added to the ifconfig(8) man page. Reviewed by: cognet, glebius, hrs Tested by: zarychtam@plan-b.pwste.edu.pl Approved by: cognet, glebius Relnotes: yes Differential Revision: https://reviews.freebsd.org/D49681
Commits about commands found in man section 1 (other than networking).
Add a new -h option that causes stat to print a list of holes for each file argument. Sponsored by: Klara, Inc. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D52481
Man pages, release notes, etc.
The manual page does not directly mention this reason for getting EPERM, instead referring the reader to chroot(2). We have had some questions about it recently, in part due to a bug (fixed), and this case is not an obvious permission/problem, so let's be more explicit. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280809 Reviewed by: jamie MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52319
from jesper wallin
ok bluhm
Obtained from: OpenBSD, jmc <jmc@openbsd.org>, 8c83d32726
Sponsored by: Rubicon Communications, LLC ("Netgate")
Hint that the tcp timeout values can be adjusted collectively via "set
optimization".
from jesper wallin
ok bluhm
Obtained from: OpenBSD, jmc <jmc@openbsd.org>, df80715c2d
Sponsored by: Rubicon Communications, LLC ("Netgate")
So that it renders as intended. MFC after: 3 days Sponsored by: The FreeBSD Foundation
If this tunable is enabled and vtnet receives a packet with VIRTIO_NET_HDR_F_NEEDS_CSUM set, vtnet computes the TCP/UDP checksum and writes it in the checksum field. This was somewhat useful when vtnet pretended that such a packet has a correct checksum and set the mbuf flag CSUM_DATA_VALID. But this is not the case anymore. Reviewed by: tuexen MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D52546
Bring up to date with NSS by substituting "file" with "database". Describe more precisely which database is accessed, i.e., only the group database, which value should be used and where it lands in the result. Prefer a terminology referring to POSIX terms, i.e., use "effective group list" instead of "group access list". Reviewed by: gbe MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52283
Add a new SECURITY CONSIDERATIONS section describing in details what the
new behavior is after commit 9da2fe96ff2e ("kern: fix setgroups(2) and
getgroups(2) to match other platforms"), what setgroups(2) does not
do anymore, and how programs using it are affected.
Fix the groups limit after commit 9da2fe96ff2e ("kern: fix setgroups(2)
and getgroups(2) to match other platforms").
Prefer a terminology referring to POSIX terms, i.e., use "effective
group list" instead of "group access list".
While here, fix some style.
Note for MFC to stable/14: The content will have to be revised as the
new behavior is not in place. The latter should still be mentioned as
upcoming in 15.
Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms")
MFC after: 5 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52284
Reviewed by: gbe Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52285
Clarify and be more precise about the behavior of getgroups(2), in
particular with respect to 'gidsetlen'.
Prefer a terminology referring to POSIX terms, i.e., use "supplementary
groups" instead of "group access list".
Say that getgroups(2) reports the supplementary groups in strictly
ascending order and returns the cardinal of the set they form (and
mention this has been the case since FreeBSD 14.3).
Add a new SECURITY CONSIDERATIONS section contrasting the new behavior
after commit 9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to
match other platforms") with the historical one.
While here, fix some style.
Note for MFC to stable/14: The content will have to be revised as the
new behavior is not in place. The latter should be mentioned as
upcoming in 15.
Reviewed by: gbe (older version)
MFC after: 5 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52286
Reviewed by: gbe MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52287
MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52288
reads odd to repeat, e.g. -F, when listing all its modifiers.
as a consequence, automatic tagging wouldn't work, e.g. no "zero"
tag would exist to jump to that -F modifier's definition.
also add manual tags for -R and -T as get explained together with
-s and -t, respectively, where only the first flag gets tagged.
Obtained from: OpenBSD, kn <kn@openbsd.org>, e08605c7f2
Sponsored by: Rubicon Communications, LLC ("Netgate")
OK sashan henning deraadt
Obtained from: OpenBSD, kn <kn@openbsd.org>, 1ddc001403
Sponsored by: Rubicon Communications, LLC ("Netgate")
In the manual pages for configuration files based on parse.y, describe
the syntax of both defining and using macros, rather than exclusively
relying on examples, which some of the pages do not even provide.
In those pages containing tables of content, also clarify that
the "Macros" section contains *definitions* of variables.
Both changes were already committed to vm.conf(5) earlier.
OK florian@, and deraadt also requests keeping these manuals in sync.
Obtained from: OpenBSD, schwarze <schwarze@openbsd.org>, 20aba01e82
Sponsored by: Rubicon Communications, LLC ("Netgate")
vnet.9: Rename vnet.9/vimage.9 to VNET.9/VIMAGE.9 Fix crossreferences to VNET(9) by correcting it's capitalization. MFC after: 3 days Reviewed by: enji, ziaee Closes: https://github.com/freebsd/freebsd-src/pull/1848
ObsoleteFiles: Remove the miscapitalized vnet.9 MFC after: 3 days Fixes: https://cgit.freebsd.org/src/commit/?id=3049b2f5115b (vnet.9: Rename vnet.9/vimage.9)
ObsoleteFiles: Remove the miscapitalized vimage.9 MFC after: 3 days Fixes: https://cgit.freebsd.org/src/commit/?id=08d41d8803d9 (ObsoleteFiles: Remove the miscapitalized vnet.9) Fixes: https://cgit.freebsd.org/src/commit/?id=3049b2f5115b (vnet.9: Rename vnet.9/vimage.9 to VNET.9/VIMAGE.9)
CDCEEM is already defined in the document name, no need to list it in parentheticals a second time in the document description. This brings the apropos listing down to one line on the one true standard console. MFC after: 3 days
Hardware drivers and architecture-specific code.
Add the Arm C1-Nano, C1-Pro, C1-Premium, and C1-Ultra CPUs from their Technical Reference Manuals. Sponsored by: Arm Ltd
The check was always true so would incorrectly enable the feature when it wasn't supported. Due to another bug this was harmless. Sponsored by: Arm Ltd
xhci offers a debugging interface which uses a special usb 3 cable with the D+, D- and VBUS pairs disconnected. This interface allows a target device to configure its xhci controller as a debugging channel which can then be used to provide a serial link between the target and a debug host. This change extracts the udbc host mode driver from hrs@'s xhci debug implementation. Reviewed by: bcr (man page) MFC after: Before 15-ALPHA3 builds Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D51299
If the device is opened with O_NONBLOCK, even though we check for it in order to set CHN_F_NBIO, the subsequent chn_reset() calls will clear all flags, except those set in CHN_F_RESET, which does not include CHN_F_NBIO. Add CHN_F_NBIO to CHN_F_RESET. Additionally, because primary channels can be reused, make sure we do not unintentionally keep CHN_F_NBIO set if the channel is re-opened, but without O_NONBLOCK. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289441 MFC after: 2 days Reviewed by: christos, markj Differential Revision: https://reviews.freebsd.org/D52493
When fixing the conflicts caused by gallatin's commit and the reviewed patch, I missed this location because it didn't exist when gallatin did their change. Obtained from: Juniper Networks, Inc.
