Force ACL application on app-owned ix-volume paths
## Problem
The served schema hides `force` for ix-volumes and defaults it to true, but clients submit an explicit false and middleware honours it, so applying an ACL fails with `path contains existing data` as soon as the app has written to its own volume. Once that false is persisted, validation rejects the config before normalization can correct it.
The bad value comes from the UI, which honours `hidden` only on the field carrying it: for an ix-volume the whole `options` block is hidden, so the form still builds a `force` control, seeds it with its own boolean default of false rather than the schema's true, and submits that for a system managed dataset.
## Solution
ix-volumes are system managed, so anything in them is ours - confirmed with Stavros that `force` should always be true for them when an ACL is wanted.
`normalize_ix_volume` stamps `force` to true in place once it has computed the volume's host path, gated on a containment check since `dataset_name` is not validated as a path anywhere. `validate_acl_entries` skips its existing-data probe for anything under `/mnt/.ix-apps/app_mounts` - that tree is ours, and `filesystem.add_to_acl` still refuses an unforced apply over a populated path.
Host path ACLs keep their guard and their false default. The cost is that a host path typed under `app_mounts` now fails from `add_to_acl` rather than validation, so it fails later, after `update_volumes` has created datasets and any sibling ACLs have been applied.
Merge tag 'scftorture.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux
Pull smp_call_function() torture-test updates from Paul McKenney:
- Count single_rpc offline failures in statistics output
- Make invoker threads actually wait for all threads to start
* tag 'scftorture.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:
scftorture: Make invoker threads actually wait for all threads to start
scftorture: Count single_rpc offline failures in statistics output
Force ACL application on app-owned ix-volume paths
## Problem
Enabling an ACL on an ix-volume of an installed app fails with `path contains existing data and 'force' was not specified`. The served schema hides the `force` flag for ix-volumes and defaults it to true, but clients can still submit an explicit false, and middleware then faithfully applies it - so the guard trips as soon as the app has written anything into its own volume, which is almost immediately after install. A false which has already been persisted is worse: on the next update validation rejects the config before normalization ever gets a chance to correct it.
## Solution
**Normalization** - `normalize_ix_volume` stamps `force` to true right after it computes the volume's host path, in place, so the dict which gets written back to the app config agrees with the ACL which was actually applied and a stored false heals itself. Doing it there rather than in `normalize_acl` matters twice over: `normalize_acl` is also reached by `host_path_config.acl`, which must keep its data-loss guard, and for volumes whose `acl_entries` carries its own `normalize/acl` ref the child is normalized while descending, before the parent has re-pointed the path - a decision taken then would outlive the re-point. `dataset_name` is not validated as a path anywhere, so the new `is_app_volume_path` containment check is what stops an absolute or `..`-laden one from steering the clamp onto somebody else's data.
**Validation** - `validate_acl_entries` runs before normalization, so a persisted false is rejected before the clamp can heal it. It now skips the existing-data probe for any path under `/mnt/.ix-apps/app_mounts`. That whole tree is created and owned by middleware, so whether it holds data is not middleware's call to refuse a save over, and skipping only drops a pre-flight message - `filesystem.add_to_acl` still refuses an unforced apply over a populated path, and `force` is written in exactly one place, the clamp above, which only ever sets it for the requesting app's own volume. Keying the skip on the shared root rather than on the requesting app keeps it to four lines with no plumbing: no flag threaded through `validate_question`, and no app name threaded into three validators two of which would ignore it.
The exemption is deliberately broader than the requesting app, and it costs one degraded error path plus a widening of an existing partial-apply hazard. A user who sets a storage entry to host path, types a path under `/mnt/.ix-apps/app_mounts`, enables the ACL and leaves force unchecked now gets a late unscoped `Failed to apply ACLs to the following paths` instead of a field-scoped validation error. Failing at `add_to_acl` rather than at validation also means `update_volumes` has already created the ix-volume datasets, and in a multi-ACL config `core.bulk` applies the other ACLs before collecting the failure - so some ACLs land while the config edit rolls back. Both routes still reject, and no ACL is ever applied outside the requesting app's own volume, because the clamp stays app-scoped.
