amd64: Make the SYSENTER and INTn action same as for IDT case.
Fixes: 6e93f5e4d693 ("amd64: FRED support")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
amd64: do not pass SYSENTER frame to FRED fast syscall handler
With FRED, SYSCALL is delivered as event type syscall (7) and vector 1.
SYSENTER is syscall with vector 2. Handle SYSENTER in slow path,
otherwise 32bit code is able to execute 64bit syscalls.
Also check that SYSCALL comes from the 64bit mode. Intel already
specifies that SYSCALL causes #UD in compatibility mode, but there is no
AMD specification for SYSCALL under FRED yet, and SYSCALL is allowed
in compatibility mode on AMD with IDT event delivery.
Fixes: 6e93f5e4d693 ("amd64: FRED support")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
amd64: fixes for register handling of syscall entry for FRED
- Save %r10 into tf_rcx. This is the location for the 4th arg.
libsys stubs do 'movq %rcx, %r10' so the fast syscall path works
as is. But Go binaries directly put arg 4 into %r10.
Also save %r11 into tf_r11 for the duration of syscall handler.
- Somewhat improve binary compatibility with IDT SYSCALL fast return,
by copying userspace return %rip into %rcx, and %rflags into %r11,
emulating SYSCALL IDT delivery.
Fixes: 6e93f5e4d693 ("amd64: FRED support")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
amd64: do not allow to set IOPL to 3 when FRED is used
SDM requires that IOPL is zero when returning to usermode with ERETU.
Do not set rflags.iopl for FreeBSD io(4) open.
This might be changed to disallow io(4) open for FRED at all with a
knob, if there is a real need.
Return ENOSYS from linux iopl(2), apparently Linux kernel can be
configured without iopl(2) support, so linux programs should be prepared
for this error.
Return EINVAL from vt(4)/syscons(4) ioctl(KDENABIO).
Fixes: 6e93f5e4d693 ("amd64: FRED support")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
amd64_cpu_init_fred(): set stack level for NMI and not #NM
Fixes: 6e93f5e4d693 ("amd64: FRED support")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
sound tests: Check the return value of close(2)
While here, remove two munmap(2) calls on mappings the tests require to
have failed, since they are practically dead.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60800
sound: Let pcm_unregister() tear down a partially initialized device
Since 3107b952f534 ("sound: Merge PCM_ALIVE() with PCM_REGISTERED()"),
pcm_unregister() is gated on PCM_REGISTERED(), so it cannot run unless
pcm_register() has already succeeded, which means drivers will leak
resources if a failure happened prior to this.
Reintroduce PCM_ALIVE(), but test dev rather than the lock. pcm_init()
assigns dev before anything else, so it can tell us whether pcm_init()
has run or not. Make sure to clear it in pcm_unregister() so that a
second call to pcm_unregister() cannot double-free.
While here, publish to sndstat(4) only once pcm_register() has
succeeded.
Reported by: jah
Fixes: 3107b952f534 ("sound: Merge PCM_ALIVE() with PCM_REGISTERED()")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
[2 lines not shown]
ocs_fc: Fix config space bounds, double PRLI response and a stack overflow
Fix three unrelated problems found by security review of the driver.
ECD helper ioctl:
- OCS_ECD_HELPER_CFG_READ* and OCS_ECD_HELPER_CFG_WRITE* passed a user
supplied offset straight to pci_read_config() and pci_write_config().
Reject accesses that extend past PCIE_REGMAX, so that a wide access
starting in range cannot run past the end of config space.
- Use the real access width (1, 2 or 4 bytes) of the command for both
the BAR and the config space checks, rather than assuming 4 bytes, so
that narrow accesses at the very end of the BAR or config space are
not rejected while wider ones remain bounded.
PRLI:
- When a PRLI carries an FC-4 type other than the one the driver
supports, ocs_d_send_prli_rsp() sent an LS_RJT and started node
shutdown, but then fell through and sent a second response on the same
IO (another LS_RJT, or a PRLI LS_ACC when the initiator is accepted),
[19 lines not shown]
ocs_fc: Harden ioctl, XRI lookup and FCP command validation
Fix several issues found by security review of the driver.
ioctl:
- Require PRIV_DRIVER for all ocs ioctls and create the device node
with mode 0600, group wheel.
- Return the error from ocs_process_sli_config() to the caller.
Previously only ENXIO was propagated, so a failed validation or a
failed copyin() still issued the mailbox command, in the latter case
with a descriptor pointing at freed memory.
- Reject COMMON_WRITE_OBJECT when in_bytes exceeds
desired_write_length, and cap WRITE_OBJECT, READ_OBJECT,
READ_OBJECT_LIST and non-embedded mailbox buffers at
OCS_MAX_DMA_ALLOC, returning EINVAL.
- Use a 64-bit size for the non-embedded mailbox buffer to avoid
truncation of a user supplied length.
- Refuse to copy out more than the size of the DMA buffer allocated
for the command.
[19 lines not shown]
OCI: Remove dead code
We don't need to pick a repository URL when all we're doing is enabling
one which was specified in /etc/pkg/.
