The RACK stack's path capacity measurement module maintains an array of
samples, updated when the stack receives an ACK. The array grows as
needed, but code which handles the expansion is susceptible to remotely
triggerable overflow. This could lead to underallocation and a ~512KB
out-of-bounds write.
Fix this by bounding the sample array size.
Approved by: so
Security: FreeBSD-SA-26:70.tcp
Security: CVE-2026-101307
Reviewed by: glebius, markj
Reported by: Nozomi Networks Security Research
vmm doesn't implement them, and after commit 2272fac218
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
hdaa_audio_setup() reads the converter widget's ELD when choosing
between HDMI and DisplayPort audio infoframes. ELD is stored on the
output pin, so the converter has no ELD and the driver selects HDMI
framing even when the connected display uses DisplayPort.
Read the ELD from the output pin to select the correct audio framing.
The equivalent change was tested on DragonFly BSD with an Intel Kaby
Lake display-audio codec and an LG HDR 4K monitor connected over
DisplayPort. Before the change, converter node 2 had no ELD, while
output pin 5 had an 83-byte ELD identifying DisplayPort. Captured driver
commands programmed HDMI audio infoframe bytes (84 01 0a 70 01 00 00
00). After applying the change and rebooting, the commands used the
existing DisplayPort form (84 1b 44 01 00 00 00), and console tones and
desktop audio were audible.
PR: 299094
Signed-off-by: David Bidner <[email protected]>
Reviewed by: christos
MFC after: 2 weeks
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2463
epoch_drain_callbacks() bound the calling thread to each CPU in turn
to queue a callback on that CPU's record. Callers are often user
threads, such as kldunload or ifconfig destroy, and ULE does not
preempt a CPU-bound thread for a migrating thread of no better
priority, so each bind could wait out a time slice. On an 8-CPU VM
with six busy loops running, destroying an epair interface took 1.5 s
and kldunload pflow 0.8 s.
Instead, set a request flag on each record and enqueue that CPU's
callback task, which queues the callback before it polls the record.
The task runs on the CPU's softirq gtaskqueue thread at PI_SOFT, which
preempts a busy user thread, so the request is served at once; the
caller no longer migrates. Both operations now take under 10 ms, idle
or under load.
Reviewed by: markj
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60646
Cover the interface identifier selection in in6_ifadd(): a /64
link-local address provides the identifier, while a /128 link-local
address or no link-local address at all yields the EUI-64 identifier
derived from the MAC address. Each case asserts the exact
autoconfigured address. ndp_prefix_len_mismatch reaches the same
fallback with a /127 link-local address, but only checks that some
address was configured.
Stable addresses (RFC 7217) are the default and bypass both paths, so
the host disables them. The advertisement goes to all nodes, and an
interface only joins that group with its first address, so the case
without a link-local address gives the host a static address from
another prefix.
ra.py now takes the Ethernet source address from --sendif rather than
from a route lookup; for ff02::1 that lookup fails in scapy 2.7.0.
Reviewed by: pouria
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60520
The setting of _TTY ran afoul of set -e.
Also the handling of Myname blew up if debug.sh included by
a login sheel (eg in .profile).
For non-posix shell, leave false alone if it is a builtin.
Complete the controls with -v "values":
sh ./safe_eval.sh set_var -a "knob" -v "no yes" knob=yes knob=no knob=ok ok=yes
knob=yes
knob=no
denied value 'ok' for 'knob'
denied variable 'ok'
Packets decapsulated by a tunnel interface carry the NIC's flowid
computed over the outer tunnel tuple, which is the same for every
flow a peer carries. Therefore mpath nhop selection places all
traffic on one path.
Add encap_set_flowid() to ip_encap.c, which rehashes a decapsulated
IP packet on its inner addresses.
The feature is off by default and is enabled with the per-vnet
net.route.hash_inbound sysctl.
Reviewed by: gallatin
Differential Revision: https://reviews.freebsd.org/D60552
The PowerPC context switch waited for the incoming thread to leave
blocked_lock before releasing the outgoing thread. If two CPUs selected
each other's running threads concurrently, both CPUs waited for the
other to perform the release and neither could progress. This appeared
as intermittent boot hangs under QEMU MTTCG when taskqueue threads were
bound to opposite CPUs.
8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
attempted to fix the same hang by moving isync into the polling loop.
That did not address the circular wait: isync cannot cause either CPU to
execute the release store after the loop. It only added context
synchronization to failed iterations and changed timing. Move isync back
to the successful exit, which preserves acquire ordering for subsequent
context loads.
