Move VM video model migration to 27.0
## Problem
The VM video model change is being backported to 27.0 with its own 27.0 migration. Master's 28.0 migration added the same column, so a 27.0 database stamped with the backported revision would have no path into master's chain, and master's v27_0_0 API models would not match what 27.0 ships.
## Solution
Added the 27.0 migration as it ships on 27.0, made the 28.0 migration a no-op that keeps its revision so installs that already recorded it keep a valid chain, and added a merge migration joining the two. The 27.0 migration skips itself when the column already exists, so nightlies that ran the original 28.0 migration keep their values. Also added `video_model` to master's v27_0_0 VM models to match 27.0.
Allow selecting the VM video model
## Problem
VMs always got a QXL video adapter. QXL can deadlock a Linux guest during shutdown when the host stops releasing its memory.
## Solution
Added `video_model` (`QXL`, `VGA`, `VIRTIO`) to VMs, with new VMs defaulting to `VGA`. The 27.0 migration keeps existing VMs with a display on `QXL` and moves headless VMs from libvirt's implicit cirrus adapter to `VGA`. It skips itself when the column already exists, so databases that ran the original 28.0 migration keep their values.
This depends on the matching truenas_pylibvirt change and has to be merged together with it.
[lldb][RISCV] Update CSRI patch set for 'Xqci' (#229165)
Update the control and status register information patch set for 'Xqci'
to align with 'Xqci v0.13' –
- Add 'mcause'
- Remove 'mscratch0', 'mscratch1', 'mnepc', and 'mncause'
- Correct the identification of 'mclicilvl0[0-9]'
[SCEV] Add compile-time regression test for CompareSCEVComplexity (#223723)
Add test coverage for the exponential compile-time fixed by
https://github.com/llvm/llvm-project/pull/230252.
Distinct SCEVUnknowns could compare equal, causing CompareSCEVComplexity
to repeatedly compare shared subexpressions.
Before the fix, the test takes too long to complete. With the fix, it
completes quickly.
Assisted-by: OpenAI Codex
[ARM] Protect against scalar geps in MVE gather lowering (#231939)
In case when looking back through geps two are scalar, bail out of
CheckAndCreateOffsetAdd.
Fixes #231773
[clang][bytecode][NFC] Simplify bytecode emission (#232215)
Remove unused parameters and switch to returning the success boolean
instead of writing to a reference parameter.
*/*: fix build broken by PuLP rename
PuLP was renamed to pulp in the port math/py-PuLP and by the upstream.
Reported by: fallout
Approved by: portmgr (unbreak; blanket)
[mlir][OpenMP] Model recursive memory effects of omp.master (#230190)
Remove effect-free master regions while preserving nested memory
effects.
Assisted by: AI (ChatGPT)
---------
Co-authored-by: Jamie.Rowlinson-Patel at arm.com <jamrow01 at ip-10-252-16-38.eu-west-1.compute.internal>
Simplify license delegate active check and usage alert
This commit makes some changes where license delegates decided whether the node is the active controller by reading failover.status.get_local and the VIP rows themselves; they now use the existing failover.is_single_master_node check, same as the TNC heartbeat.
It also turns the unlicensed features in use alert from a 10 minute polling source into a one-shot alert that is evaluated at the end of truenas.license.apply, once at system.ready on the active node and when a node becomes master, since gates already block new use of unlicensed features so the list can only shrink between license changes. A license daemon error still leaves the existing alert untouched.
AMDGPU: Create the implicit argument attributes once
AAAMDAttributes created each of its 21 string attributes again for
every function it manifested, which hashes the attribute name to find
the uniqued attribute. Create them once in the information cache,
sorted by name like they are in an attribute set.
Instructions spent in amdgpu-attributor
(opt, parse cost subtracted, median of 3 runs):
rocPRIM test_device_scan, gfx942: 1963M -> 1922M (-2.1%)
Blender Cycles HIP kernel, gfx1100: 636M -> 632M (within noise)
rocPRIM 16 tests, full LTO, closed world: 7415M -> 7231M (-2.5%)
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
Attributor: Don't remove attributes with an empty mask
Manifesting attributes always removed the attributes of an empty
AttributeMask, which copies the attribute set into an AttrBuilder and
looks up each of its attributes in the mask. Skip the removal if the
mask is empty, and add AttributeMask::empty for that.
Instructions spent in amdgpu-attributor
(opt, parse cost subtracted, median of 3 runs):
rocPRIM test_device_scan, gfx942: 1963M -> 1927M (-1.8%)
Blender Cycles HIP kernel, gfx1100: 636M -> 632M (within noise)
rocPRIM 16 tests, full LTO, closed world: 7415M -> 7313M (-1.4%)
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[IR] Verify oracle functions are only used by llvm.speculative.load. (#226669)
Update speculative load verification rules to enforce that speculative
load oracle functions are only used by speculative loads and require
local linakge.