Reviewed by: dch, imp
Fixes: c73ae6734899 ("release/tools: use same pkg settings ...")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60868
(cherry picked from commit 93c05b743ea865bb87653e9ee5fbaa837c00eee7)
powerpc: Avoid deadlock when CPUs exchange threads
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e5421468 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
[22 lines not shown]
powerpc: Avoid deadlock when CPUs exchange threads
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e5421468 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
[22 lines not shown]
usr.bin/man: allow man(1) to search translated manpages in pure $man_lang subdirectory (+)
Currently our man(1) utility search manages only in $lang_country.$charset, $lang.$charset and,
as failover, in en.$charset which is historical behavior.
But nowadays most of ported software uses only $lang subdirectories for translated manpages
instead of use full locale notation, for example, share/ja/man1, share/de/man1, share/ru/man1.
In such cases, our man(1) utility cannot find any translated manpages and silently fallback to english version.
Add $man_lang in search path allows man(1) search and use translated manpages under historical and modern path traditions
MFC after: 1 day
MFC to: stable/15 stable/14
Reviewed by: ziaee, fernape
Approved by: fernape
Differential Revision: https://reviews.freebsd.org/D55805
sctp: improve handling of SO_SETFIB socket option
Since SCTP keeps fibnum in the SCTP protocol control block,
the code can't just defer the processing to the IPv4 or IPv6
layer. Therefore it needs to be implemented in the the SCTP
layer and it needs to call the socket layer function.
PR: 300091
Reviewed by: tuexen
Fixes: caccbaef8e26 ("socket: Move SO_SETFIB handling to protocol layers")
MFC after: 3 days
MFC to: stable/14
MFC to: stable/15
sound examples: trigger dsp devices via syncgroup
Triggering is only needed if device is in mmap mode, and in mmap example
the device is triggered as part of syncgroup. For non-mmap mode,
triggering is not needed at all. Triggering mmap'ed device too early
would start the IPTR/OPTR counters and that would cause those pointers
to be out of sync, so let syncgroup do the triggering once the device is
fully configured and ready for capture and playback.
MFC after: 1 week
Reviewed by: christos
Differential Revision: https://reviews.freebsd.org/D60839
(cherry picked from commit d3aa926bffd20e4ef0e12e3ee9af1707ad234cda)
amdsmu: Use devclass name instead of module name
The diagnostics array contained expected modules to be loaded but the
checking logic checked for if a devclass of that name existed instead.
Have the diagnostics array contain the devclass instead as well as the
module to load for the hint string.
Furthermore, check tha the number of devices is greater than 0 so that
leftover devclasses from unloaded modules don't skip the hint.
Reported by: emaste
Reviewed by: emaste
Fixes: 758578370f6b ("amdsmu: Hints on what to do if IP block blocking S0i3")
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/70
riscv: Map the DTB when it is outside the kernel's 1GB region
When the kernel is started directly by SBI firmware, locore.S maps only
the 1GB region that contains the kernel, and initriscv() reads the DTB
through that mapping at the physical address passed in a1. If the
firmware put the DTB in another 1GB region, as QEMU does with more than
1GB of RAM, fake_preload_metadata() faults before the console is up and
the kernel hangs.
Also map the 1GB region that contains the DTB.
This fixes direct kernel booting without FreeBSD loader(8).
PR: 299088
Reviewed by: mhorne
Fixes: bfb857546984 ("riscv: Construct an identity map in locore.S")
MFC after: 1 week
Signed-off-by: Rick Richard <rick at sloservers.com>
inotify: Open target the directory when adding a watch
When an application uses inotify to watch a directory,
vn_inotify_add_watch() reads the directory entries and does a name
lookup so as to induce the filesystem to create namecache entries.
Some filesystems expect the directory to be opened before VOP_READDIR
can be called, so do that.
PR: 299239
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60782
(cherry picked from commit de80428118101624aaeaae02d59665d1027ff10e)
bhyve: fix integer overflow in qXfer packet parser
doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data(). Rewrite the comparison to avoid the addition.
Reviewed by: markj
Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60847
(cherry picked from commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234)
amd64/vmm: Don't advertise support for performance counters
vmm doesn't implement them, and after commit 2272fac218a8
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72f62c91cb27dd644a62d6a6f5bd56ba)
tcp: Preserve borrowed ICMPv6 error mbufs
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <andrew at calif.io>
[5 lines not shown]
net: Fix handling of sockaddrs in the SIOC{ADD,DEL}MULTI handlers
The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list. The
link-layer address is passed using the ifr_addr field of the request
structure.
struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address). Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.
Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.
Also validate the sockaddr_dl internal length fields, suggested by zlei.
[9 lines not shown]
sysvshm: Fix locking in shm_prison_set()
We were not acquiring the global sysvshm lock when handling cleanup of
sysvshm segments. Acquire the lock in shm_prison_cleanup() instead, to
be consistent with the sysv semaphore code.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60030
(cherry picked from commit 546d15061962a8c45c779210969015e30124fe8d)
ipfilter: fix inverted range check on the lookup iterator unit
ipf_lookup_iterate() validates iter.ili_unit with
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)
or alternatively,
if (iter.ili_unit < -1 && iter.ili_unit > 7)
ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <andrew at calif.io>
Reviewed by: markj
MFC after: 1 week
[3 lines not shown]
jail: Fix a race in prison_deref()
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f)
