FreeBSD/src ad9b4ccstand/efi/loader/arch/i386 setup.c amd64_tramp.S, sys/dev/gpio acpi_gpiobus.c

update email address in my copyright notices
DeltaFile
+1-1sys/dev/gpio/acpi_gpiobus.c
+1-1stand/efi/loader/arch/i386/setup.c
+1-1stand/efi/loader/arch/i386/amd64_tramp.S
+3-33 files

FreeBSD/src bf05236sys/netpfil/pf pf.h pf_syncookies.c

pf: Send syncookies from the receiving thread

pf sends outbound packets by offloading them to a single per-vnet SWI handler
through the `V_pf_sendqueue` mbuf queue. A large DDoS attack may overwhelm
that per-vnet queue with syncookie packets and cause contention in the SWI
handler that negatively affects other pf operations.

Fix this by sending the initial syncookie challenge from the context
of the receiving thread. This avoids the syncookie-induced contention on
the `pf_intr` mbuf queue.

Sponsored by:   Klara, Inc.
Sponsored by:   Entersekt
MFC after:      3 weeks
Reviewed by:    kp
Differential Revision:  https://reviews.freebsd.org/D59068
DeltaFile
+39-28sys/netpfil/pf/pf.c
+29-3sys/netpfil/pf/pf_syncookies.c
+8-1sys/netpfil/pf/pf.h
+76-323 files

FreeBSD/src 1ac08a4lib/libsys ptrace.2 pdfork.2

pdfork.2: document cap mode, namely pdopenpid(2) and pdptrace(2) errors

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+33-0lib/libsys/pdfork.2
+10-0lib/libsys/ptrace.2
+43-02 files

FreeBSD/src ddf62c8tests/sys/kern procdesc.c

sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode

Adjust test to check for ECAPMODE using grandchild instead of child.
Childrens can be opened even in cap mode.  Add test for the later.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+34-4tests/sys/kern/procdesc.c
+34-41 files

FreeBSD/src 1d20ebbsys/compat/freebsd32 freebsd32_sysent.c, sys/kern init_sysent.c

Regen
DeltaFile
+3-3sys/kern/init_sysent.c
+3-3sys/compat/freebsd32/freebsd32_sysent.c
+6-62 files

FreeBSD/src 7006cb7sys/compat/freebsd32 freebsd32_misc.c, sys/kern syscalls.master sys_process.c

pdptrace(2): allow debugging in capability mode

The pdopenpid(2) syscall is allowed in capability mode. Add the chicken
switch security.bsd.ptrace_in_cap_mode, which disables it without
reboot, if needed.

The descriptor passed to pdptrace(2) must have the CAP_PTRACE
capability enabled. This capability is not enabled by default by
pdfork()/pdopenpid(), and the calls do not return a procdesc suitable
for debugging. The opening code must prepare for debugging in advance by
passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid().

For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current
thread and process in cap mode as well.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+22-4sys/kern/sys_process.c
+2-2sys/kern/syscalls.master
+0-3sys/compat/freebsd32/freebsd32_misc.c
+24-93 files

FreeBSD/src 73c92a9sys/kern syscalls.master sys_procdesc.c

pdopenpid(2): allow in capability mode with restrictions

The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.

The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+6-0sys/kern/sys_procdesc.c
+1-1sys/kern/syscalls.master
+7-12 files

FreeBSD/src 68d4b31sys/kern sys_process.c kern_prot.c, sys/sys ptrace.h proc.h

kern: add p_canopen()

The function defines the policy for allowing to open a pid.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58989
DeltaFile
+26-2sys/kern/kern_prot.c
+5-0sys/kern/sys_process.c
+1-0sys/sys/ptrace.h
+1-0sys/sys/proc.h
+33-24 files

FreeBSD/src 6b9ef5dsys/compat/freebsd32 freebsd32_misc.c, sys/kern sys_process.c

ptrace(2): add PT_GET_ABI_NAME request

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59113
DeltaFile
+19-1sys/kern/sys_process.c
+12-0sys/compat/freebsd32/freebsd32_misc.c
+1-0sys/sys/ptrace.h
+32-13 files

FreeBSD/src 3dfd63blib/libsys ptrace.2

ptrace.2: document PT_GET_ABI_NAME

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59113
DeltaFile
+11-0lib/libsys/ptrace.2
+11-01 files

FreeBSD/src 5f5910btests/sys/kern pdwait.c

tests/sys/kern/pdwait: adjust test for the addition of CAP_PTRACE

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-1tests/sys/kern/pdwait.c
+1-11 files

FreeBSD/src 4563360lib/libsys ptrace.2 pdfork.2, share/man/man4 rights.4

pdfork.2, rights.4: document pdptrace(2), CAP_PTRACE, and pdfork(PD_PTRACE_CAP)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+48-3lib/libsys/pdfork.2
+3-0share/man/man4/rights.4
+1-0lib/libsys/ptrace.2
+52-33 files

FreeBSD/src 9cea869sys/compat/freebsd32 freebsd32_misc.c, sys/kern sys_process.c

ptrace: split sys_ptrace()/freebsd32_ptrace()

