linux: Add STF type and convert some if_type to ARPHRD
Convert IFT_BRIDGE and IFT_L2VLAN to ARPHRD_ETHER, and IFT_LOOP
to ARPHRD_LOOPBACK in linux netlink.
Also, add ARPHRD_SIT and convert IFT_STF to it.
Reviewed by: kfv
Differential Revision: https://reviews.freebsd.org/D58573
nhop.9: Rewrite relics of rtentry.9 into nhop.9
Parts of rtentry.9 information such as information related to
the nexthop is outdated.
Remove those relics and add the new design into separate
manual instead.
Reviewed by: bcr
Discussed with: ziaee
Differential Revision: https://reviews.freebsd.org/D58564
gve: Implement AQ batching for queue creation and destruction
Currently, the FreeBSD driver configures and destroys queues
sequentially by issuing individual Admin Queue (AQ) commands.
During queue teardown (e.g., interface reset), disabling queues
one by one leaves the device in a partially configured state.
Because the device does not yet know that the driver is in the
process of fully unconfiguring all queues, this intermediate
state can trigger transient error logs (such as when queue 0 is
disabled while other queues are still active).
Modify the driver to use Admin Queue batching for both the
creation and destruction of TX and RX queues. Commands are now
queued and kicked together, ensuring the queue configuration changes
are applied atomically and preventing transient errors from being logged.
Signed-off-by: Sujithra Periasamy <sujithra at google.com>
[6 lines not shown]
ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
(cherry picked from commit 3c8f8432b6f653128016c6aaf826e1efb7ee1cec)
epoch: Fix epoch_drain_callbacks()
This function is supposed to wait until all pending callbacks have been
executed. This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.
The implementation schedules a callback on each CPU and waits for them
all to run. This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed. This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.
Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order. However,
[24 lines not shown]
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
(cherry picked from commit 196874ce2e97e3e6425493b1d501e716b356bc36)
in_mcast: Fix uninitialized variable usage in inm_merge()
When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.
To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.
All of the above applies to the v6 case.
Reported by: Daniel Birtwhistle
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
proc: Copy the p_reapsubtree field explicitly during fork
p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization. However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status. This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.
Close the race: explicitly copy the field under the proctree lock during
fork.
Reported by: syzkaller
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58482
(cherry picked from commit 8616b7dc3850758eb39a5b63f41f56c05403380b)
tests: Fix build if TIOCSTI is not defined
Some downstream projects (e.g. ElectroBSD) have removed the TIOCSTI
We already have some components (such as mail and tcsh) that build
without TIOCSTI defined. This is (existing portability support in those
projects.
Simplify things for downstreams by extending this approach to this
additional TIOCSTI user.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D50614
(cherry picked from commit 52a2b4bc5da21d7a54cb16b9450196244b59b8c0)
(cherry picked from commit b1bb3aa65cc9d720f54dba009565e0d1d0419323)
LinuxKPI: 802.11: deal with wdev list, and misc
Fill in more (lvif) wdev details and add it to the list under the wiphy
struct so that iterators at least work and find the (one) device.
This is needed for the upcoming espwl(4) driver.
misc: add WPI-SMS4 to the list of cipher suits (we won't support it but
at least print the name).
MFC after: 3 days
LinuxKPI: 802.11: add more defines, structures, ...
Add more defines, structures, sort struct field types, add inline
functions (partially implemented) all needed for the upcoming
espwl(4) wireless driver.
MFC after: 3 days
shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks
This is ABI-breaking change that could be considered as the bug fix.
Requested by: David Timber <dxdt at dev.snart.me>
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
Relnotes: yes
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58942
tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts
37bd69d43c7 gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>. Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS. Both headers are self-contained; stage them alongside
stdckdint.h.
Fixes: 37bd69d43c7 ("sys: Add sys/ckdint.h")
Reviewed by: rpaulo, markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58943
vmm: Emulate CPUID leaf 1Fh for guests
On an Intel N150 host a guest started with sockets=1, cores=4,
threads=1 reports "1 package(s) x 2 core(s) x 2 hardware threads"
instead of four cores with one thread each, while the host itself
detects its topology correctly.
