HardenedBSD/src 1466806crypto/openssl/doc/man1 openssl-ciphers.pod.in, secure/usr.bin/openssl/man openssl-ciphers.1

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+0-2,323sys/contrib/zstd/doc/educational_decoder/zstd_decompress.c
+0-2,237sys/contrib/zstd/doc/zstd_manual.html
+0-1,771sys/contrib/zstd/doc/zstd_compression_format.md
+0-1,018sys/contrib/zstd/zlibWrapper/examples/zwrapbench.c
+442-346secure/usr.bin/openssl/man/openssl-ciphers.1
+438-329crypto/openssl/doc/man1/openssl-ciphers.pod.in
+880-8,0241,241 files not shown
+6,287-17,6091,247 files

HardenedBSD/src 1f54e7dshare/man/man4 nlsysevent.4, stand/efi/loader/arch/amd64 trap.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+132-0share/man/man4/nlsysevent.4
+54-40sys/dev/virtio/block/virtio_blk.c
+59-29stand/efi/loader/arch/amd64/trap.c
+0-7sys/dev/hwpmc/hwpmc_mod.c
+4-2tests/sys/arch/Makefile
+4-2sys/dev/hwpmc/hwpmc_ibs.c
+253-806 files not shown
+258-8812 files

HardenedBSD/src 72d701eshare/man/man4 nlsysevent.4 Makefile

nlsysevent: add manpage

Reviewed by:    des
DeltaFile
+132-0share/man/man4/nlsysevent.4
+1-0share/man/man4/Makefile
+133-02 files

HardenedBSD/src c622499sys/compat/freebsd32 freebsd32_misc.c

freebsd32: Fix freebsd11_nstat copyout condition

freebsd11_freebsd32_nstat() invoked copyout(2) when
freebsd11_cvtnstat32() failed and skipped copyout on success. This is
backwards.

Fix this to match freebsd11_freebsd32_nlstat() and freebsd11_nstat(),
and only copy the nstat32 result to userspace when conversion succeeds.

Signed-off-by:  Weixie Cui <cuiweixie at gmail.com>
Reviewed by:    mhorne
MFC after:      1 week
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2109
DeltaFile
+1-1sys/compat/freebsd32/freebsd32_misc.c
+1-11 files

HardenedBSD/src f86ba3esys/dev/hwpmc hwpmc_ibs.c

hwpmc: prevent IBS fetch from getting stuck

Both fetch and op IBS sampling have the same problem where we need to
rewrite the control MSR to ensure sampling continues at the correct
rate.  I also like this because it resets the counter reducing the
chances that we collect a sample inside the NMI handler.

Reported by:    Aalok Agarwal
Reviewed by:    mhorne
Sponsored by:   Netflix
Fixes:  e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2130
DeltaFile
+2-0sys/dev/hwpmc/hwpmc_ibs.c
+2-01 files

HardenedBSD/src 7a1aacasys/dev/hwpmc hwpmc_ibs.c hwpmc_ibs.h

hwpmc: Fix bug when stopping ibs-op

In ibs_stop_pmc I accidently cleared the fetch max count value rather
than the op max count value, when stopping the op counter.  This
mitigates a bug in early pre-zen processors, but breaks using both
counters simultaneously.  I also found that the max op count mask needs
to be extended for recent zen processors.

Reported by:    Andre Fernando da Silva
Reviewed by:    mhorne
Sponsored by:   Netflix
Fixes:  e51ef8ae490f ("hwpmc: Initial support for AMD IBS")
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2120
DeltaFile
+2-2sys/dev/hwpmc/hwpmc_ibs.c
+1-1sys/dev/hwpmc/hwpmc_ibs.h
+3-32 files

HardenedBSD/src 187482busr.sbin/bsdinstall/scripts mirrorselect

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-74usr.sbin/bsdinstall/scripts/mirrorselect
+0-741 files

HardenedBSD/src b5dd3e4crypto/openssl/doc/man1 openssl-ciphers.pod.in, secure/usr.bin/openssl/man openssl-ciphers.1

Merge remote-tracking branch 'internal/freebsd/current/main' into hardened/current/master

Conflicts:
        usr.sbin/bsdinstall/scripts/mirrorselect (unresolved)
DeltaFile
+0-2,323sys/contrib/zstd/doc/educational_decoder/zstd_decompress.c
+0-2,237sys/contrib/zstd/doc/zstd_manual.html
+0-1,771sys/contrib/zstd/doc/zstd_compression_format.md
+0-1,018sys/contrib/zstd/zlibWrapper/examples/zwrapbench.c
+442-346secure/usr.bin/openssl/man/openssl-ciphers.1
+438-329crypto/openssl/doc/man1/openssl-ciphers.pod.in
+880-8,0241,229 files not shown
+6,102-17,5201,235 files

