HardenedBSD/src 121dd79sbin/nvmecontrol/modules/intel intel.c, sys/arm/conf GENERIC.hints

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+16-2sbin/nvmecontrol/modules/intel/intel.c
+2-0sys/arm/conf/GENERIC.hints
+2-0sys/arm64/conf/GENERIC.hints
+2-0sys/riscv/conf/GENERIC.hints
+22-24 files

HardenedBSD/src 5b14e93sbin/nvmecontrol/modules/intel intel.c, sys/arm/conf GENERIC.hints

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+16-2sbin/nvmecontrol/modules/intel/intel.c
+2-0sys/arm/conf/GENERIC.hints
+2-0sys/arm64/conf/GENERIC.hints
+2-0sys/riscv/conf/GENERIC.hints
+22-24 files

HardenedBSD/src 94ffbdbsys/arm/conf GENERIC.hints, sys/arm64/conf GENERIC.hints

sys: Empty hints files

Create empty hints files for these platforms. They don't normally need a
hints file, but people use them for device instance wiring. It's less
confusing if they always exist.

Sponsored by:           Netflix
Differential Revision:  https://reviews.freebsd.org/D49052
DeltaFile
+2-0sys/arm/conf/GENERIC.hints
+2-0sys/arm64/conf/GENERIC.hints
+2-0sys/riscv/conf/GENERIC.hints
+6-03 files

HardenedBSD/src 2b14601sbin/nvmecontrol/modules/intel intel.c

nvmecontrol: Add more keys for CA page (Additional smart data)

Micron and Samsung also use this standard, though Micron is known to use
a few different keys. Add the ones that public information say are the
same among those the drives that have them.

There's others, but either they aren't publicly documented in datasheets
or nvme-cli code, or they vary betwen models and our code needs a fair
amount of rework needed.

Also print hex value for unknown keys. This allows scripts to more
easily pick bytes out for those keys who have values that are encoded by
packing multiple values into the 48-bit field.

Sponsored by:           Netflix
DeltaFile
+16-2sbin/nvmecontrol/modules/intel/intel.c
+16-21 files

HardenedBSD/src 2eef41esys/fs/tmpfs tmpfs_subr.c, sys/kern uipc_shm.c

Revert "vm_page: define partial page invalidate"

A negative review arrived as this was being committed, so undo and
reevaluate.

This reverts commit 5611a38d818587b307e1fb110f72d2996c170035.
DeltaFile
+0-50sys/vm/vm_page.c
+43-4sys/fs/tmpfs/tmpfs_subr.c
+43-4sys/kern/uipc_shm.c
+0-2sys/vm/vm_page.h
+86-604 files

HardenedBSD/src 5611a38sys/fs/tmpfs tmpfs_subr.c, sys/kern uipc_shm.c

vm_page: define partial page invalidate

Two different functions in different files do the same thing - fill a
partial page with zeroes. Add that functionality to vm_page.c and
remove it elsewhere to avoid code duplication.

Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D49096
DeltaFile
+50-0sys/vm/vm_page.c
+4-43sys/fs/tmpfs/tmpfs_subr.c
+4-43sys/kern/uipc_shm.c
+2-0sys/vm/vm_page.h
+60-864 files

HardenedBSD/src 561691dsys/netinet tcp_input.c

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+5-8sys/netinet/tcp_input.c
+5-81 files

HardenedBSD/src 5c882a0sys/kern uipc_socket.c, sys/netinet in_pcb.c udp_usrreq.c

Merge remote-tracking branch 'origin/freebsd/14-stable/main' into hardened/14-stable/master

Conflicts:
        sys/netinet/tcp_input.c (unresolved)
DeltaFile
+755-0tests/sys/netinet/fibs_multibind_test.c
+237-0tools/tools/fib_multibind/sink.c
+85-54sys/netinet/in_pcb.c
+69-44sys/netinet6/in6_pcb.c
+29-9sys/netinet/udp_usrreq.c
+20-15sys/kern/uipc_socket.c
+1,195-12226 files not shown
+1,439-23332 files

HardenedBSD/src 28a3e99. .cirrus.yml

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+1-1.cirrus.yml
+1-11 files

HardenedBSD/src 072c10f. .cirrus.yml

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+1-1.cirrus.yml
+1-11 files

HardenedBSD/src 5bd7cf8. .cirrus.yml

Cirrus-CI: Bump image to (supported) 13.4

Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1.cirrus.yml
+1-11 files

HardenedBSD/src 860c84bsys/net pfvar.h, sys/netpfil/pf pf_ioctl.c pf.c

pf: Stop using net_epoch to synchronize access to eth rules

Commit 20c4899a8eea4 modified pf_test_eth_rule() to not acquire the
rules read lock, so pf_commit_eth() was changed to wait until the
now-inactive rules are no longer in use before freeing them.  In
particular, it uses the net_epoch to schedule callbacks once the
inactive rules are no longer visible to packet processing threads.

