HardenedBSD/src 062db6csbin/hastd control.c, sbin/hastd/tests hastd_test.sh

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+23-23sys/kern/kern_descrip.c
+23-23share/man/man4/tws.4
+36-0sbin/hastd/tests/hastd_test.sh
+6-15share/man/man4/tun.4
+10-10sys/kern/vfs_syscalls.c
+17-0sbin/hastd/control.c
+115-7110 files not shown
+157-8516 files

HardenedBSD/src e623f76sys/compat/freebsd32 freebsd32_misc.c, sys/dev/asmc asmcmmio.c asmcvar.h

Merge remote-tracking branch 'rad/hardened/15-stable/main' into hardened/15-stable/pledge
DeltaFile
+1,536-654sys/dev/asmc/asmc.c
+131-916sys/dev/asmc/asmcvar.h
+275-188sys/kern/tty.c
+402-0sys/dev/asmc/asmcmmio.c
+162-72sys/kern/sys_process.c
+90-66sys/compat/freebsd32/freebsd32_misc.c
+2,596-1,89660 files not shown
+3,400-1,99266 files

HardenedBSD/src e6de538sbin/hastd control.c, sbin/hastd/tests hastd_test.sh

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+23-23sys/kern/kern_descrip.c
+23-23share/man/man4/tws.4
+36-0sbin/hastd/tests/hastd_test.sh
+6-15share/man/man4/tun.4
+10-10sys/kern/vfs_syscalls.c
+17-0sbin/hastd/control.c
+115-7110 files not shown
+157-8516 files

HardenedBSD/src aedbda5usr.sbin/bhyve pci_hda.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+37-18usr.sbin/bhyve/pci_hda.c
+37-181 files

HardenedBSD/src 4ec3ca5etc/mtree BSD.tests.dist, sbin/hastd Makefile

hastd: Add rudimentary tests

Test that we can start and stop hastd with an empty configuration.

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D59345
DeltaFile
+36-0sbin/hastd/tests/hastd_test.sh
+4-0sbin/hastd/tests/Makefile
+3-0sbin/hastd/Makefile
+2-0etc/mtree/BSD.tests.dist
+45-04 files

HardenedBSD/src ff4b81esys/kern vfs_syscalls.c kern_descrip.c, sys/sys syscallsubr.h

syscalls: Avoid C++ reserved words

Both kern_renameat() and kern_dup() had arguments named `new`.  Rename
their arguments to match their respecitve manual pages.

Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D59386
DeltaFile
+23-23sys/kern/kern_descrip.c
+10-10sys/kern/vfs_syscalls.c
+3-3sys/sys/syscallsubr.h
+36-363 files

HardenedBSD/src 7dfadd7sbin/hastctl hastctl.c, sbin/hastd hast.h hastd.c

hastd: Add a stop control message

Add a stop control message which causes hastd to clean up and terminate.

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D59344
DeltaFile
+17-0sbin/hastd/control.c
+14-0sbin/hastctl/hastctl.c
+8-4sbin/hastd/hastd.c
+1-0sbin/hastd/hast.h
+40-44 files

HardenedBSD/src 911bda7sbin/hastd nv.c

hastd: Ensure nvpair padding is initialized

The proto-libnv implementation embedded in hastd pads names and values
out to the nearest multiple of eight bytes, but leaves the padding
uninitialized, leaking up to 14 bytes of recycled heap per pair in a
message.

While here, switch from bcopy() to memcpy().

