openssh: Update and refactor makefiles for 10.6p1 import
Highlights:
* New components: /usr/libexec/ssh-sk-helper and /usr/libexec/sshd-auth.
* Enabled the security key helper for the later FIDO/U2F support.
NOTE: That requires to import the libfido2 and libcbor libraries.
* Removed libprivate_ssh library; it has been refactored as an internal
library.
Major changes:
* Refactor lib/libssh to make it an internal library, rather than
previously as a private library.
* Sync the libssh.a source list with the vendor's makefile.
* The auto-generated config.h is copied as lib/libssh/config.h.auto, and
the final config.h is created with the makefile to apply our
corrections.
* Add the lib/libssh/Makefile.common to reduce duplicate code among all
the OpenSSH components.
Merge branch 'vendor/OPENSSH'
Upgrade OpenSSH from 9.8p1 to 10.6p1.
The last update didn't use the vendor branch, so the vendor branch
upgraded from 9.1p1 to 10.6p1, but the real update is 9.8p1 to 10.6p1.
bsd.crunchgen.mk: Make "depend" for internal libraries first
A program may depend on the output (e.g., a generated header) of
"make depend" of its internal libraries, so make "depend" for the
internal libraries first.
This is required by the forthcoming update to the libssh internal
library.
ifconfig(8): Fix false -Wuse-after-free warnings in ifwg.c
Tweak the code to fix the false -Wuse-after-free warnings in
wg_data_grow() from GCC 12.5:
```
/usr/src/sbin/ifconfig/ifwg.c: In function 'wg_data_grow':
/usr/src/sbin/ifconfig/ifwg.c:79:20: warning: pointer may be used after 'realloc' [-Wuse-after-free]
79 | aip_offset = (char *)wg_aip - (char *)wg_interface;
| ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:82:33: note: call to 'realloc' here
82 | wg_data.wgd_interface = realloc(wg_interface, wg_data.wgd_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:78:21: warning: pointer may be used after 'realloc' [-Wuse-after-free]
78 | peer_offset = (char *)wg_peer - (char *)wg_interface;
| ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sbin/ifconfig/ifwg.c:82:33: note: call to 'realloc' here
82 | wg_data.wgd_interface = realloc(wg_interface, wg_data.wgd_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[3 lines not shown]
csh(1): Silence -Wuse-after-free warnings from GCC 12.5
GCC 12.5 generates the following -Wuse-after-free warnings, which are
all false positives, so silence them for this vendor source. I'd like
to submit the code fixes to upstream and then do a vendor update.
```
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c: In function 'iconv_catgets':
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:2600:34: warning: pointer may be used after 'realloc' [-Wuse-after-free]
2600 | dest = p + (dest - buf);
| ~~~~~~^~~~~~
In file included from /usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:32:
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.h:499:25: note: call to 'realloc' here
499 | # define xrealloc(p, i) realloc(p, i)
| ^~~~~~~~~~~~~
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.func.c:2597:26: note: in expansion of macro 'xrealloc'
2597 | if ((p = xrealloc(buf, buf_size * 2)) == NULL)
| ^~~~~~~~
/usr/src/bin/csh/csh/../../../contrib/tcsh-6/sh.proc.c: In function 'morecommand':
[22 lines not shown]
contrib/gcc-12: Silence -Wmaybe-uninitialized warning
GCC 12.5 would generate the following -Wmaybe-uninitialized warning for
expmed.cc, which defines the #pragma to force this diagnostic to be a
warning, so the GCC's own bootstrap that uses -Werror could succeed.
However, this #pragma makes this warning can't be silenced by a
-Wno-maybe-uninitialized option on the command line. So just modify the
source file to ignore it.
```
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc: In function 'rtx_def* extract_bit_field_1(rtx, poly_uint64, poly_uint64, int, rtx, machine_mode, machine_mode, bool, bool, rtx_def**)':
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc:1832:45: warning: '*(unsigned int*)((char*)&imode + offsetof(scalar_int_mode, scalar_int_mode::m_mode))' may be used uninitialized [-Wmaybe-uninitialized]
1832 | rtx sub = extract_bit_field_as_subreg (mode1, op0, imode,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
1833 | bitsize, bitnum);
| ~~~~~~~~~~~~~~~~
/usr/src/gnu/usr.bin/cc120/libbackend/../../../../contrib/gcc-12/gcc/expmed.cc:1792:19: note: '*(unsigned int*)((char*)&imode + offsetof(scalar_int_mode, scalar_int_mode::m_mode))' was declared here
1792 | scalar_int_mode imode;
| ^~~~~
[6 lines not shown]
gnu/cc80: Correct CFLAGS to fix mkdep warnings
These programs require to use a C++ compiler to compile their '.c'
sources, so they used hacks to do this, one of which is overriding
'MKDEPCC=${CXX}'. However, the CFLAGS wasn't overridden, so calling
mkdep(1) programs would give the warnings:
```
cc1plus: warning: command-line option '-std=gnu11' is valid for C/ObjC but not for C++
```
Fix it by additionally overriding CC and CFLAGS, similar to the
practice used in 'cc80/cc_tools/libcpp/Makefile'. One bonus is that we
can also remove the rule overriding.
