sys: centralize SV_* flags definitions for several FreeBSD ABIs
The omitted ABI is compat32 on arm64, which lacks SV_ASLR.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
ssh: use defaultkey sentinel for ML-DSA-44 default host key
servconf_add_hostkey() compares its file argument to defaultkey by
pointer to skip an unreadable default key; the ML-DSA-44 entry passed
the "[default]" literal, so the skip (and the "No host key files found"
fallback) never applied to it.
MFC after: 1 week
Reviewed by: emaste
Fixes: bb5c77e9d281 ("OpenSSH: Update to 10.4p1")
Differential Revision: https://reviews.freebsd.org/D60922
ObsoleteFiles.inc: Add moved certificates
These two moved from trusted to untrusted.
Fixes: 21ac4761428c ("ObsoleteFiles.inc: Add dropped certificates")
caroot: Regenerate
Regenerate using certificate data from NSS 3.131.1.
Upstream dropped emSign_ECC_Root_CA_-_G3.pem entirely; we deliberately
move it to untrusted instead to block its reintroduction through e.g.
an outdated copy of security/ca_root_nss.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60906
arm64: enable ossl accelerated AES-GCM on arm64
Connect the baseline OpenSSL ARMv8 fused AES-GCM kernels to the OCF
ossl driver. Advertise the algorithm only when the system-wide capability set
includes both AES and PMULL.
Note that get_kernel_reg() is used to detect features such as PMULL
because the ossl device attaches before arm64 populates elf_hwcap when
ossl is built into the kernel or pre-loaded at boot.
Prefer OSSL over armv8crypto for AES-GCM sessions while retaining
armv8crypto as a fallback.
This provides about a 50% speedup for a Netflix ktls workload on a small
neoverse N1 board.
Reviewed by: markj
Constructive review feedback from: andrew, ngie
Differential Revision: https://reviews.freebsd.org/D60097
Sponsored by: Netflix
if_media: Add 100BASE-T1 and 1000BASE-T1 media types
100BASE-T1 (IEEE 802.3bw) and 1000BASE-T1 (IEEE 802.3bp) are Single-Pair
Ethernet (SPE) standards intended for use in automotive and industrial
applications.
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60864
arm64: Fix EFI runtime mappings with 16K pages
Map complete EFI descriptor ranges at the kernel page granularity
and merge compatible entries when 4K EFI regions share a kernel page.
Preserve execution when any sharing region requires it and reject
conflicting mapping attributes without panicing.
This gets my small N1 booting with 16K pages.
Reviewed by: chs, imp
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60749
stand: userboot: improve userdisk error handling
Currently, userdisk_init() iterates through disks and
checks whether DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls
are available for the device. If either ioctl fails, userdisk_init()
returns ENXIO with ud_info only partially initialized.
devinit() records the failure, but loader_main() ignores
devinit()'s return value, so later code may access an
uninitialized entry.
In certain cases this code can still boot from a disk even if
userdisk_init() returns ENXIO, for example, when the first of
two disks is valid and the second errors out.
To address this issue while not breaking the current behavior, do
the following:
- Zero-initialize the userdisk_info array and use a zero media size
to mark disks that do not support the ioctls mentioned above or
[16 lines not shown]
diff: diff regular files when `-q` is specified again
c30a321a61ce accidentally modified the code paths when diffing regular
files to not diff them if `-q` was specified. Call `diffreg(..)` again,
regardless of whether or not `-q` was specified to restore the
functionality pre-c30a321a61ce, while only printing out the result to
the console if `-q` is not specified.
This change unbreaks diff so 2 files which differ are reported again via
the exit code when with `-q` is specified.
MFC after: 3 days
PR: 299643
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D60910
Fixes: c30a321a61ce ("diff: support -qq to output absolutely nothing")
devfs: make persistent controlling terminal an ABI property
Linux leaves the session's controlling terminal in place after the
last file descriptor on the slave is closed, so a later open of
/dev/tty succeeds. FreeBSD drops the session vnode reference on that
close. /dev/tty then fails, which breaks Linux programs such as xterm
that close the pty slave during startup and expect /dev/tty to keep
working.
When the closer is a Linux process, leave the session reference in
place. Still pass FLASTCLOSE to the driver so the master sees hangup.
Native close behavior is unchanged.
Add the SV_PERSISTENT_CTTY sysentvec flag for ABIs that retain the
controlling terminal after the last slave descriptor is closed. This
keeps the devfs behavior ABI-agnostic and allows other ABIs to request
the same semantics if needed. Use the flag in devfs_close().
Reviewed by: kib
[2 lines not shown]
termios.4: clarify the behavior on the last close of controlling terminal
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60701
powerpc: powerpc_ipi_handler(): Stop first, preempt last
Preemption should happen last so that other IPIs have a chance to be
executed in due course, in particular hardclockintr(). So, move
handling of IPI_PREEMPT at the end.
An IPI_STOP/IPI_STOP_HARD request should be processed immediately to
avoid risks that further processing changes the system state on panic,
or worse itself causes another panic on corrupted kernel state.
While here, move IPI_AST handling just before IPI_PREEMPT. We currently
do not need to do anything for it, but if we were to, it is likely that
would have to happen after other IPIs but IPI_PREEMPT.