MFC after:      3 days
Reviewed by:    kevans, emaste
Differential Revision:  https://reviews.freebsd.org/D59343
DeltaFile
+3-3sbin/hastd/nv.c
+3-31 files

HardenedBSD/src e0a7832usr.sbin/bsdinstall/scripts hardening

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-19usr.sbin/bsdinstall/scripts/hardening
+0-191 files

HardenedBSD/src e914707sys/compat/freebsd32 freebsd32_misc.c, sys/dev/asmc asmcmmio.c asmcvar.h

Merge remote-tracking branch 'rad/freebsd/15-stable/main' into hardened/15-stable/main

Conflicts:
        usr.sbin/bsdinstall/scripts/hardening (unresolved)
DeltaFile
+1,536-654sys/dev/asmc/asmc.c
+131-916sys/dev/asmc/asmcvar.h
+275-188sys/kern/tty.c
+402-0sys/dev/asmc/asmcmmio.c
+162-72sys/kern/sys_process.c
+90-66sys/compat/freebsd32/freebsd32_misc.c
+2,596-1,89660 files not shown
+3,382-1,97466 files

HardenedBSD/src a73bb62contrib/kyua/engine/prepare prepare_all.cpp

contrib/kyua: fix -Wshadow error

This fixes the build with gcc 14:

/usr/src/contrib/kyua/engine/prepare/prepare_all.cpp:56:16: error: declaration of 'handler' shadows a member of 'engine::prepare::prepare_all' [-Werror=shadow]
   56 |     for (auto& handler : prepare::handlers()) {
      |                ^~~~~~~
In file included from /usr/src/contrib/kyua/engine/prepare/prepare_all.hpp:35,
                 from /usr/src/contrib/kyua/engine/prepare/prepare_all.cpp:29:
/usr/src/contrib/kyua/engine/prepare/prepare.hpp:51:15: note: shadowed declaration is here
   51 | class handler {
      |               ^

Fixes:  edb230c4af499203d7a6894b3711fe6574b26040

Reviewed by:    igoro, rlibby, ngie
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D59346
DeltaFile
+3-3contrib/kyua/engine/prepare/prepare_all.cpp
+3-31 files

HardenedBSD/src d7ed56blib/msun/tests nearbyint_test.c

lib/msun/tests: remove nearbyint test xfail on riscv

PR:             290099
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1lib/msun/tests/nearbyint_test.c
+1-11 files

HardenedBSD/src 555972cshare/man/man4 tun.4

tun.4: Canonicalize SYNOPSIS and AUTHORS

While here, s/PR#2411/NetBSD PR#2411/ in the comments for clarity.
I had to go to netbsd sources to get this information.

MFC after:      3 days
Event:          Berlin Hackathon 202609
DeltaFile
+6-15share/man/man4/tun.4
+6-151 files

HardenedBSD/src ef3239cshare/man/man4 tws.4

tws.4: Canonicalize SYNOPSIS + nits

+ wrap some long lines
+ escape some ? wildcards
+ no macros in width specifiers
+ mention the speed in HARDWARE (bumps date)
+ use the hyperlink macro for... the defunct LSI website...
+ write out a symbol heavy error message format string in mdoc

MFC after:      3 days
Event:          Berlin Hackathon 202609
DeltaFile
+23-23share/man/man4/tws.4
+23-231 files

HardenedBSD/src 3557da0usr.sbin/bhyve pci_hda.c

bhyve: Do not panic on invalid input in HDA emulation

The emulated HDA controller passed values taken from guest registers and
from guest memory straight into assert(), so a guest could abort bhyve
with values the emulation did not expect. Reject them instead.

In case the guest asked to start something and it failed, clear the
corresponding run/enable bit.

PR:             256379, 256381, 256382, 256383, 256384, 256385, 256386, 256498
Sponsored by:   The FreeBSD Foundation
MFC after:      2 weeks
Reviewed by:    bnovkov, jhb
Differential Revision:  https://reviews.freebsd.org/D59082

(cherry picked from commit f4d953bea74091874f019e3a2c4902dd013ee739)
DeltaFile
+37-18usr.sbin/bhyve/pci_hda.c
+37-181 files

HardenedBSD/src d9d2b38include wchar.h inttypes.h, sys/arm/include _stdint.h

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+6-0include/inttypes.h
+3-0sys/sys/stdint.h
+3-0include/wchar.h
+2-0sys/sys/_types.h
+0-1sys/arm64/include/_stdint.h
+0-1sys/arm/include/_stdint.h
+14-23 files not shown
+14-59 files

