FreeBSD/src cf4ff7b — sys/amd64/amd64 genassym.c exception.S, sys/cddl/dev/dtrace/amd64 dtrace_asm.S

amd64 FRED: fix dtrace fbt

- jump to dtrace_invop_jump_addr on kernel #BP
- use ERETS instead of IRETQ when done

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+12-6sys/cddl/dev/dtrace/amd64/dtrace_asm.S
+12-0sys/amd64/amd64/exception.S
+4-0sys/amd64/amd64/genassym.c
+28-63 files

FreeBSD/src bf074ee — sys/amd64/amd64 trap.c

amd64 FRED: fix handling of ATPIC IRQ range when no atpic is configured

Do not fall back to lapic_handle_intr().  Ignore the interrupt from the
range same as it is done by apic_vector.S:spuriousint.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+4-4sys/amd64/amd64/trap.c
+4-41 files

FreeBSD/src 7f49a62 — sys/amd64/amd64 trap.c

amd64: add helpers to set up thread state on trap

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+17-8sys/amd64/amd64/trap.c
+17-81 files

FreeBSD/src 32b9c96 — sys/amd64/amd64 trap.c

amd64 FRED: handle INT 3, INT 4, and INT 0x92 same as for IDT

Userspace INT {3, 4, 0x92} have DPL 3 gate in IDT, so enable them for
FRED as well, matching the IDT action.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+16-0sys/amd64/amd64/trap.c
+16-01 files

FreeBSD/src 0213bd5 — sys/amd64/amd64 trap.c

amd64 FRED: re-wrap the comment

Fixes:  837bb27c93a5 ("amd64 FRED: clear %dr6 on #DB from kernel")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+3-3sys/amd64/amd64/trap.c
+3-31 files

NetBSD/src MCS4nNn — lib/libc/stdio vfwscanf.c

   PR lib/60885 - fix wscanf(3) conversion of multi-byte decimal point

   This alters the way that the decimal point character in the locale
   data is converted before processing float (all sizes) data fields.

   This is a much simpler change to that for scanf(3), as the decimal
   point (radix character) remains a single (wchar_t) character, and is
   processed as such.  All that is needed for wscanf() is to properly
   convert the value from the locale data to a wchar_t.

   No pullups planned, no NetBSD release contains any locales with
   multi-byte LC_NUMERIC decimal points (or LC_MONETARY either, though
   that would be irrelevant to scanf) so there is no point adding the
   code to deal with something that doesn't exist there.
VersionDeltaFile
1.14+9-3lib/libc/stdio/vfwscanf.c
+9-31 files

NetBSD/src V22OCSM — lib/libc/stdio vfscanf.c

   PR lib/60885 - fix scanf(3) handling of multi-byte decimal point

   This alters the way that the decimal point character is scanned
   when processing float (all sizes) data fields.

   A new state is added to the state machine to handle moving through
   the bytes that make up the decimal point - entered only when there
   is more than one such byte.

   No pullups planned, no NetBSD release contains any locales with
   multi-byte LC_NUMERIC decimal points (or LC_MONETARY either, though
   that would be irrelevant to scanf) so there is no point adding the
   code to deal with something that doesn't exist there.
VersionDeltaFile
1.48+20-5lib/libc/stdio/vfscanf.c
+20-51 files

NetBSD/src nzjL4I1 — lib/libc/stdio vfwprintf.c

   PR lib/60886 - fix weird printf(3) grouping for specific integer values

   See the PR for the details - the bug is so bizarre, and impossible to
   trigger with any real locale, that new ones needed to be invented to
   expose it.   This fixes that bug.

   Since this issue cannot be observed with any real world locale, and
   no locale in any released version of NetBSD has settings which would
   allow the bug to manifest, no pullups for this are planned.
VersionDeltaFile
1.44+15-12lib/libc/stdio/vfwprintf.c
+15-121 files

FreeBSD/ports 898db49 — security/vuxml/vuln 2026.xml

security/vuxml: fix markup of p5-MIME-Tools entry

This fixes "make validate".

Fixes:          3b5083083a26 ("security/vuxml: Document p5-MIME-Tools multiple vulnerabilities")
Pointy hat to:  rodrigo
DeltaFile
+14-14security/vuxml/vuln/2026.xml
+14-141 files

FreeBSD/ports e48cf66 — security/vuxml/vuln 2026.xml

security/vuxml: fix markup of p5-HTTP-Body entry

This fixes "make validate".

