Welcome to 8.3

(martin)

Prepare for 8.3

(martin)

Ticket #1960

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #1960):

sys/netinet6/frag6.c: revision 1.78

frag6: fix calculation of fragment length

Because of the miscalculation, 32 bytes fragmented IPv6 packets
have been wrongly dropped.

See https://mail-index.netbsd.org/tech-net/2024/04/14/msg008741.html
for more details.

Patch from Yasuyuki KOZAKAI (with minor tweaks)

(martin)

Tickets #1955 - #1959

(martin)

Pull up following revision(s) (requested by andvar in ticket #1959):

sys/arch/x86/x86/viac7temp.c: revision 1.10

viac7temp(4): define module metadata using MODULE() macro and implement
viac7temp_modcmd() to handle module load/unload events.

Fixes PR kern/58148. Look OK by mrg@.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1958):

usr.bin/who/utmpentry.c: revision 1.22

PR/56013: Kouichi Hashikawa: Move setutent/setutxent right before the loops.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1957):

external/gpl2/grep/dist/src/grep.c: revision 1.3

PR/56584: Andreas Gustafsson: Skip FIFO's when -D

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1956):

external/bsd/am-utils/dist/include/amq_defs.h: revision 1.2
external/bsd/am-utils/dist/amq/amq_xdr.c: revision 1.2
external/bsd/am-utils/dist/amq/amq.c: revision 1.4
external/bsd/am-utils/dist/amd/amq_subr.c: revision 1.4
external/bsd/am-utils/dist/amd/amq_subr.c: revision 1.5

fix pointer bug (thanks RVP) and change to use 64 bit times. Don't bother
with backwards compatibility; too much work for little benefit.

remove long cast (thanks RVP)

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1955):

distrib/evbarm/instkernel/sshramdisk/Makefile: revision 1.26

evbarm/instkernel/sshramdisk: Put firmware in the right paths.

Maybe this should also be wired up to `release' to put the ramdisk in
the releasedir so we detect destdir path leakage like this had.

PR port-evbarm/58035

(martin)

Tickets #1953 and #1954

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1954):

share/mk/bsd.lib.mk: revision 1.398
share/mk/bsd.lib.mk: revision 1.399
share/mk/bsd.x11.mk: revision 1.152
(via patch)

PR/58104: Kouichi Hashikawa: Use ${TOOL_AWK}

Back-out unintented commit.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1953):

sys/dev/pci/if_iwn.c: revision 1.100

if_iwn.c: pick up proper firmware for Centrino Wireless-N 130

Both variants should use iwlwifi-6000g2b-6 not iwlwifi-6000g2a-6. (It
seems only two specific product variants use iwlwifi-6000g2a-6. We
could simplify by reversing the sense of the test, as OpenBSD does, but
it doesn't seem to matter much, as what we now match seems to be the
full gamut possible, so the simpler diff was chosen here.)

Addresses PR kern/58105 from wandrien.dev%gmail.com@localhost, with the
PCI_PRODUCT_INTEL_WIFI_LINK_130_1 match tested by the reporter. Code
inspection of the FreeBSD driver indicates we should safely be able to
match PCI_PRODUCT_INTEL_WIFI_LINK_130_2 also.

(martin)

Ticket #1952

(martin)

Pull up following revision(s) (requested by uwe in ticket #1952):

external/gpl2/groff/dist/tmac/doc.tmac: revision 1.3

doc.tmac: .Lk - handle punctuation without anchor-text correctly
doc-get-arg-type expects that doc-width is set beforehand, so call
doc-get-width to make sure doc-get-arg-type detects the trailing
punctuation correctly.

PR bin/58074

(martin)

Tickets #1949 - #1951

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1951):

sys/dev/qbus/if_qe.c: revision 1.82

vax/qe(4): supply an ipf->if_init() so that if_init() doesn't crash.

convert the existing qeinit() to one compatible with if_init.
should fix PR#58068.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1949):

etc/etc.amd64/Makefile.inc: revision 1.17
distrib/amd64/ramdisks/common/Makefile.ramdisk: revision 1.17
etc/etc.i386/Makefile.inc: revision 1.70
distrib/i386/ramdisks/common/Makefile.ramdisk: revision 1.16

x86: Release the ramdisks too.

This way we will get cgdroot.fs (and zfsroot.fs too) in the release.
PR misc/57534

(martin)

Pull up following revision(s) (requested by mrg in ticket #1950):

usr.bin/audio/common/wav.c: revision 1.24

audio_wav_parse_hdr: handle zero-length data files again
the previous clean up turns zero-length data into no data and thus
an error, instead of simply doing nothing.  noted by gson.

(martin)

Tickets #1940 and #1948

(martin)

Pull up the following revisions, requested by mrg in ticket #1948:

usr.bin/audio/common/auconv.h                  up to 1.6
usr.bin/audio/common/audio.c                    up to 1.27
usr.bin/audio/common/decode.c                  up to 1.2
usr.bin/audio/common/libaudio.h                up to 1.22
usr.bin/audio/common/sun.c                      up to 1.11
usr.bin/audio/common/wav.c                      up to 1.22
usr.bin/audio/play/audioplay.1                  up to 1.34
usr.bin/audio/play/play.c                      up to 1.64
usr.bin/audio/record/audiorecord.1              up to 1.45
usr.bin/audio/record/record.c                  up to 1.58

- support for playing 32-bit and 64-bit IEEE FP .wav files
- support for recording 24 bit .wav files
- read-overflow fixes for .wav files, and other fixes for the
  wav parser
- audioplay gains -n flag (no play, like make -n)
- audiorecord manual gained useful examples

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1940):

sys/dev/usb/usbdi.c: revision 1.248

usbdi(9): Avoid calling ubm_softint with lock held and polling on.

PR kern/57783

(martin)

Tickets #1945 - #1947

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #1947):

lib/libc/gen/getcap.c: revision 1.58

Fix memory leak in getent()

Memory was not freed if record was not found

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1946):

sys/net/if_tun.c: revision 1.175

tun(4): Allow IPv6 packets with TUNSLMODE configured.
PR kern/58013

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1945):

sys/kern/sysv_shm.c: revision 1.142 (patch)

Avoid overflow when computing kern.ipc.shmmax. Keep shmmax (bytes) and
shmall (pages) values aligned and use arithmetic everywhere instead
of shifts.

Should fix PR 57979

(martin)

Tickets #1939, #1941 - #1944

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1944):

sys/netinet6/in6.c: revision 1.292

netinet6: Avoid NPD on `ifconfig ifN inet6 ... pltime 0 vltime 0'.
PR kern/53922

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1943):

usr.bin/getconf/getconf.c: revision 1.37
usr.bin/getconf/getconf.1: revision 1.14

PR/57875: Jason Bacon: Try again without an _ for portability.
getconf.1: Note that leading underscores in configuration
variable names are ignored by getconf(1).

While here, add a section with examples, and make the synopsis
more concise.

PR bin/57875

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1942):

sys/dev/usb/if_urtwn.c: revision 1.109 (patch)

urtwn(4): Ditch old queued commands on overflow.
Don't increment ring->queued past what the task will decrement.

This is a stop-gap measure; really, we should just have one task for
each operation that is deferred to the task thread.

PR kern/57965

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1941):

lib/libc/net/getnameinfo.3: revision 1.43

Document the NI_NUMERICSCOPE flag.
PR lib/57832

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1939):

lib/libc/net/getnameinfo.c: revision 1.60

PR/57609: Carl Engvall: Add salen checks but accept larger sizes
(upto sockaddr_storage)

(martin)

Ticket #1938

(martin)

Pull up the following, requested by msaitoh in ticket #1938:

sys/dev/pci/if_wm.c 1.792,1.794-1.798 via patch
sys/dev/pci/if_wmreg.h 1.131

- Add RQDPC(Receive Queue Drop Packet Count) to iqdrops.
- Drop frames if the RX descriptor ring has no room on multiqueue system.
- Improve dmesg output.
  - Print RX packet buffer size.
  - Fix the upper 16bit of Image Unique ID(EtrackID).
- Fix comment.

(martin)

Ticket #1937

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1937):

tests/lib/libm/t_fenv.c: revision 1.14
tests/lib/libm/t_fenv.c: revision 1.15
lib/libm/arch/x86_64/fenv.c: revision 1.11

fenv(3): Add test for PR port-amd64/57949.

fenv(3): Fix fetestexcept to avoid side effects on trap state.

PR port-amd64/57949

(martin)

Tickets #1935 and #1936

(martin)

Pull up following revision(s) (requested by shm in ticket #1936):

libexec/utmp_update/utmp_update.c: revision 1.14

Check for non-printable characters in ut_host.

