iavf: Honor PF-negotiated RSS sizes
Use the key and lookup table lengths returned by GET_VF_RESOURCES when
configuring RSS through virtchnl, as DPDK does. The Windows E835 PF
advertises a 40-byte key and rejects our fixed 52-byte CONFIG_RSS_KEY
request, leaving receive traffic on queue zero.
Validate the negotiated lengths before constructing AdminQ messages and
publish the lookup table size to iflib. Preserve register-mode RSS
selection and its fixed hardware sizes. Use aligned, zero initialized
key storage so an RSS kernel's 40-byte key does not leave an uninitialized
tail when the PF requests 52 bytes.
Validation: normal and RSS enabled iavf module builds passed. On an E835
VF under Hyper-V Server 2025, repeated IPv4 and IPv6 receive tests used all
three configured guest RX queues in both transparent hn and non-transparent
lagg modes. The RSS key rejection disappeared, IPv4 transmit tests passed,
and no TX watchdog fired. Each traffic case used three runs of 16 streams.
[3 lines not shown]
thunderbolt: Account for CRC in router config write message size
Fixes: 9c6e9bfb3474 ("thunderbolt: Support writing to router config space")
Sponsored by: The FreeBSD Foundation
hn: Forward capability changes to transparent VFs
The transparent VF capability handler ignored the requested change and
only copied the VF's enabled capabilities. Forward SIOCSIFCAP to the VF
and return its result. Preserve VF capabilities which hn does not expose.
Limit advertised capabilities to those supported by the transparent
packet path and VLAN relay. Do not inherit VF services such as send tags
or the extended capability ioctl when hn has no corresponding methods.
At handoff, adopt the VF's enabled offloads without reconfiguring it.
Mark the datapath as switching while the VF applies a capability change,
since its ioctl may reinitialize the device. If the association is still
ready and unchanged afterwards, synchronize hn with the actual VF state
even on error and restrict checksum assistance to the forwarded offloads.
Republish link state suppressed during the transition when the VF is
still ready. Refresh VLAN child capabilities after adoption and when
restoring the synthetic path.
[9 lines not shown]
hn: Relay VLAN membership to transparent VFs
VLANs configured on the synthetic interface do not otherwise reach the
accelerating VF's VLAN callbacks. Those callbacks can be needed for
hardware filter membership or for interpreting stripped VLAN tags, even
though no vlan interface is attached directly to the VF.
Subscribe to VLAN events only in transparent mode and schedule the
existing VF task. Snapshot the synthetic interface's VLAN topology under
network epoch, then leave epoch before invoking the VF callbacks, which
may sleep. Do not acquire hn_lock or configure the VF from a VLAN event
handler; the worker applies membership outside the VLAN configuration
lock.
Keep an applied-VID bitmap under hn_lock and relay only changes. Replay
VLANs configured before VF arrival, reconcile changes while acceleration
is active, and preserve membership across temporary datapath switches.
This relays guest intent; it does not configure host access VLAN policy
or overcome PF restrictions on tagged traffic.
[7 lines not shown]
ice: Use sleepable locks in shared code
The Intel shared code can wait for firmware resources while holding its
OS abstraction locks. FreeBSD mapped these locks to mutexes, which
cannot be held across a voluntary sleep. Concurrent PF rebuilds
therefore trigger WITNESS when RSS profile updates contend for the
firmware change lock.
Map the shared-code lock abstraction to exclusive sx locks. This also
covers tunnel and flow-profile operations which can reach the same
firmware wait while serialized.
Validated with WITNESS on a dual port Intel E835. Sixteen CORE resets
rebuilt both PFs without lock warnings, reset failures, or watchdogs.
Ten interface down/up cycles and twenty promiscuous-filter cycles also
completed cleanly.
Reviewed by: erj
MFC after: 2 weeks
[2 lines not shown]
rsa_pmeth: also copy saltlen and min_saltlen for RSA-PSS
EVP_PKEY_CTX_dup() failed to copy saltlen and min_saltlen for RSA-PSS and
would therefore use the defaults for the copied context, losing intended
restrictions from the original.
From Frank Denis
[AMDGPU] Form VOPD3 pairs with pair-local literal moves
This PR lets GCNCreateVOPD form a VOPD3 pair when its components use one
distinct non-inline constant. VOPD3 cannot encode literal operands, but src0
can read scalar registers, so we move the value to a free SGPR. If both
components use the same value, one move serves both.
We reject pairs that need two values because two moves add more instructions
than one fusion removes. We also reject functions without tracked liveness and
functions optimized for size.
We use one reverse liveness walk to find an SGPR that is free over each
pair-local range. We exclude reserved registers and VCC. Disjoint selected
pairs can reuse the same SGPR, and each accepted pair adds at most one
S_MOV_B32 for the one instruction removed by fusion.
When overlapping candidates form the same number of pairs, we prefer the set
that needs fewer scalar moves. We keep pair count as the primary objective.
[2 lines not shown]
[NFC][AMDGPU] Separate VOPD candidate selection
This PR separates VOPD candidate matching from selection without changing
generated code.
GCNCreateVOPD used to choose a pair as soon as tryMatchVOPDPair found one.
That made matching and selection one operation: the first match consumed both
instructions before later work could decide whether the pair was usable.
We now record matches in program order, collect every adjacent candidate, and
select the same greedy non-overlapping set in a separate step.
This gives later changes a place to reject or rank a candidate without hiding
an overlapping pair that uses its second instruction.
libextractor: update to 1.15.
Security fix release.
Fix pkglint.
Add test arget.
Mon Jun 29 07:58:39 PM CEST 2026
Fix potential 4 MB on-stack memory allocation that could
result in a stack-based buffer overflow in the OLE2 extractor.
Thanks to Haitam Lazaar for reporting.
Releasing GNU libextractor 1.15. -CG
Mon May 25 12:43:20 PM CEST 2026
Revive REAL plugin (fixes #2518).
Revive VLC plugin (fixes #2075).
Fix issues in ELF plugin (fixes #8514).
Fix issues in HTML plugin (fixes #8620).
Fix issues in EXIV2 plugin (fixes #8513, #9223).
Revive Applefile plugin (fixes #2517).
[3 lines not shown]
get_crl_score: delta CRLs should not be used as full CRLs
The glorious OpenSSL invention called CRL score is backed by muppety code
that is an obvious bug magnet. If extended CRL support is enabled and the
delta CRL has onlySomeReasons, the logic that is supposed to reject delta
certs is not reached. Fix this by pulling it up.
Reported by Frank Denis and Acts1631.
ok kenjiro
[bazel][libc][test] Allow LLVM-libc tests to be run in full-build mode (#219262)
This PR makes the required changes to run LLVM-libc full build tests in
Bazel. After this PR, most tests pass:
```
bazel test @llvm-project//libc/test/... --config=ci --@llvm-project//libc:build_mode=full --keep_going
Executed 760 out of 970 tests: 760 tests pass and 210 fail to build.
```
Follow on changes will fix specific tests that are failing (some missing
deps etc).
Specifically, this PR:
- Propagates the correct dependencies and compiler/linker options from
[`add_libc_hermetic`](https://github.com/llvm/llvm-project/blob/4098f568c46e06b6df470111868b4c165dd80f4d/libc/cmake/modules/LLVMLibCTestRules.cmake#L750).
- Adds `crt1.o` and hermetic utils as deps for all full-built tests.
- Fixes some build deps to be full-build compatible.
