svn commit: r338991 - head/sys/conf

2018-09-27 Thread Glen Barber
Author: gjb
Date: Fri Sep 28 00:01:45 2018
New Revision: 338991
URL: https://svnweb.freebsd.org/changeset/base/338991

Log:
  Update head from ALPHA7 to ALPHA8 as part of the 12.0-RELEASE
  cycle.
  
  Approved by:  re (implicit)
  Sponsored by: The FreeBSD Foundation

Modified:
  head/sys/conf/newvers.sh

Modified: head/sys/conf/newvers.sh
==
--- head/sys/conf/newvers.shThu Sep 27 21:08:32 2018(r338990)
+++ head/sys/conf/newvers.shFri Sep 28 00:01:45 2018(r338991)
@@ -46,7 +46,7 @@
 
 TYPE="FreeBSD"
 REVISION="12.0"
-BRANCH="ALPHA7"
+BRANCH="ALPHA8"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
 fi
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


Re: svn commit: r338930 - head/libexec/rtld-elf/powerpc

2018-09-27 Thread Konstantin Belousov
On Thu, Sep 27, 2018 at 09:37:31PM +0200, Andreas Tobler wrote:
> On 27.09.18 20:48, Michael Tuexen wrote:
> >> On 25. Sep 2018, at 21:29, Andreas Tobler  wrote:
> >>
> >> Author: andreast
> >> Date: Tue Sep 25 19:29:35 2018
> >> New Revision: 338930
> >> URL: https://svnweb.freebsd.org/changeset/base/338930
> >>
> >> Log:
> >>   Bring the 32-bit powerpc (PowerMac) back to live. The commit 338486 
> >> reworked
> >>   some TLS bits. This broke operation on the PowerMac. Namely one could 
> >> not login.
> >>   At login the screen/shell was giving back lots of backslashes and the 
> >> login
> >>   shell dumped core.
> >>
> >>   The fix to this issue is to revert the powerpc commit from 338486 and to
> >>   increase the TLS_TCB_SIZE to 16.
> >>   Reverting only did not help, login was possible but userland applications
> >>   aborted with strange messages.
> >>
> >>   I tested this patch with world/kernel builds and with port upgrades.
> >>   Additionally a full gcc8 bootstrap was successfully completed.
> >>
> >>   Reviewed by: jhibbits@
> >>   Approved by: re (Glen)
> >>
> >> Modified:
> >>   head/libexec/rtld-elf/powerpc/rtld_machdep.h
> >>
> >> Modified: head/libexec/rtld-elf/powerpc/rtld_machdep.h
> >> ==
> >> --- head/libexec/rtld-elf/powerpc/rtld_machdep.h   Tue Sep 25 18:54:18 
> >> 2018(r338929)
> >> +++ head/libexec/rtld-elf/powerpc/rtld_machdep.h   Tue Sep 25 19:29:35 
> >> 2018(r338930)
> >> @@ -69,12 +69,12 @@ void _rtld_powerpc_pltcall(void);
> >>
> >> #define TLS_TP_OFFSET  0x7000
> >> #define TLS_DTV_OFFSET 0x8000
> >> -#define TLS_TCB_SIZE  8
> >> +#define TLS_TCB_SIZE  16
> >>
> >> #define round(size, align) \
> >>  (((size) + (align) - 1) & ~((align) - 1))
> >> #define calculate_first_tls_offset(size, align) \
> >> -TLS_TCB_SIZE
> >> +round(8, align)
> >> #define calculate_tls_offset(prev_offset, prev_size, size, align) \
> >>  round(prev_offset + prev_size, align)
> >> #define calculate_tls_end(off, size)((off) + (size))
> >>
> > After performing a buildworld/buildkernel and running r338956 on a 32-bit 
> > powerpc machine (G4 Mac Mini),
> > the following program:
> > 
> > #include 
> > #include 
> > #include 
> > 
> > void *
> > f(void * arg)
> > {
> > return (arg);
> > }
> > 
> > int
> > main(void)
> > {
> > void *res;
> > pthread_t tid;
> > int err;
> > 
> > if ((err = pthread_create(, NULL, f, NULL)) != 0) {
> > fprintf(stderr, "pthread_create: %s\n", strerror(err));
> > }
> > if ((err = pthread_join(tid, )) != 0) {
> > fprintf(stderr, "pthread_join: %s\n", strerror(err));
> > }
> > return (0);
> > }
> > 
> > is killed:
> > 
> > tuexen@bsd5:~ % ./test
> > ld-elf.so.1: assert failed: 
> > /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
> > Abort (core dumped)
> > 
> > gdb shows:
> > 
> > tuexen@bsd5:~ % gdb -c test.core test
> > GNU gdb (GDB) 8.1 [GDB v8.1 for FreeBSD]
> > Copyright (C) 2018 Free Software Foundation, Inc.
> > License GPLv3+: GNU GPL version 3 or later 
> > 
> > This is free software: you are free to change and redistribute it.
> > There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
> > and "show warranty" for details.
> > This GDB was configured as "powerpc-portbld-freebsd12.0".
> > Type "show configuration" for configuration details.
> > For bug reporting instructions, please see:
> > .
> > Find the GDB manual and other documentation resources online at:
> > .
> > For help, type "help".
> > Type "apropos word" to search for commands related to "word"...
> > Reading symbols from test...done.
> > [New LWP 100112]
> > Core was generated by `./test'.
> > Program terminated with signal SIGABRT, Aborted.
> > #0  0x41829a58 in thr_kill () at thr_kill.S:3
> > 3   RSYSCALL(thr_kill)
> > (gdb) bt
> > #0  0x41829a58 in thr_kill () at thr_kill.S:3
> > #1  0x41829378 in __raise (s=6)
> >  at /usr/home/tuexen/head/lib/libc/gen/raise.c:52
> > #2  0x41823b84 in abort () at 
> > /usr/home/tuexen/head/lib/libc/stdlib/abort.c:67
> > #3  0x41813f58 in allocate_tls (objs=0x41843000, oldtcb=,
> >  tcbsize=8, tcbalign=)
> >  at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
> > #4  0x41813fc0 in _rtld_allocate_tls (oldtls=0x0, tcbsize=8, tcbalign=16)
> >  at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:5030
> > #5  0x41877438 in _tcb_ctor (thread=0x41a8d300, initial=)
> >  at /usr/home/tuexen/head/lib/libthr/thread/thr_ctrdtr.c:45
> > #6  0x41876ebc in _thr_alloc (curthread=0x41a8d000)
> >  at /usr/home/tuexen/head/lib/libthr/thread/thr_list.c:172
> > #7  0x41867118 in _pthread_create (thread=0xdc10, attr=0x0,
> >  start_routine=0x180073c , arg=0x0)
> >  at /usr/home/tuexen/head/lib/libthr/thread/thr_create.c:81
> > #8  

svn commit: r338990 - in head/sys: compat/freebsd32 dev/pci

2018-09-27 Thread Brooks Davis
Author: brooks
Date: Thu Sep 27 21:08:32 2018
New Revision: 338990
URL: https://svnweb.freebsd.org/changeset/base/338990

Log:
  Centralize compat support for PCIOCGETCONF.
  
  The pre-7.x compat for both native and 32-bit code was already in
  pci_user.c. Use this infrastructure to add implement 32-bit support.
  This is more correct as ioctl(2) commands only have meaning in the
  context of a file descriptor.
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Obtained from:CheriBSD
  Sponsored by: DARPA, AFRL
  Differential revision:https://reviews.freebsd.org/D17324

Modified:
  head/sys/compat/freebsd32/freebsd32_ioctl.c
  head/sys/compat/freebsd32/freebsd32_ioctl.h
  head/sys/dev/pci/pci_user.c

Modified: head/sys/compat/freebsd32/freebsd32_ioctl.c
==
--- head/sys/compat/freebsd32/freebsd32_ioctl.c Thu Sep 27 20:48:07 2018
(r338989)
+++ head/sys/compat/freebsd32/freebsd32_ioctl.c Thu Sep 27 21:08:32 2018
(r338990)
@@ -58,9 +58,6 @@ __FBSDID("$FreeBSD$");
 
 CTASSERT(sizeof(struct ioc_read_toc_entry32) == 8);
 CTASSERT(sizeof(struct mem_range_op32) == 12);
-CTASSERT(sizeof(struct pci_conf_io32) == 36);
-CTASSERT(sizeof(struct pci_match_conf32) == 44);
-CTASSERT(sizeof(struct pci_conf32) == 44);
 
 static int
 freebsd32_ioctl_ioc_read_toc(struct thread *td,
@@ -148,108 +145,6 @@ freebsd32_ioctl_memrange(struct thread *td,
 }
 
 static int
-freebsd32_ioctl_pciocgetconf(struct thread *td,
-struct freebsd32_ioctl_args *uap, struct file *fp)
-{
-   struct pci_conf_io pci;
-   struct pci_conf_io32 pci32;
-   struct pci_match_conf32 pmc32;
-   struct pci_match_conf32 *pmc32p;
-   struct pci_match_conf pmc;
-   struct pci_match_conf *pmcp;
-   struct pci_conf32 pc32;
-   struct pci_conf32 *pc32p;
-   struct pci_conf pc;
-   struct pci_conf *pcp;
-   u_int32_t i;
-   u_int32_t npat_to_convert;
-   u_int32_t nmatch_to_convert;
-   vm_offset_t addr;
-   int error;
-
-   if ((error = copyin(uap->data, , sizeof(pci32))) != 0)
-   return (error);
-
-   CP(pci32, pci, num_patterns);
-   CP(pci32, pci, offset);
-   CP(pci32, pci, generation);
-
-   npat_to_convert = pci32.pat_buf_len / sizeof(struct pci_match_conf32);
-   pci.pat_buf_len = npat_to_convert * sizeof(struct pci_match_conf);
-   pci.patterns = NULL;
-   nmatch_to_convert = pci32.match_buf_len / sizeof(struct pci_conf32);
-   pci.match_buf_len = nmatch_to_convert * sizeof(struct pci_conf);
-   pci.matches = NULL;
-
-   if ((error = copyout_map(td, , pci.pat_buf_len)) != 0)
-   goto cleanup;
-   pci.patterns = (struct pci_match_conf *)addr;
-   if ((error = copyout_map(td, , pci.match_buf_len)) != 0)
-   goto cleanup;
-   pci.matches = (struct pci_conf *)addr;
-
-   npat_to_convert = min(npat_to_convert, pci.num_patterns);
-
-   for (i = 0, pmc32p = (struct pci_match_conf32 *)PTRIN(pci32.patterns),
-pmcp = pci.patterns;
-i < npat_to_convert; i++, pmc32p++, pmcp++) {
-   if ((error = copyin(pmc32p, , sizeof(pmc32))) != 0)
-   goto cleanup;
-   CP(pmc32,pmc,pc_sel);
-   strlcpy(pmc.pd_name, pmc32.pd_name, sizeof(pmc.pd_name));
-   CP(pmc32,pmc,pd_unit);
-   CP(pmc32,pmc,pc_vendor);
-   CP(pmc32,pmc,pc_device);
-   CP(pmc32,pmc,pc_class);
-   CP(pmc32,pmc,flags);
-   if ((error = copyout(, pmcp, sizeof(pmc))) != 0)
-   goto cleanup;
-   }
-
-   if ((error = fo_ioctl(fp, PCIOCGETCONF, (caddr_t),
- td->td_ucred, td)) != 0)
-   goto cleanup;
-
-   nmatch_to_convert = min(nmatch_to_convert, pci.num_matches);
-
-   for (i = 0, pcp = pci.matches,
-pc32p = (struct pci_conf32 *)PTRIN(pci32.matches);
-i < nmatch_to_convert; i++, pcp++, pc32p++) {
-   if ((error = copyin(pcp, , sizeof(pc))) != 0)
-   goto cleanup;
-   CP(pc,pc32,pc_sel);
-   CP(pc,pc32,pc_hdr);
-   CP(pc,pc32,pc_subvendor);
-   CP(pc,pc32,pc_subdevice);
-   CP(pc,pc32,pc_vendor);
-   CP(pc,pc32,pc_device);
-   CP(pc,pc32,pc_class);
-   CP(pc,pc32,pc_subclass);
-   CP(pc,pc32,pc_progif);
-   CP(pc,pc32,pc_revid);
-   strlcpy(pc32.pd_name, pc.pd_name, sizeof(pc32.pd_name));
-   CP(pc,pc32,pd_unit);
-   if ((error = copyout(, pc32p, sizeof(pc32))) != 0)
-   goto cleanup;
-   }
-
-   CP(pci, pci32, num_matches);
-   CP(pci, pci32, offset);
-   CP(pci, pci32, generation);
-   CP(pci, pci32, status);
-
-   error = copyout(, uap->data, sizeof(pci32));
-
-cleanup:
-

svn commit: r338989 - head/sys/amd64/amd64

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 20:48:07 2018
New Revision: 338989
URL: https://svnweb.freebsd.org/changeset/base/338989

Log:
  amd64: fix return value of copyinstr after r338970
  
  The function stopped swapping rdi and rsi, but the error handling
  code was not updated with the new register name.
  
  Approved by:  re (implicit)
  Sponsored by: The FreeBSD Foundation

Modified:
  head/sys/amd64/amd64/support.S

Modified: head/sys/amd64/amd64/support.S
==
--- head/sys/amd64/amd64/support.S  Thu Sep 27 20:00:07 2018
(r338988)
+++ head/sys/amd64/amd64/support.S  Thu Sep 27 20:48:07 2018
(r338989)
@@ -1097,7 +1097,7 @@ copyinstr_toolong_smap:
 copyinstr_toolong:
/* rdx is zero - return ENAMETOOLONG or EFAULT */
movq$VM_MAXUSER_ADDRESS,%rax
-   cmpq%rax,%rsi
+   cmpq%rax,%rdi
jae cpystrflt
movl$ENAMETOOLONG,%eax
jmp cpystrflt_x
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


RE: Cloud Computing Expo NOV/12 - NOV/13/2018 Visitors Mailing List

2018-09-27 Thread Amy Smith
 

 

Hi,

 

I haven't heard you from a while. Hence floating this to the top of your
inbox to understand, if you did get a chance to review my earlier mail. 

 

Kindly let me know your interest so that I can get back to you with counts
and pricing available.

 

 

Best Regards,

Amy Smith

Business Development Executive

 

From: Amy Smith [mailto:a...@tradeattendees.com] 
Sent: Thursday, September 20, 2018 3:29 PM
To: 'svn-src-all@freebsd.org'
Subject: Cloud Computing Expo NOV/12 - NOV/13/2018 Visitors Mailing List

 

Hi,

 

Just wanted to reach out to see if you have any interest in acquiring Cloud
Computing Expo NOV/12 - NOV/13/2018 Visitors Mailing List?

 

The list can be used for pre-show internal lead generation, branding,
product/service promotion campaigns, booth invites, appointment setting and
also for your sales/marketing activities.