(martin)

Pull up the following, requested by kre in ticket #1935:

external/public-domain/tz/dist/Makefile        up to 1.1.1.38
external/public-domain/tz/dist/NEWS            up to 1.1.1.45
external/public-domain/tz/dist/TZDATA_VERSION  up to 1.37
external/public-domain/tz/dist/africa          up to 1.1.1.33
external/public-domain/tz/dist/asia            up to 1.12
external/public-domain/tz/dist/australasia      up to 1.9
external/public-domain/tz/dist/checknow.awk    up to 1.1.1.2
external/public-domain/tz/dist/etcetera        up to 1.1.1.8
external/public-domain/tz/dist/europe          up to 1.1.1.39
external/public-domain/tz/dist/leap-seconds.list up to 1.7
external/public-domain/tz/dist/leapseconds      up to 1.7
external/public-domain/tz/dist/leapseconds.awk  up to 1.1.1.14
external/public-domain/tz/dist/northamerica    up to 1.1.1.35
external/public-domain/tz/dist/southamerica    up to 1.1.1.25
external/public-domain/tz/dist/theory.html      up to 1.1.1.19
external/public-domain/tz/dist/version          up to 1.12
external/public-domain/tz/dist/zishrink.awk    up to 1.1.1.9
external/public-domain/tz/dist/zonenow.tab      up to 1.1.1.2
doc/3RDPARTY apply patch

Updated tzdata to 2024a

(martin)

Tickets #1931 - #1934

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1934):

sys/dev/hdaudio/hdafg.c: revision 1.29

ignore NULL for hdaudio_audiodev in hdafg_freem

also guard against NULL in ad_{capture,playback}
observed during shutdown on Lenovo W510

(martin)

Pull up the following, requested by msaitoh in ticket #1933:

sys/dev/pci/ixgbe/ix_txrx.c 1.105-1.116 via patch
sys/dev/pci/ixgbe/ixgbe.c 1.345-1.346,1.349 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.94-1.98
sys/dev/pci/ixgbe/ixgbe_type.h 1.62
sys/dev/pci/ixgbe/ixv.c 1.193,1.195-1.196

- Clear the WTHRESH bit field before writing it.
- Optimize ixgbe_txeof().
- Use kmem_zalloc() instead of malloc(,M_ZERO).
- Add QPRDC(Queue Packet Receive Drop Count) into iqdrops.
- No functional change
  - Move assignment of TXD.
  - ixv(4): Remove unused IFF_OACTIVE.
  - Don't include the Flow Director related members to reduce the
    size of struct tx_ring. On amd64 and aarch64, the real size is
    not changed because of the alignment.
  - The descriptor ring size and the alignment are tested in the
    attach function, so it's not required to use
    roundup2(size, DBA_ALIGN).
  - Use #ifdef LRO more to reduce the size of struct rx_ring.
  - Change "me" from 32bit to 8bit because the max is 128.
    This commit doesn't change the real size of ix_queue, tx_ring
    and rx_ring because of the alignment.
  - Th RSC (hardware receive side coalescing) feature has been
    disabled all along, so enclose the code with #ifdef RSC.
  - Remove unused.
  - Modify for the readability.
  - Modify comment.
  - Fix comment. Whitespace.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1932):

sys/dev/pci/if_wm.c: revision 1.793

Add Intel I219-{LM,V}(20,21) support.

(martin)

regen (ticket #1931)

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1931):

sys/dev/pci/pcidevs: revision 1.1477
sys/dev/pci/pcidevs: revision 1.1494
sys/dev/pci/pcidevs: revision 1.1498
sys/dev/pci/pcidevs: revision 1.1499
sys/dev/pci/pcidevs: revision 1.1500
sys/dev/pci/pcidevs: revision 1.1501
sys/dev/pci/pcidevs: revision 1.1502

Add ID for the EXAR XR17V354 PCIe UART.
From Hakan Engvall.
PR kern/57202

pcidevs: Add missing I225/I226 series devices

pcidevs: Add Mellanox ConnectX-6 Lx.

add some newer Areca boards in prep for updating driver

Add Intel C26[26] eSPI.

Update Intel Raptor Lake devices.

Add Intel I219-{LM,V}(20,21)

(martin)

Ticket #1930

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1930):

external/bsd/iscsi/dist/src/lib/protocol.c: revision 1.5

libiscsi: Fix types of Time2Wait and Time2Retain in logout decap.

According to https://www.rfc-editor.org/rfc/rfc7143#section-11.15,
these are both 2-byte quantities.  Loading 4-byte quantities and
passing them through ISCSI_NTOHS might have worked by accident on
x86, but it's not gonna fly on big-endian.  (Fortunately sparc64 is
not just big-endian but also strict-alignment so it caught this
problem!)

XXX Is there an upstream for this code?  doc/3RDPARTY doesn't cite
any easily-followed references.

PR port-sparc64/57784

(martin)

Ticket #1929

(martin)

Pull up following revision(s) (requested by hgutch in ticket #1929):

sys/conf/copyright: revision 1.22

Update copyright notice for 2024.

(martin)

Ticket #1928

(martin)

Pull up the following, requested by kry in ticket #1928:

external/public-domain/tz/dist/checknow.awk    up to 1.1.1.1
external/public-domain/tz/dist/zonenow.tab      up to 1.1.1.1
external/public-domain/tz/dist/CONTRIBUTING    up to 1.1.1.8
external/public-domain/tz/dist/Makefile        up to 1.1.1.37
external/public-domain/tz/dist/NEWS            up to 1.1.1.44
external/public-domain/tz/dist/README          up to 1.1.1.11
external/public-domain/tz/dist/TZDATA_VERSION  up to 1.36
external/public-domain/tz/dist/africa          up to 1.1.1.32
external/public-domain/tz/dist/antarctica      up to 1.1.1.18
external/public-domain/tz/dist/asia            up to 1.11
external/public-domain/tz/dist/australasia      up to 1.8
external/public-domain/tz/dist/backward        up to 1.11
external/public-domain/tz/dist/backzone        up to 1.1.1.27
external/public-domain/tz/dist/checklinks.awk  up to 1.1.1.4
external/public-domain/tz/dist/checktab.awk    up to 1.1.1.13
external/public-domain/tz/dist/etcetera        up to 1.1.1.7
external/public-domain/tz/dist/europe          up to 1.1.1.38
external/public-domain/tz/dist/iso3166.tab      up to 1.1.1.9
external/public-domain/tz/dist/leap-seconds.list up to 1.6
external/public-domain/tz/dist/leapseconds      up to 1.6
external/public-domain/tz/dist/leapseconds.awk  up to 1.1.1.13
external/public-domain/tz/dist/northamerica    up to 1.1.1.34
external/public-domain/tz/dist/southamerica    up to 1.1.1.24
external/public-domain/tz/dist/theory.html      up to 1.1.1.18
external/public-domain/tz/dist/version          up to 1.11
external/public-domain/tz/dist/ziguard.awk      up to 1.1.1.10
external/public-domain/tz/dist/zone.tab        up to 1.1.1.26
external/public-domain/tz/dist/zone1970.tab    up to 1.1.1.27
distrib/sets/lists/base/mi (apply patch)
doc/3RDPARTY (apply patch)

Update tzdata to tzdata2023dgtz.

(martin)

Ticket #1927

(martin)

Pull up following revision(s) (requested by schmonz in ticket #1927):

sys/nfs/nfs_vnops.c: revision 1.325

NFS client: fix interop with macOS 14 servers.

Symptom: a bunch of "Cannot open `.' (Invalid argument)".
thorpej@ analysis and fix: on the first request to read a given
directory, make sure READDIR and READDIRPLUS cookie verifiers are
being set to 0. This is in RFC1813 and macOS must have gotten
stricter about it.

Verified on 10.0_RC1/aarch64 to fix the reproducers in PR kern/57691 as
well as the original use case in which I met the bug: pkg_rr once again
runs to completion.

(martin)

Ticket #1926

(martin)

Pull up following revision(s) (requested by kre in ticket #1926):

usr.bin/systat/vmstat.c: revision 1.92

PR bin/56014 from Kouichi Hashikawa

Don't try to optimise away placing the "s" or " " after "N user"
(" " where N==1, "s" otherwise) when it seems unnecessary, as that
fails when the number of users hasn't changed, but the screen is
being redrawn from nothing (as in after being resumed from a ^Z,
as in the PR, but just doing a ^L would make the same thing happen).

(martin)

Ticket #1925

(martin)

Pull up following revision(s) (requested by kre in ticket #1925):

lib/libc/net/sethostent.c: revision 1.21

Fix a couple of (not very likely) memory leaks, reported by enh@google.com
who attributed them:

  the malloc one was reported to Android (as
  https://android-review.googlesource.com/c/platform/bionic/+/2856549)
  by wuhaitao3 <wuhaitao3@xiaomi.corp-partner.google.com>; Chris Ferris
  <cferris@google.com> then spotted the goto nospc one.