This simplifies dropping oracle functions during codegen.
PR: https://github.com/llvm/llvm-project/pull/226669
bhyve: Fix handling of framebuffer resizing
The rfb code maintains an array of CRCs for 32x32 tiles in the
framebuffer. This array is sized statically based on the rfb code's
notion of the maximum framebuffer size, which changed in commit
fb51ddb20d57 without updating the rfb code.
Morever, writes to the framebuffer BAR can modify the recorded height
and width of the framebuffer. These values were not validated against
the maximum at all, unlike the parameters set via bhyve config.
Fix these problems:
- Define the maximum width and height in a shared header file so that
they do not get out of sync again.
- In pci_fbuf_render(), don't resize the console if the new dimensions
are too large.
- Add a mutex to synchronize framebuffer BAR I/O with the rfb thread.
Approved by: so
[5 lines not shown]
bhyve: Improve HDA stream descriptor validation
The length of each block in the stream must be non-zero. This is
assumed in hda_transfer(), otherwise an out-of-bounds read or write is
possible.
Use atomic loads to access stream descriptor fields, since they are
guest-controlled. Make sure that the descriptor array is suitably
aligned so that we can drop the __packed annotation from the structure
definition; per section 3.3.42 of the HDA spec the BDL pointer is
supposed to be 128-byte aligned, in fact.
Approved by: so
Security: FreeBSD-SA-26:72.bhyve
Security: CVE-2026-101310
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60678
bhyve: Fix handling of the xhci event ring
rts->erst_p and rts->erstba_p are pointers to guest-controlled memory
which describe the event rings and pending event array, respectively.
The device model was not validating the size nor saving the value.
As a result, the bounds checks in pci_xhci_insert_event() were
susceptible to TOCTOU races.
Fix pci_xhci_rtsregs_write() to save the ring size in a softc field.
Validate that the size isn't larger than the maximum allowed by the XHCI
specification (64KB, or 4096 TRBs).
When processing TRBs, make sure we don't load fields more than once.
Make sure that pci_xhci_trb_next() doesn't return a pointer to host
memory. When handling ERDP writes, make sure that the guest-supplied
address is actually a pointer into the TRB array, and ignore the write
if not.
Approved by: so
[4 lines not shown]
sound: Revalidate after reacquiring locks when resizing buffers
sndbuf_resize() and sndbuf_remalloc() drop the channel lock in order to
allocate the new buffer(s) with M_WAITOK. Before doing that they verify
that the buffer is not mapped, but this could change while the lock is
dropped, as there is no higher-level synchronization which prevents
buffer resize (e.g., via the SNDCTL_DSP_SETBLKSIZE ioctl) from happening
concurrently with mmap. Thus, these checks are insufficient.
Modify sndbuf_resize() and sndbuf_remalloc() to revalidate after
reacquiring the lock. Extend them to check for a couple of channel
flags, mirroring the check in chn_resizebuf(). Modify chn_resizebuf()
to revalidate state after reacquiring the channel lock.
We could also allocate new buffers with M_NOWAIT and so avoid dropping
the lock. Then, I think we could go even further and invoke
CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS with the channel lock
held. But really it would be better to ensure that dsp operations are
serialized; there is no reason for mmap and chn_resizebuf() to be able
[10 lines not shown]
sound: Check for errors from sndbuf_resize()
Most implementations of CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS
were not checking this. This is probably not a big problem: it's
unlikely for sndbuf_resize() to fail due to the refcount check in this
case since it's operating on the hardware buffer, which doesn't get
mmaped. But, I will add more reasons for it to fail in the next patch,
so let's be more careful.
This change modifies various CHANNEL_SETBLOCKSIZE implementations to
check for errors. In some cases I reordered things to avoid updating
driver state until after sndbuf_resize() succeeds.
Return 0 from CHANNEL_SETBLOCKSIZE to indicate an error, as it otherwise
returns the new block size. We could change the interface to return
both an error number and a block size, but that would break at least one
out-of-tree driver and I wish to avoid that here. Make sure that errors
from CHANNEL_SETFRAGMENTS are returned to userspace.
[4 lines not shown]
tcp/rack: Fix a potential overflow in rack_update_pcm_ack()
The RACK stack's path capacity measurement module maintains an array of
samples, updated when the stack receives an ACK. The array grows as
needed, but code which handles the expansion is susceptible to remotely
triggerable overflow. This could lead to underallocation and a ~512KB
out-of-bounds write.
Fix this by bounding the sample array size.
Approved by: so
Security: FreeBSD-SA-26:70.tcp
Security: CVE-2026-101307
Reviewed by: glebius, markj
Reported by: Nozomi Networks Security Research
