rename page list so i don't have to think as hard.
pages moved between "empty", "part", and "full" lists, but does
empty refer to when all the items in a page are allocated or free?
full could apply to either of those states too depending on your
perspective.
replace these names with "used", "part", and "idle" page lists.
"used" pages have 100% of their items allocated, and "idle" pages
have 0 allocated items. "part" pages are in between still.
jmatthew@ thinks this reads ok.
x11/lxqt: update to 2.5.0.
see https://lxqt-project.org/release/2026/11/05/release-lxqt-2-5-0/
- drops dependency on external x11/menu-cache
- replace session dependency on oxygen for breeze icon theme, follows
lxqt/lxqt-session#411 (pcmanfm-qt & qtplugin still default to oxygen..)
should fix icon issues reported by Robert Carleton.
- fix keymap layout detection in startlxqtwayland
- dues to bugs in qtlayershell, the panel & desktop still crash on
wayland when clicking on it.
pf(4) fix traffic statistics for state created by af-to rules
The af-to states are always matched by inbound packets (PF_IN), therefore when
updating statistics the in vs. out (or request vs. reply) direction must take
address families (af) in the matched packet and in wire state key attached
to matching state into account. This allows pf(4) to choose to bump
either counters for inbound or outbound side.
OK bluhm@
libssl: fix previous and unbreak openssl-ruby regress
tls_key_share.c r1.13 changed behavior of SSL_get_peer_tmp_key() which
can now signal success but not actually succeed if no X25519/dhe/ecdhe
is in use, which is the case in ruby's test_get_ephemeral_key, which
uses kRSA with TLSv1.2 on both sides.
Only allocate the pkey if it's actually going to be used and set. Keep
returning NULL in the other cases. This stops triggering an unexpected
assertion in said test.
ok beck
pf(4): source tracking option flush does not work for NAT states
The flush option for source tracking rule also removes all states
created by offending source address. This does not work when
rule comes with nat-to option and creates NAT states. Those
states are not matched by pf_src_connlimit() when it attempts
to remove those states.
pf_src_connlimit() when removing the states must also chose correct state key
using packet direction to match the state to remove. The state keys differ
when NAT happens. For states created by nat-to rule one needs to use the
stack-side key that contains original address before packet got translated.
The issue was kindly reported and the fix submitted by Acts-1631.
OK bluhm@
Unlock KERN_HOSTNAME and KERN_DOMAINNAME sysctl paths.
Use the new hostname_mtx mutex to protect data. Use the temporary buffer
for exchange with userland. We have some areas outside sysctl layer
where we do read-only kernel-locked access to the hostname and the
domainname, so keep modification under two locks. The mutex could be
pushed in such areas later.
We also do hostname and domainname modification during kernel bootstrap
on diskless stations, but this happens at early startup before rootfs
mount.
ok deraadt
fill socket length
socket length needs to be set when building the various sockaddr
structures, otherwise m_add_sockaddr() is going to serialize exactly
zero bytes.
spotted by acts, thank you!
Fix .note.gnu.property values in ld -b binary invocations
ld.lld -b binary generated bogus .note.gnu.property values because in
such invocations there are no ELF object files to AND the -1 initial
value with. Use 0 as a starting value in that case.
Upstream PR: https://github.com/llvm/llvm-project/pull/238541
ok robert@ kettenis@
SEV-SNP: Register GHCB and handle #VC for unvalidated pages
More preparations for SEV-SNP: With SNP enabled, the GHCB page needs
to be registered with the hypervisor through the GHCB MSR protocol.
When we are an SNP enabled guest and touch a page that has not been
validated by us, the CPU delivers a #VC with error code
SVM_VMEXIT_PAGE_NOT_VALIDATED. In that case we panic.
vctrap() now takes the faulting address as an additional argument,
so vctrap_early() has to pass %cr2 in %r8. While there, also zero
the arguments sig and code: vctrap_early() is always in kernel mode,
so user is zero and they are never used.
ok mlarkin
pf(4): depleted source port pool for NAT starves other packets
The function pf_get_sport() in current selects the source port
number for network address translation (a.k.a. NAT). It basically
chooses a random source port and uses pf_find_state_all()
to check if the chosen port number is already in use for a particular NAT
address. If the port is already in use, pf_get_sport() selects
another port number and retries. This process continues as long
as the chosen port number collides with an existing address:port tuple.
The problem is that all this happens under the protection of
PF_LOCK(). This effectively stops pf(4) rule evaluation
for other packets that enter the firewall and have no state.
The fix introduces a limit on retries. The limit is set to 128.
If no free port number is found within 128 attempts, the function
gives up. The packet is dropped and PF_LOCK() is released so other
packets waiting for a rule check can be inspected by pf_test().
The issue was kindly reported and the fix submitted by Acts-1631.
[2 lines not shown]
raise the gem object size limit from 512M to 1.5G
volker@ reports that llama.cpp wants slightly more than 1G sized objects
when running on inteldrm (Raptor Lake).
libssl: stop inspecting cert signatures for seclevel
As pointed out by dadrian to OpenSSL in #31195, it makes no sense
to inspect our certificate's signatures. Our stack may not even
know the algorithms our CA used (think some PQ CA, for example).
What matters to us is that we don't use a key that is too weak,
so keep the check for that.
We do not currently inspect the peer's cert for strength either.
That may be an omission/bug.
On side effect of this removal is that we do no longer ensure that
a RSA-PSS cert has a salt length matching the hash length. That's
not really part of security, and if we care to restore this for
reasons of compliance, we should think about where to put it in
a way that throws a better error than 'ca md too weak'
Prompted by a report by semarie.
[2 lines not shown]
libssl: stop inspecting our cert chain for "security"
The chain signing our leaf cert is not crypto we ourselves use. The peer
can decide that the weak crypto is unacceptable if they care.
ok beck
