HardenedBSD/src 90de72bsbin/pfctl pfctl.c, sys/netpfil/pf pf_ioctl.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+94-9sys/netpfil/pf/pf_ioctl.c
+38-0tests/sys/netpfil/pf/pass_block.sh
+2-2sbin/pfctl/pfctl.c
+134-113 files

HardenedBSD/src 6900d8brelease/packages/ucl libsdp-all.ucl

packages: Remove stale libsdp-all.ucl

This package no longer exists since it was merged into bluetooth.

Fixes:  41ee4321cc52 ("libsdp: Move to bluetooth-lib package")
MFC after:      3 days
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D55822
Sponsored by:           https://www.patreon.com/bsdivy
DeltaFile
+0-28release/packages/ucl/libsdp-all.ucl
+0-281 files

HardenedBSD/src ea25f49release/packages/ucl ftpd-all.ucl

packages: Remove stale ftpd-all.ucl

This file was missed when ftpd(8) was removed.

Fixes:  614c8750ce11 ("Remove ftpd(8)")
MFC after:      3 days
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D55820
Sponsored by:           https://www.patreon.com/bsdivy
DeltaFile
+0-4release/packages/ucl/ftpd-all.ucl
+0-41 files

HardenedBSD/src 4311217sys/netpfil/pf pf_ioctl.c

pf: include all elements when hashing rules

MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit c6bcf6e6fd507d952a48226b51cc161b8ef972a2)
DeltaFile
+93-9sys/netpfil/pf/pf_ioctl.c
+93-91 files

HardenedBSD/src e224b9bsbin/pfctl pfctl.c

pfctl: always warn if a duplicate rule was detected

MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 66d66dd0f6f83926980fc1d68dd366c0057350c5)
DeltaFile
+2-2sbin/pfctl/pfctl.c
+2-21 files

HardenedBSD/src 4e00773tests/sys/netpfil/pf pass_block.sh

pf tests: verify that we handle address range rules correctly

There's been a problem where rules which differed only in address ranges
were considered duplicates and not added. Test for this.

MFC after:      1 week
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit ab74151e8d097b263237942c0b12277098bc9533)
DeltaFile
+38-0tests/sys/netpfil/pf/pass_block.sh
+38-01 files

HardenedBSD/src 38f8ac5sys/netpfil/pf pf_ioctl.c

pf: Fix hashing of IP address ranges

This corrects the false detection of duplicate rules.

MFC after:      1 week
Reviewed by:    kp

(cherry picked from commit 1fa873c93c8b08561c53107c7b90c53dfad30ddc)
DeltaFile
+1-0sys/netpfil/pf/pf_ioctl.c
+1-01 files

HardenedBSD/src 746d6b2lib/libc/stdlib realpath.3 realpath.c, sys/dev/nvmf/controller nvmft_controller.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+12-24lib/libc/stdlib/realpath.3
+7-3lib/libc/stdlib/realpath.c
+1-1sys/dev/nvmf/controller/nvmft_controller.c
+20-283 files

HardenedBSD/src 61f7813stand defs.mk

stand: Force disable RETPOLINE for boot loaders

Boot loaders do not require speculative execution protection, and may be
too large if enabled.

Reported by:    Shawn Webb
Reviewed by:    dim, imp
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56068
DeltaFile
+1-0stand/defs.mk
+1-01 files

HardenedBSD/src 615f1b9sys/amd64/amd64 machdep.c

kern/amd64/machdep: Replace memset in wrmsr_early_safe_end

GENERIC-KASAN kernel failed to boot on a Dell PowerEdge C6615 with
an AMD EPYC 8224P CPU; UEFI BIOS caught a #GP exception with %RIP
in kasan_memset where %GS relative pointer (curthread->td_pflags2)
was dereferenced. Investigation led to wrmsr_early_safe_end which
calls memset to clear early #GP IDT entry. Replacing memset with
__builtin_memset_inline still resulted in the compiler emitting a
call to the memset resolver in GENERIC-KASAN build and the kernel
stil faulted during boot. This version which has been successfully
tested with both GENERIC and GENERIC-KASAN kernels uses memset_early.

Signed-off-by: Kristofer Peterson <kris at tranception.com>
Reviewed-by: kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2069
DeltaFile
+1-1sys/amd64/amd64/machdep.c
+1-11 files

HardenedBSD/src b1d3252sys/dev/nvmf/controller nvmft_controller.c

nvmf: Fix null ptr reference

Reported by:    Nikolay Denev <ndenev at gmail.com>
Reviewed by:    imp, jhb
Differential Revision:  https://reviews.freebsd.org/D55863

(cherry picked from commit 09c5bb35425bc70573c007e7f7e82be286677a87)
DeltaFile
+1-1sys/dev/nvmf/controller/nvmft_controller.c
+1-11 files

HardenedBSD/src 930a790share/man/man4 rge.4, sys/dev/rge if_rge_sysctl.c if_rge.c

rge: make rx_process_limit a sysctl tunable

The number of packets processed per interrupt was hardcoded to 16.
Add a per-interface sysctl dev.rge.%d.rx_process_limit tunable so
users can adjust this value at runtime.