However, since commit 812839e5aaaf4, pf_test_eth_rule() acquires the
rules read lock, so this deferred action is unneeded.  This patch
reverts a portion of 20c4899a8eea4 such that we avoid using deferred
callbacks to free inactive rules.

The main motivation is performance: epoch_drain_callbacks() is quite
slow, especially on busy systems, and its use in the DIOCXBEGIN handler
in particular causes long stalls in relayd when reloading configuration.

Reviewed by:    kp
MFC after:      2 weeks

    [5 lines not shown]
DeltaFile
+3-29sys/netpfil/pf/pf_ioctl.c
+3-6sys/netpfil/pf/pf.c
+0-1sys/net/pfvar.h
+6-363 files

HardenedBSD/src fba404bsbin/pfctl pfctl_table.c, share/man/man5 pf.conf.5

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+83-71share/man/man5/pf.conf.5
+67-59sys/netpfil/pf/pf.c
+60-1tests/sys/netpfil/pf/pflog.sh
+16-11sbin/pfctl/pfctl_table.c
+7-5sys/netpfil/pf/pf_norm.c
+7-4sys/netpfil/pf/if_pflog.c
+240-1513 files not shown
+248-1599 files

HardenedBSD/src 9d4cba7sbin/pfctl pfctl_table.c, share/man/man5 pf.conf.5

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+83-71share/man/man5/pf.conf.5
+67-59sys/netpfil/pf/pf.c
+60-1tests/sys/netpfil/pf/pflog.sh
+16-11sbin/pfctl/pfctl_table.c
+7-5sys/netpfil/pf/pf_norm.c
+7-4sys/netpfil/pf/if_pflog.c
+240-1513 files not shown
+248-1599 files

HardenedBSD/src fd258b6sbin/ipfw ipfw2.c

ipfw: make 'ipfw show' output compatible with 'ipfw add' command

If rule was added in compact form and rule body is empty, print
'proto ip' opcode to be compatible with ipfw(8) syntax parser.

  Before:
  $ ipfw add allow proto ip
  000700 allow
  After:
  $ ipfw add allow proto ip
  000700 allow proto ip

(cherry picked from commit 706a03f61bbb6e0cf10e6c3727966495b30d763e)
DeltaFile
+7-0sbin/ipfw/ipfw2.c
+7-01 files

HardenedBSD/src dbbcbaasys/netpfil/pf pf.c

pf: Cut down on if statements around pf_icmp_state_lookup

Checked with blambert@, OK millert, henning

Obtained from:  OpenBSD, mikeb <mikeb at openbsd.org>, 12e5d1443d
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+17-22sys/netpfil/pf/pf.c
+17-221 files

HardenedBSD/src 5dad98dsys/netpfil/pf pf.c

pf: remove redundant argument from pf_icmp_state_lookup()

We already pass struct pf_pdesc to pf_icmp_state_lookup(). There's no need to
also pass the direction.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+10-14sys/netpfil/pf/pf.c
+10-141 files

HardenedBSD/src 27cb332sys/netpfil/pf pf_norm.c

pf: micro-optimise padding check

In most cases, IP fragments do not have an Ethernet padding.  So
add a condition to save a useless call to m_adj() and have a paranoid
length check in the other cases.
OK henning@

Obtained from:  OpenBSD, bluhm <bluhm at openbsd.org>, fcf0d61153
Obtained from:  OpenBSD, chris <chris at openbsd.org>, ebe64b684c
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+4-2sys/netpfil/pf/pf_norm.c
+4-21 files

HardenedBSD/src 94bf6a4sys/netpfil/pf pf.c

pf: Cleanup leftover PF_ICMP_MULTI_* code that is not needed anymore.

ok henning

Obtained from:  OpenBSD, mikeb <mikeb at openbsd.org>, ecdc46e922
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+17-19sys/netpfil/pf/pf.c
+17-191 files

HardenedBSD/src 08d0120usr.sbin/bsnmpd/modules/snmp_pf pf_snmp.c

snmp_pf: fix rules->label use

We now support multiple lables on a rule, so 'rule' is an array of strings, not
just one string. Adjust the check for 'is there a label?'.

CID:            1471808
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+1-1usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
+1-11 files

HardenedBSD/src 207f938usr.sbin/bsnmpd/modules/snmp_pf pf_snmp.c

snmp_pf: address Coverity remarks about time_t

On most platforms time_t is 64 bits wide, but we assign it to 32 bits
variables. Unfortunately these are SNMP fields that are defined to be 32 bits
wide, so we cannot change this. We are similarly unable to prevent the passage
of time, meaning that time_t must remain 64 bits wide as well.

Explicitly cast to tell Coverity that we're aware of these limitations and do
not wish to be reminded of them.

