John Baldwin [Thu, 29 Jun 2023 18:27:12 +0000 (11:27 -0700)]
bhyve: Fully reset the fwctl state machine if the guest requests a reset.
If a guest tries to reset the fwctl device while a pending request was
in flight, the fwctl state machine can be left in an incomplete state.
Specifically, rinfo is not cleared.
Normally the state machine for fwctl alternates between REQ (receiving
request) and RESP (sending response) and ignores port writes while in
RESP or port reads while in REQ. Once a guest completes the writes to
the port to send a request, the state machine transitions to RESP and
ignores future writes.
However, if a guest writes a full request and then resets the fwctl
device, the state would transition to REQ without draining the pending
response or discarding the received request. Instead, additional
port writes after the reset were treated as new payload bytes, but
were appended to the previously-received request and could overflow
the fget_str buffer.
To fix, fully reset the fwctl state machine if the guest requests a
reset.
admbugs: 998
Approved by: so
Reviewed by: markj
Reported by: Omri Ben Bassat <t-benbassato@microsoft.com>
Security: FreeBSD-SA-23:07.bhyve
Security: CVE-2023-3494
Eric van Gyzen [Tue, 25 Jul 2023 16:58:11 +0000 (11:58 -0500)]
proc_detach: use ptrace(PT_KILL) to kill the tracee
When MFC'ing commit dad11f990e2 to stable/12, the child would dump core
when dtrace exited. It was getting SIGTRAP, even though proc_detach
sent a SIGKILL. I could not find the reason for this difference in
behavior from main (and stable/13). The present change, however, works
as expected, probably due the proc_wkilled special case in kern_ptrace.
It also seems like a more obvious approach.
While I'm here, fix two other issues in the previous code:
It would SIGKILL a tracee even in read-only mode.
It would SIGSTOP/SIGCONT the tracee if ptrace succeeded but errno happened
to be EBUSY for some other reason.
Eric van Gyzen [Tue, 25 Jul 2023 16:59:07 +0000 (11:59 -0500)]
dtrace: do not overload libproc flags
dtrace stored its PR_RLC and PR_KLC flags in the proc_handle's flags,
where they collided with PATTACH_FORCE and PATTACH_RDONLY, respectively.
Thus, Psetflags(PR_KLC) effectively also set the PATTACH_RDONLY flag.
Since the flags are private to dtrace (at least on FreeBSD), store them in
dtrace's own dt_proc structure instead.
On FreeBSD, either PR_RLC or PR_KLC was always set, so remove code that
would handle the case where neither was set.
Eric van Gyzen [Tue, 25 Jul 2023 16:58:47 +0000 (11:58 -0500)]
dtrace: remove illumos code from dt_proc.c
The illumos #ifdef's in this file make it harder to read and maintain.
There is little change upstream, and increasing changes for FreeBSD.
Remove the illumos code with `unifdef`. The only manual changes here
are the #includes and #defines at the top, and removing blank lines.
Mark Johnston [Tue, 1 Aug 2023 14:11:23 +0000 (10:11 -0400)]
libdtrace: Explicitly set SHLIBDIR and SHLIB_MAJOR
They were previously being defined by cddl/lib/Makefile.inc, and as of
commit 4ae699122810 were being overridden by defaults in bsd.own.mk,
which changed SHLIBDIR to /usr/lib.
John Baldwin [Mon, 31 Jul 2023 20:24:44 +0000 (13:24 -0700)]
memdesc: Add routines for copying data to/from memory descriptors
These are modeled on the API used for m_copydata/m_copyback and the
crypto buffer APIs. One day it might be nice to reduce the
proliferation of these by adding cursors and using memdesc directly
for crypto request buffers.
tools/build: Work around broken Clang FreeBSD resource dir logic pre-13
Prior to Clang 13 (e.g. in the Clang 11 present in 13.0-RELEASE), the
resource directory logic for FreeBSD was broken and would not resolve
symlinks, meaning symlinks would only work if in a directory next to the
containing lib directory. Therefore we cannot even use a symlink for
worldtmp, we have to make a wrapper script that execs the real binary
via an absolute path.
Kevin Bowling [Mon, 31 Jul 2023 15:16:24 +0000 (08:16 -0700)]
e1000: Fix lem(4)/em(4) TSO6
* Fix TSO6 by specializing IP checksum insertion and following Intel SDM
values for IPv6.
