tests/netinet/socket_afinet: reduce tautology in test cases names
Just avoid repeating the test program name in every test case name.
No functional change.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56727
tests/socket_afinet: extend bind_connected_port_test to cover more cases
- Test SOCK_DGRAM (UDP) sockets.
- Test binding to 0:port and to a addr:port in presence of connected socket
using the port.
Differential Revision: https://reviews.freebsd.org/D56707
tests/socket_afinet: make child_bind() return a full spectre of results
There is no functional change for existing tests, but allows to write a test
that would expect an immediate success of bind(2).
inpcb: use correct mask in in6_pcblookup_lbgroup()
There is no visible bug fixed as in current tree masks are the same.
Fixes: 6883b120c53735ff1681ef96d257f376731f56b3
hym8563: Fix 32-bit powerpc build
Depend on clknode_if.h in the module Makefile, so that it gets
explicitly built for the module. Also, reduce the #if guards to only
the new clock output code, and gate them on all powerpc, not just
powerpc64.
Fixes: 6b77d34f("HYM8563: Add support for clock output.")
Reviewed by: mmel
Differential Revision: https://reviews.freebsd.org/D57795
rge: Fix 32-bit powerpc build
Book-E powerpc has 64-bit bus_addr_t but only a 32-bit bus_size_t. Use
the right macros for maxsize and maxsegsize to fix the build.
Fixes: 4bf8ce037 ("if_rge: initial import of if_rge driver from OpenBSD.")
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57794
ktls: Add a tunable to disable TLS receive
TLS receive offload is really only beneficial for in-kernel use cases
(such as NFS over TLS) or when using a hardware offload. In addition,
several recent SAs have involved the TLS receive path, but the only
current mitigation for those is to disable TLS offload entirely.
Reviewed by: ziaee, gallatin, markj
Relnotes: yes
Sponsored by: Netflix
Sponsored by: Chelsio Communications
Co-authored-by: John Baldwin <jhb at FreeBSD.org>
Differential Revision: https://reviews.freebsd.org/D57974
ktls: Centralize the check for CBC ciphers
Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.
Reviewed by: gallatin, markj
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D57973
pkgconf: match the update to version 2.9.93
This update brings spdxtool(1), with the ability to generate software
bill of material files (SBOM) in the SPDX 3.0.1 format (JSON-LD).
Reviewed by: markj
Approved by: markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57953
asmc: try PIO before MMIO to avoid false T2 detection
Add hw.asmc.system-state and hw.asmc.board-id read-only sysctls to
expose the T2 system state register and Mac board identifier via SMC.
Try PIO access before MMIO during probe to prevent false T2 detection
on Macs that happen to have something mapped at the T2 BAR address.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57844
net80211: fix CCMP/GCMP AAD for MFP frames
Update ieee80211_crypto_init_aad() to do what 802.11-2020 says -
only mask fc[0] bits 4-6 on data frames, not on management frames.
This (with other diffs to actually negotiate MFP and configure
ath(4) for MFP + software keys) allows the CCMP path to decrypt
CCMP MFP frames in the software path.
Differential Revision: https://reviews.freebsd.org/D57799
asmc: deduplicate sensor converters and cause sysctls
Replace per-type spXX_to_milli() functions with a table-driven
asmc_sensor_convert() that looks up the divisor by SMC type string.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57854
asmc: add system state and board identity sysctls
Add dev.asmc.0.system subtree with read-only sysctls for SMC diagnostic
and identity keys: shutdown_cause (MSSD), sleep_cause (MSSP),
thermal_status (MSAL), time_of_day (CLKT), power_state (MSPS),
board_id (RPlt), and chip_gen (RGEN).
Each sysctl is registered only if the key exists on the hardware.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D57853
bhyve: Add CPU pinning diagnostic message
When pinning a vcpu to a hostcpu fails, print out a diagnostic message
to stderr indicating the failing CPU pair.
MFC after: 1 month
Reviewed by: bnovkov
Differential Revision: https://reviews.freebsd.org/D57619
syslogd: Handle connection errors when setting up forwarding sockets
Since syslogd was converted to run in a Capsicum sandbox, it needs to
explicitly connect() its forwarding sockets rather than using sendmsg().