These functions are stubs that do nothing but are called by some software and not providing them results in implicit function declaration errors. This was missed in D25740. Reviewed by: #riscv, mhorne MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52035
The first store-pair instruction in save_registers_head decrements the stack pointer to create room for most of the trapframe (and the redzone area for nested exceptions). However, the expression was a bit non-intuitive as it was using an expression without a leading negative sign to adjust the stack pointer. Rewrite the expression so that it is more clearly a negative adjustment to the stack pointer. Suggested by: andrew Reviewed by: andrew Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D52514
x18 is overwritten with a temporary copy of the kernel stack pointer when it is saved in the trapframe. This does not matter in terms of function since nested exception return does not restore x18 from the trapframe, but it does mean that examining x18 in a debugger in stack frames above a nested fault outputs the wrong register value. To fix, compute the value of the original stack pointer to save in x18 later after the trapframe has been constructed. Reviewed by: jhb, andrew Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D52472
Add PNP info so it the module can be by devmatch(8) and automatically loaded. On non-x86 platforms it is not included in GENERIC. Reviewed by: imp MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52557
Use tsadc_temp_to_raw instead of tsadc_raw_to_temp, otherwise rk3566/68 get stuck in a kernel reboot cycle. https://forums.freebsd.org/threads/running-freebsd-on-radxa-rock-3c-rk3566-board.89389/post-624890 Submitted by: covacat Reviewed by: mmel MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D52309
This patch revisits the controller reset path and introduces timeout handling for I/O commands. To support controller reset during driver operation, the controller’s construct, destruct, enable, and disable functions are clearly separated in ufshci_ctrlr.c. ufshci_ctrlr_hw_reset() function is added to leverage enable/disable. After initialization, ufshci_ctrlr_reset_task() is also introduced to ensure controller resets are performed via the task queue. Timeout handling is designed in five steps. This patch implements Step 1 and Step 5, while the remaining steps will be added later. The timeout mechanism follows the same shared timeout model used in the NVMe driver. Test: Intentionally delayed UPIU I/O in QEMU to trigger a timeout and verify timeout handling. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D52440
The CPUCTL_UPDATE is supposed to be applied only to the CPU the ioctl(2) was performed on. This is true for Intel CPUs, but for AMD the SMP rendezvouz of amd_ucode_wrmsr() effectively executed it on all CPUs. Also, the update failure was not reported. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D52466
The function is never called with onoff = -1 MFC after: 3 days MFC with: 9ae3c30
arm64: Move the FEAT_PAN check later We only need to enable PAN (Privileged access never) before userspace is running. Before that there are no unprivileged mappings to protect the kernel from accessing. While here switch to use get_kernel_reg to handle the case some CPUs have FEAT_PAN, while some don't. Reviewed by: emaste Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D52576
arm64: Add cpu_feat_disabled for disabled features When a feature is disabled we may need to run a cleanup handler, e.g. to remove a feature from the sanitized ID registers. Add support for this with a new feat_disabled handler. Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D52577
arm64: Read the CPU feature tunables once Rather than reading the CPU tunables each time we enable a feature just read them once on boot. Reading them early on non-boot CPUs causes issues where they try to allocate memory before the core is set up to do so. As they don't change it is safe to cache the state of them. Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D52578
arm64: Fix enabling CPU features Previously when enabling CPU feature we assumed the no check function means the feature was unconditionally enabled. When adding support to disable features on boot this check was incorrectly partially left in place. As all current features have a check function this meant all features were disabled. Fix this by restoring the previous behaviour while also allowing the user to disable the feature. Reviewed by: emaste Fixes: https://cgit.freebsd.org/src/commit/?id=4bc68fa98f68 ("arm64: Support managing features from loader") Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D52579
arm64: Set the endian without a memory access Early in the kernel we set the endian through the sctlr_el1 and sctlr_el2 registers. To get the value to put into these registers we load them from memory. As this will depend on the endian to get the fields in the correct order then it will fail if the endian is not what the kernel expects. Add a macro to load a 64-bit value into a register without a memory access and use this to set the register. As instructions are not affected by the endian set in sctlr this is safe. It is unlikely this will be hit as UEFI requires the processor to be in little endian mode, however when booting using the Linux ABI the kernel may start in big-endian, and secondary CPUs could be big-endian. Reviewed by: emaste Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D51012
arm64: Enable EPAN and IESB These are both safe to enable. EPAN only affects PAN when it's enabled, and IESB makes exception entry and exit an Implicit Error Synchronization event. Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D51013
Migrate the following wifi drivers to use the seqno offload option. Locally tested (STA mode) on: * mtw * uath * upgt * ural * urtw * uzyd Differential Revision: https://reviews.freebsd.org/D50771 Okayed by: bz
* Convert the rest of the drivers to implement driver/offloaded sequence number handling. * For drivers that implement their own sequence number space handling for A-MPDU, only call ieee80211_output_seqno_assign() if the frame isn't tagged with M_AMPDU_MPDU, which mirrors the original net80211 sequence number behaviour. (Except of course, the assignment is now happening during final encap/transmit, not early in encap.) Locally tested (sta mode): * ath * iwn * bwi * bwn * iwm * otus * ral Differential Revision: https://reviews.freebsd.org/D50772 Okayed by: bz
the firmware should be sending these. Differential Revision: https://reviews.freebsd.org/D52298 Reviewed by: bz Locally tested: * rtl8821/rtl8812au (STA)
Don't originate null data frames in net80211; leave that up to the iwn firmware. This should fix a bunch of cases where we're seeing out of sequence 802.11n aggregation data packets because net80211 power management stuff was triggering NULL data frames when we don't need them and messing up the firmware / ring buffer sequence number space. Differential Revision: https://reviews.freebsd.org/D52299 Locally tested: * 6205, STA mode
Tell it not to originate NULL / QoS NULL data frames. The firmware will handle them here. Differential Revision: https://reviews.freebsd.org/D52300 Reviewed by: bz Locally tested: * 9260, STA mode
Otherwise we get a NULL pointer dereference when writing to /dev/random. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288826 Reviewed by: cem MFC after: 1 week Fixes: https://cgit.freebsd.org/src/commit/?id=fa8db724ae6e ("random: Treat writes to /dev/random as separate from /entropy") Differential Revision: https://reviews.freebsd.org/D52633
Reviewed by: jrtc27, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D52626
Noted and reviewed by: jrtc27 Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D52626
We already use clflushopt in support.S, there is no reason to manually construct the encoding. Initially it was done because toolchains did not supported the (then) new instruction. Sponsored by: The FreeBSD Foundation MFC after: 1 week
to evdev or sysmouse. It is required to avoid receiving of double events on hybrid devices supporting both interfaces like ums (4). MFC after: 1 day Reviewed by: glebius (via private chat) Differential Revision: https://reviews.freebsd.org/D52647
I received a report on freebsd-wireless@ that traffic stopped working. It seems that although my AX210 is fine with this change, the AX201/22000 hardware/firmware seems to require it. There's a bit to set in the TX command to force the FW to set the sequence control. We only set a few flags, and we don't set that. So, add the sequence number allocation where encryption is performed. Locally tested: * AX210, STA mode * AX201, STA mode Differential Revision: https://reviews.freebsd.org/D52652 Reviewed by: kevans Tested by: kevans
I've had a report of this breaking without the sequence number assigned (from glebius@) so, similar to iwx work, let's just re-add it here. Reported by: glebius Differential Revision: https://reviews.freebsd.org/D52664 Reviewed by: glebius Tested by: glebius
Network-related commands, library, and kernel.