kern: skip module shutdown handlers on panic
module_shutdown() is a shutdown_post_sync handler, so it also runs on the
panic path after the panicking CPU has stopped the other CPUs. Some
MOD_SHUTDOWN handlers block on kernel threads that cannot run once their
CPU is stopped: vn calls disk_destroy(), and disk_msg_send_sync() then
waits forever for the disk_msg_core thread. The machine hangs after
"Dump complete" and never reboots.
Skip the module shutdown handlers on a panic, as resettodr_on_shutdown()
and shutdown_kproc() already do. The dump is already written when this
handler runs.
Reproduced in a QEMU/NVMM guest: panic + dump with
hw.acpi.handle_reboot=1 hangs at "Dump complete" on SMP and reboots on a
single CPU. With this change the guest reboots with
hw.acpi.handle_reboot 1 and 0, with and without a dump.
Bug: https://bugs.dragonflybsd.org/issues/3450
mrsas(4): Fix lost wakeups by restoring two wait queues
mrsas(4) is a port of the Linux megaraid_sas driver (see e.g. v3.13).
The port translated Linux's wake_up(), which wakes every non-exclusive
waiters on a wait queue, as wakeup_one(), which wakes only one. It also
collapsed Linux driver's two wait queues ('int_cmd_wait_q' for internal
DCMDs and 'abort_cmd_wait_q' for aborts) into the single 'sc->chan'
channel.
Both loops wait on a per-command predicate (cmd->cmd_status), so a
single wakeup on a shared channel can wake the wrong thread and drop the
wakeup for the command that actually completed. With two blocked
commands outstanding, one of them then times out after
MRSAS_INTERNAL_CMD_WAIT_TIME even though it completed.
Fix the problem by correct the two porting issues:
* internal DCMDs continue to use 'sc->int_chan' that is renamed from
'sc->chan', woken by mrsas_wakeup();
[21 lines not shown]
acpica: Fix -Wvla warnings in acpi_hp.c
Avoid using a variable solely for sizes that are never meant to be
modified runtime.
Obtained-from: FreeBSD (commit 2cafe2f90ca5d7c0ac859db440fa4159f442f128)
asr(4): Fix -Wint-to-pointer and -Warray-bounds warnings
This does fix any real bug, but silence the following warnings from GCC
12.5. This also fixes buildworld that was broken by the previous commit,
which revealed the -Wint-to-pointer warning with GCC 8 as well.
```
/usr/src/sys/dev/raid/asr/asr.c: In function 'ASR_queue_i':
/usr/src/sys/dev/raid/asr/asr.c:3353:42: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
3353 | elm->UserSpace = (caddr_t)
| ^
In file included from /usr/src/sys/dev/raid/asr/i2otypes.h:91,
from /usr/src/sys/dev/raid/asr/i2omsg.h:120,
from /usr/src/sys/dev/raid/asr/i2oexec.h:96,
from /usr/src/sys/dev/raid/asr/asr.c:149:
/usr/src/sys/dev/raid/asr/asr.c: In function 'ASR_acquireLct':
/usr/src/sys/dev/raid/asr/asr.c:1476:52: warning: array subscript 'struct _I2O_EXEC_LCT_NOTIFY_MESSAGE[0]' is partly outside array bounds of 'unsigned char[32]' [-Warray-bounds]
1476 | I2O_MESSAGE_FRAME_setFunction(&(Message_Ptr->StdMessageFrame),
| ^~
[60 lines not shown]
asr(4): Fix bug of DPT_4_BYTES being wrongly defined as long (8 bytes)
Caught by GCC 12.5 with the following '-Warray-bounds' warnings:
```
In file included from /usr/src/sys/dev/raid/asr/asr.c:148:
/usr/src/sys/dev/raid/asr/asr.c: In function 'ASR_getStatus':
/usr/src/sys/dev/raid/asr/dptalign.h:277:26: warning: array subscript 'long unsigned int[4]' is partly outside array bounds of 'I2O_EXEC_STATUS_GET_MESSAGE[1]' {aka 'struct _I2O_EXEC_STATUS_GET_MESSAGE[1]'} [-Warray-bounds]
277 | *((unsigned DPT_4_BYTES __FAR__ *)getUP1(x,y)) \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/raid/asr/i2odep.h:492:17: note: in expansion of macro 'setLU4'
492 | setLU4((&(x)->ReplyBufferLength),0,y)
| ^~~~~~
/usr/src/sys/dev/raid/asr/asr.c:614:9: note: in expansion of macro 'I2O_EXEC_STATUS_GET_MESSAGE_setReplyBufferLength'
614 | I2O_EXEC_STATUS_GET_MESSAGE_setReplyBufferLength(Message_Ptr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/raid/asr/asr.c:599:41: note: at offset 32 into object 'Message' of size 36
599 | I2O_EXEC_STATUS_GET_MESSAGE Message;
| ^~~~~~~
[15 lines not shown]
acpica: Remove redundant checks to fix -Waddress warnings
The 'Source' field defined as a flexible array in a struct, so the
checks are always true.