Fixes:          12a9b03253a4 ("security/vuxml: Document p5-HTTP-Body multiple vulnerabilities")
Pointy hat to:  rodrigo
DeltaFile
+26-26security/vuxml/vuln/2026.xml
+26-261 files

FreeBSD/ports 333ff2d — security/vuxml/vuln 2026.xml

security/vuxml: fix markup of p5-Starman entry

This fixes "make validate".

Fixes:          fa646dcabec6 ("security/vuxml: Document p5-Starman multiple vulnerabilities")
Pointy hat to:  rodrigo
DeltaFile
+16-16security/vuxml/vuln/2026.xml
+16-161 files

FreeBSD/ports 3f9a5d9 — security/vuxml/vuln 2026.xml

security/vuxml: fix markup of p5-Plack entry

This fixes "make validate".

Fixes:          5fedc982d45b ("security/vuxml: Document p5-Plack memory allocation vulnerability")
Pointy hat to:  rodrigo
DeltaFile
+1-1security/vuxml/vuln/2026.xml
+1-11 files

FreeBSD/ports 6e4f29e — security/vuxml/vuln 2026.xml

security/vuxml: fix markup of p5-GD entry

This fixes "make validate" and the vuxml build.

Fixes:          f5bd9f0e379f ("security/vuxml: Document p5-GD security issues")
Pointy hat to:  rodrigo
DeltaFile
+2-2security/vuxml/vuln/2026.xml
+2-21 files

FreeBSD/ports a794a82 — devel/gitlab-runner Makefile distinfo

devel/gitlab-runner: update to 19.5.2

Changes:        https://gitlab.com/gitlab-org/gitlab-runner/blob/main/CHANGELOG.md
DeltaFile
+9-9devel/gitlab-runner/distinfo
+1-1devel/gitlab-runner/Makefile
+10-102 files

LLVM/project 93d4812 — llvm/lib/Transforms/Vectorize VPlanTransforms.cpp VPlan.cpp, llvm/test/Transforms/LoopVectorize/VPlan first-order-recurrence-sink-replicate-region.ll vplan-sink-scalars-and-merge.ll

[VPlan] Compute the backedge-taken count with an explicit recipe. (#236655)

Instead of a symbolic VPValue for the backedge-taken count, which is
materialized after dissolving the loop regions, compute TC - 1 directly
in the vector preheader when creating the header mask that compares
against it, together with an explicit broadcast.

This removes VPlan::BackedgeTakenCount (VPlan)global state.
DeltaFile
+69-37llvm/test/Transforms/LoopVectorize/VPlan/vplan-printing-reductions-tail-folded.ll
+48-28llvm/test/Transforms/LoopVectorize/VPlan/vplan-sink-scalars-and-merge.ll
+21-9llvm/test/Transforms/LoopVectorize/VPlan/first-order-recurrence-sink-replicate-region.ll
+11-18llvm/lib/Transforms/Vectorize/VPlanLowering.cpp
+1-17llvm/lib/Transforms/Vectorize/VPlan.cpp
+10-7llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+160-11613 files not shown
+198-16119 files

LLVM/project 6a9fc66 — llvm/lib/Target/Sparc DelaySlotFiller.cpp, llvm/test/CodeGen/SPARC LeonInsertNOPLoadPassUT.ll tailcall.ll

[SPARC] Do not fill delay slots at -O0 (#235248)

At -O0 the delay slot filler still moves the instruction before a call
into its delay slot, and at -O0 that's typically the spill of an
argument. A breakpoint on the line of the call stops on the `call`
before the store has run, so the debugger reads stale stack. GCC only
fills delay slots from -O1, and the Mips filler skips -O0 as well.

This skips the optional fill, and the restore folding, at -O0. 

Two fills are needed for correctness and are kept at every level: the
restore before a tail call has to be in its delay slot (a jmp %reg reads
its target from the current window, a call writes %o7), and so does the
mov %g1, %o7 before a leaf tail call.

Until now only the optional search put them there, so
`-disable-sparc-delay-filler` produced leaf tail calls that returned
into the next function.


    [33 lines not shown]
DeltaFile
+114-45llvm/test/CodeGen/SPARC/fp16-promote.ll
+100-50llvm/test/CodeGen/SPARC/2011-01-19-DelaySlot.ll
+111-0llvm/test/CodeGen/SPARC/tailcall.ll
+36-5llvm/lib/Target/Sparc/DelaySlotFiller.cpp
+2-1llvm/test/CodeGen/SPARC/LeonInsertNOPLoadPassUT.ll
+363-1015 files

LLVM/project 46551a6 — flang/test/Semantics modfile-explicit-shape-bounds.f90, llvm/test/CodeGen/AArch64 sve-fixed-length-masked-expandloads.ll

