HardenedBSD/src 823fa91sys/dev/cxgbe t4_netmap.c, sys/powerpc/aim moea64_native.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+90-9sys/powerpc/powermac/platform_powermac.c
+5-0sys/powerpc/aim/moea64_native.c
+1-3sys/dev/cxgbe/t4_netmap.c
+96-123 files

HardenedBSD/src 4b59f4dsys/dev/cxgbe t4_netmap.c, sys/powerpc/aim moea64_native.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+90-9sys/powerpc/powermac/platform_powermac.c
+5-0sys/powerpc/aim/moea64_native.c
+1-3sys/dev/cxgbe/t4_netmap.c
+96-123 files

HardenedBSD/src 77d71f5sys/dev/cxgbe t4_netmap.c

cxgbe(4): Fix netmap rx behavior with nm_split_rss

The driver should look for active queues and one potential default-queue
in both halves of the split instead of stopping at the first valid
default-queue.

Fixes:          a9f476580eb0 cxgbe(4): fixes for netmap operation with only some queues active
MFC after:      1 week
Sponsored by:   Chelsio Communications
DeltaFile
+1-3sys/dev/cxgbe/t4_netmap.c
+1-31 files

HardenedBSD/src 9a5baa9sys/powerpc/aim moea64_native.c

powerpc: disable the TLBIE lock, it's not needed for POWER8

According to POWER8_UM_v1.3_16MAR2016 3.8.3 Translation Lookaside
Buffer (TLB), POWER8 supports lockless TLBIE operations.

Locally Tested:

* IBM POWER8 Revision 2.0, dual socket, 160 threads

Differential Revision:  https://reviews.freebsd.org/D54855
Approved by:    jhibbits
DeltaFile
+5-0sys/powerpc/aim/moea64_native.c
+5-01 files

HardenedBSD/src 422c871sys/powerpc/powermac platform_powermac.c

powerpc: add a best-effort SMP time base sync for G5's that need it

There's no timebase freeze platform routine registered on my dual 2.3GHz
G5 PPC970FX Apple PowerMac.

For platforms without an explicit timebase freeze/unfreeze, we'll have to
make do with what we have - which for now is an explicit hand-crafted
spinlock/rendezvous method.

* For existing platforms, they'll still continue to clock freeze /
  rendezvous; albeit with some stronger atomic bits now (from jhibbits@.)
* Instead of the fallback being "no timesync", implement a
  best-effort one which does a similar rendezvous barrier between
  BSP and APs, but instead of freeze/unfreeze the first instruction
  after the CPUs all register they're ready is to set the timebase.

This has resulted in many reboots of my Powermac G5 dual-socket device
correctly starting and running in SMP mode.


    [2 lines not shown]
DeltaFile
+90-9sys/powerpc/powermac/platform_powermac.c
+90-91 files

HardenedBSD/src f4be8d1lib/libc/gen posix_spawnattr_getprocdescp_np.3 posix_spawn.c, lib/libsys/amd64 pdrfork_thread.S

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+321-22sys/kern/subr_witness.c
+101-0lib/libsys/i386/pdrfork_thread.S
+94-0lib/libc/gen/posix_spawnattr_getprocdescp_np.3
+83-0lib/libsys/amd64/pdrfork_thread.S
+49-34usr.sbin/bhyve/amd64/pci_lpc.c
+49-5lib/libc/gen/posix_spawn.c
+697-6123 files not shown
+818-13329 files

HardenedBSD/src 9e4dd19lib/libc/gen posix_spawnattr_getprocdescp_np.3 posix_spawn.c, lib/libsys/amd64 pdrfork_thread.S

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+321-22sys/kern/subr_witness.c
+101-0lib/libsys/i386/pdrfork_thread.S
+94-0lib/libc/gen/posix_spawnattr_getprocdescp_np.3
+83-0lib/libsys/amd64/pdrfork_thread.S
+49-34usr.sbin/bhyve/amd64/pci_lpc.c
+49-5lib/libc/gen/posix_spawn.c
+697-6123 files not shown
+818-13329 files