Obtained from FreeBSD (commit d19b0f3ea51bc68a1c095176a7c491370d433cc0).
Fix the following '-Waddress' warnings given by GCC 12.5:
```
/usr/src/sys/dev/acpica/acpi_pcib.c: In function 'prt_attach_devices':
/usr/src/sys/dev/acpica/acpi_pcib.c:99:23: warning: the comparison will always evaluate as 'false' for the address of 'Source' will never be NULL [-Waddress]
99 | if (entry->Source == NULL || entry->Source[0] == '\0')
| ^~
In file included from /usr/src/sys/contrib/dev/acpica/source/include/platform/acenv.h:298,
from /usr/src/sys/contrib/dev/acpica/source/include/acpi.h:164,
from /usr/src/sys/dev/acpica/acpi_pcib.c:38:
/usr/src/sys/contrib/dev/acpica/source/include/acrestyp.h:953:59: note: 'Source' declared here
953 | ACPI_FLEX_ARRAY(char, Source);
[24 lines not shown]
firewire: Use a union to fix -Warray-bounds warning
GCC 12.5 generated the following '-Warray-bounds' warning because the
'struct fw_pkt' is larger than a 'uint32_t', so introduce a union to
help the aliasing and fix the warning.
This does fix a real bug, and the change is obtained from NetBSD (GitHub
commit a30bc076fe2f3e969d7451633acfceedb3412fa3: don't assign struct
pointers to smaller then structure regions of memory).
```
/usr/src/sys/bus/firewire/fwohci.c: In function 'fwohci_arcv_swap.isra':
/usr/src/sys/bus/firewire/fwohci.c:2598:33: warning: array subscript 'struct fw_pkt[0]' is partly outside array bounds of 'u_int32_t[1]' {aka 'unsigned int[1]'} [-Warray-bounds]
2598 | switch (fp0->mode.common.tcode) {
| ~~~~~~~~~~~~~~~~^~~~~~
/usr/src/sys/bus/firewire/fwohci.c:2586:19: note: object 'ld0' of size 4
2586 | u_int32_t ld0;
| ^~~
```
if_txp: Fix -Waddress warning from GCC 12.5
Remove the dead condition to fix the following '-Waddress' warning:
```
/usr/src/sys/dev/netif/txp/if_txp.c: In function 'txp_rxring_empty':
/usr/src/sys/dev/netif/txp/if_txp.c:1082:39: warning: the comparison will always evaluate as 'false' for the pointer operand in 'sc->sc_rxbufs + (sizetype)((long unsigned int)i * 16)' must not be NULL [-Waddress]
1082 | if (&sc->sc_rxbufs[i] == NULL)
| ^~
```
devfs(5): Remove redundant checks to fix -Waddress warnings
The 'mntpoint', 'name' and 'linkname' fields are char arrays in
'struct devfs_rule_ioctl', so the warned checks were redundant. Remove
them to fix the '-Waddress' warnings given by GCC 12.5:
```
/usr/src/sys/vfs/devfs/devfs_rules.c: In function 'devfs_rule_alloc':
/usr/src/sys/vfs/devfs/devfs_rules.c:87:29: warning: the comparison will always evaluate as 'false' for the address of 'mntpoint' will never be NULL [-Waddress]
87 | if (templ->mntpoint == NULL)
| ^~
In file included from /usr/src/sys/vfs/devfs/devfs_rules.c:44:
/usr/src/sys/sys/devfs_rules.h:74:17: note: 'mntpoint' declared here
74 | char mntpoint[PATH_MAX];
| ^~~~~~~~
/usr/src/sys/vfs/devfs/devfs_rules.c:100:33: warning: the comparison will always evaluate as 'false' for the address of 'name' will never be NULL [-Waddress]
100 | if (templ->name == NULL)
| ^~
/usr/src/sys/sys/devfs_rules.h:76:17: note: 'name' declared here
[29 lines not shown]
ahci: Remove redundant conditions to fix -Waddress warnings
The 'ap_ata' field is a pointer array, so 'ap->ap_ata' represents the
address of the field, which is always not NULL. Remove the redundant
checks to fix the '-Waddress' warnings given by GCC 12.5:
