[ELF] --print-icf-sections: print classes in input order (#233345)
... instead of the hash-sorted section order, so a change to the hash no
longer reorders the output.
buf: updated to 1.74.0
v1.74.0 - 2026-10-14
- Improve the performance of the `PROTOVALIDATE` lint rule, which is now up to 3x faster
and allocates less memory on modules using `cel` rules or `example` values.
- Send the module name of each file to check plugins, which is available as
`FileDescriptor.ModuleName()` in bufplugin-go v0.11.0 and later.
- Update `buf curl` to automatically use HTTP/2 prior knowledge for `http` URLs when server
reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these
require HTTP/2. The `--http2-prior-knowledge` flag is no longer required in these cases.
- Add `--stdin-filepath` flag to `buf format`, which reads a single `.proto` file from
stdin and writes the formatted result to stdout. The path is not read from disk, and is
only used to report parse errors and diffs.
- Fix `buf convert` panic when converting images that contain files without a `syntax`
declaration or with unused imports.
- Fix `buf generate` with `strategy: directory` and `include_imports: true` adding imports
to the `CodeGeneratorRequest` of the directory that imports them. Imports are now split
by directory into their own requests, the same as non-imports.
[15 lines not shown]
py-apsw: updated to 3.54.1.0
3.54.1.0
Fixed build failure on recent gcc, due to using header that was included by other headers. (APSW issue 640)
Fixed reference count leak due to incorrect reference count handling. The main symptom would be connections not automatically being garbage collected. (APSW issue 641)
databases/openldap2[567]-server: Restore SMBPWD
Since FreeBSD 15 switched to MIT Kerberos, the SMBPWD option
was excluded because smbk5pwd requires Heimdal for its Kerberos
support. However, the Samba and shadow password hash parts of
the overlay do not depend on Kerberos and are still useful.
On FreeBSD 15 and later, build smbk5pwd without DO_KRB5 instead
of excluding the option altogether.
PR: 299408
Reported by: Geoffroy Desvernay <dgeo at centrale-med.fr>
[SLP] Handle REVEC when costing expanded compress mask (#232810)
With REVEC the scalars are vectors.
After https://github.com/llvm/llvm-project/pull/135174 the
masked-load-compress
shuffle that is emitted uses the compress mask expanded to the elements
of
those vectors (transformScalarShuffleIndiciesToVector), but the cost was
left
computed with the unexpanded per-vector mask, so a shuffle such as <24 x
i8> ->
<16 x i8> was costed as a <2 x i8> shuffle. This made the compress
sequence
looked cheaper than it is.
Assisted-By: Claude Sonnet 5.5
libthr: drop use of try_gc in the end of thr_join
thr_try_gc unlock and lock again to make sure the lock order. However,
there is no reason for such roundtrip if the caller holds the correct
oder. As a result, we create a new helper function to add the thread
to gc list without unlock + lock and wire the join_common to this new helper.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60717
[WebAssembly] Disallow Wasm EH + Emscripten SjLj in backend (#232559)
This combination has long been disallowed in Emscripten
(https://github.com/emscripten-core/emscripten/pull/18692) and in Clang
(#122466) but the backend code assumed it was possible. This removes
code that handled this in LowerEmscriptenEHSjLj and explicitly errors
out if the combination is given.
net/samba425: avoid SIGFPE in streams_xattr_get_ea_value_fsp
As reported in https://bugzilla.samba.org/show_bug.cgi?id=16278,
upstream commit 5fa43440ebd3 ("vfs: Implement larger streams in multiple
xattrs"), results in many signal 8 (SIGFPE) crashes in smbd child
processes on FreeBSD, if the streams_xattr vfs module is loaded.
This is because streams_xattr_get_ea_value_fsp() can divide by zero, if
the "max xattrs per stream" is left at its default value.
Apply the upstream fix to avoid the crashes.
PR: 299446
Obtained from: https://gitlab.com/samba-team/samba/-/commit/21f8b339
MFH: 2026Q4
Approved by: samba (kiwi)
Rework how license changes are applied
This PR adds changes to replace the license reconcile delegates and the post_license_update hook with a single apply path driven by the entitlement matrix. Every install path (upload, TNC heartbeat, HA peer propagation, legacy sync) snapshots entitlements before and after the change, diffs them and runs only the delegates of the features that actually flipped, so unaffected services are no longer reloaded/restarted on every license change.
Delegates are defined next to their plugins on top of a small base (converge, workload and custom kinds) which owns the service control flags, running/active node checks and failure reporting. Revoking a feature now revokes running functionality as well: VMs and containers are shut down (autostart ones come back on re-grant), docker is stopped while keeping its pool, webshare is stopped and masked, NFS snapshot exposure and DS auth are gated at render time (DS auth is left alone if no usable local admin exists), FC/RDMA targets are converged and KMIP keys are pulled back locally. STIG/FIPS, dedup, NVMe-oF SPDK and network FEC are alert-only. A single alert lists features which are not licensed but still in use, including revokes which did not complete.
On HA, uploads are refused on the standby, during failover and when they would drop HA on a configured pair, and the newer license is pushed to the peer when it reconnects. The pending changes are journalled in /run so a middlewared restart between install and apply does not lose them.
Address review findings in license apply rework
This commit fixes the issues found while reviewing the license apply rework: KMIP now resolves its push/pull direction through the entitlement check so a daemon blip never pulls keys and the integration tests exercise the real path, the KMIP tests expect escrow references to be kept when the server is unreachable, HA delegate steps are isolated from each other, the remote client cannot be started twice on a first HA license, and the apply/journal replay paths no longer race the upload lock.
