tpm: Harvest entropy from TPM 1.2 devices
The TPM 2.0 driver periodically contributes TPM-generated random bytes
to the kernel entropy pool, but the TPM 1.2 driver does not.
Issue TPM_GetRandom every ten seconds and submit successful responses
as RANDOM_PURE_TPM. Keep each exchange under the TPM transaction lock.
Defer harvesting while the character device is open or a command is
pending so the task cannot consume a user response. Drain the task for
suspend and detach, rearming it after resume or a failed suspend.
Document the expanded scope of RANDOM_ENABLE_TPM and update the kernel
configuration comments that described it as TPM 2.0-only.
Validated on a STMicroelectronics TPM 1.2 TIS device. DTrace observed
periodic entropy submissions; a raw GetRandom response remained intact
while the device was held open across a harvest interval; and module
unload/reload deregistered and restored the entropy source cleanly.
[5 lines not shown]
tpm: crb: Improve ACPI control and buffer addresses
The TPM2 ControlAddress identifies the control area, not necessarily a
PTP locality block. Hyper-V exposes a start-method-7 control area at the
beginning of its ACPI memory resource, with command and response buffers
in separate reserved memory pages. Assuming control registers are at
resource + 0x40 instead writes CANCEL as LOC_CTRL and fails attach.
Map the control area using ControlAddress and map buffers using their
reported physical addresses. Reuse the resource mapping for contained
ranges and track ownership of independent mappings for cleanup. Request
locality only when the resource contains the preceding 64-byte PTP header.
Keep the existing Pluton notification callbacks and locality behavior for
that layout. Control, locality, and buffer accesses use their respective
mappings directly, without the tpm_bus accessor class.
Bound transfers by the mapped buffer sizes and TPM_BUFSIZE. Clamp an
overstated buffer that starts within the ACPI resource to its remaining
extent, while requiring room for a complete response header. Keep strict
[21 lines not shown]
tpm: Tie exclusive-open cleanup to the file lifetime
Use a cdevpriv destructor to abort an unfinished TPM 1.2 transaction and
release exclusive-open ownership. Register it before setting TPM_OPEN so
a failed registration leaves the device available. The last reference to
the successful open triggers cleanup, including after dup() or fork().
Suggested by: kevans
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59812
(cherry picked from commit 084f245a8514e89a506e43efd1a7ed44ffdbb5eb)
tpm: Validate firmware interrupt routes and fall back cleanly
A host IRQ resource is not necessarily an LPC SIRQ selector. Let the
frontend configure the route: ACPI uses the allocated _CRS interrupt and
_SRS when present, preserving the firmware selector, while ISA supplies a
separate, range-checked SIRQ. Match trigger and polarity to the host route
and TPM capabilities, including opaque INTRNG resource mappings.
Pass the firmware descriptor unchanged to _SRS; apply the x86 ISA polarity
override only when computing the TPM mode. ISA chips without rising-edge
support now poll instead of substituting a level mode for the host route.
For both FIFO drivers, require a complete GetRandom transport response and
a fresh DATA_AVAIL interrupt before selecting interrupt waits. Perform
the test with polling before publishing the device, and repeat it after
resume. During cold boot, defer the test and publication to an interrupt
configuration hook so the IRQ grace wait can sleep and the handler can run.
Drain the hook before teardown; failed deferred initialization remains
unpublished and can be detached safely. Missing or failed routes release
the handler and IRQ resource;
[34 lines not shown]
tpm: Validate TIS 1.2 IRQs and quiesce delivery before teardown
The TIS 1.2 driver uses the IRQ resource value directly as the four-bit
LPC SIRQ selector in TPM_INT_VECTOR, without validating it before
narrowing. Add the missing range check on the full resource value and use
polling for routes outside 1 through 15. This restriction reflects the
driver's current routing support: parent interrupt numbers need not equal
LPC SIRQ channels.
Attach also installs a handler when the chip's quirks select polling.
Release the IRQ resource when initialization selects polling. Retain an
interrupt cookie only after successful setup and require it for interrupt
waits.
Share verified interrupt masking across initialization, resume, and
detach. Quiesce after draining cdev methods and before removing a handler,
including polling devices whose failed resume left firmware delivery on.
Preserve an owned locality until the existing abort path discards any
pending response. Report quiesce failures while completing detach cleanup.
[18 lines not shown]
e1000: Honor the common RSS hash-field policy
Use rss_gethashconfig() to select MRQC hash fields in both the em and
igb multiqueue paths, including kernels built without options RSS.
igb previously enabled UDP four-tuple hashing unconditionally, while
the stack defaults to hashing only the addresses unless
net.inet.rss.udp_4tuple is enabled. Honor that setting and include the
configured IPv6 extension-header address hash.
Limit the 82574 mapping to its supported fields. Its TCP/IPv6 selector
is bit 18, named IPV6_TCP_EX in the shared definitions; bit 21 and the
UDP selectors are reserved. Its default field selection is unchanged.
Sponsored by: BBOX.io
(cherry picked from commit 86bdf7a4aec5223b016791ffc6bffb8a51865670)
[clang] Include definition ranges in macro info dumps (#241185)
`MacroInfo::dump()` omits the macro's definition range, making it harder
to trace the original definition after `#pragma pop_macro` restores it.
Print the definition range while preserving the no-argument overload for
debugger use.
[clang] Include source locations in macro directive dumps (#240172)
`#pragma clang __debug macro` dumps macro directive history without
showing where each directive occurred.
Pass the `SourceManager` to `MacroDirective::dump()` and print each
directive's location alongside its address, making definitions and
undefinitions easier to trace.
