csjp [Fri, 26 Oct 2007 01:23:07 +0000 (01:23 +0000)]
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
cognet [Thu, 25 Oct 2007 23:02:42 +0000 (23:02 +0000)]
Add an option to be able to override the value of the AT91 master clock
frequency. It'd be better to be able to calculate it at runtime, but we need
the information very early, to setup the uart.
rwatson [Thu, 25 Oct 2007 22:45:25 +0000 (22:45 +0000)]
Sort entry points in mac_framework.h and mac_policy.h alphabetically by
primary object type, and then by secondarily by method name. This sorts
entry points relating to particular objects, such as pipes, sockets, and
vnodes together.
Sponsored by: SPARTA (original patches against Mac OS X)
Obtained from: TrustedBSD Project, Apple Computer
jhb [Thu, 25 Oct 2007 17:30:18 +0000 (17:30 +0000)]
Don't attach to the "IBM0057" ID. This ID is used by IBM machines for
the PS/2 mouse controller. Thus, when acpi_ibm(4) claimed the mouse
device, the mouse would stop working. The one ACPI dump of an R40 that
I've looked at includes an HKEY device with the proper "IBM0068" ID, so
I'm not sure how the "IBM0057" ID could have helped at all.
nyan [Thu, 25 Oct 2007 12:57:46 +0000 (12:57 +0000)]
MFi386: part of revision 1.51
Rework the read/write support in the bios disk driver some to cut down
on duplicated code.
- All of the bounce buffer and retry logic duplicated in bd_read() and
bd_write() are merged into a single bd_io() routine that takes an
extra direction argument. bd_read() and bd_write() are now simple
wrappers around bd_io().
rwatson [Thu, 25 Oct 2007 12:34:14 +0000 (12:34 +0000)]
Rename mac_associate_nfsd_label() to mac_proc_associate_nfsd(), and move
from mac_vfs.c to mac_process.c to join other functions that setup up
process labels for specific purposes. Unlike the two proc create calls,
this call is intended to run after creation when a process registers as
the NFS daemon, so remains an _associate_ call..
rwatson [Thu, 25 Oct 2007 11:31:11 +0000 (11:31 +0000)]
Consistently name functions for mac_<policy> as <policy>_whatever rather
than mac_<policy>_whatever, as this shortens the names and makes the code
a bit easier to read.
When dealing with label structures, name variables 'mb', 'ml', 'mm rather
than the longer 'mac_biba', 'mac_lomac', and 'mac_mls', likewise making
the code a little easier to read.
imp [Thu, 25 Oct 2007 07:05:38 +0000 (07:05 +0000)]
Load the bytes into the EMAC's MAC address register in the proper
order. The kernel used to shuffle them around to get things right,
but that was recently fixed. This makes our boot loader match the
behavior of most other boot loaders for the atmel parts. This bug was
inherited from the Kwikbyte loader that we started from.
This bug was discovered by Bj\e.A\eNvrn K\eNvnig back in June, but fell on the
floor. He provided patches to the kernel, include backwards
compatibility options that were similar to Olivier's if_ate.c commit.
cognet [Wed, 24 Oct 2007 23:12:19 +0000 (23:12 +0000)]
In ate_get_mac(), try to get the mac address in the right order, at least
in the same order as it's set in ate_set_mac.
I remember a discussion about this on -arm, but apparently nothing was done.
Warner, is this wrong ?
jhb [Wed, 24 Oct 2007 21:33:00 +0000 (21:33 +0000)]
First cut at support for booting a GPT labeled disk via the BIOS bootstrap
on i386 and amd64 machines. The overall process is that /boot/pmbr lives
in the PMBR (similar to /boot/mbr for MBR disks) and is responsible for
locating and loading /boot/gptboot. /boot/gptboot is similar to /boot/boot
except that it groks GPT rather than MBR + bsdlabel. Unlike /boot/boot,
/boot/gptboot lives in its own dedicated GPT partition with a new
"FreeBSD boot" type. This partition does not have a fixed size in that
/boot/pmbr will load the entire partition into the lower 640k. However,
it is limited in that it can only be 545k. That's still a lot better than
the current 7.5k limit for boot2 on MBR. gptboot mostly acts just like
boot2 in that it reads /boot.config and loads up /boot/loader. Some more
details:
- Include uuid_equal() and uuid_is_nil() in libstand.
- Add a new 'boot' command to gpt(8) which makes a GPT disk bootable using
/boot/pmbr and /boot/gptboot. Note that the disk must have some free
space for the boot partition.
