HardenedBSD/src ca1b2d6lib/libpmc libpmc.c pmc.perf.3, sys/arm64/acpica acpi_iort.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+360-0sys/dev/hwpmc/hwpmc_perf.c
+129-15sys/arm64/acpica/acpi_iort.c
+132-0lib/libpmc/pmc.perf.3
+57-52sys/arm64/include/armreg.h
+22-22sys/arm64/arm64/identcpu.c
+31-0lib/libpmc/libpmc.c
+731-8930 files not shown
+889-13836 files

HardenedBSD/src 74a7968release/tools vmimage.subr, sys/netpfil/pf pf_lb.c pf.c

Merge remote-tracking branch 'rad/hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+15-10sys/netpfil/pf/pf.c
+9-5usr.sbin/syslogd/syslogd.c
+10-1sys/netpfil/pf/pf_lb.c
+7-0usr.sbin/syslogd/tests/syslogd_test.sh
+1-1release/tools/vmimage.subr
+42-175 files

HardenedBSD/src 54d67b6lib/libpmc libpmc.c pmc.perf.3, sys/arm64/acpica acpi_iort.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+360-0sys/dev/hwpmc/hwpmc_perf.c
+129-15sys/arm64/acpica/acpi_iort.c
+132-0lib/libpmc/pmc.perf.3
+57-52sys/arm64/include/armreg.h
+22-22sys/arm64/arm64/identcpu.c
+31-0lib/libpmc/libpmc.c
+731-8930 files not shown
+889-13836 files

HardenedBSD/src b31db8dsbin/ipfw ipfw.8

ipfw.8: more grammar fixes
DeltaFile
+3-3sbin/ipfw/ipfw.8
+3-31 files

HardenedBSD/src b891252sbin/ipfw ipfw.8

ipfw.8: whitespace police
DeltaFile
+1-1sbin/ipfw/ipfw.8
+1-11 files

HardenedBSD/src 055a726sbin/ipfw ipfw.8

ipfw.8: grammar
DeltaFile
+8-8sbin/ipfw/ipfw.8
+8-81 files

HardenedBSD/src d20f2ddrelease/tools vmimage.subr

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-4release/tools/vmimage.subr
+0-41 files

HardenedBSD/src 467c3cbrelease/tools vmimage.subr, sys/netpfil/pf pf_lb.c pf.c

Merge remote-tracking branch 'rad/freebsd/15-stable/main' into hardened/15-stable/main

Conflicts:
        release/tools/vmimage.subr (unresolved)
DeltaFile
+15-10sys/netpfil/pf/pf.c
+9-5usr.sbin/syslogd/syslogd.c
+10-1sys/netpfil/pf/pf_lb.c
+7-0usr.sbin/syslogd/tests/syslogd_test.sh
+4-0release/tools/vmimage.subr
+45-165 files

HardenedBSD/src 5369f8elib/libpmc libpmc.c pmc.perf.3, sys/dev/hwpmc hwpmc_amd.c hwpmc_intel.c

hwpmc: add MPERF/APERF MSR support for AMD/Intel CPUs

Add support for reading the MPERF (MSR 0xE7) and APERF (MSR 0xE8)
model-specific registers on AMD/Intel CPUs through hwpmc(4). These
counters track maximum and actual performance frequency respectively,
and are used to compute effective CPU frequency scaling independent
of the nominal TSC rate. The name of the class was chosen as PERF
because later support for other PERF MSRs can be added to the same
class.

Extend libpmc(3) to expose the AMD/Intel MPERF/APERF counters added
to hwpmc(4) in the companion kernel change, so userland consumers
(pmcstat(8), etc.) can allocate and read these events by name.

Document the new PERF class and its MPERF/APERF counters in a new
pmc.perf.3 manual page, describing their semantics and how to read
them via pmc(3) and pmcstat(8).

Bump PMC_VERSION_MINOR.

