Commit Graph

253941 Commits

Author SHA1 Message Date
maxv 1fe402e2a1 Always mask the 16 bits of the segregs in the trapframe. We don't zero-
extend the uint64_t's when building it, so we're leaking 48 bits of kernel
stack to userland.

Having said that, it appears that I unintentionally fixed most of this
issue in locore.S::rev1.127 - by building the frame with interrupts
disabled, we are implicitly guaranteeing that the structure doesn't get
overwritten by the kernel. Which means, we are leaking to userland data
that comes from userland anyway.

(still other places with this issue, but I'll fix them differently)
2017-10-19 10:01:09 +00:00
maxv 20f14b034c Make sure we don't go farther with 32bit LWPs. There appears to be some
confusion in the code - in part introduced by myself -, and clearly this
place is not supposed to handle 32bit LWPs.

Right now we're returning EINVAL, but verily we would need to redirect
these calls to their netbsd32 counterparts.
2017-10-19 09:32:01 +00:00
knakahara d71c6de37e fix vlan panic when vlan is re-configured without destroy.
E.g. the following operation causes this panic.
    ====================
    # ifconfig vlan0 create
    # ifconfig vlan0 vlan 1 vlanif ixg3
    # ifconfig vlan1 create
    # ifconfig vlan1 vlan 1 vlanif ixg2
    # ifconfig vlan1 -vlanif
    # ifconfig vlan1 vlan 1 vlanif ixg2

    panic: kernel diagnostic assertion "new->ple_next == NULL" failed: file "/git/netbsd-src/sys/sys/pslist.h", line 118
    ====================

Pointed out and tested by msaitoh@n.o, fixed by s-yamaguchi@IIJ, thanks.

XXX need pullup-8
2017-10-19 07:02:00 +00:00
msaitoh 8427810e88 Add the following bits in AMD Fn8000000a %edx features (SVM features):
PFThreshold (PAUSE filter threshold)
	AVIC (AMD virtual interrupt controller)
	V_VMSAVE_VMLOAD (virtualized VMSAVE and VMLOAD)
	vGIF (virtualized GIF)
2017-10-19 06:29:16 +00:00
msaitoh 2cc66b4771 Fix a bug that the TPH ST table is decoded even if it's not in the TPH
Requester extended capability structure.
2017-10-19 05:52:57 +00:00
skrll 2307aa9b6a Fix RCSIds 2017-10-19 05:45:37 +00:00
skrll 2f93eddcf8 KASSERT -> KASSERTMSG and while I'm here update a comment 2017-10-19 05:39:22 +00:00
nonaka b593b49cd1 external/lgpl3/gmp build fail in configure phase with "ln -s J /etc/malloc.conf".
patch from pkgsrc/devel/gmp
  http://mail-index.netbsd.org/pkgsrc-changes/2017/06/15/msg158404.html
2017-10-19 03:26:28 +00:00
msaitoh 4a84e4a57f Update from Intel SDM:
0x55: Xeon Scalable (Skylake)
 0x57: Xeon Phi [357]200 (Knights Landing)
 0x66: Future Core (Cannon Lake)
 0x85: Future Xeon Phi (Knights Mill)
2017-10-19 03:09:55 +00:00
kre bffe519047 Re-factor the code that extracts status from exited jobs, avoiding
code duplication, and reducing the size of /bin/sh by a trivial amount.

NFCI.

This is being done now as there are two other changes forthcoming, both
of which benefit - one would result in even more code duplication without
this, the other might need to alter how this is done, and doing it after this
means there's just one place to change (if required).
2017-10-19 01:57:18 +00:00
ozaki-r 7107584815 Turn on D_MPSAFE flag of bpf_cdevsw that is already MP-safe
Pointed out by k-goda@IIJ
2017-10-19 01:57:15 +00:00
wiz 14b00a757c Remove unnecessary Tn. 2017-10-18 18:11:54 +00:00
maxv bf5a5b0bda If a branch is already there, use it and don't create a new one. This way
we can call mm_map_tree twice with neighboring regions.
2017-10-18 17:12:42 +00:00
maxv e1daa555fd Group the sections into segments, and align to KERNALIGN only between
segments. Prerequisite for other changes. Unfortunately the code is not
very compact, but whatever.
2017-10-18 16:29:56 +00:00
jmcneill cadc6bb824 Match BUFFALO CEWL-1 (Sony UWA-BR100 WLAN) 2017-10-18 16:01:58 +00:00
jmcneill 030d0c3789 regen 2017-10-18 16:01:21 +00:00
jmcneill d8660ee7d1 Add Sony UWA-BR100 WLAN adapter 2017-10-18 16:00:53 +00:00
macallan 706f5de2be do what freebsd does:
- when disabling an interrupt, disable it on the HT PIC as well
- when establishing an interrupt, don't enable it right away
- program IRQs 0-3 as level, like freebsd does
Now svwsata is almost usable. We still get an interrupt storm but it doesn't
eat up all CPU cycles anymore.
2017-10-18 12:55:14 +00:00
msaitoh 3c7d057a21 Protect ec_multi* with mutex like other MP safe Ethernet drivers.
See if_ether.h rev. 1.66 and related stuff:
http://mail-index.netbsd.org/source-changes/2016/12/28/msg080289.html
2017-10-18 10:43:32 +00:00
kre 9bbf3fccba I have seen (way too often) uses of test(1) that are not defined to
actually work (but just happen to, today, and in some cases, even
that trusts to some luck.)