* Remove unnecessary 82544 IP-bit handling
* Remove TSO6 from lem(4) capabilitities
Mark Johnston [Mon, 31 Jul 2023 14:44:32 +0000 (10:44 -0400)]
xargs tests: Disable the test added in commit eab91d008165
This test has been triggering OOM kills in CI runs since it triggers an
allocation of 16GB. Temporarily disable the test until the problem is
solved one way or another.
nvme(4): detect S3X NVMe controller in 2016-2017 MacBooks
Adds support for detection of the S3X NVMe controller found in the
13" MacBook Pro 2017 without Touch Bar (MacBook14,1)
It is known to be used in following MacBooks:
- Retina MacBook 2016 (MacBook9,1)
- 13" MacBook Pro 2016 without Touch Bar (MacBook13,1)
- 13" MacBook Pro 2016 with Touch Bar (MacBook13,2)
Doug Moore [Sun, 30 Jul 2023 20:12:06 +0000 (15:12 -0500)]
radix_tree: compute slot from keybarr
The computation of keybarr(), the function that determines when a
search has failed at a non-leaf node, can be done in a way that
computes the 'slot' value when keybarr() fails, which is exactly when
slot() would next be invoked. Computing things this way saves space in
search loops.
This reduces the amd64 coding of the search loop in vm_radix_lookup
from 40 bytes to 28 bytes.
Reviewed by: alc
Tested by: pho (as part of a larger change)
Differential Revision: https://reviews.freebsd.org/D41235
Mark Johnston [Sun, 30 Jul 2023 15:12:35 +0000 (11:12 -0400)]
amd64: Fix TLB invalidation routines in !SMP kernels
amd64 is special in that its implementation of zpcpu_offset_cpu() is not
the identity transformation, even in !SMP kernels. Because the pm_pcidp
array of amd64's struct pmap is allocated from a pcpu UMA zone, this
means that accessing pm_pcidp directly, as is done in !SMP
implementations of pmap_invalidate_*, does not work. Specifically, I
see occasional unexplicable crashes in userspace when PCIDs are enabled.
Apply a minimal patch to fix the problem. While it would also make
sense to provide separate implementations of zpcpu_* for !SMP kernels,
fixing it this way makes the SMP and !SMP implementations of
pmap_invalidate_* more similar.
Reviewed by: alc, kib
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D41230
Doug Moore [Sun, 30 Jul 2023 06:20:07 +0000 (01:20 -0500)]
radix_tree: redefine the clev field
The clev field in the node struct is almost always multiplied by
WIDTH; occasionally, it is incremented and then multiplied by
WIDTH. Instructions can be saved by storing it always multiplied by
WIDTH.
For the computation of slot(), this just eliminates a
multiplication. For trimkey(), where the caller always adds one to
clev before passing it as an argument, this change has the caller, not
the caller, do that. Trimkey() handles it not by adding WIDTH to the
input parameter, but by shifting COUNT, and not 1. That produces the
same result, and it relieves keybarr of the need to test to avoid
shifting by more than 63 bits, since level is always <= 63.
This takes 3 instrutions and 14 bytes out of the basic lookup loop on
amd64.
Reviewed by: kib
Tested by: pho (as part of a larger change)
Differential Revision: https://reviews.freebsd.org/D41226
Stefan Eßer [Sat, 29 Jul 2023 18:52:53 +0000 (20:52 +0200)]
usr.bin/gh-bc: fix Makefile for WITHOUT_NLS_CATALOGS case
Some macro definitions had been moved into a Makefile section
that depends on MK_NLS_CATALOGS != "no", leading to LTO and the
installation of tests being disabled in the WITHOUT_NLS_CATALOGS
case.
Kevin Bowling [Sat, 29 Jul 2023 01:14:29 +0000 (18:14 -0700)]
e1000: HWCSUM excemption fixes
Also disable IPV6 checksum offload.
Spell hw->mac.type < e1000_82543 as e1000_82542. Confusingly, chips
like 82540 and 82541 come later and do not have these issues. There
is no functional change here, as the enum was defined in such a way
it worked correctly. But this reads literally.
Warner Losh [Fri, 28 Jul 2023 18:11:21 +0000 (12:11 -0600)]
cam: Log errors from passthru commands
Since a30ecd42b8e09 we've logged almost all unexpected errors from
commands. However, some passthru commands were not logged via devctl. To
fix this, pass all requests through passerror (which calls
cam_periph_error), but flag those requests that didn't want error
recovery as SF_NO_RECOVERY, like we do for device probing. By doing this
we get identical behavior to the current code, but log these errors.
We have had hangs on drives that seems to show no error. Vendor analysis
of the drive found an illegal command that happen to hang the drive. In
verifying their analysis, we discovered that the pass through commands
from things like smartctl that encountered errors or timeouts weren't
logged.
