Warner Losh [Fri, 16 Feb 2024 03:53:19 +0000 (20:53 -0700)]
loader: Add prototype for gfx_interp_md
This function will be used to draw in the graphics bindings when the
loader is compiled with graphics (gfx) support. Provide definitions
for lua and the simple interpreter. 4th support is forthcoming.
Warner Losh [Fri, 16 Feb 2024 03:53:07 +0000 (20:53 -0700)]
loader: Create new gfx table
Create a new gfx global table. Put into it all the graphics bindings
that we have in loader today. For now, have compatability binding for
loader. Remove them from loader.
Warner Losh [Fri, 16 Feb 2024 03:52:41 +0000 (20:52 -0700)]
loader: Simplify the loader.has_command
luaL_checkstring already checks for the right number of
arguments. There's no need to do that by hand here. Now an exception
will be thrown like any other function with the wrong args. Also,
push a boolean instead of an int.
ipfw: Skip to the start of the loop when following a keep-state rule
When a packet matches an existing dynamic rule for a keep-state rule,
the matching engine advances the "instruction pointer" to the action
portion of the rule skipping over the match conditions. However, the
code was merely breaking out of the switch statement rather than doing
a continue, so the remainder of the loop body after the switch was
still executed. If the first action opcode contains an F_NOT but not
an F_OR (such as an "untag" action), then match is toggled to 0, and
the code exits the inner loop via a break which aborts processing of
the actions.
John Baldwin [Fri, 16 Feb 2024 01:56:01 +0000 (17:56 -0800)]
pci_host_generic: Properly handle bus_release_resource of IRQ resources
Unlike other bus methods updated to use bus_generic_rman_* in commit d79b6b8ec267, the bus_release_resource method was using
bus_generic_rman_release_resource for all types other than
PCI_RES_BUS. Instead, bus_generic_rman_* should only be used for
memory and I/O port resources for this driver.
John Baldwin [Fri, 16 Feb 2024 00:05:09 +0000 (16:05 -0800)]
pci_host_generic: Set a valid error if allocating a range resource fails
Previously pci_host_generic_attach was returning 0 (success)
incorrectly if allocating a range failed. The error value was 0 from
the previously successful call to bus_set_resource in this case.
Fixes: d79b6b8ec267 pci_host_generic: Don't rewrite resource start address for translation
John Baldwin [Fri, 16 Feb 2024 00:04:50 +0000 (16:04 -0800)]
simplebus: Map SYS_RES_IOPORT to SYS_RES_MEMORY later in alloc_resource
Specifically, the set/get_resource methods do not currently remap
resource types, so remap the type in alloc_resource only after
looking for a matching resource list entry.
Fixes: 3cf553288b96 simplebus: Consistently map SYS_RES_IOPORT to SYS_RES_MEMORY
Warner Losh [Thu, 15 Feb 2024 21:28:54 +0000 (14:28 -0700)]
reboot: initialize howto
Make static analyzers happy by initialzing howto to 0. Coverity is
cranky that it could be used unused. But it's analysis is incomplete
because the args to getopt when it wasn't initialized preclude it from
being used.
Cy Schubert [Thu, 15 Feb 2024 15:41:07 +0000 (07:41 -0800)]
heimdal: Fix NULL deref
A flawed logical condition allows a malicious actor to remotely
trigger a NULL pointer dereference using a crafted negTokenInit
token.
Upstream notes:
Reported to Heimdal by Michał Kępień <michal@isc.org>.
From the report:
Acknowledgement
---------------
This flaw was found while working on addressing ZDI-CAN-12302: ISC BIND
TKEY Query Heap-based Buffer Overflow Remote Code Execution
Vulnerability, which was reported to ISC by Trend Micro's Zero Day
RFC8062 Section 7 requires verification of the PA-PKINIT-KX key
excahnge when anonymous PKINIT is used. Failure to do so can
permit an active attacker to become a man-in-the-middle.
Cy Schubert [Thu, 15 Feb 2024 00:54:46 +0000 (16:54 -0800)]
heimdal: CVE-2022-41916: Check for overflow in _gsskrb5_get_mech()
Apply upstream 22749e918 to fix a buffer overflow.