It has been recently pointed out to me that the man page (ie: this
file) doesn't give any real guidance to what is really acceptable,
and what is not.

The CAVEATS section does note that the grammar is ambiguous, but then
just says that test(1) implements what POSIX requires, and refers
readers to the relevant section of the POSIX standard for more details.
That is probably asking too much of the average reader...

So, add some extra information in the CAVEATS with what is defined to work,
and what should be avoided.   Not all of the POSIX rules are here, but this
might hopefully help script authors avoid some of the pitfalls.
2017-10-18 08:54:59 +00:00
jdolecek bc37d5c3ea add newlines to the debug messages 2017-10-18 08:38:35 +00:00
msaitoh 96bdde7969 Add Turbo Boost Max Technology 3.0 bit. 2017-10-18 03:38:32 +00:00
pgoyette 00e42ae268 Typo: s/processes/process's/ for possession 2017-10-17 21:11:36 +00:00
rjs 01b82b52c9 Make SCTP work when IPSEC is also defined. 2017-10-17 19:23:42 +00:00
rjs a6a6d8236d Move call to sofree() to end of sctp_inpcb_free() and re-aquire
softnet_lock.

Logic copied from in_pcb.c.
2017-10-17 19:18:30 +00:00
jdolecek 2ee262ca2c reintroduce ATACH_IRQ_WAIT flag for attachments using wdcintr(), only
process the interrupt when the flag is set - this fixes spurious interrupt
during post-reset drive setup in wdc_ata_bio_start(), and wdc_atapi_start()

while those functions set WDCTL_IDS, this seems to be ignored by certain
(maybe all) PCI-IDE controllers; usually the implicit KERNEL_LOCK() would
prevent the interrupt anyway, but not when the start routine is started
from the atabus thread, which doesn't take it

fixes 'panic: wdc_ata_bio_intr: bad state' reported on current-users
by Chavdar Ivanov
2017-10-17 18:52:50 +00:00
jdolecek fc3dcf85cb no need to clear DMA WAIT flag in mvsata_edma_handle(), it's not needed
by atabus layer
2017-10-17 16:24:14 +00:00
skrll 4d29dcf4b2 Fix eva argument to pmap_remove and passed prot bits in flags for
pmap_enter, i.e. fix previous.
2017-10-17 16:23:50 +00:00
rjs ff49eadede Set SPL level to match usage for TCP. 2017-10-17 16:07:18 +00:00
rjs f7f68e9d8d Remove duplicate assignment, comment doesn't match it anyway. 2017-10-17 15:53:01 +00:00
rjs 3fb7470622 Remove some foreign conditional code. NFC intended. 2017-10-17 15:49:00 +00:00
rjs b08ca904df Wrap pcb list check with #ifdef DEBUG. 2017-10-17 15:02:31 +00:00
rjs e331dc9cec Remove function prototype that is no longer required. NFC 2017-10-17 14:53:23 +00:00
msaitoh 798eec36f8 Update from the latest Intel SDM:
0x5c: Atom (Goldmont)
 0x5f: Atom (Goldmont, Denverton)
 0x7a: Atom (Goldmont Plus)
2017-10-17 14:48:42 +00:00
maxv 031660d47b Move %ds and %es into the GDT on 64bit LWPs. 2017-10-17 07:48:10 +00:00
maxv aa64020b8e Have the cpu clear PSL_D automatically when entering the kernel via a
syscall. Then, don't clear PSL_D and PSL_AC in the syscall entry point,
they are now both cleared by the cpu (faster). However they still need to
be manually cleared in the interrupt/trap entry points.
2017-10-17 07:33:44 +00:00
ozaki-r a05a27d7e6 Fix buffer length for ipsec_logsastr 2017-10-17 07:23:08 +00:00
ozaki-r 37c5cac096 Don't setup SPs if no policy sepecifier is specified
We expect that SPs are set up iff some policy sepecifier(s) are specified.