Match the ordering used by other architectures: publish the outgoing
thread's new lock before waiting for the incoming thread. Apply the
correction to both 32-bit and 64-bit switch paths.
The 2015 change moved the release after the stack switch because the old
implementation continued through pmap_activate() and optional state
restoration on the outgoing thread's stack after making that thread
runnable. The switch path has since changed: after the release it only
polls wired td_lock state using registers, then immediately loads the
incoming PCB_SP before updating per-CPU state or making any calls.
cpu_switch() also runs with external and decrementer interrupts disabled
by spinlock_enter(). Thus this does not restore the post-release call
window that the 2015 change corrected.
Reviewed by: jhb, jhibbits
Approved by: jhb (mentor)
Fixes: 53607fe3cc ("Fix an extremely subtle concurrency bug...")
Fixes: 7a49d964d3 ("Merge r278429 from ppc64:")
Fixes: 8df2e54214 ("powerpc: put the isync inside the TD_LOCK()...")
MFC after: 2 weeks
Sponsored by: FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59742
Move back to the current committers section and record acm and dtxdf
as mentors.
Approved by: dtxdf (mentor)
Differential Revision: https://reviews.freebsd.org/D60683
linux stores mount id as a int32_t, using xor would make it becomes
negative in some cases. As a result, we cap the value to INT_MAX to
prevent getting a negative value from userspace.
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59202
LIBPTHREAD_QUEUE_FIFO is used in bitwise offset, we set the limit to
0~31 so that it won't cause undefined behavior. Also, create a new
helper function to do getenv++strtol directly and check the boundary of
the valid value.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60487
pf_modevent() registers the generic netlink family at MOD_LOAD, before
vnet_pf_init() has set up the state hashes and locks the handlers use,
and pf_unload() unregisters it after vnet_pf_uninit() has torn them
down. Sending PFNL_CMD_GETSTATES while pf loads or unloads panics in
pf_handle_getstates() on a NULL or freed V_pf_idhash.
Register the family from a SYSINIT ordered after vnet_pf_init(), and
unregister it from the matching SYSUNINIT, before vnet_pf_uninit().
Reviewed by: kp
Fixes: 2cef62886d ("pf: convert state retrieval to netlink")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60651
pf_hash_pool() hashes the first address of a pool as a whole struct
pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr
or pfr_ktable pointer.
An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on
every load, so with "set keepcounters" the rule never matches its
predecessor and loses its counters on every reload. The pointers also
differ between hosts: once a filter rule in the main ruleset has an
interface or table pool, pfsync peers disagree on the ruleset checksum
and bind every synced state to the default rule.
Hash the address with that union cleared. The rest of the address,
including the prefix length of an interface address, is hashed as
before, and the hash of a rule with a plain address pool does not
change.
Reviewed by: kp
Fixes: c6bcf6e6fd ("pf: include all elements when hashing rules")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60370
Lid state changes are only published to userland, via devd and evdev.
Drivers that need to react to the lid in the kernel have no hook, so
they end up installing a second ACPI_DEVICE_NOTIFY handler on the same
lid object and reimplementing the _LID evaluation.
Add acpi_lid_event, invoked from acpi_lid_status_update() alongside the
existing devd notification, carrying the new state (1 open, 0 closed).
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D60704
Increase wait timeout as needed for slower systems.
It takes ~120ms on the Codasip Prime for the MGB_PHY_READY bit
to set after phy reset command issued.
Reviewed by: emaste
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D60706
Add support for Microchip PCI11414 Gigabit Ethernet Controller.
The PCI11414 is used on the CHERI VITA 57.1 PCIe Extension Board.
- Add PCI11414 device ID
- Add support for SGMII mode. Read the programmed strap configuration
and enable SGMII operation when configured. Bypass the MII interface
in SGMII mode.
- Increase the DMA descriptor ring size.
Reviewed by: emaste
Sponsored by: EPSRC ("UKRI3001: CHERI Research Centre")
Differential Revision: https://reviews.freebsd.org/D60539
Linux allows 0 as a signal for rt_sigqueueinfo(2) the same as it does
for kill(2). This is used to check for process existence and
permissions.
Allow this value through as a special case in linux_rt_siqgueueinfo the
same way as was done for linux_kill.
Before this change, lio_listio(3) would fail with EINVAL under
Linuxulator. Now it is functional.
MFC after: 1 week
Reviewed by: kevans
Approved by: kevans (mentor)
Differential Revision: https://reviews.freebsd.org/D60574
Fix all pointer-sign warnings generated when compiling libifconfig.