Upstream notes:
If len_len is equal to total_len - 1 (i.e. the input consists only of a
0x60 byte and a length), the expression 'total_len - 1 - len_len - 1',
used as the 'len' parameter to der_get_length(), will overflow to
SIZE_MAX. Then der_get_length() will proceed to read, unconstrained,
whatever data follows in memory. Add a check to ensure that doesn't
happen
Cy Schubert [Wed, 14 Feb 2024 20:04:30 +0000 (12:04 -0800)]
Heimdal: CVE-2018-16860 Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum
Upstream's explanation of the problem:
S4U2Self is an extension to Kerberos used in Active Directory to allow
a service to request a kerberos ticket to itself from the Kerberos Key
Distribution Center (KDC) for a non-Kerberos authenticated user
(principal in Kerboros parlance). This is useful to allow internal
code paths to be standardized around Kerberos.
S4U2Proxy (constrained-delegation) is an extension of this mechanism
allowing this impersonation to a second service over the network. It
allows a privileged server that obtained a S4U2Self ticket to itself
to then assert the identity of that principal to a second service and
present itself as that principal to get services from the second
service.
There is a flaw in Samba's AD DC in the Heimdal KDC. When the Heimdal
KDC checks the checksum that is placed on the S4U2Self packet by the
server to protect the requested principal against modification, it
does not confirm that the checksum algorithm that protects the user
name (principal) in the request is keyed. This allows a
man-in-the-middle attacker who can intercept the request to the KDC to
modify the packet by replacing the user name (principal) in the
request with any desired user name (principal) that exists in the KDC
and replace the checksum protecting that name with a CRC32 checksum
(which requires no prior knowledge to compute).
This would allow a S4U2Self ticket requested on behalf of user name
(principal) user@EXAMPLE.COM to any service to be changed to a
S4U2Self ticket with a user name (principal) of
Administrator@EXAMPLE.COM. This ticket would then contain the PAC of
the modified user name (principal).
Apply upstream b1e699103. This fixes a bug introduced by upstream f469fc6 which may in some cases enable bypass of capath policy.
Upstream writes in their commit log:
Note, this may break sites that rely on the bug. With the bug some
incomplete [capaths] worked, that should not have. These may now break
authentication in some cross-realm configurations.
John Baldwin [Thu, 15 Feb 2024 20:20:30 +0000 (12:20 -0800)]
riscv: Add missing includes for DDB
The #ifdef DDB code in parse_metadata was dead code without opt_ddb.h.
While here, update the call to db_fetch_ksymtab for changes in commit 02bc014a200a.
Gleb Smirnoff [Thu, 15 Feb 2024 18:48:44 +0000 (10:48 -0800)]
socket tests: add listener_wakeup
This test runs several scenarios when sleep(9) on a listen(2)ing socket is
interrupted by shutdown(2) or by close(2). What should happen in that
case is not specified, neither is documented. However, there is certain
behavior that we have and this test makes sure it is preserved. There is
software that relies on it, see bug 227259. This test is based on
submission with this bug, bugzilla attachment 192260.
The test checks TCP and unix(4) stream socket behavior and SCTP can be
added easily if needed.
The test passes on FreeBSD 11 to 15. It won't pass on FreeBSD 10,
although the wakeup behavior of shutdown(2) is the same, but it doesn't
return error.
Gleb Smirnoff [Thu, 15 Feb 2024 18:48:44 +0000 (10:48 -0800)]
sockets: repair wakeup of accept(2) by shutdown(2)
That was lost in transition from one-for-all soshutdown() to protocol
specific methods. Only protocols that listen(2) were affected. This is
not a documented or specified feature, but some software relies on it. At
least the FreeSWITCH telephony software uses this behavior on
PF_INET/SOCK_STREAM.
Ed Maste [Thu, 15 Feb 2024 14:55:39 +0000 (09:55 -0500)]
rights.4: Remove sentence implying that rights are a mask
Capability rights passed to cap_rights_* are (now) not simple bitmaks
and cannot be ORed together in general (although it will work for
certain subsets of rights).