Doug Moore [Fri, 28 Jul 2023 16:39:52 +0000 (11:39 -0500)]
Every path in a radix trie ends with a leaf or a NULL. By replacing
NULL (non-leaf) pointers with NULL leaves, there is a NULL test
removed from every iteration of an index-based search loop.
This speeds up radix trie searches by few percent. If there are any
radix tries that are not initialized with the init() function, but
instead depend on zeroing everything being proper initialization, this
will break those tries.
Reviewed by: alc, kib
Tested by: pho (as part of a larger change)
Differential Revision: https://reviews.freebsd.org/D41171
Mark Johnston [Fri, 28 Jul 2023 13:32:45 +0000 (09:32 -0400)]
arm64: Add constants for decoding ISS fields for WF* exceptions
WFI and WFIT trap to EL2 when executed in a vmm guest. (Currently
WFE/WFET are not configured to trap.) We only handle WFI at the moment,
so these constants are useful when handling the exception.
Reviewed by: andrew
MFC after: 1 week
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D41199
Andrew Turner [Thu, 6 Jul 2023 14:40:01 +0000 (15:40 +0100)]
arm64: Update the ID_AA64PFR1_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40896
Andrew Turner [Thu, 6 Jul 2023 14:02:35 +0000 (15:02 +0100)]
arm64: Update the ID_AA64PFR0_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40895
Andrew Turner [Thu, 6 Jul 2023 12:34:28 +0000 (13:34 +0100)]
arm64: Update the ID_AA64MMFR0_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40890
Andrew Turner [Thu, 6 Jul 2023 10:01:11 +0000 (11:01 +0100)]
arm64: Update the ID_AA64ISAR1_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40889
Andrew Turner [Thu, 6 Jul 2023 09:19:21 +0000 (10:19 +0100)]
arm64: Update the ID_AA64ISAR0_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40888
Andrew Turner [Mon, 13 Mar 2023 09:17:32 +0000 (09:17 +0000)]
arm64: Update the ID_AA64DFR0_EL1 fields
While here move to decimal for the _op and _CR definitions to be used
by a future macro to define the register when the assembler doesn't
know about it.
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D40887
mroute: avoid calling if_allmulti with the lock held
Avoid locking issues when if_allmulti() calls the driver's if_ioctl,
because that may acquire sleepable locks (while we hold a non-sleepable
rwlock).
Fortunately there's no pressing need to hold the mroute lock while we
do this, so we can postpone the call slightly, until after we've
released the lock.
This avoids the following WITNESS warning (with iflib drivers):
lock order reversal: (sleepable after non-sleepable)
1st 0xffffffff82f64960 IPv4 multicast forwarding (IPv4 multicast forwarding, rw) @ /usr/src/sys/netinet/ip_mroute.c:1050
2nd 0xfffff8000480f180 iflib ctx lock (iflib ctx lock, sx) @ /usr/src/sys/net/iflib.c:4525
lock order IPv4 multicast forwarding -> iflib ctx lock attempted at:
#0 0xffffffff80bbd6ce at witness_checkorder+0xbbe
#1 0xffffffff80b56d10 at _sx_xlock+0x60
#2 0xffffffff80c9ce5c at iflib_if_ioctl+0x2dc
#3 0xffffffff80c7c395 at if_setflag+0xe5
#4 0xffffffff82f60a0e at del_vif_locked+0x9e
#5 0xffffffff82f5f0d5 at X_ip_mrouter_set+0x265
#6 0xffffffff80bfd402 at sosetopt+0xc2
#7 0xffffffff80c02105 at kern_setsockopt+0xa5
#8 0xffffffff80c02054 at sys_setsockopt+0x24
#9 0xffffffff81046be8 at amd64_syscall+0x138
#10 0xffffffff8101930b at fast_syscall_common+0xf8
Warner Losh [Fri, 28 Jul 2023 04:21:44 +0000 (22:21 -0600)]
universe: Demote armv6 to an extra architecture.
Per discussions over how to lighten the load of armv6, move it to an
extra arch. You can still build TARGET_ARCH=armv6 if you desire, but
it won't be built as part of 'make universe' without -DEXTRA_TARGETS.
Warner Losh [Thu, 27 Jul 2023 22:05:29 +0000 (16:05 -0600)]
cam: Fail 2/0 asc/ascq return code
This asc/ascq code 2/0 ("No seek complete") is a fatal error on modern
drives indicating a sensor failure. One of our vendors noticed we
retried 2/0 so many times in their failure analysis and asked why (no
other OS else does). They've indicated that this failures means the
track couldn't be located (something that's not going to change, except
if the environment changes significantly, which won't happen on a
timescale useful to retries).