Framgent count and statistics are stored in struct pf_status. From
there pfctl(8) and systat(1) collect and show them. Note that pfctl
-s info needs the -v switch to show fragments.
input claudio@; OK henning@
Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 19e99d0613
Sponsored by: Rubicon Communications, LLC ("Netgate")
Obtained from: OpenBSD, jsg <jsg@openbsd.org>, 7ac7a88014
Sponsored by: Rubicon Communications, LLC ("Netgate")
ng_hci: Cast NG_HCI_BDADDR_ANY to const bdaddr_t * This is needed to address some compiler errors cleanly, where consumer functions want this address to be a const pointer. Sponsored by: The FreeBSD Foundation MFC after: 3 days Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D52310
ng_btsocket_rfcomm: Mark a couple buffers as const in a helper function Fixes: https://cgit.freebsd.org/src/commit/?id=680f9acc3657 ("ng_hci: Cast NG_HCI_BDADDR_ANY to const bdaddr_t *")
This adds support for obtaining timestamps from IPv6 packets using the SO_BINTIME socket option, bringing it in parity with IPv4 behavior. Enable testing the SO_BINTIME option in the relevant (manual) regression test. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289423 Reviewed by: markj MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D52504
In case we use OVPN_CIPHER_ALG_NONE, the memcpy will attempt to copy 0 bytes from an uninitialized pointer. While the memcpy() implementation will treat this as a no-op and not actually dereferece the undefined variable it is still undefined behaviour to the compiler and should be fixed. Found by building with clang HEAD Reviewed by: kp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52543
Previously, the macros used '>' instead of '>=' when comparing elapsed time against the preferred and valid lifetimes. This caused any deprecated address to become usable again for one extra second after receiving each Router Advertisement. In that short window, the address could be selected as a source for outgoing connections. Update the checks to use '>=' so that addresses are deprecated or invalid when their lifetime expires. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289177 Reported by: Dmitry Nexus <fbsd.4f6a at nexus tel> Reviewed by: zlei Submitted by: Marek Zarychta MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52323
so that we do not discard EtherIP packets ( over IPv6 network ) when net.inet6.ip6.fw.deny_unknown_exthdrs is set to 1 ( which is the default value ). PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=227450 Reviewed by: ae, #network MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52566
This requires passing the reason pointer down into pf_build_tcp().
ok bluhm@
Obtained from: OpenBSD, sf <sf@openbsd.org>, 03c532ca70
Sponsored by: Rubicon Communications, LLC ("Netgate")
TCP reset packets are generated for the sequence numbers that have
been acknowledged. Our pf(4) is quite strict regarding sequence
numbers of reset packets to avoid evil connection drops. It expected
exact match and did not allow a sequence window for resets. As pf
tracks neither gaps in the sequence space nor the acknowledged data,
it does not know where exactly the reset is expected by the TCP
stack.
Problem was that legit reset packets before a gap but not at the
highest sequence numbers were blocked by pf. Solution is to fix
pf_tcp_track_full(). Now it allows sequence number windows if the
packet has ACK+RST flags set and the acknowlege number matches
perfectly. This still prevents reset number guessing by an attacker.
Curiously the TCP stack behaves correctly and accepts only resets
before the gap. pf only allowed resets after the final data. So
any reset was ignored by the system. When the other side processed
the challenge ACK, the situation could be fixed.
bug reported and fix tested by Lucas Aubard with Johan Mazel, Gilles
Guette and Pierre Chifflier; OK sashan@
Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 12e4c257ea
Sponsored by: Rubicon Communications, LLC ("Netgate")
The previous pf_krule_global leak fix was a bit too aggressive and cleaned up the inactive tree pointer before we needed it to preserve counters. Only clean up anchors that are entirely unused. Clean up pf_main_ruleset on pf shutdown. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289299 MFC after: 1 week Fixes: https://cgit.freebsd.org/src/commit/?id=275ff85b25 ("pf: fix struct pf_krule_global leak") Sponsored by: Rubicon Communications, LLC ("Netgate")
Implement RFC 7217 (A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)) in our IPv6 stack. A new ifconfig `stableaddr` flag is added to enable the feature on interfaces, which defaults to on or off for new interfaces based on the sysctl `net.inet6.ip6.use_stableaddr` (off by default, so this commit causes no change in behavior with default settings). The algorithm follows the RFC in its logic, using SHA256-HMAC as the algorithm to derive addresses so as to provide code that can be leveraged by future implentations of RFC 8981, leveraging the `hostuuid` as the secret. The source of the hostidentifier can be configured using the sysctl `net.inet6.ip6.stableaddr_netifsource`, while the number of retries generating a new address in case of collision can be configured using the `net.inet6.ip6.stableaddr_maxretries` sysctl (default 3). Documentation about all these flags is added to the ifconfig(8) man page. Reviewed by: cognet, glebius, hrs Tested by: zarychtam@plan-b.pwste.edu.pl Approved by: cognet, glebius Relnotes: yes Differential Revision: https://reviews.freebsd.org/D49681
Stuff in man section 8 (other than networking).
found by "buffer overflow 'anchortypes' 10 <= 12" smatch error
feedback and ok sashan@, ok miod@ on an earlier version
Obtained from: OpenBSD, jsg <jsg@openbsd.org>, 730c5d0121
Sponsored by: Rubicon Communications, LLC ("Netgate")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Add missing error checks
Input kettenis, millert
OK millert
Obtained from: OpenBSD, florian <florian@openbsd.org>, a7b9eedcb4
Sponsored by: Rubicon Communications, LLC ("Netgate")
Obtained from: OpenBSD, jsg <jsg@openbsd.org>, 6768654732
Sponsored by: Rubicon Communications, LLC ("Netgate")
Some options (in particular, -g) are processed immediately upon being parsed. This will produce the wrong result in combination with -j since we only attach to the jail after we're done parsing arguments. Solve this by attaching to the jail immediately when -j is encountered. The downside is that e.g. `ifconfig -j foo -j bar` would previously attach to jail “bar”, whereas now it will attempt to attach to jail “foo”, and if successful, attempt to attach to jail “bar” within jail “foo”. This may be considered a feature. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289134 MFC after: 1 week Reviewed by: zlei Differential Revision: https://reviews.freebsd.org/D52501
Build without LOADER_BIOS_TEXTONLY since it is now the default. Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D52559
When passing an NVIDIA GPU to a Linux VM, the GPU driver refuses to work and complains about a missing IRQ: [ 77.208984] NVRM: Can't find an IRQ for your NVIDIA card! [ 77.212697] NVRM: Please check your BIOS settings. [ 77.212699] NVRM: [Plug & Play OS] should be set to NO [ 77.212700] NVRM: [Assign IRQ to VGA] should be set to YES [ 77.212702] nvidia: probe of 0000:00:07.0 failed with error -1 By setting a valid INTPIN in the PCI config space those error messages disappear. Additionally, tools like nvidia-smi are able to detect the GPU and the GPU driver seems to work properly. Note that bhyve still doesn't support legacy interrupts. So, the guest shouldn't try to use it even though we're assigning an INTPIN. Reviewed by: jhb Tested by: chuck MFC after: 1 week Sponsored by: Beckhoff Automation GmbH & Co. KG Differential Revision: https://reviews.freebsd.org/D51892
When starting single-user mode, use the home directory from user root as current directory and for the HOME environment variable. If the directory does not exist, set HOME=/. Also adjust /root/.profile to stop setting HOME, since it should always have been set now. This is intended to keep shell startup files working in single-user mode after /.profile has been removed. Reviewed by: emaste, ivy, kevans MFC after: 1 week Relnotes: yes Differential Revision: https://reviews.freebsd.org/D52527
It is in fact redundant with the previous one, as the set of supplementary groups is expected to be empty. MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52281
This change allows user to define table inside the anchor like that:
anchor foo {
table <bar> { 192.168.1.1 }
pass in from <bar> to <self>
}
Without this diff one must either create table <bar> in main
ruleset (root) or use 'pfctl -a foo -t bar -T add 192.168.1.1'
This glitch is hard to notice. Not many human admins try to attach
tables to non-global anchors. Deamons which configure pf(4) automatically
at run time such as relayd(8) and spamd(8) create tables attached to
thair anchors (for example 'relayd/*') but the deamons use way similar
to pfctl(8) to add and manage those tables.
The reason why I'd like to seal this gap is that my long term goal
is to turn global `pfr_ktable` in pf(4) into member of pf_anchor.
So each ruleset will get its own tree of tables.
feedback and OK bluhm@
Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 30269bc362
Sponsored by: Rubicon Communications, LLC ("Netgate")
The current way to adjust pf(4) limits in pf.conf(5) is inconvenient.
