[sanitizer_common] Measure strstr's haystack only if there is no match (#239871)
StrstrCheck, used by the interceptors of strstr and strcasestr, calls
internal_strlen on the haystack unconditionally, but uses that length
only if there was no match. A match at the start of a long string
therefore costs time proportional to the length of the string, and the
usual loop
`while ((p = strstr(p, needle))) { ...; p++; }`
is quadratic in the size of the buffer.
Compute the length only when it is needed. The ranges that are checked
are the same as before.
One case differs: for a haystack that has no terminator in front of an
unmapped page, the old code crashes in internal_strlen even if strstr
finds a match. Unless strict_string_checks is set, the new code does not
read past what strstr itself reads.
The new test strstr-match.c pins down which part of the haystack is
[6 lines not shown]
tests: Add test for vn_io_fault1 bug
This bug was fixed in b487aca48535, but I did not have a regression
test ready for it at the time.
The test allocates a large buffer, faults part of it in and leaves the
rest unmapped, then tries to read a 3 GiB file into it. If the bug is
present, the read succeeds, but the return value exceeds the requested
amount by exactly one page less than the amount that was prefaulted.
PR: 298159
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61475
[AMDGPU] Trim unused leading components of tbuffer loads (#240750)
Trim unused leading components of `tbuffer.load` in
`simplifyAMDGCNMemoryIntrinsicDemanded`. Untyped buffer loads already do
this; tbuffer loads were a TODO.
The format describes the whole element, so moving the offset alone is
not enough. Skipping `k` leading components:
- adds `k * BitsPerComp / 8` to the offset. The component size comes
from the format, not the result type (they differ for d16 and for
8/16-bit formats returning `float`).
- switches to the format with `k` fewer components, so the element still
ends at the same byte and bounds checking is unchanged.
The trim is skipped if no such format exists (e.g. there is no
`16_16_16`, packed formats) or if a demanded lane is past the end of the
format. The format table depends on the subtarget, hence the new
`GCNSubtarget` parameter.
[4 lines not shown]
[CIR] Support annotations on locals, parameters, fields, and __builtin_annotation (#240666)
ClangIR only handled `__attribute__((annotate(...)))` on globals and
functions. Everywhere else it was either silently dropped or not
implemented:
```cpp
struct S { int v __attribute__((annotate("on_field"))); }; // NYI
int f(int p __attribute__((annotate("on_param")))) { // dropped, no diagnostic
int x __attribute__((annotate("on_local"))); // dropped, no diagnostic
return __builtin_annotation(p, "on_builtin"); // NYI
}
```
Further, Global annotations crashed on targets whose globals don't live
in address space 0, such as SYCL device code on SPIR-V and AMDGPU:
```
error: 'llvm.mlir.addressof' op pointer address space must match address space of the referenced global or alias
```
This patch adds three ops that mirror the LLVM dialect's annotation
[31 lines not shown]
Skip the BACKUP from vrrp_backup's own keepalived restart
vrrp_backup pauses failover events, stops keepalived to move the
VIPs off this node, and starts it again before unpausing. The
restarted keepalived reports BACKUP (init). If VrrpFifoThread
reconnects to the fifo after the unpause, which happens when the
time from keepalived stopping to the unpause is less than the
reader's 2 second retry sleep, that BACKUP is processed as a new
event and the whole BACKUP sequence runs a second time.
Drop a BACKUP event when the last failover event was a successful
vrrp_backup. VrrpEventThread already did this for events arriving
in rapid succession, using LAST_EVENT_TYPE; now it does it for every
BACKUP. Set LAST_EVENT_TYPE to MASTER when vrrp_master starts
rather than when it succeeds, so that a BACKUP following a MASTER
attempt that failed or was ignored is still processed.
mlx5en: Report the configured RSS tuple selections
Derive SIOCGIFRSSHASH's TCP and UDP selections from the same boot-time
hash configuration used by mlx5e_build_tir_ctx(). The query previously
advertised all six IPv4/IPv6 hash types even when the transport-specific
TIRs selected only the IP addresses. In particular, the default RSS
configuration disables UDP four-tuple hashing.
Continue reporting IPv4 and IPv6 two-tuple hashing unconditionally,
matching the driver's IP-only TIRs. Do not report IPv6 extension-header
variants which the query did not previously claim. Leave key selection,
TIR programming, and the receive datapath unchanged. This lets consumers
such as hn(4) match the VF's hash inputs instead of enabling incompatible
UDP four-tuple hashes on their own receive path.
Fixes: a00718e1dfcd ("Implement SIOCGIFRSSKEY and SIOCGIFRSSHASH and mlx5en(4).")