HardenedBSD/src d35385ashare/man/man4 capsicum.4, sys/amd64/include ifunc.h

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+11-2sys/compat/freebsd32/freebsd32.h
+5-5share/man/man4/capsicum.4
+8-2sys/kern/kern_ktrace.c
+9-1sys/sys/abi_compat.h
+5-0sys/i386/include/ifunc.h
+5-0sys/amd64/include/ifunc.h
+43-101 files not shown
+44-107 files

HardenedBSD/src d47c1c2sbin/setkey setkey.c

sbin/setkey: add -Z option to disable receive timeouts

Sponsored by:   NVidia networking
MFC after:      1 week
DeltaFile
+15-9sbin/setkey/setkey.c
+15-91 files

HardenedBSD/src a68d541sys/compat/freebsd32 freebsd32_misc.c

freebsd32_rusage_out(): bzero the compat32 structure

(cherry picked from commit 6af3cf27ed0072f2dcb17380ab63228f9aa28708)
DeltaFile
+1-0sys/compat/freebsd32/freebsd32_misc.c
+1-01 files

HardenedBSD/src 96e697bsys/amd64/include ifunc.h, sys/i386/include ifunc.h

x86: add machine/ifunc.h

(cherry picked from commit 2b1db07bec92e9447e6574a74366d4dd606e80a6)
DeltaFile
+5-0sys/amd64/include/ifunc.h
+5-0sys/i386/include/ifunc.h
+10-02 files

HardenedBSD/src dc46f06sys/compat/freebsd32 freebsd32.h, sys/sys abi_compat.h

sys/abi_compat.h: fix UB for bintime32 handling

(cherry picked from commit be1b2da855cc38531733b5c97891cd4a40a993bc)
DeltaFile
+1-1sys/compat/freebsd32/freebsd32.h
+1-1sys/sys/abi_compat.h
+2-22 files

HardenedBSD/src 3b85009sys/kern kern_ktrace.c

ktrace: do not enqueue request if the process' ktrioparams are freed

(cherry picked from commit 6bb3f208617b58a54e2204eb31bae3f9a86117a7)
DeltaFile
+8-2sys/kern/kern_ktrace.c
+8-21 files

HardenedBSD/src a984c23sys/compat/freebsd32 freebsd32.h, sys/sys abi_compat.h

compat32: provide a type and a macro for (u)int64_t handling on non-x86 arches

(cherry picked from commit 96acaa960023c20e852e04e7cc5c6a5faca36c67)
DeltaFile
+10-1sys/compat/freebsd32/freebsd32.h
+8-0sys/sys/abi_compat.h
+18-12 files

HardenedBSD/src 69de2b4sys/dev/bnxt/bnxt_en if_bnxt.c

bnxt: don't set media status if link is down

When the link is down don't set flags other than IFM_AVALID & IFM_ETHER
This avoids `media: Ethernet autoselect (Unknown <full-duplex>)` on ifconfig

Reviewed by:    zlei, pouria
Approved by:    glebius (mentor)
MFC after:      1 week
Sponsored by:   Stormshield
Differential Revision: https://reviews.freebsd.org/D54573
DeltaFile
+3-4sys/dev/bnxt/bnxt_en/if_bnxt.c
+3-41 files

HardenedBSD/src d1a8f1asys/netpfil/ipfw ip_fw_dynamic.c

ipfw: don't use the upper half lock to walk dynamic states buckets

The lock is sleepable and we can't grab it in dyn_tick().  Use the
individual bucket locks instead.

Fixes:  e3caa360d5d0a73af0de1d293d5b8ff6e900ceb4
DeltaFile
+4-14sys/netpfil/ipfw/ip_fw_dynamic.c
+4-141 files

HardenedBSD/src 31e5decsys/arm64/vmm vmm_mmu.c

arm64/vmm: Simplify vmmpmap_remove()

This function handles invalid intermediate PTP entries, but there's no
reason for this: the passed range should be mapped.  In particular, we
assert that all L3 entries encountered are mapped.  So let's simplify
the code a bit.  No functional change intended.