    [6 lines not shown]
DeltaFile
+360-0sys/dev/hwpmc/hwpmc_perf.c
+132-0lib/libpmc/pmc.perf.3
+31-0lib/libpmc/libpmc.c
+28-0sys/dev/hwpmc/hwpmc_perf.h
+18-0sys/dev/hwpmc/hwpmc_intel.c
+16-0sys/dev/hwpmc/hwpmc_amd.c
+585-07 files not shown
+613-313 files

HardenedBSD/src 7324487tools/boot universe.sh

universe.sh: don't overwrite no_zfs's build log

Give the WITHOUT_LOADER_BIOS_TEXTONLY build its own log file.
DeltaFile
+1-1tools/boot/universe.sh
+1-11 files

HardenedBSD/src 0e3dae1tests/sys/fs/fusefs utils.cc Makefile

tests/fusefs: fix the build with gcc 16

Reviewed by:    asomers
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+7-0tests/sys/fs/fusefs/Makefile
+1-1tests/sys/fs/fusefs/utils.cc
+8-12 files

HardenedBSD/src 84eac60sbin/pfctl pfctl.8

pfctl(8): Remove superflous parenthesis

Since apropos(8) uses case-insensitive regular expressions by default
for both manpage names and descriptions, pfctl appears in results
regardless of the parenthetical initialism.

MFC after:      1 week
Reported by:    ziaee@
DeltaFile
+1-1sbin/pfctl/pfctl.8
+1-11 files

HardenedBSD/src e780051sys/dev/tpm tpm_crb.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+88-29sys/dev/tpm/tpm_crb.c
+88-291 files

HardenedBSD/src 0a74a38sys/dev/tpm tpm_crb.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+88-29sys/dev/tpm/tpm_crb.c
+88-291 files

HardenedBSD/src 6af3031sys/dev/tpm tpm_crb.c

tpm: crb: make the Pluton startmethod more resilient

The original implementation assumed that the start/reply doorbells
lived within the device _CRS space, but that isn't always the case.  On
my AMD Ryzen 7640U-based frame.work laptop, device memory runs from
0xc0500000-0xc0500fff while the doorbells are up around 0xc0508000.

Stop sanity checking the addresses and just map them in to work reliably
whether they're within the device range or not.

pluton_wait_reply is cribbed from tpm_wait_for_u32, but rewritten
slightly to read in just one place and to read one last time before
giving up at the end of the timeout, just in case.

Reviewed by:    kbowling
Differential Revision:  https://reviews.freebsd.org/D59327
DeltaFile
+88-29sys/dev/tpm/tpm_crb.c
+88-291 files

HardenedBSD/src 74c5995usr.sbin/syslogd/tests syslogd_test.sh

syslogd/tests: Amend a test to catch leaked process descriptors

This serves to catch the regression fixed by commit
1a669b66ddb4 ("syslogd: reap pipe children on config reload").

MFC after:      1 week

(cherry picked from commit 231dfc99a08874c269593c2e491ce16a618f4ed6)
DeltaFile
+7-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-01 files

HardenedBSD/src 8cf0058usr.sbin/syslogd syslogd.c

syslogd: reap pipe children on config reload

On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running.  close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue.  When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.

Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.

Reviewed by:    markj
Fixes:  95381c0139d6 (syslogd: Use process descriptors)
Differential Revision:  https://reviews.freebsd.org/D59319

(cherry picked from commit 1a669b66ddb4748c24116e32dcb51eabaf4859ed)
DeltaFile
+9-5usr.sbin/syslogd/syslogd.c
+9-51 files

HardenedBSD/src 266331csys/netpfil/pf pf_lb.c pf.c

pf: Re-optimize state key handling

pf states may be looked up using one of two keys: the stack key or the
wire key.  For states involving address translation, these will be
distinct; the stack key describes the addresses seen by the local
network stack, and the wire key has the translated addresses.

Historically, pf would avoid allocating separate keys if both are
identical.  This changed in commit fcdb520c1b4e ("pf: nat64") to always
allocate separate state key structures.  Incidentally, OpenBSD seems to
maintain the optimization, but also has an explicit reference count
embedded in state keys.

The change breaks another optimization: pf_state_key_attach() still uses
state key pointer equality to check whether the stack and wire keys are
equal, so those checks are always false after the aforementioned commit.
Thus we never skip the second key lookup, even when that's possible
(i.e., no address translation is involved).


