HardenedBSD/src 5429957include stdio.h, share/man/man4 iflib.4

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+208-60sys/net/iflib.c
+189-11sys/arm64/arm64/pmap.c
+59-0share/man/man4/iflib.4
+14-0sys/dev/pci/pci.c
+7-3sys/dev/enetc/if_enetc.c
+7-3include/stdio.h
+484-7717 files not shown
+536-9623 files

HardenedBSD/src 2fca36ainclude stdio.h, share/man/man4 iflib.4

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+208-60sys/net/iflib.c
+189-11sys/arm64/arm64/pmap.c
+59-0share/man/man4/iflib.4
+14-0sys/dev/pci/pci.c
+7-3sys/dev/enetc/if_enetc.c
+7-3include/stdio.h
+484-7717 files not shown
+536-9623 files

HardenedBSD/src 06aaca4sys/net iflib.c

iflib: actually disable simple_tx when ALTQ is in use

When getting some baseline ALTQ numbers, I noticed that
if simlple_tx is enabled in kenv, we wind up re-setting the transmit
routine, but I neglected to actually clear ctx->ifc_sysctl_simple_tx.
That leads to many different panics as we run a mixture of mp_ring
and simple_tx.

Pointy-hat to: gallatin
Sponsored by: Netflix
DeltaFile
+1-0sys/net/iflib.c
+1-01 files

HardenedBSD/src b4208a6sys/net iflib.c

iflib: Initialize the VFLR task unconditionally

The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths.  ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task.  Even with MSI-X, the admin
interrupt was established before the task was initialized.

Initialize it alongside the other private tasks.  The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.

MFC after:      2 weeks
Sponsored by:   BBOX.io
DeltaFile
+1-1sys/net/iflib.c
+1-11 files

HardenedBSD/src ac56d36share/man/man4 iflib.4, sys/net iflib.c

iflib: Add an admin task detach fail point

Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.

Use a bounded delay to keep the task active while detach enters the
taskqueue drain.  Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().

Reviewed by:    gallatin, kgalazka
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58720
DeltaFile
+19-0share/man/man4/iflib.4
+11-0sys/net/iflib.c
+30-02 files

HardenedBSD/src ba353c8sys/net iflib.c

iflib: Drain configuration tasks before interface detach

iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change.  This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.

Drain the entire private taskqueue before ether_ifdetach().  Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.

MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58452

Co-authored-by: Andrew Gallatin <gallatin at FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling at FreeBSD.org>
DeltaFile
+7-0sys/net/iflib.c
+7-01 files

HardenedBSD/src 90e7dbeshare/man/man4 iflib.4, sys/net iflib.c

iflib: Add registration failure injection points

Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.

Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.

Reviewed by:    gallatin
MFC after:      2 weeks
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58722
DeltaFile
+46-0sys/net/iflib.c
+40-0share/man/man4/iflib.4
+86-02 files

HardenedBSD/src ffc9b42share/man/man4 rctl.4

rctl(4): document the sysctl tree

Do not duplicate the documentation already available
through "sysctl -d", but tell the user where to find it.

PR:             257984
Suggested by:   Felix Johnson <felix.the.red at gmail.com>
DeltaFile
+6-1share/man/man4/rctl.4
+6-11 files

HardenedBSD/src fe00ca2sys/dev/bnxt/bnxt_en if_bnxt.c, sys/dev/enetc if_enetc.c

iflib: Complete registration failure cleanup

Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.

Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.

Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.

A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and

    [29 lines not shown]
DeltaFile
+114-37sys/net/iflib.c
+7-3sys/dev/enetc/if_enetc.c
+7-2sys/dev/bnxt/bnxt_en/if_bnxt.c
+5-3sys/dev/vmware/vmxnet3/if_vmx.c
+3-2sys/dev/igc/if_igc.c
+2-0sys/dev/ixgbe/if_sriov.c
+138-471 files not shown
+139-477 files

HardenedBSD/src 57293f4sys/dev/pci pci.c

pci: Do not reconcile MPS across PCI domains

A PCI function can provide a host bridge into a synthetic PCI domain.
Intel VMD does this: the host facing VMD function remains in its
original domain while the hidden Root Ports and endpoints appear in a
separate domain.  The VMD function's Device Control does not describe
an upstream link in that synthetic hierarchy.