- This required exposing the backend of the 'add' function as a
gpt_add_part() function to the rest of gpt(8). 'boot' uses this to
create a boot partition if needed.
- Don't cripple cgbase() in the UFS boot code for /boot/gptboot so that
it can handle a filesystem > 1.5 TB.
- /boot/gptboot has a simple loader (gptldr) that doesn't do any I/O
unlike boot1 since /boot/pmbr loads all of gptboot up front. The
C portion of gptboot (gptboot.c) has been repocopied from boot2.c.
The primary changes are to parse the GPT to find a root filesystem
and to use 64-bit disk addresses. Currently gptboot assumes that the
first UFS partition on the disk is the / filesystem, but this algorithm
will likely be improved in the future.
- Teach the biosdisk driver in /boot/loader to understand GPT tables.
GPT partitions are identified as 'disk0pX:' (e.g. disk0p2:) which is
similar to the /dev names the kernel uses (e.g. /dev/ad0p2).
- Add a new "freebsd-boot" alias to g_part() for the new boot UUID.
MFC after: 1 month
Discussed with: marcel (some things might still change, but am committing
what I have so far)
marius [Wed, 24 Oct 2007 20:51:44 +0000 (20:51 +0000)]
Add ABI backwards compatibility to the FreeBSD 4/5/6 versions of
the PCIOCGETCONF, PCIOCREAD and PCIOCWRITE IOCTLs, which was broken
with the introduction of PCI domain support.
As the size of struct pci_conf_io wasn't changed with that commit,
this unfortunately requires the ABI of PCIOCGETCONF to be broken
again in order to be able to provide backwards compatibility to
the old version of that IOCTL.
Requested by: imp
Discussed with: re (kensmith)
Reviewed by: PCI maintainers (imp, jhb)
MFC after: 5 days
sam [Wed, 24 Oct 2007 20:20:41 +0000 (20:20 +0000)]
silence complaint about not loading the wlan_scan_monitor module;
it does not exist and is not needed as monitor mode operation has
always required setting the current channel
rwatson [Wed, 24 Oct 2007 19:04:04 +0000 (19:04 +0000)]
Merge first in a series of TrustedBSD MAC Framework KPI changes
from Mac OS X Leopard--rationalize naming for entry points to
the following general forms:
The previous naming scheme was inconsistent and mostly
reversed from the new scheme. Also, make object types more
consistent and remove spaces from object types that contain
multiple parts ("posix_sem" -> "posixsem") to make mechanical
parsing easier. Introduce a new "netinet" object type for
certain IPv4/IPv6-related methods. Also simplify, slightly,
some entry point names.
All MAC policy modules will need to be recompiled, and modules
not updates as part of this commit will need to be modified to
conform to the new KPI.
Sponsored by: SPARTA (original patches against Mac OS X)
Obtained from: TrustedBSD Project, Apple Computer
jhb [Wed, 24 Oct 2007 12:49:55 +0000 (12:49 +0000)]
Rework the read/write support in the bios disk driver some to cut down
on duplicated code and support 64-bit LBAs for GPT.
- The code to manage an EDD or C/H/S I/O request are now in their own
routines. The EDD routine now handles a full 64-bit LBA instead of
truncating LBAs to the lower 32-bits. (MBRs and BSD labels only
have 32-bit LBAs anyway, so the only LBAs ever passed down were 32-bit).
- All of the bounce buffer and retry logic duplicated in bd_read() and
bd_write() are merged into a single bd_io() routine that takes an
extra direction argument. bd_read() and bd_write() are now simple
wrappers around bd_io().
- If a disk supports EDD then always use it rather than only using it if
the cylinder is > 1023. Other parts of the boot code already do
something similar to this. Also, GPT just uses LBAs, so for a GPT disk
it's probably best to ignore C/H/S completely. Always using EDD when
it is supported by a disk is an easy way to accomplish this.
nyan [Wed, 24 Oct 2007 11:54:04 +0000 (11:54 +0000)]
MFi386: revision 1.41
Slightly cleanup the 'bootdev' concept on x86 by changing the various
macros to treat the 'slice' field as a real part of the bootdev instead
of as hack that spans two other fields (adaptor (sic) and controller)
that are not used in any modern FreeBSD boot code.
jhb [Wed, 24 Oct 2007 04:03:25 +0000 (04:03 +0000)]
Slightly cleanup the 'bootdev' concept on x86 by changing the various
macros to treat the 'slice' field as a real part of the bootdev instead
of as hack that spans two other fields (adaptor (sic) and controller)
that are not used in any modern FreeBSD boot code.