HardenedBSD/src 2f3dcbbsys/dev/hwpmc hwpmc_mod.c

hwpmc: Fix compile warning

.../sys/dev/hwpmc/hwpmc_mod.c:4640:1: warning: unused function 'pmc_is_multipart' [-Wunused-function]
 4640 | pmc_is_multipart(struct pmc_sample *ps)
      | ^~~~~~~~~~~~~~~~
1 warning generated.

Reviewed by:    mhorne
Fixes:          e51ef8ae490f - main - hwpmc: Initial support for AMD IBS
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D56296
DeltaFile
+0-7sys/dev/hwpmc/hwpmc_mod.c
+0-71 files

HardenedBSD/src f916091share/man/man7 tuning.7

tuning.7: Fix suds typo in manual pages

MFC after:              3 days
Fixes:                  fc32c802158f Add two new manual pages
Differential Revision:  https://reviews.freebsd.org/D55814
DeltaFile
+2-2share/man/man7/tuning.7
+2-21 files

HardenedBSD/src 8672683tests/sys/arch Makefile Makefile.inc

test/sys/arch: Fix arch without test/sys/arch/${MACHINE_ARCH}

Fixes:          0ddaa4c86d68 ("arm64: Add arm64 SVE tests")
Sponsored by:   The FreeBSD Foundation
DeltaFile
+4-2tests/sys/arch/Makefile
+0-2tests/sys/arch/Makefile.inc
+4-42 files

HardenedBSD/src 0dd9c4atools/build Makefile

tools/build/Makefile: Always add md4.h to SYSINCS

Since libmd was added to the bootstrap, building main on stable/14
fails because of an incompatibility in its old md4.h.  Fix this by
always including md4.h in the bootstrap headers, instead of only
doing so when building on a non-FreeBSD host.

Fixes:          50de0bf50512 ("flua: Always build as a bootstrap tool")
Reported by:    olce
Reviewed by:    olce, kevans
Sponsored by:   https://www.patreon.com/bsdivy
Differential Revision:  https://reviews.freebsd.org/D56327
DeltaFile
+0-2tools/build/Makefile
+0-21 files

HardenedBSD/src f542095sys/dev/virtio/block virtio_blk.c

virtio_blk: Fix initialisation of dump request structure

Commit c8c37141 ("virtio_blk: Use bus_dma for command/ack buffer
allocations") failed to update initialisation of the dedicated dump
request structure. This caused a panic on attempting to dump core to a
virtio_blk device.

Reviewed by:    asomers
Sponsored by:   Arm Ltd
Pull Request:   https://reviews.freebsd.org/D56156
DeltaFile
+54-40sys/dev/virtio/block/virtio_blk.c
+54-401 files

HardenedBSD/src aacf448stand/efi/loader/arch/amd64 trap.c

loader.efi: panic() should show stack trace

Because panic() does provide mechanism to have architecture specific
panic call, we can instruct it to print out stack trace too
(in hope we actually can print). While there, also implement simple
check to detect loop in trace.

illumos issue: https://www.illumos.org/issues/17887
DeltaFile
+59-29stand/efi/loader/arch/amd64/trap.c
+59-291 files

HardenedBSD/src 42951ddlib/libc/gen posix_spawn_file_actions_addopen.3 dlopen.3, libexec/rtld-elf rtld.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+54-3libexec/rtld-elf/rtld.c
+45-0libexec/rtld-elf/tests/dlopen_hash_test.c
+17-12lib/libc/gen/posix_spawn_file_actions_addopen.3
+14-0lib/libc/gen/dlopen.3
+12-2sys/kern/kern_event.c
+5-0lib/libc/gen/posix_spawn.c
+147-178 files not shown
+166-2514 files

HardenedBSD/src c1c97f1stand/i386/gptzfsboot zfsboot.c

gptzfsboot: boot prompt should emit new line on input

In case the user did input, we should put newline
on screen to avoid possible error messages to get
mixed with user input.
DeltaFile
+4-2stand/i386/gptzfsboot/zfsboot.c
+4-21 files

HardenedBSD/src bdad702sys/netpfil/ipfw/nptv6 nptv6.c

ipfw_nptv6: fix handling the ifaddr removal event

The result of IN6_ARE_MASKED_ADDR_EQUAL() macro is not an integer, so
threat it as a boolean value.