Reviewed by:    andrew
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54738
DeltaFile
+6-21sys/arm64/vmm/vmm_mmu.c
+6-211 files

HardenedBSD/src 1db1e4busr.sbin/bhyve pci_emul.c pci_emul.h, usr.sbin/bhyve/amd64 pci_lpc.c

bhyve: Use PCIOCGETCONF to find the host LPC bridge

pci_host_read_config() requires write access to /dev/pci so cannot be
used with unprivileged bhyve.  The lpc init code uses it to find the
host system's LPC bridge device and so was generating warnings with
bhyve running as a non-root user.

Refactor the implementation to use PCIOCGETCONF instead, which doesn't
require any special privileges.  This isn't formally necessary, as we
only care about copying the host system's identifiers in order to
support Intel GPU passthrough (see commit f4ceaff56ddaa), but it's
straightforward and lets an unprivileged user run bhyve without seeing
warnings about failing to open /dev/pci with write permissions.

Reviewed by:    corvink, rew
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54851
DeltaFile
+49-34usr.sbin/bhyve/amd64/pci_lpc.c
+12-10usr.sbin/bhyve/pci_emul.c
+1-1usr.sbin/bhyve/pci_emul.h
+62-453 files

HardenedBSD/src 77c5f29lib/libc/gen posix_spawnattr_getprocdescp_np.3 Makefile.inc

libc: document posix_spawnattr_{get,set}procdescp_np(3)

Reviewed by:    asomers
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54899
DeltaFile
+94-0lib/libc/gen/posix_spawnattr_getprocdescp_np.3
+2-0lib/libc/gen/Makefile.inc
+2-0lib/libc/gen/posix_spawn.3
+98-03 files

HardenedBSD/src 6253212contrib/openbsm/etc audit_event, contrib/openbsm/sys/bsm audit_kevents.h

Add pdrfork to OpenBSM

It's necessary for auditd to be able to log its events.  Note that the
recently added pdwait() syscall is only auditable because an audit event
of that name was preemptively added back in 2012.

PR:             292739
MFC after:      1 week
Fixes:          5c2ee618d5e "sys: add pdrfork(2)"
Sponsored by:   ConnectWise
Reviewed by:    kib
Differential Revision: https://reviews.freebsd.org/D54897
DeltaFile
+1-0contrib/openbsm/etc/audit_event
+1-0contrib/openbsm/sys/bsm/audit_kevents.h
+2-02 files

HardenedBSD/src f9ecb74share/man/man4 capsicum.4

capsicum.4: Replace 'fi' ligature and smart quotation mark

While here, wrap the line to 80 characters.

Reviewed by:    jlduran
Fixes:          c54534e60263 ("capsicum.4: Add some more detail from the Capsicum paper")
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D54761

(cherry picked from commit e6bafbeb1ee7a61ddfe92ba052c476c7646c405b)
DeltaFile
+5-5share/man/man4/capsicum.4
+5-51 files

HardenedBSD/src fb4b0c9share/man/man4 witness.4, sys/kern subr_witness.c

witness: Provide facility to print detailed lock tree

When witness(4) detects lock order reversals (LORs), it prints
information about the stack trace which caused the LOR. If available,
it can also print information about the first stack trace which
established the other lock ordering. However, it only does this for
"simple" LORs where the two locks in question were directly locked
in the opposite order. When the lock order was established through
a more complex pattern of intermediate locks, WITNESS only prints
the stack trace where it detected the LOR.

This commit provides new functionality to provide more verbose
information about the lock chain(s) which established the lock
ordering. The new functionality can be disabled by setting the
debug.witness.trace sysctl/tunable to 1. The new functionality
is also available through the debug.witness.badstacks sysctl,
which has been modified to always show the more verbose
information.


