vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[8 lines not shown]
malloc: Fix realloc() for large allocations
min() truncates its parameters.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit ca16e7a4920415bf9d09cf76bd2c3cda7447c098)
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
[5 lines not shown]
hv_kvp: Fix some bugs and nits
- Use pending_mutex to synchronize several state flags. In particular,
ensure that two threads can't race to open the device file at the same
time.[1]
- Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a
one-byte OOB read if the caller supplied a large enough read buffer.[2]
- Change the device permissions to 0600: hv_kvp_dev_daemon_read()
returns an error until the owning process registers itself with a
write, so there's no sense in providing read-only access.
- Use bool instead of boolean_t.
- Don't return negative error numbers to userspace.
- Call seldrain() when closing the device.
Reported by: pixelpop [1][2]
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60387
(cherry picked from commit ebf1041fc854c531a27efd9f979e28d57306777d)
bhyve: Fix virtio-input event array resizing
Use the new array size when calling realloc(). Note that this queue
stores events read from a host evdev device, i.e., it is not
guest-controlled.
While here, use the cdefs.h __unused macro and use them correctly, i.e.,
don't mark "arg" as unused when it isn't.
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Fixes: 054accac71e0 ("Add a virtio-input device emulation.")
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60679
(cherry picked from commit f1986e5b88630b1404a202251499bca0f97f5f06)
pam_exec: fix the stderr close test and avoid a double close
The cleanup tested cherr[0] when closing cherr[1]. The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again. Clear each fd after closing and test the right
one.
Reviewed by: des, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60924
(cherry picked from commit 06abe08de45d251410949eac1bbb025367275260)
dhclient: Avoid out-of-bounds reads in check_classless_option()
The loop did not verify that the option buffer is large enough before
reading an address.
Reported by: Andrew Griffiths <andrew at calif.io>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60484
(cherry picked from commit 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b)
inetd: use snprintf() in inetd_setproctitle()
inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60879
(cherry picked from commit 9ab2bf0f4296e8bfafe4dc70f2f200265e6933bd)
dhclient: Add some regression tests
Add tests for some recently fixed bugs in dhclient. All of these tests
set up two VNET jails connected by an epair. dhclient runs in one jail,
and the test code runs on the other end. It uses scapy to inject
"interesting" packets in response to DHCPDISCOVER messages from
dhclient, then checks the configured interface and lease file.
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60485
(cherry picked from commit a143197801c680b958ab662c88cf086668a1958b)
MIR: Add tests for the registers section syntax
Most tests now put register classes inline. Add dedicated testing for
the registers section class handling so this coverage isn't lost when
tests are cleaned up.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[bazel] Avoid deprecated ctx.outputs.executable and output_to_genfiles (#241742)
Modernize custom Starlark rules in `binary_alias.bzl` and
`mlir/tblgen.bzl`:
- Declare executable outputs explicitly via `ctx.actions.declare_file`
and return them in `DefaultInfo(files = ..., executable = ...)` instead
of relying on the deprecated `ctx.outputs.executable` predeclared
output.
- Remove the deprecated no-op `output_to_genfiles = True` argument from
`gentbl_shard_rule`.
Assisted-by: Gemini
[CIR][NFC] Add test coverage for static member call side effects (#239291)
This patch adds tests for calling static member functions through
instance and pointer expressions in ClangIR
(`clang/test/CIR/CodeGenCXX/static-member-call.cpp`).
Under standard C++ Sema, calling a static member function via an object
instance (`s.static_func()`) or pointer (`p->static_func()`) is lowered
into a standard `CallExpr` with a `MemberExpr` callee.
This patch adds test coverage verifying that:
1. Direct instance calls (`s.static_func()`) emit expected CIR and OGCG
LLVM IR.
2. Pointer arrow calls (`p->static_func()`) emit expected CIR and OGCG
LLVM IR.
3. Temporary base object expressions are evaluated for side effects
(`get_s().static_func()`).
4. Mutating pointer expressions are evaluated for side effects
(`(p++)->static_func()`).
