rtprio*: Add capability mode checks
These syscalls are allowed in capability mode but accept an arbitrary
pid or lwpid. Restrict them to the calling process in capability mode.
In capability mode rtprio_thread(2) only looks up threads of the
calling process, and returns ECAPMODE for any other lwpid, including
one that does not exist.
Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <ojanerif at amd.com>
Reviewed by: olce
vmm: Skip TMR rebuilds for edge-to-edge IOAPIC writes
IOAPIC redirection-table writes rendezvous all active vCPUs to
rebuild their vlapic trigger-mode registers when fields other than
mask or polarity change. Retargeting an edge-triggered pin incurs
this cost even though it does not contribute to the TMR.
vioapic_update_tmr() rebuilds the TMR from level-triggered entries
only. Skip the rendezvous when the modified entry is edge-triggered
both before and after the write. Check the old and new trigger modes
so that edge-to-level and level-to-edge transitions still rebuild
the TMR. Retain the existing all-vCPU rebuild path, mask/polarity
exclusions and remote-IRR handling.
Approved by: markj, cperciva
Differential Revision: https://reviews.freebsd.org/D60721
MFC to: releng/15.2
Reported by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: Wanpeng Qian <wanpengqian at gmail.com>, markj
[2 lines not shown]
vmm: Add a bulk TMR reset hook for Intel APICv
vioapic_update_tmr() resets all 256 vectors before rebuilding the
level-triggered vector set. With Intel virtual interrupt delivery,
each per-vector reset loads the VMCS, reads and writes an EOI-exit
bitmap, and clears the VMCS.
Add an optional bulk-reset hook so VMX can clear the four EOI-exit
bitmaps with one VMCS load/clear pair. Clear the software TMR banks
directly when using the hook, and retain the per-vector fallback
for backends without it.
Approved by: markj, cperciva
Differential Revision: https://reviews.freebsd.org/D60692
MFC to: releng/15.2
Reviewed by: markj
(cherry picked from commit ee9205f068c7675cf4d23e51cc98238d95ba1950)
xdr: Fix xdr_string
Forcing maxsize to RPC_MAXDATASIZE breaks code that deliberately uses
XDR with longer strings than permitted by SunRPC.
MFC after: 1 week
Fixes: 6448ec89e739 (" * limit size of buffers to RPC_MAXDATASIZE")
Fixes: e17d7ab869bb ("xdr_string: don't leak strings with xdr_free")
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, brooks
Differential Revision: https://reviews.freebsd.org/D59994
(cherry picked from commit d2018cedb414ef17e77b7fc2fa19fd81328da46b)
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
[9 lines not shown]
xdr_string: don't leak strings with xdr_free
Historically (and in a small amount of older software such as OpenAFS),
developers would attempt to free XDR strings with
xdr_free((xdrproc_t)xdr_string, &string)
This resulted in xdr_free calling xdr_string with only two intentional
arguments and whatever was left in the third argument register. If the
register held a sufficently small number, xdr_string would return FALSE
and not free the string (no one checks the return values).
Software should instead free strings with:
xdr_free((xdrproc_t)xdr_wrapstring, &string)
Because buggy software exists in the wild, act as though xdr_wrapstring
was used in the XDR_FREE case and plug these leaks.
[7 lines not shown]
xdr_string: don't leak strings with xdr_free
Historically (and in a small amount of older software such as OpenAFS),
developers would attempt to free XDR strings with
xdr_free((xdrproc_t)xdr_string, &string)
This resulted in xdr_free calling xdr_string with only two intentional
arguments and whatever was left in the third argument register. If the
register held a sufficently small number, xdr_string would return FALSE
and not free the string (no one checks the return values).
Software should instead free strings with:
xdr_free((xdrproc_t)xdr_wrapstring, &string)
Because buggy software exists in the wild, act as though xdr_wrapstring
was used in the XDR_FREE case and plug these leaks.
[7 lines not shown]
xdr: Fix xdr_string
Forcing maxsize to RPC_MAXDATASIZE breaks code that deliberately uses
XDR with longer strings than permitted by SunRPC.
MFC after: 1 week
Fixes: 6448ec89e739 (" * limit size of buffers to RPC_MAXDATASIZE")
Fixes: e17d7ab869bb ("xdr_string: don't leak strings with xdr_free")
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, brooks
Differential Revision: https://reviews.freebsd.org/D59994
(cherry picked from commit d2018cedb414ef17e77b7fc2fa19fd81328da46b)
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
[9 lines not shown]
su, login: fix heap over-read in environment export filter
ok_to_export() (su.c) and export() (login.c) read s[n] before
strncmp(s, *pp, n) confirms s is at least n bytes long, where n is
the length of the blocked variable name. A PAM environment entry
shorter than that name over-reads past its heap allocation.
Check strncmp() first; it stops at s's NUL terminator and never
reads past the boundary that guarded the s[n] access.
MFC after: 1 week
Sponsored by: Advanced Micro Devices, Inc.
Signed-off-by: Osvaldo Janeri Filho <ojanerif at amd.com>
Reviewed by: des, markj
Differential Revision: https://reviews.freebsd.org/D61420
tests/net: unskip tests waiting for bpf fixes
These tests pass for more than 200+ runs consecutively.
