HardenedBSD/src b84418fsys/dev/usb usbdevs, usr.sbin/syslogd syslogd.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-0sys/dev/usb/usbdevs
+1-1usr.sbin/syslogd/syslogd.c
+30-13 files

HardenedBSD/src cda272asys/dev/usb usbdevs, usr.sbin/syslogd syslogd.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+7-0sys/dev/usb/usbdevs
+1-1usr.sbin/syslogd/syslogd.c
+30-13 files

HardenedBSD/src 6904270usr.sbin/syslogd syslogd.c, usr.sbin/syslogd/tests syslogd_test.sh

syslogd: Fix ereregex property filters and add test

This change fixes Bug 293879, where ereregex filters in syslogd
did not handle alternation correctly.

The issue appears to come from mixing up two different kinds of
flags: syslogd's internal serialized filter flags in
usr.sbin/syslogd/syslogd.h, and the regex compilation flags from
include/regex.h. ereregex was storing REG_EXTENDED in cmp_flags,
even though cmp_flags is meant to carry syslogd's own FILT_FLAG_*
values for configuration serialization and reconstruction.

REG_EXTENDED has the same bit value as FILT_FLAG_EXCLUDE, so the
filter could be reconstructed with the wrong semantics.

The fix stores FILT_FLAG_EXTENDED instead, allowing syslogd to
correctly REG_EXTENDED when compiling the regex.

A test was also added for both ereregex and !ereregex filters.

    [7 lines not shown]
DeltaFile
+22-0usr.sbin/syslogd/tests/syslogd_test.sh
+1-1usr.sbin/syslogd/syslogd.c
+23-12 files

HardenedBSD/src e7de7fesys/dev/usb usbdevs

usbdevs: Add USB device IDs for Nuand bladeRF SDR

Add vendor and product IDs for bladeRF family of USB software defined radios manufactured by Nuand LLC.

Reviewed by:    imp, adrian
Differential Revision:  https://reviews.freebsd.org/D54733
DeltaFile
+7-0sys/dev/usb/usbdevs
+7-01 files

HardenedBSD/src 528c683sys/fs/nfsserver nfs_nfsdsocket.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src 77d0196sys/fs/nfsserver nfs_nfsdsocket.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src b65e7b4sys/fs/nfsserver nfs_nfsdsocket.c

nfs_nfsdsocket.c: All Copy and Clone across file systems

For some server file system types, such as ZFS, a Copy/Clone
operation can be done across file systems of the same file
system type.

As such, this patch allows the Copy/Clone to be attempted
when the file handles are for files on different file systems.

This fixes a problem for exported ZFS file systems when a
copy_files on file_range(2) between file systems in the same
NFSv4 mount is attempted.

PR:     294010
MFC after:      2 weeks
DeltaFile
+2-1sys/fs/nfsserver/nfs_nfsdsocket.c
+2-11 files

HardenedBSD/src f2921earelease Makefile, release/scripts HardenedBSD_install_cdrom.conf pkgbase-stage.lua

HBSD: Build framework updates

In preparing the next quarterly build (2026q2), I discovered that
HardenedBSD 15-STABLE is lagging behind with regards to building the
installer images. This commit brings us more up-to-date and fixes the
build.

This is a direct commit to 15-STABLE.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+10-36release/Makefile
+7-11usr.sbin/bsdinstall/scripts/pkgbase.in
+15-0release/scripts/HardenedBSD_install_cdrom.conf
+3-7release/scripts/pkgbase-stage.lua
+4-0release/scripts/HardenedBSD-base-offline.conf
+39-545 files

HardenedBSD/src 30e2162lib/libc/gen dup3.3, lib/libsys dup.2

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-5usr.bin/diff/pr.c
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+10-124 files

HardenedBSD/src 0253f52lib/libc/gen dup3.3, lib/libsys dup.2

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-5usr.bin/diff/pr.c
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+10-124 files

HardenedBSD/src 6cc99balib/libc/gen dup3.3, lib/libsys dup.2

dup(2): document the handling of filedescriptor flags

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D56121
DeltaFile
+4-1lib/libsys/dup.2
+2-0lib/libc/gen/dup3.3
+6-12 files

HardenedBSD/src c8d40bfusr.bin/diff pr.c

diff: use O_CLOEXEC on pipes

This only simplifies the code, no functional changes expected

MFC After:      1 week
DeltaFile
+2-5usr.bin/diff/pr.c
+2-51 files

HardenedBSD/src 945e60eusr.bin/diff3 diff3.c

diff3: set O_CLOEXEC on pipes

This avoid leaking pipe fd in children and simplifies the code

MFC After:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56120
DeltaFile
+2-6usr.bin/diff3/diff3.c
+2-61 files

