powerpc/radix: take the pmap lock in mmu_radix_sync_icache()
mmu_radix_sync_icache() walked the page tables with an unlocked
pmap_extract() and passed the result straight to PHYS_TO_DMAP(),
checking only that it was non-zero. Nothing keeps the mapping - or the
page table page holding it - alive across that window: if another thread
of the same process tears a mapping down concurrently, the page table
page can be freed and reused, so pmap_extract() reads arbitrary memory
and returns a bogus physical address. __syncicache() then dereferences
an unmapped direct map address and the kernel takes a data storage
interrupt:
fatal kernel trap:
exception = 0x300 (data storage interrupt)
virtual address = 0xc003317ca6022a00
dsisr = 0x40000000
srr0 = 0xc000000000f59460 (__syncicache)
lr = 0xc000000000f23588 (mmu_radix_sync_icache)
pid = 23878, comm = skyframe-evaluator-
[25 lines not shown]
tpm: Move user copies outside the TPM 1.2 lock
The character-device paths held the transaction and lifecycle lock while
uiomove() accessed user memory. A user page fault could therefore delay
suspend or detach, and a copyout failure occurred while the TPM response
was still active.
Copy commands into the bounded stack buffer before taking the lock. For
reads, validate the response header, buffer the complete response while
the lock is held, finish the TPM transaction, and copy it to userspace
after unlocking. Use a non-blocking allocation so memory pressure
cannot turn response buffering into another lifecycle wait.
NetBSD uses the same separation but limits responses to its fixed 1 KiB
buffer. Allocate the TPM-advertised response length to preserve the
existing FreeBSD support for larger streamed responses.
On a ThinkPad T440p with an STMicro TPM 1.2, a PCR read into a 4 KiB
userspace buffer returned the expected 30-byte response. A deliberately
[7 lines not shown]
tpm: Bound TPM 1.2 locality ownership
A TIS locality must remain active while a command is in flight, but
should be relinquished once the command completes or is abandoned. The
driver retained locality zero after probe, initialization, and resume,
and several transaction error paths returned without releasing it.
Closing the device after writing a command without reading its response
had the same effect.
Track locality ownership and whether a command is awaiting its response.
Release locality after probe, initialization, and resume; retain it only
across a successful command write and its matching response read. Abort
and release on errors, replacement commands, close, and detach.
Wait for locality during ISA probe instead of assuming an immediate
grant, release locality acquired by the probe, and stop treating the
command-style TPM_ACCESS register as restorable state.
On a ThinkPad T440p with an STMicro TPM 1.2, the old driver left
[9 lines not shown]
tpm: Remove Giant from the TPM 1.2 driver
Serialize TPM 1.2 commands, character-device methods, and power
transitions with an sx lock, following the command ownership model used
by the TPM 2.0 driver. Reject new operations once detach starts and
drain the character device before releasing transport resources.
Giant also closed the interrupt race between the final TIS status check
and tsleep. Replace that implicit dependency with a mutex and condition
variable, use an absolute deadline across unrelated wakeups, and make
the interrupt handler MPSAFE.
Create the device node atomically with its softc and finish failed write
transactions so every command path releases its transport state.
The polling path was validated on ThinkPad T430 and T440p systems with
their STMicro TPM 1.2 devices enabled. Exclusive-open behavior, 100
consecutive PCR reads, and module unload and reload completed without
errors on both systems. Two consecutive S3 cycles on each system
[7 lines not shown]
tpm: Restore TPM 1.2 TIS state after resume
Firmware restores the state saved by TPM_ORD_SaveState, but the TIS
interrupt, locality, and command FIFO state are not guaranteed to
survive S3. The legacy driver previously treated resume as a no-op.
Revalidate the interface and device identity, disable and acknowledge
stale interrupts, restore the configured interrupt vector, reacquire
locality zero, and return the FIFO to command-ready state. Also disable
TIS interrupts during initial setup when the device uses polling so
firmware settings cannot leave an unhandled interrupt enabled.