 

Visitors:

. CIOs/CTOs/CEOs/CMOs

. Presidents & SVPs of Technology

. Chief Systems Engineers

. IT Directors and Managers

. Network and Storage Managers

. Enterprise Architects

. Communications and Networking Specialists

. Directors of Infrastructure

. Directors of Business Development

. Product and Purchasing Managers

 

Visitors List includes: Company Name, Web/URL, Visitor Name, Visitor Job
Title, Verified email address, Complete Mailing Address, Contact Number and
etc.

 

Kindly let me know your interest so that I can get back to you with Counts
and Pricing for your review.

 

Awaiting for your response!!

 

Regards,

Amy Smith

Business Development Executive

 

Note: If you do not wish to receive further E-mails please reply us with opt
out in subject line.

 

___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


Re: svn commit: r338930 - head/libexec/rtld-elf/powerpc

2018-09-27 Thread Andreas Tobler

On 27.09.18 20:48, Michael Tuexen wrote:

On 25. Sep 2018, at 21:29, Andreas Tobler  wrote:

Author: andreast
Date: Tue Sep 25 19:29:35 2018
New Revision: 338930
URL: https://svnweb.freebsd.org/changeset/base/338930

Log:
  Bring the 32-bit powerpc (PowerMac) back to live. The commit 338486 reworked
  some TLS bits. This broke operation on the PowerMac. Namely one could not 
login.
  At login the screen/shell was giving back lots of backslashes and the login
  shell dumped core.

  The fix to this issue is to revert the powerpc commit from 338486 and to
  increase the TLS_TCB_SIZE to 16.
  Reverting only did not help, login was possible but userland applications
  aborted with strange messages.

  I tested this patch with world/kernel builds and with port upgrades.
  Additionally a full gcc8 bootstrap was successfully completed.

  Reviewed by: jhibbits@
  Approved by: re (Glen)

Modified:
  head/libexec/rtld-elf/powerpc/rtld_machdep.h

Modified: head/libexec/rtld-elf/powerpc/rtld_machdep.h
==
--- head/libexec/rtld-elf/powerpc/rtld_machdep.hTue Sep 25 18:54:18 
2018(r338929)
+++ head/libexec/rtld-elf/powerpc/rtld_machdep.hTue Sep 25 19:29:35 
2018(r338930)
@@ -69,12 +69,12 @@ void _rtld_powerpc_pltcall(void);

#define TLS_TP_OFFSET   0x7000
#define TLS_DTV_OFFSET  0x8000
-#define TLS_TCB_SIZE   8
+#define TLS_TCB_SIZE   16

#define round(size, align) \
 (((size) + (align) - 1) & ~((align) - 1))
#define calculate_first_tls_offset(size, align) \
-TLS_TCB_SIZE
+round(8, align)
#define calculate_tls_offset(prev_offset, prev_size, size, align) \
 round(prev_offset + prev_size, align)
#define calculate_tls_end(off, size)((off) + (size))


After performing a buildworld/buildkernel and running r338956 on a 32-bit 
powerpc machine (G4 Mac Mini),
the following program:

#include 
#include 
#include 

void *
f(void * arg)
{
return (arg);
}

int
main(void)
{
void *res;
pthread_t tid;
int err;

if ((err = pthread_create(, NULL, f, NULL)) != 0) {
fprintf(stderr, "pthread_create: %s\n", strerror(err));
}
if ((err = pthread_join(tid, )) != 0) {
fprintf(stderr, "pthread_join: %s\n", strerror(err));
}
return (0);
}

is killed:

tuexen@bsd5:~ % ./test
ld-elf.so.1: assert failed: /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
Abort (core dumped)

gdb shows:

tuexen@bsd5:~ % gdb -c test.core test
GNU gdb (GDB) 8.1 [GDB v8.1 for FreeBSD]
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "powerpc-portbld-freebsd12.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from test...done.
[New LWP 100112]
Core was generated by `./test'.
Program terminated with signal SIGABRT, Aborted.
#0  0x41829a58 in thr_kill () at thr_kill.S:3
3   RSYSCALL(thr_kill)
(gdb) bt
#0  0x41829a58 in thr_kill () at thr_kill.S:3
#1  0x41829378 in __raise (s=6)
 at /usr/home/tuexen/head/lib/libc/gen/raise.c:52
#2  0x41823b84 in abort () at /usr/home/tuexen/head/lib/libc/stdlib/abort.c:67
#3  0x41813f58 in allocate_tls (objs=0x41843000, oldtcb=,
 tcbsize=8, tcbalign=)
 at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
#4  0x41813fc0 in _rtld_allocate_tls (oldtls=0x0, tcbsize=8, tcbalign=16)
 at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:5030
#5  0x41877438 in _tcb_ctor (thread=0x41a8d300, initial=)
 at /usr/home/tuexen/head/lib/libthr/thread/thr_ctrdtr.c:45
#6  0x41876ebc in _thr_alloc (curthread=0x41a8d000)
 at /usr/home/tuexen/head/lib/libthr/thread/thr_list.c:172
#7  0x41867118 in _pthread_create (thread=0xdc10, attr=0x0,
 start_routine=0x180073c , arg=0x0)
 at /usr/home/tuexen/head/lib/libthr/thread/thr_create.c:81
#8  0x01800798 in main ()
(gdb) quit

Any idea what is wrong?


TLS is broken on powerpc ;)

I see the same.

Would you mind reverting my commit and see if it is better/different and 
how different?


For me the commit was an improvement, but I agree this is not enough.

I try to analyze what is going on. Any help is appreciated.

Thanks for the report.
Andreas

___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338987 - stable/11/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:54:41 2018
New Revision: 338987
URL: https://svnweb.freebsd.org/changeset/base/338987

Log:
  Check to ensure the buffer returned is not NULL.
  
  Direct commit to the branch as this behavior is only seeing in stable/11.
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Reviewed by:  wes@
  Approved by:  so
  Security: FreeBSD-EN-18:10.syscall
  Security: CVE-2018-17154

Modified:
  stable/11/sys/kern/vfs_syscalls.c

Modified: stable/11/sys/kern/vfs_syscalls.c
==
--- stable/11/sys/kern/vfs_syscalls.c   Thu Sep 27 18:50:10 2018
(r338986)
+++ stable/11/sys/kern/vfs_syscalls.c   Thu Sep 27 18:54:41 2018
(r338987)
@@ -601,6 +601,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, , size, , UIO_SYSSPACE,
uap->mode);
+   if (buf == NULL)
+   return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338986 - in stable/11/sys: netinet netinet6

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:50:10 2018
New Revision: 338986
URL: https://svnweb.freebsd.org/changeset/base/338986

Log:
  There are various cases where we modify the inp_vflag and inp_inc.inc_flags
  fields during a syscall, but don't restore those fields if the operation
  fails.  This can leave the inp structure in an inconsistent state and cause
  various problems.
  
  Restore the inp_vflag and inp_inc.inc_flags fields when the underlying
  operation fails and the inp could be in an inconsistent state.
  
  This is a direct commit to the branch as the code is different enough in
  the other branches to make it difficult to resolve a merge.
  
  Submitted by:   jtl@
  Reported by:Jakub Jirasek, Secunia Research at Flexera
  Reviewed by:jhb@
  Approved by:so
  Security:   FreeBSD-EN-18:11.listen
  Security:   CVE-2018-6925

Modified:
  stable/11/sys/netinet/tcp_usrreq.c
  stable/11/sys/netinet6/sctp6_usrreq.c
  stable/11/sys/netinet6/udp6_usrreq.c

Modified: stable/11/sys/netinet/tcp_usrreq.c
==
--- stable/11/sys/netinet/tcp_usrreq.c  Thu Sep 27 18:48:50 2018
(r338985)
+++ stable/11/sys/netinet/tcp_usrreq.c  Thu Sep 27 18:50:10 2018
(r338986)
@@ -339,6 +339,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_char vflagsav;
 
sin6p = (struct sockaddr_in6 *)nam;
if (nam->sa_len != sizeof (*sin6p))
@@ -355,6 +356,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
error = EINVAL;
goto out;
@@ -384,6 +386,8 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
error = in6_pcbbind(inp, nam, td->td_ucred);
INP_HASH_WUNLOCK(_tcbinfo);
 out:
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
TCPDEBUG2(PRU_BIND);
TCP_PROBE2(debug__user, tp, PRU_BIND);
INP_WUNLOCK(inp);
@@ -447,6 +451,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
int error = 0;
struct inpcb *inp;
struct tcpcb *tp = NULL;
+   u_char vflagsav;
 
TCPDEBUG0;
inp = sotoinpcb(so);
@@ -456,6 +461,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
error = EINVAL;
goto out;
}
+   vflagsav = inp->inp_vflag;
tp = intotcpcb(inp);
TCPDEBUG1();
SOCK_LOCK(so);
@@ -482,6 +488,9 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
if (tp->t_flags & TF_FASTOPEN)
tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 #endif
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
+
 out:
TCPDEBUG2(PRU_LISTEN);
TCP_PROBE2(debug__user, tp, PRU_LISTEN);
@@ -558,6 +567,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_int8_t incflagsav;
+   u_char vflagsav;
 
TCPDEBUG0;
 
@@ -574,6 +585,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
+   incflagsav = inp->inp_inc.inc_flags;
if (inp->inp_flags & INP_TIMEWAIT) {
error = EADDRINUSE;
goto out;
@@ -603,11 +616,11 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
}
 
in6_sin6_2_sin(, sin6p);
-   inp->inp_vflag |= INP_IPV4;
-   inp->inp_vflag &= ~INP_IPV6;
if ((error = prison_remote_ip4(td->td_ucred,
_addr)) != 0)
goto out;
+   inp->inp_vflag |= INP_IPV4;
+   inp->inp_vflag &= ~INP_IPV6;
if ((error = tcp_connect(tp, (struct sockaddr *), td)) != 0)
goto out;
 #ifdef TCP_OFFLOAD
@@ -625,11 +638,11 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
}
}
 #endif
+   if ((error = prison_remote_ip6(td->td_ucred, >sin6_addr)) != 0)
+   goto out;
inp->inp_vflag &= ~INP_IPV4;
inp->inp_vflag |= INP_IPV6;
inp->inp_inc.inc_flags |= INC_ISIPV6;
-   if ((error = prison_remote_ip6(td->td_ucred, >sin6_addr)) != 0)
-   goto out;
if ((error = tcp6_connect(tp, nam, td)) != 0)
goto out;
 #ifdef TCP_OFFLOAD
@@ -642,6 +655,15 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
error = tp->t_fb->tfb_tcp_output(tp);
 
 out:
+   /*
+* If the implicit bind in the connect 

Re: svn commit: r338930 - head/libexec/rtld-elf/powerpc

2018-09-27 Thread Michael Tuexen
> On 25. Sep 2018, at 21:29, Andreas Tobler  wrote:
> 
> Author: andreast
> Date: Tue Sep 25 19:29:35 2018
> New Revision: 338930
> URL: https://svnweb.freebsd.org/changeset/base/338930
> 
> Log:
>  Bring the 32-bit powerpc (PowerMac) back to live. The commit 338486 reworked
>  some TLS bits. This broke operation on the PowerMac. Namely one could not 
> login.
>  At login the screen/shell was giving back lots of backslashes and the login
>  shell dumped core.
> 
>  The fix to this issue is to revert the powerpc commit from 338486 and to
>  increase the TLS_TCB_SIZE to 16.
>  Reverting only did not help, login was possible but userland applications
>  aborted with strange messages.
> 
>  I tested this patch with world/kernel builds and with port upgrades.
>  Additionally a full gcc8 bootstrap was successfully completed.
> 
>  Reviewed by: jhibbits@
>  Approved by: re (Glen)
> 
> Modified:
>  head/libexec/rtld-elf/powerpc/rtld_machdep.h
> 
> Modified: head/libexec/rtld-elf/powerpc/rtld_machdep.h
> ==
> --- head/libexec/rtld-elf/powerpc/rtld_machdep.h  Tue Sep 25 18:54:18 
> 2018(r338929)
> +++ head/libexec/rtld-elf/powerpc/rtld_machdep.h  Tue Sep 25 19:29:35 
> 2018(r338930)
> @@ -69,12 +69,12 @@ void _rtld_powerpc_pltcall(void);
> 
> #define TLS_TP_OFFSET 0x7000
> #define TLS_DTV_OFFSET0x8000
> -#define TLS_TCB_SIZE 8
> +#define TLS_TCB_SIZE 16
> 
> #define round(size, align) \
> (((size) + (align) - 1) & ~((align) - 1))
> #define calculate_first_tls_offset(size, align) \
> -TLS_TCB_SIZE
> +round(8, align)
> #define calculate_tls_offset(prev_offset, prev_size, size, align) \
> round(prev_offset + prev_size, align)
> #define calculate_tls_end(off, size)((off) + (size))
> 
After performing a buildworld/buildkernel and running r338956 on a 32-bit 
powerpc machine (G4 Mac Mini),
the following program:

#include 
#include 
#include 

void *
f(void * arg)
{
return (arg);
}

int
main(void)
{
void *res;
pthread_t tid;
int err;

if ((err = pthread_create(, NULL, f, NULL)) != 0) {
fprintf(stderr, "pthread_create: %s\n", strerror(err));
}
if ((err = pthread_join(tid, )) != 0) {
fprintf(stderr, "pthread_join: %s\n", strerror(err));
}
return (0);
}

is killed:

tuexen@bsd5:~ % ./test
ld-elf.so.1: assert failed: /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
Abort (core dumped)

gdb shows:

tuexen@bsd5:~ % gdb -c test.core test
GNU gdb (GDB) 8.1 [GDB v8.1 for FreeBSD]
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "powerpc-portbld-freebsd12.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from test...done.
[New LWP 100112]
Core was generated by `./test'.
Program terminated with signal SIGABRT, Aborted.
#0  0x41829a58 in thr_kill () at thr_kill.S:3
3   RSYSCALL(thr_kill)
(gdb) bt
#0  0x41829a58 in thr_kill () at thr_kill.S:3
#1  0x41829378 in __raise (s=6)
at /usr/home/tuexen/head/lib/libc/gen/raise.c:52
#2  0x41823b84 in abort () at /usr/home/tuexen/head/lib/libc/stdlib/abort.c:67
#3  0x41813f58 in allocate_tls (objs=0x41843000, oldtcb=, 
tcbsize=8, tcbalign=)
at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:4753
#4  0x41813fc0 in _rtld_allocate_tls (oldtls=0x0, tcbsize=8, tcbalign=16)
at /usr/home/tuexen/head/libexec/rtld-elf/rtld.c:5030
#5  0x41877438 in _tcb_ctor (thread=0x41a8d300, initial=)
at /usr/home/tuexen/head/lib/libthr/thread/thr_ctrdtr.c:45
#6  0x41876ebc in _thr_alloc (curthread=0x41a8d000)
at /usr/home/tuexen/head/lib/libthr/thread/thr_list.c:172
#7  0x41867118 in _pthread_create (thread=0xdc10, attr=0x0, 
start_routine=0x180073c , arg=0x0)
at /usr/home/tuexen/head/lib/libthr/thread/thr_create.c:81
#8  0x01800798 in main ()
(gdb) quit

Any idea what is wrong?

