pci: restore resizable BAR sizes in pci_cfg_restore()
After a device reset, resizable BARs return to their default sizes.
Restore them to the sizes they had prior to reset.
Reviewed by: imp, adrian
Differential Revision: https://reviews.freebsd.org/D61110
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
ppp: bound Predictor-1 decompression output
Pred1Input() decompressed CCP data into a MAX_MRU+2 mbuf with no limit
on the output, so a peer could expand a short compressed frame (up to
8:1) past the buffer and overflow adjacent heap. An input length below
4 also drove decompress() with a negative length.
Reject out-of-range input lengths and stop decompression at the
destination buffer size.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D61011
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
ppp: drop config packets whose options overrun the packet
fsm_readopt() advanced the decode cursor by the option length without
checking it against the end of the packet. A crafted LCP/CCP/IPCP
option could then make the Config-Reject/Nak echo copy past the
received packet into adjacent heap, disclosing heap bytes to the peer
before authentication.
Check the option framing once in fsm_Input() and drop the packet before
decoding per RFC1661
Reviewed by: adrian, markj
Differential Revision: https://reviews.freebsd.org/D61008
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
linux: do not truncate the listxattr() size
listxattr() sized its buffer with min(), which truncates the 64-bit
size to 32 bits, so a size of 2^32 + k allocated k bytes while the
copy-out guard used the full size. The walk then read record lengths
past the buffer and copied kernel heap out to the caller, and could
panic the kernel. Any user can reach it through a user.* attribute on
a file it owns.
Use MIN(), and fail with EIO if a record runs past the data returned.
Reviewed by: adrian, markj
Approved by: adrian (mentor)
Differential Revision: https://reviews.freebsd.org/D61006
Signed-off-by: Nick Price <nprice at FreeBSD.org>
xdr: Limit xdr_wrapstring
The previous commit (re)introduced the possibility that a malicious or
corrupt message can cause the receiver to allocate a very large amount
of memory before realizing that the message is much shorter than
claimed. Revert the change to xdr_wrapstring() to avoid this.
Fixes: d2018cedb414 ("xdr: Fix xdr_string")
Reported by: bjk@
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60898
iSCSI: Fast and per-session timeouts
Support per-session configurable ping (SCSI NOP) and login timeouts
similar to what is supported in the Linux iSCSI initiator configuration file.
Reduce iscsi timer granularity to 0.1 sec.
For backwards compatibility, when all timers are selected on integer numbers,
all status messages are unchanged. If the higher granularity is used, the
log messages include sub-second granularity.
The sysctl(3) interface has changed from pure int to string, in order to
support fractional seconds in a human-readable, dotted notation.
Reviewed By: #netapp, #manpages, jhb, pauamma_chezdork.com, siderop1_netapp.com
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D32540
asmc: move the sysctl registration loops next to their tables
asmc_attach() and asmc_init() had 4 description tables inline,
several hundred lines from the tables they index. Wrapped each loop in a
function defined after its table.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61293
asmc: make the raw key debug state unconditional
The ASMC_DEBUG block was in mid-struct, so struct asmc_softc had a different
layout in translation units that missed opt_asmc.h.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61292
asmc: move the backlight control level into the softc
light_control was a file-scope static shared by resume, the light.control
sysctl and the backlight method. Per-device state belongs in the softc.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61291
asmc: scan every sensor range through one helper
asmc_detect_sensors hand-rolled the temperature and light scans as copies
of asmc_scan_sensor_range(). Give the helper a match predicate and route
all five ranges through it.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61289
asmc: table-drive the system state and board identity sysctls
The dev.asmc.n.system subtree was seven copies of "probe the key, then
register", and the auto_poweron/sil pair in asmc_init two more. Drive both
from tables.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61288
asmc: collapse the SMS axis and light sensor sysctl handlers
asmc_mb_sysctl_sms_{x,y,z} differed only in which SMS key they read, and
asmc_mbp_sysctl_light_{left,right} only in which light key. One handler
each, selecting from a table through arg2.