(martin)

Ammend ticket #1920 for additional pullups.
Tickets #1923 and #1924.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1924):

tests/lib/libpthread/Makefile: revision 1.16
lib/libpthread/pthread.c: revision 1.184
distrib/sets/lists/debug/mi: revision 1.424
distrib/sets/lists/tests/mi: revision 1.1297
tests/lib/libpthread/t_stack.c: revision 1.1
tests/lib/libpthread/t_stack.c: revision 1.2
tests/lib/libpthread/t_stack.c: revision 1.3
tests/lib/libpthread/t_stack.c: revision 1.4
tests/lib/libpthread/t_stack.c: revision 1.5
tests/lib/libpthread/t_stack.c: revision 1.6

pthread: Add tests for pthread user stack allocation.
PR lib/57721

libpthread/t_stack: Make this more robust to the guard size bug.
Make sure to allocate enough space for the thread's stack for a guard
even though there shouldn't be one, so that when we run the thread,
it doesn't start with the stack pointer pointing into someone else's
allocation (like malloc) causing stack frames to trash another data
structure -- or causing the user of that data structure to trash the
stack frames.
PR lib/57721

libpthread/t_stack: Omit needless cast in previous.
Arose from an earlier draft of the change.
PR lib/57721

libpthread/t_stack: Appease gcc12 maybe-uninitialized warning.
The jmp_buf is not, in fact, uninitialized at the point of use, but
it doesn't hurt to narrow the scope a bit to between when the jmp_buf
is initialized by setjmp, and when the signal handler might be called
after sigaction.
Noted by prlw1.
PR lib/57721

libpthread/t_stack: Fix format string for size_t.
Tested this on i386 since that had been crashing before, but i386
doesn't see %zu for unsigned int as a problem.
PR lib/57721

pthread: Don't adjust user-allocated stack addresses by guardsize.
PR lib/57721

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1923):

lib/libc/gen/vis.c: revision 1.75-1.86
tests/lib/libc/gen/t_vis.c: revision 1.10-1.14

PR 56260: fix out-of-bounds stack read.

vis(3): Avoid nonportable MIN in portable code.

vis(3) tests: Add xfail test for encoding overflow.

>From Kyle Evans <kevans%FreeBSD.org@localhost>.
PR lib/57573

vis(3) tests: Expand tests and diagnostic outputs on failure.
PR lib/57573

vis(3) tests: Test another overflow edge case.
Related to PR lib/57573.

vis(3): Make maxolen unsigned size_t, not ssize_t.
It is initialized once either to *dlen, which is unsigned size_t, or
to wcslen(start) * MB_MAX_LEN + 1, and wcslen returns unsigned size_t
too.  So there appears to have never been any reason for this to be
signed.
Part of PR lib/57573.

vis(3): Make mbslength unsigned.
Sprinkle assertions and comments justifying the proposition that it
would never go negative if signed.
Obviates need to worry about mblength > SSIZE_MAX.
Prompted by PR lib/57573.

vis(3): Avoid arithmetic overflow before calloc(3).
Prompted by PR lib/57573.

vis(3): Call wcslen(start) only once.
It had better not change between these two times!
Prompted by PR lib/57573.

vis(3): Avoid potential arithmetic overflow in maxolen.
Can't easily prove that this overflow is impossible, so let's add a
check.
Prompted by PR lib/57573.

vis(3): Fix main part of PR lib/57573.
>From Kyle Evans <kevans%FreeBSD.org@localhost>.

vis(3): Fix one more buffer overrun in an edge case.
PR lib/57573

vis(3): Sort includes.  No functional change intended.
Prompted by PR lib/57573.

vis(3): Need <stdint.h> for SIZE_MAX, per C standard.
>From Kyle Evans <kevans%FreeBSD.org@localhost>.
Followup to PR lib/57573.

vis(3): Per KNF, sys/param.h comes before sys/types.h.
Which is nice because that's also lexicographic.

(martin)

Additionally pull up following revision(s) (requested by riastradh in ticket #1920):

tests/lib/libc/sys/Makefile: revision 1.75 (via patch)

t_setrlimit uses alloca now

(martin)

Ticket #1922

(martin)

Pull up following revision(s) (requested by taca in ticket #1922):

etc/namedb/root.cache: revision 1.24
etc/namedb/root.cache: revision 1.25
etc/namedb/root.cache: revision 1.26

sync with most recent (no changes)

Update to 2019093001

Update to 2023112702 (November 27, 2023).

(martin)

Ammend ticket #1920 for additional pullups

(martin)

Additionally pull up the following for ticket #1920:

sys/kern/exec_subr.c 1.87

Fix build for kernels w/o PAX_MPROTECT.

(martin)

Tickets #1920 and #1921

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1921):

sys/ufs/ffs/ffs_vfsops.c: revision 1.382

ffs_sync: Avoid unlocked access to v_numoutput/v_dirtyblkhd.

Found by lockdoc.

PR kern/57606

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1920):

tests/lib/libc/sys/t_setrlimit.c: revision 1.8
tests/lib/libc/sys/t_setrlimit.c: revision 1.9
sys/kern/exec_subr.c: revision 1.86

t_setrlimit: Verify changing RLIMIT_STACK affects access to stack.
PR kern/57711

exec: Map noaccess part of stack with prot=NONE, maxprot=READ|WRITE.
This way, setrlimit(RLIMT_STACK) can grant READ|WRITE access when
increasing the stack size.
PR kern/57711

(martin)

Ticket #1919

(martin)

Pull up following revision(s) (requested by tsutsui in ticket #1919):

external/gpl3/binutils/dist/gas/config/tc-mips.c: revision 1.25

binutils: fix gas that doesn't handle MIPS1 FPR load hazard correctly.
Fixes PR/57680.

(martin)

Tickets #1917 and #1918

(martin)

Apply patch (requested by mrg in ticket #1918):

external/mit/xorg-server/dist/dix/enterleave.h
external/mit/xorg-server/dist/mi/mipointer.c
external/mit/xorg-server/dist/include/eventstr.h
external/mit/xorg-server/dist/randr/rrproperty.c
external/mit/xorg-server/dist/os/auth.c
external/mit/xorg-server/dist/Xi/xiproperty.c

merge security fixes from xorg-server 21.1.9 into xorg-server 1.18.4.

Fixes CVE-2023-5367 and CVE-2023-5380.

(martin)

Pull up following revision(s) (requested by mrg in ticket #1917):

external/mit/xorg-server.old/dist/dix/enterleave.h: revision 1.2
external/mit/xorg-server.old/dist/mi/mipointer.c: revision 1.2
external/mit/xorg-server.old/dist/include/eventstr.h: revision 1.2
external/mit/xorg-server.old/dist/randr/rrproperty.c: revision 1.2
external/mit/xorg-server.old/dist/os/auth.c: revision 1.4
external/mit/xorg-server.old/dist/Xi/xiproperty.c: revision 1.2

merge security fixes from xorg-server 21.1.9 into xorg-server 1.10.6.

Fixes CVE-2023-5367 and CVE-2023-5380.

(martin)

Ticket #1916

(martin)

Pull up following revision(s) (requested by buhrow in ticket #1916):

sys/dev/pci/mpii.c: revision 1.30

Fixes for PR kern/57133:

I can now explain why this assert is firing and have a fix for it.  It is a  regression introduced in R1.22 of mpii.c.

        If a request comes in and the IOC returns a MPII_SCSIIO_STATUS_CHECK_COND condition, after
a successful transfer, or one that is a recovered error,
mpii(4) correctly sets the xs->error to XS_SENSE, but incorrectly sets xs->resid to 0 before
returning the xfer to the upper scsi layers.  Once the upper layers get it, they notice the
XS_SENSE check condition and because it's a retryable error, they increment xs_requeuecnt, set
ERESTART and send the xfer request down to the mpii(4) layer again for a retry. What they do
not do is reset xs->resid equal to xs->datalen.  When the xfer comes down to mpii(4) again, the
assert happens.  The fix is for the mpii(4) driver to leave xs->resid alone when it encounters
a MPII_SCSIIO_STATUS_CHECK_COND condition.

This bug affects NetBSD-10, netbsd-9 and netbsd-8.

(martin)

Tickets #1914 and #1915

(martin)

regen (for ticket #1915)

(martin)

Pull up the following, requested by msaitoh in ticket #1915:

sys/dev/pci/pcidevs 1.1497
sys/dev/pci/if_wm.c 1.689,1.790-1.791 via patch
sys/dev/pci/if_wmreg.h 1.120 via patch
sys/dev/pci/if_wmvar.h 1.51

- Use 12K for packet buffer for jumbo frame on PCH2 and newer.
- Add new workaround for Tiger Lake and newer to avoid packet loss.
- Add I219{V,LM}({22,23}) devices (Raptor Lake).

(martin)

Pull up the following, requested by msaitoh in ticket #1914:

sys/dev/pci/ixgbe/ix_txrx.c 1.103-1.104
sys/dev/pci/ixgbe/ixgbe.c 1.334-1.338,
1.341-1.344 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.90-1.93
sys/dev/pci/ixgbe/ixgbe_82599.c 1.31-1.32
sys/dev/pci/ixgbe/ixgbe_api.c 1.29
sys/dev/pci/ixgbe/ixgbe_bypass.h 1.5
sys/dev/pci/ixgbe/ixgbe_common.c 1.46-1.47
sys/dev/pci/ixgbe/ixgbe_common.h 1.18
sys/dev/pci/ixgbe/ixgbe_dcb.c 1.14-1.15
sys/dev/pci/ixgbe/ixgbe_dcb_82598.c 1.13
sys/dev/pci/ixgbe/ixgbe_type.h 1.59-1.61
sys/dev/pci/ixgbe/ixgbe_x540.c 1.24
sys/dev/pci/ixgbe/ixgbe_x550.c 1.28
sys/dev/pci/ixgbe/ixv.c 1.187-1.192 via patch

- ixg(4): Add 82599 LS support once again.
- ixg(4): Filter out spurious link up indication more.
- ixg(4): Print DEVICE_CAPS register.
- ixg(4): Fix a bug that the number of queues is unintentionally
  limited to a small number or wrong error message may be printed
  when two devices' number of MSI-X vectors are different.
- Modify error message of wrong TX/RX descriptor size.
- Enable interrupt after setting IFF_RUNNING.
- Fix a bug that changing hw.ix[gv]X.qY.interrupt_rate would change
  all devices all queues default interrupt rate.
- Cleanup the code.