```
/usr/src/sys/dev/disk/ahci/ahci.c: In function 'ahci_port_free':
/usr/src/sys/dev/disk/ahci/ahci.c:1029:13: warning: the comparison will always evaluate as 'true' for the address of 'ap_ata' will never be NULL [-Waddress]
1029 | if (ap->ap_ata) {
| ^~
In file included from /usr/src/sys/dev/disk/ahci/ahci.c:54:
/usr/src/sys/dev/disk/ahci/ahci.h:488:34: note: 'ap_ata' declared here
488 | struct ata_port *ap_ata[AHCI_MAX_PMPORTS];
| ^~~~~~
/usr/src/sys/dev/disk/ahci/ahci.c: In function 'ahci_port_hardstop':
/usr/src/sys/dev/disk/ahci/ahci.c:1831:21: warning: the comparison will always evaluate as 'true' for the address of 'ap_ata' will never be NULL [-Waddress]
1831 | for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
| ^~
[4 lines not shown]
nata: Tweak 'struct dvd_miscauth' to fix -Warray-bounds warnings
GCC 12.5 gave the warnings because the actual allocated space was
smaller than sizeof(struct dvd_miscauth), which had the data[2048]
field. There is no code depend on sizeof(struct dvd_miscauth), so turn
it into a flexible array to fix the -Warray-bounds warnings.
GCC 12.5 warnings example:
```
In function 'acd_send_key',
inlined from 'acd_ioctl' at /usr/src/sys/dev/disk/nata/atapi-cd.c:756:14:
/usr/src/sys/dev/disk/nata/atapi-cd.c:1476:20: warning: array subscript 'struct dvd_miscauth[0]' is partly outside array bounds of 'unsigned char[8]' [-Warray-bounds]
1476 | d->data[0] = ai->region;
| ~~~~~~~~~~~^~~~~~~~~~~~
In file included from /usr/src/sys/dev/disk/nata/atapi-cd.c:42:
In function '__kmalloc',
inlined from 'acd_send_key' at /usr/src/sys/dev/disk/nata/atapi-cd.c:1475:6,
inlined from 'acd_ioctl' at /usr/src/sys/dev/disk/nata/atapi-cd.c:756:14:
/usr/src/sys/sys/malloc.h:280:32: note: object of size 8 allocated by '_kmalloc'
[6 lines not shown]
ufs,ext2fs: Fix -Warray-bounds warnings from GCC 12.5
The code of using 'struct dirtemplate' in ufs_dirempty() and
ext2_dirempty() was added in 1983 the 4.4BSD era, with the intention of
reducing stack use then [1]. However, this optimization is no longer
need now as we have larger stack space, so revert to use the real
'struct direct' or 'struct ext2fs_direct_2' to silence the warnings.
While there, adjust the MINDIRSIZ definition and rename 'count' to
'resid' to clean up the code a bit.
[1] cleanup dirempty to cut down on stack space used and speed up a tad
https://github.com/weiss/original-bsd/commit/de69dc11a62d21d77105282cc2d8b0cac21e1587
GCC 12.5 warnings example:
```
/usr/src/sys/vfs/ufs/ufs_lookup.c: In function 'ufs_dirempty':
/usr/src/sys/vfs/ufs/ufs_lookup.c:1076:23: warning: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Warray-bounds]
1076 | if (dp->d_reclen == 0)
[5 lines not shown]
msdosfs: Silence a -Wmaybe-uninitialized false warning
GCC 12.5 gave the following warning. It's a false positive, but let's
silence it as it's easy to do.
```
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c: In function 'freeclusterchain':
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:874:17: warning: 'bn' may be used uninitialized [-Wmaybe-uninitialized]
874 | updatefats(pmp, bp, bn);
| ^~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/vfs/msdosfs/msdosfs_fat.c:819:16: note: 'bn' was declared here
819 | u_long bn, bo, bsize, byteoffset;
| ^~
```