Remove sentence that implied rights are masks. We already have the
sentence "The complete list of capability rights is provided below" so
listing the rights without an introductory sentence seems fine.
Ed Maste [Thu, 15 Feb 2024 00:45:42 +0000 (19:45 -0500)]
path_test: fix cap_rights_init usage
Capability rights passed to cap_rights_* are not simple bitmaks and
cannot be ORed together in general (although it will work for certain
subsets of rights).
PR: 277057
Fixes: e5e1d9c7b781 ("path_test: Add a test case for...")
Sponsored by: The FreeBSD Foundation
Philip Paeps [Thu, 15 Feb 2024 13:49:33 +0000 (21:49 +0800)]
bsdinstall: prefer HTTP
In 2024, users are more likely to have working HTTP than working FTP.
Present http://ftp.FreeBSD.org as the first option in the installer.
Keep ftp://ftp.FreeBSD.org as the second option.
Even though message version is automatically recognized and the top of
the struct is identical for different versions, when iterating over
multiple messages proper message length must be used. That's the length
of an union member for given version, not of the union itself.
Ed Maste [Thu, 15 Feb 2024 00:42:48 +0000 (19:42 -0500)]
libcasper: fix cap_rights_init usage
Capability rights passed to cap_rights_* are not simple bitmaks and
cannot be ORed together in general (although it will work for certain
subsets of rights).
PR: 277057
Fixes: faaf43b2a750 ("fileargs: add tests")
Sponsored by: The FreeBSD Foundation
Ed Maste [Thu, 15 Feb 2024 00:03:40 +0000 (19:03 -0500)]
cat: fix cap_rights_init usage
Capability rights passed to cap_rights_* are not simple bitmaks and
cannot be ORed together in general (although it will work for certain
subsets of rights).
John Baldwin [Wed, 14 Feb 2024 22:07:33 +0000 (14:07 -0800)]
pci_host_generic: Don't rewrite resource start address for translation
Allocate resources from the parent device for decoded physical address
ranges. When child resources suballocated from rman's are mapped,
translate those mapping requests into a mapping request of the
associated physical address range in a bus_map_resource method.
While here, convert generic_pcie_rman to a bus_get_rman method and use
bus_generic_rman_* for operations on child resources.
Factor out a generic_pcie_containing_range to share logic between
bus_translate_resource and bus_*map_resource.
John Baldwin [Wed, 14 Feb 2024 22:07:33 +0000 (14:07 -0800)]
physmem ram: Don't reserve excluded regions
These regions can conflict with I/O resources and prevent allocation
of those regions by other drivers. It may make sense to reserve them
after the boot-time probe of devices has concluded (or after an
initial pass to reserve firmware-assigned resources before "wildcard"
resources are allocated), but that would require additional changes.
John Baldwin [Wed, 14 Feb 2024 22:07:32 +0000 (14:07 -0800)]
acpi: Allow child drivers to use bus_set_resource for more resources
acpi_set_resource excludes certain types of resources for certain
devices. The intention of this is to avoid adding resource entries
for bogus resources enumerated via _CRS. However, this also prevents
drivers from adding those resources explicitly if needed. To fix
this, move the logic to exclude these resources into an ignore hook
used when parsing _CRS to create the initial set of resources for each
device.
John Baldwin [Wed, 14 Feb 2024 22:07:32 +0000 (14:07 -0800)]
pci_host_generic: Include the bridge's device name in rman descriptions
The rman description strings now match those used in the PCI-PCI
bridge driver. Using more specific names removes ambiguity in devinfo -u
output on systems with multiple host to PCI bridges.
Bjoern A. Zeeb [Mon, 5 Feb 2024 14:51:08 +0000 (14:51 +0000)]
LinuxKPI: 802.11: update the ni/lsta reference cycle
Update the ni/lsta reference cycle, add extra checks and assertions.
This is to accomodate problems we were seeing based on net80211
behaviour (join1() and (*iv_update_bss)() as well as state changes for
new iv_bss nodes during an active session).