Merge branch 'main' into users/gandhi56/regalloc-cache-failed-reassign
DeltaFile
+4,101-4,285llvm/test/CodeGen/AArch64/sve-fixed-length-masked-expandloads.ll
+981-2,174llvm/test/CodeGen/AMDGPU/load-global-i8.ll
+479-1,254llvm/test/CodeGen/AMDGPU/kernel-args.ll
+481-1,089llvm/test/CodeGen/AMDGPU/load-constant-i8.ll
+1,013-90llvm/test/CodeGen/AMDGPU/insert_vector_dynelt.ll
+939-0flang/test/Semantics/modfile-explicit-shape-bounds.f90
+7,994-8,892739 files not shown
+33,102-16,085745 files

LLVM/project 490c5ff — llvm/lib/Transforms/Scalar LoopUnrollPass.cpp

[LoopUnroll] Use DenseMap::contains instead of count (NFC) (#224529)

Replace count()-then-lookup style membership checks with contains() in
analyzeLoopUnrollCost for readability.
DeltaFile
+3-3llvm/lib/Transforms/Scalar/LoopUnrollPass.cpp
+3-31 files

FreeBSD/src 0fdb7f3 — sys/net iflib.c

iflib: Use private lifecycle state for control work

Use the context-locked datapath state for netmap initialization results,
resume completion and administrative work eligibility.  Keep stopped
and failed interfaces eligible for link and mailbox recovery without
using IFF_DRV_OACTIVE as an implicit indication that initialization has
been attempted.  Evaluate media and deferred admin eligibility under
the context lock rather than from an earlier IFF_DRV_ flag snapshot.

Always pass through iflib_stop() before an IOV-init callback which
changes the PF queue layout, as the IOV-uninit counterpart already does.
Neither administrative down nor a cleared IFF_DRV_RUNNING proves that
queue DMA is stopped.  The private lifecycle state decides whether the
hardware stop is necessary; IFF_UP only decides whether to initialize
again afterward.

Reviewed by:    iflib (gallatin)
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D59597

    [2 lines not shown]
DeltaFile
+27-24sys/net/iflib.c
+27-241 files

FreeBSD/src cc0a172 — share/man/man4 ixv.4, sys/dev/ixgbe ixgbe_hv_vf.h if_ixv.c

ixv: Use host granted RSS queues on Hyper-V

Discover the Hyper-V queue grant through PCI configuration space for
X550, X552, X553, and E610 VFs.  The X550 family exposes a byte at 0x207;
0x208 is a separate DCB flag.  E610 exposes a little-endian queue count
word at those offsets.  Accept grants of one, two, or four and use at most
two symmetric queue sets, subject to the existing MSI-X resource limit.
Keep one queue for invalid grants and for 82599/X540 Hyper-V VFs.

The family gates and queue limits are snooped from Windows Intel VF bus
traffic.

Update the shared code queue max so stop disables every usable queue.
Also program the receive length limit on every usable RX queue instead
of only queue zero and retain the 82599 exception for that register field.

Sponsored by:   BBOX.io

(cherry picked from commit a54f83544eea2a9804ac7940d35b26ffcb34dfb3)
DeltaFile
+48-6sys/dev/ixgbe/ixgbe_hv_vf.c
+14-1share/man/man4/ixv.4
+1-1sys/dev/ixgbe/if_ixv.c
+1-0sys/dev/ixgbe/ixgbe_hv_vf.h
+64-84 files

FreeBSD/src 8e74a48 — share/man/man4 ixv.4, sys/dev/ixgbe if_ixv.c ixgbe_hv_vf.c

ixv: Recover E610 Hyper-V carrier without the PCI link query

Current Windows PF drivers do not emulate the E610 link-status query at
PCI configuration offset 0x209.  The installed Intel ixw 1.8.54.0 driver
returns zero even with the physical port connected, leaving the VF at
no carrier after an otherwise successful hn handoff.

When the query returns zero, use VFLINKS for carrier only.  Its speed
field is not the negotiated E610 line rate: the tested 1 Gb/s port
reports the default 10 Gb/s encoding.  Publish an unknown speed instead,
including in the verbose link-up diagnostic, and document this fallback.
Keep nonzero PCI results authoritative and reject all-ones reads.  Other
Hyper-V families and the native E610 mailbox path are unchanged.

A zero result cannot distinguish an unsupported query from a down link;
in either case this fallback relies on the legacy carrier indication.
The connected and disconnected ports reported VFLINKS.UP set and clear,
respectively, while both returned zero from the PCI query.