The code to handle copyin and copyout of the structured parameters is
moved into the helpers.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+65-64sys/compat/freebsd32/freebsd32_misc.c
+61-53sys/kern/sys_process.c
+2-0sys/sys/ptrace.h
+128-1173 files

FreeBSD/src 16ff23dsys/compat/freebsd32 freebsd32_proto.h freebsd32_systrace_args.c, sys/kern systrace_args.c

Regen
DeltaFile
+38-0sys/kern/systrace_args.c
+38-0sys/compat/freebsd32/freebsd32_systrace_args.c
+9-0sys/sys/sysproto.h
+9-0sys/compat/freebsd32/freebsd32_proto.h
+2-1sys/sys/syscall.mk
+2-1sys/sys/syscall.h
+98-27 files not shown
+108-313 files

FreeBSD/src f8c0616sys/compat/freebsd32 freebsd32_misc.c, sys/kern syscalls.master sys_process.c

Add pdptrace(2)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+61-22sys/kern/sys_process.c
+19-5sys/compat/freebsd32/freebsd32_misc.c
+9-0sys/kern/syscalls.master
+2-2sys/sys/ptrace.h
+91-294 files

FreeBSD/src 6d17a04lib/libsys Symbol.sys.map, sys/sys procdesc.h

lib/libsys: export pdptrace(2)

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-0sys/sys/procdesc.h
+1-0lib/libsys/Symbol.sys.map
+2-02 files

FreeBSD/src b2f300esys/bsm audit_kevents.h

sys/bsm/audit_kevents.h: add AUE_PDPTRACE

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+1-0sys/bsm/audit_kevents.h
+1-01 files

FreeBSD/src 8c911d9sys/kern kern_descrip.c, sys/sys filedesc.h

kern/kern_descrip.c: export filecaps_fill()

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58094
DeltaFile
+1-1sys/kern/kern_descrip.c
+1-0sys/sys/filedesc.h
+2-12 files

FreeBSD/src 5f82dd8sys/kern subr_capability.c, sys/sys caprights.h capsicum.h

capsicum: add CAP_PTRACE

The capability will allow the ptrace(2) on the procdesc.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+5-3sys/sys/capsicum.h
+1-0sys/sys/caprights.h
+1-0sys/kern/subr_capability.c
+7-33 files

FreeBSD/src e8c3132sys/kern sys_procdesc.c kern_fork.c, sys/sys procdesc.h

pdfork(2): add PD_PTRACE_CAP flag

If the flag is not specified, the process descriptor returned by either
pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58586
DeltaFile
+14-0sys/kern/kern_fork.c
+6-1sys/kern/sys_procdesc.c
+4-2sys/sys/procdesc.h
+24-33 files

FreeBSD/src 44b8321sys/kern uipc_usrreq.c

unix: Fix a socket leak

When connecting a unix domain stream socket, we
1. look up the peer (listening) socket,
2. allocate a new socket
3. add the new socket to the listening socket's queue

Prior to commit 26147c51546e, this sequence of operations was
synchronized by a pool mutex, also acquired in uipc_close().

After commit 26147c51546e, we drop the vnode pool lock immediately after
finding the peer socket via a filesystem lookup.  This creates a window
where it's possible for a connection to add a new socket to the
listening queue after the listening queue has been aborted.

Fix the race by restoring the old behaviour of holding the pool lock
across the solisten_enqueue() call.  This is a bit ugly since we need to
pass a mutex lock and a vnode through a couple of layers, but it seems
like a low-risk solution.  Alternately we could add some flag to the

    [8 lines not shown]
DeltaFile
+70-38sys/kern/uipc_usrreq.c
+70-381 files

FreeBSD/src 2c68ad4lib/libutil mntopts.c, sbin/mount_nullfs mount_nullfs.c mount_nullfs.8

nullfs: Allow VSOCK to be mounted on top of another VSOCK

In the world of containers, mounting a unix(4) socket is a common
practice to allow communication between processes within containers.
For example, both Podman and Docker can expose a unix(4) socket,
and that same unix(4) socket can be mounted as a file accessible
to a process inside a container, allowing that application to control
Podman or Docker. Another example is PHP-FPM with NGINX, where,
instead of using TCP/IP for communication between containers, a
unix(4) socket is sufficient.

However, nullfs(4) and all related components do not allow mounting
a VSOCK on top of another. The current workaround involves creating
the socket in a directory and mounting that directory. This is an
option, though it does not provide a good user experience compared
to directly mounting a VSOCK on top of another, since the application
that creates the socket may create other sockets in that directory,
and the user may not wish to share them, or, worse yet, applications
that create unix(4) sockets may not provide any authentication at

    [7 lines not shown]
DeltaFile
+3-3sys/kern/vfs_mount.c
+3-3sys/kern/vfs_cache.c
+3-3sbin/mount_nullfs/mount_nullfs.c
+4-2sbin/mount_nullfs/mount_nullfs.8
+1-1sys/fs/nullfs/null_vfsops.c
+1-1lib/libutil/mntopts.c
+15-136 files

FreeBSD/src 0c9cc6cshare/man/man4 nvme.4

nvme.4: Canonicalize SYNOPSIS

MFC after: 3 days

(cherry picked from commit b863d38437af11c18a88de656404af8cefa35e63)
DeltaFile
+38-18share/man/man4/nvme.4
+38-181 files

FreeBSD/src 3ccccd8sys/net iflib.c

iflib: Initialize the VFLR task unconditionally

The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths.  ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task.  Even with MSI-X, the admin
interrupt was established before the task was initialized.