This should hopefully help to stabilise behaviour until the underlying
problems gets properly addressed (for this and all other device drivers).
PR: 272607, 273985, 274003
MFC after: 3 days
Reviewed by: cc
Differential Revision: https://reviews.freebsd.org/D43753
Bjoern A. Zeeb [Sat, 3 Feb 2024 16:33:56 +0000 (16:33 +0000)]
LinuxKPI: 802.11: band-aid for invalid state changes after (*iv_update_bss)
With firmware based solutions we cannot just jump from an active session
to a new iv_bss node without tearing down state for the old and bringing
up the new node. This likely used to work on softmac based cards/drivers
where one could essentially set the state and fire at will.
We track (*iv_update_bss) calls from net80211 and set a local flag that
we are out of synch and do not allow any further operations up the state
machine until we hit INIT or SCAN. That means someone will take the state
down, clean up firmware state and then we can join again and build up
state.
Apparently this problem has been "known" for a while as native iwm(4) and
others have similar workarounds (though less strict) and can be equally
pestered into bad states. For LinuxKPI all the KASSERTs just massively
brought this problem out. The solution will be some rewrites in net80211.
Until then, try to keep us more stable at least and not die on second
join1() calls triggered by service netif start wlan0 and similar.
PR: 271979, 271988, 275255, 263613, 274003
Sponsored by: The FreeBSD Foundation (2023, partial)
MFC after: 3 days
Reviewed by: cc
Differential Revision: https://reviews.freebsd.org/D43725
Bjoern A. Zeeb [Wed, 10 Jan 2024 10:14:16 +0000 (10:14 +0000)]
net80211: deal with lost state transitions
Since 5efea30f039c4 we can possibly lose a state transition which can
cause trouble further down the road.
The reproducer from 643d6dce6c1e can trigger these for example.
Drivers for firmware based wireless cards have worked around some of
this (and other) problems in the past.
Add an array of tasks rather than a single one as we would simply
get npending > 1 and lose order with other tasks. Try to keep state
changes updated as queued in case we end up with more than one at a
time. While this is not ideal either (call it a hack) it will sort
the problem for now.
We will queue in ieee80211_new_state_locked() and do checks there
and dequeue in ieee80211_newstate_cb().
If we still overrun the (currently) 8 slots we will drop the state
change rather than overwrite the last one.
When dequeing we will update iv_nstate and keep it around for historic
reasons for the moment.
The longer term we should make the callers of
ieee80211_new_state[_locked]() actually use the returned errors
and act appropriately but that will touch a lot more places and
drivers (possibly incl. changed behaviour for ioctls).
rtwn(4) and rum(4) should probably be revisted and net80211 internals
removed (for rum(4) at least the current logic still seems prone to
races).
PR: 271979, 271988, 275255, 263613, 274003
Sponsored by: The FreeBSD Foundation (in 2023)
MFC after: 3 days
Reviewed by: cc
Differential Revision: https://reviews.freebsd.org/D43389
Bjoern A. Zeeb [Mon, 12 Feb 2024 16:09:12 +0000 (16:09 +0000)]
iwlwifi: improve error message
In case we cannot identify the firmware monitor buf_location,
print the type (usually 0 = invalid) so we have an idea at least
of what was set (or not).
Bjoern A. Zeeb [Mon, 29 Jan 2024 22:35:08 +0000 (22:35 +0000)]
LinuxKPI: 802.11: correct HT protection fields
It seems during the initial buildup of the file, the defines were
either mixed or not flagged as "FIXME".
Define the values through to the net80211 definitions and also
annotate them by at least some standards reference.
MFC after: 3 days
Fixes: 6b4cac814e32f
Reviewed by: cc
Differential Revision: https://reviews.freebsd.org/D43658
Bjoern A. Zeeb [Mon, 29 Jan 2024 20:59:05 +0000 (20:59 +0000)]
net80211: fix checks for (*iv_preamble_update)/(*iv_ht_protmode_update)
Both vap_update_preamble() and vap_update_ht_protmode() also check for
(*iv_erp_protmode_update)() rather than (*iv_preamble_update)()
or (*iv_ht_protmode_update)() before calling the later.
