FreeBSD/src 868158fsbin/nvmecontrol nvmecontrol.8

nvmecontrol.8: Explain non-operational power modes

`nvmecontrol power -l ...` lists the available power modes.
Non-operational modes are marked with an asterisk. While here,
add <device-id | namespace-id> to the "nvmecontrol power" synopsis.

MFC after:              3 days
Reviewed by:            dab, imp, michaelo, ziaee
Differential Revision:  https://reviews.freebsd.org/D58480
DeltaFile
+5-1sbin/nvmecontrol/nvmecontrol.8
+5-11 files

FreeBSD/src 21bc31csys/dev/acpica acpi.c

acpi: parse resources of not-present devices that are kept enabled

acpi_probe_child() keeps PCI link devices, the RTC,
and docking stations enabled even when _STA reports them not present,
but skipped acpi_parse_resources() for them. With an empty resource
list, resource-based hint matching (BUS_HINT_DEVICE_UNIT) cannot wire
such a device to its hinted unit, and the hinted ISA device is then
created as a duplicate.

Modern AMI firmware reports the PNP0B00 RTC as not present while
handing timekeeping to the ACPI Time-and-Alarm device.

Reviewed by:    adrian, jhb
Differential Revision:  https://reviews.freebsd.org/D58047
DeltaFile
+35-24sys/dev/acpica/acpi.c
+35-241 files

FreeBSD/src 1932bd2sys/kern imgact_elf.c

ptrace: Propagate errors from set_fpregs()

Otherwise ptrace(PT_SETREGSET) will not return errors to userspace.

Fixes:          cef05c5a62ba ("amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS)")
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58577
DeltaFile
+4-4sys/kern/imgact_elf.c
+4-41 files

FreeBSD/src ea7d355sys/vm uma_core.c

uma: Fix KMSAN integration with malloc zones

In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
basis that UMA and kmem_malloc() would handle updates of the KMSAN
shadow map.  However, I missed that UMA explicitly does not handle this.

Modify UMA to only omit origin map updates for malloc zones.

Fixes:          459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
Reviewed by:    rlibby
Differential Revision:  https://reviews.freebsd.org/D58574
DeltaFile
+4-6sys/vm/uma_core.c
+4-61 files

FreeBSD/src b5fe1bclibexec/rc/rc.d bthidd

rc.d/bthidd: Correct load_kld invocations

Pass a single module name to load_kld for kbdmux and vkbd, allowing
bthidd_prestart to load both modules successfully.

Fixes:          cfe1962a1925 (rc: Fix improper use of load_kld)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+2-2libexec/rc/rc.d/bthidd
+2-21 files

FreeBSD/src f7e7fabsys/compat/linuxkpi/common/include/linux xarray.h

linuxkpi: Add xa_insert_irq wrapper

This just invokes xa_insert similar to other xa_*_irq wrappers.

Reviewed by:    bz
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D58576
DeltaFile
+3-0sys/compat/linuxkpi/common/include/linux/xarray.h
+3-01 files

FreeBSD/src c7400festand/common load_elf.c

stand: Reject ELF files with PT_LOAD segments where filesz > memsz

Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58543
DeltaFile
+6-0stand/common/load_elf.c
+6-01 files

FreeBSD/src 486dfbbsys/kern link_elf.c

kld: Reject kernel modules with PT_LOAD segments where filesz > memsz

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.