[Mips] Mark immediate branch macros as having delay slots (#217565)
Immediate conditional branch macros expand to real branches with delay
slots, but their pseudo-instruction definitions did not carry
`hasDelaySlot`. Mark them consistently with the register forms so IAS
inserts a delay-slot `nop` under `.set reorder`.
Adds `llvm/test/MC/Mips/macro-bcc-imm-delay-slot.s` covering reordered
and non-reordered expansion.
Fixes #217368
www/qt5-webengine: Fix build on -CURRENT
clang on CURRENT invokes ld.lld, which does not search LOCALBASE.
GN host tools such as character_data_generator then fail with
"unable to find library -levent".
Add USES=localbase:ldflags and LIBRARY_PATH so the host linker
can find ports libraries without relying on GNU ld following the
chromium and qt6-webengine patterns.
Approved by: blanket
libusb: Validate arguments before dereferencing the hotplug context
libusb_hotplug_register_callback() resolves its context with
GET_CONTEXT() and then immediately reads ctx->no_discovery and
ctx->usb_event_mode, but only checks "ctx == NULL" afterwards.
GET_CONTEXT() falls back to usbi_default_context, which is NULL before
libusb_init() and is reset to NULL by libusb_exit(). An application
that calls libusb_hotplug_register_callback(NULL, ...) without an
initialised default context therefore crashes on the ctx->no_discovery
read, instead of getting the LIBUSB_ERROR_INVALID_PARAM the existing
guard was clearly written to return.
Move the argument validation ahead of the first dereference. None of
the validated arguments depend on the context, so no other ordering
constraint is affected.
Signed-off-by: yuvrajnode <yuvrajsinghrock1221 at gmail.com>
Reviewed by: aokblast
[3 lines not shown]
libusb: Fix NULL dereference when a hotplug callback deregisters itself
libusb_hotplug_register_callback() runs the newly registered callback
over the already-enumerated device list when LIBUSB_HOTPLUG_ENUMERATE
is set. A hotplug callback returning non-zero means "deregister me",
and the enumerate loop honours that by freeing the handle and setting
it to NULL.
Since commit 6bda9f26d2ed changed libusb_hotplug_callback_handle from a
pointer to an int, the tail of the function unconditionally dereferences
that handle, so any caller that passes LIBUSB_HOTPLUG_ENUMERATE, a
non-NULL handle pointer, and a callback that returns non-zero on a
matching device crashes inside libusb. This is a normal usage pattern
and it was safe before the conversion, when the equivalent line simply
stored NULL.
Report the reserved id 0 instead. The allocator hands out ids starting
at 1, and libusb_hotplug_deregister_callback() already ignores 0, so
this restores the pre-conversion behaviour.
[6 lines not shown]
[DAG] Remove trivial VP SDNodes. NFC (#217866)
This removes the codegen parts of the trivial VP intrinsics. It's quite
far reaching, but the general categories of code removed are:
- Removing definitions from VPIntrinsics.def
- Legalization and expansion code
- MatchContext used to match over both VP and non-VP nodes
- Some dead DAGCombines and folds in SelectionDAGBuilder
There are still more things to be cleaned up after this, e.g. removing
more of the VPIntrinsic class hierarchy, removing
ExpandVectorPredication/moving expansion into other places, removing
MatchContext from SDPatternMatch
Merge tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux
Pull RCU updates from Paul McKenney:
"Make expedited grace periods expedite normal RCU callbacks
Miscellaneous fixes:
- Improve diagnostic output with character task states
- Mark accesses to inform KCSAN of concurrency design
- Move from kmalloc() to kmalloc_obj()
- Documentation updates
- Improve handling of RCU deferred quiescent states
- Clean up unused function arguments and structure fields
- Reduce show_rcu_gp_kthreads() stack space
Tasks RCU updates:
- Clean up after SRCU re-implementation of Tasks Trace RCU
- Mark accesses to inform KCSAN of concurrency design
- Add ->lazy_timer status to diagnostic output
- Remove an unnecessary memory barrier
[44 lines not shown]
ixl: Make VF reset resource reconstruction fallible
Treat each stage of VF reset and VSI reconstruction as fallible. Keep
the VF out of VFACTIVE when PCIe drain, reset completion, VSI
release, or VSI allocation fails, following the DPDK PF reset model.