Use the appropriate NULL-function-pointer checks before calling it.
All seem unused currently so no functional changes expected.
MFC after: 3 days
Fixes: f1481c8d3b58e
Reviewed by: cc
Differential Revision: https://reviews.freebsd.org/D43655
Warner Losh [Wed, 14 Feb 2024 18:07:10 +0000 (11:07 -0700)]
loader: Make vidc_biosputchar static
It's currently unused outside of vidconsole.c. Gerald Hicks' fix to the
beep code from de37e4a6d2333/1998 introduced the funciton as
static. Maxim Sobolev (sobomax) made it non-static since his spinconsole
called it in c4c3b35172d67/2009. When sobomax dropped the direct call
after making spinconsole console independent in b35172d67/2017,
vidc_biosputchar remained a harmless unreferenced global. Make it static
once again.
Warner Losh [Wed, 14 Feb 2024 17:51:38 +0000 (10:51 -0700)]
loader: Fetch initial script from loader_lua env
Sometimes it is nice to override the initial script that we run. Make it
possible by fetching loader_lua from the env and using that instead of
the default if prsent.
Himanshu Chauhan [Wed, 14 Feb 2024 15:31:26 +0000 (11:31 -0400)]
riscv: Introduce support for APLIC interrupt controller
This patch introduces support for the RISC-V APLIC interrupt controller
[1]. Currently, it is only supports direct mode, i.e. without an IMSIC
and functionally replacing the legacy RISC-V PLIC. Work on IMSIC support
is in progress.
Mitchell Horne [Wed, 14 Feb 2024 15:12:57 +0000 (11:12 -0400)]
riscv: add firmware partitions to GENERICSD.conf
Create two partitions in the existing space at the beginning of the
image (8MB). These are intended to hold u-boot SPL and u-boot proper.
The partition types selected are compatible with SiFive boards, e.g. the
HiFive Unmatched. They can easily be overridden for a platform that uses
the same scheme but different partition types, e.g. the StarFive
VisionFive v2. Firmware is not actually installed, this too is left for
the user.
It is not as simple to create the firmware partitions after the fact,
e.g. with partition indices 3 and 4. It is a shortcoming of current day
u-boot that the SPL loader looks for a specific partition index, rather
than the partition type, meaning that we will fail to boot if partition
2 doesn't contain u-boot.
Thus, our GENERICSD images become more generically usable with current
RISC-V hardware/firmware platforms.
Reviewed by: manu, karels, imp
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D43849
Mitchell Horne [Wed, 14 Feb 2024 15:12:29 +0000 (11:12 -0400)]
release: make SD card partition layout more flexible
Currently the partition layout is hardcoded to create an EFI/FAT
partition and a UFS root partition, with some logic to handle GPT/MBR
differences.
On RISC-V platforms we are seeing the emerging pattern that firmware
should be placed in a partition of a known type, rather than just a
known sector of the disk. Thus, some functionality is needed to
customize the layout for SD card images.
Add a hook, arm_create_partitions(), which can be overridden to insert
additional platform-specific partitions, possibly preceding the standard
EFI and UFS ones. A couple of new variables are added to track the
indices, e.g. ROOTFSPART_SUFFIX=p2.
In a couple places this de-duplicates the GPT/MBR logic.
Reviewed by: manu, karels, imp
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D43848
Check for privilege PRIV_SCHED_SETPOLICY instead of PRIV_SCHED_SET, to
at least make it coherent with what is done at thread creation when
a realtime policy is requested, and have users authorized by
mac_priority(4) pass it.
This change is good enough in practice since it only allows 'root' (as
before) and mac_priority(4)'s authorized users in (the point of this
change), without other side effects. More changes in this area, to
generally ensure that all privilege checks are consistent, are going to
come as olce's priority revamp project lands.
tcp: fix RTO ssthresh for non-6675 pipe calculation
Follow up on D43768 to properly deal with the non-default
pipe calculation. When CC_RTO is processed, the timeout
will have already pulled back snd_nxt. Further, snd_fack
is not pulled along with snd_una.