    [3 lines not shown]
DeltaFile
+17-0sys/dev/ixgbe/ixgbe_hv_vf.c
+7-3sys/dev/ixgbe/if_ixv.c
+4-1share/man/man4/ixv.4
+28-43 files

FreeBSD/src d8ede50 — share/man/man4 ixv.4, sys/dev/ixgbe ixgbe_osdep.h ixgbe_osdep.c

ixv: Add Hyper-V virtual function support

Hyper-V does not expose the normal Intel PF/VF mailbox.

Import the Hyper-V operation overrides from DPDK and complete its reset
callback with the configuration-space mechanism submitted by Microsoft.
Route ixv operations through the operation table, use mailbox API 1.0,
and limit this environment to one queue pair.

Claim the 82599, X540, X550, X550EM-X, and X550EM-A Hyper-V device IDs
listed by DPDK.  Select the same path for the E610 Hyper-V subdevice
identity defined there.

For E610/Linkville, read the emulated VFLINKS-format status from PCI
configuration space at offset 0x209.  Older families retain the MMIO
VFLINKS path.

Treat receive-mode changes as host-owned no-ops and do not retry VLAN
operations that Hyper-V permanently rejects.  Limit the Hyper-V 82599

    [15 lines not shown]
DeltaFile
+277-0sys/dev/ixgbe/ixgbe_hv_vf.c
+94-40sys/dev/ixgbe/if_ixv.c
+12-0sys/dev/ixgbe/ixgbe_hv_vf.h
+9-2share/man/man4/ixv.4
+7-1sys/dev/ixgbe/ixgbe_osdep.c
+4-0sys/dev/ixgbe/ixgbe_osdep.h
+403-432 files not shown
+406-438 files

FreeBSD/ports c410f00 — math/R-cran-Deriv Makefile distinfo

math/R-cran-Deriv: Update to 4.3.6

Reported by:    portscout
DeltaFile
+3-3math/R-cran-Deriv/distinfo
+1-1math/R-cran-Deriv/Makefile
+4-42 files

FreeBSD/src 88ad5d5 — contrib/hyperv/tools/scripts hyperv_vfup

hyperv: Configure IPv6 when setting up VF failover

The default VF-up script moves IPv4 configuration from the synthetic
interface to a failover lagg, but leaves IPv6 unconfigured on the lagg.
Adding the synthetic interface as a member can remove its IPv6 addresses,
so deleting the remaining member addresses is not sufficient.

Stop accepting router advertisements on the synthetic interface before
adding it to the lagg.  Leave its link-local address and IPv6 enable state
in place for lagg's address, prefix and default-router cleanup, then disable
IPv6 and explicitly remove any remaining addresses.  This also covers
members without a link-local address or with IPv6 already disabled.

Replay the synthetic interface's IPv6 rc.conf configuration on the lagg,
including aliases, prefix-derived addresses and legacy configuration names.
Remap the variables in a subshell and reuse network.subr's IPv6 helpers.
For SLAAC, solicit fresh router advertisements rather than copying learned
addresses as permanent ones.  Configure IPv6 independently of the IPv4
DHCP/static choice, and leave existing laggs alone on repeated invocation.

    [7 lines not shown]
DeltaFile
+75-5contrib/hyperv/tools/scripts/hyperv_vfup
+75-51 files

FreeBSD/src 1327d91 — contrib/hyperv/tools/scripts hyperv_vfup

hyperv: Bound IPv4 address removal when configuring VF failover

The VF-up script repeatedly deletes the first IPv4 address from hn until
ifconfig fails.  Netlink-based ifconfig returns success when no address
remains, so the script can loop forever and block subsequent devd work.

Use ipv4_down() from the already-sourced network.subr to enumerate the
addresses and delete each explicitly.  This also handles multiple
addresses without relying on the exit status of an empty deletion.  The
behavior depends on ifconfig, not the VF hardware, so no device-specific
fallback is needed.

Fixes:  c68595695679 ("hyperv: Add VF bringup scripts and devd rules.")
Sponsored by:   BBOX.io

(cherry picked from commit 90f7956ff61f537def0d0aeb6ee03605a671d57e)
DeltaFile
+2-8contrib/hyperv/tools/scripts/hyperv_vfup
+2-81 files

FreeBSD/src f6d7a06 — sys/dev/hyperv/netvsc if_hn.c, sys/net if_var.h if.c

hn: Invoke the owned VF's transmit queue flush callback

The generic if_qflush() only clears if_snd.  Calling it directly for a
transparent VF bypasses the driver's callback and its private software
transmit queues.  Add if_getqflushfn(), matching the existing callback
accessors, and invoke the registered callback while hn_vf_lock protects
the VF pointer.