csjp [Wed, 24 Oct 2007 00:50:13 +0000 (00:50 +0000)]
When processing multi-path ip6 routers, place each router entry on its
own line. We made this change in traceroute(8) some time ago. This
is particularly useful when you are not resolving hostnames since ip6
addresses can be quite long, and lines wrap fairly easily in the
multi-path router case.
csjp [Wed, 24 Oct 2007 00:14:19 +0000 (00:14 +0000)]
Move where we audit the PID argument such that we unconditionally
audit it at the beginning of the syscall. This fixes a problem
where the user supplies an invalid process ID which is > 0 which
results in the PID argument not being audited.
csjp [Wed, 24 Oct 2007 00:05:52 +0000 (00:05 +0000)]
Use extended process token. The in kernel process audit
state is stored in an extended subject token now. Make sure
that we are using the extended data. This fixes the termID
for process tokens.
julian [Tue, 23 Oct 2007 17:54:15 +0000 (17:54 +0000)]
Take out the single-threading code in fork.
After discussions with jeff, alc, (various Ironport people), david Xu,
and mostly Alfred (who found the problem) it has been demonstrated that this
is not needed for our implementations of threads and represents a real
(as in we've seen it happen a lot) deadlock danger.
Several points:
Since forking multiple threads is not allowed, and posix states that
any mutexes owned by othre threads wilol be owned in the child by
phantom threads, and therads shouldn't ba accessing shared structures without
protection, It can be proved that if this leads to the child process accessing
inconsistent data, it's a programming error.
The mode of thread_single() being used in fork() is the wrong one.
It is using SINGLE_NO_EXIT when it should be using SINGLE_BOUNDARY.
Even if this we used, System processes have no need to do it as they have
no userland to get inconsistent.
This commmit first fixes the above bugs to get tehm correct in CVS.
then removes them with #ifdef.
This is so that history contains the corrected version should it
be needed in the future.
This code may be needed if we implement the forkall() syscall from
Solaris. It may be needed for other non-posix thread libraries
at some time in the future, so let the code sit for a short while
while I do some work on it anyhow.
This removes a reproducible lockup in NFS.
It may be argued that maybe doing a fork while holding a vnode lock may
not be the best idea in th efirst place but it shouldn't cause a deadlock.
The removal has been running under soak test for several days now.
This removal should be seriously considered for 7.0 and RELENG_6.
Note. There is code in the core-dumping code that may have a similar problem
with coredumping threaded processes
rwatson [Tue, 23 Oct 2007 14:12:16 +0000 (14:12 +0000)]
Bump MAC_VERSION to 4 and add an 8.x line in the version table. Version 4
will include significant synchronization to the Mac OS X Leopard version
of the MAC Framework.
bde [Tue, 23 Oct 2007 10:39:03 +0000 (10:39 +0000)]
Forced commit to note that rev.1.179 has the following fixes in addition to
the ones mentioned in its log message:
For mount-update from rw to ro:
- don't misuse the MNT_FORCE flag to break error handling for mark volume
to clean.
- mark volume back to dirty if g_access() failed (not just if mark volume
to clean failed).
- clear pm_fmod on success. pm_fmod is bogus, since it is only used to
cause a panic in unreachable code when we forgot to clear it here, but
something like it will be needed.
For mount-update from rw to ro and from ro to rw:
- don't forget to lock mp when changing mp->mnt_flag. Giant locking
may make this unnecessary, but it is simpler to copy what ffs does.
Most of the style changes are near here, to copy ffs's cleaner code.
For unmount:
- don't misuse the MNT_FORCE flag to break error handling for mark volume
to clean. Failure of markvoldirty() is similar to failure of
ffs_subupdate() in ffs, and ffs has never used MNT_FORCE to ignore
the corresponding error. MNT_FORCE for unmount _should_ force the
unmount to succeed, but forcing away of write errors has never been
supported.
- explicitly return 0 instead of `error' in msdosfs_unmount() after
committing to success. This is now just a style fix. With errors from
markvoldirty() ignored in the MNT_FORCE case, any error in markvoldirty()
caused a nonzero `error' to be returned despite committing to success.
Upper layers soon paniced trying to back out of the committed unmount.
This bug used to be present in another form in most file systems.