(martin)

Tickets #1911 - #1913

(martin)

Regen for ticket #1913 (Intel 82599 LS and Pericom(Diodes) PCIe switches added)

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1913):

sys/dev/pci/pcidevs: revision 1.1493
sys/dev/pci/pcidevs: revision 1.1495

Add Intel 82599 LS.
Add Pericom(Diodes) PCIe switches.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1912):

sys/dev/pci/ixgbe/if_bypass.c 1.10
sys/dev/pci/ixgbe/if_fdir.c 1.6 via patch
sys/dev/pci/ixgbe/if_sriov.c 1.18 via patch
sys/dev/pci/ixgbe/ix_txrx.c 1.102 via patch
sys/dev/pci/ixgbe/ixgbe.c 1.333,1.339 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.89
sys/dev/pci/ixgbe/ixgbe_api.h 1.17
sys/dev/pci/ixgbe/ixgbe_common.h 1.17
sys/dev/pci/ixgbe/ixgbe_bypass.h 1.4
sys/dev/pci/ixgbe/ixgbe_common.c 1.45
sys/dev/pci/ixgbe/ixgbe_fdir.h 1.5
sys/dev/pci/ixgbe/ixgbe_netmap.h 1.3
sys/dev/pci/ixgbe/ixgbe_netmap.c 1.6
sys/dev/pci/ixgbe/ixgbe_osdep.c 1.9
sys/dev/pci/ixgbe/ixgbe_sriov.h 1.6
sys/dev/pci/ixgbe/ixgbe_type.h 1.58
sys/dev/pci/ixgbe/ixgbe_x550.c 1.27
sys/dev/pci/ixgbe/ixv.c 1.186 via patch

ixgbe: Rename some definitions, modify comment. No functional change.
Apply changes from FreeBSD's ix-3.3.31 and ixv-1.5.32.
    - struct adapter *adapter -> struct ixgbe_softc *sc
    - master -> primary
    - black -> block

ixg(4): Whitespace. No functional change.

(martin)

Pull up following revision(s) (requested by abs in ticket #1911):

sys/dev/pci/ahcisata_pci.c: revision 1.71

Add support for ASMEDIA 0x0624
... an AHCI SATA adaptor which identifies itself as an IDE storage device

(martin)

Regen for ticket #1911 (add ASMEDIA 0x0624 - ASM1062 + JMB575 Port Multiplier)

(martin)

Pull up following revision(s) (requested by abs in ticket #1911):

sys/dev/pci/pcidevs: revision 1.1496

Add entry for ASMEDIA 0x0624 - ASM1062 + JMB575 Port Multiplier

(martin)

Tickets #1909 and #1910

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1910):

sys/dev/pci/if_wm.c: revision 1.785
sys/dev/pci/if_wm.c: revision 1.786
sys/dev/pci/if_wm.c: revision 1.787
sys/dev/pci/if_wm.c: revision 1.788
sys/dev/pci/if_wm.c: revision 1.789

wm(4): Use SCVPC and HRMPC for 82575 and newer.
  The SCVPC(SerDes/SGMII Code Violation Packet Count) register and the HRMPC
  (Header Redirection Missed Packet Count) register were added in if_wm.c
  rev. 1.776 but the location in the code were incorrect. Fix them.

wm(4): Add some info to some event counters.
- The difference between the RUC(Rx Undersize) and RFC(Rx Fragment) is whether
  the CRC is valid or not.
- The difference between the ROC(Rx Oversize) and RJC(Rx Jabber) is whether
  the CRC is valid or not.
- LENERRS(Length Errors) is for the length/type field <= 1500.

wm(4): the IAC(Interrupt Assertion Count) register is for 82571 and newer.

wm(4): Modify descriptions of flow control related event counters.

wm(4): Replace /* nothing */ to __nothing for evcnt macros
Prevent empty if bodies for !WM_EVENT_COUNTERS.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1745):

sys/dev/pci/ixgbe/ixgbe.c 1.327-1.332 via patch
sys/dev/pci/ixgbe/ixgbe.h 1.87-1.88
sys/dev/pci/ixgbe/ixv.c 1.184-1.185
sys/dev/pci/ixgbe/ix_txrx.c 1.101
sys/dev/pci/ixgbe/ixgbe_82599.c 1.30
sys/dev/pci/ixgbe/ixgbe_vf.c 1.32-1.33
sys/dev/pci/ixgbe/ixgbe_vf.h 1.18
sys/dev/pci/ixgbe/ixgbe_mbx.h 1.20
sys/dev/pci/ixgbe/ixgbe_type.h 1.57

- Reorder some event counters for readability.
- Rename some descriptions of event counters.
- Count Queue Bytes {Transmit, Receive} counter.
- Improve error check in ixgbe_check_mac_link_vf().
- Add new IXGBE_VF_GET_LINK_STATE message support.
  The VF's link state can be forced to down by PF.
- Update FCTRL after writing multicast filter.
- Update comments.

(martin)

Ticket #1908

(martin)

Apply patch, requested by mrg in ticket #1908:

xsrc/external/mit/libXpm/dist/src/CrPFrBuf.c (apply patch)
xsrc/external/mit/libXpm/dist/src/CrPFrDat.c (apply patch)
xsrc/external/mit/libXpm/dist/src/CrPFrI.c (apply patch)
xsrc/external/mit/libXpm/dist/src/RdFToP.c (apply patch)
xsrc/external/mit/libXpm/dist/src/XpmI.h (apply patch)
xsrc/external/mit/libXpm/dist/src/create.c (apply patch)
xsrc/external/mit/libXpm/dist/src/data.c (apply patch)
xsrc/external/mit/libX11/dist/src/CrPixmap.c (apply patch)
xsrc/external/mit/libX11/dist/src/ImUtil.c (apply patch)
xsrc/external/mit/libX11/dist/src/PutImage.c (apply patch)
xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c (apply patch)

Backport of upstream libX11 and libXpm 2023-10 security updates,
fixing: CVE-2023-43785, CVE-2023-43786, CVE-2023-43787, CVE-2023-43788,
CVE-2023-43789

(martin)

Tickets #1900 - #1907

(martin)

Pull up following revision(s) (requested by lukem in ticket #1907):

libexec/ftpd/version.h: revision 1.80

NetBSD-ftpd 20230930

Update version to "NetBSD-ftpd 20230930" for changes:
- fix uninitialized memory usage in count_users()
- fix pam_set_item call with proper struct passed as PAM_SOCKADDR

(martin)

Pull up following revision(s) (requested by lukem in ticket #1906):

libexec/ftpd/ftpd.c: revision 1.208

pam_set_item PAM_SOCKADDR expects sockaddr_storage structure

Instead, internal struct sockinet was used. Because it's length is shorter
than sockaddr_storage, libpam was copying also memory outside of sockinet
struct.

(martin)

Pull up following revision(s) (requested by lukem in ticket #1905):

libexec/ftpd/conf.c: revision 1.65

Fix uninitialized memory usage in count_users()

If the file was previously empty, pids table is not set, the code however used
pids[0] which is uninitialized in this case. In some scenarios it may lead to
propagate garbage value from pids[0] to the file and cause writing outside of
allocated memory.

OK lukem@

(martin)

Pull up following revision(s) (requested by lukem in ticket #1904):

libexec/ftpd/ftpcmd.y: revision 1.95

Add missing check_login checks for MLST and MLSD

(martin)

Pull up following revision(s) (requested by lukem in ticket #1903):

libexec/ftpd/ftpd.c: revision 1.207
libexec/ftpd/version.h: revision 1.78

ftpd: improve seteuid error handling

Handle seteuid() failures. Per suggestion by Simon Josefsson.

Consistent logging and fatal exit if uid/gid switching fails.

Log correct errno if dataconn() fails.

(martin)

Pull up following revision(s) (requested by lukem in ticket #1902):

libexec/ftpd/ftpd.c: revision 1.206

Treat failed chdir/chroot for guest and chroot accounts as fatal.

Also treat failed set{e,}(u,g}id calls as fatal.

Addresses CVE-2020-7468, via FreeBSD.

(martin)

Pull up following revision(s) (requested by lukem in ticket #1901):

libexec/ftpd/extern.h: revision 1.65
libexec/ftpd/ftpd.c: revision 1.205

bump sizes

(martin)

Pull up following revision(s) (requested by lukem in ticket #1900):

libexec/ftpd/ftpd.8: revision 1.87
libexec/ftpd/ftpd.c: revision 1.204

Add -f option to ftpd to stay in foreground with -D.