Flush an attached VF whenever transparent mode owns it, not only while
the VF datapath is enabled.  Disabling transmit during handoff does not
discard packets already queued to the VF.  This also covers the inactive
interval after fallback.  Non-transparent VFs remain independently owned
and are not flushed by hn.  Synthetic queue flushing is unchanged.

Sponsored by:   BBOX.io

(cherry picked from commit 8e816fc2e98c8c0bf0b6fef3bd5f52bc03c843ce)
DeltaFile
+6-0sys/net/if.c
+3-2sys/dev/hyperv/netvsc/if_hn.c
+1-0sys/net/if_var.h
+10-23 files

FreeBSD/src 5441029 — sys/dev/hyperv/netvsc if_hn.c

hn: Serialize VF link events with datapath handoff

Hold hn_vf_lock across the VF identity/state check and link publication.
Otherwise an event can observe an enabled VF, pause during fallback, then
overwrite the freshly reported synthetic carrier with stale VF state.
Ignore events while switching or after the association generation changes.
The link notification only queues further work, so the callback does not
need the sleepable hn lock.

Document that association serial numbers are currently diagnostic:
hn_ismyvf() matches the VF by MAC, while notifications gate availability.

Sponsored by:   BBOX.io

(cherry picked from commit 6b3b1d6d4f43d1521e5e10b759e3542deaf23667)
DeltaFile
+8-1sys/dev/hyperv/netvsc/if_hn.c
+8-11 files

FreeBSD/src b0179ff — sys/dev/hyperv/netvsc hn_nvs.h if_hnreg.h

hn: Track VF association and wait for datapath switch completion

Handle the host's VF association notifications instead of ignoring them.
Require an allocated association before switching to the MAC-matched VF,
and track notification generations so a withdrawal during initialization
cannot enable an obsolete handoff.  Defer association and address-event
work to the VF taskqueue; the receive channel must remain available to
deliver switch completions.

Request and wait for the empty VMBus completion for SET_DATAPATH, checking
submission and channel-revocation failures.  Enable transparent VF
transmit and select its link status only after the switch completes.
Use the existing transaction lifetime and revocation handling, without a
timeout that could leave a late completion referencing a freed request.

Restore synthetic capabilities, TSO limits and hardware-assist flags on
fallback, targeting hn rather than the departing VF.  Block transparent
transmit during handoff and after association withdrawal.  Separate the
attach delay from saved-setting readiness, permit delayed association to

    [7 lines not shown]
DeltaFile
+242-93sys/dev/hyperv/netvsc/if_hn.c
+42-6sys/dev/hyperv/netvsc/hn_nvs.c
+9-1sys/dev/hyperv/netvsc/if_hnvar.h
+7-1sys/dev/hyperv/netvsc/if_hnreg.h
+1-1sys/dev/hyperv/netvsc/hn_nvs.h
+301-1025 files

FreeBSD/src f5f6479 — sys/dev/hyperv/pcib vmbus_pcib.c

hyperv: Stop bus relations handling from falling through to eject

The PCI_BUS_RELATIONS2 case lacks a break after queuing the reported
devices.  It consequently processes the same packet as PCI_EJECT,
interpreting device_count as the slot number.  If that value matches an
existing child, the callback schedules an unintended device eject.

End the relations case after processing the device list, matching the
original PCI_BUS_RELATIONS handling.

Fixes:  ea11861e434a ("arm64: Hyper-V: vPCI: Enabling v-PCI in FreeBSD in ARM64 Hyper-V")
Sponsored by:   BBOX.io

(cherry picked from commit ddcf8be82b0f17c767d2edab026a4f5cfa3d217e)
DeltaFile
+1-0sys/dev/hyperv/pcib/vmbus_pcib.c
+1-01 files

FreeBSD/src d3b1d2f — sys/dev/hyperv/netvsc if_hn.c

hn: Refresh VF offloads after bringing it up

VF readiness can precede its first initialization.  In particular,
iflib populates if_hwassist during init, so copying it while the VF is
still down can leave hn advertising checksum and TSO capabilities with
no hardware-assist flags.  The stack then uses software segmentation
until a capability ioctl happens to refresh the copied state.

Synchronize enabled capabilities and hardware-assist flags after the VF
up ioctl succeeds, before switching the datapath and enabling transparent
VF transmit.  Use the existing helper in the common initialization path,
covering both normal bring-up and delayed VF initialization.

Sponsored by:   BBOX.io

(cherry picked from commit 7c43b915de433bf7a9988faccd6e638f02e47fea)
DeltaFile
+6-0sys/dev/hyperv/netvsc/if_hn.c
+6-01 files