On Mon, Sep 23, 2024 at 03:01:17PM -0600, Theo de Raadt wrote:
> Does this help?
> 
> Since we are close to release, I'm intentionally making it a seperate
> block, and we can trust the compiler's common-subexpression-elimination
> to clean it up.  If there was a 3rd entry we would  make it a switch().

I tested an equivalent diff. This then runs into the sigills that sthen
posted.

> 
> Index: kern_pledge.c
> ===================================================================
> RCS file: /cvs/src/sys/kern/kern_pledge.c,v
> diff -u -p -u -r1.319 kern_pledge.c
> --- kern_pledge.c	4 Sep 2024 07:45:08 -0000	1.319
> +++ kern_pledge.c	23 Sep 2024 21:00:17 -0000
> @@ -997,6 +997,11 @@ pledge_sysctl(struct proc *p, int miblen
>  	    mib[0] == CTL_MACHDEP && mib[1] == CPU_ID_AA64ISAR0)
>  		return (0);
>  #endif /* CPU_ID_AA64ISAR0 */
> +#ifdef CPU_ID_AA64ISAR1
> +	if (miblen == 2 &&		/* arm64 libcrypto inspects CPU features */
> +	    mib[0] == CTL_MACHDEP && mib[1] == CPU_ID_AA64ISAR1)
> +		return (0);
> +#endif /* CPU_ID_AA64ISAR1 */
>  
>  	snprintf(buf, sizeof(buf), "%s(%d): pledge sysctl %d:",
>  	    p->p_p->ps_comm, p->p_p->ps_pid, miblen);
>