For example when ruleset uses more than 512 anchors (the current default
limit) one would typically add 'set limit anchor 1024' to adjust
the limit so the 'pf.conf(5)' gets processed. Unfortunately it
does not work because limit gets changed with DIOCXCOMMIT which
is too late. The pf.conf(5) fails to load the anchors to transaction,
because the old lower limit is still in place. To fix it we must
set the limit as soon as we parse 'set limit ...' option.
The issue has been reported and fix tested by rafal _dot_ ramocki _von_ eo.pl
OK @bluhm
Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 85baac7751
Sponsored by: Rubicon Communications, LLC ("Netgate")
This moves some math to where it logically makes more sense for skipping over the ": " separator in the message formatted "app[PID]: MSG". No functional change. Fixes: https://cgit.freebsd.org/src/commit/?id=18bcf5a0 ("Restore local kernel "prog" filtering") Sponsored by: Dell Inc.
This fixes two printing bugs in cpucontrol(1). First, the utility will now print "updating from rev X to rev Y", instead of incorrect "updating to revision X", where X is actually the old revision. This also matches what Intel updater prints. Second, the utility won't incorrectly warn that the update failed after reading the new revision post update. Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D52506
- Reformat function definitions
POSIX states that compound commands, i.e., ones that use `(..)` or
`{ .. } `, are permissible as function definitions, however, many shell
syntax validators do not acknowledge the former format.
Switch to the latter format so more naive editors, like the vim syntax
highlighter, better parse the syntax of the file.
Moreover, replacing `(..)` with `{..}` replaces several subshells with
their non-subshell equivalents. Given that `set -e` is used liberally
and `exit` is not used in the calling code when `set -e` is not
enforced, there is no net loss by making this change.
- Clean trailing whitespace.
- Reindent some related comments to match the indentation of the
previous line.
- Add shebangs to the tops of files to help syntax colorizers and file
identifiers understand that the files are in shell syntax.
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D52596
pw: Remove duplicate lines from the pw useradd usage message No functional change intended. MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc.
pw: Print warnings when metadata updates fail We do this in most places already, but not consistently. MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc.
pw: Clean up a couple of errx() calls - Remove a stray backslash. - Make an error message fit on one line. No functional change intended. MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc.
pw: Add a missing chown() when creating dirs in mkdir_home_parents() mkdir_home_parents() effectively performs a mkdir -p of the root home directory. It chowns the home directory to 0, 0, but doesn't do so for the intermediate directories. Add an explicit chown() call for those too. Fix a long line while here. Reviewed by: bapt MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52587
pw: Use copy_file_range() when copying skeleton files As a bonus, check for I/O errors and print them to standard error. Reviewed by: bapt, emaste MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52588
pw: Add a metalog output mode When creating OS images as a non-root user, it may be useful to pre-create users in the staged tree. The useradd operation adds files to the new user's home directory, copied from the skeleton directory (/usr/share/skel), which makes it inconvient for use in this scenario since the added files are not recorded in the mtree metalog. To cover this gap, this change adds a new -M <metalog> option to pw's useradd operation, causing pw to add mtree entries for newly added files. Extend an existing regression test to validate this mode. Reviewed by: bapt, emaste MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52590
Update the pkgbase component selection dialogue to take the components list from the meta-package sets available on the install media, except for "kernel" which is still handled magically. Always install "minimal", and by default select "base", "kernel-dbg" and any libcompat sets (e.g., lib32) if they're available. Replace the various "dbg" options with a single "debug" component that installs the debug symbols for all the components the user selected, except for kernel since we handle that separately and it's common to want kernel debugs symbols without userland debug symbols. MFC after: 3 seconds Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D52558
Signed-off-by: Siva Mahadevan <me@svmhdvn.name> PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266374 Pull request: https://github.com/freebsd/freebsd-src/pull/1851 Reviewed by: emaste Sponsored by: The FreeBSD Foundation
This ensures the normally-empty directories /proc, /net, /media and /mnt are created on a fresh pkgbase install. Put /proc, /mnt and /media in -runtime since those are basic directories that should always exist. /net is only used by the automounter, so put that in -autofs. While here, also tag /rescue in -rescue, since nothing else installs there. Reported by: Graham Perrin <grahamperrin@gmail.com> PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289654 MFC after: 3 days Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D52622
Historically this capability is IFCAP_NOMAP but it was renamed to IFCAP_MEXTPG. Catch up with the change 3f43ada98c89. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289545 Fixes: https://cgit.freebsd.org/src/commit/?id=3f43ada98c89 Catch up with https://cgit.freebsd.org/src/commit/?id=6edfd179c86: mechanically rename IFCAP_NOMAP to IFCAP_MEXTPG MFC after: 3 days
It is appeared that currently starting of moused does not depend on moused_enable variable value in rc.conf. That leads to missing USB mice support in default configuration. Start moused in traditional per device mode with devd to follow POLA. One daemon per system mode still can be enabled with setting of moused_port="auto" moused_nondefault_enable="NO" variables in /etc/rc.conf To revert to sysmouse mode add moused_type="sysmouse" to /etc/rc.conf Reported by: many Requested by: glebius Reviewed by: glebius MFC after: 1 day Differential Revision: https://reviews.freebsd.org/D52430
This follows the commit 4cdc1f5421c5, which introduces the IFCAP_HWSTATS capability. Fixes: https://cgit.freebsd.org/src/commit/?id=4cdc1f5421c5 There are some high performance NICs that count statistics in hardware MFC after: 3 days
This follows the commit 051e7d78b039, which introduces the IFCAP_NV capability. Fixes: https://cgit.freebsd.org/src/commit/?id=051e7d78b039 Kernel-side infrastructure to implement nvlist-based set/get ifcaps MFC after: 3 days
Fixes the following warnings: ld: error: relocation R_X86_64_32S cannot be used against local symbol; recompile with -fPIC >>> defined in /usr/obj/usr/src/amd64.amd64/lib/libsamplerate/libsamplerate.a(samplerate.o) >>> referenced by samplerate.c:498 (/usr/src/contrib/libsamplerate/samplerate.c:498) >>> >>> samplerate.o:(src_new) in archive /usr/obj/usr/src/amd64.amd64/lib/libsamplerate/libsamplerate.a Related discussion: https://reviews.freebsd.org/D52306 Sponsored by: The FreeBSD Foundation Reviewed by: fuz Differential Revision: https://reviews.freebsd.org/D52307
No functional change (intended). MFC after: 5 days Sponsored by: The FreeBSD Foundation
In particular, fixes 'procstat -s -M' (for processes with more than 16 groups). Reviewed by: kib Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52275
We must not return ENOMEM, but rather -1 with 'errno' set to ENOMEM, as described in the manual page and as other implementations are doing. A malloc() failure actually already sets ENOMEM for us. Add comments indicating which function set 'errno' each time we return. While here, improve style and remove useless headers. Reviewed by: kib, emaste Fixes: https://cgit.freebsd.org/src/commit/?id=54404cfb13d4 ("In preparation for raising NGROUPS and NGROUPS_MAX, ...") MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52580
After commit 9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to
match other platforms"), initgroups() does not set the effective GID
anymore and uses all passed groups as the supplementary group list.
This effectively breaks backwards compatibility with programs/libraries
compiled on a FreeBSD 14 or earlier system.
Restore compatibility by creating a new version of the 'initgroups'
symbol that designates the current implementation and providing
a pre-FreeBSD-15-compatible version under the symbol's previously
exported version. The new version calls the new setgroups(2) system
call, while the compatible one calls the original one (called
freebsd14_setgroups()).
Update the manual page with some history and comparison with other
current open-source systems. Add a "SECURITY CONSIDERATIONS" section
highlighting some security properties of this approach and the reasons
we adopt it. While here, revamp the manual page, in particular to use
the exact POSIX terminology where possible.
