[RISCV][GlobalISel] Use Zfhmin for G_FPTRUNC to f16 (#231370)
Zfhmin includes `FCVT.H.S` and (with D) `FCVT.H.D`, so `G_FPTRUNC` from
f32/f64 to f16 only requires Zfhmin.
Use libcalls when the required extensions are unavailable. This also
completes legalization of half-precision `G_FREM`.
re-import emulators/wine
ok brynet@
DESCR:
Wine is a compatibility layer for running Windows applications on Unix.
It translates Windows API calls into native system calls.
This port includes experimental OpenBSD amd64 from
https://github.com/NethIafin/wine/tree/openbsd-master.
Only 64-bit Windows applications are supported.
[RISCV][P-ext] Restructure scalar tests to increase testing and reduce duplicaton. NFC (#232613)
Rename rv32p.ll to rvp-scalar.ll and add RV64 RUN line. This improves
coverage of some operations like i8/i16 saturating adds/subs that don't
have direct P extension instructions but might use some P instructions
in their lowering like sati. Or it may show cases where we should insert
a scalar into a packed instruction to reduce the code.
Rename rv64p.ll to rvp-scalar-rv64.ll and remove anything thats in
rvp-scalar.ll.
Revert "[SimplifyCFG] Mark branch weights unknown in masked switch to lookup" (#233325)
Reverts llvm/llvm-project#233321
Breaks the profcheck bot and needs more investigation.
Fix overflow in hardware accelerated AES-GMAC crypto.
On amd64 using AES-NI or on octeon with crypto coprocessor, an
unauthenticated ESP packet that matches a configured AES-GMAC
security association could copy almost 64 KB of attacker-controlled
data into a 4096-byte kernel heap buffer.
from Acts1631; from bluhm@; OK visa@ hshoexer@
this is errata/8.0/003_aesgmac.patch.sig
Fix overflow in hardware accelerated AES-GMAC crypto.
On amd64 using AES-NI or on octeon with crypto coprocessor, an
unauthenticated ESP packet that matches a configured AES-GMAC
security association could copy almost 64 KB of attacker-controlled
data into a 4096-byte kernel heap buffer.
from Acts1631; from bluhm@; OK visa@ hshoexer@
this is errata/7.9/038_aesgmac.patch.sig
Fix overflow in hardware accelerated AES-GMAC crypto.
On amd64 using AES-NI or on octeon with crypto coprocessor, an
unauthenticated ESP packet that matches a configured AES-GMAC
security association could copy almost 64 KB of attacker-controlled
data into a 4096-byte kernel heap buffer.
from Acts1631; from bluhm@; OK visa@ hshoexer@
this is errata/7.8/074_aesgmac.patch.sig
Backport security fixes from upstream nsd(8) version 4.15.3.
* CVE-2026-101341: Stack overwrite from specially formatted TXT-DATA
RDATA field
* CVE-2026-101339: Stack overwrite from a specially crafted and
formatted HIP RR
* CVE-2026-101338: Stack overwrite from a specially crafted and
formatted SVCB or HTTPS RR
* CVE-2026-101337: Stack overwrite from specially formatted base64
RDATA field
from bluhm@; OK sthen@ renaud@ deraadt@
this is errata/8.0/002_nsd.patch.sig
Backport security fixes from upstream nsd(8) version 4.15.3.
* CVE-2026-101341: Stack overwrite from specially formatted TXT-DATA
RDATA field
* CVE-2026-101339: Stack overwrite from a specially crafted and
formatted HIP RR
* CVE-2026-101338: Stack overwrite from a specially crafted and
formatted SVCB or HTTPS RR
* CVE-2026-101337: Stack overwrite from specially formatted base64
RDATA field
from bluhm@; OK sthen@ renaud@ deraadt@
this is errata/7.9/037_nsd.patch.sig
Backport security fixes from upstream nsd(8) version 4.15.3.
* CVE-2026-101341: Stack overwrite from specially formatted TXT-DATA
RDATA field
* CVE-2026-101339: Stack overwrite from a specially crafted and
formatted HIP RR
* CVE-2026-101338: Stack overwrite from a specially crafted and
formatted SVCB or HTTPS RR
* CVE-2026-101337: Stack overwrite from specially formatted base64
RDATA field
from bluhm@; OK sthen@ renaud@ deraadt@
this is errata/7.8/073_nsd.patch.sig
[SimplifyCFG] Mark branch weights unknown in masked switch to lookup (#233321)
We cannot infer the branch weights because this transformation splits
the default case into two (values fully out of range, and holes inside
the range), which we cannot infer without additional value profiling.
[mlir][arith] Drop invalid overflow flags when narrowing
Preserve nsw only when narrowing preserves signed operand and result
values, and nuw only when it preserves unsigned values. Flags proven
at the original width may otherwise introduce poison after narrowing.
Add concrete regression cases for addi, subi, muli, and shli, covering
both overflow flags and retention of valid flags.
iflib: Pass up the frames received before a descriptor error
When the driver's isc_rxd_pkt_get() fails part way through a receive
pass, iflib_rxeof() jumps straight to the reset request. The frames it
already took off the ring and chained for if_input() are neither passed
up nor freed, so up to budget - 1 frames are lost and their mbufs and
clusters leak on every such error, and the frames queued to LRO in the
pass wait for the next one. Leave the loop instead, pass the chain up
and flush LRO as on the normal exit, then request the reset as before,
without refilling.
The path is reachable from several drivers: igc, em, igb and ixgbe
return EBADMSG for frames received with errors, which the hardware
passes up only with store-bad-packets enabled; ixl, iavf and ice for
every descriptor flagged RXE; aq, enetc, mgb and enic for descriptors
they cannot use.
Reviewed by: gallatin
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60805
Fix overflow in hardware accelerated AES-GMAC crypto.
On amd64 using AES-NI or on octeon with crypto coprocessor, an
unauthenticated ESP packet that matches a configured AES-GMAC
security association could copy almost 64 KB of attacker-controlled
data into a 4096-byte kernel heap buffer.
from Acts1631; OK visa@ hshoexer@
isakmpd: Bound the HASH coverage in cfg_verify_hash()
The verifier assumed the HASH payload is the first payload and
derived the covered length from the message length, reading past
the end of the message when another payload precedes HASH. Compute
the covered range from the HASH payload's actual position and reject
it if it extends past the message end.
from hshoexer@; from markus@; OK hshoexer@ deraadt@
this is errata/7.9/036_isakmpd.patch.sig
isakmpd: Bound the HASH coverage in cfg_verify_hash()
The verifier assumed the HASH payload is the first payload and
derived the covered length from the message length, reading past
the end of the message when another payload precedes HASH. Compute
the covered range from the HASH payload's actual position and reject
it if it extends past the message end.
from hshoexer@; from markus@; OK hshoexer@ deraadt@
this is errata/7.8/072_isakmpd.patch.sig
Fix an off-by-one in bsd_decompress()
An incorrect bounds check for the LZW KwKwK case allows the creation of a
self-refential dictionary entry, resulting in an infinite expansion loop
that writes backward from the output mbuf, corrupting kernel memory.
This is an ancient buffer overflow that is also present in the version of
the code in RFC 1977.
from Acts1631; from tb@; OK deraadt@
this is errata/8.0/001_ppp.patch.sig