CID:            1553869
CID:            1557025
CID:            1592232
CID:            1592234
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+4-4usr.sbin/bsnmpd/modules/snmp_pf/pf_snmp.c
+4-41 files

HardenedBSD/src 83f9b68share/man/man5 pf.conf.5

pf.conf.5: Don't use greater-equal/less-equal symbols where "<="/">=" are intended.

Also, clean up some usage of predefined strings (which are discouraged by
mandoc_char(7) for portability reasons) and improve spacing in
hostapd.conf(5).

ok schwarze@

Obtained from:  OpenBSD, bentley <bentley at openbsd.org>, e369c2e695
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+49-49share/man/man5/pf.conf.5
+49-491 files

HardenedBSD/src 1ba1e15sys/net if_pflog.h pfvar.h, sys/netpfil/pf pf.c if_pflog.c

pf: make log(matches) more useful

change log(matches) semantics slightly to make it more useful. since it
is a debug tool change of semantics not considered problematic.
up until now, log(matches) forced logging on subsequent matching rules,
the actual logging used the log settings from that matched rule.
now, log(matches) causes subsequent matches to be logged with the log settings
from the log(matches) rule. in particular (this was the driving point),
log(matches, to pflog23) allows you to have the trace log going to a seperate
pflog interface, not clobbering your regular pflogs, actually not affecting
them at all.
long conversation with bluhm about it, which didn't lead to a single bit
changed in the diff but was very very helpful. ok bluhm as well.

Obtained from:  OpenBSD, henning <henning at openbsd.org>, f61b1efcce
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+30-11sys/netpfil/pf/pf.c
+7-4sys/netpfil/pf/if_pflog.c
+3-3sys/netpfil/pf/pf_norm.c
+2-2sys/net/if_pflog.h
+1-1sys/net/pfvar.h
+43-215 files

HardenedBSD/src 71cf410share/man/man5 pf.conf.5

pf.conf.5: a shot at documenting the changed log(matches) semantics

Obtained from:  OpenBSD, henning <henning at openbsd.org>, eb4e49a617
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+4-2share/man/man5/pf.conf.5
+4-21 files

HardenedBSD/src 3c0a0deshare/man/man5 pf.conf.5

pf.conf.5: rephrase log() documentation

after some discussion with henning, document the various log options as
one section; some text was altered to make it read better;

ok henning

Obtained from:  OpenBSD, jmc <jmc at openbsd.org>, cea6f9db1f
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+33-23share/man/man5/pf.conf.5
+33-231 files

HardenedBSD/src 921c9c7tests/sys/netpfil/pf pflog.sh

pf tests: test new log(matches) behaviour

Ensure that a log(matches, to pflog1) sends all future matches to pflog1.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+60-1tests/sys/netpfil/pf/pflog.sh
+60-11 files

HardenedBSD/src 8754ba5sbin/pfctl pfctl_table.c

pfctl: Rewrite to void using union sockaddr_union

ok mikeb

Obtained from:  OpenBSD, deraadt <deraadt at openbsd.org>, 8717211fe3
Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+16-11sbin/pfctl/pfctl_table.c
+16-111 files

HardenedBSD/src ab5f6ffsys/dev/qcom_ess_edma qcom_ess_edma.c qcom_ess_edma_hw.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+985-0sys/dev/qcom_ess_edma/qcom_ess_edma.c
+752-0sys/dev/qcom_ess_edma/qcom_ess_edma_hw.c
+514-0sys/dev/qcom_ess_edma/qcom_ess_edma_rx.c
+462-0sys/dev/qcom_ess_edma/qcom_ess_edma_gmac.c
+454-0sys/dev/qcom_ess_edma/qcom_ess_edma_tx.c
+429-0sys/dev/qcom_ess_edma/qcom_ess_edma_reg.h
+3,596-010 files not shown
+4,574-016 files

HardenedBSD/src 2057dcasys/dev/qcom_ess_edma qcom_ess_edma.c qcom_ess_edma_hw.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+985-0sys/dev/qcom_ess_edma/qcom_ess_edma.c
+752-0sys/dev/qcom_ess_edma/qcom_ess_edma_hw.c
+514-0sys/dev/qcom_ess_edma/qcom_ess_edma_rx.c
+462-0sys/dev/qcom_ess_edma/qcom_ess_edma_gmac.c
+454-0sys/dev/qcom_ess_edma/qcom_ess_edma_tx.c
+429-0sys/dev/qcom_ess_edma/qcom_ess_edma_reg.h
+3,596-010 files not shown
+4,574-016 files

HardenedBSD/src cf82a0dsys/arm/conf ASUS_AC1300

ASUS_AC1300: add storage device options

This adds the required bits for the installed NAND/NOR chips.

Differential Revision:  https://reviews.freebsd.org/D49028
DeltaFile
+14-0sys/arm/conf/ASUS_AC1300
+14-01 files