Note for MFC to stable/14: Only the manual page update is to be MFCed,
and the text changed to reflect the old behavior and inform readers of
the new upcoming behavior in 15.
Reviewed by: kib
Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms")
MFC after: 5 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52282
Fixes compiler error when the caller passes a const bdaddr_t * paramemeter (e.g., NG_HCI_BDADDR_ANY). Sponsored by: The FreeBSD Foundation MFC after: 1 day Reviewed by: markj, emaste Differential Revision: https://reviews.freebsd.org/D52582
Due to the partial-only changes of commit 46c07316f906 ("kern: adopt the
cr_gid macro for cr_groups[0] more widely"), subsequent commit
be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
caused a mismatch between filling cr_groups[0] in 'reused_creds' in
fuse_interrupt_send() and reading 'cr_gid' from it in
fuse_setup_ihead(), with the consequence that the kernel would send
a FUSE_INTERRUPT message to the FUSE deamon with an uninitialized GID in
its header (which, besides being wrong, would disclose 4 bytes from its
stack).
Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52255
This comment has been obsoleted by commit be1f7435ef21 ("kern: start
tracking cr_gid outside of cr_groups[].").
No functional change.
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52264
If the last copy of an open file resides within the socket buffer of a unix-domain socket, then VOP_CLOSE will be called with no thread information. Fix fusefs to handle that case, and add a regression test. Also add a test case for writes to a file that lies within a sockbuf. Along with close, a write from the writeback cache is the only other operation I can think of that might apply to a file residing in a sockbuf. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289686 Reported by: iron.udjin@gmail.com MFC after: 1 week Sponsored by: ConnectWise Reviewed by: glebius, markj Differential Revision: https://reviews.freebsd.org/D52625
Kernel stuff (other than networking, filesystems, and drivers).
Enabled qat driver support for 402xx device with ID 0x4944/0x4945. This is an additional device supported under the existing qat_4xxx driver. Firmwares specific to the 402xx device are added. Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com> Relnotes: yes Sponsored by: Intel Corporation MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D52488
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D52538
aarch64 and riscv are supported since 2023 so it should be safe to enable it by default. MFC after: 2 weeks Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D52575
Currently it is impossible for a privileged, jailed process to set audit session state. This can result in suprising audit event misattribution. For example, suppose a user ssh'es into a jail and restarts a service; normally, sshd sets audit state such that events generated by the SSH session are attributed to the newly authenticated user, but in a jail, the corresponding setaudit(2) call fails, so events are attributed to the user who had started sshd in the jail (typically the user who had started the jail itself by some means). While this behaviour is reasonable, administrators might want to trust the jailed sshd to reset audit state, such that the authenticated user appears in audit logs. Add a jail knob to enable this. Add a simple regression test. This is a reapplication of commit 246d7e9fc23928 following a revert. The audit system calls must preserve the old behaviour of returning ENOSYS if the system call is disallowed within a jail, as some applications depend on that behaviour. Reviewed by: kevans, jamie (previous version) MFC after: 1 week Sponsored by: Modirum MDPay Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D51719 Differential Revision: https://reviews.freebsd.org/D52572
Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differrential revision: https://reviews.freebsd.org/D52567
* Allow the congestion control modules CDG, CHD, HD, and vegas also to be compiled into the kernel for IPv6 only kernel configs. * Compile the helper module h_ertt for round trip time estimation only into the kernel, if one of the congestion control module using it (one of CDG, CDH, HD, or vegas) is also compiled into the kernel. Please note the second point implies that TCP TSO is done whenever possible as long as none of the congestion control modules CDG, CHD, HD, or vegas is loaded or compiled into the kernel. Reviewed by: cc MFC after: 3 days Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D52547
cmcred_groups[0] in 'struct cmsgcred' must be the effective GID. Note that the code in unp_addsockcred() filling up 'struct sockcred'/'struct sockcred2' (LOCAL_CREDS/LOCAL_CREDS_PERSISTENT options) was in fact "wrong" before 'cr_gid' was moved out of cr_groups[], in the sense that it would transmit the effective GID twice, both separately as 'sc_egid' and as the first element of 'sc_groups'. It is now exact, so is left unchanged, which causes a difference in output (the effective GID is no more in 'sc_groups', unless it is also a supplementary group) that is unlikely to affect applications in practice. Reviewed by: glebius Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52262
cred: 'kern.ngroups' tunable: Rework the comment on the initial value
Remove the parts about the effective GID being stored as the first
element of the groups array, as this is generally not the case now after
commit be1f7435ef21 ("kern: start tracking cr_gid outside of
cr_groups[]") (some credentials export structures still have the old
layout, and need to do the 'ngroups_max + 1' computation, but given the
computation needed to obtain a size in bytes, this detail is not really
important here).
Remove the part about 32-bit machines, avoiding another modification
when support for them is removed.
No functional change.
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52265
cred: Update some comments after 'cr_gid' is no more cr_groups[0] While here, fix style of some already-updated comments. Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52266
cred: Remove obsolete comment after getgroups() not returning the eGID No functional change. Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52267
cred: Restore proper checking of effective groups in some security policies The removal of 'cr_gid' from cr_groups[] as cr_groups[0] made cr_canseeothergids() skip considering the subject's first supplementary group, causing the 'security.bsd.see_other_gids' policy to be too restrictive, and cr_xids_subset() miss a check on the effective GID, relaxing the "can debug" and "can export KTLS keys" checks. Fix these policies. Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52268
cred: 'struct ucred': Rework comment on 'cr_gid'/cr_groups[] Make it more straightforward for consumers. Also, recommend using cr_sgroups[] for supplementary groups, as this can generally alleviate index problems and will help us spot and change consumers if/when 'struct ucred' is evolved incompatibly (and cr_sgroups[] suppressed). MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52269
Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52270
As 'cr_gid' was in fact stored in cr_groups[0], rule_grant_supplementary_groups() would loop only on further elements of cr_groups[]. Now that cr_groups[0] is not 'cr_gid' anymore, but some supplementary group, take it into account. Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52271
Invert the initial test on whether the policy is in force so that, if there are no restrictions, the function bails out early, allowing to de-indent the rest of the code and have it finish with a non-zero (deny) 'return'. No functional change (intended). MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52272
linux: Simplify further getgroups() after 'cr_gid' not in cr_groups[] No functional change (intended). While here, fix/improve style a bit and in setgroups(). MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52276
linux: setgroups(): Fix the group number's upper limit 'ngroups_max' is the maximum number of supplementary groups the system will accept, and this has not changed. Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52277
linux: setgroups(): Avoid allocation under the process lock
This was missed in commit 838d9858251e ("Rework the credential code to
support larger values of NGROUPS (...)").
No functional change (intended).
