HBSD: Update /etc/os-release and /var/run/os-release
Now that we have completed the migration to Radicle, we need to update
the URLs and other auxiliary data in the os-release files.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
nvmecontrol.8: Explain non-operational power modes
`nvmecontrol power -l ...` lists the available power modes.
Non-operational modes are marked with an asterisk. While here,
add <device-id | namespace-id> to the "nvmecontrol power" synopsis.
MFC after: 3 days
Reviewed by: dab, imp, michaelo, ziaee
Differential Revision: https://reviews.freebsd.org/D58480
(cherry picked from commit 868158f7fd2a172ef22f1b6b682cc1d38e54cf63)
ctfmerge.1: Fix uniqlabel typos
The flag is -D, but it was written as a second -d. Add a period too.
MFC after: 3 days
(cherry picked from commit 4f293e32e4529617dd05bd64fd3c22a57a56a355)
ctfmerge.1: Import ENVIRONMENT from NetBSD
Import the ENVIRONMENT section from NetBSD, minus the variable that our
ctfmerge does not have. Alphabetize them, polish grammar and alignment,
and add the variables to the man database. While here, remove whitespace
from the end of some lines to quiet linter.
MFC after: 3 days
PR: 291186
Co-authored-by: Alexander Ziaee <ziaee at FreeBSD.org>
Obtained from: NetBSD (christos <christos at NetBSD.org>, 8a0c0d8)
Differential Revision: https://reviews.freebsd.org/D54054
(cherry picked from commit 32cf24b725fdf899fb642c47004b69fcfae9b9db)
padlock.4: Update slightly for 64-bit hardware
- Change the document description to "Via and Zhaoxin CPU crypto driver"
- Add a HARDWARE section mentioning these in the hardware release note
This manual still needs desperate help, but just this little bit could
have saved a lot of confusion. I'd write more if I had information.
PR: 295517
Fixes: 14b8531c4ccb8 (Restore padlock_rng the the amd64 build)
MFC after: 3 days (to 15 only)
Reviewed by: bcr, asomers
Differential Revision: https://reviews.freebsd.org/D57920
(cherry picked from commit 380c6f59c4f87dbc45a67983d927700ca7e22be2)
rtadvd(8): Fix RA flag inconsistency messages
During flag inconsistency report, we handle rai->rai_otherflg
as a bool, but the value is 0x40. Make it a simple number comparison.
PR: 295995
Reviewed by: markj, Faraz Vahedi <kfv at kfv.io>
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58672
HBSD: Explicitly dissuade from pkgbase use
HardenedBSD isn't ready for pkgbase. I would rather folks not use it,
but if they do, they know it's really not supported.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
pseudofs: Don't purge the cache on shutdown
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
igc: defer sysctl-driven reinit to the admin task
igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.
Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.
Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.
While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58629
e1000: defer sysctl-driven reinit to the admin task
Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.
The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.
While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58628