Best regards
Michael
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338985 - in stable/10/sys: netinet netinet6

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:48:50 2018
New Revision: 338985
URL: https://svnweb.freebsd.org/changeset/base/338985

Log:
  There are various cases where we modify the inp_vflag and inp_inc.inc_flags
  fields during a syscall, but don't restore those fields if the operation
  fails.  This can leave the inp structure in an inconsistent state and cause
  various problems.
  
  Restore the inp_vflag and inp_inc.inc_flags fields when the underlying
  operation fails and the inp could be in an inconsistent state.
  
  This is a direct commit to the branch as the code is different enough in
  the other branches to make it difficult to resolve a merge.
  
  Submitted by: jtl@
  Reported by:  Jakub Jirasek, Secunia Research at Flexera
  Reviewed by:  jhb@
  Approved by:  so
  Security: FreeBSD-EN-18:11.listen
  Security: CVE-2018-6925

Modified:
  stable/10/sys/netinet/tcp_usrreq.c
  stable/10/sys/netinet6/sctp6_usrreq.c
  stable/10/sys/netinet6/udp6_usrreq.c

Modified: stable/10/sys/netinet/tcp_usrreq.c
==
--- stable/10/sys/netinet/tcp_usrreq.c  Thu Sep 27 18:44:40 2018
(r338984)
+++ stable/10/sys/netinet/tcp_usrreq.c  Thu Sep 27 18:48:50 2018
(r338985)
@@ -328,6 +328,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_char vflagsav;
 
sin6p = (struct sockaddr_in6 *)nam;
if (nam->sa_len != sizeof (*sin6p))
@@ -344,6 +345,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
error = EINVAL;
goto out;
@@ -373,6 +375,8 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
error = in6_pcbbind(inp, nam, td->td_ucred);
INP_HASH_WUNLOCK(_tcbinfo);
 out:
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
TCPDEBUG2(PRU_BIND);
INP_WUNLOCK(inp);
return (error);
@@ -434,6 +438,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
int error = 0;
struct inpcb *inp;
struct tcpcb *tp = NULL;
+   u_char vflagsav;
 
TCPDEBUG0;
inp = sotoinpcb(so);
@@ -443,6 +448,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
error = EINVAL;
goto out;
}
+   vflagsav = inp->inp_vflag;
tp = intotcpcb(inp);
TCPDEBUG1();
SOCK_LOCK(so);
@@ -469,6 +475,9 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
if (tp->t_flags & TF_FASTOPEN)
tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 #endif
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
+
 out:
TCPDEBUG2(PRU_LISTEN);
INP_WUNLOCK(inp);
@@ -543,6 +552,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_int8_t incflagsav;
+   u_char vflagsav;
 
TCPDEBUG0;
 
@@ -559,6 +570,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
+   incflagsav = inp->inp_inc.inc_flags;
if (inp->inp_flags & INP_TIMEWAIT) {
error = EADDRINUSE;
goto out;
@@ -584,11 +597,11 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
}
 
in6_sin6_2_sin(, sin6p);
-   inp->inp_vflag |= INP_IPV4;
-   inp->inp_vflag &= ~INP_IPV6;
if ((error = prison_remote_ip4(td->td_ucred,
_addr)) != 0)
goto out;
+   inp->inp_vflag |= INP_IPV4;
+   inp->inp_vflag &= ~INP_IPV6;
if ((error = tcp_connect(tp, (struct sockaddr *), td)) != 0)
goto out;
 #ifdef TCP_OFFLOAD
@@ -601,11 +614,11 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
goto out;
}
 #endif
+   if ((error = prison_remote_ip6(td->td_ucred, >sin6_addr)) != 0)
+   goto out;
inp->inp_vflag &= ~INP_IPV4;
inp->inp_vflag |= INP_IPV6;
inp->inp_inc.inc_flags |= INC_ISIPV6;
-   if ((error = prison_remote_ip6(td->td_ucred, >sin6_addr)) != 0)
-   goto out;
if ((error = tcp6_connect(tp, nam, td)) != 0)
goto out;
 #ifdef TCP_OFFLOAD
@@ -618,6 +631,15 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
error = tcp_output(tp);
 
 out:
+   /*
+* If the implicit bind in the connect call fails, restore
+* the flags we modified.
+

svn commit: r338984 - stable/10/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:44:40 2018
New Revision: 338984
URL: https://svnweb.freebsd.org/changeset/base/338984

Log:
  MFC r338982.
  
  Clear stack allocated data structure to prevent kernel memory leak.
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Reviewed by:  wes@
  Approved by:  so
  Security: FreeBSD-EN-18:12.mem
  Security: CVE-2018-17155

Modified:
  stable/10/sys/kern/kern_context.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/kern/kern_context.c
==
--- stable/10/sys/kern/kern_context.c   Thu Sep 27 18:42:40 2018
(r338983)
+++ stable/10/sys/kern/kern_context.c   Thu Sep 27 18:44:40 2018
(r338984)
@@ -68,6 +68,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -108,6 +109,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338983 - stable/11/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:42:40 2018
New Revision: 338983
URL: https://svnweb.freebsd.org/changeset/base/338983

Log:
  MFC r338982.
  
  Clear stack allocated data structure to prevent kernel memory leak.
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Reviewed by:  wes@
  Approved by:  so
  Security: FreeBSD-EN-18:12.mem
  Security: CVE-2018-17155

Modified:
  stable/11/sys/kern/kern_context.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/kern_context.c
==
--- stable/11/sys/kern/kern_context.c   Thu Sep 27 18:39:54 2018
(r338982)
+++ stable/11/sys/kern/kern_context.c   Thu Sep 27 18:42:40 2018
(r338983)
@@ -68,6 +68,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -108,6 +109,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338982 - head/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:39:54 2018
New Revision: 338982
URL: https://svnweb.freebsd.org/changeset/base/338982

Log:
  Clear stack allocated data structure to prevent kernel memory leak.
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Reviewed by:  wes@
  Approved by:  re (implicit)
  Approved by:  so
  Security: FreeBSD-EN-18:12.mem
  Security: CVE-2018-17155

Modified:
  head/sys/kern/kern_context.c

Modified: head/sys/kern/kern_context.c
==
--- head/sys/kern/kern_context.cThu Sep 27 18:36:30 2018
(r338981)
+++ head/sys/kern/kern_context.cThu Sep 27 18:39:54 2018
(r338982)
@@ -70,6 +70,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -110,6 +111,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338981 - in releng: 10.4/sys/kern 11.1/sys/kern 11.2/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:36:30 2018
New Revision: 338981
URL: https://svnweb.freebsd.org/changeset/base/338981

Log:
  Fix small kernel memory disclosures. [EN-18:12.mem]
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Approved by:  so
  Security: FreeBSD-EN-18:12.mem
  Security: CVE-2018-17155

Modified:
  releng/10.4/sys/kern/kern_context.c
  releng/11.1/sys/kern/kern_context.c
  releng/11.2/sys/kern/kern_context.c

Modified: releng/10.4/sys/kern/kern_context.c
==
--- releng/10.4/sys/kern/kern_context.c Thu Sep 27 18:34:42 2018
(r338980)
+++ releng/10.4/sys/kern/kern_context.c Thu Sep 27 18:36:30 2018
(r338981)
@@ -68,6 +68,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -108,6 +109,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);

Modified: releng/11.1/sys/kern/kern_context.c
==
--- releng/11.1/sys/kern/kern_context.c Thu Sep 27 18:34:42 2018
(r338980)
+++ releng/11.1/sys/kern/kern_context.c Thu Sep 27 18:36:30 2018
(r338981)
@@ -68,6 +68,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -108,6 +109,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);

Modified: releng/11.2/sys/kern/kern_context.c
==
--- releng/11.2/sys/kern/kern_context.c Thu Sep 27 18:34:42 2018
(r338980)
+++ releng/11.2/sys/kern/kern_context.c Thu Sep 27 18:36:30 2018
(r338981)
@@ -68,6 +68,7 @@ sys_getcontext(struct thread *td, struct getcontext_ar
if (uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
PROC_LOCK(td->td_proc);
uc.uc_sigmask = td->td_sigmask;
@@ -108,6 +109,7 @@ sys_swapcontext(struct thread *td, struct swapcontext_
if (uap->oucp == NULL || uap->ucp == NULL)
ret = EINVAL;
else {
+   bzero(, sizeof(ucontext_t));
get_mcontext(td, _mcontext, GET_MC_CLEAR_RET);
bzero(uc.__spare__, sizeof(uc.__spare__));
PROC_LOCK(td->td_proc);
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338980 - in releng: 10.4 10.4/sys/conf 10.4/sys/netinet 10.4/sys/netinet6 11.1/sys/netinet 11.1/sys/netinet6 11.2/sys/netinet 11.2/sys/netinet6

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:34:42 2018
New Revision: 338980
URL: https://svnweb.freebsd.org/changeset/base/338980

Log:
  Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
  
  Reported by:  Jakub Jirasek, Secunia Research at Flexera
  Approved by:  so
  Security: FreeBSD-EN-18:11.listen
  Security: CVE-2018-6925

Modified:
  releng/10.4/UPDATING
  releng/10.4/sys/conf/newvers.sh
  releng/10.4/sys/netinet/tcp_usrreq.c
  releng/10.4/sys/netinet6/sctp6_usrreq.c
  releng/10.4/sys/netinet6/udp6_usrreq.c
  releng/11.1/sys/netinet/tcp_usrreq.c
  releng/11.1/sys/netinet6/sctp6_usrreq.c
  releng/11.1/sys/netinet6/udp6_usrreq.c
  releng/11.2/sys/netinet/tcp_usrreq.c
  releng/11.2/sys/netinet6/sctp6_usrreq.c
  releng/11.2/sys/netinet6/udp6_usrreq.c

Modified: releng/10.4/UPDATING
==
--- releng/10.4/UPDATINGThu Sep 27 18:32:14 2018(r338979)
+++ releng/10.4/UPDATINGThu Sep 27 18:34:42 2018(r338980)
@@ -17,6 +17,13 @@ stable/10, and then rebuild without this option. The b
 older version of current is a bit fragile.
 
 
+20180927   p13 FreeBSD-EN-18:11.listen
+   FreeBSD-EN-18:12.mem
+
+   Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
+
+   Fix small kernel memory disclosures. [EN-18:12.mem]
+
 20180912   p12 FreeBSD-SA-18:12.elf
 
Fix improper elf header parsing.

Modified: releng/10.4/sys/conf/newvers.sh
==
--- releng/10.4/sys/conf/newvers.sh Thu Sep 27 18:32:14 2018
(r338979)
+++ releng/10.4/sys/conf/newvers.sh Thu Sep 27 18:34:42 2018
(r338980)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.4"
-BRANCH="RELEASE-p12"
+BRANCH="RELEASE-p13"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/10.4/sys/netinet/tcp_usrreq.c
==
--- releng/10.4/sys/netinet/tcp_usrreq.cThu Sep 27 18:32:14 2018
(r338979)
+++ releng/10.4/sys/netinet/tcp_usrreq.cThu Sep 27 18:34:42 2018
(r338980)
@@ -328,6 +328,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_char vflagsav;
 
sin6p = (struct sockaddr_in6 *)nam;
if (nam->sa_len != sizeof (*sin6p))
@@ -344,6 +345,7 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
error = EINVAL;
goto out;
@@ -373,6 +375,8 @@ tcp6_usr_bind(struct socket *so, struct sockaddr *nam,
error = in6_pcbbind(inp, nam, td->td_ucred);
INP_HASH_WUNLOCK(_tcbinfo);
 out:
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
TCPDEBUG2(PRU_BIND);
INP_WUNLOCK(inp);
return (error);
@@ -434,6 +438,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
int error = 0;
struct inpcb *inp;
struct tcpcb *tp = NULL;
+   u_char vflagsav;
 
TCPDEBUG0;
inp = sotoinpcb(so);
@@ -443,6 +448,7 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
error = EINVAL;
goto out;
}
+   vflagsav = inp->inp_vflag;
tp = intotcpcb(inp);
TCPDEBUG1();
SOCK_LOCK(so);
@@ -469,6 +475,9 @@ tcp6_usr_listen(struct socket *so, int backlog, struct
if (tp->t_flags & TF_FASTOPEN)
tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 #endif
+   if (error != 0)
+   inp->inp_vflag = vflagsav;
+
 out:
TCPDEBUG2(PRU_LISTEN);
INP_WUNLOCK(inp);
@@ -543,6 +552,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
struct inpcb *inp;
struct tcpcb *tp = NULL;
struct sockaddr_in6 *sin6p;
+   u_int8_t incflagsav;
+   u_char vflagsav;
 
TCPDEBUG0;
 
@@ -559,6 +570,8 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
inp = sotoinpcb(so);
KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
INP_WLOCK(inp);
+   vflagsav = inp->inp_vflag;
+   incflagsav = inp->inp_inc.inc_flags;
if (inp->inp_flags & INP_TIMEWAIT) {
error = EADDRINUSE;
goto out;
@@ -584,11 +597,11 @@ tcp6_usr_connect(struct socket *so, struct sockaddr *n
}
 
in6_sin6_2_sin(, sin6p);
-   inp->inp_vflag |= INP_IPV4;
-   inp->inp_vflag &= 

svn commit: r338979 - in releng: 11.1/sys/kern 11.2/sys/kern

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:32:14 2018
New Revision: 338979
URL: https://svnweb.freebsd.org/changeset/base/338979

Log:
  Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
  
  Reported by:  Thomas Barabosch, Fraunhofer FKIE
  Approved by:  so
  Security: FreeBSD-EN-18:10.syscall
  Security: CVE-2018-17154

Modified:
  releng/11.1/sys/kern/vfs_syscalls.c
  releng/11.2/sys/kern/vfs_syscalls.c

Modified: releng/11.1/sys/kern/vfs_syscalls.c
==
--- releng/11.1/sys/kern/vfs_syscalls.c Thu Sep 27 18:29:55 2018
(r338978)
+++ releng/11.1/sys/kern/vfs_syscalls.c Thu Sep 27 18:32:14 2018
(r338979)
@@ -641,6 +641,8 @@ freebsd4_getfsstat(td, uap)
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, , size, , UIO_SYSSPACE,
uap->mode);
+   if (buf == NULL)
+   return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;