The hierarchy wide cold pass incorrectly used the VMD function's MPS
to reprogram the hidden ports and their endpoints.  Stop both cold
reconciliation and runtime path walks at a PCI domain boundary.  The
real Root Ports within the VMD domain continue to reconcile their
endpoints normally.

Reviewed by:    imp
Tested by:      Michael Butler <imb at protected-networks.net>
Fixes:          8e9fe9996a1f ("pci: Reconcile MPS before attaching PCIe devices")
MFC after:      6 days
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58837
DeltaFile
+14-0sys/dev/pci/pci.c
+14-01 files

HardenedBSD/src 2193da1share/man/man3 pthread_create.3

pthread_create(3): fix dead references to racct(2)

As far as I can tell, racct(2) has never existed, not even when
I added these references a decade ago.

Change them as commit e9e615c88a74 did in thr_new(2).

Reported by:    Karlo Miličević <karlo98.m at gmail.com>
DeltaFile
+2-2share/man/man3/pthread_create.3
+2-21 files

HardenedBSD/src 6fa9c2bsys/arm64/arm64 vfp.c

arm64: close a race in SVE register management

While testing an unrelated pmap change, D58708, that dramatically
reduces the number of TLBI instructions performed, and likely the
timing of unrelated events, I started seeing "Storing an invalid VFP
state" panics in vfp_save_state_common().  However, the origin of this
panic is elsewhere, in the else branch of sve_restore_state().
Specifically, my pmap change seems to have increased the likelihood that
the thread executing the else branch would be preempted by another
thread between the critical_exit() inside the else branch's call to
vfp_restore_state_common() and its own call to critical_enter().  Prior
to expanding the scope of the else branch's critical section, the MPASS
added by this change would fire, catching the problem at its source,
rather than later in vfp_save_state_common().

Assisted-by:    Claude Code (Opus 5)
Reviewed by:    kib, markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58723
DeltaFile
+4-2sys/arm64/arm64/vfp.c
+4-21 files

HardenedBSD/src 7753a59sys/netinet6 in6_src.c

netinet6: Fix check for pktinfo outgoing ifindex in route cache

lookup_route is only called for outgoing traffic, therefore
check nh_ifp index instead of nh_aifp as specified by RFC3542 sec 6.

Differential Revision: https://reviews.freebsd.org/D58544
DeltaFile
+1-1sys/netinet6/in6_src.c
+1-11 files

HardenedBSD/src 5549785sys/arm64/arm64 pmap.c

arm64 pmap: use range-based TLBI instructions

Rewrite pmap_s1_invalidate_strided() to use range-based TLBI
instructions when they are when available.  This change can
significantly reduce the number of invalidation instructions
issued, leading to decreased system time.  (More details on the
decrease can be found in the review.)

Assisted-by:    Claude Code (Opus 5)
Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58708
DeltaFile
+189-11sys/arm64/arm64/pmap.c
+189-111 files

HardenedBSD/src 471e142libexec/rc rc.conf, libexec/rc/rc.d nfsd

nfsd: Update the rc.d script for RDMA for the nfsd service

Commit 7144a1d58c5c added the hooks for the nfsrdma.ko module.
Once loaded, this module adds RDMA support to the nfsd.

This patch adds a few lines to /etc/rc.d/nfsd, so that
nfs_server_rdma_enable="YES"
in your /etc/rc.conf will load nfsrdma.ko, so that RDMA
service is enabled.
It also supports
nfs_server_rdma_listen="port#"
so that the default of 20490 can be overridden in /etc/rc.conf.

At this available as time, the nfsrdma.ko module is an unofficial port,
since it was developed by Vinicius Ferrao <ferrao at versatushpc.com.br>
using generative AI.
As soon as it is available, it will be announced on
freebsd-current at freebsd.org.