PR:             294114
Reported by:    Peter Much <pmc citylink dinoex sub org>

(cherry picked from commit d9d7b59486499615a5fdce54443ce62aecf557e8)
DeltaFile
+2-2sys/netpfil/ipfw/nptv6/nptv6.c
+2-21 files

HardenedBSD/src 5dc4da1. RELNOTES

RELNOTES: catchup on changes I have made
DeltaFile
+38-0RELNOTES
+38-01 files

HardenedBSD/src 111a42dsys/contrib/zstd/doc zstd_manual.html zstd_compression_format.md, sys/contrib/zstd/doc/educational_decoder zstd_decompress.c

MFV: zstd: Remove entries listed in FREEBSD-Xlist
DeltaFile
+0-2,323sys/contrib/zstd/doc/educational_decoder/zstd_decompress.c
+0-2,237sys/contrib/zstd/doc/zstd_manual.html
+0-1,771sys/contrib/zstd/doc/zstd_compression_format.md
+0-1,018sys/contrib/zstd/zlibWrapper/examples/zwrapbench.c
+0-605sys/contrib/zstd/zlibWrapper/examples/minigzip.c
+0-599sys/contrib/zstd/zlibWrapper/examples/example_original.c
+0-8,55344 files not shown
+0-14,00750 files

HardenedBSD/src a985740doc zstd_manual.html zstd_compression_format.md, doc/educational_decoder zstd_decompress.c

Remove entries listed in FREEBSD-Xlist.
DeltaFile
+0-2,323doc/educational_decoder/zstd_decompress.c
+0-2,237doc/zstd_manual.html
+0-1,771doc/zstd_compression_format.md
+0-1,018zlibWrapper/examples/zwrapbench.c
+0-605zlibWrapper/examples/minigzip.c
+0-599zlibWrapper/examples/example_original.c
+0-8,55345 files not shown
+0-14,01251 files

HardenedBSD/src 7c94186sys/contrib/zstd FREEBSD-Xlist

sys/contrib/zstd: further narrow FREEBSD-Xlist

We don't need any docs or examples in tree, as well
as any upstream-specific build infrastructure.

Differential Revision: https://reviews.freebsd.org/D55836
DeltaFile
+10-1sys/contrib/zstd/FREEBSD-Xlist
+10-11 files

HardenedBSD/src 45079cdusr.sbin/bsdinstall/scripts mirrorselect

installer: Add download.freebsd.org to mirror list

download.freebsd.org is backed by project mirrors and a CDN, which
should benefit most users.

Sponsored by:   The FreeBSD Foundation
Reviewed by:    delphij (releng)
MFC after:      3 days
Differential Revision: https://reviews.freebsd.org/D54849
DeltaFile
+12-1usr.sbin/bsdinstall/scripts/mirrorselect
+12-11 files

HardenedBSD/src 84ce651sys/sys extattr.h

<sys/extattr.h>: use designated initializers for EXTATTR_NAMESPACE_NAMES

This is not a functional change, but it makes it more clear upon
inspection of the definition that the mapping property described is
preserved.  Maybe more importantly, if one ends up getting an index
wrong or punching a hole in the name array unexpectedly, then it'll
hopefully manifest more clearly as a (null) or nullptr deref rather than
potentially just emitting the wrong namespace name.

It's noted that this almost certainly invalidates its use in C++, but
there aren't really any known C++ consumers of it- let's just cross
that bridge if we get there.

Reviewed by:    kib, mckusick, rmacklem
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D55323
DeltaFile
+3-3sys/sys/extattr.h
+3-31 files

HardenedBSD/src 22fba3ausr.bin/find function.c find.1, usr.bin/find/tests find_test.sh

find: add -xattr and -xttrname

We use -xattr in our openrsync tests for convenience, and it seems like
a good addition to FreeBSD.  -xattr and -xattrname will both consult all
available namespaces by default, but -xattrname allows filtering by
namespace using a "user:" or "system:" prefix.

Inspired by:    https://github.com/apple-oss-distributions/shell_cmds
Reviewed by:    kib, rmacklem
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D55286
DeltaFile
+94-0usr.bin/find/function.c
+80-0usr.bin/find/tests/find_test.sh
+21-2usr.bin/find/find.1
+2-0usr.bin/find/option.c
+2-0usr.bin/find/extern.h
+199-25 files

HardenedBSD/src 9a8d333lib/libc/gen memfd_create.c, lib/libsys shm_open.2

libc: fix memfd_create's HUGETLB handling

The 'simplification' commit referenced below actually broke one aspect
of MFD_HUGETLB: the caller isn't supposed to be required to specify a
size.  MFD_HUGETLB by itself without a shift mask just requests a large
page, so we revert that part of memfd_create() back.