Modified: releng/11.2/sys/kern/vfs_syscalls.c
==
--- releng/11.2/sys/kern/vfs_syscalls.c Thu Sep 27 18:29:55 2018
(r338978)
+++ releng/11.2/sys/kern/vfs_syscalls.c Thu Sep 27 18:32:14 2018
(r338979)
@@ -600,6 +600,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, , size, , UIO_SYSSPACE,
uap->mode);
+   if (buf == NULL)
+   return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338978 - in releng: 11.1 11.1/sys/conf 11.1/sys/netinet6 11.2 11.2/sys/conf 11.2/sys/netinet6

2018-09-27 Thread Gordon Tetlow
Author: gordon
Date: Thu Sep 27 18:29:55 2018
New Revision: 338978
URL: https://svnweb.freebsd.org/changeset/base/338978

Log:
  Fix regression in IPv6 fragment reassembly. [EN-18:09.ip]
  
  Approved by:  so
  Security: FreeBSD-EN-18:09.ip

Modified:
  releng/11.1/UPDATING
  releng/11.1/sys/conf/newvers.sh
  releng/11.1/sys/netinet6/frag6.c
  releng/11.2/UPDATING
  releng/11.2/sys/conf/newvers.sh
  releng/11.2/sys/netinet6/frag6.c

Modified: releng/11.1/UPDATING
==
--- releng/11.1/UPDATINGThu Sep 27 18:14:01 2018(r338977)
+++ releng/11.1/UPDATINGThu Sep 27 18:29:55 2018(r338978)
@@ -16,6 +16,19 @@ from older versions of FreeBSD, try WITHOUT_CLANG and 
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20180927   p15 FreeBSD-EN-18:09.ip
+   FreeBSD-EN-18:10.syscall
+   FreeBSD-EN-18:11.listen
+   FreeBSD-EN-18:12.mem
+
+   Fix regression in IPv6 fragment reassembly. [EN-18:09.ip]
+
+   Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
+
+   Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
+
+   Fix small kernel memory disclosures. [EN-18:12.mem]
+
 20180912   p14 FreeBSD-SA-18:12.elf
FreeBSD-EN-18:08.lazyfpu
 

Modified: releng/11.1/sys/conf/newvers.sh
==
--- releng/11.1/sys/conf/newvers.sh Thu Sep 27 18:14:01 2018
(r338977)
+++ releng/11.1/sys/conf/newvers.sh Thu Sep 27 18:29:55 2018
(r338978)
@@ -44,7 +44,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.1"
-BRANCH="RELEASE-p14"
+BRANCH="RELEASE-p15"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/11.1/sys/netinet6/frag6.c
==
--- releng/11.1/sys/netinet6/frag6.cThu Sep 27 18:14:01 2018
(r338977)
+++ releng/11.1/sys/netinet6/frag6.cThu Sep 27 18:29:55 2018
(r338978)
@@ -216,7 +216,9 @@ frag6_input(struct mbuf **mp, int *offp, int proto)
int offset = *offp, nxt, i, next;
int first_frag = 0;
int fragoff, frgpartlen;/* must be larger than u_int16_t */
-   uint32_t hash, hashkey[sizeof(struct in6_addr) * 2 + 1], *hashkeyp;
+   uint32_t hashkey[(sizeof(struct in6_addr) * 2 +
+   sizeof(ip6f->ip6f_ident)) / sizeof(uint32_t)];
+   uint32_t hash, *hashkeyp;
struct ifnet *dstifp;
u_int8_t ecn, ecn0;
 #ifdef RSS

Modified: releng/11.2/UPDATING
==
--- releng/11.2/UPDATINGThu Sep 27 18:14:01 2018(r338977)
+++ releng/11.2/UPDATINGThu Sep 27 18:29:55 2018(r338978)
@@ -16,6 +16,19 @@ from older versions of FreeBSD, try WITHOUT_CLANG and 
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20180927   p4  FreeBSD-EN-18:09.ip
+   FreeBSD-EN-18:10.syscall
+   FreeBSD-EN-18:11.listen
+   FreeBSD-EN-18:12.mem
+
+   Fix regression in IPv6 fragment reassembly. [EN-18:09.ip]
+
+   Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
+
+   Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
+
+   Fix small kernel memory disclosures. [EN-18:12.mem]
+
 20180912   p3  FreeBSD-SA-18:12.elf
FreeBSD-EN-18:08.lazyfpu
 

Modified: releng/11.2/sys/conf/newvers.sh
==
--- releng/11.2/sys/conf/newvers.sh Thu Sep 27 18:14:01 2018
(r338977)
+++ releng/11.2/sys/conf/newvers.sh Thu Sep 27 18:29:55 2018
(r338978)
@@ -44,7 +44,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.2"
-BRANCH="RELEASE-p3"
+BRANCH="RELEASE-p4"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
 fi

Modified: releng/11.2/sys/netinet6/frag6.c
==
--- releng/11.2/sys/netinet6/frag6.cThu Sep 27 18:14:01 2018
(r338977)
+++ releng/11.2/sys/netinet6/frag6.cThu Sep 27 18:29:55 2018
(r338978)
@@ -216,7 +216,9 @@ frag6_input(struct mbuf **mp, int *offp, int proto)
int offset = *offp, nxt, i, next;
int first_frag = 0;
int fragoff, frgpartlen;/* must be larger than u_int16_t */
-   uint32_t hash, hashkey[sizeof(struct in6_addr) * 2 + 1], *hashkeyp;
+   uint32_t

svn commit: r338977 - head/sbin/ipfw

2018-09-27 Thread Guangyuan Yang
Author: ygy (doc committer)
Date: Thu Sep 27 18:14:01 2018
New Revision: 338977
URL: https://svnweb.freebsd.org/changeset/base/338977

Log:
  Add description, parameters, options, sysctl and examples of using AQMs to 
ipfw man page. CoDel, PIE, FQ-CoDel and FQ-PIE AQM for Dummynet exist in 
FreeBSD 11 and 10.3.
  
  Submitted by: ralsa...@swin.edu.au
  Reviewed by:  AllanJude
  Approved by:  re (gjb)
  MFC after:1 week
  Differential Revision:https://reviews.freebsd.org/D12507

Modified:
  head/sbin/ipfw/ipfw.8

Modified: head/sbin/ipfw/ipfw.8
==
--- head/sbin/ipfw/ipfw.8   Thu Sep 27 17:33:59 2018(r338976)
+++ head/sbin/ipfw/ipfw.8   Thu Sep 27 18:14:01 2018(r338977)
@@ -1,7 +1,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd August 10, 2018
+.Dd September 27, 2018
 .Dt IPFW 8
 .Os
 .Sh NAME
@@ -2711,7 +2711,7 @@ The following case-insensitive parameters can be confi
 scheduler:
 .Pp
 .Bl -tag -width indent -compact
-.It Cm type Ar {fifo | wf2q+ | rr | qfq}
+.It Cm type Ar {fifo | wf2q+ | rr | qfq | fq_codel | fq_pie}
 specifies the scheduling algorithm to use.
 .Bl -tag -width indent -compact
 .It Cm fifo
@@ -2738,9 +2738,70 @@ with poor service guarantees.
 implements the QFQ algorithm, which is a very fast variant of
 WF2Q+, with similar service guarantees and O(1) processing
 costs (roughly, 200-250ns per packet).
+.It Cm fq_codel
+implements the FQ-CoDel (FlowQueue-CoDel) scheduler/AQM algorithm, which
+uses a modified Deficit Round Robin scheduler to manage two lists of sub-queues
+(old sub-queues and new sub-queues) for providing brief periods of priority to
+lightweight or short burst flows.
+By default, the total number of sub-queues is 1024.
+FQ-CoDel's internal, dynamically
+created sub-queues are controlled by separate instances of CoDel AQM.
+.It Cm fq_pie
+implements the FQ-PIE (FlowQueue-PIE) scheduler/AQM algorithm, which similar to
+.Cm fq_codel
+but uses per sub-queue PIE AQM instance to control the queue delay.
 .El
+.Pp
+.Cm fq_codel
+inherits AQM parameters and options from
+.Cm codel
+(see below), and
+.Cm fq_pie
+inherits AQM parameters and options from
+.Cm pie
+(see below).
+Additionally, both of
+.Cm fq_codel
+and
+.Cm fq_pie
+have shared scheduler parameters which are:
+.Bl -tag -width indent
+.It Cm quantum
+.Ar m
+specifies the quantum (credit) of the scheduler.
+.Ar m
+is the number of bytes a queue can serve before being moved to the tail
+of old queues list.
+The default is 1514 bytes, and the maximum accepable value
+is 9000 bytes.
+.It Cm limit
+.Ar m
+specifies the hard size limit (in unit of packets) of all queues managed by an
+instance of the scheduler.
+The default value of
+.Ar m
+is 10240 packets, and the maximum accepable value is 20480 packets.
+.It Cm flows
+.Ar m
+specifies the total number of flow queues (sub-queues) that fq_*
+creates and manages.
+By default, 1024 sub-queues are created when an instance
+of the fq_{codel/pie} scheduler is created.
+The maximum accepable value is
+65536.
 .El
 .Pp
+Note that any token after
+.Cm fq_codel
+or
+.Cm fq_pie
+is considered a parameter for fq_{codel/pie}.
+So, ensure all scheduler
+configuration options not related to fq_{codel/pie} are written before
+.Cm fq_codel/fq_pie
+tokens.
+.El
+.Pp
 In addition to the type, all parameters allowed for a pipe can also
 be specified for a scheduler.
 .Pp
@@ -2869,8 +2930,137 @@ greater than zero)
 specifies the expected maximum packet size, only used when queue
 thresholds are in bytes (defaults to 1500, must be greater than zero).
 .El
+.Pp
+.It Cm codel Oo Cm target Ar time Oc Oo Cm interval Ar time Oc Oo Cm ecn |
+.Cm noecn Oc
+Make use of the CoDel (Controlled-Delay) queue management algorithm.
+.Ar time
+is interpreted as milliseconds by default but seconds (s), milliseconds (ms) or
+microseconds (us) can be specified instead.
+CoDel drops or marks (ECN) packets
+depending on packet sojourn time in the queue.
+.Cm target
+.Ar time
+(5ms by default) is the minimum acceptable persistent queue delay that CoDel
+allows.
+CoDel does not drop packets directly after packets sojourn time becomes
+higher than
+.Cm target
+.Ar time
+but waits for
+.Cm interval
+.Ar time
+(100ms default) before dropping.
+.Cm interval
+.Ar time
+should be set to maximum RTT for all expected connections.
+.Cm ecn
+enables (disabled by default) packet marking (instead of dropping) for
+ECN-enabled TCP flows when queue delay becomes high.
+.Pp
+Note that any token after
+.Cm codel
+is considered a parameter for CoDel.
+So, ensure all pipe/queue
+configuration options are written before
+.Cm codel
+token.
+.Pp
+The
+.Xr sysctl 8
+variables
+.Va net.inet.ip.dummynet.codel.target
+and
+.Va net.inet.ip.dummynet.codel.interval
+can be used to set CoDel default parameters.
+.Pp
+.It Cm pie Oo Cm target Ar time Oc Oo Cm tupdate Ar time Oc Oo
+.Cm alpha Ar n Oc Oo Cm beta Ar n Oc Oo Cm max_burst Ar time Oc Oo

svn commit: r338976 - in head/sys: amd64/amd64 i386/i386

2018-09-27 Thread John Baldwin
Author: jhb
Date: Thu Sep 27 17:33:59 2018
New Revision: 338976
URL: https://svnweb.freebsd.org/changeset/base/338976

Log:
  Don't clear DR6 for debug exceptions from userland.
  
  This reverts part of r68.  The attempt to clear DR6 was occuring
  too soon as trapsignal() does not pause to let the debugger notice the
  SIGTRAP and query DR6.  The signal exchange does not occur until much
  later during ast().  As a result, GDB was no longer recognizing
  hardware breakpoints and watchpoints on x86.
  
  In addition, any userland programs that want to inspect DR6 in a
  SIGTRAP handler don't have a way to do this if we clear DR6 in the
  exception handler.
  
  Instead of relying on the kernel to clear DR6, debuggers will have to
  explicitly clear it after a trace trap (which they needed to do on
  older kernels anyway).
  
  Reviewed by:  kib
  Approved by:  re (delphij)
  MFC after:3 days
  Differential Revision:https://reviews.freebsd.org/D17319

Modified:
  head/sys/amd64/amd64/trap.c
  head/sys/i386/i386/trap.c

Modified: head/sys/amd64/amd64/trap.c
==
--- head/sys/amd64/amd64/trap.c Thu Sep 27 17:22:40 2018(r338975)
+++ head/sys/amd64/amd64/trap.c Thu Sep 27 17:33:59 2018(r338976)
@@ -659,12 +659,6 @@ trap(struct trapframe *frame)
KASSERT((read_rflags() & PSL_I) != 0, ("interrupts disabled"));
trapsignal(td, );
 
-   /*
-* Clear any pending debug exceptions after allowing a
-* debugger to read DR6 while stopped in trapsignal().
-*/
-   if (type == T_TRCTRAP)
-   load_dr6(0);
 userret:
userret(td, frame);
KASSERT(PCB_USER_FPU(td->td_pcb),

Modified: head/sys/i386/i386/trap.c
==
--- head/sys/i386/i386/trap.c   Thu Sep 27 17:22:40 2018(r338975)
+++ head/sys/i386/i386/trap.c   Thu Sep 27 17:33:59 2018(r338976)
@@ -762,12 +762,6 @@ kernel_trctrap:
KASSERT((read_eflags() & PSL_I) != 0, ("interrupts disabled"));
trapsignal(td, );
 
-   /*
-* Clear any pending debug exceptions after allowing a
-* debugger to read DR6 while stopped in trapsignal().
-*/
-   if (type == T_TRCTRAP)
-   load_dr6(0);
 user:
userret(td, frame);
KASSERT(PCB_USER_FPU(td->td_pcb),
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338975 - in stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs: . sys

2018-09-27 Thread Alexander Motin
Author: mav
Date: Thu Sep 27 17:22:40 2018
New Revision: 338975
URL: https://svnweb.freebsd.org/changeset/base/338975

Log:
  MFC r334810 (by benno), r338205, r338206:
  r334810:
  Break recursion involving getnewvnode and zfs_rmnode.
  
  When we're at our vnode limit, getnewvnode will call into the vnode LRU
  cache to free up vnodes. If the vnode we try to recycle is a ZFS vnode we
  end up, eventually, in zfs_rmnode. If the ZFS vnode we're recycling
  represents something with extended attributes, zfs_rmnode will call
  zfs_zget which will attempt to allocate another vnode. If the next vnode we
  try to recycle is also a ZFS vnode representing something with extended
  attributes we can recurse further. This ends up being unbounded and can end
  up overflowing the stack.
  