A FreeBSD guest picks the topology leaf in topo_probe_intel_0xb(),
sys/x86/x86/mp_x86.c, and since 6badb512a94d it prefers leaf 1Fh over
leaf 0Bh whenever cpu_high is 1Fh or higher. bhyve passes leaf 0
through unmodified, so the guest sees the maximum basic leaf of the
host, which is 1Fh or above on Alder Lake and newer, and takes that
path. x86_emulate_cpuid(), sys/amd64/vmm/x86.c, derives the topology
from vm_get_topology() for leaves 1, 4 and 0Bh, but has no case for
1Fh, so the request ends up in default_leaf and the host values are
returned verbatim. The guest therefore enumerates the topology of the
host: with an SMT shift of 1 in the host's leaf 1Fh and four vCPUs this
gives core_id_shift = 1 and pkg_id_shift = 2, which is exactly the
reported 2 cores x 2 threads. Hosts whose maximum basic leaf is below
[13 lines not shown]
libc: Restore prior C23 include guards
To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them. This is to close off whole class of possible breakage,
rather than patching it case by case.
Reported by: dim
Reviewed by: dim, dteske, fuz
Approved by: dim, dteske (mentor), fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58911
contrib/netbsd-tests: lib/libc/c063: sync with NetBSD
This change syncs the lib/libc/c063 NetBSD tests with FreeBSD. This does
two things:
- Addresses bogus tautologically true assertions flagged by clang and gcc
with ATF 0.22+ [1].
- Brings in some new test coverage.
Obtained from: NetBSD (date tag: `20260818UTC`)
MFC after: 2 weeks
1. https://github.com/freebsd/atf/pull/72
libexpat: update AUTHORS section of libbsdxml.3
The eXpat project has changed maintainers since this section was written
in 2002. Update it to reflect reality.
Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by: bcr
Differential Revision: https://reviews.freebsd.org/D58835
(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
net80211: migrate the ioctl API to a 128 bit specific API + use key API
* Begin migrating the ioctl code to use the key management APIs.
Not all of it has been migrated (notably the WEP API hasn't.)
* Take special care to copy the TKIP MIC in and out correctly.
* Note that some of the defines used as sizes are actually the ioctl
sizes, they'll need to be fixed before I push this into a review.
* Document this current API as a specific 128 bit key + 128 bit
TKIP MIC API.
The goal here is to solidify this stuff as the 128 bit ioctl API
and not change it, even if net80211 will eventually grow 256 and
384 bit key support.
Notably the TKIP stuff - the driver_bsd.c code puts the TKIP after
the normal key contents, whereas the net80211 code puts the TKIP
[6 lines not shown]
net80211: add key get/set methods
Introduce net80211 key get and set methods with appropriate
bounds checking and buffer zero'ing.
Differential Revision: https://reviews.freebsd.org/D58705
net80211: fix WEP transmit
This was broken in 2022 with a security fix (61605e0ae5d8f) which
disallowed defaulting to the default TX key if there's no unicast
key. Unfortunately this path was also used by WEP transmit.
To fix it, add a separate check which ensures that WEP is configured
(authtype OPEN, privacy enabled) - then also check if the default TX
key is set and that said key is a WEP key.
Fixes: 61605e0ae5d8f
Locally tested:
* rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured
Differential Revision: https://reviews.freebsd.org/D58854
libexpat: update AUTHORS section of libbsdxml.3
The eXpat project has changed maintainers since this section was written
in 2002. Update it to reflect reality.
Discussed with: Sebastian Pipping <sebastian at pipping.org>
Reviewed by: bcr
Differential Revision: https://reviews.freebsd.org/D58835
(cherry picked from commit 5e6c894510fc66c18d69164d591184a2d23b16e5)
linux: add dma-buf and sync_file ioctl handlers
drm-kmod already implements the dma-buf and sync_file ioctls, but
linux_ioctl.c had no handler group for the 'b' and '>' magic bytes, so
the requests never reached it and returned EINVAL from
linux_ioctl_fallback(). Route the commands drm-kmod services to
sys_ioctl(), translating the direction bits with SETDIR(); everything
else still falls through to the fallback and keeps getting named in
dmesg.
Approved-by: adrian
Accepted-by: dumbbell
Signed-off-by: Nick Price <nprice at FreeBSD.org>
(cherry picked from commit d6a7e89504af337413af39fd121026f512c0a35d)
bcm2835_audio: Comment out vchi_service_release()
bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.
In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.
vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.
PR: 297187
MFC after: 2 weeks
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58921