VOP_CLOSE() was called after committing to success, so it was necessary
to force the VOP_CLOSE() to succeed. This was not done; instead,
VOP_CLOSE()'s error code was returned to upper layers so upper layers
soon paniced if VOP_CLOSE() failed. I saw this panic only with a buggy
device driver with a missing close method, but VOP_CLOSE() can easily
fail in theory, with errors like EDQUOT and EIO for unwriteable output.
Now the bug has moved. g_vfs_close() is called instead of VOP_CLOSE(),
and it returns void so unmount vops cannot even detect errors in it.
Hopefully, errors in it only occur when there are other bugs. E.g.,
with the MNT_FORCE bug in msdosfs_close(), when markvoldirty() in
umount failed due to the bugs in mount-update, and when this was the
only write error, g_vfs_close() was reached despite the write error
being detected earlier; it found one unwriteable buffer which it can
only report via printf; then after fixing the panic, umount(2)
"succeeded" but the unwriteable buffer was left in the buffer cache
and/or VMIO object to spam the console with printfs about failed
write attempts, until the next rw mount when the write succeeds,
possibly clobbering different media.
grehan [Tue, 23 Oct 2007 00:52:25 +0000 (00:52 +0000)]
Cut over to ULE on PowerPC
kern/sched_ule.c - Add __powerpc__ to the list of supported architectures
powerpc/conf/GENERIC - Swap SCHED_4BSD with SCHED_ULE
powerpc/powerpc/genassym.c - Export TD_LOCK field of thread struct
powerpc/powerpc/swtch.S - Handle new 3rd parameter to cpu_switch() by
updating the old thread's lock. Note: uniprocessor-only, will require
modification for MP support.
powerpc/powerpc/vm_machdep.c - Set 3rd param of cpu_switch to mutex of
old thread's lock, making the call a no-op.
jhb [Mon, 22 Oct 2007 19:01:26 +0000 (19:01 +0000)]
Close a race when trying to lookup a gateway route in rt_check().
Specifically, if two threads were doing concurrent lookups and the existing
gateway was marked down, the the first thread would drop a reference on the
gateway route and then unlock the "root" route while it tried to allocate
a new route. The second thread could then also drop a reference on the
same gateway route resulting in a reference underflow. Fix this by
clearing the gateway route pointer after dropping the reference count but
before dropping the lock. Secondly, in this same case, the second thread
would overwrite the gateway route pointer w/o free'ing a reference to the
route installed by the first thread. In practice this would probably just
fix a lost reference that would result in a route never being freed.
This fixes panics observed in rt_check() and rtexpunge().
MFC after: 1 week
PR: kern/112490
Insight from: mehuljv at yahoo.com
Reviewed by: ru (found the "not-setting it to NULL" part)
Tested by: several
delphij [Mon, 22 Oct 2007 17:43:43 +0000 (17:43 +0000)]
Fixes to msdosfs dirtyflag related stuff:
- markvoldirty() needs to write to underlying GEOM provider. We
have to do that *before* g_access() which sets the GEOM provider
to read-only.
- Remove dirty flag before free'ing iconv related resources. The
dirty flag removal could fail, and it is hard to revert the
iconv-free after the fail.
- Mark volume as dirty if we have failed to mark it clean for safe.
- Other style fixes to the touched functions.
ru [Mon, 22 Oct 2007 10:13:38 +0000 (10:13 +0000)]
- Stop calling libthr alternative as it's now the default
threading library.
- Now that libpthread is a symlink, it's no longer possible
to link applications with libpthread and have libmap.conf(5)
select the desired threading library; applications will be
linked to the default threading library, libkse or libthr.
Remove an obsolete paragraph.
- Mention that improvements can be seen compared to libkse.
dougb [Mon, 22 Oct 2007 09:38:44 +0000 (09:38 +0000)]
1. Determine the location of the rndc* binaries relative to $command
so that when using named from the ports (or elsewhere) the proper rndc*
commands will be run.
2. Rework the stop routine using ideas from brooks and delphij.
Specifically I am duplicating a lot of code from rc.subr's stop routine
so that this one will behave more like the one in rc.subr, but use rndc
to kill the daemon (or regular kill if that fails). This also avoids
the problems related to using killall if rndc fails, which is bad if
you're running more than one named on the same box.
3. Take a concept from gshapiro and allow the rndc.key file to be
owned by root OR the named_uid user.