An admin's explicit upload on the active node is now authoritative. It is propagated through a private endpoint which skips the stale/test license refusals on the standby and a marker keeps the reconnect push from reverting it until the peer has accepted it. TNC and reconnect deliveries keep those refusals.
Simplify license delegate active check and usage alert
This commit makes some changes where license delegates decided whether the node is the active controller by reading failover.status.get_local and the VIP rows themselves; they now use the existing failover.is_single_master_node check, same as the TNC heartbeat.
It also turns the unlicensed features in use alert from a 10 minute polling source into a one-shot alert that is evaluated at the end of truenas.license.apply, once at system.ready on the active node and when a node becomes master, since gates already block new use of unlicensed features so the list can only shrink between license changes. A license daemon error still leaves the existing alert untouched.
VM and container updates are gated by the license again without carving out autostart-only edits, since an autostart instance coming back on a re-grant is what autostart means and the admin can change it once licensed.
Stopping active VMs and containers is simplified as well. The libvirt reachability probe, the resume-before-stop of suspended instances and the extra private endpoints are gone; a suspended VM is powered off and a suspended container killed, shutdown and failover call stop_active directly, and the pool import license guard for containers is dropped since container.start already refuses when unlicensed.
net/samba424: avoid SIGFPE in streams_xattr_get_ea_value_fsp
As reported in https://bugzilla.samba.org/show_bug.cgi?id=16278,
upstream commit 5fa43440ebd3 ("vfs: Implement larger streams in multiple
xattrs"), results in many signal 8 (SIGFPE) crashes in smbd child
processes on FreeBSD, if the streams_xattr vfs module is loaded.
This is because streams_xattr_get_ea_value_fsp() can divide by zero, if
the "max xattrs per stream" is left at its default value.
Apply the upstream fix to avoid the crashes.
PR: 299445
Obtained from: https://gitlab.com/samba-team/samba/-/commit/21f8b339
MFH: 2026Q4
Approved by: samba (kiwi)
www/pomerium-envoy-custom: Fix build on aarch64
gperftools has no way to read the program counter from a signal's
ucontext on FreeBSD/aarch64, so its CPU profiler, which Envoy builds
with --define tcmalloc=gperftools, failed to compile:
getpc-inl.h:393:22: error: no member named 'Get' in ...
On FreeBSD/aarch64 the kernel stores the interrupted PC in
uc_mcontext.mc_gpregs.gp_elr. Add an accessor for it to gperftools
and apply the patch through the gperftools http_archive in envoy's
bazel/repositories.bzl, the same way the msgpack patch is applied.
The hunk offsets of the other entries in that patch are refreshed
while here.
The gperftools change has been verified with getpc_test on an Ampere
eMAG running FreeBSD 15.1 and submitted upstream. The full port has
only been test-built on amd64 so far.
Upstream PR: https://github.com/gperftools/gperftools/pull/1647
Update bind.keys from src/external/mpl/dist/bind.keys.
managed-keys is ancient history and just generated warnings doing
nothing useful. The proper keyword to use is trust-anchors and
this file is now current. The latest root key is only partially
specified as it wasn't published at the time this file was updated,
but enough information is provided for named to download the full
key using RFC 5011.
Fixes PR/52465 and PR/60864
Revert "[ProfileSummaryInfo] Honor the hot function attribute in hotness queries" (#233334)
Reverts llvm/llvm-project#232085
Looks like https://github.com/llvm/llvm-project/pull/233298 broke one of
the tests. I'll fix it tomorrow and resubmit then.
[libc] Add Kushal Pal(quic-k) as the maintainer for Hexagon (#232009)
@michaelrj-google @androm3da
Hexagon port for libc merged
https://github.com/llvm/llvm-project/pull/217528
Signed-off-by: Kushal Pal <kushpal at qti.qualcomm.com>
Co-authored-by: Brian Cain <brian.cain at oss.qualcomm.com>
[ProfileSummaryInfo] Honor the hot function attribute in hotness queries (#232085)
LangRef documents the `hot` function attribute as taking precedence over
profile information and acting as a manual alternative to PGO hotness
data when training inputs lack coverage for hot functions. However,
ProfileSummaryInfo only checked `Attribute::Cold` (in
isFunctionEntryCold) and never consulted `Attribute::Hot`. As a result,
functions marked `hot` that had zero entry counts in PGO profiles (for
example, newly introduced functions not executed during profile
collection) were still treated as cold by PSI queries, causing passes
such as TailCallElim and PGOForceFunctionAttrs to apply cold-function
heuristics.
Check `Attribute::Hot` in `isFunctionEntryHot`,
`isFunctionHotInCallGraph`, `isFunctionColdInCallGraph`, and
`isFunctionEntryCold` before checking `hasProfileSummary()` or
`Attribute::Cold`. This matches the precedence in CodeGenPrepare and
ensures the attribute is honored both with and without profile data.
Assisted-by: Gemini
rpki-client: fix doc comment on maxLength in extern.h
Since roa.c 1.6 (2019), the maxlength member of struct roa_ip is set to
the prefix length rather than zero if the maxLength element is absent.
While this move simplified some things, it also required some complexity.
Maybe this needs revisiting at some point.
For now stop lying (something these dumb comments often end up doing...)