HardenedBSD/src 2bcf220sys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/src 01d69basys/contrib/xen/arch-x86 cpuid.h, sys/dev/hyperv/vmbus/x86 hyperv_reg.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+52-0sys/x86/x86/local_apic.c
+31-6sys/x86/x86/io_apic.c
+35-0sys/x86/include/bhyve.h
+9-2sys/x86/x86/msi.c
+7-0sys/contrib/xen/arch-x86/cpuid.h
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+140-87 files not shown
+154-1313 files

HardenedBSD/src 7b6be00sys/dev/hyperv/vmbus/x86 hyperv_reg.h, sys/x86/x86 local_apic.c

Hyper-V: Detect Extended Destination ID support

Hyper-V advertises support for the Extended Destination ID standard via
bit 2 of the value returned in the EAX register when the hypervisor
stack properties are queried via CPUID.

This is based on a commit to the Linux kernel, as there does not seem
to be any other documentation of this feature.

Reviewed by:    Souradeep Chakrabarti
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55432
DeltaFile
+9-0sys/x86/x86/local_apic.c
+6-0sys/dev/hyperv/vmbus/x86/hyperv_reg.h
+15-02 files

HardenedBSD/src 8dd9a0dsys/x86/x86 local_apic.c

Bhyve: Detect Extended Destination ID support

Bhyve advertises support for the Extended Destination ID standard via
bit 0 (aka CPUID_BHYVE_FEAT_EXT_DEST_ID) of the value returned in the
EAX register when Bhyve features are queried via CPUID.

MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55431
DeltaFile
+8-0sys/x86/x86/local_apic.c
+8-01 files

HardenedBSD/src 49b6254sys/amd64/vmm x86.c, sys/x86/include bhyve.h

vmm: Move defines from x86.c to x86/bhyve.h

The values CPUID_BHYVE_FEATURES and CPUID_BHYVE_FEAT_EXT_DEST_ID are
useful for guests, not just hosts; so they belong in a header file in
sys/x86/include rather than simply in the .c file implementing the
bhyve host side.

The original addition of these defines took place without adding a
copyright statement, but since I'm moving them into a new file I've
added the original author's standard copyright (Amazon).

MFC after:      3 weeks
Fixes:  313a68ea20b4 ("bhyve: Add CPUID_BHYVE_FEATURES leaf")
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55430
DeltaFile
+35-0sys/x86/include/bhyve.h
+1-4sys/amd64/vmm/x86.c
+36-42 files

HardenedBSD/src 9b18ba2sys/x86/x86 local_apic.c

Xen: Detect Extended Destination ID support

Xen advertises support for the Extended Destination ID standard via
bit 5 (aka XEN_HVM_CPUID_EXT_DEST_ID) of the value returned in the
EAX register when Xen features are queried via CPUID.

MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55429
DeltaFile
+6-0sys/x86/x86/local_apic.c
+6-01 files

HardenedBSD/src 8c986d1sys/contrib/xen/arch-x86 cpuid.h

x86/cpuid: add CPUID flag for Extended Destination ID support

Introduce the CPUID flag to be used in order to signal the support for
using an extended destination ID in IO-APIC RTEs and MSI address
fields. Such format expands the maximum target APIC ID from 255 to
32768 without requiring the usage of interrupt remapping.

The design document describing the feature can be found at:

http://david.woodhou.se/15-bit-msi.pdf

Signed-off-by: Roger Pau Monné <roger.pau at citrix.com>
Reviewed-by: Jan Beulich <jbeulich at suse.com>
DeltaFile
+7-0sys/contrib/xen/arch-x86/cpuid.h
+7-01 files

HardenedBSD/src 9ab5aa3sys/x86/include kvm.h, sys/x86/x86 local_apic.c

KVM: Detect Extended Destination ID support

KVM advertises support for the Extended Destination ID standard via
bit 15 of the value returned in the EAX register when KVM features
are queried via CPUID.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55427
DeltaFile
+11-0sys/x86/x86/local_apic.c
+1-0sys/x86/include/kvm.h
+12-02 files

HardenedBSD/src b0e1b10sys/x86/include apicvar.h, sys/x86/x86 io_apic.c

io_apic: Support APIC Extended Destination IDs

If APIC Extended Destination ID support is enabled, use it in APIC RTEs
by allowing APIC IDs up to 2^15 - 1 and encoding the high bits into
Intel "reserved" bits per the standard.