Propagate initial reset failures back through pci_iov_vf_add and unwind
the VF queue allocation.
Free the old software filter list before initializing a replacement VSI.
ixl_init_filters() previously replaced the list head without freeing its
entries, so every VF FLR leaked all MAC and VLAN filter objects. Reset
the associated counters and VLAN bitmap with the list.
Avoid allocating an initial VSI only to destroy it during the required
initial VF reset, and remove redundant broadcast/filter programming from
VSI setup. Also delete a partially created VSI when later Admin Queue
setup fails.
(cherry picked from commit ee52b925fa08158e510d5dddfd1c8fa26f120575)
www/osrm-backend: Fix build: 'deadline_timer' is deprecated: Use system_timer
In file included from /wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/src/tools/r
outed.cpp:1:
In file included from /wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/include/ser
ver/server.hpp:4:
/wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/include/server/connection.hpp:53:
18: error: 'deadline_timer' is deprecated: Use system_timer [-Werror,-Wdeprecated-declarations]
53 | boost::asio::deadline_timer timer;
| ^
/usr/local/include/boost/asio/deadline_timer.hpp:36:1: note: 'deadline_timer' has been explicitly marked deprecated here
36 | BOOST_ASIO_DEPRECATED_MSG("Use system_timer")
| ^
/usr/local/include/boost/asio/detail/config.hpp:1484:47: note: expanded from macro 'BOOST_ASIO_DEPRECATED_MSG'
1484 | # define BOOST_ASIO_DEPRECATED_MSG(msg) [[deprecated(msg)]]
| ^
1 error generated.
- Add -Wno-deprecated-declarations to the CXXFLAGS.
[7 lines not shown]
ixl: Validate VF virtchnl configuration
Bound variable-length virtchnl messages before computing their expected
length, following the newer Intel virtchnl implementation.
Validate VF ring sizes and alignments before programming HMC contexts.
DPDK uses 128-byte ring alignment and 64 through 8160 descriptors;
the virtchnl ABI further specifies TX multiples of 8 and RX multiples
of 32. Preserve the 4096-descriptor limit on X722.
Validate queue bitmaps before changing any rings, validate all queue
and interrupt contexts before applying a request, and reject invalid
RSS table entries. Also avoid sending an ACK after VLAN-strip setup
fails and reply to delete-VLAN errors with the correct opcode.
These checks prevent malformed or oversized requests from an untrusted
VF from partially programming resources outside its allocation.
(cherry picked from commit e779914354db5cb3a20f4ec894d08b0f81d05ba2)
ixl: Initialize VF sysctl contexts before use
The VF array is zeroed at allocation, but its sysctl contexts were
only populated after each VF was successfully added. If VF setup
failed, IOV teardown still passed every requested VF context to
sysctl_ctx_free(). An untouched context is not an initialized empty
TAILQ and caused a page fault during teardown.
Initialize every VF context with the array so both successful setup
and partial-failure cleanup have a valid lifetime.
(cherry picked from commit ae122c5443882ae4d3d19aacfcfd16a2c8d7b688)
iavf: Honor iflib transmit completion batching
iavf uses descriptor writeback by default. Hardware writes completion
status into a transmit descriptor only when it completes a descriptor
marked RS. iavf marked every packet RS even though its report-status
queue recorded and inspected only descriptors selected by iflib. The
other completion writes could not help reclaim descriptors.
iflib marks selected packets with IPI_TX_INTR as completion
checkpoints. It forces a checkpoint as deferred work or ring pressure
grows. Retain EOP on every packet, but set RS only at those
checkpoints.
The deprecated head-writeback option on 700-series VFs gets the same
batching: each RS checkpoint permits hardware to publish the completed
ring head.