  In order to avoid this, restructure zfs_rmnode to simply add the extended
  attribute directory's object ID to the unlinked set, thus not requiring the
  allocation of a vnode. We then schedule a task that calls zfs_unlinked_drain
  which will do the work of properly marking the vnodes for unlinking.
  zfs_unlinked_drain is also called on mount so these will be cleaned up
  there.
  
  r338205:
  Create separate taskqueue to call zfs_unlinked_drain().
  
  r334810 introduced zfs_unlinked_drain() dispatch to taskqueue on every
  deletion of a file with extended attributes.  Using system_taskq for that
  with its multiple threads in case of multiple files deletion caused all
  available CPU threads to uselessly spin on busy locks, completely blocking
  the system.
  
  Use of single dedicated taskqueue is the only easy solution I've found,
  while in would be great if we could specify that some task should be
  executed only once at a time, but never in parallel, while many tasks
  could use different threads same time.
  
  r338206:
  Add dmu_tx_assign() error handling in zfs_unlinked_drain().
  
  The error handling got lost during r334810, while according to the report
  error there may happen in case of dataset being over quota.  In such case
  just leave the node in the unlinked list to be freed sometimes later.

Modified:
  stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_vfsops.h
  stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c
  stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vfsops.c
Directory Properties:
  stable/11/   (props changed)

Modified: 
stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_vfsops.h
==
--- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_vfsops.h   
Thu Sep 27 17:11:11 2018(r338974)
+++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_vfsops.h   
Thu Sep 27 17:22:40 2018(r338975)
@@ -85,6 +85,9 @@ struct zfsvfs {
sa_attr_type_t  *z_attr_table;  /* SA attr mapping->id */
 #defineZFS_OBJ_MTX_SZ  64
kmutex_tz_hold_mtx[ZFS_OBJ_MTX_SZ]; /* znode hold locks */
+#if defined(__FreeBSD__)
+   struct task z_unlinked_drain_task;
+#endif
 };
 
 /*

Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c
==
--- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c  Thu Sep 
27 17:11:11 2018(r338974)
+++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c  Thu Sep 
27 17:22:40 2018(r338975)
@@ -281,6 +281,7 @@ zfs_unlinked_drain(zfsvfs_t *zfsvfs)
zap_attribute_t zap;
dmu_object_info_t doi;
znode_t *zp;
+   dmu_tx_t*tx;
int error;
 
/*
@@ -317,6 +318,26 @@ zfs_unlinked_drain(zfsvfs_t *zfsvfs)
continue;
 
vn_lock(ZTOV(zp), LK_EXCLUSIVE | LK_RETRY);
+#if defined(__FreeBSD__)
+   /*
+* Due to changes in zfs_rmnode we need to make sure the
+* link count is set to zero here.
+*/
+   if (zp->z_links != 0) {
+   tx = dmu_tx_create(zfsvfs->z_os);
+   dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
+   error = dmu_tx_assign(tx, TXG_WAIT);
+   if (error != 0) {
+   dmu_tx_abort(tx);
+   vput(ZTOV(zp));
+   continue;
+   }
+   zp->z_links = 0;
+   VERIFY0(sa_update(zp->z_sa_hdl, SA_ZPL_LINKS(zfsvfs),
+   >z_links, sizeof (zp->z_links), tx));
+   dmu_tx_commit(tx);
+   }
+#endif
zp->z_unlinked = B_TRUE;
vput(ZTOV(zp));
}
@@ -388,12 +409,15 @@ zfs_purgedir(znode_t *dzp)
return (skipped);
 }
 
+#if defined(__FreeBSD__)
+extern taskq_t *zfsvfs_taskq;
+#endif
+
 void
 

svn commit: r338974 - stable/11/cddl/contrib/opensolaris/lib/libzfs/common

2018-09-27 Thread Alexander Motin
Author: mav
Date: Thu Sep 27 17:11:11 2018
New Revision: 338974
URL: https://svnweb.freebsd.org/changeset/base/338974

Log:
  MFC r07 (by sbruno):
  Cleanup sundry clang warnings for code that is not upstream in illumos.
  
https://github.com/illumos/illumos-gate/edit/master/usr/src/lib/libzfs/common/libzfs_sendrecv.c
  
  Patch our version of it to quiesce warnings until someone decides to sync
  up our code:
  
