minor markup improvements:
in particular, more consistently use .Cm for module names, Makefile targets,
and fixed strings like Yes and No, .Ev for Makefile variables,
and .Sy for command names not documented in the present page
OK daniel@
SEV: Add option AMDSEV
To allow building the small RAMDISK kernel without SEV-* support
introduce the option AMDSEV.
When running a non-SEV kernel as a SEV guest we will raise a #VC
exception on the very first CPUID instruction. To allow a somehwat
graceful termination keep the locore0 #VC trap handler, fall through
to the termination code and issue TERMINATION request to the
hypervisor. In all other environments #VC will never be raised and
the kernel runs normally.
Build RAMDISK without SEV-* support, all other kernel keep SEV-*
support.
While there, cleanup and unify some definitions of the MSR protocol.
ok kettenis@
pf(4): connection counter for source track must use atomic_{inc,_dec}()
The connection counter is advanced when on state transition from
SYN_SENT to ESTABLISHED. That code in pf(4) currently runs with
no locks. If two packets happen to share the same source tracking
node, the race may occur. Two packets try to advance connection
counter simultaneously but only one operation is observed.
There is similar race between packet and timer that removes
expired state entry, the timer drops the connection count for
the source tracking entry while packet does opposite.
The result of those races may lead to connection counter underflow.
The issue was investigated and kindly reported by
Janak Trivedi <janakktrivedi _at_ gmail _dot_ com>
Feedback and suggestions by bluhm@
OK @bluhm
Update perl to 5.42.3
We already had the security changes, this is mostly version bumps
and documentation adjustments for them. There does pull in additional
changes in Archive-Tar, Compress-Raw-Bzip2, and IO-Compress.
While here, bump the libperl version for the previous CVE that
changed a public header.
OK and suggestions bluhm@
In mparse_open(), stop using the same local variable for two entirely
distinct purposes. Instead, declare two different variables, each with
an adequate type (const vs. non-const) and a more descriptive name.
No functional change.
Small style issue reported by gcc-16.1.1 on Fedora 44
via Xose Vazquez Perez <xose.vazquez at gmail.com>.
In mdoc_ptext(), stop confusingly declaring two pointers "const"
that actually point into a non-const string that is sometimes modified
in the function (to trim trailing whitespace).
No functional change.
Small style issue reported by gcc-16.1.1 on Fedora 44
via Xose Vazquez Perez <xose.vazquez at gmail.com>.
libssl: use correct alert for key_share without supported_groups
Processing the key_share extension requires a supported_groups extension.
RFC 9846, section 9.2 explicitly mandates a missing_extension alert in
this situation, so use that instead of illegal_parameter.
We do have code in tls13_client_hello_required_extensions() implementing
the requirements on extensions of the relevant paragraph of that section
with the corrrect alerts. The error in the extension processing happens
before hitting these checks in this particular case.
Reported by Tom Gouville of the tlspuffin team as part of
https://github.com/libressl/portable/issues/1279
ok jsing kenjiro
Ensure numbering is repainted after completion redraw.
Fixes screen corruption when using completion if line numbering is
enabled. Otherwise, the completion area is redrawn without line
numbers. From Jeffrey Johnson
I noticed boot-time /tmp pruning could take a substantial amount of time.
The purpose is two-fold, to remove cruft, and stop newly authenticated users
from seeing it. Took about 20 drafts to get it right. The /tmp files
are now pushed into a mktemp directory, then deleted async, except a few are
removed immediately for the case of the filesystem being full. After daemon
startup has completed, we wait for the removal job to complete (let's keep an
eye on this, because it is possible we actually don't need to wait)
draft iterations with millert, afresh1, and dgl
