riscv/pmap.c: Add an Svinval-aware variant of pmap_invalidate_range
This change introduces a variant of `pmap_invalidate_range` that uses
the fine-grained TLB invalidation instructions introduced by the
Svinval extension. These instructions allow for more efficient TLB
flushing on certain implementations. Under this new scheme,
`pmap_invalidate_range` was converted to an ifunc that selects the
appropriate variant during boot.
Event: BSDCan 2026
Reviewed by: markj, mhorne
Differential Revision: https://reviews.freebsd.org/D57624
riscv: Add support for the Svinval extension
This change adds wrappers for the new fine-grained TLB invalidation
instructions and extends the capability detection logic to include
the Svinval extension, which is mandatory in the RVA23S64 profile.
Event: BSDCan 2026
Differential Revision: https://reviews.freebsd.org/D57623
Reviewed by: mhorne, markj
net/hostapd: Update to 2.12
This includes the following changes:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
- fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
[13 lines not shown]
security/wpa_supplicant: Update to 2.12
This includes the following changes:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
[15 lines not shown]
multimedia/gaupol: Improve port
- Actually switch to GTK4.
- Use USE_GSTREAMER=rust instead of manually defining as dependency.
- Pet port{clippy,fmt}.
Fixes: f4bb31f406d7 ("multimedia/gaupol: Update 1.16 => 2.0")
Approved by: osa, vvd (Mentors, implicit)
libsysdecode: also verify command decoders
We already verified that the attribute parser tables were correctly
sorted. Now also verify that the command decoders are too.
While here move the assertions into a constructor so we only run them once.
libsysdecode: use decoder table for PF netlink commands
Introduce a PF netlink command decoder table mapping PFNL commands to
their attribute decoder sets. This replaces the existing switch-based
dispatch and makes it easier to add support for additional PF netlink
commands.
Signed-off-by: Ishan Agrawal <iagrawal9990 at gmail.com>
Sponsored-by: Google LLC (GSoC 2026)
Reviewed by: kp
ixl: Quiesce VF DMA before a PF reset
A PF reset has a warning interval before the hardware reset begins.
Cooperative VF drivers respond to the reset event by stopping and
releasing their receive buffers, but notifying VFs did not stop the
hardware queues. An active VF could therefore DMA through its old
rings into freed mbuf clusters during the warning interval.
Put every enabled VF in reset, drain its PCIe transactions, disable its
queues, wait for receive queue shutdown, and drain transactions again
before tearing down the PF HMC and AdminQ.
Hold VFs in reset again while rebuilding the firmware topology. Release
VF reset before programming the replacement VSI and queue mappings,
since VF reset clears those registers, and publish VFACTIVE only after
reconstruction succeeds. Leave a VF held in reset if rebuilding it
fails.
Fixes: 983e628a0c47 ("ixl: Rebuild VF resources after a PF reset")
MFC after: 2 weeks
iavf: Resume AdminQ processing after PF reset
A PF reset indication leaves IAVF_STATE_RESET_PENDING set while the
VF recreates its AdminQ and negotiates new resources. The ordinary
AdminQ task refuses to consume messages while that state is set.
Consequently, the first DISABLE_QUEUES reply after successful mailbox
rediscovery remains in the receive queue and initialization times out.
Later retries and manual interface restarts repeat the same cycle.
Clear the stale reset indication once VERSION and GET_VF_RESOURCES have
succeeded, before enabling interrupts and resuming normal virtchnl
requests.
MFC after: 2 weeks
wpa: Update to 2.12
Fixes and new features include:
hostapd:
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
- fix group key rekeying
* enable SAE group 20 by default if SAE-EXT-KEY is enabled
* reject unexpected SAE password identifier to avoid DoS attack against
a specific STA
* mandate use of SAE H2E when using password identifiers
* assign VLAN when using SAE with PMKSA caching
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
[46 lines not shown]
if_ovpn: free crp, mbuf, and release refcount on crypto_dispatch() failure
When crypto_dispatch() or crypto_dispatch_async() returns non-zero,
the registered callback is never invoked. In both ovpn_transmit_to_peer()
and ovpn_udp_input(), if_ovpn.c did not free the cryptop request, release
the peer/sc reference count, or free the mbuf on dispatch failure.
This results in three simultaneous leaks per failed dispatch:
- crp allocated via crypto_getreq() is never freed
- peer->refcount (encrypt) or sc->refcount (decrypt) incremented but
never decremented
- mbuf passed to crypto_use_mbuf() is never freed
The leaks are reachable under memory pressure when the OCF scheduler
returns ENOMEM from crypto_dispatch(). The registered callbacks
(ovpn_encrypt_tx_cb, ovpn_decrypt_rx_cb) correctly handle crp_etype
for crypto operation failures; this fix addresses the separate
dispatch-level failure path where no callback is invoked.
[4 lines not shown]
ports-mgmt/pkg-devel: update to 2.8.99.1
Changes:
- security: bound vulnerability database downloads and decompression; build a temporary database and atomically replace it only after validation
- security: bound repository archive downloads and extraction (1 GiB or half of free temporary storage, 1 MiB metadata) and reject duplicate members and oversized target members
- security: bound repository signature extraction (8 MiB callback response, at most 8 signature entries of 1 MiB each)
- security: drop to nobody before entering Capsicum in the sandboxed archive and signature callbacks
- security: enforce the signed package size while fetching, capping the stream even when the server omits a Content-Length
- security: reject invalid repository signature types; only pubkey, fingerprints and none are accepted
- repo: keep file lists out of the data catalog
- repo: open the catalogue read-only when checking its validity
- rwhich: store the compressed filesite as a standalone file
- rwhich: verify the repository signature and store the filesite as a raw compressed file
- rwhich: add a global and a per-repository configuration
- fix: report (added)/(removed) reinstall reasons only once
- fix: use-after-free during the additional SAT cycle
- fix: deferred rc script execution
- rcscript: add a dedicated PKG_EVENT_RC_SCRIPT event for rc.d script actions
- fix: remove leftover nested @dir parents on deinstall
[6 lines not shown]
ports-mgmt/pkg: update to 2.8.2
Changes:
- lots of security improvements
- repo: keep file lists out of the data catalog
- rwhich: store filesite as a compressed archive locally.
- rwhich add global and per repository configuration of the file
database
- fix deferred rc script execution
- fix duplicated reinstall reason
- fix UAF in additional SAT cycle
- fix SRV/HTTP mirror handling
- respect compression level for file database and metadata