While we're here, fix up the related parts of the manpages a little bit,
since MFD_HUGETLB is actually supported.  The manpage claims that we
would return ENOSYS if forced mappings weren't supported, but this was
actually not true.  However, that seems like a very important
distinction to make between ENOSYS and EOPNOTSUPP, so fix the
implementation to match the docs.

Fixes:  8b8cf4ece660f ("memfd_create: simplify HUGETLB support [...]")
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56114
DeltaFile
+45-0tests/sys/posixshm/posixshm.h
+13-25tests/sys/posixshm/posixshm_test.c
+35-0tests/sys/posixshm/memfd_test.c
+27-4lib/libsys/shm_open.2
+16-7lib/libc/gen/memfd_create.c
+136-365 files

HardenedBSD/src 0bf4d22sys/kern kern_event.c

kqueue: don't leak file refs on failure to knote_attach()

We'll subsequently just knote_free() since the knote is barely
constructed, but that bypasses any logic that might release references
on owned files/fops.  Defer clearing those until the knote actually owns
them and update the comment to draw the line more clearly.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D56318
DeltaFile
+10-6sys/kern/kern_event.c
+10-61 files

HardenedBSD/src c6dd40fsys/kern kern_event.c

kqueue: slightly clarify the flow in knlist_cleardel()

This is purely a cosmetic change to make it a little easier on the eyes,
rather than jumping back to the else branch up top.  Re-flow it to use
another loop on the outside and just inline the re-lock before we repeat
after awaking from fluxwait.

The !killkn path should maybe issue a wakeup if there's a thread in
KQ_SLEEP so that userland can observe the EOF, but this isn't a
practical problem today: pretty much every case of knlist_clear is tied
to a file descriptor and called in the close(2) path.  As a consequence,
potentially affected knotes are almost always destroyed before we even
get to knlist_clear().

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56226
DeltaFile
+29-21sys/kern/kern_event.c
+29-211 files

HardenedBSD/src 0c9cec8tests/sys/kqueue kqueue_fork.c

tests: kqueue: add a basic test for CPONFORK

Just copy over a timer and a write-filter, be sure that we can observe
both in the child.  Maybe the timer should check for a minimum time
passed, but I don't know that we'd be likely to get that wrong.

This also adds a negative test with a kqueue that is *not* set for
CPONFORK being added to the first one, made readable, and confirming
that we don't see a knote for it in the child.

Some other improvements to the test noted in the review are planned in
the short term, but they're not particularly worth blocking adding this
as a basic sanity check.

Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D56223
DeltaFile
+140-0tests/sys/kqueue/kqueue_fork.c
+140-01 files

HardenedBSD/src 9f7080bsecure/lib/libcrypto/man/man3 X509V3_EXT_print.3 Makefile

crypto/openssl: add new manpage from release 3.5.6

MFC after:      1 day (the security issues warrant a quick backport).
MFC with:       10a428653ee7216475f1ddce3fb4cbf1200319f8
DeltaFile
+108-0secure/lib/libcrypto/man/man3/X509V3_EXT_print.3
+2-0secure/lib/libcrypto/man/man3/Makefile
+110-02 files

HardenedBSD/src 5254e16secure/lib/libcrypto/man/man3 SSL_CTX_set1_curves.3 SSL_CONF_cmd.3, secure/lib/libcrypto/man/man7 property.7

crypto/openssl: update artifacts to match 3.5.6 release artifacts

A new manpage and any associated links will be added in the next commit.

MFC after:      1 day (the security issues warrant a quick backport).
MFC with:       10a428653ee7216475f1ddce3fb4cbf1200319f8
DeltaFile
+442-346secure/usr.bin/openssl/man/openssl-ciphers.1
+85-36secure/lib/libcrypto/man/man3/SSL_CTX_set1_curves.3
+56-48sys/crypto/openssl/aarch64/vpsm4_ex-armv8.S
+27-2secure/lib/libcrypto/man/man7/property.7
+9-11secure/lib/libcrypto/man/man3/SSL_CONF_cmd.3
+12-3secure/lib/libcrypto/man/man3/PKCS5_PBE_keyivgen.3
+631-446903 files not shown
+1,654-1,424909 files