At the time syslogd starts during boot, some of its forwarding
destinations may not be routable, in which case connect() fails.
Fix this by making connect() failures non-fatal, and use cap_net to
lazily connect sockets once something actually tries logging to the
destination.
Add a regression test.
Reported by: ae
Reviewed by: ae
Discussed with: jfree
Fixes: 4ecbee2760f7 ("syslogd: Open forwarding socket descriptors")
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D57394
tools: Add git-mfc
This is a utility that effectively wraps git-cherry-pick for performing
MFCs, though it has some other usages. In addition to actually
cherry-pick the specified commits, it looks at the upstream branch for
fixup commits, denoted by a `Fixes:` tag which references the fixed
commit.
Aside from actually cherry-picking commits, git-mfc can also be used to
list pending MFCs (commits in the upstream branch which are eligible for
MFC based on the `MFC after` tag), and "dangling" MFCs, where a commit
was MFCed to the currently checked out stable branch, and the upstream
branch has one or more fixup commits which have not been merged.
The utility requires python and the gitpython module.
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D57845
stand: Fix shadow buffer offset handling
The shadow buffer is addressed relative to `tg_origin`, which includes
the padding offset, whereas `gfxfb_blt` operates on coordinates without
that offset. To make `gfx_fb_copy_area` emulate the behavior of
`gfxfb_blt`, the source coordinates must include the padding offset,
while the destination coordinates must not. The original implementation
omitted the offset from the source coordinates; this change corrects
that.
Additionally, `gfx_fb_cons_display` already applies the padding offset,
so the redundant adjustment is removed.
PR: 296246
Reported by: 2khramtsov at gmail.com
Reviewed by: imp
Tested by: 2khramtsov at gmail.com, junchoon at dec.sakura.ne.jp,
naito.yuichiro_ at gmail.com
Fixes: 32da2f23ae4d
[3 lines not shown]
kern: syscall_thread_enter() cannot fail
Attempting to handle the error gracefully can easily result in missing
SIGSYS, so this was made to always succeed in
39024a89146 ("syscalls: fix missing SIGSYS for several ENOSYS errors")
and returns the nosys entry on failure.
Drop the pretense of returning an error and clean up a few dead error
paths.
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D57848
ktls CBC decrypt: Avoid creating zero length iovec entries
If an mbuf's length in the chain for an encrypted TLS record exactly
matches the remaining length of header bytes to skip, skip the mbuf
entirely rather than adding a zero-length iovec entry.
Sponsored by: Chelsio Communications
iconv: Fix a stack buffer overflow in _ISO2022_sputwchar()
In the ISO2022-CN encoding, characters may require at least seven bytes,
and MB_LEN_MAX==6 is insufficient. From code inspection,
_ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to
size buffers.
Add a regression test.
Approved by: so
Security: FreeBSD-SA-26:49.iconv
Security: CVE-2026-58082
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D57950
ktls CBC decrypt: Only increment iovec index when an entry is used
If an mbuf in the chain was skipped because it only contained bytes
from the header, the iovec index ('i') was incremented even though the
entry was not populated. Only increment 'i' when an iovec entry is
consumed.
Add a new type of KTLS receive test which writes a single TLS record
via two separate write(2) calls over a TCP_NODELAY socket to trigger
a split in the mbuf chain in the kernel. Test various split locations
including after the "plain" TLS header (5 bytes), after the full TLS
header, in the middle of the data payload, just before the start of
the trailer, and in the middle of the trailer. These tests are also
run against all supported ciphers, not just CBC. The 'header' test
for CBC ciphersuites was able to trigger the bug.
Approved by: so
Security: FreeBSD-SA-26:46.ktls
Security: CVE-2026-49423
Sponsored by: Chelsio Communications
posixshm: Disallow truncation of largepage objects
We correctly handled ftruncate(), but not open(O_TRUNC).
Add a regression test.
Approved by: so
Security: FreeBSD-SA-26:44.posixshm
Security: CVE-2026-49428
Reported by: Chris Jarrett-Davies <chrisjd at openai.com>
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57831
