pf(4) fix NULL pointer dereference in outbound packet path.
Outbound packet which matches rule with source limiter attached,
for example:
source limiter "crash" id 1 entries 10000 limit 1000
pass out from any to any source limiter "crash" keep state
triggers a NULL pointer dereference.
The issue was kindly reported and initial version of fix
submitted by SecBuddyF, Tencent KeenLab.
The submitted diff fixed the issue for failing look up by destination
address in outbound packet. dlg@ also pointed out the change should
be further improved so NULL pointer dereference is avoided when rule
uses nat-to/rdr-to option.
OK dlg@
[3 lines not shown]
pf: include direction in fragment key
pf(4) currently ignores fragment direction (in vs. out)
in pf_frnode_compare() function.
Issue noticed and reported by Frank Denis
OK @bluhm
Obtained from: OpenBSD, sashan <sashan at openbsd.org>, eaa2c80721
Sponsored by: Rubicon Communications, LLC ("Netgate")
acpi_cpu(4): Call ACPI_GET_FEATURES() on a reset 'features' variable
This is to prevent child drivers from using the features returned by
previous drivers (in an arbitrary order). None of the existing ones do
that, so this is purely defensive.
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 664ad9ac4c9047d29d5f37d43174e1b469e2ec80)
x86/local_apic.c: Fiddle with thermal LVT slot only if supported
The thermal LVT slot does not necessarily exist.
According to Intel's Software Developers Manual, for Intel processors
supporting 64-bit operation (amd64), probably even the earliest ones
should have a local APIC with such a slot (the slot was introduced with
Pentium 4 and Xeon processors according to the manual, and the 64-bit
implementation in some later versions of them). AMD's Architecture
Programmer's Manual also seems to imply that all AMD processors
supporting amd64 should have the slot too. So this change may not be
needed when i386's code is dropped, but it does not hurt to have it, and
it might ease possible MFCs.
Change the signature of lapic_enable_thermal() so that it can report
failure (if there is no local APIC or if there is no thermal LVT slot).
Reviewed by: bnovkov, kib
MFC after: 2 weeks
[4 lines not shown]
x86/local_apic.c: Factor out version read and max LVT slot computation
This makes the code slightly more compact and easier to read.
No functional change intended.
Reviewed by: bnovkov
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58110
(cherry picked from commit 060ecf296664fd150328ac6dcdc24764a427bc3a)
x86/local_apic.c: Properly calculate the number of LVT entries
First, the CMCI entry index is APIC_LVT_MAX, so it was excluded
unconditionall [1].
Second, the number of entries is reported by the version register, and
we must not access past the last reported entry.
Reported by: olivier [1]
Fixes: 11f954b021a1aadde1d03d40ed5d6b529e14da98
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54773
(cherry picked from commit 709a53c8b20b5770f7e2f117d4799b5617479976)
x86/local_apic.c: add lapic_maxlvt() helper
that calculates the max index of the present LVT entry from the value of
the LAPIC version register.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54773
(cherry picked from commit ad5e3cb950344f9822dbbd90f5ac7c256f97fa4c)
x86/local_apic.c: Thermal interrupt support: Additional style fixes
Rename handler function type 'lapic_thermal_handle_function' to the
shorter 'lapic_thermal_handler_t'. Move it closer to the function
declaration block where it is used. Make it a true function type (no
pointer) and add explicit pointer marks on usage.
Rename 'lapic_thermal_function_value' to the more immediately clear
'lapic_thermal_function_arg'. In lapic_thermal_enable(), use 'func_arg'
as the argument name for the handler argument, which at least refers to
function 'func', rather than the generic 'value'.
Finally, rename the global handler variable from
'lapic_thermal_function_ptr' to the shorter 'lapic_thermal_function'
(dynamic functions can be referenced only through a pointer).
MFC with: 87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Sponsored by: The FreeBSD Foundation
(cherry picked from commit e1f4a8cb8656e64a1fe2b1ab519821b14c4985a0)
i386: supply thermal interrupt handler
This fixes a build break for i386.
Reviewed by: kib, olce, Koine Yuusuke <koinec at yahoo.co.jp>
Fixes: 87ba088fa310 ("x86/local_apic.c: Add support for installing a thermal interrupt handler")
Differential Revision: https://reviews.freebsd.org/D58332
(cherry picked from commit cb325dcedfa291c9bfe350a513694df3776a17a4)
x86/local_apic.c: Add support for installing a thermal interrupt handler
The thermal interrupt is initially masked.
Thermal interrupt handling is enabled by calling lapic_enable_thermal(),
which installs a (single) handler.
[olce: Wrote the commit message.]
Reviewed by: kib, olce
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D44454
(cherry picked from commit 87ba088fa3108dd180008a04f25760ec71476c87)
intr/x86: add ioapic_drv_t to reduce number of casts in IO-APIC implementation
void * is handy when you truly do not care about the type. Yet there is
so much casting back and forth in the IO-APIC code as to be hazardous.
Achieve better static checking by the compiler using a typedef.
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1457
(cherry picked from commit 90fb07edbd7adb653bd8dc1aac09a63b7ff76f89)
ps.1: Fix broken comment line
While here, remove the long-unused dash in the first line.