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59807
(cherry picked from commit 0f111a802f6beb88f3edad9fa48d3721f8b3ec7b)
tpm20: Preserve all harvested random bytes
The TPM requests 16 random bytes every ten seconds, but a random
harvest event retains at most eight bytes. random_harvest_queue()
reduces a larger input to one 32-bit Jenkins hash, so each successful
TPM request contributed only four bytes to the entropy accumulator.
Split the response into harvest event sized chunks. This preserves all
16 random bytes without increasing the TPM command rate or changing its
high quality source classification.
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59246
(cherry picked from commit 914892d374e924cae2a0a1d7a669f246a845ad35)
tpm: Harvest entropy from TPM 1.2 devices
The TPM 2.0 driver periodically contributes TPM-generated random bytes
to the kernel entropy pool, but the TPM 1.2 driver does not.
Issue TPM_GetRandom every ten seconds and submit successful responses
as RANDOM_PURE_TPM. Keep each exchange under the TPM transaction lock.
Defer harvesting while the character device is open or a command is
pending so the task cannot consume a user response. Drain the task for
suspend and detach, rearming it after resume or a failed suspend.
Document the expanded scope of RANDOM_ENABLE_TPM and update the kernel
configuration comments that described it as TPM 2.0-only.
Validated on a STMicroelectronics TPM 1.2 TIS device. DTrace observed
periodic entropy submissions; a raw GetRandom response remained intact
while the device was held open across a harvest interval; and module
unload/reload deregistered and restored the entropy source cleanly.
[5 lines not shown]
tpm: crb: Improve ACPI control and buffer addresses
The TPM2 ControlAddress identifies the control area, not necessarily a
PTP locality block. Hyper-V exposes a start-method-7 control area at the
beginning of its ACPI memory resource, with command and response buffers
in separate reserved memory pages. Assuming control registers are at
resource + 0x40 instead writes CANCEL as LOC_CTRL and fails attach.
Map the control area using ControlAddress and map buffers using their
reported physical addresses. Reuse the resource mapping for contained
ranges and track ownership of independent mappings for cleanup. Request
locality only when the resource contains the preceding 64-byte PTP header.
Keep the existing Pluton notification callbacks and locality behavior for
that layout. Control, locality, and buffer accesses use their respective
mappings directly, without the tpm_bus accessor class.
Bound transfers by the mapped buffer sizes and TPM_BUFSIZE. Clamp an
overstated buffer that starts within the ACPI resource to its remaining
extent, while requiring room for a complete response header. Keep strict
[21 lines not shown]
tpm: Tie exclusive-open cleanup to the file lifetime
Use a cdevpriv destructor to abort an unfinished TPM 1.2 transaction and
release exclusive-open ownership. Register it before setting TPM_OPEN so
a failed registration leaves the device available. The last reference to
the successful open triggers cleanup, including after dup() or fork().
Suggested by: kevans
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59812
(cherry picked from commit 084f245a8514e89a506e43efd1a7ed44ffdbb5eb)
tpm: Validate firmware interrupt routes and fall back cleanly
A host IRQ resource is not necessarily an LPC SIRQ selector. Let the
frontend configure the route: ACPI uses the allocated _CRS interrupt and
_SRS when present, preserving the firmware selector, while ISA supplies a
separate, range-checked SIRQ. Match trigger and polarity to the host route
and TPM capabilities, including opaque INTRNG resource mappings.
Pass the firmware descriptor unchanged to _SRS; apply the x86 ISA polarity
override only when computing the TPM mode. ISA chips without rising-edge
support now poll instead of substituting a level mode for the host route.
For both FIFO drivers, require a complete GetRandom transport response and
a fresh DATA_AVAIL interrupt before selecting interrupt waits. Perform
the test with polling before publishing the device, and repeat it after
resume. During cold boot, defer the test and publication to an interrupt
configuration hook so the IRQ grace wait can sleep and the handler can run.
Drain the hook before teardown; failed deferred initialization remains
unpublished and can be detached safely. Missing or failed routes release
the handler and IRQ resource;
[34 lines not shown]
tpm: Validate TIS 1.2 IRQs and quiesce delivery before teardown
The TIS 1.2 driver uses the IRQ resource value directly as the four-bit
LPC SIRQ selector in TPM_INT_VECTOR, without validating it before
narrowing. Add the missing range check on the full resource value and use
polling for routes outside 1 through 15. This restriction reflects the
driver's current routing support: parent interrupt numbers need not equal
LPC SIRQ channels.
Attach also installs a handler when the chip's quirks select polling.
Release the IRQ resource when initialization selects polling. Retain an
interrupt cookie only after successful setup and require it for interrupt
waits.
Share verified interrupt masking across initialization, resume, and
detach. Quiesce after draining cdev methods and before removing a handler,
including polling devices whose failed resume left firmware delivery on.
Preserve an owned locality until the existing abort path discards any
pending response. Report quiesce failures while completing detach cleanup.
