Stop docker.socket before docker.service
## Problem
`DockerService.stop()` stopped `docker.service` first and `docker.socket` second, leaving the socket armed for the whole service teardown — around 11.5 seconds on a box with a couple of dozen containers. Anything connecting to `/var/run/docker.sock` in that window socket-activates the very service we are stopping. With the `StartLimitBurst=1` drop-in that phantom start gets refused, the unit latches `failed`, and `CollectMode=inactive` never garbage-collects a failed unit — so the rate-limit counter stays pinned and nothing short of a reboot recovers. That is what leaves an apps-pool migration reporting "Migration completed successfully" at 100% and `Docker service is not running` in the same job.
## Solution
Enqueue the stop on `docker.socket` first. This is not really a reordering of the teardown: systemd builds a two-job transaction and still takes the service down first per `After=`. What changes is that a stop job is pending on the socket, and systemd suppresses activation requests while that is true, so nothing can resurrect the service mid-teardown.
`super().stop()` moves into a `finally` so the service is still stopped if the socket stop raises. It becomes a near no-op in practice, since `docker.service` requires the socket and is already on its way down, but it is worth keeping as a defensive call in case that dependency ever changes upstream. One consequence for anyone reading a trace: the teardown wait now sits on the socket stop rather than on `super().stop()`.
The same shape applies to any unit with a non-empty `TriggeredBy=` — `virtlogd.socket` and `rpcbind.socket` have the same exposure, they just lack the start-rate limit that turns a silent resurrection into a permanent failure.
[clang-nvlink-wrapper] Fix response file handling for the nvlink wrapper (#220249)
Summary:
Response files were not handled correctly because the copied support
used the `nvlink` argument which is not supported by the argument
parser. Pass to the nvlink wrapper using the canonical format and then
reconstruct it when we execute the sub jobs
Fixes: https://github.com/llvm/llvm-project/issues/219914
libc: Parenthesise qualifier-preserving function definitions
Required to prevent function-like macros with the same name from
being expanded in the definitions once they become active in a
later C mode. Without the parentheses, the macro would rewrite
the declarator, and the file would consequently fail to compile.
This style is already used for similar cases such as mempcpy().
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D59600
x11-wm/halley: Add new port
Halley is a spatial Wayland compositor built for multi-monitor desktops. Each
display has an independent infinite Field: a camera over freely overlapping
windows, collapsed node landmarks, and clusters assembled around the work you
actually want to keep together. Windows can decay when they leave your active
area, return through history-aware navigation, or remain pinned as durable
landmarks.
WWW: https://saltnpepper97.github.io/halley-site/
tests: Fix graid3 insert tests
The script was passing the wrong device name to `graid3 insert` and
didn't notice that the command was failing.
MFC after: 1 week
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59564
graid3: Restore lock acquisition
The lock acquisition in g_raid3_ctl_insert() was improperly dropped a
while ago, making it impossible to add or replace a device in an
existing graid3. This went unnoticed because the tests are broken.
MFC after: 1 week
Fixes: fcf69f3dbce6 ("Consistently use gctl_get_provider instead of home-grown variants.")
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59563
mail/dovecot24-pigeonhole: new port
Sieve language support by a plugin for the Dovecot deliver LDA&LMTP
* Mail filtering
* Mail forwarding
* Vacation auto-reply
PR: 298046
Reviewed-by: Martin Waschbüsch <martin at waschbuesch.de>
Michael Grimm <trashcan at ellael.org>
kew: update to 3.4.3
- Add Scrollable text on help view.
- Add progress bar below mini-controls.
- Volume now can go to 12, or 120%.
- Added ability to read lyrics from TXXX (description: USLT) tags,
which is how ffmpeg defaults to encode lyrics.
- Auto-resume is now off by default in a fresh install.
- bug fixes
Revert "[Clang] Refactor instantiation of declarations within concepts" (#223235)
This reverts llvm/llvm-project#221707
This broke std::map as reported in
https://github.com/llvm/llvm-project/issues/223220
[DAGCombiner] Only fold shift+mask compare to rotate if the shift amount divides the bit width (#220743)
DAGCombiner::visitSETCC can turn `(X << S) == (X & -(1 << S))` (or the
srl variant) into `rotl(X, S) == X`, and the other way around, when the
target prefers one form over the other. The two forms are only equivalent when
S divides the bit width. The check used `isPowerOf2(S)`, which is the same
thing for i8/i16/i32/i64 but not for odd widths like i3, where S = 2 is a
power of two that does not divide 3. On x86, which prefers the rotate,
the reporter's i3 function returned the wrong value for two of its eight
inputs.