HardenedBSD/src 74ef136include wchar.h inttypes.h, sys/arm/include _stdint.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+6-0include/inttypes.h
+3-0sys/sys/stdint.h
+3-0include/wchar.h
+2-0sys/sys/_types.h
+0-1sys/x86/include/_stdint.h
+0-1sys/arm/include/_stdint.h
+14-23 files not shown
+14-59 files

HardenedBSD/src 72ed6f9include wchar.h, sys/powerpc/include _stdint.h

libc: Add WCHAR_WIDTH in <wchar.h> as well

Define __WCHAR_WIDTH in sys/_types.h and derive WCHAR_WIDTH from
that, the same way as WCHAR_MIN and WCHAR_MAX, in both <wchar.h>
and <stdint.h> as per C23 §7.31.1 and §7.22.3.4, respectively.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59385
DeltaFile
+3-0sys/sys/stdint.h
+3-0include/wchar.h
+2-0sys/sys/_types.h
+0-1sys/x86/include/_stdint.h
+0-1sys/riscv/include/_stdint.h
+0-1sys/powerpc/include/_stdint.h
+8-32 files not shown
+8-58 files

HardenedBSD/src 733ea4einclude inttypes.h

libc: Add <inttypes.h> C23 feature test macro

Define __STDC_VERSION_INTTYPES_H__ now that the header fully
conforms to C23.

Reviewed by:    fuz
Approved by:    fuz (mentor)
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D59382
DeltaFile
+6-0include/inttypes.h
+6-01 files

HardenedBSD/src 5f953e4sys/powerpc/booke machdep_e500.c pmap.c, sys/powerpc/include pcpu.h

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+69-21sys/powerpc/booke/trap_subr.S
+66-0sys/powerpc/booke/booke_machdep.c
+45-0sys/powerpc/booke/pmap_64.c
+17-17sys/powerpc/booke/pmap.c
+10-2sys/powerpc/include/pcpu.h
+7-2sys/powerpc/booke/machdep_e500.c
+214-426 files not shown
+239-4212 files

HardenedBSD/src 34562cfsys/powerpc/booke machdep_e500.c pmap.c, sys/powerpc/include pcpu.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+69-21sys/powerpc/booke/trap_subr.S
+66-0sys/powerpc/booke/booke_machdep.c
+45-0sys/powerpc/booke/pmap_64.c
+17-17sys/powerpc/booke/pmap.c
+10-2sys/powerpc/include/pcpu.h
+7-2sys/powerpc/booke/machdep_e500.c
+214-426 files not shown
+239-4212 files

HardenedBSD/src 5aeedafsys/powerpc/aim aim_machdep.c, sys/powerpc/booke booke_machdep.c

powerpc/ddb: Dump more state in `show pcpu`

Add a new CPU-family `show pcpu` handler, cpu_db_show_mdpcpu() to dump
CPU-specific PCPU data.  Only Book-E is populated for now, but AIM may
be populated later.

These new field prints: save areas, TLB miss nesting, the new critical
stack pointer.  All of them have been very useful for debugging very
esoteric bugs, so make them easier to see from DDB, instead of having to
rummage through hex dumps.
DeltaFile
+48-0sys/powerpc/booke/booke_machdep.c
+7-0sys/powerpc/powerpc/db_interface.c
+7-0sys/powerpc/aim/aim_machdep.c
+5-0sys/powerpc/include/md_var.h
+67-04 files

HardenedBSD/src d8f9d33sys/powerpc/booke pmap_32.c pmap.c

powerpc/pmap(booke): Allocate 64-bit roots from DMAP

When a TLB miss exception occurs the exception handler must walk the
page table from the root.  When the root is allocated from KVA the TLB
miss exception may take another exception if the root page(s) aren't in
the TLB.