>From nia in PR bin/53221.

(martin)

Tickets #1898 and #1899

(martin)

Pull up following revision(s) (requested by gutteridge in ticket #1899):

share/examples/wpa_supplicant/wpa_supplicant.conf: revision 1.4

wpa_supplicant.conf: fix connection string for Eduroam
"MSCHAPV2" must have an uppercase "V" in the connection string.

Reported by nebbionegiuseppe at gmail.com in PR misc/57634.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1898):

lib/libpam/modules/pam_krb5/pam_krb5.c: revision 1.32

pam_krb5: Fix PR lib/57631.

Loose ends in the fix for NetBSD-SA2023-006 that weren't caught by
review or, somehow, by my own testing.  Evidently we need automatic
tests for this pam business.

(martin)

Ticket #1897

(martin)

Pull up following revision(s) (requested by rin in ticket #1897):

sys/arch/i386/stand/efiboot/Makefile.efiboot: revision 1.22
sys/arch/i386/stand/efiboot/eficpufunc.c: revision 1.1
sys/arch/i386/stand/efiboot/eficpufunc.h: revision 1.1
sys/arch/i386/stand/efiboot/eficons.c: revision 1.13
sys/arch/i386/stand/efiboot/eficons.c: revision 1.14

efiboot/x86: Add serial console support via raw I/O port access

Unfortunately, some (most?) UEFI implementations do not support
com ports by ``Serial I/O Protocol''.
``PNP0501-0'' and friends are not recognized also.

In this case, if user explicitly requires to switch to serial
console by ``consdev'' command, try to use raw I/O port access.

Ugly, but what FreeBSD does, at least.
Proposed as PR port-amd64/57523

efiboot/x86: eficons.c: Explicitly include params.h for howmany()

NFC for -current and netbsd-10, but necessary for netbsd-[89] to
pull up raw IO serial port support (PR port-amd64/57523).

(martin)

Ticket #1896

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1896):

lib/libpam/modules/pam_ksu/pam_ksu.c: revision 1.11

pam_ksu(8): Allow homedir access during kuserok.

Otherwise, the default kuserok logic to look at ~targetuser/.k5login
would be blocked by the security measure to thwart NetBSD-SA2023-005.

(There are other ways, e.g. setting SYSTEM-K5LOGIN in /etc/krb5.conf
so the file is /etc/k5login.d/user instead of ~user/.k5login, but
that's not the default configuration and there are plenty of
deployments that rely on ~user/.k5login today.)

I reviewed libkrb5 for homedir access checks.  There are three:
1. krb5_config_parse_file_multi, called only by:
  - verify_krb5_conf -- not relevant
  - krb5_config_parse_file -- not used here as far as I can tell,
    only by libhdb ldap logic and test code in heimdal
  - krb5_set_config_files -- used here only via krb5_init_context,
    which is done at this point
2. plugin_get_hosts in krbhst.c, used to look up hosts for KDC I/O,
  which shouldn't be happening at this point, so this is almost
  certainly unreachable; also it only appears to control whether
  some old plugin API can be used, long after we have read the krb5
  config controlling which plugins are available, so this is
  probably harmless
3. krb5_kuserok, which is the one we want to allow

Note: This will have to be updated again in the next Heimdal update,
which eliminates the global homedir access flag in favour of making
the default per-context homedir access flag conditional on !issuid.

(martin)

Ticket #1895

(martin)

Pull up following revision(s) (requested by mrg in ticket #1895):

crypto/external/bsd/openssl/dist/crypto/sparccpuid.S: revision 1.11

fix SPARC v8/v9 detection code.

this code uses a trick where the encoding on both v8 and v9 are
the same, and are not illegal instructions, but that the v9 one
has a detectable difference than v8.

the idea is that we perform a "subcc" (set condition codes) which
sets "%ccr" on v9, which is an unimplemented "%asr2" on v8, then
we read %ccr (v9) or %asr2 (v8), which will always be 0x99 on v9,
and .. is non-trapping but impleentation defined on v8.

for many implementations this returns the value of the %y reg.

as nothing actually sets %y in this path, it remains the value it
was most recently set to by something (anything), and if it just
happens to be 0x99 then the v9 paths will be taken on v8.

fix this by clearing the %y register before the potential read.

fixes PR port-sparc/57594.  tested on ss20 and in qemu.  this
version of the patch has been submitted upstream.

(martin)

Ticket #1894

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1894):

sys/dev/pci/if_wmvar.h: revision 1.50
sys/dev/pci/if_wm.c: revision 1.783,1.784 via patch

Delay sending LINK_STATE_UP to prevent dropping packets on I35[04] and I21[01].

Some (not all) systems use I35[04] or I21[01] don't send packet soon
after linkup. The MAC send a packet to the PHY and any error is not
observed. This behavior causes a problem that gratuitous ARP and/or
IPv6 DAD packet are silently dropped. To avoid this problem, don't
call mii_pollstat() here which will send LINK_STATE_UP notification
to the upper layer. Instead, mii_pollstat() will be called in
wm_gmii_mediastatus() or mii_tick() will be called in wm_tick().

Note that the similar workaround is in Linux's igb driver though it's
only for I21[01].

OK'd by hikaru@ and knakahara@.

Fix #ifdef WM_DEBUG code in wm_gmii_i82544_{read,write}reg_locked.

(martin)

Tickets #1890 - #1893

(martin)

Pull up following revision(s) (requested by kardel in ticket #1893):

sys/net/npf/npf_ruleset.c: revision 1.52

The analysis documented in PR misc/56990 is correct.

Fix by not returning when encountering a ruleset rule.

The code up to now would stop at any group rule.
ruleset rules are marked as group rule and a dynamic rule.
processing is only finished when a result is present AND
we are looking at a plain group rule.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1892):

usr.sbin/cpuctl/cpuctl.8: revision 1.21
usr.sbin/cpuctl/cpuctl.c: revision 1.33

Unless -v is given, ignore EEXIST errors from the IOC_CPU_UCODE_APPLY ioctl()
used to implement "cpuctl ucode N",  which indicates that the microcode
to be loaded already exists in the CPU, and as such, isn't really a
very interesting "error".

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1891):

sys/dev/pci/ichsmb.c: revision 1.85
sys/dev/pci/ismt.c: revision 1.11

ichsmb(4),ismt(4): Add Snow Ridge support.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1890):

sys/arch/x86/pci/pci_machdep.c: revision 1.94

Fix detection of availability of MSI/MSI-X on some systems.

Try to find all functions on bus 0, device 0 to find a PCI host bridge.
Some CPU's host bridge is at 0:0.4. Tested by Intel Snow Ridge.

(martin)

Tickets #1888 and #1889

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1889):

sys/dev/pci/sdhc_pci.c: revision 1.21

Add quirk setting for some Intel eMMC devices.

On some Intel eMMC controllers, the driver reports "autoconfiguration error:
couldn't enable card: 60" even though they really have eMMC device.

This change fixes the problem on some machines. It might be required more
quirks for newer devices (or HS400 support). At least, this change fixes the
problem on GIGABYTE MA10-ST0.

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1888):

sys/arch/x86/pci/amdzentemp.c: revision 1.20
sys/arch/x86/pci/amdsmn.c: revision 1.17
sys/arch/x86/pci/amdzentemp.c: revision 1.19

Add Zen4 Ryzen "Phoenix" support.
Add Zen2 Mendocino APU support.
Add Zen4 Phoenix support.

(martin)

Ticket #1887

(martin)

regen (for ticket #1887)

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1887):

sys/dev/pci/pcidevs: revision 1.1483-1.1492

Add AMD 19h/7xh Root Complex.
pcidevs: add ASMedia ASM106x

Add Intel Snow Ridge devices.

Fix some descriptions of Intel Snow Ridge.

Add Intel I226 devices.

Add device ids of the VX800 chipset and s3 chrome 500 series GPU.
Descriptions mainly aligned with VX800/820 Series System Programming Manual.
fix duplicate definition.

Add some Intel Xeon D-2100 devices. Fix description of Intel 0x37d0.

Simplify descriptions of Snow Ridge internal Ethernet devices.

Rename PCI to PCIE for naming consistency.

(martin)

Ticket #1886

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1886):

distrib/sets/lists/debug/mi 1.409 (patch)
distrib/sets/lists/tests/mi 1.1280 (patch)
libexec/ld.elf_so/Makefile 1.145-1.147 (patch)
libexec/ld.elf_so/hash.c 1.1
libexec/ld.elf_so/hash.h 1.1
libexec/ld.elf_so/reloc.c 1.118 (patch)
libexec/ld.elf_so/rtld.c 1.215 (patch)
libexec/ld.elf_so/rtld.h 1.145,1.147 (patch)
libexec/ld.elf_so/symbol.c 1.74-1.76 (patch)
tests/libexec/ld.elf_so/Makefile 1.21 (patch)
tests/libexec/ld.elf_so/t_hash.c 1.1

The SysV ABI specifies that the symbol hash function should return only 32
bits of hash. Unfortunately due to an implementation bu and the fact that
the return type is unsigned long which is 64 bits in LP64, this can fail
in some cases: "\xff\x0f\x0f\x0f\x0f\x0f\x12". See:
https://maskray.me/blog/2023-04-12-elf-hash-function

>From Ed Maste @ FreeBSD:
https://cgit.freebsd.org/src/commit/?id=29e3a06510823edbb91667d21f530d3ec778116d

Need to write Unit Tests for this.