MFC after: 5 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52278
linux: setgroups16(): Pre-extend the groups array For the size we know we will need in the end. No functional change (intended). MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52279
linux: getsockopt(): Simplify exporting groups a bit No functional change (intended). Go through conversion to a 'l_gid_t' before copying out in order to cope with differing group types (except for not representable values, of course). This is what is done, e.g., for getgroups() in 'linux_misc.c'. As Linux's group type is the same as ours on all architectures, we could as well just stop bothering and copy out our memory representation, eliminating the loop here. Whatever the choice, though, it has to be consistent here and there. Introduce 'out' of type 'l_gid_t' to avoid performing "by hand" array arithmetics when copying out. MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52280
An examination of the scripts under 'sys/tools/syscalls' indicates that keeping STD as a type in the presence of COMPATxx does not make any difference, and regenerating system call files with STD removed does indeed not show any difference. Moreover, this practice is inconsistent with the rest of the file. Thus, remove the superfluous STD type for the two above-mentioned system calls. While here, re-order the remaining types for getgroups() to be consistent with other such occurences (COMPATxx before CAPENABLED). Reviewed by: kevans, emaste MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52499
and the last acquired file and line to witness object. For recursable locks, unfortunately current implementation records only the recurse count and the last acquired file and line, but does not restore the previous acquired file and line on unlock. Hence it is possible to report false acquired file and line, and that may mislead developers and make the report by users a little harder to analyse. Since subsequent recurse locks do not affect how witness order check, record the first acquired file and line so that the logic is much clear. Reported by: bz Reviewed by: kib (previous version), markj See also: https://lists.freebsd.org/archives/freebsd-current/2025-June/007944.html MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D52496
It does not hold since introduction of vnode state tracking, which
validates unlock only happens after the target vnode is sorted out
(fully constructed or aborted). See 829f0bcb5fe24bb5 ("vfs: add the
concept of vnode state transitions").
dtrace_xcall() is just a thin wrapper around smp_rendezvous_cpus(). There's no need for six identical implementations to live in MD layers. No functional change intended. MFC after: 2 weeks
Chace Linux change fca76071bab2 ("lib/string_helpers: Split out
string_choices.h") from v6.5. Everything that we implemented from
string_helpers.h has moved, so rename the file, update the include
guards, and add a new dummy string_helpers.h that just #includes it.
This matches Linux for the functionality that we have.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52606
Reported and tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week
Noticed when building a kernel with options RANDOM_FENESTRASX. MFC after: 1 week
Generalize foffset_lock/unlock() by splitting the locking info file_v_lock/unlock() (LP64 case) or file_v_lock/unlock_mtxp() for ILP32 (using mutex pool) and then taking the action to read the offset. sys/file.h: rename struct file f_vnread_flags member into generic f_vflags Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D52486
Use f_vflags file locking for this. Allowing more than one thread handling F_SETFL might cause de-sync between real driver state and flags. Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D52487
gcc 13 and earlier don't have __builtin_bitcountg. The linux wifi kpi uses this unconditionally. While in this one use, it might not be needed, I opted to not compile iwlwifi when building gcc12 or 13 rather than risk breaking it for everbody else. With this change gcc12 builds the kernel. Maybe this will stop jenkins email for every commit I make. Sponsored by: Netflix
Reviewed by: thj MFC with: d566b6a70bcbc329e8c690464043401fa8bdd49f Sponsored by: The FreeBSD Foundation
When MANSPLITPKG is disabled (which is now the default), the kernel
manpages in sections 4 and 9 are installed in the -kernel package
instead of the -kernel-man package, because bsd.man.mk doesn't add
the -man suffix.
Since we already have handling for kernel-man in generate-ucl.lua,
set PACKAGE=kernel-man to make sure they're always in the right
package.
To avoid creating -kernel-man-man when WITH_MANSPLITPKG is enabled,
add some logic to bsd.man.mk (suggested by kevans) to avoid adding
the -man suffix if the package already has a -man suffix, and while
here, ensure ${__group}PACKAGE is always defined.
MFC after: 3 seconds
Reviewed by: des, bapt
Differential Revision: https://reviews.freebsd.org/D52525
I did this for disc1 but forgot to amend the dvd invocation. Fixes: https://cgit.freebsd.org/src/commit/?id=340e68fd7c0d ("release: Pass ABI to pkgbase-stage.lua") MFC after: 3 days Sponsored by: https://www.patreon.com/cperciva
Provide variables, PKG_REPOS_DIR and PKG_REPO_NAME, to allow the user to configure the source package repository. Configure pkg to emit added files to a metalog which gets concatenated with the main metalog immediately before we build the root filesystem. Reviewed by: cperciva, emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52453
The FreeBSD-src package is the largest single pkgbase package at 158M currently. Remove it and FreeBSD-src-sys (87M) from the base set as they are not useful to all users. Reviewed by: emaste, ivy Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52573
Create a new tests package set to hold the tests, which are not useful to all users and don't belong in the base set. Reviewed by: emaste, ivy Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52574
release: Make azure cloudware images buildable as non-root - Don't chroot to uninstall pkg since we don't install pkg in the first place. - Use pw -R instead of chrooting. - Add metalog entries. Reviewed by: cperciva, emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52451
release: Prepare EC2 cloudware images to be buildable as non-root - Avoid chrooting to uninstall pkg, as it will not be installed in the first place when in non-root mode. - Add metalog entries. Reviewed by: cperciva MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52452
release: Prepare oracle cloudware images for non-root builds - Add metalog entries. - Remove a stray entry in the package list. Reviewed by: cperciva, emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52454
release: Prepare GCE cloudware images for building as non-root - Avoid mounting devfs just to list packages and fetch distfiles. - Add metalog entries. Reviewed by: cperciva, emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52455
release: Prepare Vagrant cloudware images for building as non-root Add metalog entries for various files. This is a bit incomplete as pw(8) doesn't yet have support for emitting metalog entries, which we need since it's used here to create an interactive user. Reviewed by: emaste MFC after: 3 days Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D52456
crypto/openssl: apply polish to new vendor import process This change does the following 2 things: - Makes the build more repeatable by isolating the environment. This prevents bmake from leaking variables into gmake and makes the overall process a bit more robust. - Add debug printouts to make the process more straightforward to the reader and whoever is executing doing the current vendor import. MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D52420
crypto/openssl: fix importing new versions from pristine trees Prior to this change, CC was not being passed through to Configure, which was resulting in failures when Configure was running compiler checks. Pass through CC via `WRK_ENV` to Configure so the compiler is defined properly as part of the initial build. MFC after: 1 month Fixes: https://cgit.freebsd.org/src/commit/?id=d18058b7b850 ("crypto/openssl: apply polish to new vendor import process") Differential Revision: https://reviews.freebsd.org/D52595
packages: Add minimal-jail set This is minimal, but without bootloader, hardware and networking support that's typically not required in jails. This requires extending the 'set' annotation to be a comma-separated list, so that packages can be in multiple sets. MFC after: 3 seconds Reviewed by: bapt Differential Revision: https://reviews.freebsd.org/D52591
packages: Mark all sets as vital At least "minimal" must be vital, because it's required for a functional system. For example, we might create new packages in the future which are required for the multi-user system and are part of the minimal set, so it's important that users don't remove set-minimal to ensure they get those new packages. For the other sets, it's debatable whether they should be vital or not, but let's start out with the assumption that if the user installed a set, they should have to have to explicit request it be removed. This means if, for example, they install set-devel, then remove lldb, pkg won't remove set-devel and cause the next "pkg autoremove" to remove everything else that was in set-devel. We might want to adjust this later (or possibly adjust the behaviour of pkg(8) itself) based on user feedback. While here, fix a typo in the description of the devel set. Suggested by: bapt MFC after: 3 seconds Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D52562