[clang][NFC] Remove unused MacroDirective PCH origin tracking (#240171)
`MacroDirective::IsFromPCH` is never set, and its accessors have no
callers. Macro history serialization instead uses the identifier's
deserialization and change state.
Remove the unused flag, accessors, and corresponding `dump()` output.
[Clang][CFI] Check ObjectWithVPtr in ShouldEmitVTableTypeCheckedLoad (#241639)
In `MicrosoftCXXABI::getVirtualFunctionPointer`,
`EmitVTableTypeCheckedLoad` and `EmitTypeMetadataCodeForVCall` use the
class that owns the selected vfptr (`ObjectWithVPtr`), while
`ShouldEmitVTableTypeCheckedLoad` has checked `MethodDecl->getParent()`
since 0ca0363d0524 (D21122).
When the overriding class and secondary-vfptr owner differ in LTO
visibility or ignorelist status (for example, a hidden class overriding
a method in an `lto_visibility_public` or COM/`dllimport` secondary
base), `ShouldEmitVTableTypeCheckedLoad` checked the wrong record.
Guard both paths with `PrepareForLTO` (matching the existing
`EmitTypeMetadataCodeForVCall` call in `getVirtualFunctionPointer`) and
pass `ObjectWithVPtr` to `ShouldEmitVTableTypeCheckedLoad`.
Needed by #241647.
Assisted-by: Gemini
[Cloning] Move undeclared scopes into cloned disjoint domains
When a scope from a disjoint-scope domain is cloned (because its
llvm.experimental.noalias.scope.decl is in the code being duplicated),
the clone is placed into a clone of the domain. Scopes of that domain
without a declaration in the duplicated code, however, were left in the
original domain. InstCombine removes declarations of scopes it considers
unused, so this happens in practice: an !alias.scope list {b, c} where
only c is still declared became {b, c'} when copying for loop unrolling, with c' in
the new domain. ScopedNoAliasAA then only compared {c'} against a
!noalias {c'} list in that domain and concluded NoAlias, while the
original {b, c} list was not noalias with {c}.
Fix this by also cloning, into the cloned domain, any scope of that
domain used by the adapted instructions. Renaming a whole disjoint
domain consistently within the duplicated code preserves the relations
inside it. I don't expect the theoretical precision loss here to be an
issue in practice.
[7 lines not shown]
[NFC][Transforms] Add tests with undeclared scopes in cloned disjoint domains
Pre-commit tests for fixing #241246. When scopes from a disjoint-scope domain
are cloned into a clone of that domain, scopes of the same domain that
have no llvm.experimental.noalias.scope.decl in the cloned region
currently stay in the original domain. An !alias.scope list that uses
both kinds of scope is then split across the two domains, which leads
ScopedNoAliasAA to report a false NoAlias.
AI disclosure: Claude wrote these (and `llvm-reduce`d them), and
mostly wrote this commit message (I tinkered with it a bit)
Co-Authored-By: Claude Opus 5.5 <noreply at anthropic.com>
vmm: Don't assert on device errors in MOVS emulation
emulate_movs() asserts that it fails only with EFAULT, but a device read
or write can fail with other errors, such as EINVAL from lapic_mmio_read()
for an access whose 4-byte-aligned offset is not 16-byte aligned, or from
lapic_mmio_write() for an unaligned or non-4-byte access. A guest could
therefore panic a kernel with INVARIANTS using a MOVS from the local APIC.
Return the error, as the other emulation functions do.
Reviewed by: markj
MFC after: 1 week
Sponsored by: Alchemilla Ventures Private Limited
tests/sys/kern/ssl_sendfile: :eagain_vs_eof: improve failure messaging
Convert many raw `ATF_REQUIRE(..)` macro calls to `ATF_REQUIRE_MSG(..)`
and output the sbytes attached to the context in provide meaningful
information with failure messages.
While here, fix a typo in a comment and some indentation in another
testcase (:random).
PR: 299447
MFC after: 1 week
tests/sys/kern/ssl_sendfile: :eagain_vs_eof: improve failure messaging
Convert many raw `ATF_REQUIRE(..)` macro calls to `ATF_REQUIRE_MSG(..)`
and output the sbytes attached to the context in provide meaningful
information with failure messages.
While here, fix a typo in a comment and some indentation in another
testcase (:random).
PR: 299447
MFC after: 1 week
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
Approved by: re (cperciva)
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
(cherry picked from commit 2d6f961164e4ab7e823972336dc9cfaae6a88ed8)
(cherry picked from commit 55ede03fc24aa8de58814563e82e72cf8b34d9cc)
OpenSSH: Update to 10.6p2
Full release notes are available at
https://www.openssh.org/txt/release-10.6p2 .
Selected items from the upstream release notes:
Future deprecation notice
-------------------------
* scp(1): begin deprecating the -R flag, which is used to perform a
remote-to-remote copy by executing scp on a remote host. This
option is a fragile optimisation that is difficult to use because
it requires credentials on the remote host. It also creates
security risks if the shell quoting rules on the remote system
where the copy is performed differ from the client's expectations.
From OpenSSH 10.6, this option will continue to work but will
cause a deprecation warning to be emitted to standard error. In
[10 lines not shown]
OpenSSH: Update to 10.6p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.6 .
Selected items from the upstream release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[37 lines not shown]
AMDGPU: Use inline register class syntax in MIR tests (#242042)
Move away from keeping a registers section just to state the register
class. Delete the registers section when the class was the only used
field.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
OpenSSH: Update to 10.5p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.5.
Selected items from the release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[37 lines not shown]
