atf: refer to `common.mk` using `SRCTOP`
This helps make the dependent Makefile (and the values contained within)
easier to catch when upgrading atf in the future.
MFC after: 1 week
Change invalid reference LE_Set_Scan_Parameters to LE_Set_Scan_Param
hccontrol(8) lists "LE_Set_Scan_Parameters" as a subcommand, but it does
not work on recent releases. Use the LE_Set_Scan_Param instead as that
seems to be the new name according to the source file. Update the man
page accordingly.
PR: 300178
Event: Oslo Hackathon 2026
libthr: Robust tryjoin test
We cannot actually rely on a status (finish) before thr_exit. The
thread needs the kernel signal status=1 to userspace. Before that,
any tryjoin fails. The previous one works as we sleep 1 and should be
enough for normal case.
Reviewed by: kib, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60832
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[6 lines not shown]
Revert "bind_all_fibs: Disable bind_all_fibs by default"
This reverts commit 714433a6772b346723341735ef9547f672d9d2a3.
There were issues reported by markj
I will hold this commit until those are fixed.
rk_pinctrl: Fix the drive strength of the pins on the older SoCs
rk_pinctrl_parse_drive(), used for every Rockchip SoC but the RK3568, could
never succeed and so the drive-strength of the pins was never programmed:
- OF_getencprop() returns the size of the property, but the result was
tested against 0. A present property made the function return an error.
- The register offset of the matching table entry was never returned, so
the caller used whatever was left in reg (the pull register or an
uninitialized value). Fixing only the first problem would have written
the drive value in the wrong register.
- The table lookup skipped an entry only if both the bank and the subbank
differed, so an entry matching only one of them could be used.
Test the size of the property, skip an entry if either the bank or the
subbank differs and return the offset of the entry.
Tested on a Rock64 (RK3328) by clearing the drive strength of the gmac pins
in U-Boot: without this change they stay at 2mA, with it they get the 4mA
[8 lines not shown]
rk_pinctrl: Fix the drive strength of the RK3568 pins
The drive strength of the RK3568 pins was never programmed. The drive-strength
property was tested with OF_getencprop() == 0 but that function returns the
size of the property on success, so the branch was dead code and the pins kept
whatever the previous stage of the boot left in the registers.
The register layout was also wrong: each pin has an 8 bits wide drive field
and a register holds two pins, but the value was shifted by pin % 2 bits
instead of (pin % 2) * 8 and the mask only covered six bits. An odd pin would
have overwritten part of the field of the even pin next to it.
Test the size of the property, put the field at (pin % 2) * 8 and write the
whole 8 bits, like Linux does.
Tested on a Quartz64 Model A and on a NanoPi R5S.
Reviewed by: mmel
rtld: free heap donelists abandoned by the lookup restart
A symbol lookup done under the read-locked rtld_bind_lock is restarted
with the write lock when it needs to load filtees. The restart is done
by siglongjmp() from lock_restart_for_upgrade(), which skips
donelist_free() for the heap donelists of the unwound frames. Only
do_dlsym() freed one such donelist, tracked by SymLook.donelist_mem.
The donelist of symlook_default() called from _rtld_bind(), the
donelist of get_program_var_addr() called for dlopen(RTLD_TRACE), and
the donelists of nested symlook_obj_load_filtees() calls were leaked.
Link the heap donelists allocated under the read lock into the list
owned by RtldLockState, which also owns the sigjmp_buf, instead of the
symlook request.
Fixes: 1e370f038778 ("rtld: stop using unbound alloca()")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
bind_all_fibs: Disable bind_all_fibs by default
net.inet.{tcp,udp,raw}.bind_all_fibs was set to 1 for backward
compatibility. Set to 0 by default to drop them all unless an inpcb
bound to the same FIB exists.
While here, Add an UPDATING entry for behaviour change.
Relnotes: yes
Reviewed by: markj
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/73
memset.3: Fix .Fn usage and too many commas
Fix wrong usage of .Fn macro in paragraph for `memset_explicit' that
caused too many commas improperly emitted into rendered manual page.
Approved by: des
MFC after: 1 week
Makefile.inc1: Make bootstrap mandoc's bootstrap libz dependency conditional
We bootstrap libz unconditionally on macOS and Linux, and conditionally
on FreeBSD if pre-1600029 or DISK_IMAGE_TOOLS_BOOTSTRAP is enabled, but
if building on new enough -CURRENT without DISK_IMAGE_TOOLS_BOOTSTRAP
then libz is not bootstrapped and so this libz dependency does not
exist. Add the dependency whenever we are bootstrapping libz but not
otherwise, and do so without duplicating the condition.
Fixes: 1dbcc7ee92c4 ("Makefile.inc1: Make sure mandoc bootstrap tool depends on libz")
MFC after: 1 week
libc: Fix stack buffer overflow in cgetnext()
`cgetnext()` copies a capability record's name field into a fixed
1024 byte on-stack buffer (`nbuf[BSIZE]`) one character at a time,
but never checks that the write pointer stays within the buffer.
Therefore, a record name that is longer than `BSIZE` (either on a
single line, or accumulated across several `\`-continued lines as
the pointer is not reset amidst continuation) writes past the end
of `nbuf` and smashes the stack.
The name field is read directly from the capability file, so any
consumer of `cgetnext()`/`cgetfirst()` that processes an untrusted
`termcap(5)`- or `printcap(5)`-style database (e.g. `cap_mkdb(1)`,
`lpr(1)`, or any third-party caller) can be exposed and hence made
to corrupt the stack.
Reviewed by: fuz, dteske
Approved by: fuz (mentor), dteske (mentor)
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2309