packages: Move kernel-man to the minimal set Currently this is in the "kernels" set, which doesn't make sense because it's not a kernel. Move it to the "minimal" set, on the basis that minimal already includes a bunch of manpages, and a user who installs with minimal expects that e.g. "man ix" will work. MFC after: 3 seconds Reported by: des Reviewed by: bapt Differential Revision: https://reviews.freebsd.org/D52560
Contains almost everything of use in a container except: - *lib32 - *dev - *dbg - *src - anything expecting hardware such as device config tools Differential Revision: https://reviews.freebsd.org/D51471 Reviewed by: dfr, emaste Approved by: cperciva MFC after: 1 day Sponsored by: SkunkWerks, GmbH
Include a pkg package in the pkgbase repo It is essential that users be able to install the FreeBSD base system from release media and have all the bits needed to update the FreeBSD base system without touching the ports tree or pkg.freebsd.org. To that end, resurrect (and heavily rewrite) the make-pkg-package.sh script and hook it into the create-packages target; if /usr/ports exists when building pkgbase packages, we'll also (cross)build pkg and include it in the repository. Scripting for actually installing this package as part of the FreeBSD installation process to come later, but I wanted this in the tree in time to test it in this week's snapshots. MFC after: 1 day Sponsored by: https://www.patreon.com/cperciva
Bootstrap pkg before building a pkg package At sufficiently high levels of build parallelism we can try to create the pkg before any of the other pkgbase-creation steps have taken care of the bootstrap. Fixes: https://cgit.freebsd.org/src/commit/?id=6b5adf33873a ("Include a pkg package in the pkgbase repo") MFC after: 12 hours Sponsored by: https://www.patreon.com/cperciva
release: Allow powerpc GENERIC64(le)? kernels The pkgbase-stage.lua script asserts that it has exactly one "kernel", but only accepts GENERIC as a "kernel". Use a slightly more permissive regex in order to capture kernels with names which start "GENERIC". Reviwed by: ivy MFC after: 12 hours Sponsored by: https://www.patreon.com/cperciva Differential Revision: https://reviews.freebsd.org/D52544
release: Make PKGBASE the default Replace the PKGBASE option by a NOPKGBASE option. Check for both whether the option is defined and whether it is empty, since when running from release.sh we always define NOPKGBASE. MFC after: 12 hours Sponsored by: https://www.patreon.com/cperciva Differential Revision: https://reviews.freebsd.org/D52536
release: Always dist sets on dvd1 In the !NOPKGBASE && !NODISTSETS case, we only want the pkgbase repo on disc1; but we want both packaging formats on dvd in order to allow for offline installs in both methods and also tools which ingest the dist sets from the dvd image. MFC after: 12 hours Sponsored by: https://www.patreon.com/cperciva Differential Revision: https://reviews.freebsd.org/D52537
We don't want a tests-dev package, because this means set-devel depends on tests-dev, which transitively depends on tests, which means you can't install set-devel without also getting tests. The only real "dev" files in tests-dev are from ATF (libprivateatf), so move that to its own package and add a dependency from tests. Also move Kyua to its own package, since this might be useful for running tests even when the user doesn't want the whole set of base tests installed. Add a dependency from -tests to both -atf and -kyua, and a dependency on -set-base, since the tests won't work without the full base system installed. The remaining "dev" files in tests are actually test artifacts, not real development libraries. Add a new NO_DEV_PACKAGE option to bsd.lib.mk, which causes dev files to be installed in the base package instead of creating a -dev package, and set this option for everything that installs test libraries. While here, add a slightly more informative description for the tests package. MFC after: 3 seconds Reviewed by: bapt, emaste Differential Revision: https://reviews.freebsd.org/D52597
Move mandoc to its own package so users can install it independently of -utilities. Put the package in the minimal set, since we also ship manpages in minimal and "man" is a basic Unix utility. Add a pkg-triggers(5) hook to run makewhatis when new manpages are installed, so that apropos(1) works. This depends on a new pkg(8) feature expected to be in in the upcoming 2.3.2 release; in the mean time, this is a no-op (i.e., having an older pkg doesn't break anything, it just won't run the trigger). MFC after: 3 seconds Reviewed by: bapt Differential Revision: https://reviews.freebsd.org/D52564
pkgbootstrap: Build pkg if PORTSDIR exists If we don't already have the pkg tool installed, we need to install it before we can build packages for pkgbase. (This arises in release builds which run in clean chroots; most users will have pkg installed already.) Installing it from pkg.freebsd.org via "pkg bootstrap" runs into two problems: First, it's an external dependency with security implications; and second, there's a bootstrapping problem on new major versions where pkg.freebsd.org does not have packages yet. Instead, if we have a ports tree, use it to build pkg ourselves. With hat: re MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
pkgbootstrap: Gate building from ports In release builds we want to build pkg from the ports tree for reasons mentioned in a previous commit; but non-release pkgbase builds may be just fine with installing pkg from pkg.freebsd.org. Gate it behind BOOTSTRAP_PKG_FROM_PORTS rather than building form ports any time we have a ports tree available. While I'm here, make the pkgbase-repo target in release/Makefile create the temporary directories we need for building. Reviewed by: ivy MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva Fixes: https://cgit.freebsd.org/src/commit/?id=2c06b824436d ("pkgbootstrap: Build pkg if PORTSDIR exists")
While we usually build FreeBSD releases on the same major version, we do need to be able to e.g. build 15 on 16. Tell the ports tree that we know what we're doing. (We don't, not really, but we can at least pretend...) MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
The introduction of package sets allows us to replace the current fragile string matching with this simpler and more robust alternative. Sponsored by: The FreeBSD Foundation MFC after: 3 seconds Reviewed by: emaste, ivy Differential Revision: https://reviews.freebsd.org/D52592
* Ignore "wrong major" errors when obtaining WRKDIR. * Put distfiles in /tmp in case /usr/ports is read-only. MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
We need to put pkg into the pkgbase repository for release builds, but not for non-release pkgbase builds. Gate the contents of package-pkg behind INCLUDE_PKG_IN_PKGBASE_REPO=YES and set that when building releases. Reviewed by: ivy MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
release.sh: Bootstrap pkg from the ports tree When building OCI continers, we create a pkgbase repository; but we need pkg in order to do this, and it may not be fetchable. Bootstrap it from the ports tree instead. Note that this pkgbase repository is not the same one as we ship as part of the release build; this duplication of package-creation will be fixed at a later date. MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
release.sh: Use mkdir -p Don't fail if directories already exist. Fixes: https://cgit.freebsd.org/src/commit/?id=08adaf71e2e5 ("release.sh: Bootstrap pkg from the ports tree") MFC after: 6 hours Sponsored by: https://www.patreon.com/cperciva
Add myself (jaeyoon@) as a new src committer with imp@ as my mentor. Reviewed by: imp (mentor) Approved by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D52570
The LastLocalModify tests were originally written to simulate a race condition between VOP_SETATTR and VOP_LOOKUP. They were later extended to cover some other VOPs that can affect file size, including VOP_WRITE. However, the test never correctly simulated the race with VOP_WRITE. So that test only ever passed by accident. Fix it by always opening the file with O_DIRECT. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289237 Reported by: Siva Mahadevan <me@svmhdvn.name> MFC after: 1 week
Ensure that the fragmentation counters work as expected.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Now that stat(1) can report whether a file is sparse, we no longer need a helper program for our tests. Sponsored by: Klara, Inc. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D52482
These tests use pft_ping.py, which requires python3 and Scapy. Reviewed by: ngie Approved by: emaste (mentor) Fixes: https://cgit.freebsd.org/src/commit/?id=65c318630123 ("pf: Add prefer-ipv6-nexthop option for route-to pools") MFC after: 10 days Differential Revision: https://reviews.freebsd.org/D52589
The 'setgroups(0, NULL);' stance works the same on all versions of FreeBSD, getting rid of all supplementary groups. The replaced code would force the effective GID to also be a supplementary group. Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms") MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52289
To this end, call setgroups(0, NULL) instead of passing the effective GID. This stance is fully compatible with older versions of FreeBSD. Fixes: https://cgit.freebsd.org/src/commit/?id=9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms") MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52290
Sponsored by: Rubicon Communications, LLC ("Netgate")
Verify that 'set limit anchors' now has the expected effect.
Sponsored by: Rubicon Communications, LLC ("Netgate")
The location of the 'wasxfail' attribute was moved from the 'reason' attribute back to the parent 'report'. This fixes an issue where xfails are wrongly reported to ATF as skipped tests. Signed-off-by: Siva Mahadevan <me@svmhdvn.name> Pull-request: https://github.com/freebsd/freebsd-src/pull/1849 Sponsored by: The FreeBSD Foundation
These could go in other categories, but it's more clear if they're here instead.