    [15 lines not shown]
DeltaFile
+15-10sys/netpfil/pf/pf.c
+10-1sys/netpfil/pf/pf_lb.c
+25-112 files

HardenedBSD/src 2eb83e9tools/boot universe.sh

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+13-1tools/boot/universe.sh
+13-11 files

HardenedBSD/src e928f18tools/boot universe.sh

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+13-1tools/boot/universe.sh
+13-11 files

HardenedBSD/src 1de79e7tools/boot universe.sh

universe.sh: add MK_BEARSSL build

BEARSSL is disabled by default, add this here to make sure it doesn't
break.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D59516
DeltaFile
+12-0tools/boot/universe.sh
+12-01 files

HardenedBSD/src bac0daatools/boot universe.sh

universe.sh: build with 1.5 * ncpu jobs

Build with 1.5 * ncpu jobs instead of hardcoding 40.

Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D59515
DeltaFile
+1-1tools/boot/universe.sh
+1-11 files

HardenedBSD/src a63319erelease/tools vmimage.subr

vmimage.subr: Use makefs -N

By default, makefs uses the host environment's user and group databases
when creating filesystems.  This causes makefs to fail when trying to
create files owned by users or groups which don't exist in the host
environment, for example when creating a VM with packages pre-installed
which added their own users/groups.

Pass "-N ${DESTDIR}/etc" to makefs to point it at the user and group
databases from the image being created.

MFC after:      1 week
Sponsored by:   Amazon

(cherry picked from commit 7ca0c1eba2e4c49ac92499ef0f6adf27c8b930d4)
DeltaFile
+1-1release/tools/vmimage.subr
+1-11 files

HardenedBSD/src 254c62elib/msun Makefile, lib/msun/amd64 Makefile.inc s_fmaf_avx.S

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+24-0lib/msun/amd64/s_fmaf_avx.S
+24-0lib/msun/amd64/s_fma_avx.S
+10-1lib/msun/src/s_fmaf.c
+10-1lib/msun/src/s_fma.c
+5-4lib/msun/Makefile
+8-1lib/msun/amd64/Makefile.inc
+81-76 files

HardenedBSD/src b0bff66lib/msun Makefile, lib/msun/amd64 Makefile.inc s_fmaf_avx.S

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+24-0lib/msun/amd64/s_fmaf_avx.S
+24-0lib/msun/amd64/s_fma_avx.S
+10-1lib/msun/src/s_fmaf.c
+10-1lib/msun/src/s_fma.c
+5-4lib/msun/Makefile
+8-1lib/msun/amd64/Makefile.inc
+81-76 files

HardenedBSD/src 18a5549lib/msun/amd64 Makefile.inc s_fma_avx.S, lib/msun/src s_fmaf.c s_fma.c

lib/msun amd64: use AVX FMA instructions for fma(3) and fmaf(3) when available

Utilize the ARCHLEVEL framework from libc/amd64/string to provide the
way for runtime selection of the implementation, if wanted.

Reviewed by:    fuz, kfv
Discussed with: kargl
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59462
DeltaFile
+24-0lib/msun/amd64/s_fma_avx.S
+24-0lib/msun/amd64/s_fmaf_avx.S
+10-1lib/msun/src/s_fmaf.c
+10-1lib/msun/src/s_fma.c
+8-1lib/msun/amd64/Makefile.inc
+76-35 files

HardenedBSD/src b45fd24lib/msun Makefile

lib/msun: move the calculation of LIBC_SRCTOP earlier

which makes the variable available for machine/Makefile.inc usage.

Reviewed by:    fuz, kfv
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59462
DeltaFile
+5-4lib/msun/Makefile
+5-41 files

HardenedBSD/src 252d9e5usr.bin/sort sort.1.in

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+1-1usr.bin/sort/sort.1.in
+1-11 files

HardenedBSD/src 59c57d1usr.bin/sort sort.1.in

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+1-1usr.bin/sort/sort.1.in
+1-11 files

HardenedBSD/src 4fb4be7usr.bin/sort sort.1.in

sort.1: Fix default memory buffer size

PR:             261496
Fixes:          554442439dd0 ("Change the memory heuristics")
MFC after:      3 days
Reported by:    wosch
DeltaFile
+1-1usr.bin/sort/sort.1.in
+1-11 files