Build date: 1751061601 - Fri Jun 27 22:00:01 UTC 2025
Build cvs date: 1751045217 - Fri Jun 27 17:26:57 UTC 2025
Build id: 2025-06-28.1
Build tags: amd64-regress sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P lib/libcrypto/Makefile
P lib/libcrypto/aes/aes.c
P lib/libcrypto/aes/aes_amd64.c
P lib/libcrypto/aes/aes_i386.c
P lib/libcrypto/aes/aes_local.h
P lib/libcrypto/arch/amd64/crypto_arch.h
P lib/libcrypto/arch/i386/crypto_arch.h
P lib/libcrypto/evp/e_aes.c
P regress/lib/libssl/openssl-ruby/Makefile
P sbin/pfctl/parse.y
P sys/arch/amd64/amd64/ghcb.c
P sys/arch/amd64/amd64/locore0.S
P sys/arch/amd64/amd64/machdep.c
P sys/arch/amd64/amd64/trap.c
P sys/arch/amd64/amd64/vector.S
P sys/arch/amd64/include/cpufunc.h
P sys/arch/amd64/include/ghcb.h
P sys/arch/amd64/include/segments.h
P sys/dev/pci/if_ice.c
P sys/dev/pci/if_icereg.h
P sys/net/if_veb.c
P usr.bin/sndiod/dev.c
P usr.bin/watch/watch.1
M usr.sbin/bgpd/session.c
P usr.sbin/rpki-client/cert.c
P usr.sbin/rpki-client/geofeed.c
P usr.sbin/vmctl/vmctl.h

commit 2ZGv0j5JVIAQn5WE
Author: jsing
Date: 2025/06/27 17:26:57

  Simplify EVP AES-GCM implementation and remove AES-NI specific code.

  Like CTR, the mode implementation for GCM has two variants - rather than
  using multiple variants (one for AES-NI, another for non-AES-NI),
  consistently use CRYPTO_gcm128_{en,de}crypt_ctr32() with the
  aes_ctr32_encrypt_internal() function added for CTR mode.

  This lets us remove the AES-NI specific code, AES-NI specific EVP_CIPHER
  methods and the ctr function pointer from EVP_AES_GCM_CTX.

  ok tb@

  lib/libcrypto/Makefile
  lib/libcrypto/aes/aes_local.h
  lib/libcrypto/evp/e_aes.c

commit sgmWBxgdmO75zCS7
Author: bluhm
Date: 2025/06/27 17:23:49

  Allocate GHCB and handle #VC trap early in AMD SEV-ES guest.

  When the kernel runs as SEV-ES guest, claim two pages to be used
  for GHCB communication with vmm(4).  As the guest wants to share
  these two pages with vmm(4) host, re-map them as plain text.  Do
  this as soon as we reach long mode.

  Arriving in init_x86_64(), reset the IDT used during locore0 and
  install a new #VC trap handler.  This is the actual handler the
  kernel will use from now on.  However, as we are not fully up and
  running yet, use a simple and kernel-only entry stub for the #VC
  exception.  At the end of early bootstrap, init_x86_64() will install
  the actual and final IDT.

  For now this will reset and disable the #VC handler.  Therefore,
  SEV-ES enabled guest are not working yet.

  The #VC handler vctrap() is also hooked into kerntrap() and usertrap().
  Communication with  vmm(4) using the GHCB protocol is also ready.
  However, the actual handling of cpuid, in/out, wrmsr/rdmsr is left
  out for now.  Again, SEV-ES enabled guest are not working yet.

  from hshoexer@; OK mlarkin@

  sys/arch/amd64/amd64/ghcb.c
  sys/arch/amd64/amd64/locore0.S
  sys/arch/amd64/amd64/machdep.c
  sys/arch/amd64/amd64/trap.c
  sys/arch/amd64/amd64/vector.S
  sys/arch/amd64/include/cpufunc.h
  sys/arch/amd64/include/ghcb.h
  sys/arch/amd64/include/segments.h

commit C2FTygFH20zoXoxO
Author: jsing
Date: 2025/06/27 17:10:45

  Move AES-NI from EVP to AES for CTR mode.