Pre-quote macros passed to .incbin to avoid unwanted substitution
Currently for the MFS, firmware and VDSO template assembly files we pass
the path to include with .incbin unquoted and use __XSTRING within the
assembly file to stringify it. However, __XSTRING doesn't just perform a
single level of expansion, it performs the normal full expansion of the
macro, and so if the path itself happens to tokenise to something that
includes a defined macro in it that will itself be substituted. For
example, with #define MACRO 1, a path like /path/containing/MACRO/in/it
will expand to /path/containing/1/in/it and then, when stringified, end
up as "/path/containing/1/in/it", not the intended string. Normally,
macros have names that start or end witih underscores and are unlikely
to appear in a tokenised path (even if technically they could), but now
that we've switched to GNU C as of commit ec41a96daaa6 ("sys: Switch the
kernel's C standard from C99 to GNU99.") there are a few new macros
defined which don't start or end with underscores: unix, which is always
defined to 1, and i386, which is defined to 1 on i386. The former
probably doesn't appear in user paths in practice, but the latter has
been seen to and is likely quite common in the wild.
Fix this by defining the macro pre-quoted instead of using __XSTRING.
Note that technically we don't need to do this for vdso_wrap.S today as
all the paths passed to it are safe file names with no user-controlled
prefix but we should do it anyway for consistency and robustness against
future changes.
This allows make tinderbox to pass when built with source and object
directories inside ~/path-with-unix, which would otherwise expand to
~/path-with-1 and break.
PR: 272744
Fixes: ec41a96daaa6 ("sys: Switch the kernel's C standard from C99 to GNU99.")
During a driver reload stress test, after 50-300 reloads a panic occurs.
After adding sleeps in between loading and unloading the driver, the
issue does not occur. It's possible that loading/unloading too fast may
cause the gt_taskqueue pointer to be freed earlier than expected;
checking for a null pointer first fixes it.
UFS/FFS: Migrate to modern uintXX_t from u_intXX_t.
As per https://lists.freebsd.org/archives/freebsd-scsi/2023-July/000257.html
move to the modern uintXX_t. While here also migrate u_char to uint8_t.
Where other kernel interfaces allow, migrate u_long to uint64_t.
No functional changes intended.
MFC-after: 1 week Sponsored-by: The FreeBSD Foundation
Val Packett [Thu, 27 Jul 2023 21:55:16 +0000 (14:55 -0700)]
mk: fix unnecessary library relinking with incremental builds
Initial libs such as csu are always built (.PHONY), and their
installation to WORLDTMP was causing all the subsequent libraries to
be considered out-of-date even when in reality they were not. Use
install -C more consistently everywhere to avoid unnecessarily
updating the mtimes in WORLDTMP, fixing this problem.
This cut down my no-change buildworld time from 30 to 15 seconds.
This option is a blanket for all the DTrace-related software. The option
when enabled passes in -fsanitize=address -fsanitize=undeifned, enabling
ASAN and UBSAN in the following components:
Mark Johnston [Mon, 17 Jul 2023 13:34:57 +0000 (09:34 -0400)]
kmsan: Use the correct origin bytes in kmsan_check_arg()
Upon discovering a violation kmsan_check_arg() passes a pointer to
function parameter shadow state to kmsan_report_hook().
kmsan_report_hook() uses that address to find the origin cells, assuming
that the passed address belongs to the kernel map. This has two
problems:
1) Function parameter origin state is also located in TLS, not in the
origin map, but kmsan_report_hook() doesn't know this.
2) KMSAN TLS for thread0 is statically allocated and thus isn't shadowed
(because the kernel itself is not shadowed).
These bugs could result in inaccuracies in KMSAN reports, or a page
fault when trying to report a KMSAN violation (which by default panics
the kernel anyway).
Fix the problem by making callers of kmsan_report_hook() provide a
pointer to origin cells.
Mark Johnston [Thu, 27 Jul 2023 19:44:52 +0000 (15:44 -0400)]
opencrypto: Respect alignment constraints in xor_and_encrypt()
Copy operands to an aligned buffer before performing operations which
require alignment. Otherwise it's possible for this code to trigger an
alignment fault on armv7.
Mark Johnston [Thu, 27 Jul 2023 19:44:00 +0000 (15:44 -0400)]
arm/unwind: Check stack pointer boundaries before dereferencing
If the unwinder somehow ends up with a stack pointer that lies outside
the stack, then an attempt to dereference can lead to a fault, which
causes the kernel to panic again and unwind the stack, which leads to a
fault...