No functional change.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61287
asmc: collapse the per-fan speed sysctl handlers
The five fan speed handlers differed only in which key they read and
whether they wrote back. Select the key from a table through arg2, the way
asmc_sensor_sysctl() already packs a type and an index, and keep one
handler. A second table drives the seven registration calls.
No functional change,
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61286
asmc: share the getinfo and getbyindex PIO transactions
asmc_key_getinfo() and asmc_key_dump_by_index() both ran the command 0x13
transaction, the latter after a command 0x12. Put each behind a helper that
assumes the caller holds sc_mtx, and fold the shared response decode into
asmc_keyinfo_decode().
The index bytes are now derived inside the helper, so they are recomputed
per retry. Same value all the time.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61285
asmc: rebuild asmc_key_dump on the by-index helper
asmc_key_dump() branched on the backend, but asmc_key_dump_by_index()
already dispatches on it, so the PIO arm open-coded a transaction it could
have called. Keep one printer for both.
Output is unchanged. The PIO arm checked asmc_key_read()'s return value
instead of printing a zeroed buffer; the merged printer keeps that. Its
retry exhaustion message is gone, which asmc_dumpall() cannot observe.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61284
asmc: factor out the PIO data port byte loops
Reuse existing pattern and evict magic numbers
No functional change: the port access sequence and the per-caller retry
and error reporting behaviour are unchanged.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D61283
acpi_apple: Fix sleep with non-sleepable lock held
Apple platform attach and detach functions are serialized with ordinary
mutex and contain code that executes malloc() that leads to INVARIANTS
warnings. Fix it through replacement of mutex with sx lock.
Fixes: d7d237ce731f ("acpi_apple: Apple platform ACPI driver")
Reviewed by: seuros
Differential Revision: https://reviews.freebsd.org/D61295
sys/kobj.h: Convert macro DEFINE_CLASS to designated initializers
So that it is less error prone when adding new struct members or
refactoring in future.
No functional change intended.
Reviewed by: kib, imp
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D61276
sdiob: copy vendor/device IDs from card common CIS
Copy both the vendor and device IDs from the card common CIS if they are
absent in a function.
These are optional according to the spec. [1]
[1] Part E1 SDIO Simplified Specification §16.6
MFC after: 3 days
Reviewed by: kibab, imp, adrian
Differential Revision: https://reviews.freebsd.org/D60988
(cherry picked from commit c91dfb47e0bcdf682f7f152624e03747787c6ea3)
sdiob: copy vendor/device IDs from card common CIS
Copy both the vendor and device IDs from the card common CIS if they are
absent in a function.
These are optional according to the spec. [1]
[1] Part E1 SDIO Simplified Specification §16.6
MFC after: 3 days
Reviewed by: kibab, imp, adrian
Differential Revision: https://reviews.freebsd.org/D60988
(cherry picked from commit c91dfb47e0bcdf682f7f152624e03747787c6ea3)
TCP RACK: fix RSM computation for TCP fast open
When spitting an RSM containing the SYN and data, honor the
sequence number used by the SYN flag when computing the offset
in the socket buffer.
PR: 297006
Reviewed by: rrs, Peter Lei
MFC after: 3 days
MFC to: stable/15
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D61149
mac syscalls: add kern_ implementations
Where the kern_ interfaces map trivially to the syscall interface, follow
the syscall name even if awkward (e.g., sys___mac* -> kern___mac*).
Otherwise use shorter names.
Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
xhci: only set the slot context parent hub fields on xHCI 1.2
The Enhanced SuperSpeed meaning of the slot context parent hub slot ID
and port number fields was introduced in xHCI 1.2. Controllers built to
an earlier revision define them only for a Low- or Full-speed device
behind a High-speed hub.
A SuperSpeed device behind a USB 3.2 hub on an Intel Alpine Ridge
controller, an xHCI 1.1 part, stops responding to Address Device and
loops in uhub_reattach_port until the port is disabled.
Fixes: 20b19982545e ("usb: support SSP and SSPx2 xHCI")
Reviewed by: aokblast, ngie, adrian
Differential Revision: https://reviews.freebsd.org/D61278