[18 lines not shown]
e1000: Honor the common RSS hash-field policy
Use rss_gethashconfig() to select MRQC hash fields in both the em and
igb multiqueue paths, including kernels built without options RSS.
igb previously enabled UDP four-tuple hashing unconditionally, while
the stack defaults to hashing only the addresses unless
net.inet.rss.udp_4tuple is enabled. Honor that setting and include the
configured IPv6 extension-header address hash.
Limit the 82574 mapping to its supported fields. Its TCP/IPv6 selector
is bit 18, named IPV6_TCP_EX in the shared definitions; bit 21 and the
UDP selectors are reserved. Its default field selection is unchanged.
Sponsored by: BBOX.io
(cherry picked from commit 86bdf7a4aec5223b016791ffc6bffb8a51865670)
[clang] Include definition ranges in macro info dumps (#241185)
`MacroInfo::dump()` omits the macro's definition range, making it harder
to trace the original definition after `#pragma pop_macro` restores it.
Print the definition range while preserving the no-argument overload for
debugger use.
[clang] Include source locations in macro directive dumps (#240172)
`#pragma clang __debug macro` dumps macro directive history without
showing where each directive occurred.
Pass the `SourceManager` to `MacroDirective::dump()` and print each
directive's location alongside its address, making definitions and
undefinitions easier to trace.
[clang][NFC] Remove unused MacroDirective PCH origin tracking (#240171)
`MacroDirective::IsFromPCH` is never set, and its accessors have no
callers. Macro history serialization instead uses the identifier's
deserialization and change state.
Remove the unused flag, accessors, and corresponding `dump()` output.
[Clang][CFI] Check ObjectWithVPtr in ShouldEmitVTableTypeCheckedLoad (#241639)
In `MicrosoftCXXABI::getVirtualFunctionPointer`,
`EmitVTableTypeCheckedLoad` and `EmitTypeMetadataCodeForVCall` use the
class that owns the selected vfptr (`ObjectWithVPtr`), while
`ShouldEmitVTableTypeCheckedLoad` has checked `MethodDecl->getParent()`
since 0ca0363d0524 (D21122).
When the overriding class and secondary-vfptr owner differ in LTO
visibility or ignorelist status (for example, a hidden class overriding
a method in an `lto_visibility_public` or COM/`dllimport` secondary
base), `ShouldEmitVTableTypeCheckedLoad` checked the wrong record.
Guard both paths with `PrepareForLTO` (matching the existing
`EmitTypeMetadataCodeForVCall` call in `getVirtualFunctionPointer`) and
pass `ObjectWithVPtr` to `ShouldEmitVTableTypeCheckedLoad`.
Needed by #241647.
Assisted-by: Gemini
[Cloning] Move undeclared scopes into cloned disjoint domains
When a scope from a disjoint-scope domain is cloned (because its
llvm.experimental.noalias.scope.decl is in the code being duplicated),
the clone is placed into a clone of the domain. Scopes of that domain
without a declaration in the duplicated code, however, were left in the
original domain. InstCombine removes declarations of scopes it considers
unused, so this happens in practice: an !alias.scope list {b, c} where
only c is still declared became {b, c'} when copying for loop unrolling, with c' in
the new domain. ScopedNoAliasAA then only compared {c'} against a
!noalias {c'} list in that domain and concluded NoAlias, while the
original {b, c} list was not noalias with {c}.
Fix this by also cloning, into the cloned domain, any scope of that
domain used by the adapted instructions. Renaming a whole disjoint
domain consistently within the duplicated code preserves the relations
inside it. I don't expect the theoretical precision loss here to be an
issue in practice.
[7 lines not shown]
[NFC][Transforms] Add tests with undeclared scopes in cloned disjoint domains
Pre-commit tests for fixing #241246. When scopes from a disjoint-scope domain
are cloned into a clone of that domain, scopes of the same domain that
have no llvm.experimental.noalias.scope.decl in the cloned region
currently stay in the original domain. An !alias.scope list that uses
both kinds of scope is then split across the two domains, which leads
ScopedNoAliasAA to report a false NoAlias.
AI disclosure: Claude wrote these (and `llvm-reduce`d them), and
mostly wrote this commit message (I tinkered with it a bit)
Co-Authored-By: Claude Opus 5.5 <noreply at anthropic.com>
vmm: Don't assert on device errors in MOVS emulation
emulate_movs() asserts that it fails only with EFAULT, but a device read
or write can fail with other errors, such as EINVAL from lapic_mmio_read()
for an access whose 4-byte-aligned offset is not 16-byte aligned, or from
lapic_mmio_write() for an unaligned or non-4-byte access. A guest could
therefore panic a kernel with INVARIANTS using a MOVS from the local APIC.
Return the error, as the other emulation functions do.
Reviewed by: markj
MFC after: 1 week
Sponsored by: Alchemilla Ventures Private Limited