Found on investigating an issue reported by Robert Swindells
2017-10-17 07:13:19 +00:00
maxv b91671f97b fix comment, rdx, not edx 2017-10-17 07:02:50 +00:00
maxv 41713064f0 Add support for SMAP on amd64.
PSL_AC is cleared from %rflags in each kernel entry point. In the copy
sections, a copy window is opened and the kernel can touch userland
pages. This window is closed when the kernel is done, either at the end
of the copy sections or in the fault-recover functions.

This implementation is not optimized yet, due to the fact that INTRENTRY
is a macro, and we can't hotpatch macros.

Sent on tech-kern@ a month or two ago, tested on a Kabylake.
2017-10-17 06:58:15 +00:00
maya 5dceac39a7 Update protocol reverse engineering URL to a working one
only mention it once.

From openbsd by Seth Jackson
2017-10-17 06:50:00 +00:00
maya 6f49444b54 Check that the host supports GET_SPEED as well as GET_VERSION
before deciding vmt_probe has succeeded.

qemu supports GET_VERSION but not the RPC protocol so the probe succeeds
but the attach fails, resulting in "vmt0: failed to open backdoor RPC
channel (TCLO protocol)".  All known versions of vmware support GET_SPEED
and no known qemu versions do, so this prevents it from attempting to
attach (and failing) on qemu while still working on vmware.

stop checking vmt_type to avoid having to adapt this code.

- Taken from openbsd
2017-10-17 05:47:09 +00:00
maya 10f56c9348 Explain our implementation choice for implementation-defined values 2017-10-17 00:26:35 +00:00
christos c9c3919a67 simplify previous. 2017-10-16 17:52:10 +00:00
spz f48fb7bb9f apply patches from upstream, namely from https://w1.fi/security/2017-1/ :
rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch	02-Oct-2017 16:19 	6.1K
rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch	02-Oct-2017 16:19 	7.7K
rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch	02-Oct-2017 16:19 	6.7K
rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
02-Oct-2017 16:19 	2.5K
rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
02-Oct-2017 16:19 	1.9K
rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
02-Oct-2017 16:19 	4.2K
rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch	02-Oct-2017 16:19 	1.6K
rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch	02-Oct-2017 16:19 	2.7K

for CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080
 CVE-2017-13081 CVE-2017-13082 CVE-2017-13086 CVE-2017-13087 CVE-2017-13088

(see
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
for details)
2017-10-16 17:36:16 +00:00
jnemeth 869f53c4eb typo: unvalid -> invalid 2017-10-16 17:08:35 +00:00
christos e97f745b4f revert; this is section 9 and userland headers are not available in kernel
context.
2017-10-16 15:48:14 +00:00
bouyer 3fd50a1c81 We KASSERT((fregs->vfp_fpexc & VFP_FPEXC_EN) == 0) just before, so
enabled is always false. remove.
2017-10-16 15:13:00 +00:00
bouyer 36e1796fa5 In the REENABLE case, make sur the fpexc copy in the pcb also has
VFP_FPEXC_EN set. Otherwise we could trap on every context switch even if
the CPU already has the VFP state.
2017-10-16 15:08:24 +00:00
bouyer d4ce271380 PR port-arm/52603:
There is a race here, as seen on arm with FPU:
LWP L is running but not on CPU, has its FPU state on CPU2 which
has not been released yet, so fpexc still has VFP_FPEXC_EN set in the PCB copy.

LWP L is scheduled on CPU1, CPU1 calls cpu_switchto() for L in mi_switch().
cpu_switchto() will set VFP_FPEXC_EN in the FPU's fpexc register per the
PCB fpexc copy.

Before CPU1 calls pcu_switchpoint() for L, CPU2 calls
pcu_do_op(PCU_CMD_SAVE | PCU_CMD_RELEASE) for L because it still holds its
FPU state and wants to load another lwp. This cause VFP_FPEXC_EN to
be cleared in the PCB copy, but not in CPU1's register. L's l_pcu_cpu is
set to NULL.

When CPU1 calls pcu_switchpoint() for L it see l_pcu_cpu is NULL, and doesn't
call the release callback.

Now CPU1 has its FPU enabled but with the wrong FPU state.

Fix by releasing the PCU even if l_pcu_cpu is NULL.
2017-10-16 15:03:57 +00:00