A couple more snuck in while the previous batch of fixes was landing.
Fixes: 963f1a5455 ("ifconfig: add CMIS support for 400GbE optics")
Reviewed by: kevans
Approved by: kevans (mentor)
Differential Revision: https://reviews.freebsd.org/D60573
Implement the debugnet KPI in rge(4) by mirroring the re(4) pattern.
Tested with a RTL8125 2.5GbE NIC.
Approved by: adrian
Differential Revision: https://reviews.freebsd.org/D60135
When an ICMPv6 query or reply matches a translated state,
pf_test_state_icmp() copies the state's virtual id into icmp6_id. Only
echo messages have an identifier there. For all other types the
virtual id is 0 and those two bytes hold something else; in a neighbour
advertisement they hold the R, S and O flags. The checksum was not
updated either, so icmp6_input() dropped the advertisement as a bad
checksum.
Unicast NUD probes to a link-local neighbour, such as the default
router, are sent from the link-local address. With a nat rule that
matches it (e.g. "from any"), every advertisement answering a probe was
dropped: NUD failed, the neighbour cache entry was deleted, and traffic
to the neighbour stalled until it was resolved again.
Only rewrite the id of echo messages, as the ICMPv6 error path already
does, and update the checksum, as the IPv4 path does.
Add a regression test.
Reviewed by: kp
Fixes: f1ddd7f1da ("pf: add forgotten fixup for icmp6 id's when translating")
See also: https://redmine.pfsense.org/issues/16236
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60542
All communication between auditdistd senders and receivers and
internally between auditdistd and its worker children passes through the
same pair of send / receive functions. The receive function uses
recv(2) with the MSG_WAITALL flag, which in theory means we should never
get a short read. However, when handing off a socket to a worker child,
we also pass a variable-length string identifying the type of socket
we're passing, and reading this string relies on a short read. This
used to work because the arrival of the descriptor would interrupt the
recv(2) call, but this bug was fixed when the AF_UNIX code was rewritten
a while ago and auditdistd has been broken ever since.
Fixing the length of the protocol name to four characters including the
terminating null solves the short-read bug by never requiring a short
read (nothing else in auditdistd requires one).
PR: 296107
MFC after: 1 week
Reviewed by: js, kevans
Differential Revision: https://reviews.freebsd.org/D59565
pfr_insert_kentry() returned the error of pfr_route_kentry() and
leaked the entry it had created; pfr_insert_kentries() stopped at the
first entry it could not route and leaked it and the rest of the work
queue, which no caller frees. Destroy an entry that cannot be routed
and go on with the next.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60532
Before and after DMA operations we need memory barriers to ensure
stores on the CPU are observed by the device, and stores by the device
are observed by the CPU.
Previously we used a "dsb sy" instruction, however this is too strong
and can lead to slower performance.
Drew Gallatin found and tested the issue with cache-coherent devices,
reducing the barriers to dmb instructions in the outer-shareable
domain. After discussing the issue with the Arm Linux DMA maintainer I
concluded it was safe for non-coherent devices as the only dsb
instructions we need are after cache operations and these already exist.
Replace the dsb before DMA with a "dmb oshst" when cache-coherent, or
the existing dsb after invalidating the cache when not coherent. This
ensures earlier stores have completed before we signal the device.
Replace the dsb after DMA with "dmb oshld" in both cases. This ensures
later loads or stores are ordered after earlier device register loads.
Co-Authored-By: Andrew Gallatin <[email protected]>
Sponsored by: Arm Ltd
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60407
For certain instructions like msr, mrs, ldr & str, Rt=31 means the
operand is the Zero register (XZR) as opposed to the SP, even though the
two share the encoding of 31 on AArch64.
This is currently ignored in register and instruction emulation, so
emulated guest operations like "msr <reg>, xzr" will set the value of
<reg> to the current value of the SP instead of to 0.
Skip set and get operations when Rt=31 to correct the behaviour.
Signed-off-by: Kajetan Puchalski <[email protected]>
Reviewed by: andrew
Sponsored by: Arm Ltd
Pull Request: https://github.com/freebsd/freebsd-src/pull/2454
Changing the layout of the pkthdr requires external drivers
to be rebuilt, lest they access the wrong fields.
Sponored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60691
When the leaf_rcv union was introduced to support ktls RX offload in
4d88d81c31 it was put at the front of the pkthhdr, and pushed the
more commonly accessed csum_flags and rsstype into the next cacheline.