DPDK uses the same sparse RS design. Let iflib choose the adaptive
interval for FreeBSD. This is a PCIe/memory bandwidth savings.
[2 lines not shown]
ixl: Honor iflib transmit completion batching
ixl uses head writeback by default. Hardware publishes the transmit
ring head through DMA only after completing a descriptor marked RS.
Marking every packet requested much more frequent head updates than
iflib needs to reclaim descriptors.
iflib marks selected packets with IPI_TX_INTR as completion
checkpoints. It forces a checkpoint as deferred work or ring pressure
grows. Retain EOP on every packet, but set RS only at those
checkpoints. This batches head writebacks while preserving bounded
descriptor reclamation.
The optional descriptor writeback mode benefits as well. ixl already
recorded only IPI_TX_INTR descriptors in its report-status queue, so
status written for every other packet was not inspected.
DPDK uses the same sparse RS design. Let iflib choose the adaptive
interval for FreeBSD. This is a PCIe/memory bandwidth savings.
[2 lines not shown]
iavf: Recover when PF communication is unavailable
A PF reset or loss of virtchnl service can make visible interface
initialization wait up to ten seconds and then return from the void
ifdi_init callback. Iflib consequently marks the interface running even
though its queues were not initialized, and no retry is scheduled when
the PF returns.
Check reset readiness without polling during reinitialization, propagate
queue-message submission errors, and bound a silent enable or disable to
one mailbox timeout. Report unsuccessful initialization to iflib and
publish link-down state without polling the stopped mailbox.
A VFLR also discards the Admin Queue and permits the PF to replace the
VF VSI. Track when full virtchnl rediscovery is required, renegotiate the
API version, refresh and validate the VF resources before using a cached
VSI ID, and replay the MAC and VLAN filters cleared by reset. Bound each
runtime discovery attempt while preserving the existing attach-time wait.
[5 lines not shown]
e1000: Correct 82542 flow-control mode handling
The 82542-specific setup routine unconditionally reads the NVM
default, overwriting a flow-control mode selected by software. It
also removes transmit PAUSE support from all 82542 revisions even
though the hardware restriction applies only to rev 2.0.
Resolve the NVM default only when requested, scope the transmit
restriction to rev 2.0, and replace integer bit masking of the enum
with explicit valid mode transitions. This restores the behavior
from before the Intel shared-code split and resolves -Wassign-enum.
Reported by: glebius
(cherry picked from commit 2f1d9ab96214db2ec6ce30c44b55a89a7eaa8f6a)
ice: Report initialization failures to iflib
The primary and mirror-VSI ifdi_init callbacks can return early when
reset state or hardware queue and filter setup prevents initialization.
Iflib then marks the interface running and enables interrupts although
the driver did not finish bringing it up.
Report each non-detach failure through iflib_init_failed(). Keep the
existing ice reset and subinterface-reinitialization machinery
responsible for scheduling recovery.
(cherry picked from commit dcdc00a41d3e4be0e75eb625cd3a23d5a927ed15)
bnxt: Report initialization failures to iflib
HWRM failures currently return from the void ifdi_init callback.
iflib then marks the interface running and enables interrupts despite an
incomplete ring or VNIC setup.
Move the hardware setup into an error-returning helper. The ifdi_init
wrapper can report failure through iflib_init_failed(), while firmware
recovery can propagate the same error through bnxt_open(). Also clear
the initialized state after partial setup is torn down.
(cherry picked from commit cb0e8f5fb6de03428137c096b1c8b62710829029)
ixgbe: Enable PF RSS across queues with SR-IOV
PSRTYPE is indexed by pool in VMDq+RSS mode, and its RQPL
field selects the number of receive queues available within the pool.
The PF occupies the last pool, but the driver programmed pool zero and
left the PF RQPL value at zero. As a result, all PF receive traffic
was directed to its first queue while SR-IOV was enabled.
Program PSRTYPE for the PF pool and encode its allocated receive queue
count.
