BSD Commit Log Search

   sys/uvm: validate anonymous object pager requests

   uao_get() trusts the requested page range before allocating pages and
   looking up swap slots; an invalid request can therefore allocate a page
   outside the object and read beyond its swap slot array. Validate the
   request before page lookup or allocation, preserving optional fault
   clustering at the object boundary.

   Reject nonpositive page counts and starting page indices outside the
   object; require the entire range for PGO_ALLPAGES, or a centeridx within
   both the request and the object otherwise. Compare against the remaining
   page count in voff_t and derive pageidx from the validated firstpage,
   avoiding overflow in the bounds check and unchecked narrowing.

   Reported by Andrew Griffiths, thanks!

   OK: kettenis@

   Fix resuming the secondary CPUs when resuming from hibernation.  Like on
   amd64, park the CPUs before unpacking the hibernate image.  On arm64 we
   park the CPUs somewhere safe in the kernel.  When we unpark the CPUs,
   we need to locate its struct cpu_info and stack as these are dynamically
   allocated and the booted kernel may have allocated them in a different
   location.

   ok deraadt@

   Add some memory barriers to make writing out the hibernate image work
   on the Radxa Dragon Q6A.  Moving forward we really need a side-effect free
   bus_dmamap_sync(9), but a memory barrier will do the job as long as the
   hardware has cache-coherent DMA.

   ok mglocker@

   Make a failure to allocate a dedicated queue for hibernat support
   non-fatal.

   ok deraadt@, mglocker@

   Use getexecpath(3).  Since this is crucial build tooling, if getexecpath(3)
   fails, fallback to the old method in case someone tries to build on an old
   system.  Future clang updates should not contain this fallback code chunk.
   ok kettenis

   Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
   and execv(3).

   Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
   and execv(3).

   Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
   and execv(3).
   (this lpd is an incomplete replacement which has never been finished, but
   maybe eventually someone will finish it...)

   Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
   and execv(3).

   Replace argv[0] with execvp(3) for fork+exec privsep with getexecpath(3)
   and execv(3).

   authpf executes absolute-path /sbin/pfctl with execvp(3).  Use execv(3)
   instead.

   Use getexecpath(3) in florian's privsep fork+exec daemons.  These programs
   are normally started from rc(8) which provides absolute-paths, so these
   daemons were trusting argv[0] to be safe, unlike the paranoid behaviour in
   sshd(8). If the daemon is started manually without absolute-path, execvp(2)
   was being used which walks $PATH (includes /sbin and /usr/sbin) and it works
   but isn't ideal.  Since getexecpath(3) now always provides a
   realpath(3)-style canonicalized absolute path, execv(2) can be used instead.

   Use getexecpath(3); if it fails use argv[0] as before with the pre-existing
   code to validate it is an absolute path.  Here's a bit of history:  sshd
   became the first fork+exec privsep daemon (I did some arm-twisting).
   That privsep has recently turned into fork+exec different binaries but
   the SIGHUP restart code still want to re-run the binary from the original path.
   The rc startup sequence always passes an absolute path.  sshd was paranoid
   and validated it.  That made hand-restarts of sshd without absolute paths
   not work.  getexecpath(3) improves the ergonomics.
   ok djm

   Enable arm64 hibernation support.

   Main credits for enabling arm64 hibernation support goes to kettenis@
   for getting everything to work finally, and mlarkin@ for advising based
   on his amd64/i386 hibernation experience.

   ok kettenis@, deraadt@

   arm64 hibernate:
   Move the HIBERNATE_HIBALLOC_PAGE mapping in to own functions since on
   arm64 HIBERNATE_HIBALLOC_PAGE is a HIGH VA mapped by uvm at boot, and
   gets a no-op.  Plus adding hibernate data memory region.

   ok kettenis@, deraadt@

   arm64 hibernate:
   Move the HIBERNATE_HIBALLOC_PAGE mapping in to own functions since on
   arm64 HIBERNATE_HIBALLOC_PAGE is a HIGH VA mapped by UVM at boot, and
   gets a no-op.  Plus adding hibernate data memory region.

   ok kettenis@, deraadt@

   Add support for arm64 hibernation, MI part.

   ok kettenis@, deraadt@

   Add support for arm64 hibernation, MD part.

   ok kettenis@, deraadt@

   Bump version such that we can easily detect hibernate support.

   Implement page table mirroring in apldart(4) and use that to enable the
   IOMMU for the USB controllers on Apple Silicon.

   Based on a diff from Heyang Zhou.

   Fix free space check for unqualified filenames

   In limited instances, fetch recieves an unqualified filename that
   will be fetched into the current directory.  The simple "dirname"
   implementation wasn't smart enough.

   install.sub: fix and save spaces

   ok deraadt@

   varifier -> verifier

   ascic -> ASCII

   trucation -> truncation

   sync

   functions tests -> functions test

   functions conforms -> functions conform

   Change three paragraphs in different parts of the manual page (-O control
   commands, -Q query options, and private key file names) into tagged lists
   to make them more readable; no content change intended.
   OK naddy@; general direction requested by deraadt@.

   Limit size of files fw_update can download

   An unxpectedly large file could fill the disk causing issues for
   install or startup.

   Suggestion and initial code from Acts1631 <acts1631kjv () proton ! me>
   Refactor by me
   Feedback and reads ok dgl@