Alexander Motin [Tue, 13 Feb 2024 19:15:16 +0000 (14:15 -0500)]
Linux: Cleanup taskq threads spawn/exit
This changes taskq_thread_should_stop() to limit maximum exit rate
for idle threads to one per 5 seconds. I believe the previous one
was broken, not allowing any thread exits for tasks arriving more
than one at a time and so completing while others are running.
Also while there:
- Remove taskq_thread_spawn() calls on task allocation errors.
- Remove extra taskq_thread_should_stop() call.
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Rich Ercolani <rincebrain@gmail.com>
Signed-off-by: Alexander Motin <mav@FreeBSD.org>
Sponsored by: iXsystems, Inc.
Closes #15873
Make sh(1) recognize the default $HOME. By default /home
is a symlink; without this change, when you log in, sh(1)
won't realize the current directory (eg '/usr/home/test')
is the same as $HOME ('/home/test').
/home is no longer a symlink by default, but new users may be added on
systems that started out with an earlier version of FreeBSD (and still
have /home as a symlink) or admins may do so.
This test is not particularly expensive, so just restore it.
Kyle Evans [Tue, 13 Feb 2024 15:38:02 +0000 (09:38 -0600)]
rtld: add some dlopen tests
dlopen_basic just tests that libthr.so can be dlopen()ed, which will
just serve as a sanity check that "libthr.so" is a thing that can be
dlopened in case we get a weird failure in dlopen_recursing.
dlopen_recursing tests a regression reported after the libsys split,
where some dlopen() may cause infinite recursion and a resulting crash.
This case is inspired by bdrewery's description of what seemed to be
causing his issue.
The corresponding fix landed in commit 968a18975ad ("rtld: ignore load_filtees() calls if we already [...]")
rtld: ignore load_filtees() calls if we already loading filtees for the obj
in addition to avoiding it for already loaded filtees. Issue is that
during load, rtld needs to resolve some special ABI symbols, like
executable stack fixer and static TLS initializer, which might trigger
recursion.
Example is libthr which is filter for libsys, and which exports
__pthread_distribute_static_tls.
Tested by: kevans, krion
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D43858
Andrew Turner [Tue, 9 Jan 2024 13:29:47 +0000 (13:29 +0000)]
dev/uart: Support 8-byte register access
While we only support 4-byte registers in the uart code the physical
access may be to an 8-byte register. Support this as an option on
non-i386. On i386 we lack the needed 8-byte bus_space functions.
ACPI has an option for 8-byte register io width, and FDT can be given
any size. Support these sizes, even if we don't expect to see hardware
with an 8-byte io width.
Reviewed by: imp
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D43374
Andrew Turner [Mon, 8 Jan 2024 15:24:33 +0000 (15:24 +0000)]
dev/uart: Support the pl011 uart in hw.uart.console
Add the pl011 uart to the list of supported uarts for use by
hw.uart.console. This is commonly found in Arm based devices, and a
variant is standardised in the Arm SBSA.
Reviewed by: imp
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D43363
Andrew Turner [Mon, 8 Jan 2024 15:02:29 +0000 (15:02 +0000)]
dev/uart: Use a linker set to find uart classes
When the uart is configured via the environment we need to find the
uart class with a specified name. Currently to do this with an
incomplete list of uarts. As we may not have included all uarts in the
kernel each class is defined as weak.
Switch to a linker set so the list is always up to date based on what
is included in the kernel, and the class can be static.
Reviewed by: imp
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D43361
Andrew Turner [Mon, 8 Jan 2024 14:45:51 +0000 (14:45 +0000)]
sys: Simplify enabling EARLY_PRINTF uarts
Support selecting the early uart with "options EARLY_PRINTF=foo" in
the kernel configuration file. This allows us to not have to change
source files when enabling EARLY_PRINTF, simplifying enabling it.
New uart drivers can be enabled by defining a new early_printf_foo
value to be unique, then using "#if CHECK_EARLY_PRINTF(foo)" to decide
when to enable the uart.