TIS 1.3 Table 22 makes the interrupt control registers locality
protected. Acquire locality before disabling or programming them during
initial setup and resume rather than relying on probe retaining
locality.
Keep TPM self-test outside the resume critical path. It can take
minutes on some TPM 1.2 devices and is not required to restore the
[17 lines not shown]
tpm: Correct the TPM 1.2 suspend transaction
The legacy driver wrote TPM_ORD_SaveState directly to the command
FIFO, but used ordinal 156 instead of the TPM 1.2 ordinal 152 and
never completed the transaction through the transport start and end
methods. On a TIS device this omitted TPM_STS_GO, and the response
read used the header length as flags instead of requesting the complete
parameter size. The legacy Atmel reader would also dereference the
null byte-count pointer.
Send the header-only command through the normal transport lifecycle,
validate the response header and TPM result, and retry TPM_WARN_RETRY
for a bounded five seconds. Fail suspend rather than enter S3 after
an unsuccessful state save.
This follows the TPM 1.2 SaveState command definition and the bounded
retry policy used by other TPM 1.2 implementations.
The stock driver failed to resume a ThinkPad T440p with its STMicro
[10 lines not shown]
nfs_clvfsops.c: Fix the non-VIMAGE build
The OFED code checks for a vnet argument, but it is
is not defined.
Reported by: glebius
MFC after: 3 months
Fixes: 884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")
gvirstor: Modernize the I/O path
- Add unmapped I/O support. The only case when the code needs data
access is BIO_READ returning zeroes for unallocated space.
- Add BIO_FLUSH support. Just send it to all allocated components.
- Add BIO_DELETE support. While current design does not allow
freeing allocated blocks, at least pass it to underlying providers.
- Add direct I/O completion support.
- Add rotation rate reporting.
- Fix few minor issues.
lib9p: Make it a private library
lib9p was imported to add a 9p server to bhyve (and I believe this was
the original motivation for writing it in the first place). Its
external interfaces are kind of strange (from first-hand experience
using it to implement an inetd-based 9p server) and undocumented.
Moreover, upstream has been inactive for over five years.
I suspect there are no third-party consumers. Let's make it a private
library for now, so as to make it easier to rework external interfaces.
If we get more code written against it, symbol versioning, and some
documentation, we can revisit this decision.
PR: 297499
Reviewed by: jhb, emaste
Differential Revision: https://reviews.freebsd.org/D58828
nfsclient: Fix problems with the NFS over RDMA glue
There were a couple of problems detected w.r.t. the
"glue" for the nfsclrdma.ko module.
- When the NFS server has a small reply for a read,
it can choose to not use the reduction chunk
(separate memory area for the read data). I did
not realize this was the case.
- There was a bug in rpc_copy_uio_pages() function
that caused intermittent crashes in memcpy().
This patch fixes the above cases. It uses M_PROTO6
to mark that an RPC reply has used a reduction chunk,
so that read can handle it correctly. Read also now
provides a reduction chunk for all read sizes, since
the worst case for the rest of the read RPC reply is
close to the 1024 byte limit. (NFSv4 uses strings
instead of uid/gid in the attributes and these name
strings can be rather large.)
[12 lines not shown]
pdopenpid(2): in cap mode, translate all errors from pdopenpid1() to ECAPMODE
to not leak information about unused pids or system processes' pids.
Reviewed by: markj
Fixes: 73c92a978cce ("pdopenpid(2): allow in capability mode with restrictions")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59252
tests/sys/kern/procdesc.c: mark grandchild var in pdopenpid_capmode() as volatile
The variable is written in the child process which shares the address
space with the parent. The data flow must not be optimized by a compiler.