[skip ci]
Fixed typos in UPDATING Signed-off-by: Harry Fellowes <harryfellowes1@gmail.com> Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/1846
"[ n foo ]" is an error and should have been "[ -n foo ]". Fortunately the only ill effect was to result in garbage in /tmp/ when creating powerpc ISO images. Fixes: https://cgit.freebsd.org/src/commit/?id=6c3e01bf8578 ("release: Randomize powerpc boot block file name") MFC after: 3 days Sponsored by: https://www.patreon.com/cperciva
MFC after: 3 days
No functional change intended. MFC after: 1 week Sponsored by: The FreeBSD Foundation Sponsored by: Klara, Inc.
raidz_outlier_check_interval_ms has type hrtime_t, which is a long long, which is 64 bits wide on all supported platforms.
libc++: avoid use of deprecated builtin This pulls in LLVM commit accfbd4cb327411ad66c0109ba1841482b871967 to avoid the use of __libcpp_is_trivially_relocatable. This fixes building FreeBSD libc++ with clang HEAD as of today. Original commit message: [libc++] Replace __is_trivially_relocatable by is_trivially_copyable (#124970) The __is_trivially_relocatable builtin has semantics that do not correspond to any current or future notion of trivial relocation. Furthermore, it currently leads to incorrect optimizations for some types on supported compilers: - Clang on Windows where types with non-trivial destructors get incorrectly optimized - AppleClang where types with non-trivial move constructors get incorrectly optimized Until there is an agreed upon and bugfree implementation of what it means to be trivially relocatable, it is safer to simply use trivially copyable instead. This doesn't leave a lot of types behind and is definitely correct. Reviewed by: dim MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52529
libc++: avoid use of deprecated __reference_binds_to_temporary This was removed in upstream libc++ in commit 437ad06f762ab07d89badecdd20627db200b98d3, but as this does not apply cleanly to the current repository, I am applying the equivalent change in a minimally invasive way. This is needed to build with latest clang HEAD as of today. Reviewed by: dim MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52530
libc++: Fix deprecation warnings with latest clang Latest clang has become more strict in diagnosing deprecated decls, so pull in LLVM commit 9feac2cbd0d80927ce9a8b4c3e810d2b81802d55. Original commit message: [libc++] Improve deprecated diagnostic guards. Recent Clang-21 builds improved the deprecated diagnotics. This uncovered missing guards in libc++ internally. Reviewed by: dim MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52531
libc++: silence -Wnontrivial-memaccess warning with newer clang Apply part of LLVM commit 71315698c91d0cda054b903da0594ca6f072c350 to silence the -Wnontrivial-memaccess warning that is triggered any time this function is instantiated by user code. This fixes another buildworld failure with Clang HEAD. Original commit message: [clang] Warn about memset/memcpy to NonTriviallyCopyable types (#111434) This implements a warning that's similar to what GCC does in that context: both memcpy and memset require their first and second operand to be trivially copyable, let's warn if that's not the case. Reviewed by: emaste, dim MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52534
Reviewed by: emaste Fixes: https://cgit.freebsd.org/src/commit/?id=be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52274
This is a targeted effort to update the INCS and SRCS entries for libcrypto, the legacy provider, and libssl to match what upstream (OpenSSL) builds in their respective libraries. The number of stylistic changes were kept at a minimum. Another incoming change will reformat this file to make future maintenance easier. MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D52554
MFC after: 3 days
acpi: Fix build when `ACPI_DEBUG_OUTPUT` defined Reviewed by: olce Fixes: https://cgit.freebsd.org/src/commit/?id=ce5e22b28ef6 ("acpi: Use sleep types defined in sys/power.h") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52545
Revert "acpi: Fix build when `ACPI_DEBUG_OUTPUT` defined" This reverts commit 4894f5ba394306a75dbed9ed4377ab0eae75aede. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289634
jail: Optionally allow audit session state to be configured in a jail Currently it is impossible for a privileged, jailed process to set audit session state. This can result in suprising audit event misattribution. For example, suppose a user ssh'es into a jail and restarts a service; normally, sshd sets audit state such that events generated by the SSH session are attributed to the newly authenticated user, but in a jail, the corresponding setaudit(2) call fails, so events are attributed to the user who had started sshd in the jail (typically the user who had started the jail itself by some means). While this behaviour is reasonable, administrators might want to trust the jailed sshd to reset audit state, such that the authenticated user appears in audit logs. Add a jail knob to enable this. Add a simple regression test. Reviewed by: kevans, jamie MFC after: 1 week Sponsored by: Modirum MDPay Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D51719
Revert "jail: Optionally allow audit session state to be configured in a jail" Changing audit system calls to return EPERM instead of ENOSYS when invoked from a jail breaks some userspace applications. Revert for now until a more complete change is reviewed. This reverts commit 246d7e9fc23928be22db38220f5439f5cdee5264. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289645
This reverts commit e779891327b1d9b9ab10ba482e59f498790505a7. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289634
This reverts commit ce5e22b28ef6caff3ffd228ac188114b08c0da02. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289634
kern/vfs_vnops.c: generalize the lock primitive for file foffset Generalize foffset_lock/unlock() by splitting the locking info file_v_lock/unlock() (LP64 case) or file_v_lock/unlock_mtxp() for ILP32 (using mutex pool) and then taking the action to read the offset. sys/file.h: rename struct file f_vnread_flags member into generic f_vflags Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D52486
Revert "kern/vfs_vnops.c: generalize the lock primitive for file foffset" Temporarily back this out to fix the tree while I try 16.0 snapshot builds. It will come back once D52626 lands. This reverts commit 94a0f9f63e164e4f3791bc7d105d6f267b4d47bc. Discussed with: kib
fcntl(F_SETFL): only allow one thread to perform F_SETFL Use f_vflags file locking for this. Allowing more than one thread handling F_SETFL might cause de-sync between real driver state and flags. Reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D52487
Revert "fcntl(F_SETFL): only allow one thread to perform F_SETFL" Temporarily back this out to fix the tree while I try 16.0 snapshot builds. It will come back once D52626 lands. This reverts commit 40a42785dbba93cc5196178fc49d340c1a89cabe. Discussed with: kib
This reverts commit 9a3edc8d5dbcb896179cfa7867f961184e146a09. Apparently returning EINVAL is more aggressive than UFS does it, and this causes compatibility issues with apps that actually trigger the behavior. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289485, https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289678 Sponsored by: The FreeBSD Foundation MFC after: 3 days
This reverts commit cead6157cc1b748df29b32072f492d4f6afae65a. Same as 9a3edc8d5dbcb896179cfa7867f961184e146a09 Sponsored by: The FreeBSD Foundation MFC after: 3 days
This reverts commit 676d64ee8327851063d92d0dd6a4ceee6b3a25e6. These tests take a combined 3h to run and are consuming our montly Cirrus-CI credits in short order, before failing. In the PR markj reports that the failure appeared somewhere between: good: da64f6e047b5f6cd9b9e8450d19072cb0b6e44d0 bad: b197d2abcb6895d78bc9df8404e374397aa44748 Unfortunately, even after we find the offending commit and have a fix we still do not have sufficient monthly compute credit. Disable these tests for now, pending a solution to both issues. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289696 Reviewed by: ngie Differential Revision: https://reviews.freebsd.org/D52618
Not classified automatically, and waiting for manual attention.
-- no commits in this category this week --
Dates:
Automatic grouping:
This reverts commit \\b([0-9a-fA-F]{40})\\b
and the hash was found in this week's commits.
Automatic categories:
Source code:
Generated with commits-periodical 0.18 at 2025-11-03 03:26:52+00:00.
This work is supported by Tarsnap Backup Inc.
Alternate version: 2025-09-15 (debug) (contains info about the classification)