This changes the `MayTransformRotate` flag passed to
`preferedOpcodeForCmpEqPiecesOfOperand` to check `NumBits % S == 0`
(with S != 0) and fixes the two comments that described the old rule. For legal
scalar types nothing changes. On illegal non power of two widths this
also lets a non power of two amount that divides the width use the rotate
(like i6 with S = 3); that is correct for the same reason and legalizes
through the usual rotate promotion, same as i6 with S = 2 did before. The x86
hook already honors the flag in both directions, so the fix lives in the
[6 lines not shown]
ocaml-cppo: add version string to dune-project
If /usr/ports is a git checkout, and a dune project is missing the version
string, then dune will attempt to check if the port is a git project in
order to find a version string via git.
However ocaml-cppo is not a git project and so dune walks the directory tree
until it finds the unrelated /usr/ports/.git in this setup. Dune then uses
the unrelated parent git repo to extract the wrong version string for
ocaml-cppo's metadata.
Fix this by patching in a version string manually into dune-project. This
will avoid dune going down this wrong code path. Note that the build will
only error out on a system that is also missing a git package. If git is
present then dune will silently insert the wrong package metadata.
Spotted by tb@
qat: driver updates to enhance qat infrastructure
- Updated QAT infrastructure FW version/AE mask/num_banks fields
to facilitate integration of future QAT products.
- Exposed service as sym;asym instead of cy for gen4
- Enhanced cpaGetInstances() for accurate instance retrieval
- Added 57-bit virtual address support to lac_lock_free_stack
- Minor bug fixes and improvements
Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj at intel.com>
Reviewed by: markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D57746
(cherry picked from commit 682f135f5de39cfc24cfd529ea8a161e94c76c8e)
if_vxlan(4): Fix panic by validating unused drvspec values
Add validation for unused parameter values in the gap between
VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent
panics.
PR: 297151
Reported by: Robert Morris <rtm at lcs.mit.edu>
Reviewed by: markj
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58552
(cherry picked from commit c4d7745cd90fc99af3cbccfda7e11798ea7d187b)
ice(4): Add two more 4-part IDs for E835 adapters
Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Reviewed by: erj
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57337
(cherry picked from commit f370d9e4d5844daa06d77e57236e03bd7c5f4ba1)
ice(4): Add support for E835 CNSA 2.0 adapters
Added support for E835 adapters with post-quantum cryptographic (PQC)
algorithms in firmware/software signage and in SPDM attestation.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Reviewed by: Miłosz Linkiewicz <milosz.linkiewicz at intel.com>
Differential Revision: https://reviews.freebsd.org/D57868
(cherry picked from commit 8194c32827e9c3867d4b295edca9842b71608526)
arm64: fpu: avoid unnecessarily reads of MVFR1_EL1
The contents of MVFR1_EL1 do not change at runtime and it is already
saved in struct cpu_info. Use the cached value in fpu_state_load() as it
avoids a guest exit when running under a hypervisor with HCR_EL2.TID3 = '1'.
ice: Report initialization failures to iflib
The primary and mirror-VSI ifdi_init callbacks can return early when
reset state or hardware queue and filter setup prevents initialization.
Iflib then marks the interface running and enables interrupts although
the driver did not finish bringing it up.
Report each non-detach failure through iflib_init_failed(). Keep the
existing ice reset and subinterface-reinitialization machinery
responsible for scheduling recovery.
(cherry picked from commit dcdc00a41d3e4be0e75eb625cd3a23d5a927ed15)
ice: Add led(4) identification support
Expose the firmware-controlled physical port identification LED
through /dev/led/ice*. Use the AdminQ port-identification command to
select blinking mode and restore the netlist-selected original mode
before the interface is stopped.
Sponsored by: BBOX.io
(cherry picked from commit a781965b91ea390f9576ae42c35c842db74aab86)