Reviewed by:    kib
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55889
DeltaFile
+7-0sys/x86/x86/io_apic.c
+1-0sys/x86/include/apicvar.h
+8-02 files

HardenedBSD/src 02f29c1sys/x86/x86 msi.c

msi: Support APIC Extended Destination IDs

If APIC Extended Destination ID support is enabled, use it in MSIs by
allowing APIC IDs up to 2^15 - 1 and encoding the high bits into
Intel "reserved" bits per the standard.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55426
DeltaFile
+9-2sys/x86/x86/msi.c
+9-21 files

HardenedBSD/src d9db6d7sys/x86/include apicvar.h, sys/x86/x86 local_apic.c

x86: Add stub for Extended Destination ID support

Without an IOMMU, the APIC standard only allows 8 bits of Destination
ID for MSI messages, limiting us to 256 CPUs.  While IOMMUs can allow
for more than 256 CPUs to be supported, they are not necessarily
desirable in virtualized environments.

The Extended Destination ID standard authored by David Woodhouse uses
7 "Reserved" bits for the high bits of a 15-bit Extended Destination
ID in order to address this: http://david.woodhou.se/ExtDestId.pdf

Add a loader tunable machdep.apic_ext_dest_id to control the use of
this feature; the default value (-1) means "autodetect" while 0 and
1 mean disabled and enabled respectively.

Code to detect host support in Xen, Hyper-V, KVM, and Bhyve will come
in future commits, as will the code to use this setting in msi_map and
ioapic_program_intpin.


    [4 lines not shown]
DeltaFile
+15-0sys/x86/x86/local_apic.c
+1-0sys/x86/include/apicvar.h
+16-02 files

HardenedBSD/src 5809c9asys/x86/x86 io_apic.c

io_apic: Don't route to APIC ID > 255

I/O APIC Redirection Table Entries use 8 bits to encode the Destination
ID.  Attempting to route an IRQ to a higher APIC ID would result in it
being silently routed to the value reduced modulo 256, causing a panic
if the IRQ fired since the receiving CPU would not expect that IRQ.

Instead, print a warning and mark the interrupt as invalid, resulting
in it being forcibly masked.

Reviewed by:    kib
Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55857
DeltaFile
+13-3sys/x86/x86/io_apic.c
+13-31 files

HardenedBSD/src 1d0ccd6sys/x86/x86 io_apic.c

x86: Add struct ioapic_intsrc.io_valid

As of this commit, io_valid is always set to 1; but a future commit
will set it to 0, at which point IOART_INTMSET will be set to forcibly
disable interrupt sources regardless of whether they are requested to
be "masked".

Reviewed by:    kib
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D56006
DeltaFile
+11-3sys/x86/x86/io_apic.c
+11-31 files

HardenedBSD/src f350063sys/x86/x86 local_apic.c

clapic_handle_intr: KASSERT isrc != NULL

If an interrupt arrives at a CPU which isn't expecting that particular
vector, intr_lookup_source will return an isrc of NULL and we'll panic
when intr_execute_handlers increments *isrc->is_count.

Place a KASSERT a few nanoseconds earlier in order to leave some more
breadcrumbs for the next person to trip over this behaviour.

Tested on:      EC2 r8i.96xlarge
MFC after:      3 weeks
Sponsored by:   Amazon
Differential Revision:  https://reviews.freebsd.org/D55851
DeltaFile
+3-0sys/x86/x86/local_apic.c
+3-01 files

HardenedBSD/src 72bb61bsys/amd64/conf NOTES, sys/x86/conf NOTES

i386/amd64/NOTES: Add some missing devices

The following devices to x86: ocs_fc aq vge tws
And this to amd64: ufshci

These are in GENERIC, but not NOTES.

Sponsored by:           Netflix
DeltaFile
+5-0sys/x86/conf/NOTES
+3-0sys/amd64/conf/NOTES
+8-02 files

HardenedBSD/src ccc235fsys/dev/vmgenc vmgenc_acpi.c

vmgenc: fix typo in MODULE_DEPEND declaration

The random_harvestq dependency was registered under the misspelled
name "vemgenc" instead of "vmgenc", causing the dependency to not
be associated with the correct module.

Signed-off-by: Christos Longros <chris.longros at gmail.com>
Reviewed by: cem, imp
Differential Revision:  https://reviews.freebsd.org/D56012
DeltaFile
+1-1sys/dev/vmgenc/vmgenc_acpi.c
+1-11 files

HardenedBSD/src e0af444sys/net rtsock.c route.h, sys/net/route route_ctl.c nhop_ctl.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+50-0tests/sys/netinet6/ndp.sh
+2-36sys/net/route/route_ctl.c
+13-21sys/netlink/route/rt.c
+10-22sys/net/rtsock.c
+0-17sys/net/route.h
+4-13sys/net/route/nhop_ctl.c
+79-10941 files not shown
+120-22147 files