Reviewed by: ziaee, olce
Fixes: ddf144a04b53 ("ps.1: Revamp: Explain general principles, update to match reality")
MFC after: 1 day
Differential Revision: https://reviews.freebsd.org/D58038
(cherry picked from commit 759ce9a2b38e1de70c14c81dee7e245bf0bc6b94)
acpi_timer(4): Remove unused 'acpi_timer_disabled' boolean
Same reason as for the previous commit to acpi_cpu(4). This boolean is
not used anywhere. Disabling acpi_timer(4) can be done through the
regular ACPI disable mechanism (using the 'debug.acpi.disabled' tunable,
see acpi_disabled()).
Reviewed by: emaste (implicit)
Fixes: ac3ede5371af ("x86/xen: remove PVHv1 code")
MFC after: 3 days
Event: Halifax Hackathon 202606
Location: Dalhousie CS Faculty building
Sponsored by: The FreeBSD Foundation
(cherry picked from commit ad26a56cf2f55967cc73d04a6ea17c27892d3141)
files: riscv, arm64: Remove redundant 'ofw_cpu.c'
Should have been removed when that line was moved from 'files.arm' to
'files'.
Fixes: 14e1a2cd295d ("Move ofw_cpu file to the main files conf file.")
MFC after: 2 weeks
Event: Halifax Hackathon 202606
Location: Seat 36K in AC667, over Maine near Canadian border
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 10213f01773f22ab948ec1e87c880b1d19a1fc45)
acpi_hpet(4): Remove unused 'acpi_hpet_disabled' boolean
Same reason as for the previous commit to acpi_cpu(4). This boolean is
not used anywhere. Disabling acpi_hpet(4) can be done through the
regular ACPI disable mechanism (using the 'debug.acpi.disabled' tunable,
see acpi_disabled()).
Reviewed by: emaste (implicit)
Fixes: ac3ede5371af ("x86/xen: remove PVHv1 code")
MFC after: 3 days
Event: Halifax Hackathon 202606
Location: Dalhousie CS Faculty building
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 25df388574ac1d295f4014825de0df1d65cbdc53)
sched_ule: Fix off by one in preempt_thresh definition
Since 'preempt_thresh' is set to PRI_MIN_KERN by default, and comparison
of the considered thread's priority with that threshold is done with
'<=', PRI_MIN_KERN threads actually can preempt other threads, contrary
to other non-interrupt kernel ones (between PRI_MIN_KERN + 1 and
PRI_MAX_KERN).
So, replace the comparison operator '<=' by '<'. The alternative would
be to change the default value, but changing the comparison instead has
the benefit to be consistent with the 0 setting (which forbids
preemption entirely), since allowing only threads with priority 0 to
preempt becomes possible.
Consequently, we also change the default value for the FULL_PREEMPTION
option by adding 1 to PRI_MAX_IDLE (in practice, that does not make any
difference in the current setting, since no preemption will happen if
the new priority value is not strictly lower than the current one, and
PRI_MAX_IDLE is PRI_MAX, the highest possible priority).
[10 lines not shown]
acpi_cpu(4): Remove unused 'acpi_cpu_disabled' boolean
It is not used anywhere. Disabling acpi_cpu(4) can be done through the
regular ACPI disable mechanism (using the 'debug.acpi.disabled' tunable,
see acpi_disabled()).
Reviewed by: emaste, obiwac
Fixes: ac3ede5371af ("x86/xen: remove PVHv1 code")
MFC after: 3 days
Event: Halifax Hackathon 202606
Location: Dalhousie CS Faculty building
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57888
(cherry picked from commit 98a77972381c6bb5ceda375fd1db7dccb3a1c89e)
sched_ule: sched_clock(): Remove a superfluous space
MFC after: 1 week
Event: Halifax Hackathon 202606
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 5f376d52f2c86fd19e3f774a02c4b0debeb3f2cf)
acpi: Suffix acpi_sleep_enable() with '_locked'
For clarification. This function assumes that the acpi mutex is held,
contrary to acpi_sleep_disable().
No functional change (intended).
Reviewed by: obiwac
Event: Halifax Hackathon 202606
Sponsored by: The FreeBSD Foundation
Pull Request: https://github.com/OlCe2/freebsd-src/pull/8
(cherry picked from commit 3b3911aaf834824f2de0db9fc7d0b9e2b3c089b4)
sched_ule: sched_priority(): More accurate __unused annotation
Change a '__unused' to '__diagused', which is more precise for that use.
No functional change.
MFC after: 1 week
Event: Halifax Hackathon 202606
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 83a6946595829407c80075f33e49329d1b621522)
MAC/do: Clarify comments about flags attached per-ID or per-ID-type
No functional change.
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0c2d64ce3da9c042da133c8b6d7391abb177f2c9)
kern_prot.c: Belatedly add copyright
See the commit log for the why.
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 1c0e5c53ff1672a93fc42988020723bb6bc427c1)
MAC/do: Tests: Quote the source directory
In a standard test suite installation, this is not necessary, but be
bullet-proof to custom ones, however improbable.
Reviewed by: bapt
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
(cherry picked from commit 33daea3f862d7fe996602756805a92a600356f94)