Signed-off-by: Christos Longros <chris.longros at gmail.com>

Reviewed by:    ziaee, adrian
Differential Revision:  https://reviews.freebsd.org/D56014
DeltaFile
+5-0share/man/man4/rge.4
+5-0sys/dev/rge/if_rge_sysctl.c
+2-1sys/dev/rge/if_rge.c
+2-0sys/dev/rge/if_rgevar.h
+14-14 files

HardenedBSD/src 8f36a01share/man/man4 rge.4

rge.4: fix incorrect speed range in HARDWARE section

The HARDWARE section stated "PCIe 1GB to 1GB Ethernet devices"
which is incorrect. The RTL8125/8126/8127 chips support speeds
from 1Gbps to 10Gbps. Correct the range.

Signed-off-by: Christos Longros <chris.longros at gmail.com>

rge.4: note that the driver manages PHY directly

The rge(4) driver does not use the miibus(4) interface for PHY
management. Instead, it accesses PHY registers directly via the
chip's OCP (On-Chip Peripheral) bus. Document this in the
DESCRIPTION section.

Signed-off-by: Christos Longros <chris.longros at gmail.com>

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D55995
DeltaFile
+17-2share/man/man4/rge.4
+17-21 files

HardenedBSD/src f7fd4e7sys/dev/rge if_rge.c if_rgevar.h

rge: handle interface flags changes

Handle interface flags like other drivers do.

Reviewed by:    zlei, adrian
Differential Revision:  https://reviews.freebsd.org/D55728
DeltaFile
+9-14sys/dev/rge/if_rge.c
+2-0sys/dev/rge/if_rgevar.h
+11-142 files

HardenedBSD/src 8e987f8lib/libc/stdlib realpath.3

realpath: Improve manual page

* Try to make the RETURN VALUES section flow better.

* Add basename(3), dirname(3), free(3) to the SEE ALSO section.

* Drop the CAVEATS section, which was obsolete the moment realpath(3)
  was added to the Single Unix Specification in 1994.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D55928

(cherry picked from commit 1aecb32021ce46d812db36b9037cdc6f423575f9)
DeltaFile
+12-24lib/libc/stdlib/realpath.3
+12-241 files

HardenedBSD/src f174c04lib/libc/stdlib realpath.c

realpath: Improve prev_len logic

* Save prev_len after having checked for and appended a trailing slash,
  not before.  This requires us to back up if we end up returning a
  partial result, but previously we would sometimes return a partial
  result with a trailing slash and sometimes without.

* Replace strlcat() with a faster strlcpy() since we know exactly how
  far into the buffer we are.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D55914

(cherry picked from commit 99d295e471bc362a7927047c89472e1ee2d0da6b)
DeltaFile
+7-3lib/libc/stdlib/realpath.c
+7-31 files

HardenedBSD/src 41474e7usr.bin/m4 eval.c look.c

m4: Misc style fixes

MFC after:      1 week

Reviewed by:    fuz
Differential Revision:  https://reviews.freebsd.org/D55794
DeltaFile
+9-9usr.bin/m4/eval.c
+9-8usr.bin/m4/look.c
+5-7usr.bin/m4/misc.c
+2-3usr.bin/m4/main.c
+1-1usr.bin/m4/expr.c
+1-1usr.bin/m4/mdef.h
+27-296 files

HardenedBSD/src f8f6f1cusr.bin/m4 eval.c mdef.h

m4: Stop abbreviating builtin names

* Stop abbreviating macro names half-randomly to 8 chars, this is no
  longer 1990.

* Likewise for function names (in particular use doindex for a function
  that is notably different from the classic index function).

* Rename a few things for more fidelity: eval is the builtin name, not
  expr and your maketemp/mkstemp conform to mkstemp semantics for better
  security.

* Rewrap a few comments that were ludicrously short.

No functional changes except improved accuracy of some error messages.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D55793
DeltaFile
+86-98usr.bin/m4/eval.c
+44-44usr.bin/m4/mdef.h
+33-32usr.bin/m4/main.c
+3-3usr.bin/m4/look.c
+1-1usr.bin/m4/extern.h
+1-1usr.bin/m4/misc.c
+168-1796 files

HardenedBSD/src 8243aa2. ObsoleteFiles.inc, sys/netinet tcp_usrreq.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+113-0tests/sys/netinet/tcp_socket.c
+0-80tests/sys/netinet/tcp_implied_connect.c
+8-8sys/netinet/tcp_usrreq.c
+5-4sys/security/mac_do/mac_do.c
+3-0ObsoleteFiles.inc
+1-1tests/sys/netinet/Makefile
+130-936 files

HardenedBSD/src d6f1ba1. ObsoleteFiles.inc, sys/netinet tcp_usrreq.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+113-0tests/sys/netinet/tcp_socket.c
+0-80tests/sys/netinet/tcp_implied_connect.c
+8-8sys/netinet/tcp_usrreq.c
+5-4sys/security/mac_do/mac_do.c
+3-0ObsoleteFiles.inc
+1-1tests/sys/netinet/Makefile
+130-936 files

HardenedBSD/src 769a6f8sys/netinet tcp_usrreq.c

tcp_usrreq: Only allocate TFO counter when required

During tcp_usr_listen(), only allocate TFO counter when required.