    [2 lines not shown]
DeltaFile
+7-0libexec/rc/rc.d/nfsd
+2-0libexec/rc/rc.conf
+9-02 files

HardenedBSD/src 73cceb0sys/net iflib.c

iflib: Fix several memory handling issues around iflib_encap()

- Fixed memory leaks around m_dup() not freeing the original chain on
  failure. If we return ENOMEM, we are expected to have freed the
  chain, else the mbuf would be leaked. Also updated iflib_ether_pad()
  to follow the same structure.

- In iflib_parse_header()
    o Fixed a bug where the ip/ip6 and th pointers may point into a
      freed chain after m_pullup.  Those pointers must be reset to
      point into the new chain.

    o Eliminate ENXIO returns for non-TCP TSO sends (which would violate
      the mbuf ownership contract if they could happen). Since they
      cannot happen, I made them assertions instead.

- in iflib_ether_pad(), return ENOMEM after freeing mbuf, so that
  mp_ring knows it is free. An ENOBUFS error will cause the mp_ring
  path to retain the mbuf and retry

    [24 lines not shown]
DeltaFile
+28-22sys/net/iflib.c
+28-221 files

HardenedBSD/src cd0727einclude xlocale.h stdio.h, include/rpc xdr.h

libc: Add <stdio.h> C23 feature test macro

Define the __STDC_VERSION_STDIO_H__ feature test macro now that
the header fully conforms to C23.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58842
DeltaFile
+7-1stand/libsa/geli/geliboot_internal.h
+3-3include/stdio.h
+1-1lib/libgeom/libgeom.h
+1-1lib/libc/xdr/xdr.3
+1-1include/xlocale.h
+1-1include/rpc/xdr.h
+14-81 files not shown
+15-97 files

HardenedBSD/src 10d5a54include stdio.h

libc: Add _PRINTF_NAN_LEN_MAX per C23

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision: https://reviews.freebsd.org/D58842
DeltaFile
+4-0include/stdio.h
+4-01 files

HardenedBSD/src 1cc64bclib/libusb libusb20.3 libusb20_ugen20.c, sys/netipsec key.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+73-60sys/netipsec/key.c
+102-22lib/libusb/libusb20_ugen20.c
+49-32sys/rpc/clnt_bck.c
+62-3lib/libusb/libusb20.3
+23-41usr.sbin/usbconfig/dump.c
+49-2usr.sbin/bhyve/bhyve_config.5
+358-16034 files not shown
+652-20040 files

HardenedBSD/src f0ac102lib/libusb libusb20.3 libusb20_ugen20.c, sys/netipsec key.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+73-60sys/netipsec/key.c
+102-22lib/libusb/libusb20_ugen20.c
+49-32sys/rpc/clnt_bck.c
+62-3lib/libusb/libusb20.3
+23-41usr.sbin/usbconfig/dump.c
+49-2usr.sbin/bhyve/bhyve_config.5
+358-16034 files not shown
+652-20040 files

HardenedBSD/src a61cb9csys/dev/vmware/vmxnet3 if_vmx.c, sys/sys param.h

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+6-1sys/dev/vmware/vmxnet3/if_vmx.c
+1-1sys/sys/param.h
+7-22 files

HardenedBSD/src a257e2dusr.sbin/bhyve bhyve_config.5

bhyve: document missing options in bhyve_config(5)

Document a few options that are currently supported but
not covered in bhyve_config(5):

 - monitor
 - vcpu.N.cpuset
 - domains.N.{size,cpus,domain_policy}
 - console (for arm64 and riscv)

MFC after:              1 week
Reviewed by:            bnovkov, jhb
Sponsored by:           The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58399
DeltaFile
+49-2usr.sbin/bhyve/bhyve_config.5
+49-21 files

HardenedBSD/src 9de55e8sys/sys param.h

Bump __FreeBSD_version to 1501502

Bump the version after the amd64 FRED KBI change was merged to stable/15.

