build: clean up dev build logic
- Add messaging after options like UBSAN, etc, to make it clear that
options are enabled.
- Use `pkg-config` to determine where ATF is instead of just assuming
that the first path is the desired path.
- Use --coverage instead of the longhand form for some -fprofile*
options.
- Add `--with-tests` to explicitly enable building tests, as opposed to
just assuming that because ATF/kyua is present on the system, the
end-user *also* wants to build the tests.
Signed-off-by: Enji Cooper <ngie at FreeBSD.org>
Fix running configure from within git worktrees
`.git` in git worktree roots is a text file that points to another
location, not a directory.
Signed-off-by: Enji Cooper <ngie at FreeBSD.org>
AArch64: Use m_GPtrAdd in selectAddrModeRegisterOffset (#217446)
Replace the getVRegDef + G_PTR_ADD opcode check and operand
accesses with an m_GPtrAdd matcher.
Co-authored-by: Claude (Opus 4.8) <noreply at anthropic.com>
Resolve migrated USB devices by their vendor and product ids
## Problem
A USB passthrough device is named after the port it is plugged into, which is what 25.10 stored. The 26.0 pre-releases built the same shape of name out of the bus and device number instead — an enumeration counter the kernel reissues on every replug — so those stored values name a port nobody chose.
The incus migration has the same preference the same way round: it resolves a device by the bus and device number the manifest carries and only falls back to the vendor and product ids when those are missing. It picks the counter that gets reused over the identity that survives a replug, and because it runs exactly once per machine and is never run again, a wrong row it writes stays wrong. There is no second run, no manifest retained afterwards, and no repair path.
This matters for a population that has not been hit yet: `maybe_migrate_legacy` first shipped in 26.0.0-BETA.1 and does not exist in 25.10, so every 25.10 system with incus containers still has `virt_global.pool` set and spends its single migration on its first boot of a 26.0 build.
## Solution
- **Only the vendor and product ids identify a device.** The bus and device number takes no part in resolution. A manifest device that does not carry both ids is dropped rather than guessed at, and the reason is logged.
- **Ids that no connected device carries are still stored as ids.** The device is merely unplugged; the row stays visible and editable rather than disappearing.
- **One device per row.** Rows written for a container claim what they point at, so two manifest devices can no longer land on one port or one pair of ids — which used to leave a container that could neither start nor be edited back. Where several identical devices are connected, each row takes the first one still free.
- **Devices pylibvirt cannot read are not candidates.** Entries marked unavailable are left out of the index, so a manifest no longer resolves onto one and then fails at start claiming the port is empty.
- **A device that cannot be resolved at start reads as an error, not a traceback.** pylibvirt's exception type is caught at both start call sites and reported as a `CallError`, which is what 25.10 did.
- **Every resolution is logged, not only the failures.** Nothing on the row records which identity it came from and the job log does not survive a restart, so this is the only thing that makes a wrong outcome reconstructable later.
- Also included: MAC normalization for NIC rows the incus migration writes (these go straight to the datastore, so `MACAddress` never sees them and the alembic pass has already run by then), and removal of `middlewared/utils/usb.py`, which had no callers and was a second implementation of the old naming scheme.
This is the same fix already on the release line, retyped against `ServiceContext`: master's `migrate.py` has no `ContainerService`, `migrate_devices` takes a `ContainerEntry` rather than a dict, and the udev scan is threaded down through `to_thread`/`run_coroutine` instead of `middleware.call`.
Limit HTTP response line length
Reject status, header, proxy, and chunk-size lines larger than 64 KiB.
A network peer could previously grow the line buffer without bound.
This happens before package validation, letting an HTTP mirror or active
network attacker exhaust memory in the privileged pkg process.
Revert "[SLP]Extend GEP pointer-chain cost to casts and non-root external uses" (#217546)
Reverts llvm/llvm-project#216520 as it is causing regressing in one of
the SPEC'26 benchmark.
Create URL package downloads exclusively
Direct URL installs used predictable paths in TMPDIR without exclusive
creation. A local user could pre-create a symlink to an attacker-controlled
package, which a privileged pkg invocation could then install.
Create the download file with mkstemp in both direct URL paths. This gives
the invoking user an exclusive, non-symlink pathname before pkg_fetch_file
opens it.
Harden DNS SRV response handling
Validate DNS question and record boundaries before consuming fields.
Malformed SRV replies can otherwise read past the fixed response buffer.
Also replace the priority-group weighting loop with bounded weighted
selection. The prior subrange allocation was indexed from zero and
allowed a DNS reply with multiple priority groups to overwrite heap
memory in the privileged pkg process.
www/pomerium-envoy-custom: Attempt to fix LuaJIT build on aarch64
On FreeBSD aarch64, Bazel resolves the CPU constraint to its canonical
name @platforms//cpu:aarch64 rather than the @platforms//cpu:arm64
alias. Add aarch64 to the HOST_CONSTRAINTS check in luajit.bzl so
the platform is correctly detected on arm64 FreeBSD.
[Clang][NFC] DeducedTemplateSpecializationType can't actually be null. (#217462)
There are two issues here
- DeducedTemplateSpecializationType's template name is never actualy
null so trying to handling a null case is unecessary.
- The serialization of a null template name would not actually work as
getKind() expect a non-null storage.
We could arguably specialize DataStreamBasicWriter::writeOptional for
TemplateName however no one would use that code, so it still would leave
us with some dead code.