Reviewed by: jhibbits
Fixes: 9d5a22b928c2 ("MFp4: SMP support")
Fixes: 12640815f815 ("MFp4: SMP support")
Fixes: 7ed09a6778d3 ("powerpc: Rework IPI message processing")
MFC after: 1 week
[2 lines not shown]
x86: ipi_bitmap_handler(): Account for IPIs correctly on COUNT_IPIS
A preemption could occur before the updates to the initial CPU's IPI
counters, leading to a potential non-atomic updates of these counters
from another CPU.
Reviewed by: kib
Fixes: ff326a187907 ("x86: Restore the critical section (...)")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60862
x86: ipi_bitmap_handler(): Preempt last, reduce critical section
Preemption should happen last so that other IPIs have a chance to be
executed in due course, in particular hardclockintr(). So, move
handling of IPI_PREEMPT at the end.
Reduce the critical section to be in force only around hardclockintr(),
which needs it to execute entirely without preemption (because of code
it calls that can enter a critical section; interrupts are already
disabled in this handler, as usual).
The critical_exit() following hardclockintr() may cause preemption if
due. If that happens, there is no need to preempt again on IPI_PREEMPT,
so make sure sched_preempt() is not called in this case.
This fixes inadvertent removal of the optimization that sched_preempt()
should be called outside of a critical section to perform an immediate
context switch in the case of IPI_HARDCLOCK and IPI_PREEMPT being
handled at the same time.
[10 lines not shown]
stand: userboot: improve userdisk error handling
Currently, userdisk_init() iterates through disks and
checks whether DIOCGSECTORSIZE and DIOCGMEDIASIZE ioctls
are available for the device. If either ioctl fails, userdisk_init()
returns ENXIO with ud_info only partially initialized.
devinit() records the failure, but loader_main() ignores
devinit()'s return value, so later code may access an
uninitialized entry.
In certain cases this code can still boot from a disk even if
userdisk_init() returns ENXIO, for example, when the first of
two disks is valid and the second errors out.
To address this issue while not breaking the current behavior, do
the following:
- Zero-initialize the userdisk_info array and use a zero media size
to mark disks that do not support the ioctls mentioned above or
[16 lines not shown]
hv_kvp: Fix some bugs and nits
- Use pending_mutex to synchronize several state flags. In particular,
ensure that two threads can't race to open the device file at the same
time.[1]
- Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a
one-byte OOB read if the caller supplied a large enough read buffer.[2]
- Change the device permissions to 0600: hv_kvp_dev_daemon_read()
returns an error until the owning process registers itself with a
write, so there's no sense in providing read-only access.
- Use bool instead of boolean_t.
- Don't return negative error numbers to userspace.
- Call seldrain() when closing the device.
Reported by: pixelpop [1][2]
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60387
amd64/vmm: Port vlapic interface changes from illumos (duplicate)
This is a port of the bits related to vlapic-enablement of the following
bhyve improvement from illumos:
14598 bhyve vlapic should handle APICBASE changes
https://www.illumos.org/issues/14598
A LAPIC can be enabled/disabled in two ways:
- by the global-enable bit in the APICBASE MSR
- by the software-enable bit in the APIC's SVR register
This change allows distinguishing between both forms of enablement where
that matters. The more involved changes to allow guests to modify the
APICBASE MSR are not included at this time.
Reviewed by: corvink, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D56347
wg: fix the LINT-NOIP build
We don't have anything to tunnel without INET or INET6, so just smack
it with the same config(5) hammer that ovpn uses and exclude it from
such builds.
Reported by: mjg
Reviewed by: emaste, markj
Differential Revision: https://reviews.freebsd.org/D60896
pf: first-match-wins for nat rules, even in anchors
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
(cherry picked from commit b5219c068fbc133dde91d5cf48423e34ce27bd4f)
hastd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D60729
auditdistd: Use void pointers for opaque data
Use void, not char, for pointers to opaque data in our send and receive
functions.
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D60728
pf: Keep every chunk of a table that a ruleset defines
libpfctl sends a table definition in chunks of 256 addresses, each as
its own PFNL_CMD_INA_DEFINE. The kernel treated every chunk as a new
definition and replaced the shadow table, so only the last chunk
survived.
Mark the chunks after the first with PF_ID_APPEND and have the kernel
add them to the shadow table in progress. A request without the
attribute still replaces the shadow; one with it and no definition in
progress fails with EINVAL. Old kernels ignore the attribute, so both
halves are needed; the ioctl sends all addresses at once and is not
affected. Mask the flags userland passes to PFR_FLAG_ALLMASK, as
PFR_FLAG_APPEND is kernel-internal.
Add a test that defines a table of 1,000 addresses, also in an anchor.
Reviewed by: kp
Fixes: 219ce3063840 ("pf: convert DIOCRINADEFINE to netlink")
[2 lines not shown]
rk_spi: Do not change the clock with the driver lock held
The clock framework can sleep, it takes the clock topology sx lock. Calling
clk_set_freq() and clk_get_freq() from rk_spi_hw_setup() with the driver
mutex held triggers a witness warning about a sleepable lock acquired after
a non-sleepable one, on the first transfer that raises the clock.
Set the clock in a new function that is called before taking the lock, and
only keep the register setup under the lock.