Oops wrong mask.

ld.elf_so: Split SRCS onto multiple lines.
Makes updates easier.
No functional change intended.

ld.elf_so: Sort SRCS.
No functional change intended.

ld.elf_so: Split hash functions into a separate file.
This way we can test them in isolation.
No functional change intended.

ld.elf_so: Add some known-answer tests for hash functions.

Make sure the testing mechanism detects the traditional overflow bug.

(martin)

Tickets #1878 - #1885

(martin)

Apply patch, requested by ozaki-r in ticket #1885:

sys/net/bpf.c (apply patch)

bpf: allow to read with no filter (regressed at revision 1.213,
fixed differently in -current)

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #1884):

sys/netinet6/in6.c: revision 1.289
sys/netinet6/ip6_output.c: revision 1.234

in6: clear ND6_IFF_IFDISABLED to allow DAD again on link-up

in6: don't send any IPv6 packets over a disabled interface

(martin)

Pull up following revision(s) (requested by ozaki-r in ticket #1883):

sys/netinet6/in6_src.c: revision 1.92

in6: add missing rtcache_unref to in6_selectroute

By default, this issue is harmless.  However, if NET_MPSAFE
is enabled, it could eventually lead to a kernel panic.

(martin)

Apply patch, requested by riastradh in ticket #1882 (issue solved differently
in -current):

sys/kern/init_main.c (apply patch)

PR kern/55906: create the aiodone workqueue before running mountroothooks.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1881):

usr.sbin/ldpd/socketops.c: revision 1.36
usr.sbin/ldpd/fsm.c: revision 1.16
usr.sbin/ldpd/ldp_peer.c: revision 1.19

ldpd(8): Fix address of misaligned packed members.

PR kern/56895

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1880):

sys/uvm/uvm_map.c: revision 1.403 (patch)

mmap(2): Avoid arithmetic overflow in search for free space.

PR kern/56900

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1879):

usr.bin/find/main.c: revision 1.32
usr.bin/find/function.c: revision 1.80

PR/57313: Timo Buhrmester: Don't bail if "." cannot be opened. From FreeBSD

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1878):

lib/libpthread/arch/x86_64/pthread_md.h: revision 1.13
lib/libpthread/pthread_int.h: revision 1.110
lib/libpthread/pthread_int.h: revision 1.111
lib/libpthread/arch/i386/pthread_md.h: revision 1.21
lib/libpthread/arch/arm/pthread_md.h: revision 1.12
lib/libpthread/arch/arm/pthread_md.h: revision 1.13
lib/libpthread/pthread_spin.c: revision 1.11
lib/libpthread/arch/aarch64/pthread_md.h: revision 1.2

libpthread: Use __nothing, not /* nothing */, for empty macros.

No functional change intended -- just safer to do it this way in case
the macros are used in if branches or comma expressions.
PR port-arm/57437 (pthread__smt_pause/wake issue)

libpthread: New pthread__smt_wait to put CPU in low power for spin.

This is now distinct from pthread__smt_pause, which is for spin lock
backoff with no paired wakeup.

On Arm, there is a single-bit event register per CPU, and there are two
instructions to manage it:
- wfe, wait for event -- if event register is clear, enter low power
  mode and wait until event register is set; then exit low power mode
  and clear event register
- sev, signal event -- sets event register on all CPUs (other
  circumstances like interrupts also set the event register and cause
  wfe to wake)

These can be used to reduce the power consumption of spinning for a
lock, but only if they are actually paired -- if there's no sev, wfe
might hang indefinitely.  Currently only pthread_spin(3) actually
pairs them; the other lock primitives (internal lock, mutex, rwlock)
do not -- they have spin lock backoff loops, but no corresponding
wakeup to cancel a wfe.

It may be worthwhile to teach the other lock primitives to pair
wfe/sev, but that requires some performance measurement to verify
it's actually worthwhile.  So for now, we just make sure not to use
wfe when there's no sev, and keep everything else the same -- this
should fix severe performance degredation in libpthread on Arm
without hurting anything else.

No change in the generated code on amd64 and i386.  No change in the
generated code for pthread_spin.c on arm and aarch64 -- changes only
the generated code for pthread_lock.c, pthread_mutex.c, and
pthread_rwlock.c, as intended.
PR port-arm/57437

(martin)

Apply addition patch to fix the build, requested by riastradh
in ticket #1868:

sys/dev/spkr.c (apply patch)

Pacify -Wsign-compare.

(martin)

Ticket #1877

(martin)

Pull up following revision(s) (requested by skrll in ticket #1877):

sys/dev/usb/ehci.c: revision 1.317

PR 57518: usb keyboard causes host controller to miss microframe

As per the USB 2.0 specification section 11.18.4; paragraph 3.b
For interrupt IN/OUT full-/low-speed transactions, the host must  schedule a
complete-split transaction in each of the two microframes following the
first microframe in which the full-/low-speed transaction is budgeted. An
additional complete-split must also be scheduled in the third following
microframe unless the full-/low-speed transaction was budgeted to start
in microframe Y6.

(martin)

Tickets #1868 - #1876

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1876):

sys/external/bsd/drm2/linux/linux_ww_mutex.c: revision 1.15

drm/linux_ww_mutex: Fix wait loops.

If cv_wait_sig returns because a signal is delivered, we may
nonetheless have been granted the lock.  It is harmless for us to
ignore this fact in three of the four paths, but in
ww_mutex_state_wait_sig, we may now have ownership of the lock and
MUST NOT return failure because the caller MUST release the lock
before destroying the ww_acquire_ctx.

While here, restructure the other three loops for clarity, so they
match the structure of the fourth and so they have a little less
impenetrable negation.

PR kern/57537

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1875):

sys/external/bsd/drm2/linux/linux_ww_mutex.c: revision 1.10

drm: Spruce up ww_mutex comments.  Audit return values.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1874):

sys/external/bsd/drm2/linux/linux_ww_mutex.c: revision 1.16

drm/linux_ww_mutex: Fix ww acquire context ordering.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1873):

sys/dev/acpi/acpica/acpi_func.h: revision 1.7 (patch)

acpi(4): Fix membars in ACPI_ACQUIRE/RELEASE_GLOBAL_LOCK.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1872):

sys/fs/tmpfs/tmpfs_subr.c: revision 1.116
sys/fs/tmpfs/tmpfs_subr.c: revision 1.117

tmpfs: Refuse sizes that overflow round_page.

tmpfs: Assert no arithmetic overflow in directory node tn_size.
Need >2^57 directory entries before this is a problem.  If we created
a million per second, this would take over 4000 years.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1871):

libexec/ld.elf_so/rtld.c: revision 1.213

dlopen(3): Read _rtld_objtail under the lock.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1870):

sys/dev/isapnp/sb_isapnp.c: revision 1.54
sys/dev/ofisa/sb_ofisa.c: revision 1.24

sb(4): Fix missing mutex initialization at isapnp and ofisa.
PR kern/57363

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1869):

sys/dev/usb/xhci.c: revision 1.176
sys/dev/usb/xhcivar.h: revision 1.23

xhci(4): Defer root intr xfers while polling.

Root intr xfers require taking adaptive locks, which is forbidden
while polling.

This is not great -- any USB transfer completion callbacks might try
to take adaptive locks, not just uhub_intr, and that will always
causes trouble.  We get lucky with ukbd_intr because it's not
MP-safe, so it relies only on the kernel lock (a spin lock) anyway.
But this change brings xhci in line with ehci.

PR kern/57326

(martin)

Apply patch, requested by riastradh in ticket #1859:

        sys/arch/mips/include/asm.h    (apply patch)

Additional build fix for mips1 (and mips2?)
(patch taken from [pullup-9 #1676])

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1868):

sys/dev/spkr.c: revision 1.25 (patch)

spkr(4): Avoid some overflow issues.

(martin)

Tickets #1859 - #1867

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1867):

sys/kern/uipc_domain.c: revision 1.109

sockaddr_alloc(9): Avoid uninitialized buffer in sockaddr_checklen.

Manifests only under DIAGNOSTIC because the DIAGNOSTIC check itself
uses an uninitialized buffer.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1866):

sys/netatalk/at_control.c: revision 1.44

atalk(4): Don't let userland control sa_len when adding addresses.
- The struct sockaddr_at object accessed by at_ifinit always comes
  from an ioctl buffer that is adequately sized and fully initialized
  from userland memory.
- The newly created sockaddr_at object is later used with
  sockaddr_copy, which requires sa_len to be correctly initialized.
- sa_len is not generally required to be correctly initialized by
  userland in most entry points (with some exceptions, e.g. gif(4)
  configuration).

