loader.efi: Measure boot policy and loaded contents with a TPM
Use the EFI TCG2 protocol, or the legacy TCG protocol on TPM 1.2
firmware, to extend the loader PCRs and record EV_IPL events in the
firmware event log.
Extend PCR 8 with the final kernel environment and the type, name, and
arguments of each loaded boot input. Prefix both record types with
versioned, NUL-terminated domain strings. These make the records
self-identifying and define an explicit measured policy encoding. Store
the complete measured pre-images in the event data so attestation and
diagnostic tools can audit the values without an out of band copy.
Extend PCR 9 with the initialized contents of kernels, modules, and raw
boot inputs, but record only descriptive labels rather than copying file
contents into the event log.
The Lua module table has no defined traversal order. Retain content
ranges as loader-private metadata, then sort the final file list before
[27 lines not shown]
tests: Improve vn_io_fault1 test
* Declare that the test needs 4 GB of memory so it can be automatically
skipped on systems with low memory.
* Switch back to mmap() as in my initial prototype. Using malloc() is
simpler, but on systems with malloc debugging enabled, malloc() will
prefault the entire buffer, resulting in a false positive. Using
mmap() also guarantees that the buffer is page-aligned, which renders
the test determinstic: we now only need to prefault exactly 2 GB, and
the difference between ret and len will be exactly the amount that we
prefaulted.
* To prefault the buffer, instead of a simple loop that writes zeroes
to it, which a compiler might recognize as dead stores and eliminate,
read the first INT_MAX bytes from the file into it.
PR: 298159
Fixes: ba02bbbe86ae ("tests: Add test for vn_io_fault1 bug")
[2 lines not shown]
powerpc64: don't reserve the red zone on the alternate signal stack
A 64-bit signal frame is 1552 bytes; rounded up and with the 512 byte
red zone added it needs 2096 bytes, more than MINSIGSTKSZ (2048), so a
handler on a minimum size alternate stack had its frame start 48 bytes
below the stack. The red zone only exists below the interrupted code's
stack pointer, so skip it only when the frame goes on that stack.
A handler on a MINSIGSTKSZ alternate stack overwrote the 48 bytes below
it; the frame stays within the stack now.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61519
textproc/py-rst2ansi: unbreak py-b2 after py-docutils 0.22.4
The contributed patch includes the change I proposed and also fixes
a Python 3.14 issue.
The patch backports two fixes from upstream master:
- 81758ed drops the unused docutils.utils.error_reporting imports
(upstream issue #16), the same fix as attachment 274652
- 3728e16 passes an 8-byte struct winsize to the TIOCGWINSZ
ioctl in rst2ansi/get_terminal_size.py; Python 3.14 rejects
the old 4-byte
buffer with SystemError (upstream issue #18)
Also update pkg-descr and switch to pep517.
PR: 298414
Approved by: PopularMoment at protonmail.com (maintainer)
Obtained from: Patrick Crandol
*/*: Fix build with minizip 1.4
Upstream of the minizip moved includes from include to include/minizip.
While here replace LIB_DEPENDS=minizip with USES=minizip.
PR: 300541
Approved by: blanket (fix build)
Exp-run by: antoine
Sponsored by: UNIS Labs
net/wireguard-tools: Add more variables to the rc.d script
Most importantly, this adds support for specifying a non-default routing
table with wireguard_fib.
PR: 269010
MFH: 2026Q4
(cherry picked from commit 3c1fb50dd7a543be4425be45bac79971504c1979)
net/wireguard-tools: Support more interface names in lite flavor
Currently the lite flavor is restricted to using wg<number> interface
names, while the default flavor with wg-quick can use more descriptive
names.
Using `ifconfig wg create name ${interface}` in the rc.d script for the
lite flavor instead of `ifconfig ${interface} create` brings the
flavors to parity here and works on all supported versions of FreeBSD.
While here, pet portfmt.
PR: 300146
MFH: 2026Q4
(cherry picked from commit 9449d6410daee106004facaa066dcb4916200d4e)
net/wireguard-tools: Add more variables to the rc.d script
Most importantly, this adds support for specifying a non-default routing
table with wireguard_fib.
PR: 269010
MFH: 2026Q4
net/wireguard-tools: Support more interface names in lite flavor
Currently the lite flavor is restricted to using wg<number> interface
names, while the default flavor with wg-quick can use more descriptive
names.
Using `ifconfig wg create name ${interface}` in the rc.d script for the
lite flavor instead of `ifconfig ${interface} create` brings the
flavors to parity here and works on all supported versions of FreeBSD.
While here, pet portfmt.
PR: 300146
MFH: 2026Q4
syncache.4: Align lists
Normally I am against tabbing them over so far to align the list, but
in these lists actually the page is 862 lines rendered aligned or using
indent, so aligning it improves readability without scolling regression.
MFC after: 3 days
ioctl: Add a macro for extracting the ioctl number from a command
Sprinkle it in various drivers which hard-coded the command layout.
No functional change intended.
Reviewed by: dumbbell, emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61045
(cherry picked from commit 12b3c29a985d1753693d732372dafe915a890259)
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[8 lines not shown]
malloc: Fix realloc() for large allocations
min() truncates its parameters.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit ca16e7a4920415bf9d09cf76bd2c3cda7447c098)
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
[5 lines not shown]
hv_kvp: Fix some bugs and nits
- Use pending_mutex to synchronize several state flags. In particular,
ensure that two threads can't race to open the device file at the same
time.[1]
- Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a
one-byte OOB read if the caller supplied a large enough read buffer.[2]
- Change the device permissions to 0600: hv_kvp_dev_daemon_read()
returns an error until the owning process registers itself with a
write, so there's no sense in providing read-only access.
- Use bool instead of boolean_t.
- Don't return negative error numbers to userspace.
- Call seldrain() when closing the device.
Reported by: pixelpop [1][2]
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60387
(cherry picked from commit ebf1041fc854c531a27efd9f979e28d57306777d)
bhyve: Fix virtio-input event array resizing
Use the new array size when calling realloc(). Note that this queue
stores events read from a host evdev device, i.e., it is not
guest-controlled.
While here, use the cdefs.h __unused macro and use them correctly, i.e.,
don't mark "arg" as unused when it isn't.
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Fixes: 054accac71e0 ("Add a virtio-input device emulation.")
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60679
(cherry picked from commit f1986e5b88630b1404a202251499bca0f97f5f06)
pam_exec: fix the stderr close test and avoid a double close
The cleanup tested cherr[0] when closing cherr[1]. The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again. Clear each fd after closing and test the right
one.
Reviewed by: des, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60924
(cherry picked from commit 06abe08de45d251410949eac1bbb025367275260)
dhclient: Avoid out-of-bounds reads in check_classless_option()
The loop did not verify that the option buffer is large enough before
reading an address.
Reported by: Andrew Griffiths <andrew at calif.io>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60484
(cherry picked from commit 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b)