  libzfs_sendrecv.c:2555:30: warning: format specifies type 'unsigned long'
but the argument has type 'uint64_t' (aka 'unsigned long long') [-Wformat]
  sprintf(guidname, "%lu", thisguid);
 ~~~   ^~~~
 %llu
  libzfs_sendrecv.c:2612:29: warning: format specifies type 'unsigned long'
but the argument has type 'uint64_t' (aka 'unsigned long long') [-Wformat]
  sprintf(guidname, "%lu", parent_fromsnap_guid);
 ~~~   ^~~~
 %llu
  libzfs_sendrecv.c:2645:29: warning: format specifies type 'unsigned long'
but the argument has type 'uint64_t' (aka 'unsigned long long') [-Wformat]
  sprintf(guidname, "%lu", parent_fromsnap_guid);
 ~~~   ^~~~
 %llu

Modified:
  stable/11/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_sendrecv.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_sendrecv.c
==
--- stable/11/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_sendrecv.c  
Thu Sep 27 17:08:29 2018(r338973)
+++ stable/11/cddl/contrib/opensolaris/lib/libzfs/common/libzfs_sendrecv.c  
Thu Sep 27 17:11:11 2018(r338974)
@@ -2552,7 +2552,7 @@ again:
needagain = B_TRUE;
else
progress = B_TRUE;
-   sprintf(guidname, "%lu", thisguid);
+   sprintf(guidname, "%" PRIu64, thisguid);
nvlist_add_boolean(deleted, guidname);
continue;
}
@@ -2609,7 +2609,7 @@ again:
needagain = B_TRUE;
else
progress = B_TRUE;
-   sprintf(guidname, "%lu", parent_fromsnap_guid);
+   sprintf(guidname, "%" PRIu64, parent_fromsnap_guid);
nvlist_add_boolean(deleted, guidname);
continue;
}
@@ -2642,7 +2642,7 @@ again:
if (stream_parent_fromsnap_guid != 0 &&
 parent_fromsnap_guid != 0 &&
 stream_parent_fromsnap_guid != parent_fromsnap_guid) {
-   sprintf(guidname, "%lu", parent_fromsnap_guid);
+   sprintf(guidname, "%" PRIu64, parent_fromsnap_guid);
if (nvlist_exists(deleted, guidname)) {
progress = B_TRUE;
needagain = B_TRUE;
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338973 - head/lib/libc/amd64/string

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 17:08:29 2018
New Revision: 338973
URL: https://svnweb.freebsd.org/changeset/base/338973

Log:
  amd64: reimplement libc memcmp and bcmp with kernel memcmp
  
  Both are significantly slower than hand-coded loops. See r338963 for
  kernel commit.
  
  bcmp differs from memcmp by always returning 1 when a difference is
  found, as opposed to going for a value bigger or lower than 0
  depending on what it is. This means it can do less work. For now the
  code is duplicated and modified. This will get deduplicated after
  another round of optimization when memcmp will get a longer-term form.
  
  Both tested with the glibc suite. While the suite does not have a test
  for bcmp, I created a wrapper routine which verified that values match
  (0 vs 0, 1 vs non-zero).
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Sponsored by: The FreeBSD Foundation
  Differential Revision:https://reviews.freebsd.org/D17336

Modified:
  head/lib/libc/amd64/string/bcmp.S
  head/lib/libc/amd64/string/memcmp.S

Modified: head/lib/libc/amd64/string/bcmp.S
==
--- head/lib/libc/amd64/string/bcmp.S   Thu Sep 27 16:43:41 2018
(r338972)
+++ head/lib/libc/amd64/string/bcmp.S   Thu Sep 27 17:08:29 2018
(r338973)
@@ -1,27 +1,121 @@
+/*-
+ * Copyright (c) 2018 The FreeBSD Foundation
+ *
+ * This software was developed by Mateusz Guzik 
+ * under sponsorship from the FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *notice, this list of conditions and the following disclaimer in the
+ *documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
 #include 
 __FBSDID("$FreeBSD$");
 
-#if 0
-   RCSID("$NetBSD: bcmp.S,v 1.1 2001/06/19 00:25:04 fvdl Exp $")
-#endif
-
 ENTRY(bcmp)
-   cld /* set compare direction forward */
+   cmpq$16,%rdx
+   jae 5f
+1:
+   testq   %rdx,%rdx
+   je  3f
+   xorl%ecx,%ecx
+2:
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jne 2b
+3:
+   xorl%eax,%eax
+   ret
+4:
+   movl$1,%eax
+   ret
+5:
+   cmpq$32,%rdx
+   jae 7f
+6:
+   /*
+* 8 bytes
+*/
+   movq(%rdi),%r8
+   movq(%rsi),%r9
+   cmpq%r8,%r9
+   jne 4b
+   leaq8(%rdi),%rdi
+   leaq8(%rsi),%rsi
+   subq$8,%rdx
+   cmpq$8,%rdx
+   jae 6b
+   jl  1b
+   jmp 3b
+7:
+   /*
+* 32 bytes
+*/
+   movq(%rsi),%r8
+   movq8(%rsi),%r9
+   subq(%rdi),%r8
+   subq8(%rdi),%r9
+   or  %r8,%r9
+   jnz 4b
 
-   movq%rdx,%rcx   /* compare by words */
-   shrq$3,%rcx
-   repe
-   cmpsq
-   jne L1
+   movq16(%rsi),%r8
+   movq24(%rsi),%r9
+   subq16(%rdi),%r8
+   subq24(%rdi),%r9
+   or  %r8,%r9
+   jnz 4b
 
-   movq%rdx,%rcx   /* compare remainder by bytes */
-   andq$7,%rcx
-   repe
-   cmpsb
-L1:
-   setne   %al
-   

svn commit: r338972 - vendor-sys/acpica/20180927

2018-09-27 Thread Jung-uk Kim
Author: jkim
Date: Thu Sep 27 16:43:41 2018
New Revision: 338972
URL: https://svnweb.freebsd.org/changeset/base/338972

Log:
  Tag ACPICA 20180927.

Added:
  vendor-sys/acpica/20180927/
 - copied from r338971, vendor-sys/acpica/dist/
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338971 - in vendor-sys/acpica/dist: . generate/unix/acpiexamples generate/unix/acpiexec source/common source/compiler source/components/debugger source/components/disassembler source/c...

2018-09-27 Thread Jung-uk Kim
Author: jkim
Date: Thu Sep 27 16:43:02 2018
New Revision: 338971
URL: https://svnweb.freebsd.org/changeset/base/338971

Log:
  Import ACPICA 20180927.

Added:
  vendor-sys/acpica/dist/source/components/executer/exserial.c   (contents, 
props changed)
Modified:
  vendor-sys/acpica/dist/changes.txt
  vendor-sys/acpica/dist/generate/unix/acpiexamples/Makefile
  vendor-sys/acpica/dist/generate/unix/acpiexec/Makefile
  vendor-sys/acpica/dist/source/common/adisasm.c
  vendor-sys/acpica/dist/source/common/ahtable.c
  vendor-sys/acpica/dist/source/common/dmextern.c
  vendor-sys/acpica/dist/source/common/dmtable.c
  vendor-sys/acpica/dist/source/compiler/aslallocate.c
  vendor-sys/acpica/dist/source/compiler/aslanalyze.c
  vendor-sys/acpica/dist/source/compiler/aslcache.c
  vendor-sys/acpica/dist/source/compiler/aslcodegen.c
  vendor-sys/acpica/dist/source/compiler/aslcompile.c
  vendor-sys/acpica/dist/source/compiler/aslcompiler.l
  vendor-sys/acpica/dist/source/compiler/asldefine.h
  vendor-sys/acpica/dist/source/compiler/aslerror.c
  vendor-sys/acpica/dist/source/compiler/aslexternal.c
  vendor-sys/acpica/dist/source/compiler/aslfileio.c
  vendor-sys/acpica/dist/source/compiler/aslfiles.c
  vendor-sys/acpica/dist/source/compiler/aslfold.c
  vendor-sys/acpica/dist/source/compiler/aslglobal.h
  vendor-sys/acpica/dist/source/compiler/aslhex.c
  vendor-sys/acpica/dist/source/compiler/aslkeywords.y
  vendor-sys/acpica/dist/source/compiler/asllength.c
  vendor-sys/acpica/dist/source/compiler/asllisting.c
  vendor-sys/acpica/dist/source/compiler/asllistsup.c
  vendor-sys/acpica/dist/source/compiler/aslload.c
  vendor-sys/acpica/dist/source/compiler/asllookup.c
  vendor-sys/acpica/dist/source/compiler/aslmain.c
  vendor-sys/acpica/dist/source/compiler/aslmap.c
  vendor-sys/acpica/dist/source/compiler/aslmapenter.c
  vendor-sys/acpica/dist/source/compiler/aslmapoutput.c
  vendor-sys/acpica/dist/source/compiler/aslmessages.c
  vendor-sys/acpica/dist/source/compiler/aslmessages.h
  vendor-sys/acpica/dist/source/compiler/aslmethod.c
  vendor-sys/acpica/dist/source/compiler/aslnamesp.c
  vendor-sys/acpica/dist/source/compiler/asloffset.c
  vendor-sys/acpica/dist/source/compiler/aslopcodes.c
  vendor-sys/acpica/dist/source/compiler/asloperands.c
  vendor-sys/acpica/dist/source/compiler/aslopt.c
  vendor-sys/acpica/dist/source/compiler/asloptions.c
  vendor-sys/acpica/dist/source/compiler/aslparseop.c
  vendor-sys/acpica/dist/source/compiler/aslpld.c
  vendor-sys/acpica/dist/source/compiler/aslpredef.c
  vendor-sys/acpica/dist/source/compiler/aslprepkg.c
  vendor-sys/acpica/dist/source/compiler/aslprune.c
  vendor-sys/acpica/dist/source/compiler/aslresource.c
  vendor-sys/acpica/dist/source/compiler/aslstartup.c
  vendor-sys/acpica/dist/source/compiler/aslsupport.l
  vendor-sys/acpica/dist/source/compiler/aslsupport.y
  vendor-sys/acpica/dist/source/compiler/asltokens.y
  vendor-sys/acpica/dist/source/compiler/asltransform.c
  vendor-sys/acpica/dist/source/compiler/asltree.c
  vendor-sys/acpica/dist/source/compiler/aslutils.c
  vendor-sys/acpica/dist/source/compiler/aslwalks.c
  vendor-sys/acpica/dist/source/compiler/aslxref.c
  vendor-sys/acpica/dist/source/compiler/aslxrefout.c
  vendor-sys/acpica/dist/source/compiler/cvcompiler.c
  vendor-sys/acpica/dist/source/compiler/cvdisasm.c
  vendor-sys/acpica/dist/source/compiler/cvparser.c
  vendor-sys/acpica/dist/source/compiler/dtcompile.c
  vendor-sys/acpica/dist/source/compiler/dtcompiler.h
  vendor-sys/acpica/dist/source/compiler/dtexpress.c
  vendor-sys/acpica/dist/source/compiler/dtfield.c
  vendor-sys/acpica/dist/source/compiler/dtio.c
  vendor-sys/acpica/dist/source/compiler/dtparser.y
  vendor-sys/acpica/dist/source/compiler/dtsubtable.c
  vendor-sys/acpica/dist/source/compiler/dttable.c
  vendor-sys/acpica/dist/source/compiler/dttable2.c
  vendor-sys/acpica/dist/source/compiler/dttemplate.c
  vendor-sys/acpica/dist/source/compiler/dtutils.c
  vendor-sys/acpica/dist/source/compiler/preprocess.h
  vendor-sys/acpica/dist/source/compiler/prexpress.c
  vendor-sys/acpica/dist/source/compiler/prmacros.c
  vendor-sys/acpica/dist/source/compiler/prparser.l
  vendor-sys/acpica/dist/source/compiler/prparser.y
  vendor-sys/acpica/dist/source/compiler/prscan.c
  vendor-sys/acpica/dist/source/compiler/prutils.c
  vendor-sys/acpica/dist/source/components/debugger/dbinput.c
  vendor-sys/acpica/dist/source/components/disassembler/dmutils.c
  vendor-sys/acpica/dist/source/components/events/evregion.c
  vendor-sys/acpica/dist/source/components/events/evrgnini.c
  vendor-sys/acpica/dist/source/components/events/evxfregn.c
  vendor-sys/acpica/dist/source/components/executer/exfield.c
  vendor-sys/acpica/dist/source/components/hardware/hwsleep.c
  vendor-sys/acpica/dist/source/include/acconfig.h
  vendor-sys/acpica/dist/source/include/acdisasm.h
  vendor-sys/acpica/dist/source/include/acevents.h
  vendor-sys/acpica/dist/source/include/acexcep.h
  vendor-sys/acpica/dist/source/include

svn commit: r338970 - head/sys/amd64/amd64

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 15:53:36 2018
New Revision: 338970
URL: https://svnweb.freebsd.org/changeset/base/338970

Log:
  amd64: macroify and mostly depessimize copyinstr
  
  See r338968 for details.
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Differential Revision:https://reviews.freebsd.org/D17288

Modified:
  head/sys/amd64/amd64/support.S

Modified: head/sys/amd64/amd64/support.S
==
--- head/sys/amd64/amd64/support.S  Thu Sep 27 15:32:37 2018
(r338969)
+++ head/sys/amd64/amd64/support.S  Thu Sep 27 15:53:36 2018
(r338970)
@@ -1011,96 +1011,86 @@ fusufault:
  * EFAULT on protection violations. If lencopied is non-zero,
  * return the actual length in *lencopied.
  */
-ENTRY(copyinstr_nosmap)
+.macro COPYINSTR smap
PUSH_FRAME_POINTER
movq%rdx,%r8/* %r8 = maxlen */
-   movq%rcx,%r9/* %r9 = *len */
-   xchgq   %rdi,%rsi   /* %rdi = from, %rsi = to */
-   movqPCPU(CURPCB),%rcx
-   movq$cpystrflt,PCB_ONFAULT(%rcx)
+   movqPCPU(CURPCB),%r9
+   movq$cpystrflt,PCB_ONFAULT(%r9)
 
movq$VM_MAXUSER_ADDRESS,%rax
 
/* make sure 'from' is within bounds */
-   subq%rsi,%rax
+   subq%rdi,%rax
jbe cpystrflt
 
+   SMAP_DISABLE \smap
+
/* restrict maxlen to <= VM_MAXUSER_ADDRESS-from */
cmpq%rdx,%rax
-   jae 1f
-   movq%rax,%rdx
-   movq%rax,%r8
+   jb  8f
 1:
incq%rdx
-
 2:
decq%rdx
+.if \smap == 0
jz  copyinstr_toolong
+.else
+   jz  copyinstr_toolong_smap
+.endif
 
-   lodsb
-   stosb
-   orb %al,%al
+   movb(%rdi),%al
+   movb%al,(%rsi)
+   incq%rsi
+   incq%rdi
+   testb   %al,%al
jnz 2b
 
-   jmp copyinstr_succ
-END(copyinstr_nosmap)
+   SMAP_ENABLE \smap
 
-ENTRY(copyinstr_smap)
-   PUSH_FRAME_POINTER
-   movq%rdx,%r8/* %r8 = maxlen */
-   movq%rcx,%r9/* %r9 = *len */
-   xchgq   %rdi,%rsi   /* %rdi = from, %rsi = to */
-   movqPCPU(CURPCB),%rcx
-   movq$cpystrflt,PCB_ONFAULT(%rcx)
+   /* Success -- 0 byte reached */
+   decq%rdx
+   xorl%eax,%eax
 
-   movq$VM_MAXUSER_ADDRESS,%rax
+   /* set *lencopied and return %eax */
+   movq%rax,PCB_ONFAULT(%r9)
 
-   /* make sure 'from' is within bounds */
-   subq%rsi,%rax
-   jbe cpystrflt
-
-   stac
-
-   /* restrict maxlen to <= VM_MAXUSER_ADDRESS-from */
-   cmpq%rdx,%rax
-   jae 1f
+   testq   %rcx,%rcx
+   jz  3f
+   subq%rdx,%r8
+   movq%r8,(%rcx)
+3:
+   POP_FRAME_POINTER
+   ret
+   ALIGN_TEXT
+8:
movq%rax,%rdx
movq%rax,%r8
-1:
-   incq%rdx
+   jmp 1b
 
-2:
-   decq%rdx
-   jz  copyinstr_toolong_smap
+.endm
 
-   lodsb
-   stosb
-   orb %al,%al
-   jnz 2b
+ENTRY(copyinstr_nosmap)
+   COPYINSTR smap=0
+END(copyinstr_nosmap)
 
-   clac
+ENTRY(copyinstr_smap)
+   COPYINSTR smap=1
+END(copyinstr_smap)
 
-copyinstr_succ:
-   /* Success -- 0 byte reached */
-   decq%rdx
-   xorl%eax,%eax
-
+cpystrflt:
+   /* Fault entry clears PSL.AC */
+   movl$EFAULT,%eax
 cpystrflt_x:
/* set *lencopied and return %eax */
-   movqPCPU(CURPCB),%rcx
-   movq$0,PCB_ONFAULT(%rcx)
+   movq$0,PCB_ONFAULT(%r9)
 
-   testq   %r9,%r9
+   testq   %rcx,%rcx
jz  1f
subq%rdx,%r8
-   movq%r8,(%r9)
+   movq%r8,(%rcx)
 1:
POP_FRAME_POINTER
ret
-   /* Fault entry clears PSL.AC */
-cpystrflt:
-   movq$EFAULT,%rax
-   jmp cpystrflt_x
 
 copyinstr_toolong_smap:
clac
@@ -1109,10 +1099,8 @@ copyinstr_toolong:
movq$VM_MAXUSER_ADDRESS,%rax
cmpq%rax,%rsi
jae cpystrflt
-   movq$ENAMETOOLONG,%rax
+   movl$ENAMETOOLONG,%eax
jmp cpystrflt_x
-
-END(copyinstr_smap)
 
 /*
  * copystr(from, to, maxlen, int *lencopied)
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338969 - head/sys/netinet6

2018-09-27 Thread Bjoern A. Zeeb
Author: bz
Date: Thu Sep 27 15:32:37 2018
New Revision: 338969
URL: https://svnweb.freebsd.org/changeset/base/338969

Log:
  In in6_pcbpurgeif0() called, e.g., from if_clone_destroy(),