(cherry picked from commit 49f9143d9a37a4646c9f4ddac53b97dde04e3fa3)
ixv: Recover when the PF mailbox is unavailable
A failed VF reset or mailbox API negotiation currently returns from
the void ifdi_init callback. Iflib then marks the interface running
even though ixv left its adapter stopped. Stopped media queries can
continue polling the PF, and no timer remains active to retry when the
PF returns.
Track mailbox readiness and report unsuccessful initialization to
iflib. Stopped admin and media-status passes now publish cached
link-down state without touching the mailbox. While the VF remains
administratively up, retry complete initialization after 250 ms, one
second, four seconds, and then at a capped eight-second interval.
Preserve the requested MAC across reset, then program it once after
mailbox API negotiation. The previous two pre-reset requests each
could wait a full mailbox timeout after an established PF disappeared,
holding the iflib context lock for about two seconds before the reset
handshake.
[8 lines not shown]
www/osrm-backend: Fix build: 'deadline_timer' is deprecated: Use system_timer
In file included from /wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/src/tools/r
outed.cpp:1:
In file included from /wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/include/ser
ver/server.hpp:4:
/wrkdirs/usr/ports/www/osrm-backend/work/osrm-backend-0ae940c31566df2aec0ecd679c84c11ede9831ef/include/server/connection.hpp:53:
18: error: 'deadline_timer' is deprecated: Use system_timer [-Werror,-Wdeprecated-declarations]
53 | boost::asio::deadline_timer timer;
| ^
/usr/local/include/boost/asio/deadline_timer.hpp:36:1: note: 'deadline_timer' has been explicitly marked deprecated here
36 | BOOST_ASIO_DEPRECATED_MSG("Use system_timer")
| ^
/usr/local/include/boost/asio/detail/config.hpp:1484:47: note: expanded from macro 'BOOST_ASIO_DEPRECATED_MSG'
1484 | # define BOOST_ASIO_DEPRECATED_MSG(msg) [[deprecated(msg)]]
| ^
1 error generated.
- Add -Wno-deprecated-declarations to the CXXFLAGS.
[5 lines not shown]
ixgbe: Recognize production X550 PHY IDs
According to Linux 5f1c3589b0f0, the X550 PHY classifier still matches
an alpha silicon ID, while the shared definitions contain the two
production IDs. This can leave production hardware on the generic
probing path and issue unnecessary PHY queries.
(cherry picked from commit 392f0af6685a06e89fecdc38cc2e910d2b84d738)
ixgbe: Preserve the full VF RSS domain in the shared RETA
The 82599 and X540 share the global RSS redirection table between the
PF and its VFs. Programming that table from the PF queue count
prevents a VF from using queue indices absent from the PF layout. A
one-queue PF consequently directs every flow for a two- or four-queue
VF to queue zero.
Program at least four queue indices while SR-IOV is active. Each pool
PSRTYPE.RQPL field masks the shared table to the queue subset available
to that function, so the PF can continue using fewer queues.
(cherry picked from commit 8b668bc7e7c8b0a1bcb018360a4aafa445ff554f)
ixgbe: Add 10GBase-BX BiDi SFP+ module support
10G-BX optics use paired wavelengths to carry 10 Gb/s Ethernet over a
single strand of single-mode fiber. Their 10G compliance byte is
empty, so identify them from the SFF-8472 nominal signaling rate and
single-mode reach fields.
When an EEPROM also advertises 1G BASE-BX10, give the complete 10G
bitrate and reach signature precedence. Otherwise retain FreeBSD's
permissive 1G-BX identification rather than requiring a nominal
1.3 GBd rate.
Relnotes: yes
(cherry picked from commit f9ce33b0d8ef233063bd6c27bdba2580f97d9094)
net: Add ifmedia support for 10GBase-BX BiDi
10GBase-BX uses paired wavelengths to carry both directions over a
single strand of single-mode fiber. The optics must be paired so that
the transmit and receive wavelengths cross over.
(cherry picked from commit 4220b52453c9701922955dcc1c1e1554d6a9f3ae)