PR: 292993
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
tpm: crb: Support the ACPI start method
Some AMD firmware TPMs report StartMethod 2 and had no driver. They never
acknowledge CTRL_REQ, so skip the idle and ready requests.
Do not harvest entropy from these TPMs on AMD: on a Ryzen 7 7735HS each
periodic TPM2_GetRandom froze every CPU, for up to 1.2 s (AMD PA-410).
Reviewed by: kbowling
Approved by: kbowling
Differential Revision: https://ron-dev.freebsd.org/FreeBSD/src/pulls/103
kern_undelete: remove unused pathseg argument
I'd failed to pass it down to NDINIT, but nothing calls kern_uninit
with a path argument in sys space here or in CheriBSD so just drop it.
Effort: CHERI upstreaming
Reported by: llm-postcr
Sponsored by: Innovate UK
Fixes: 7273d80ba18c ("vfs_syscalls.c: add kern_ and user_ implementations")
ipsec: Do not reference the default policy for packets without a PCB
When no security policy matches a packet, ipsec[46]_getpolicy() returns
the default policy with a new reference, and the caller drops it right
after looking at the policy type. Once any security policy is
configured, every forwarded packet goes through ip_forward() and
ipsec4_forward(), which checks the inbound and the outbound policy.
That is four atomic operations per packet on one reference count that
all CPUs write.
The default policy is allocated with its vnet and freed only when the
vnet goes away, and the sysctl limits it to NONE or DISCARD. A packet
without a PCB has no policy cache to keep it in. In that case, check
the policy type directly and take no reference, for NONE as well as for
DISCARD. Packets with a PCB still take the reference, because the PCB
caches the policy.
No functional change intended. DISCARD still drops the packet, and the
policy violation counters are incremented as before.
[5 lines not shown]
SysV SHM: make kern_shmat static
This is the opposite of most kern_ cases, but SysV IP is designed to be
loaded as a module and freebsd32 support lives inside the main
implementation file. Arguably it should be in a seperate module with a
dependency, but that's a refactor for another day.
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
zfs: merge openzfs/zfs at 013c77e66
Notable upstream pull request merges:
#17567 816804dfd Add support for anyraid vdevsG
#18826 -multiple FDT: don't extend dedup across RAIDZ expansion
#18861 1ff8fc14a Fix out-of-bound access when resizing in receive_spill
#19026 518021947 Add alloc factor logic
#19091 e056f4df3 don't send spill or oversized blocks as WRITE_EMBEDDED
#19125 6d5d3f635 Wait for the txg-time database write before setting
spa_final_txg
#19170 b060bcb1d zio: drop a queued scan read only when its block is freed
#19171 3db7dde41 dsl_scan: resume a scan which suspends at the origin
snapshot
#19178 497f28f07 vdev_raidz: keep unverified dRAID rebuild repairs
speculative
#19188 5f1957a15 spa: number new txgs above every uberblock on disk
#19190 495d09b51 Export zpool_valid_proplist from libzfs
#19191 ed07ad74e zdb: Lower eviction timeouts on prefetched data
#19192 86b3fb1f4 Build the pool stats config without the namespace lock
[161 lines not shown]
modstat: don't copyout while holding a lock
If a user arranges for a page fault to never be filled (e.g., via a
FUSE file system), this can hold the shared lock forever.
To make this all work, refactor kern_modstat and freebsd32_modstat to
malloc a temporary buffer and fill it before copying it out rather
than doing a bunch of copies.
Add COMPAT_* ifdefs around compat code. The module_stat_v1 code is
really for a.out binaries in practice and thus a bit questionable.
Reviewed by: markj
Reported by: llm-postcr
Sponsored by: Innovate UK
Fixes: 7f8c2056db1e ("modstat: avoid copying from freed memory")
Differential Revision: https://reviews.freebsd.org/D61432
aw_ccu: h6: Use the 1x PLL_PERIPH as parents of the MMC clocks
The MMC clocks of the H6 have the doubled outputs of the PLL_PERIPH0
and PLL_PERIPH1 as inputs of their mux, followed by a fixed post divider
of 2 that the driver does not know about. The rate it computed was
twice the real one: on a Pine H64 the SD card requested at 50MHz and the
eMMC at 52MHz ran at half of that, and transfers at about half the speed
they should reach. U-Boot does the same compensation, as it pretends
the parent is the 1x PLL.
Name the 1x PLLs as parents, like the H3 driver does. The position in
the mux is the same.
Tested on: H6
allwinner: h6: Put the PM pins in bank M
The PM0 to PM4 entries of the pad table of the R_PIO controller had port
0 and pin 0, copied from the PL ones, so no pin could be found for a
<&r_pio 1 N> specifier. On the Pine H64 model B the reset GPIO of the
SDIO WiFi power sequence is PM3, and the kernel panicked in
mmc_pwrseq_attach() with "invalid pin" as the pin number was never set.
Use port 1 and the real pin numbers, like the PL entries do with port 0.
Tested on: H6
aw_gpio: Fail when a pin cannot be mapped
aw_gpio_map_gpios() returned success without setting the pin when no
entry of the pad table matched the bank and pin of the specifier, so
the caller went on with whatever was in its variable. Return EINVAL.
Tested on: H6