Reviewed by: tuexen, glebius
Differential Revision: https://reviews.freebsd.org/D56067
DeltaFile
+8-8sys/netinet/tcp_usrreq.c
+8-81 files

HardenedBSD/src cd05c88. ObsoleteFiles.inc, tests/sys/netinet tcp_socket.c tcp_implied_connect.c

tests/netinet: add test for getsockname() on a disconnected TCP socket

Stack it into existing file that exercises an other corner case of our
TCP and rename the file to a more generic name.
DeltaFile
+113-0tests/sys/netinet/tcp_socket.c
+0-80tests/sys/netinet/tcp_implied_connect.c
+3-0ObsoleteFiles.inc
+1-1tests/sys/netinet/Makefile
+117-814 files

HardenedBSD/src 7959f85sys/conf files, sys/netinet6 in6_mcast.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+4-4sys/netinet6/in6_mcast.c
+1-1sys/conf/files
+5-52 files

HardenedBSD/src f2c03e4sys/conf files, sys/netinet6 in6_mcast.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+4-4sys/netinet6/in6_mcast.c
+1-1sys/conf/files
+5-52 files

HardenedBSD/src e2083e8sys/conf files, sys/dev/ufshci ufshci_acpi.c ufshci_ctrlr.c

ufshci: Support ACPI

Supports UFS host controller attachment via ACPI. Tested on the
Samsung Galaxy Book 4 Edge using Qualcomm Snapdragon X Elite.
Additionally, a quirk related to power mode change has been added.

For reference, it doesn't reach maximum speed yet. I plan to improve
it later.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D55986
DeltaFile
+248-0sys/dev/ufshci/ufshci_acpi.c
+62-9sys/dev/ufshci/ufshci_ctrlr.c
+9-3sys/dev/ufshci/ufshci_private.h
+3-0sys/modules/ufshci/Makefile
+2-1sys/conf/files
+324-135 files

HardenedBSD/src 0850284share/man/man4 ufshci.4, sys/dev/ufshci ufshci_sysctl.c ufshci_dev.c

ufshci: add uic powermode parameter to sysctl

Adds parameters related to the performance of the UFS device.
Also update man page for the missing sysctl entries.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D55985
DeltaFile
+30-5sys/dev/ufshci/ufshci_sysctl.c
+33-1share/man/man4/ufshci.4
+7-5sys/dev/ufshci/ufshci_dev.c
+2-1sys/dev/ufshci/ufshci_private.h
+1-2sys/dev/ufshci/ufshci_pci.c
+73-145 files

HardenedBSD/src c438698sys/dev/ufshci ufshci_req_sdb.c

ufshci: fix bug in ufshci_req_sdb_enable

When enabling the request queue, safely reset the list base address.
This was added due to a quirk in the Qualcomm UFS controller during
the process of activating it.

Sponsored by:           Samsung Electronics
Reviewed by:            imp (mentor)
Differential Revision:  https://reviews.freebsd.org/D55984
DeltaFile
+36-4sys/dev/ufshci/ufshci_req_sdb.c
+36-41 files

HardenedBSD/src 82a066bsys/conf files

snd_dummy: Fix sys/conf/files entry

Fixes:          72e85a4d977e ("snd_dummy: Add to sys/conf/files and sys/conf/NOTES")
Report by:      CI
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D56065
DeltaFile
+1-1sys/conf/files
+1-11 files

HardenedBSD/src cbac897sys/netinet6 in6_mcast.c

in6_mcast: Acquire ref to ifp and exit epoch earlier in sysctl

This patch reduces the number of witness warnings during ifmcstat(8) calls.

Reviewed by: glebius, zlei
Differential Revision: https://reviews.freebsd.org/D56052
DeltaFile
+4-4sys/netinet6/in6_mcast.c
+4-41 files

HardenedBSD/src ecdaccdlib/libpmc/pmu-events/arch/x86/meteorlake mtl-metrics.json pipeline.json

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+2,825-0lib/libpmc/pmu-events/arch/x86/meteorlake/mtl-metrics.json
+2,096-0lib/libpmc/pmu-events/arch/x86/meteorlake/pipeline.json
+1,733-0lib/libpmc/pmu-events/arch/x86/meteorlake/cache.json
+623-0lib/libpmc/pmu-events/arch/x86/meteorlake/frontend.json
+499-0lib/libpmc/pmu-events/arch/x86/meteorlake/memory.json
+377-0lib/libpmc/pmu-events/arch/x86/meteorlake/virtual-memory.json
+8,153-040 files not shown
+9,213-47946 files