Add kstack_contains() checks at points where we dereference the stack
pointer. This avoids the aforementioned infinite loop in one case I hit
where some OpenSSL assembly code apparently confuses the unwinder.
Makefile.inc1: Reinstate kbdcontrol bootstrap for BUILD_WITH_STRICT_TMPPATH
During BUILD_WITH_STRICT_TMPPATH builds we need to symlink the host's
kbdcontrol into WORLDTMP/legacy/bin so that it can be used. For
completeness, also check if the host has it, since technically the host
could have been built with WITHOUT_LEGACY_CONSOLE (though given nobody's
screamed since this code was removed that's likely not something that
gets hit in practice), and handle BOOTSTRAP_ALL_TOOLS (especially since
that case will cover cross-building if and when kbdcontrol can be built
on non-FreeBSD).
This allows a BUILD_WITH_STRICT_TMPPATH tinderbox to pass.
etcupdate: Use new buildetc and installetc targets when available
These new targets avoid the need to invoke internal build system targets
or set internal variables when building, and also have the added benefit
of working with BUILD_WITH_STRICT_TMPPATH. Old source trees lacking such
targets will not work with BUILD_WITH_STRICT_TMPPATH; they could be made
to work by copying the steps, but it's not worth doing so, as they never
have worked in the past. The primary goal of this is to support changing
the default of BUILD_WITH_STRICT_TMPPATH to enabled.
Makefile.inc1: Add new buildetc and installetc targets
These implement the steps that etcupdate (and mergemaster) need in order
to build their pristine trees, avoiding the need to use internal targets
and variables. Additionally, buildetc includes the steps needed to build
with BUILD_WITH_STRICT_TMPPATH enabled, since we need some host tools to
be available during the various build and install steps.
etcupdate: Consolidate nobuild cases and make more robust
The distrib-dirs and distribution steps are shared between the two, the
only difference is whether MAKEOBJDIRPREFIX is in the environment for
the latter. Having in the environment for the former is currently not
needed but does no harm and will be needed in future, so we can just
export it up-front in the subshell. When we do distrib-dirs relative to
_obj and everything also doesn't matter, so move it next to distribution
where it makes more sense. Finally, to avoid complicated && chains, use
"|| exit 1" everywhere to make the subshell fail, and add an extra one
on to the cd $SRCDIR to handle that failing (otherwise we'd go on and
try to build the current directory after cd prints its error, which is
unhelpful).
These changes will make it easier to bundle these steps up into new
top-level targets to allow the build system to manage the steps rather
than etcupdate, which will also handle BUILD_WITH_STRICT_TMPPATH, which
currently does not work with etcupdate.
Makefile.inc1: Split _cleanworldtmp out from _worldtmp
This mirrors _cleanobj vs _obj, and will be used by etcupdate to ensure
its build tree has host tools available when BUILD_WITH_STRICT_TMPPATH
is enabled by default (whether in the source tree, like CheriBSD, or in
a system config file).
Note that due to line length the .MAKE .PHONY dependency line is split
into two, one for the filtered WMAKE_TGTS and one for the filtered
.ALLTARGETS.
tools/build: Create toolchain symlinks for non-absolute compiler/linker
If any of the toolchain variables are not absolute then we need to
create a symlink in WORLDTMP/legacy/bin in order to make them available
during a BUILD_WITH_STRICT_TMPPATH build.
depend-cleanup.sh: Generalise lib32 code and avoid duplication
By passing through _ALL_libcompats we can avoid hard-coding the list of
libcompats in depend-cleanup.sh. This cleanup also makes clean_dep
shorter by using a loop instead of handling each case explicitly (at the
expense of slightly tweaked logging).
Note that the pattern for matching is made slightly more specific, so as
to permit libcompats where one is a prefix of another (e.g. CheriBSD has
lib64 and lib64c).
libexec: Automatically generate rtld-elf list and generalise TAGS
Note that the pattern for matching is made slightly more specific, so as
to permit libcompats where one is a prefix of another (e.g. CheriBSD has
lib64 and lib64c).
Older entries in this file are left alone as hard-coding lib32 as
they're not worth the churn; downstreams will have already moved past
them (in particular, CheriBSD, which adds additional libcompats).
bsd.compat.mk Extract _ALL_LIBCOMPATS and add related variables
Adding these to a new bsd.compat.pre.mk will allow other parts of the
tree to iterate over the set of possible libcompats (upper and/or lower)
rather than having to hard-code the list.
projects / FreeBSD / FreeBSD.git / log