Reported by:    Jane Smith <thebugfixers at pm.me> (via D57785)
Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58542
DeltaFile
+8-0sys/kern/link_elf.c
+8-01 files

FreeBSD/src b9eaf9blib/libc/gen tls.c

libc: Reject static ELF exectables with PT_TLS segments were filesz > memsz

Reviewed by:    jrtc27
Differential Revision:  https://reviews.freebsd.org/D58558
DeltaFile
+4-0lib/libc/gen/tls.c
+4-01 files

FreeBSD/src 535eb24libexec/rtld-elf rtld.c map_object.c

rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front.  The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Reviewed by:    jrtc27, kib
Differential Revision:  https://reviews.freebsd.org/D58541
DeltaFile
+12-0libexec/rtld-elf/map_object.c
+6-0libexec/rtld-elf/rtld.c
+18-02 files

FreeBSD/src 80ee17cstand/common load_elf.c

stand: Improve error handling when loading ELF files

Previously all the 'goto out' statements after the image was loaded into
memory returned success rather than an error.  This is despite comments
indicating some of these conditions were in fact errors, and some of
these error conditions (such as missing PT_DYNAMIC) are treated as errors
in the kernel linker.

In addition, when failing to looking up the symbols for the linker
set, those cases returned failure leaking memory (though it's clear
from the original code from commit ca49b3342d1e that only the second
failure was intended to be an actual error).

To avoid more confusion, move the assignment of `ret` to just before
the `out` label so that `goto out` always returns an error.  This is a
more consistent pattern with other code in the tree that tends to use
labels for the error case.

Restructure some other code to avoid a few bogus errors.

    [6 lines not shown]
DeltaFile
+20-18stand/common/load_elf.c
+20-181 files

FreeBSD/src 8aec309stand/common load_elf.c

stand: Remove a pointless goto

Commit 505222d35fea removed a batch of code that this goto used to skip
around.

Reviewed by:    olce, kib, markj
Fixes:          505222d35fea ("Implement the long-awaited module->file cache database.  A userland tool (kldxref(8)) keeps a cache of what modules and versions are inside what .ko files.  I have tested this on both Alpha and i386.")
Differential Revision:  https://reviews.freebsd.org/D58539
DeltaFile
+0-3stand/common/load_elf.c
+0-31 files

FreeBSD/src 7bea49bshare/man/man4 mt7921.4

mt76: mt7921: update man page

Adjust the man page to what other LinuxKPI wlan man pages say and look
like as it has been a while since I wrote it.  The man page is not yet
hooked up to the build on purpose as the driver is not yet enabled in
the tree.

Sponsored by:   The FreeBSD Foundation
Reviewed by:    ziaee (earlier version)
Differential Revision: https://reviews.freebsd.org/D58479

(cherry picked from commit 3afa2628ccd22f81527406bbf6a4dca54d964afc)
DeltaFile
+25-39share/man/man4/mt7921.4
+25-391 files

FreeBSD/src 42b89d4sys/contrib/dev/mediatek/mt76 zzz_fw_ports_fwget.sh

mt76: update script to to deal with 7921 and 7925 flavors

Update the mt76/zzz_fw_ports_fwget.sh script to set fwget to download
mt7921 and mt7925 rather than the these days non-existent mt792x flavor.

Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57242

(cherry picked from commit b1f3726f7a677ae230135d19491ce97f2866e7c2)
DeltaFile
+17-8sys/contrib/dev/mediatek/mt76/zzz_fw_ports_fwget.sh
+17-81 files

FreeBSD/src 3b569c3usr.sbin/fwget/pci pci pci_network_mediatek

fwget: update MediaTek firmware listings to match ports

Update fwget(8) to download wifi-firmware-mt76-kmod-mt7921, and
wifi-firmware-mt76-kmod-mt7925 firmware packages instead of the
no longer available mt792x version.
Add another PCI vendor to recognize ITTIM IDs for mt7921-based
MediaTek cards.