  once we have a lock, make sure the inp is not marked freed.
  This can happen since the list traversal and locking was
  converted to epoch(9).  If the inp is marked "freed", skip it.
  
  This prevents a NULL pointer deref panic later on.
  
  Reported by:  slavash (Mellanox)
  Tested by:slavash (Mellanox)
  Reviewed by:  markj (no formal review but caught my unlock mistake)
  Approved by:  re (kib)

Modified:
  head/sys/netinet6/in6_pcb.c

Modified: head/sys/netinet6/in6_pcb.c
==
--- head/sys/netinet6/in6_pcb.c Thu Sep 27 15:27:53 2018(r338968)
+++ head/sys/netinet6/in6_pcb.c Thu Sep 27 15:32:37 2018(r338969)
@@ -809,6 +809,10 @@ in6_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifne
INP_INFO_WLOCK(pcbinfo);
CK_LIST_FOREACH(in6p, pcbinfo->ipi_listhead, inp_list) {
INP_WLOCK(in6p);
+   if (__predict_false(in6p->inp_flags2 & INP_FREED)) {
+   INP_WUNLOCK(in6p);
+   continue;
+   }
im6o = in6p->in6p_moptions;
if ((in6p->inp_vflag & INP_IPV6) && im6o != NULL) {
/*
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338968 - head/sys/amd64/amd64

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 15:27:53 2018
New Revision: 338968
URL: https://svnweb.freebsd.org/changeset/base/338968

Log:
  amd64: mostly depessimize copystr
  
  - remove a forward branch in the common case
  - replace xchg + lodsb/stosb loop with simple movs
  
  A simple test on Intel(R) Core(TM) i7-4600U CPU @ 2.10GH copying
  /foo/bar/baz in a loop goes from 295715863 ops/s to 465807408.
  
  Further changes are pending.
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Differential Revision:https://reviews.freebsd.org/D17281

Modified:
  head/sys/amd64/amd64/support.S

Modified: head/sys/amd64/amd64/support.S
==
--- head/sys/amd64/amd64/support.S  Thu Sep 27 15:24:16 2018
(r338967)
+++ head/sys/amd64/amd64/support.S  Thu Sep 27 15:27:53 2018
(r338968)
@@ -1122,34 +1122,33 @@ ENTRY(copystr)
PUSH_FRAME_POINTER
movq%rdx,%r8/* %r8 = maxlen */
 
-   xchgq   %rdi,%rsi
-   incq%rdx
+   incq%rdx
 1:
decq%rdx
jz  4f
-   lodsb
-   stosb
-   orb %al,%al
+   movb(%rdi),%al
+   movb%al,(%rsi)
+   incq%rsi
+   incq%rdi
+   testb   %al,%al
jnz 1b
 
/* Success -- 0 byte reached */
decq%rdx
xorl%eax,%eax
-   jmp 6f
-4:
-   /* rdx is zero -- return ENAMETOOLONG */
-   movq$ENAMETOOLONG,%rax
-
-6:
-
+2:
testq   %rcx,%rcx
-   jz  7f
+   jz  3f
/* set *lencopied and return %rax */
subq%rdx,%r8
movq%r8,(%rcx)
-7:
+3:
POP_FRAME_POINTER
ret
+4:
+   /* rdx is zero -- return ENAMETOOLONG */
+   movl$ENAMETOOLONG,%eax
+   jmp 2b
 END(copystr)
 
 /*
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338967 - head/sys/amd64/amd64

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 15:24:16 2018
New Revision: 338967
URL: https://svnweb.freebsd.org/changeset/base/338967

Log:
  amd64: clean up copyin/copyout
  
  - move the PSL.AC comment to the fault handler
  - stop testing for zero-sized ops. after several minutes of package
  building there were no copyin calls with zero bytes and very few
  copyout. the semantic of returning 0 in this case is preserved
  - shorten exit paths by clearing %eax earlier
  - replace xchg with 3 movs. this is what compilers do. a naive
  benchmark on EPYC suggests about 1% increase in thoughput thanks to
  this change.
  - remove the useless movb %cl,%al from copyout. it looks like a
  leftover from many years ago
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Differential Revision:https://reviews.freebsd.org/D17286

Modified:
  head/sys/amd64/amd64/support.S

Modified: head/sys/amd64/amd64/support.S
==
--- head/sys/amd64/amd64/support.S  Thu Sep 27 14:57:20 2018
(r338966)
+++ head/sys/amd64/amd64/support.S  Thu Sep 27 15:24:16 2018
(r338967)
@@ -404,10 +404,7 @@ END(fillw)
 .macro COPYOUT smap erms
PUSH_FRAME_POINTER
movqPCPU(CURPCB),%r9
-   /* Trap entry clears PSL.AC */
movq$copy_fault,PCB_ONFAULT(%r9)
-   testq   %rdx,%rdx   /* anything to do? */
-   jz  2f
 
/*
 * Check explicitly for non-user addresses.  If 486 write protection
@@ -432,10 +429,20 @@ END(fillw)
cmpq%rcx,%rax
ja  copy_fault
 
-   xchgq   %rdi,%rsi
-   /* bcopy(%rsi, %rdi, %rdx) */
+   /*
+* Set up arguments for rep movs*.
+*/
+   movq%rdi,%r8
+   movq%rsi,%rdi
+   movq%r8,%rsi
movq%rdx,%rcx
 
+   /*
+* Set return value to zero. Remaining failure mode goes through
+* copy_fault.
+*/
+   xorl%eax,%eax
+
SMAP_DISABLE \smap
 .if\erms == 0
cmpq$15,%rcx
@@ -447,17 +454,16 @@ END(fillw)
andb$7,%cl
jne 1f
SMAP_ENABLE \smap
-   xorl%eax,%eax
movq%rax,PCB_ONFAULT(%r9)
POP_FRAME_POINTER
ret
 .endif
+   ALIGN_TEXT
 1:
rep
movsb
+
SMAP_ENABLE \smap
-2:
-   xorl%eax,%eax
movq%rax,PCB_ONFAULT(%r9)
POP_FRAME_POINTER
ret
@@ -487,8 +493,6 @@ END(copyout_smap_erms)
PUSH_FRAME_POINTER
movqPCPU(CURPCB),%r9
movq$copy_fault,PCB_ONFAULT(%r9)
-   testq   %rdx,%rdx   /* anything to do? */
-   jz  2f
 
/*
 * make sure address is valid
@@ -500,10 +504,13 @@ END(copyout_smap_erms)
cmpq%rcx,%rax
ja  copy_fault
 
-   xchgq   %rdi,%rsi
+   movq%rdi,%r8
+   movq%rsi,%rdi
+   movq%r8,%rsi
movq%rdx,%rcx
-   movb%cl,%al
 
+   xorl%eax,%eax
+
SMAP_DISABLE \smap
 .if \erms == 0
cmpq$15,%rcx
@@ -511,22 +518,20 @@ END(copyout_smap_erms)
shrq$3,%rcx /* copy longword-wise */
rep
movsq
-   movb%al,%cl
+   movb%dl,%cl
andb$7,%cl  /* copy remaining bytes */
jne 1f
SMAP_ENABLE \smap
-   xorl%eax,%eax
movq%rax,PCB_ONFAULT(%r9)
POP_FRAME_POINTER
ret
 .endif
+   ALIGN_TEXT
 1:
rep
movsb
 
SMAP_ENABLE \smap
-2:
-   xorl%eax,%eax
movq%rax,PCB_ONFAULT(%r9)
POP_FRAME_POINTER
ret
@@ -549,9 +554,9 @@ ENTRY(copyin_smap_erms)
 END(copyin_smap_erms)
 
ALIGN_TEXT
+   /* Trap entry clears PSL.AC */
 copy_fault:
-   movqPCPU(CURPCB),%rdx
-   movq$0,PCB_ONFAULT(%rdx)
+   movq$0,PCB_ONFAULT(%r9)
movl$EFAULT,%eax
POP_FRAME_POINTER
ret
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338966 - stable/11/cddl/contrib/opensolaris/cmd/zpool

2018-09-27 Thread Alexander Motin
Author: mav
Date: Thu Sep 27 14:57:20 2018
New Revision: 338966
URL: https://svnweb.freebsd.org/changeset/base/338966

Log:
  MFC r333081 (by eadler):
  zpool(8): correct list of default properties in 'list'.
  
  The default provides output in the following form:
  ```
  NAME   SIZE  ALLOC   FREE  CKPOINT  EXPANDSZ   FRAGCAP  DEDUP
  HEALTH  ALTROOT
  ```
  
  this corrects the man page.
  
  Also submitted upstream as
  https://github.com/openzfs/openzfs/pull/632/files (with slightly
  different changes needed)

Modified:
  stable/11/cddl/contrib/opensolaris/cmd/zpool/zpool.8
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/cddl/contrib/opensolaris/cmd/zpool/zpool.8
==
--- stable/11/cddl/contrib/opensolaris/cmd/zpool/zpool.8Thu Sep 27 
14:52:42 2018(r338965)
+++ stable/11/cddl/contrib/opensolaris/cmd/zpool/zpool.8Thu Sep 27 
14:57:20 2018(r338966)
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd September 08, 2017
+.Dd April 27, 2018
 .Dt ZPOOL 8
 .Os
 .Sh NAME
@@ -1548,9 +1548,11 @@ section for a list of valid properties. The default li
 .Sy size ,
 .Sy used ,
 .Sy available ,
-.Sy fragmentation ,
+.Sy checkpoint ,
 .Sy expandsize ,
+.Sy fragmentation ,
 .Sy capacity  ,
+.Sy dedupratio ,
 .Sy health ,
 .Sy altroot .
 .It Fl T Cm d Ns | Ns Cm u
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338965 - head/share/man/man4

2018-09-27 Thread Mateusz Piotrowski
Author: 0mp (ports committer)
Date: Thu Sep 27 14:52:42 2018
New Revision: 338965
URL: https://svnweb.freebsd.org/changeset/base/338965

Log:
  lib(4): Fix mdoc issues.
  
  - Fix "mandoc -Tlint" warnings.
  - Use the "Er" macro for errors.
  - Add an extra newline for readability.
  - Reference m_pullup(9) and m_defrag(9).
  - Use the "Fx" macro when talking about FreeBSD versions.
  
  Reviewed by:  bcr
  Approved by:  re (gjb), krion (mentor)
  Differential Revision:https://reviews.freebsd.org/D17270

Modified:
  head/share/man/man4/iflib.4

Modified: head/share/man/man4/iflib.4
==
--- head/share/man/man4/iflib.4 Thu Sep 27 14:31:41 2018(r338964)
+++ head/share/man/man4/iflib.4 Thu Sep 27 14:52:42 2018(r338965)
@@ -1,5 +1,5 @@
 .\" $FreeBSD$
-.Dd September 20, 2018
+.Dd September 27, 2018
 .Dt IFLIB 4
 .Os
 .Sh NAME
@@ -24,7 +24,7 @@ These variables must be set before loading the driver,
 or through the use of
 .Xr kenv 1 .
 They are all prefixed by
-.Va dev.X.Y.iflib.
+.Va dev.X.Y.iflib\&.
 where X is the driver name, and Y is the instance number.
 .Bl -tag -width indent
 .It Va override_nrxds
@@ -153,7 +153,8 @@ The transmit queue consumer index of the oldest descri
 The transmit queue producer index where the next descriptor to transmit will
 be inserted.
 .It Va no_tx_dma_setup
-Number of times DMA mapping a transmit mbuf failed for reasons other than 
EFBIG.
+Number of times DMA mapping a transmit mbuf failed for reasons other than
+.Er EFBIG .
 .It Va txd_encap_efbig
 Number of times DMA mapping a transmit mbuf failed due to requiring too many
 segments.
@@ -168,12 +169,18 @@ Number of times both
 .Xr m_collapse 9
 and
 .Xr m_defrag 9
-failed after an EFBIG error
+failed after an
+.Er EFBIG
+error
 result from DMA mapping a transmit mbuf.
 .It Va m_pullups
-Number of times m_pullup was called attempting to parse a header.
+Number of times
+.Xr m_pullup 9
+was called attempting to parse a header.
 .It Va mbuf_defrag
-Number of times m_defrag was called.
+Number of times
+.Xr m_defrag 9
+was called.
 .El
 .It Va rxqZ
 The following are repeated for each receive queue, where Z is the
@@ -187,9 +194,11 @@ Current receive ring consumer index.
 Current receive ring producer index.
 .El
 .El
+.Pp
 Additional OIDs useful for driver and iflib development are exposed when the
 INVARIANTS and/or WITNESS options are enabled in the kernel.
 .Sh SEE ALSO
 .Xr iflib 9
 .Sh HISTORY
-This framework was introduced in 11.0.
+This framework was introduced in
+.Fx 11.0 .
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338964 - head/sbin/init/rc.d

2018-09-27 Thread Konstantin Belousov
Author: kib
Date: Thu Sep 27 14:31:41 2018
New Revision: 338964
URL: https://svnweb.freebsd.org/changeset/base/338964

Log:
  Remove -m (update) from ldconfig -32 & -soft invocation on startup.
  
  Since r154114 which introduced ldconfig_local32_dirs, ldconfig -32 was
  called with -m. This means that ld-elf32.so.hints paths set is not
  cleared for compat32 on boot, unlike ld,so,hints.  Same -m was used in
  r294295 for ld-elf-soft.so.hints on arm.  The patch fixes the
  asymmetry.
  
  Noted by: Andreas Longwitz 
  Reviewed by:  brooks, emaste, imp
  Discussed with:   bdrewery
  Sponsored by: The FreeBSD Foundation
  Approved by:  re (gjb)
  MFC after:1 week
  Differential revision:https://reviews.freebsd.org/D17331

Modified:
  head/sbin/init/rc.d/ldconfig

Modified: head/sbin/init/rc.d/ldconfig
==
--- head/sbin/init/rc.d/ldconfigThu Sep 27 14:05:44 2018
(r338963)
+++ head/sbin/init/rc.d/ldconfigThu Sep 27 14:31:41 2018
(r338964)
@@ -58,7 +58,7 @@ ldconfig_start()
done
check_startmsgs &&
echo '32-bit compatibility ldconfig path:' ${_LDC}
-   ${ldconfig} -32 -m ${_ins} ${_LDC}
+   ${ldconfig} -32 ${_ins} ${_LDC}
;;
esac
 
@@ -80,7 +80,7 @@ ldconfig_start()
done
check_startmsgs &&
echo 'Soft Float compatibility ldconfig path:' 
${_LDC}
-   ${ldconfig} -soft -m ${_ins} ${_LDC}
+   ${ldconfig} -soft ${_ins} ${_LDC}
;;
esac
 
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338963 - in head/sys: amd64/amd64 conf

2018-09-27 Thread Mateusz Guzik
Author: mjg
Date: Thu Sep 27 14:05:44 2018
New Revision: 338963
URL: https://svnweb.freebsd.org/changeset/base/338963

Log:
  amd64: implement memcmp in assembly
  
  Both the in-kernel C variant and libc asm variant have very poor performance.
  The former compiles to a single byte comparison loop, which breaks down even
  for small sizes. The latter uses rep cmpsq/b which turn out to have very poor
  throughput and are slower than a hand-coded 32-byte comparison loop.
  
  Depending on size this is about 3-4 times faster than the current routines.
  
  Reviewed by:  kib
  Approved by:  re (gjb)
  Differential Revision:https://reviews.freebsd.org/D17328

Modified:
  head/sys/amd64/amd64/support.S
  head/sys/conf/files
  head/sys/conf/files.arm
  head/sys/conf/files.arm64
  head/sys/conf/files.i386
  head/sys/conf/files.mips
  head/sys/conf/files.powerpc
  head/sys/conf/files.riscv
  head/sys/conf/files.sparc64

Modified: head/sys/amd64/amd64/support.S
==
--- head/sys/amd64/amd64/support.S  Thu Sep 27 13:54:09 2018
(r338962)
+++ head/sys/amd64/amd64/support.S  Thu Sep 27 14:05:44 2018
(r338963)
@@ -101,6 +101,100 @@ ENTRY(sse2_pagezero)
 END(sse2_pagezero)
 
 /*
+ * memcmpy(b1, b2, len)
+ *rdi,rsi,len
+ */
+ENTRY(memcmp)
+   PUSH_FRAME_POINTER
+   cmpq$16,%rdx
+   jae 5f
+1:
+   testq   %rdx,%rdx
+   je  3f
+   xorl%ecx,%ecx
+2:
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jz  3f
+   movzbl  (%rdi,%rcx,1),%eax
+   movzbl  (%rsi,%rcx,1),%r8d
+   cmpb%r8b,%al
+   jne 4f
+   addq$1,%rcx
+   cmpq%rcx,%rdx
+   jne 2b
+3:
+   xorl%eax,%eax
+   POP_FRAME_POINTER
+   ret
+4:
+   subl%r8d,%eax
+   POP_FRAME_POINTER
+   ret
+5:
+   cmpq$32,%rdx
+   jae 7f
+6:
+   /*
+* 8 bytes
+*/
+   movq(%rdi),%r8
+   movq(%rsi),%r9
+   cmpq%r8,%r9
+   jne 1b
+   leaq8(%rdi),%rdi
+   leaq8(%rsi),%rsi
+   subq$8,%rdx
+   cmpq$8,%rdx
+   jae 6b
+   jl  1b
+   jmp 3b
+7:
+   /*
+* 32 bytes
+*/
+   movq(%rsi),%r8
+   movq8(%rsi),%r9
+   subq(%rdi),%r8
+   subq8(%rdi),%r9
+   or  %r8,%r9
+   jnz 1b
+
+   movq16(%rsi),%r8
+   movq24(%rsi),%r9
+   subq16(%rdi),%r8
+   subq24(%rdi),%r9
+   or  %r8,%r9
+   jnz 1b
+
+   leaq32(%rdi),%rdi
+   leaq32(%rsi),%rsi
+   subq$32,%rdx
+   cmpq$32,%rdx
+   jae 7b
+   jnz 1b
+   jmp 3b
+END(memcmp)
+
+/*
  * memmove(dst, src, cnt)
  * rdi, rsi, rdx
  * Adapted from bcopy written by:

Modified: head/sys/conf/files
==
--- head/sys/conf/files Thu Sep 27 13:54:09 2018(r338962)
+++ head/sys/conf/files Thu Sep 27 14:05:44 2018(r338963)