The 64-bit page table is modeled after the AIM radix page table, with a
64kB root "page", so 16 pages.  This makes regular use of UMA
allocations unable to refer back to the DMAP, which itself is mapped in
TLB1.  Now we take another page from the radix pmap driver and grab
contiguous pages from the VM system, so that we can simply refer
directly to DMAP and avoid more nested TLB misses.  We can still take a
nested miss, though, because the pmap itself may be in KVA, but this
reduces the nesting.
DeltaFile
+45-0sys/powerpc/booke/pmap_64.c
+1-5sys/powerpc/booke/pmap.c
+4-0sys/powerpc/booke/pmap_32.c
+50-53 files

HardenedBSD/src eef2607sys/powerpc/booke pmap.c

powerpc/pmap(booke): Rework TID reuse

If a pmap is freed and its memory is reused before its TID reference is
taken, then arbitrary memory will be clobbered.  Avoid this by never
dereferencing the pmap pointer in the tidbusy array, and instead using
it as a compare sentinel.
DeltaFile
+16-12sys/powerpc/booke/pmap.c
+16-121 files

HardenedBSD/src 68ecb91sys/powerpc/booke trap_subr.S

powerpc/booke: Reorganize FRAME_LEAVE

There's a small window between when the SRR* registers are restore and
the exception returns, in which a TLB miss exception may be triggered.
Since there are not special SRR* registers for TLB miss exceptions, the
registers from the frame will be ovwritten, and the FRAME_LEAVE block
will effectively be re-entered on exit, leading to a very hard to
diagnose panic or wedge.

Minimize this chance by pushing the SRR* restore to the last possible
moments, caching them in a PCPU save area instead until the end.  This
matches what the AIM side already does.
DeltaFile
+31-11sys/powerpc/booke/trap_subr.S
+31-111 files

HardenedBSD/src 564fe16sys/powerpc/booke booke_machdep.c trap_subr.S, sys/powerpc/include pcpu.h

powerpc/booke: Use a dedicated critical exception stack

A critical exception, such as a watchdog, can trigger at any time,
including the middle of a standard exception prologue or epilogue, so
GPRs, including %r1 (the stack pointer) cannot be trusted at all.
Instead, use a private stack pointer for critical interrupts.  Each CPU
now has its own critical exception stack, with the boot stack in the
bss.
DeltaFile
+39-11sys/powerpc/booke/trap_subr.S
+18-0sys/powerpc/booke/booke_machdep.c
+10-2sys/powerpc/include/pcpu.h
+1-0sys/powerpc/powerpc/genassym.c
+68-134 files

HardenedBSD/src 42f9049sys/powerpc/booke machdep_e500.c, sys/powerpc/include spr.h

powerpc/watchdog: Make e500 watchdog action tunable

There are 4 options for e500 watchdog timeout, which may be core- or
even SoC- specific.  Add support to tune the behavior via a tunable
(machdep.watchdog_mode).  The tunable value is an integer 0-3.
DeltaFile
+7-2sys/powerpc/booke/machdep_e500.c
+1-0sys/powerpc/include/spr.h
+8-22 files

HardenedBSD/src 8ab5624tests/sys/kern Makefile procdesc.c

tests/sys/kern: Skip capsicum procdesc tests when capability mode is unavailable

(cherry picked from commit 3c5c55beee5ef80d8a9526480682cee86cbac584)
DeltaFile
+7-0tests/sys/kern/pdwait.c
+4-0tests/sys/kern/procdesc.c
+2-0tests/sys/kern/Makefile
+13-03 files

HardenedBSD/src 2469f84lib/libc/gen exterr_cat_filenames.h, sys/kern tty.c

kern/tty.c: Exterrorize returns

(cherry picked from commit 62ccaec3dba6272590d97cc0aa0df28fd3d08d1c)
DeltaFile
+27-22sys/kern/tty.c
+1-0sys/sys/exterr_cat.h
+1-0lib/libc/gen/exterr_cat_filenames.h
+29-223 files

HardenedBSD/src c41e308sys/kern tty_pts.c tty.c, sys/sys tty.h

tty: gracefully handle proctree_lock locking

(cherry picked from commit 420428718da769ea72d3f18ed8eba7c3d998b1c8)
DeltaFile
+209-172sys/kern/tty.c
+3-0sys/sys/tty.h
+3-0sys/kern/tty_pts.c
+215-1723 files