    [4 lines not shown]
DeltaFile
+321-22sys/kern/subr_witness.c
+47-3share/man/man4/witness.4
+368-252 files

HardenedBSD/src fe962e3lib/libc/gen Makefile.inc, share/man Makefile

METALOG: Order keyword entries

To facilitate comparison with mtree -C generated output, keep the
keywords ordered.

No functional change intended.

Reviewed by:    imp
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54872
DeltaFile
+3-3lib/libc/gen/Makefile.inc
+2-2share/man/Makefile
+1-1sys/conf/kmod.mk
+1-1sys/modules/Makefile
+1-1usr.sbin/services_mkdb/Makefile
+8-85 files

HardenedBSD/src 2a5b083lib/libc/gen posix_spawnattr_getexecfd_np.3

posix_spawnattr_getexecfd_np.3: add closing .Fc

Fixes:  9bf69c37f43e96292e97e41bf942d7aca4101362
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
DeltaFile
+1-0lib/libc/gen/posix_spawnattr_getexecfd_np.3
+1-01 files

HardenedBSD/src 080d8edinclude spawn.h, lib/libc/gen posix_spawn.c Symbol.map

libc: add posix_spawnattr_{get,set}procdescp_np

Reviewed by:    asomers
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54879
DeltaFile
+49-5lib/libc/gen/posix_spawn.c
+4-0include/spawn.h
+2-0lib/libc/gen/Symbol.map
+55-53 files

HardenedBSD/src 74a2bf1lib/libsys/amd64 pdrfork_thread.S Symbol.sys.map, lib/libsys/i386 pdrfork_thread.S Symbol.sys.map

libsys: add pdrfork_thread() on x86

Reviewed by:    asomers
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D54879
DeltaFile
+101-0lib/libsys/i386/pdrfork_thread.S
+83-0lib/libsys/amd64/pdrfork_thread.S
+4-0lib/libsys/amd64/Symbol.sys.map
+4-0lib/libsys/i386/Symbol.sys.map
+2-1lib/libsys/amd64/Makefile.sys
+1-1lib/libsys/i386/Makefile.sys
+195-21 files not shown
+196-27 files

HardenedBSD/src b6b10e5sys/dev/acpica acpi_spmc.c, sys/dev/sym sym_hipd.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+618-0sys/dev/acpica/acpi_spmc.c
+152-154sys/dev/sym/sym_hipd.c
+295-0tests/sys/kern/pdwait.c
+187-0tests/sys/kern/pdrfork.c
+83-15sys/riscv/riscv/pmap.c
+98-0tests/sys/kern/procdesc.c
+1,433-16912 files not shown
+1,472-20018 files

HardenedBSD/src 70e54a6sys/dev/acpica acpi_spmc.c, sys/dev/sym sym_hipd.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+618-0sys/dev/acpica/acpi_spmc.c
+152-154sys/dev/sym/sym_hipd.c
+295-0tests/sys/kern/pdwait.c
+187-0tests/sys/kern/pdrfork.c
+83-15sys/riscv/riscv/pmap.c
+98-0tests/sys/kern/procdesc.c
+1,433-16911 files not shown
+1,470-20017 files

HardenedBSD/src dec2471lib/libiconv_modules/mapper_std citrus_mapper_std.c, usr.bin/mkimg mkimg.1 mkimg.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+34-20usr.bin/mkimg/mkimg.1
+3-0usr.bin/mkimg/mkimg.c
+1-1lib/libiconv_modules/mapper_std/citrus_mapper_std.c
+38-213 files

HardenedBSD/src 97ee3aeusr.bin/mkimg mkimg.1 mkimg.c

mkimg(1): Sync mkimg(1) and usage() with the implementation

Reviewed by:    imp
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D54419

(cherry picked from commit 3aa8d5395c4223f1613f28d6f39904c2df4f92d4)
DeltaFile
+34-20usr.bin/mkimg/mkimg.1
+3-0usr.bin/mkimg/mkimg.c
+37-202 files