I don't know whether existing userland programs initialize sa_len
correctly; if they do, we can verify it matches sizeof(struct
sockaddr_at), but there's no need to copy sa_len then if it is
verified to be that fixed value.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1865):

sys/fs/hfs/libhfs.h: revision 1.9
sys/fs/hfs/libhfs.c: revision 1.16
sys/fs/hfs/libhfs.c: revision 1.17

fs/hfs: Avoid buffer overrun in hfslib_reada_node_offsets.

fs/hfs: Avoid undefined pointer arith in hfslib_reada_node_offsets.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1864):

sys/arch/xen/x86/hypervisor_machdep.c: revision 1.46 (patch)

xen/x86: Need kpreempt_disable/enable around curcpu() access.

This is called with `hardware' interrupts enabled (between sti and
cli), so presumably preemption is possible here.

(martin)

Apply patch, requested by riastradh in ticket #1863, pulling up
the essential part of

sys/arch/xen/xen/if_xennet_xenbus.c 1.129

xennet(4): Add missing membar.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1862):

sys/arch/xen/x86/xen_intr.c: revision 1.31 (patch)
sys/arch/xen/include/xen.h (apply patch)

xen_intr.c: Use kpreempt_disable/enable around access to curcpu().

curcpu() is not otherwise guaranteed to be stable at these points.

While here, nix nonsensical membars.  This need only be synchronized
with interrupts on the same CPU.

Proposed on port-xen:
https://mail-index.netbsd.org/port-xen/2022/07/13/msg010250.html

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1861):

sys/kern/kern_rwlock.c: revision 1.68 (patch)

rwlock(9): Fix membars.

rw_downgrade must be a release operation, and rw_tryupgrade must be
an acquire operation.  membar_producer is not enough -- need to use
membar_release and membar_acquire.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2023/02/22/msg028726.html

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1860):

sys/kern/kern_rwlock.c: revision 1.67
sys/kern/kern_lock.c: revision 1.182
sys/kern/kern_mutex.c: revision 1.102
(all via patch)

Sprinkle __predict_{true,false} for panicstr checks

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1859):

sys/arch/ia64/ia64/vm_machdep.c: revision 1.18
sys/arch/powerpc/powerpc/locore_subr.S: revision 1.67
sys/arch/aarch64/aarch64/locore.S: revision 1.91
sys/arch/mips/include/asm.h: revision 1.74
sys/arch/hppa/include/cpu.h: revision 1.13
sys/arch/arm/arm/armv6_start.S: revision 1.38
(applied also to sys/arch/arm/cortex/a9_mpsubr.S,
sys/arch/arm/cortex/a9_mpsubr.S,
sys/arch/arm/cortex/cortex_init.S)
sys/arch/evbmips/ingenic/cpu_startup.S: revision 1.2
sys/arch/mips/mips/locore.S: revision 1.229
sys/arch/alpha/include/asm.h: revision 1.45
(applied to sys/arch/alpha/alpha/multiproc.s)
sys/arch/sparc64/sparc64/locore.s: revision 1.432
sys/arch/vax/vax/subr.S: revision 1.42
sys/arch/mips/mips/locore_mips3.S: revision 1.116
sys/arch/ia64/ia64/machdep.c: revision 1.44
sys/arch/arm/arm32/cpuswitch.S: revision 1.106
sys/arch/sparc/sparc/locore.s: revision 1.284
(all via patch)

aarch64: Add missing barriers in cpu_switchto.
Details in comments.

Note: This is a conservative change that inserts a barrier where
there was a comment saying none is needed, which is probably correct.
The goal of this change is to systematically add barriers to be
confident in correctness; subsequent changes may remove some bariers,
as an optimization, with an explanation of why each barrier is not
needed.

PR kern/57240

alpha: Add missing barriers in cpu_switchto.
Details in comments.

arm32: Add missing barriers in cpu_switchto.
Details in comments.

hppa: Add missing barriers in cpu_switchto.
Not sure hppa has ever had working MULTIPROCESSOR, so maybe no
pullups needed?

ia64: Add missing barriers in cpu_switchto.
(ia64 has never really worked, so no pullups needed, right?)

mips: Add missing barriers in cpu_switchto.
Details in comments.

powerpc: Add missing barriers in cpu_switchto.
Details in comments.

sparc: Add missing barriers in cpu_switchto.

sparc64: Add missing barriers in cpu_switchto.
Details in comments.

vax: Note where cpu_switchto needs barriers.

Not sure vax has ever had working MULTIPROCESSOR, though, and I'm not
even sure how to spell store-before-load barriers on VAX, so no
functional change for now.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1859):

sys/arch/ia64/ia64/vm_machdep.c: revision 1.18
sys/arch/powerpc/powerpc/locore_subr.S: revision 1.67
sys/arch/aarch64/aarch64/locore.S: revision 1.91
sys/arch/mips/include/asm.h: revision 1.74
sys/arch/hppa/include/cpu.h: revision 1.13
sys/arch/arm/arm/armv6_start.S: revision 1.38
(applied also to sys/arch/arm/cortex/a9_mpsubr.S,
sys/arch/arm/cortex/a9_mpsubr.S,
sys/arch/arm/cortex/cortex_init.S)
sys/arch/evbmips/ingenic/cpu_startup.S: revision 1.2
sys/arch/mips/mips/locore.S: revision 1.229
sys/arch/alpha/include/asm.h: revision 1.45
(applied to sys/arch/alpha/alpha/multiproc.s)
sys/arch/sparc64/sparc64/locore.s: revision 1.432
sys/arch/vax/vax/subr.S: revision 1.42
sys/arch/mips/mips/locore_mips3.S: revision 1.116
sys/arch/ia64/ia64/machdep.c: revision 1.44
sys/arch/arm/arm32/cpuswitch.S: revision 1.106
sys/arch/sparc/sparc/locore.s: revision 1.284
(all via patch)

aarch64: Add missing barriers in cpu_switchto.
Details in comments.

Note: This is a conservative change that inserts a barrier where
there was a comment saying none is needed, which is probably correct.
The goal of this change is to systematically add barriers to be
confident in correctness; subsequent changes may remove some bariers,
as an optimization, with an explanation of why each barrier is not
needed.

PR kern/57240

alpha: Add missing barriers in cpu_switchto.
Details in comments.

arm32: Add missing barriers in cpu_switchto.
Details in comments.

hppa: Add missing barriers in cpu_switchto.
Not sure hppa has ever had working MULTIPROCESSOR, so maybe no
pullups needed?

ia64: Add missing barriers in cpu_switchto.
(ia64 has never really worked, so no pullups needed, right?)

mips: Add missing barriers in cpu_switchto.
Details in comments.

powerpc: Add missing barriers in cpu_switchto.
Details in comments.

sparc: Add missing barriers in cpu_switchto.

sparc64: Add missing barriers in cpu_switchto.
Details in comments.

vax: Note where cpu_switchto needs barriers.

Not sure vax has ever had working MULTIPROCESSOR, though, and I'm not
even sure how to spell store-before-load barriers on VAX, so no
functional change for now.

(martin)

Ticket #1858

(martin)

Pull up following revision(s) (requested by rin in ticket #1858):

lib/csu/arch/vax/crtbegin.S: revision 1.8
lib/csu/arch/vax/crtbegin.S: revision 1.9

vax/csu: __do_global_ctors_aux: Save actually-used r8, instead of r11

Thanks Kalvis Duckmanton for report and patch on tech-toolchain:
https://mail-index.netbsd.org/tech-toolchain/2023/07/28/msg004321.html

vax/csu: Use register name provided by asm.h. No binary changes.

(martin)

Tickets #1853 - #1857

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1857):

sys/arch/x86/x86/coretemp.c: revision 1.38-1.39 (patch)

coretemp(4): Change limits of Tjmax.
- Change the lower limit from 70 to 60. At least, some BIOSes can change
  the value down to 62.
- Change the upper limit from 110 to 120. At least, some BIOSes can change
  the value up to 115.
- Print error message when rdmsr(TEMPERATURE_TARGET) failed.
- When Tjmax exceeded the limit, print warning message and use the value
  as it is.
- KNF.

(martin)

Pull up the following revisions, via patch, requested by msaitoh in
ticket #1856:

sys/dev/pci/ichsmb.c 1.83-1.84

- Add support Intel 700 series chipset and Alder Lake-N devices.
- Use device_printf() instead of aprint_error_dev() in
  ichsmb_i2c_exec().

(martin)

regen (ticket #1855)

(martin)

Pull up the following revisions, via patch, requested by msaitoh in
ticket #1855:

sys/dev/pci/pcidevs                            1.1481-1.1482

Add Intel Alder Lake-N, Raptor Lake and 700 series chipset devices.

(martin)

Pull up the following revisions, via patch, requested by msaitoh
in ticket #1854:

usr.sbin/cpuctl/arch/i386.c                    1.137-1.139

- CPU model 0x5a is not Atom E3500 but Atom Z3500.
- Add Alder Lake-N.

(martin)

Pull up the following revisions, all via patch, requested by msaitoh
in ticket #1853:

sys/arch/x86/include/specialreg.h 1.204-1.206, 1.208

- Add Intel CPUID 0x07 %ecx bit 24 BUS_LOCK_DETECT.
- Add AMD CPUID 0x80000008 %ebx bit 30 IBPB_RET and CPUID 0x8000000a
  %edx bit 29 BusLockThreshold.
- Fix typo in comment.