(bz reduced the license in the ittim file to an SPDX tag and updated
the commit message, given this is only half the work from the review)

Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57242

(cherry picked from commit 7925256edc74a8c60435dce1c2c2a8f3dd1ef1a3)
DeltaFile
+24-0usr.sbin/fwget/pci/pci_network_ittim
+7-7usr.sbin/fwget/pci/pci_network_mediatek
+1-0usr.sbin/fwget/pci/pci
+32-73 files

FreeBSD/src 82e4762sbin/route route_netlink.c

route(8): Add null check for prefsrc option

Reported by:    Shawn Webb <shawn.webb at hardenedbsd.org>, bms
Fixes:  dd235f097af4 ("route(8): Add prefsrc option in netlink")
DeltaFile
+2-1sbin/route/route_netlink.c
+2-11 files

FreeBSD/src 833bdaesys/kern kern_exit.c

proc_realparent(): do not mark the child as orphan when reparenting to p_opptr pid

Reported and reviewed by:       markj
Fixes:  8cef3c9b768a ("proc_realparent(): assert that an orphaned child has real parent != parent")
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D58566
DeltaFile
+1-2sys/kern/kern_exit.c
+1-21 files

FreeBSD/src ff97443sys/kern kern_event.c

kqueue: do not buffer the whole knote report when sizing it

kern_proc_kqueues_out() reported into an intermediate sbuf and copied the
result into the caller's.

A process that had leaked 468k kqueue descriptors wired 757 MB of M_SBUF
while dumping core, over roughly 9M reallocations, then copied the whole
thing again.

Reviewed by:    adrian, markj
Differential Revision:  https://reviews.freebsd.org/D58536
PR: 296835
MFC after: 1 week
DeltaFile
+7-7sys/kern/kern_event.c
+7-71 files

FreeBSD/src 1c1a364usr.sbin/bhyve tpm_intf_crb.c

bhyve: tpm: Avoid printing a message when clearing the cancel bit

Some drivers do this routinely, e.g., FreeBSD's tpm20 does this every
time it sends a command in tpmcrb_transmit().  This causes the console
to fill up with messages.  Instead, only print a warning if the cancel
bit is set to one.

Reviewed by:    corvink
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D52425
DeltaFile
+11-4usr.sbin/bhyve/tpm_intf_crb.c
+11-41 files

FreeBSD/src 1719b75lib/libc/tests/secure generate-fortify-tests.lua fortify_uio_test.c

tests/libc: Fix fortify_source uio tests

Some of the preadv() and readv() tests were not initializing the iovecs
they pass to the system call.  When the system call is expected to fail,
that's fine since the FORTIFY_SOURCE checks cause the process to be
aborted.  However, in the rest of the test cases, the (p)readv() call
could cause spurious test failures, e.g., when an uninitialized iov
entry points to the current stack frame and the canary gets overwritten.

Modify the tests to explicitly initialize iov entries to avoid this.
The "iov" variants don't have this problem, so leave them alone.

Reviewed by:    kevans
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58289
DeltaFile
+80-20lib/libc/tests/secure/fortify_uio_test.c
+18-9lib/libc/tests/secure/generate-fortify-tests.lua
+98-292 files

FreeBSD/src b9d07a4usr.sbin/ppp lcp.c

ppp: Reject invalid endpoint discriminator options

Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.

PR:             271910
Reported by:    Robert Morris
Reported by:    Décio Brandão (0xDBJ)
Reviewed by:    emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58554
DeltaFile
+6-0usr.sbin/ppp/lcp.c
+6-01 files

FreeBSD/src b566e0asys/x86/x86 mp_x86.c

amd64: Mark the trapframe as initialized in ipi_bitmap_handler()

Fixes:          fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
DeltaFile
+2-0sys/x86/x86/mp_x86.c
+2-01 files

FreeBSD/src 0aca7cesys/kern kern_malloc.c

malloc: Fix domainset usage in malloc_domainset() for large allocs

We should of course pass the provided domainset rather than copying what
plain malloc() does.

Fixes:          89deca0a3361 ("malloc: make malloc_large closer to standalone")
Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58316
DeltaFile
+1-1sys/kern/kern_malloc.c
+1-11 files

FreeBSD/src 459aa03sys/kern kern_malloc.c

malloc: Refactor redzone and sanitizer handling

malloc_large() duplicates redzone and KASAN handling that is also
present in malloc() and malloc_domainset().  Refactor the
implementations to reduce this a bit.