Reviewed by: markj
Fixes: ddf62c83fc0a ("sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59282
bluetooth/ath3kfw: Whitelist "Dell Wireless 1802 Bluetooth 4.0 LE"
"Qualcomm Atheros Communications Dell Wireless 1802 Bluetooth 4.0 LE"
(0cf3:e006) is a wifi-bluetooth combo. The bluetooth chip is confirmed
to be AR3012 compatible. That's what the Linux ath3k driver loads as
well. It has been tested with the firmware files from the
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
repository as the comms/ath3k-firmware port appears to be discontinued.
Signed-off-by: Robin Haberkorn <rhaberkorn at fmsbw.de>
Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/2280
vmstat: Drop vm_cnt compat hack
Prior to FreeBSD 11, vm_cnt was named cnt. When it was renamed, vmstat
was modified to fall back to the old name if the new name was not found.
It's time we dropped this.
Reviewed by: kib, jhb, emaste
Differential Revision: https://reviews.freebsd.org/D59255
various: Fix nlist invocations
Fix nlist(3) consumers that either expected our toolchain to prepend an
underscore to symbol names or expected nlist(3) to ignore the mismatch,
as it did until we overhauled it back in May.
While here, also fix cases where the last element in the list had an
empty string instead of NULL as sentinel.
MFC after: 3 days
Fixes: 4617a6cb82a6 ("nlist: Handle multiple symbol tables")
Reviewed by: kib, jhb
Differential Revision: https://reviews.freebsd.org/D59254
msun: add asinpi, acospi, and atanpi
This commit implements the inverse half-cycle
trigonometric functions:
asinpi(x) = asin(x) / pi Eq. (1)
acospi(x) = acos(x) / pi
atanpi(x) = atan(x) / pi
Implemention details are contained in src/s_asinpi.c and
src/a_atanpi.c, where the details for acospi(x) appear in
the former.
*************
CAVEAT EMPTOR: The ld128 code has been only compiled. It has
not been tested for correctness due to lack of hardware.
*************
[127 lines not shown]
libc: Add strfromd, strfromf, and strfroml per C23
strfromd(), strfromf(), and strfroml() are implemented directly
in terms of gdtoa. If a non-conforming format string is passed,
the string "EDOOFUS" is returned and errno set to EDOOFUS as an
extension.
Reviewed by: fuz
MFC after: 1 month
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2301
Signed-off-by: Faraz Vahedi <kfv at kfv.io>
(cherry picked from commit f68d7bfc1479042184e09431bd55771c50c47f68)
ice(4): Add two more 4-part IDs for E835 adapters
Two additional subdevice IDs were introduced
to distinguish between adapters with and without
manageability over USB support.
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Reviewed by: erj
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57337
(cherry picked from commit f370d9e4d5844daa06d77e57236e03bd7c5f4ba1)
ix(4): Sanitize negative error codes
Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Reviewed by: kbowling, erj, milosz.linkiewicz_intel.com
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57642
(cherry picked from commit 33e2eac3e3e738daa95a06f42d6c661b87ad9aac)
ix(4): Remove workaround for 2.5/5G speeds on E610
The problem observed on X550 adapters with 2.5 and 5 Gbps speeds
negotiation on some switches is not affecting E610 adapters.
Remove workaround, which omitted those speeds in the list
of initially advertised speeds and advertise all speeds
supported by adapter.
Signed-off-by: Krzysztof Galazka <krzysztof.galazka at intel.com>
Reviewed by: kbowling
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57339
(cherry picked from commit 62d5d119ee7d935ac05966f1c7c4333c33c4f3a9)
ix(4): Sanitize negative error codes
Due to development history FreeBSD driver error codes are reported
the same way as in Linux (as negatives) which is inconsistent
with FreeBSD standard. It may cause unexpected behavior when driver
errors are interpreted by a kernel as syscall handler return values.
This patch converts error codes from negative to positive values for
NVM access functions.
Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>
Reviewed by: kbowling, erj, milosz.linkiewicz_intel.com
Tested by: Mateusz Moga <mateusz.moga at intel.com>
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D57642
(cherry picked from commit 33e2eac3e3e738daa95a06f42d6c661b87ad9aac)