  The mode implementation for CTR has two variants - one takes the block
  function, while the other takes a "ctr32" function. The latter is expected
  to handle the lower 32 bits of the IV/counter, but is not expected to
  handle overflow. The AES-NI implementation for CTR currently uses the
  second variant.

  Provide aes_ctr32_encrypt_internal() as a function that can be replaced on
  a machine dependent basis, along with an aes_ctr32_encrypt_generic()
  function that provides the default implementation and can be used as a
  fallback. Wire up the AES-NI version for amd64 and i386, change
  AES_ctr128_encrypt() to use CRYPTO_ctr128_encrypt_ctr32() (which calls
  aes_ctr32_encrypt_internal()) and remove the various AES-NI specific
  EVP_CIPHER methods for CTR.

  Callers of AES_ctr128_encrypt() will now use AES-NI, if available.

  ok tb@

  lib/libcrypto/aes/aes.c
  lib/libcrypto/aes/aes_amd64.c
  lib/libcrypto/aes/aes_i386.c
  lib/libcrypto/arch/amd64/crypto_arch.h
  lib/libcrypto/arch/i386/crypto_arch.h
  lib/libcrypto/evp/e_aes.c

commit syytupoeXzbKLiyt
Author: sashan
Date: 2025/06/27 16:53:51

  pfctl: remove duplicated code

  patch from Kristof Provost (kp at FreeBSD dot org)

  OK @bluhm

  sbin/pfctl/parse.y

commit Qce06csvUzRpq4s4
Author: jsing
Date: 2025/06/27 16:43:54

  Remove unused defines from aes_local.h.

  MAXKB was added in OpenSSL commit deb2c1a1 and appears to have never been
  used, while MAXKC (originally RIJNDAEL_MAXKC) stopped being used in that
  same commit. MAXNR is also unused - AES_MAXNR exists in the public
  header.

  ok tb@

  lib/libcrypto/aes/aes_local.h

commit oz2ERdEzHdE6YNaa
Author: jan
Date: 2025/06/27 16:18:10

  Use SoftLRO in ice(4), but default off.

  We don't use the ptype decode, because we just want to use SoftLRO in
  cases of TCP with just plain IPv4 and IPv6 packets.

  Tested by bluhm@

  ok bluhm@

  sys/dev/pci/if_ice.c
  sys/dev/pci/if_icereg.h

commit vuhMsUJcIy6yjFc1
Author: tb
Date: 2025/06/27 09:40:34

  geofeed: RFC 9092 is obsolete. Refer to 9632 instead.

  usr.sbin/rpki-client/geofeed.c

commit 7Tc6w7hxBsEGA9yJ
Author: jan
Date: 2025/06/27 09:25:57

  vport/veb(4): Use VLAN Hardware Tagging.

  ok dlg

  sys/net/if_veb.c

commit S24490DhBfLseDam
Author: jsg
Date: 2025/06/27 06:41:52

  remove prototype for removed slot_ctlname()

  usr.bin/sndiod/dev.c

commit uxuQp7bG9Meyt7JL
Author: jmc
Date: 2025/06/27 05:42:51

  sort SEE ALSO;

  usr.bin/watch/watch.1

commit pnNHv4vkhvYokj9Q
Author: jsg
Date: 2025/06/27 05:23:46

  remove prototypes for removed functions

  usr.sbin/vmctl/vmctl.h

commit KdOqsluAmsUudqBx
Author: tb
Date: 2025/06/27 04:01:04

  rpki-client: reject certs with unknown critical extension

  The validator will do this anyway, but the current logic suggests
  misbehavior. Also reuse the nid rather than refetching it from
  libcrypto

  ok claudio job

  usr.sbin/rpki-client/cert.c

commit l5MSIkJT5nzFGDOP
Author: tb
Date: 2025/06/27 03:32:08

  openssl-ruby-tests: prepare for ruby default switch to 3.4

  regress/lib/libssl/openssl-ruby/Makefile