Split from #237420 as requested by @Men-cotton.
[SLSR][NFC] Regenerate slsr-mul.ll checks with update_test_checks.py (#242411)
Regenerate the checks in slsr-mul.ll with update_test_checks.py. This is
a pre-commit for #240431, split out so the functional change there can
be reviewed against already-autogenerated checks. No functional change.
rtnetlink: Use default weight for unset weights in NHA_GROUP
newnhg() copied the weights of a nhgrp as is and a group
whose members all have a zero weight, which is what
userland sends when it leaves the weight unset, made
calc_min_mpath_slots_fast() divide by zero.
Therefore replace weight of zero with RT_DEFAULT_WEIGHT.
While here, return early from calc_min_mpath_slots_fast()
if all weights are zero.
MFC after: 3 days
Fixes: 7e5bf68495cc ("netlink: add netlink support")
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Fix hugetlb write fault livelock, permission overlay and GCS state
preservation across CPU suspend, cpuidle context tracking during
system suspend, GCS mode handling on signal return, AMU counter errata
workarounds, kexec loading of images with a non-zero text_offset and a
spurious ptrace warning:
- Fix hugetlb write fault livelocks caused by stale read-only TLB
entries after another CPU makes the page writable and only performs
a local invalidate. Unlike the generic fault path, hugetlb has no
fix_spurious_fault() fallback
- Save and restore POR_EL0, GCSPR_EL0 and GCSCRE0_EL1 across CPU
suspend
- Restrict cpuidle context tracking in cpu_suspend() to idle tasks,
avoiding context tracking warnings during system suspend
[30 lines not shown]
[X86/CFI] Emit __cfi symbol with same visibility as parent (#242004)
A hidden function should have a corresponding __cfi symbol with hidden
visibility.
Assisted by LLM
[dsymutil] Undo prefix mapping before resolving paths for ODR uniquing
The classic linker resolves the declaration file of a type with
realpath() to tell apart types with the same name, line and size. For
paths remapped by compilation caching, which don't exist on disk,
realpath() fails and only the file name is left, so different types
declared in headers with the same name in different directories were
merged. Undo the prefix mapping from compilation-prefix-map.json first.
[dsymutil] Support compilation-prefix-map.json from compilation caching
Compilation caching can prefix map the paths that the compiler sees, so
that cache keys don't depend on where the build happens, for example
/path/to/project becomes /^src. The build system records the mapping in
a compilation-prefix-map.json file in a parent directory of the object
files, as a JSON object from each remapped prefix to the original one.
dsymutil didn't support it, so it used the remapped paths from the
debug info as is: it failed to copy the Swift interfaces that the debug
info refers to, didn't recognize interfaces from the SDK or the
toolchain that it should skip, and wrote the remapped paths into the
dSYM.
Load the compilation-prefix-map.json closest to each object file, and
use it to find Swift interfaces and Clang modules, and to restore the
original paths in the path attributes and line tables of the linked
debug info. Clang modules use the map of the object file that refers to
them. -object-prefix-map still only applies to looking up Clang
[6 lines not shown]
[Support] Add vfs::findFileInParentDirectories()
Several tools look for a file in a directory and its parent
directories, for example clang-format for .clang-format and clang-tidy
for .clang-tidy, and each has its own loop for that. Add a function for
it, which dsymutil will use to find the compilation-prefix-map.json
files that compilation caching writes.
[Support] Add PrefixMapper
Add a utility for remapping path prefixes, along with MappedPrefix for
parsing "old=new" mappings. Mappings are matched on whole path
components and respect the configured path style, so Windows paths are
matched case- and separator-insensitively.
This will be used by dsymutil to undo the path prefix mapping applied
by compilation caching.
18536 door servers should use DOOR_PARAM_DATA_MIN to reject undersized requests
Reviewed by: Bill Sommerfeld <sommerfeld at hamachi.org>
Reviewed by: Dan McDonald <danmcd at oxide.computer>
Approved by: Gordon Ross <gordon.w.ross at gmail.com>