Initialize it alongside the other private tasks.  The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.

Sponsored by:   BBOX.io

(cherry picked from commit b4208a67edc2eb7898a9ff2a6f3990c6852910e4)
DeltaFile
+1-1sys/net/iflib.c
+1-11 files

FreeBSD/src 375892cshare/man/man4 iflib.4, sys/net iflib.c

iflib: Add an admin task detach fail point

Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.

Use a bounded delay to keep the task active while detach enters the
taskqueue drain.  Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().

Reviewed by:    gallatin, kgalazka
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58720

(cherry picked from commit ac56d36007a5a1a01fe69df370f272060e852e0b)
DeltaFile
+19-0share/man/man4/iflib.4
+11-0sys/net/iflib.c
+30-02 files

FreeBSD/src 546e2c0sys/net iflib.c

iflib: Drain configuration tasks before interface detach

iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change.  This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.

Drain the entire private taskqueue before ether_ifdetach().  Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.

Differential Revision:  https://reviews.freebsd.org/D58452

Co-authored-by: Andrew Gallatin <gallatin at FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling at FreeBSD.org>
(cherry picked from commit ba353c8950d575f9d15b82c92658e660935fba25)
DeltaFile
+7-0sys/net/iflib.c
+7-01 files

FreeBSD/src 794a87cshare/man/man4 iflib.4, sys/net iflib.c

iflib: Add registration failure injection points

Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.

Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.

Reviewed by:    gallatin
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58722

(cherry picked from commit 90e7dbe5e2ca47baff4e4c6d9e892a0554eec4db)
DeltaFile
+46-0sys/net/iflib.c
+40-0share/man/man4/iflib.4
+86-02 files

FreeBSD/src ead5f24sys/dev/bnxt/bnxt_en if_bnxt.c, sys/dev/enetc if_enetc.c

iflib: Complete registration failure cleanup

Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.

Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.

Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.

A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and

    [30 lines not shown]
DeltaFile
+114-37sys/net/iflib.c
+7-3sys/dev/enetc/if_enetc.c
+7-2sys/dev/bnxt/bnxt_en/if_bnxt.c
+5-3sys/dev/vmware/vmxnet3/if_vmx.c
+3-2sys/dev/igc/if_igc.c
+2-0sys/dev/ixgbe/if_sriov.c
+138-471 files not shown
+139-477 files

FreeBSD/src 18c03a9sys/net iflib.c

iflib: drain admin task and fix teardown order on register failure

When IFDI_ATTACH_POST() fails (or netmap attach fails), iflib tears down with
ether_ifdetach(), taskqueue_free(ifc_tq), and IFDI_DETACH(). CTX_LOCK is still
held after ether_ifattach. ether_ifdetach() and taskqueue_drain(admin) must not
run under CTX_LOCK.

Teardown ordering (match iflib_device_deregister):

- Free the per-interface admin taskqueue after IFDI_DETACH / IFDI_QUEUES_FREE, not before.
- Drop IFNET_WLOCK() across IFDI_DETACH / IFDI_QUEUES_FREE so driver detach can sleep in
LinuxKPI workqueue drain, then retake IFNET_WLOCK() before iflib_free_intr_mem and fail_unlock.

Reviewed by:    gallatin, kgalazka, #iflib
Differential Revision: https://reviews.freebsd.org/D56316

(cherry picked from commit 439132310ae1f623f6c0a3dc241d0a34e98e040b)
DeltaFile
+18-1sys/net/iflib.c
+18-11 files

FreeBSD/src b5fa891sys/net iflib.c

iflib: Fix panic observed while doing sysctl -a with if_bnxt unload

Observed below kernel panic calltrace while performing sysctl -a
operation while unloading the if_bnxt driver,

Fatal trap 9: general protection fault while in kernel mode

KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02a7569940
vpanic() at vpanic+0x136/frame 0xfffffe02a7569a70
panic() at panic+0x43/frame 0xfffffe02a7569ad0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe02a7569af0
calltrap() at calltrap+0x8/frame 0xfffffe02a7569af0

trap 0x9, rip = 0xffffffff80c0b411, rsp = 0xfffffe02a7569bc0, rbp = 0xfffffe02a7569be0 ---
sysctl_handle_counter_u64() at sysctl_handle_counter_u64+0x61/frame 0xfffffe02a7569be0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02a7569c30
sysctl_root() at sysctl_root+0x22f/frame 0xfffffe02a7569cb0
userland_sysctl() at userland_sysctl+0x196/frame 0xfffffe02a7569d50

    [23 lines not shown]
DeltaFile
+23-20sys/net/iflib.c
+23-201 files