Also normalize KMSAN map handling: make malloc() and malloc_domainset()
consistent, and do not update the KMSAN shadow map, as we can rely on
UMA and kmem_malloc() to handle that.

Reviewed by:    rlibby
MFC after:      3 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58272
DeltaFile
+51-83sys/kern/kern_malloc.c
+51-831 files

FreeBSD/src f51a5e1sys/vm uma_core.c

uma: Insert KASAN redzones after slab-allocated items

Without this, KASAN has the deficiency that inter-object overflows are
not detected most of the time[*] when keg_layout() is able to perfectly
pack a slab.  Try to overcome this by adjusting the allocation size to
include a redzone following the object.

With this change, we automatically get a redzone following each item, so
any overflow into the redzone will trigger a panic.  Most of UMA doesn't
need to know about this: at slab allocation time, the whole slab is
poisoned, and then kasan_mark_item_valid() will unpoison only the buffer
that is available to the consumer.

Note that in most zones, most objects will follow another object's
redzone, so there is some protection against underflow as well.  It
might be worthwhile to provide a stronger guarantee here.

Add an assertion to item_ctor() that the returned item is properly
aligned.  I couldn't see any pre-existing checks which verify this.

    [5 lines not shown]
DeltaFile
+38-24sys/vm/uma_core.c
+38-241 files

FreeBSD/src 5bb8119sbin/ifconfig ifgif.c

ifconfig: Add netlink support for gif(4)

This implementation does not cover tunnel addresses.

Differential Revision: https://reviews.freebsd.org/D57667
DeltaFile
+194-0sbin/ifconfig/ifgif.c
+194-01 files

FreeBSD/src 9bfb78bsys/net if_gif.c, sys/netlink/route interface.h

if_gif: Add netlink support with tests

Migrate to new if_clone KPI and implement netlink support
for gif(4). Also break GIFSOPTS ioctl logic out of gif_ioctl.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57666
DeltaFile
+270-34sys/net/if_gif.c
+160-0tests/sys/netlink/test_rtnl_gif.c
+10-0sys/netlink/route/interface.h
+1-0tests/sys/netlink/Makefile
+441-344 files

FreeBSD/src 6f940casys/dev/ixgbe if_sriov.c

ixgbe: clear VF head write-back state on reset

VF reset and FLR do not clear the transmit head write-back address
registers.  A previous VF driver can therefore leave DMA write-back
enabled with a stale address for the next driver instance.

After consuming the reset request and disabling the VF queues, clear the
address registers for each queue belonging to that VF.  Derive the queue
count from the active IOV mode so peer queue state is not touched.

Linux commit dbf231af81a7 documents the hardware behavior.  The FreeBSD
implementation follows the local queue mapping and register interfaces.

MFC after:      1 week
DeltaFile
+13-0sys/dev/ixgbe/if_sriov.c
+13-01 files

FreeBSD/src 9cf1aa6sys/dev/ixgbe ixgbe_common.c ixgbe_api.c

ixgbe: dispatch PBA string reads through EEPROM ops

E610 installs a device-specific PBA string reader, but the public API
always calls the generic implementation.  Dispatch through the EEPROM
operation table so device overrides are honored.

Initialize the generic operation for devices that use the ordinary
EEPROM representation.

Obtained from:  Intel ix 3.4.39
MFC after:      1 week
DeltaFile
+3-1sys/dev/ixgbe/ixgbe_api.c
+1-0sys/dev/ixgbe/ixgbe_common.c
+4-12 files

FreeBSD/src 86869d7sys/dev/ixgbe ixgbe_common.c

ixgbe: avoid signed shift when assembling ETrack ID

Obtained from:  Intel ix 3.4.39
MFC after:      1 week
DeltaFile
+4-4sys/dev/ixgbe/ixgbe_common.c
+4-41 files