pty: preserve O_NONBLOCK when opening /dev/ptmx
ptmx_fdopen() masks the supplied file flags to FREAD | FWRITE before
passing them to pts_alloc(). This discards FNONBLOCK even when the
caller explicitly requests O_NONBLOCK.
As a result, open("/dev/ptmx", O_RDWR | O_NOCTTY | O_NONBLOCK) succeeds,
but the returned file is blocking. F_GETFL reports O_NONBLOCK cleared,
and a subsequent read can block instead of returning EAGAIN when no
data is available.
This causes Linux xfce4-terminal/VTE running under Linuxulator to
freeze. VTE opens the PTY master with O_NONBLOCK and relies on
nonblocking reads while draining terminal output. Once the available
data has been consumed, the main UI thread blocks in ptsdev_read(),
leaving the window unresponsive even though the child shell has
started successfully.
Include FNONBLOCK in the flags passed to pts_alloc(). Blocking opens
[20 lines not shown]
sctp: improve locking validation
Ensure that the TCB lock is hold in sctp_calc_rwnd().
Reviewed by: tuexen
MFC after: 1 week
MFC to: stable/14
MFC to: stable/15
pf: only log that we're not creating a tag in verbose mode
While here get rid of the aesthetically unpleasing '== false' construct.
Sponsored by: Rubicon Communications, LLC ("Netgate")
ktls: Fix capability checks in ktls_reset_receive_tag()
IFCAP2_RXTLS4 and IFCAP2_RXTLS6 are bit numbers, not masks, so
ktls_reset_receive_tag() tested if_capenable2 against 0 for IPv4 and against the
RXTLS4 bit for IPv6. An IPv4 connection with NIC receive TLS offload thus never
got a new receive tag after its packets moved to another interface, and fell
back to software decryption for good.
c721694 fixed the same checks in ktls_alloc_rcv_tag(); use IFCAP2_BIT() here
as well.
Fixes: fe8c78f ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin, kib
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60757
ktls: Take the receiving interface of each packet in sbappend_ktls_rx()
sbappend_ktls_rx() read the receiving interface of each packet header it
demotes from the chain's first mbuf, whose header it had zeroed on the first
pass. A chain of two packets or more thus had no interface, and a change of
input interface went unnoticed: the TLS receive tag stayed on the old interface
until a later append of one packet.
Read it from the packet being demoted, as the decrypted mark is.
Fixes: fe8c78f0d202 ("ktls: Add full support for TLS RX offloading via network interface.")
Approved by: gallatin
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60758
iwm: add iwm_enable_ac_txq(); use it for command queue setup
Port iwm_enable_ac_txq() from OpenBSD. It's effictively the
command FIFO path in the existing iwm_enable_txq().
The OpenBSD driver does a bunch of TX aggregation queue setup in
iwm_enable_txq() which isn't relevant here just quite yet and
it doesn't currently hurt to leave the existing one here
whilst I figure out the next steps.
Locally tested:
* 3160, 7260, 8260, 9260 - STA mode
Obtained from: OpenBSD a6e25c727a2214219715b51ba6af2221d7e0d674
Differential Revision: https://reviews.freebsd.org/D60696
iwm: add phy/mac context tasks; clean up task stop; add net80211 MAC methods
* Add phy/mac tasks, the phy task is currently a placeholder
* Add in the MAC methods from net80211 that are called whenever
the VAP mode needs updating
* Mark the hardware as STOPPED during shutdown so scheduled tasks
don't run
The fun side of this work:
* detaching net80211 causes the parent method to be called which leads
to iwm_stop() being called, and at least one of the entry paths
into iwm_stop() has IWM_LOCK held, and we can't do a taskqueue_drain()
or taskqueue_drain_all() call with any lock held as it will sleep.
* the net80211 detach path is calling at least one of the MAC methods
during detach, and since the taskqueue is being deleted /before/
the net80211 detach path, we have to make sure nothing is actually
going to do taskqueue work after that!
[12 lines not shown]
devfs: Explicitly disable inotify
In principle, inotify can be used to leak timing information about I/O
device accesses by privileged process, which might be sensitive, e.g.,
in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing
In practice this does not work since I/O to devfs nodes does not go
through vnodes, so the INOTIFY() calls in various VOP hooks do not fire.
But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no
one tries to "fix" this bug.
Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify().
However, maybe someday it'll be desirable to enable inotify for specific
device files, in which case the filtering should live in devfs.
Add a regression test.
Reported by: Sudheendra Raghav Neela <sneela at tugraz.at>
Reviewed by: kib
[8 lines not shown]
HBSD: Garbage collect old DNSSEC root key material
This completes the migration to the new DNSSEC key material.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
X-MFC-with: 505acb182e96baee81bb398c490555b681565f8e
(cherry picked from commit 4eeb3fe08eae9b1978b812f22c1a3d9045d8c823)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
(cherry picked from commit 845ac0b0b8b795eb98b3841ddd2a62245693d0db)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
HBSD: Update the link to the new DNSSEC key
This is that follow-up commit mentioned in the commit referenced below.
Another follow-up commit will revoke the old DNSSEC key.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
X-MFC-with: 0429b93d1e93f012ffffe9f068d3b0a4238af8a6
(cherry picked from commit 505acb182e96baee81bb398c490555b681565f8e)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
(cherry picked from commit 7a8776b30fb03ee4caa092759ab1096e9fc035f0)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
HBSD: Update DNSSEC root key material
This key material was generated with the following command:
==== BEGIN COMMAND ====
$ drill -t DNSKEY . > \
share/keys/hbsd-update/trusted/dnssec.key-2026-10-13
==== END COMMAND ====
The root DNSSEC key material was updated on 11 Oct 2026.
Note that this commit only creates the new file. It does not switch to
this new key material. Updating the link will be committed in a
follow-up commit.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
See-Also: https://www.icann.org/resources/pages/ksk-rollover-en
MFC-to: 15-STABLE
(cherry picked from commit 0429b93d1e93f012ffffe9f068d3b0a4238af8a6)
[3 lines not shown]
amd64/vmm: Don't advertise support for performance counters
vmm doesn't implement them, and after commit 2272fac218a8
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72f62c91cb27dd644a62d6a6f5bd56ba)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
(cherry picked from commit e211e04735316fb82e6cfef6536b0976105961fb)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
devfs: Explicitly disable inotify
In principle, inotify can be used to leak timing information about I/O
device accesses by privileged process, which might be sensitive, e.g.,
in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing
In practice this does not work since I/O to devfs nodes does not go
through vnodes, so the INOTIFY() calls in various VOP hooks do not fire.
But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no
one tries to "fix" this bug.
Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify().
However, maybe someday it'll be desirable to enable inotify for specific
device files, in which case the filtering should live in devfs.
Add a regression test.
Reported by: Sudheendra Raghav Neela <sneela at tugraz.at>
Reviewed by: kib
[8 lines not shown]