(martin)

Ticket #1852

(martin)

Pull up following revision(s) (requested by mrg in ticket #1852):

sys/arch/x86/x86/errata.c: revision 1.32

fix the cpuids for the zen2 client CPUs.

i'm not exactly how i came up with the values i had, though one
of them was still valid and matched my test systems.

(martin)

Ticket #1851

(martin)

Pull up following revision(s) (requested by mrg in ticket #1851):

sys/arch/x86/include/specialreg.h: revision 1.207
sys/arch/x86/x86/errata.c: revision 1.31

x86: turn off zenbleed chicken bit on Zen2 cpus.

this is based upon Taylor's original work.  i just made the list
of CPUs to run on correct as i could determine.  (also, add some
Zen3 and Zen4 cpuids not yet used by any errata.)

(might be nice to have a better way to expression revision ranges
rather than specific cpuid matches, eg, 0x30-0x4f models in a cpu
family, etc.)

tested on ryzen 3600, and a ported zenbleed PoC that no longer
shows any obtained text.  (a similar module-version of it stopped
the PoC on a ryzen 3950x without having to reboot.)

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
https://lock.cmpxchg8b.com/zenbleed.html

(martin)

Ticket #1850

(martin)

Pull up following revision(s) (requested by gutteridge in ticket #1850):

external/bsd/dhcpcd/examples/Makefile: revision 1.2
distrib/sets/lists/misc/mi: revision 1.225
external/bsd/dhcpcd/examples/conf/Makefile: revision 1.1

Install a copy of dhcpcd.conf under /usr/share/examples

Addresses PR bin/57487 from Taylor R Campbell.

(martin)

Ticket #1849

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1849):

lib/libc/dlfcn/dlfcn_elf.c: revision 1.17

libc: Fix missing membar_consumer in dl_iterate_phdr.

Pairs with the existing membar_producer.

(martin)

Tickets #1847 and #1848

(martin)

Pull up following revision(s) (requested by reinoud in ticket #1848):

sys/fs/nilfs/nilfs_subr.h: revision 1.5

Remove old prototypes from writing that shouldn't have been comitted at all!

(martin)

Pull up the following revisions, requested by msaitoh in #1847:

sys/dev/pci/if_wm.c 1.768-1.782 via patch
sys/dev/pci/if_wmreg.h 1.129-1.130
sys/dev/pci/if_wmvar.h 1.49

wm(4):
- Rework for event counters:
  - Fix calculation of GORC, GOTC, TOR and TOT counters correctly.
  - Rearrange the order of the registers so that they are roughly
    in ascending order.
  - Reorder evcnt_attach_dynamic(), WM_EVCNT_ADD() and evcnt_detach()
    to match.
  - IC{TX,RX}*C registers are for older than 82575.
  - Fix a bug that the transmit underrun counter is incorrectly
    counted.
  - Don't add "Count" for event counter's description.
  - Some statistics registers were replaced with new counters on newer
    chips. Treat 0x403c(CEXTERR->HTDPMC), 0x40fc(TSCTFC->CBRMPC),
    0x4124(ICRXOC->HTCBDPC) and from 0x4104 to 0x4124.
  - Add some new counters:
    - Circuit Breaker TX Manageability Packet
    - Circuit Breaker RX Dropped Packet
    - Host Good Octets RX
    - Host Good Octets TX
    - Length Errors
    - SerDes/SGMII Code Violation Packet
    - Header Redirection Missed Packet
    - EEE TX LPI
    - EEE RX LPI
  - Fix prc511's comment and description.
- Add SOICZIFDATA (ifconfig -z) support for evcnt(9).
- Use WM_IS_ICHPCH(). No functional change.
- Fix typo. s/ictxact/ictxatc/. No functional change.
- Add comment.

(martin)

Ammend #1836 for file missed in original pullup

(martin)

Pull up the following revision, requested by riastradh in ticket #1836

sys/compat/freebsd/freebsd_machdep.c 1.5

Memset before copyout

(martin)

Tickets #1825, #1827 - #1831, #1833, #1835 - #1846

(martin)

Regen for ticket #1846

(martin)

Pull up following revision(s) (requested by msaitoh in ticket #1846):

sys/dev/pci/pcidevs: revision 1.1478
sys/dev/pci/pcidevs: revision 1.1479
sys/dev/pci/pcidevs: revision 1.1480

Add Samsung SM990.

Add devices from PPR for AMD Family 19h Model 61h Revision B1 processors.

The SATA device ID for Apollo Lake is not 0x5ae0 but 0x5ae3.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1845):

lib/libpam/modules/pam_ksu/pam_ksu.c: revision 1.10

pam_ksu: No need for homedir access.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1844):

lib/libpam/modules/pam_krb5/pam_krb5.c: revision 1.31
lib/libpam/modules/pam_krb5/pam_krb5.8: revision 1.13

pam_krb5: Refuse to operate without a key to verify tickets.

New allow_kdc_spoof overrides this to restore previous behaviour
which was vulnerable to KDC spoofing, because without a host or
service key, pam_krb5 can't distinguish the legitimate KDC from a
spoofed one.

This way, having pam_krb5 enabled isn't dangerous even if you create
an empty /etc/krb5.conf to use client SSO without any host services.

Perhaps this should use krb5_verify_init_creds(3) instead, and
thereby respect the rather obscurely named krb5.conf option
verify_ap_req_nofail like the Linux pam_krb5 does, but:
- verify_ap_req_nofail is default-off (i.e., vulnerable by default),
- changing verify_ap_req_nofail to default-on would probably affect
  more things and therefore be riskier,
- allow_kdc_spoof is a much clearer way to spell the idea,
- this patch is a smaller semantic change and thus less risky, and
- a security change with compatibility issues shouldn't have a
  workaround that might introduce potentially worse security issues
  or more compatibility issues.

Perhaps this should use krb5_verify_user(3) with secure=1 instead,
for simplicity, but it's not clear how to do that without first
prompting for the password -- which we shouldn't do at all if we
later decide we won't be able to use it anyway -- and without
repeating a bunch of the logic here anyway to pick the service name.

References about verify_ap_req_nofail:
- mit-krb5 discussion about verify_ap_req_nofail:
  https://mailman.mit.edu/pipermail/krbdev/2011-January/009778.html
- Oracle has the default-secure setting in their krb5 system:
  https://docs.oracle.com/cd/E26505_01/html/E27224/setup-148.html
  https://docs.oracle.com/cd/E26505_01/html/816-5174/krb5.conf-4.html#REFMAN4krb5.conf-4
  https://docs.oracle.com/cd/E19253-01/816-4557/gihyu/
- Heimdal issue on verify_ap_req_nofail default:
  https://github.com/heimdal/heimdal/issues/1129

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1843):

etc/pam.d/ftpd: revision 1.8
etc/pam.d/su: revision 1.9
etc/pam.d/system: revision 1.9
etc/pam.d/display_manager: revision 1.6
etc/pam.d/sshd: revision 1.10

pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC.  But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

(martin)

Apply patch, requested by riastradh in ticket #1842:

sys/dev/pci/if_wm.c (apply patch)

Fix a bug introduced in ticket #1795.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1841):

sys/compat/sunos32/sunos32_misc.c: revision 1.86
sys/compat/ossaudio/ossaudio.c: revision 1.85
sys/compat/linux32/arch/amd64/linux32_machdep.c: revision 1.48

compat_sunos32: Memset zero before copyout.

Unclear if this can leak anything but let's be on the safe side.

compat_ossaudio: Zero-initialize idat before copyout.
Unclear if there are any paths to the copyout without initialization,
but let's play it safe to keep the auditing effort low.

linux32_rt_sendsig: Memset zero before copyout.
Not sure if there's any padding here, but it's a pretty big
structure, fairly likely, so let's be rather safe than sorry.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1840):

sys/compat/netbsd32/netbsd32_nfssvc.c: revision 1.7

compat_netbsd32: Copy out 32-bit version in nfssvc32_nsd_out.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1839):

sys/compat/common/kern_time_30.c: revision 1.6
sys/compat/netbsd32/netbsd32_time.c: revision 1.50

Paranoia: zero COMPAT_30 ntptimeval and 32-bit ntptimeval too.

These structs don't have padding but safer to keep the code
structured the same way between the various ntp_gettimes in case
anyone makes more copypasta of it for future updates.

(martin)

Pull up following revision(s) (requested by riastradh in ticket #1838):

sys/compat/common/kern_time_50.c: revision 1.32

Zero ntptimeval50 too to prevent 4-byte kernel stack disclosure.

>From Thomas Barabosch of Fraunhofer FKIE.

(martin)

Apply patch, requested by riastradh in ticket #1837:

sys/compat/osf1/osf1_cvt.c
sys/compat/osf1/osf1_file.c
sys/compat/osf1/osf1_misc.c

Memset structures to zero before passing them to copyout to expose them
to userland.
No equivalent change in newer branches, commpat/osf1 has been deleted.

(martin)