Fixes: 5e1fdbdf938b ("amd64: FRED support")

Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D58743
DeltaFile
+1-1sys/sys/param.h
+1-11 files

HardenedBSD/src 5729a0busr.sbin/pmcstat pmcstat.8

pmcstat.8: Add a missing ERRORS section header

MFC after:      3 days
Sponsored by:   fme AG
DeltaFile
+2-2usr.sbin/pmcstat/pmcstat.8
+2-21 files

HardenedBSD/src 8822ef0sys/dev/clk clknode_if.m

clknode_if.m: fix two typos

One is the parameter name.
DeltaFile
+2-2sys/dev/clk/clknode_if.m
+2-21 files

HardenedBSD/src 89d1553. RELNOTES

RELNOTES: Add an entry for bumping libusb version
DeltaFile
+4-0RELNOTES
+4-01 files

HardenedBSD/src 34bb384. UPDATING, lib/libusb libusb10.c libusb.h

libusb: Bump version to 1.0.27

PR:             296234(exp-run)
Relnotes:       yes
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57772
DeltaFile
+4-0UPDATING
+1-1lib/libusb/libusb10.c
+1-1lib/libusb/libusb.h
+1-1lib/libusb/libusb-1.0.pc.in
+7-34 files

HardenedBSD/src 749318flib/libusb libusb20_int.h libusb20.c, tools/tools/usbtest usbtest.c

libusb: capsicumize libusb

FreeBSD's libusb has three components: libusb01, libusb10, and libusb20.

libusb20 handles communication with character devices. We now requires a
backend context for libusb20. The backend context contains contains the
capsicumized usbctrl fd and usb directory (/dev/usb) fd so that the
library user can enter the capiblity mode safely while using libusb.

libusb10 is updated to support capabilities via a context option. Since
libusb allows general read/write access, we preserve all possible
capabilities when passing backend context to libusb20. It is the
responsibility of the libusb user to call cap_enter() at an appropriate
time.

All base system tools using libusb and libusb20 have been updated to
support Capsicum.

Reviewed by:    adrian, markj

    [2 lines not shown]
DeltaFile
+102-22lib/libusb/libusb20_ugen20.c
+62-3lib/libusb/libusb20.3
+23-41usr.sbin/usbconfig/dump.c
+22-7lib/libusb/libusb20.c
+22-0lib/libusb/libusb20_int.h
+19-0tools/tools/usbtest/usbtest.c
+250-7314 files not shown
+354-9120 files

HardenedBSD/src 7144a1dsys/fs/nfsserver nfs_nfsdserv.c nfs_nfsdkrpc.c, sys/rpc svc_auth.c svc.h

nfsd: Add glue for the nfsrdma.ko module

Thanks to Vinicius Ferrao <versatushpc.com.br>, there
is now a module that implements the server side of RDMA
for the FreeBSD NFS server.

At least for now, it will be maintained as an "unofficial
port" for FreeBSD, since it was built with generative AI
and FreeBSD is working on a policy related to these submissions.

This patch puts the "glue" needed by Vinicius's nfsrdma.ko
module in the system.  This "glue" was written by me without
the use of AI.

The "unofficial port" of nfsrdma.ko will be advertised on
freebsd-current@ as soon as it is available.
(Vinicius's work was sponsored by VersatupHPC.)

Since newnfs_numnfsd is now declared extern in nfs.h,

    [5 lines not shown]
DeltaFile
+49-32sys/rpc/clnt_bck.c
+42-1sys/fs/nfsserver/nfs_nfsdkrpc.c
+27-0sys/rpc/krpc.h
+15-0sys/fs/nfsserver/nfs_nfsdserv.c
+11-0sys/rpc/svc.h
+3-0sys/rpc/svc_auth.c
+147-331 files not shown
+148-337 files

HardenedBSD/src 4b17776sys/compat/freebsd32 freebsd32_misc.c

compat/freebsd32: set uio_rw for trailer's uio in freebsd32_sendfile()

PR:     297516
Reported by:    asomers
Fixes:  dfad790c8cca ("sendfile: stop abusing kern_writev()")
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+2-0sys/compat/freebsd32/freebsd32_misc.c
+2-01 files