Although I used different solutions, this commit handles issues raised in:
PR: conf/73929
PR: conf/103976
PR: conf/109409
alc [Mon, 22 Oct 2007 06:23:46 +0000 (06:23 +0000)]
Correct an error of omission in the reimplementation of the page
cache: vnode_pager_setsize() must handle the case where a file is
truncated to a non-page-size-aligned boundary and there is a cached
page underlying the new end of file.
alc [Mon, 22 Oct 2007 05:21:05 +0000 (05:21 +0000)]
Correct an error in vm_map_sync(), nee vm_map_clean(), that has existed
since revision 1.1. Specifically, neither traversal of the vm map checks
whether the end of the vm map has been reached. Consequently, the first
traversal can wrap around and bogusly return an error.
This error has gone unnoticed for so long because no one had ever before
tried msync(2)ing a region above the stack.
marcel [Sun, 21 Oct 2007 19:38:21 +0000 (19:38 +0000)]
Fix a last-minute, but more importantly, an untested change that
made the previous commit non-functional: the usage string was put
in the wrong field...
marius [Sun, 21 Oct 2007 17:03:18 +0000 (17:03 +0000)]
- Given that we tell the compiler that struct ip is packed and 32-bit
aligned, GCC 4.2.1 also generates code for sendudp() that assumes
this alignment. GCC 4.2.1 however doesn't 32-bit align wbuf, causing
the loader to crash due to an unaligned access of wbuf in sendudp()
when netbooting sparc64. Solve this by specifying wbuf as packed and
32-bit aligned, too. As for lastdata and readudp() this currently is
no issue when compiled with GCC 4.2.1, though give lastdata the same
treatment as wbuf for consistency and possibility of being affected
in the future. [1]
- Sprinkle const on a lookup table.
dougb [Sun, 21 Oct 2007 05:15:02 +0000 (05:15 +0000)]
Change to the original version of the poem titled "The Guy in the Glass,"
and add the proper attribution. Also add an explanation for the Middle
English word used in the first line.
julian [Sun, 21 Oct 2007 04:11:13 +0000 (04:11 +0000)]
fix up some code for older systems changed by accident in the last commit
this whole support for systems earlier than 5.0 should probably be removed
but I'll at least FIX it before removing it, so that CVS has it right.
marcel [Sun, 21 Oct 2007 00:04:23 +0000 (00:04 +0000)]
Add the show command to print the partition information ala gpt(8).
Update the manpage accordingly. While here, mention the MBR scheme
and add a bugs section. With this commit gpt(8) can be obsoleted.
julian [Sat, 20 Oct 2007 23:23:23 +0000 (23:23 +0000)]
Rename the kthread_xxx (e.g. kthread_create()) calls
to kproc_xxx as they actually make whole processes.
Thos makes way for us to add REAL kthread_create() and friends
that actually make theads. it turns out that most of these
calls actually end up being moved back to the thread version
when it's added. but we need to make this cosmetic change first.
I'd LOVE to do this rename in 7.0 so that we can eventually MFC the
new kthread_xxx() calls.
bz [Sat, 20 Oct 2007 22:18:42 +0000 (22:18 +0000)]
Fold multiple asm statements into one so that the compiler at a certain
optimization level (-march=pentium-mmx for example) does not insert
intermediate ops which would trash the carry.
Change both sys/i386/i386/in_cksum.c[1] and sys/i386/include/in_cksum.h.
To my best understanding the same problem was addressed in rev. 1.16
of src/sys/i386/include/in_cksum.h for just a single function 3y ago.
Reviewed by: jhb
Submitted by: Zhouyi ZHOU <zhouzhouyi FreeBSD.org> (intial version of [1])
MFC after: 5 days
PR: 115678, 69257
ru [Sat, 20 Oct 2007 19:01:50 +0000 (19:01 +0000)]
- Convert NO_INSTALLLIB option to a new syntax: makefiles should
test MK_INSTALLLIB, users can set WITHOUT_INSTALLLIB. The old
NO_INSTALLLIB is still supported as several makefiles set it.
- While here, fix an install when instructed not to install libs
(usr.bin/lex/lib/Makefile).
matteo [Sat, 20 Oct 2007 11:25:34 +0000 (11:25 +0000)]
Add the -h <bindip> option to mountd, similar to the one in nfsd(8)
-h bindip
Specify specific IP addresses to bind to for TCP and UDP requests.
This option may be specified multiple times. If no -h option is
specified, mountd will bind to INADDR_ANY. Note that when specifying
IP addresses with -h, mountd will automatically add 127.0.0.1 and if
IPv6 is enabled, ::1 to the list.
PR: bin/114097
Reviewed by: pjd (an eariler version of the patch)
MFC after: 1 week