Given that csum_flags is accessed on every pkt sent and every pkt freed,
but the leaf_rcv fields are only used for ktls rx offload, it makes more
sense to have csum_flags in a cacheline that is already likely to be hot.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D60691
Sponsored by: Netflix
The GETSTATES dump sends PF_ST_ID as a u64, but the request parser
reads it as a u32 and rejects an id taken from the dump with EINVAL.
Nothing in base sends PF_ST_ID. Parse and document it as a u64.
Reviewed by: kp
Fixes: 2cef62886d ("pf: convert state retrieval to netlink")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60543
The kernel sends PF_STP_MAX_WIN and PF_STP_MSS for both peers of a
state, but struct pfctl_state_peer has no fields for them and libpfctl
dropped them. Add the fields and parse the attributes.
Reviewed by: kp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60544
powerpc has no 16-bit acquire/release atomics, so the
atomic_load_acq_16() and atomic_store_rel_16() calls on the MPC TX
ring indices fail to build there. Make the producer and consumer
indices 32 bits wide and use the 32-bit primitives.
Reviewed by: gallatin, chandrakanth.patil_broadcom.com
Sponsored by: Broadcom Inc
MFC after: 1 week
Fixes: 088a42c0ff ("if_bnxt: add MPC (Mid-Path Channel) ring infrastructure")
Differential Revision: https://reviews.freebsd.org/D60698
DIOCSETREASS stored V_pf_status.reass twice with no lock, first the
flags it was given and then, if reassembly was not among them, zero.
pf_normalize_ip() and pf_normalize_ip6() read the flags with the rules
lock held for reading, so a packet could see the intermediate value.
Compute the flags first and store them once, with the rules lock held
for writing, as DIOCSETDEBUG and DIOCSETHOSTID do.
Reviewed by: kp
Fixes: 39282ef356 ("pf: backport OpenBSD syntax of "scrub" option for "match" and "pass" rules")
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60531
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
ndp_prefix_len_mismatch exercises the fallback in in6_ifadd() for an
interface whose link-local address does not have the advertised prefix
length (9e792f7ef7). Since a2eb0894b7 made stable addresses
(RFC 7217) the default, in6_ifadd() takes the interface identifier from
in6_get_stableifid() and never looks at the link-local address, so the
case passes without reaching the fallback. Turn stable addresses off
on the interface.
Sponsored by: Rubicon Communications, LLC ("Netgate")
The IRPERF MSR counter (0xc00000e9) exposes an instructions-retired count
when read. Its support is advertised through CPUID leaf 0x80000008 EBX bit 1.
If this bit is set, the CPU supports the IRPERF MSR. For it to be used
by the system, bit 30 of the HWCR MSR (0xC0010015) needs to be enabled.
This patch checks for availability of the feature and enables the bit. If
the feature is available, the hwpmc PERF class detects its presence and
registers a third PERF MSR counter that allows hwpmc users to measure
instructions retired using IRPERF. This is AMD-only, as Intel does not
support IRPERF.
Due to erratum #1054 affecting AMD Zen 1 before model 30h, IRPERF is only
enabled for AMD Zen 1 model 30h onwards and later microarchitectures. This
commit also implements a validation step to make sure the IRPERF counter
is actually incrementing; otherwise, the feature is not enabled. This
guarantees it is working as expected before being made available to the
system and users.
To support this, the perf_pmcdesc[] structure changed from being
statically initialized with 2 entries (MPERF/APERF) to being populated
dynamically. If both MPERF/APERF and IRPERF are supported, the structure
will contain three entries: MPERF, APERF, and IRPERF. Each entry now also
carries its own MSR address and PMC event, so perf_read_pmc() reads the
MSR to use from the matching perf_pmcdesc[] entry at runtime instead of
switching over a fixed set of row indices.
Definitions for the features available on the HWCR MSR did not previously
exist. This commit adds macros for those features, including
HWCR_IRPERFEN. The MSR definition for MSR_IRPERF was also missing and has
now been added.
This commit also updates the manual page accordingly.
Signed-off-by: Anderson Nascimento <[email protected]>
Reviewed by: mhorne, adrian
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D59554
In '398254f9999e mbuf: simplify m_free' we removed tag processing
on m_free() of M_NOFREE mbufs. It is possible that a packet filter
could attach a tag to this stack mbuf and call m_free()
on it, meaning that 398254f999 may have introduced a tag leak.
However,if a tag is attached without anyone calling m_free(), then
this leak was pre-existing.
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D60686
Fixes: 398254f999
Sponsored by: Netflix
Michael Tuexen