@@ -4041,7 +4041,6 @@ libkern/murmur3_32.c  standard
 libkern/mcount.c   optional profiling-routine
 libkern/memcchr.c  standard
 libkern/memchr.c   standard
-libkern/memcmp.c   standard
 libkern/memmem.c   optional gdb
 libkern/qsort.cstandard
 libkern/qsort_r.c  standard

Modified: head/sys/conf/files.arm
==
--- head/sys/conf/files.arm Thu Sep 27 13:54:09 2018(r338962)
+++ head/sys/conf/files.arm Thu Sep 27 14:05:44 2018(r338963)
@@ -163,6 +163,7 @@ libkern/fls.c   standard
 libkern/flsl.c standard
 libkern/flsll.cstandard
 libkern/lshrdi3.c  standard
+libkern/memcmp.c   standard
 libkern/moddi3.c   standard
 libkern/qdivrem.c  standard
 libkern/ucmpdi2.c  standard

Modified: head/sys/conf/files.arm64
==
--- head/sys/conf/files.arm64   Thu Sep 27 13:54:09 2018(r338962)
+++ head/sys/conf/files.arm64   Thu Sep 27 14:05:44 2018(r338963)
@@ -244,6 +244,7 @@ libkern/ffsll.c standard
 libkern/fls.c  standard
 libkern/flsl.c  

svn commit: r338962 - head/sys/arm64/arm64

2018-09-27 Thread Andrew Turner
Author: andrew
Date: Thu Sep 27 13:54:09 2018
New Revision: 338962
URL: https://svnweb.freebsd.org/changeset/base/338962

Log:
  Export ID_AA64PFR0_EL1 to userland
  
  Create a user view of the ID_AA64PFR0_EL1 register with values common
  across all CPUs.
  
  Approved by:  re (kib)
  Sponsored by: ABT Systems Ltd
  Differential Revision:https://reviews.freebsd.org/D17301

Modified:
  head/sys/arm64/arm64/identcpu.c

Modified: head/sys/arm64/arm64/identcpu.c
==
--- head/sys/arm64/arm64/identcpu.c Thu Sep 27 13:50:57 2018
(r338961)
+++ head/sys/arm64/arm64/identcpu.c Thu Sep 27 13:54:09 2018
(r338962)
@@ -88,6 +88,7 @@ struct cpu_desc {
 };
 
 struct cpu_desc cpu_desc[MAXCPU];
+struct cpu_desc user_cpu_desc;
 static u_int cpu_print_regs;
 #definePRINT_ID_AA64_AFR0  0x0001
 #definePRINT_ID_AA64_AFR1  0x0002
@@ -163,26 +164,77 @@ const struct cpu_implementers cpu_implementers[] = {
CPU_IMPLEMENTER_NONE,
 };
 
-struct mrs_safe_value {
+#defineMRS_TYPE_MASK   0xf
+#defineMRS_INVALID 0
+#defineMRS_EXACT   1
+#defineMRS_EXACT_VAL(x)(MRS_EXACT | ((x) << 4))
+#defineMRS_EXACT_FIELD(x)  ((x) >> 4)
+#defineMRS_LOWER   2
+
+struct mrs_field {
+   boolsign;
+   u_int   type;
+   u_int   shift;
+};
+
+#defineMRS_FIELD(_sign, _type, _shift) 
\
+   {   \
+   .sign = (_sign),\
+   .type = (_type),\
+   .shift = (_shift),  \
+   }
+
+#defineMRS_FIELD_END   { .type = MRS_INVALID, }
+
+static struct mrs_field id_aa64pfr0_fields[] = {
+   MRS_FIELD(false, MRS_EXACT, ID_AA64PFR0_SVE_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64PFR0_RAS_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64PFR0_GIC_SHIFT),
+   MRS_FIELD(true,  MRS_LOWER, ID_AA64PFR0_ADV_SIMD_SHIFT),
+   MRS_FIELD(true,  MRS_LOWER, ID_AA64PFR0_FP_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64PFR0_EL3_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64PFR0_EL2_SHIFT),
+   MRS_FIELD(false, MRS_LOWER, ID_AA64PFR0_EL1_SHIFT),
+   MRS_FIELD(false, MRS_LOWER, ID_AA64PFR0_EL0_SHIFT),
+   MRS_FIELD_END,
+};
+
+static struct mrs_field id_aa64dfr0_fields[] = {
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_PMS_VER_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_CTX_CMPS_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_WRPS_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_BRPS_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_PMU_VER_SHIFT),
+   MRS_FIELD(false, MRS_EXACT, ID_AA64DFR0_TRACE_VER_SHIFT),
+   MRS_FIELD(false, MRS_EXACT_VAL(0x6), ID_AA64DFR0_DEBUG_VER_SHIFT),
+   MRS_FIELD_END,
+};
+
+struct mrs_user_reg {
u_int   CRm;
u_int   Op2;
-   uint64_tvalue;
+   size_t  offset;
+   struct mrs_field *fields;
 };
 
-static struct mrs_safe_value safe_values[] = {
+static struct mrs_user_reg user_regs[] = {
{   /* id_aa64pfr0_el1 */
.CRm = 4,
.Op2 = 0,
-   .value = ID_AA64PFR0_ADV_SIMD_NONE | ID_AA64PFR0_FP_NONE |
-   ID_AA64PFR0_EL1_64 | ID_AA64PFR0_EL0_64,
+   .offset = __offsetof(struct cpu_desc, id_aa64pfr0),
+   .fields = id_aa64pfr0_fields,
},
{   /* id_aa64dfr0_el1 */
.CRm = 5,
.Op2 = 0,
-   .value = ID_AA64DFR0_DEBUG_VER_8,
+   .offset = __offsetof(struct cpu_desc, id_aa64dfr0),
+   .fields = id_aa64dfr0_fields,
},
 };
 
+#defineCPU_DESC_FIELD(desc, idx)   
\
+*(uint64_t *)((char *)&(desc) + user_regs[(idx)].offset)
+
 static int
 user_mrs_handler(vm_offset_t va, uint32_t insn, struct trapframe *frame,
 uint32_t esr)
@@ -213,9 +265,9 @@ user_mrs_handler(vm_offset_t va, uint32_t insn, struct
Op2 = mrs_Op2(insn);
value = 0;
 
-   for (i = 0; i < nitems(safe_values); i++) {
-   if (safe_values[i].CRm == CRm && safe_values[i].Op2 == Op2) {
-   value = safe_values[i].value;
+   for (i = 0; i < nitems(user_regs); i++) {
+   if (user_regs[i].CRm == CRm && user_regs[i].Op2 == Op2) {
+   value = CPU_DESC_FIELD(user_cpu_desc, i);
break;
}
}
@@ -256,12 +308,64 @@ user_mrs_handler(vm_offset_t va, uint32_t insn, struct
 }
 
 static void
+update_user_regs(u_int cpu)
+{
+   struct mrs_field *fields;
+   uint64_t cur, 

svn commit: r338961 - in head/sys/arm64: arm64 include

2018-09-27 Thread Andrew Turner
Author: andrew
Date: Thu Sep 27 13:50:57 2018
New Revision: 338961
URL: https://svnweb.freebsd.org/changeset/base/338961

Log:
  Move the undefined instruction handler to identcpu.c so we have access
  to the registers from boot.
  
  Approved by:  re (kib)
  Sponsored by: ABT Systems Ltd
  Differential Revision:https://reviews.freebsd.org/D17301

Modified:
  head/sys/arm64/arm64/identcpu.c
  head/sys/arm64/arm64/undefined.c
  head/sys/arm64/include/undefined.h

Modified: head/sys/arm64/arm64/identcpu.c
==
--- head/sys/arm64/arm64/identcpu.c Thu Sep 27 12:20:32 2018
(r338960)
+++ head/sys/arm64/arm64/identcpu.c Thu Sep 27 13:50:57 2018
(r338961)
@@ -43,6 +43,7 @@ __FBSDID("$FreeBSD$");
 #include 
 #include 
 #include 
+#include 
 
 static int ident_lock;
 
@@ -162,6 +163,98 @@ const struct cpu_implementers cpu_implementers[] = {
CPU_IMPLEMENTER_NONE,
 };
 
+struct mrs_safe_value {
+   u_int   CRm;
+   u_int   Op2;
+   uint64_tvalue;
+};
+
+static struct mrs_safe_value safe_values[] = {
+   {   /* id_aa64pfr0_el1 */
+   .CRm = 4,
+   .Op2 = 0,
+   .value = ID_AA64PFR0_ADV_SIMD_NONE | ID_AA64PFR0_FP_NONE |
+   ID_AA64PFR0_EL1_64 | ID_AA64PFR0_EL0_64,
+   },
+   {   /* id_aa64dfr0_el1 */
+   .CRm = 5,
+   .Op2 = 0,
+   .value = ID_AA64DFR0_DEBUG_VER_8,
+   },
+};
+
+static int
+user_mrs_handler(vm_offset_t va, uint32_t insn, struct trapframe *frame,
+uint32_t esr)
+{
+   uint64_t value;
+   int CRm, Op2, i, reg;
+
+   if ((insn & MRS_MASK) != MRS_VALUE)
+   return (0);
+
+   /*
+* We only emulate Op0 == 3, Op1 == 0, CRn == 0, CRm == {0, 4-7}.
+* These are in the EL1 CPU identification space.
+* CRm == 0 holds MIDR_EL1, MPIDR_EL1, and REVID_EL1.
+* CRm == {4-7} holds the ID_AA64 registers.
+*
+* For full details see the ARMv8 ARM (ARM DDI 0487C.a)
+* Table D9-2 System instruction encodings for non-Debug System
+* register accesses.
+*/
+   if (mrs_Op0(insn) != 3 || mrs_Op1(insn) != 0 || mrs_CRn(insn) != 0)
+   return (0);
+
+   CRm = mrs_CRm(insn);
+   if (CRm > 7 || (CRm < 4 && CRm != 0))
+   return (0);
+
+   Op2 = mrs_Op2(insn);
+   value = 0;
+
+   for (i = 0; i < nitems(safe_values); i++) {
+   if (safe_values[i].CRm == CRm && safe_values[i].Op2 == Op2) {
+   value = safe_values[i].value;
+   break;
+   }
+   }
+
+   if (CRm == 0) {
+   switch (Op2) {
+   case 0:
+   value = READ_SPECIALREG(midr_el1);
+   break;
+   case 5:
+   value = READ_SPECIALREG(mpidr_el1);
+   break;
+   case 6:
+   value = READ_SPECIALREG(revidr_el1);
+   break;
+   default:
+   return (0);
+   }
+   }
+
+   /*
+* We will handle this instruction, move to the next so we
+* don't trap here again.
+*/
+   frame->tf_elr += INSN_SIZE;
+
+   reg = MRS_REGISTER(insn);
+   /* If reg is 31 then write to xzr, i.e. do nothing */
+   if (reg == 31)
+   return (1);
+
+   if (reg < nitems(frame->tf_x))
+   frame->tf_x[reg] = value;
+   else if (reg == 30)
+   frame->tf_lr = value;
+
+   return (1);
+}
+
 static void
 identify_cpu_sysinit(void *dummy __unused)
 {
@@ -170,6 +263,8 @@ identify_cpu_sysinit(void *dummy __unused)
CPU_FOREACH(cpu) {
print_cpu_features(cpu);
}
+
+   install_undef_handler(true, user_mrs_handler);
 }
 SYSINIT(idenrity_cpu, SI_SUB_SMP, SI_ORDER_ANY, identify_cpu_sysinit, NULL);
 

Modified: head/sys/arm64/arm64/undefined.c
==
--- head/sys/arm64/arm64/undefined.cThu Sep 27 12:20:32 2018
(r338960)
+++ head/sys/arm64/arm64/undefined.cThu Sep 27 13:50:57 2018
(r338961)
@@ -53,135 +53,6 @@ struct undef_handler {
  */
 LIST_HEAD(, undef_handler) undef_handlers[2];
 
-#defineMRS_MASK0xfff0
-#defineMRS_VALUE   0xd530
-#defineMRS_SPECIAL(insn)   ((insn) & 0x000fffe0)
-#defineMRS_REGISTER(insn)  ((insn) & 0x001f)
-#define MRS_Op0_SHIFT  19
-#define MRS_Op0_MASK   0x0008
-#define MRS_Op1_SHIFT  16
-#define MRS_Op1_MASK   0x0007
-#define MRS_CRn_SHIFT  12
-#define 

svn commit: r338960 - in head: contrib/bmake share/man/man5

2018-09-27 Thread Mateusz Piotrowski
Author: 0mp (ports committer)
Date: Thu Sep 27 12:20:32 2018
New Revision: 338960
URL: https://svnweb.freebsd.org/changeset/base/338960

Log:
  Cross-reference style.Makefile(5) from make(1) and make.conf(5).
  
  Reviewed by:  krion, mat, sjg
  Approved by:  re (gjb), krion (mentor), mat (mentor)
  Sponsored by: Bally Wulff Games & Entertainment GmbH
  Differential Revision:https://reviews.freebsd.org/D17170

Modified:
  head/contrib/bmake/make.1
  head/share/man/man5/make.conf.5

Modified: head/contrib/bmake/make.1
==
--- head/contrib/bmake/make.1   Thu Sep 27 12:15:31 2018(r338959)
+++ head/contrib/bmake/make.1   Thu Sep 27 12:20:32 2018(r338960)
@@ -29,7 +29,7 @@
 .\"
 .\"from: @(#)make.18.4 (Berkeley) 3/19/94
 .\"
-.Dd June 22, 2017
+.Dd September 27, 2018
 .Dt MAKE 1
 .Os
 .Sh NAME
@@ -796,7 +796,7 @@ Tells
 whether to pass the descriptors of the job token queue
 even if the target is not tagged with
 .Ic .MAKE
-The default is 
+The default is
 .Ql Pa yes
 for backwards compatability with
 .Fx 9.0
@@ -2385,7 +2385,8 @@ Basic use of suffix rules (for files only in the curre
 not trying to chain transformations together, etc.) is also reasonably
 portable.
 .Sh SEE ALSO
-.Xr mkdep 1
+.Xr mkdep 1 ,
+.Xr style.Makefile 5
 .Sh HISTORY
 A
 .Nm

Modified: head/share/man/man5/make.conf.5
==
--- head/share/man/man5/make.conf.5 Thu Sep 27 12:15:31 2018
(r338959)
+++ head/share/man/man5/make.conf.5 Thu Sep 27 12:20:32 2018
(r338960)
@@ -24,7 +24,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd August 15, 2018
+.Dd September 27, 2018
 .Dt MAKE.CONF 5
 .Os
 .Sh NAME
@@ -676,6 +676,7 @@ Porter's Handbook.
 .Xr install 1 ,
 .Xr make 1 ,
 .Xr src.conf 5 ,
+.Xr style.Makefile 5 ,
 .Xr environ 7 ,
 .Xr ports 7 ,
 .Xr sendmail 8
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338959 - head/sys/conf

2018-09-27 Thread Mateusz Piotrowski
Author: 0mp (ports committer)
Date: Thu Sep 27 12:15:31 2018
New Revision: 338959
URL: https://svnweb.freebsd.org/changeset/base/338959

Log:
  newvers.sh: Unbreak building in Git repositories.
  
  Building the kernel in Git repositories when git-svn is not available and
  the "help.autocorrect" Git parameter is enabled results in Git trying to
  replace the "svn" command (it does not know) with "serve". As a result the
  output of the "git server" command is appended to the value of the
  environmental variable VERINFO, which causes the auto generated vers.c
  file to contain invalid C syntax (missing newline escapes):
  
  #define "@(#)FreeBSD 12.0-ALPHA7  r000eversion 2
  0015agent=git/2.19.0
  000cls-refs
  0012fetch=shallow
  0012server-option
  =5e2272613fa(splash-vt)"
  #define VERSTR "FreeBSD 12.0-ALPHA7  r000eversion 2
  0015agent=git/2.19.0
  000cls-refs
  0012fetch=shallow
  0012server-option
  =5e2272613fa(splash-vt)\n"
  
  Using `-c help.autocorrect=0` seems to be a good solution as it does not
  modify user's environment. I am not sure, however, if we should use
  programs (or Git commands), which we are not sure exist (we never check if
  git-svn is available on the host), as there may be more unexpected
  behaviors like this one.
  
  Reviewed by:  eadler, emaste, krion
  Approved by:  re (gjb), krion (mentor)
  Sponsored by: Bally Wulff Games & Entertainment GmbH
  Differential Revision:https://reviews.freebsd.org/D17271

Modified:
  head/sys/conf/newvers.sh

Modified: head/sys/conf/newvers.sh
==
--- head/sys/conf/newvers.shThu Sep 27 12:08:53 2018(r338958)
+++ head/sys/conf/newvers.shThu Sep 27 12:15:31 2018(r338959)
@@ -183,7 +183,7 @@ done
 if findvcs .git; then
for dir in /usr/bin /usr/local/bin; do
if [ -x "${dir}/git" ] ; then
-   git_cmd="${dir}/git --git-dir=${VCSDIR}"
+   git_cmd="${dir}/git -c help.autocorrect=0 
--git-dir=${VCSDIR}"
break
fi
done
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338958 - head/share/man/man5

2018-09-27 Thread Mateusz Piotrowski
Author: 0mp (ports committer)
Date: Thu Sep 27 12:08:53 2018
New Revision: 338958
URL: https://svnweb.freebsd.org/changeset/base/338958

Log:
  msdosfs(5): Explain how to determine version of the FAT file system.
  
  While here, remove deprecated Tn macros.
  
  Reviewed by:  bcr
  Approved by:  re (gjb), krion (mentor)
  Sponsored by: Bally Wulff Games & Entertainment GmbH
  Differential Revision:https://reviews.freebsd.org/D17237

Modified:
  head/share/man/man5/msdosfs.5

Modified: head/share/man/man5/msdosfs.5
==
--- head/share/man/man5/msdosfs.5   Thu Sep 27 11:16:19 2018
(r338957)
+++ head/share/man/man5/msdosfs.5   Thu Sep 27 12:08:53 2018
(r338958)
@@ -2,7 +2,7 @@
 .\" Written by Tom Rhodes
 .\" This file is in the public domain.
 .\"
-.Dd October 1, 2013
+.Dd September 27, 2018
 .Dt MSDOSFS 5
 .Os
 .Sh NAME
@@ -15,9 +15,7 @@ The
 .Nm
 driver will permit the
 .Fx
-kernel to read and write
-.Tn MS-DOS
-based file systems.
+kernel to read and write MS-DOS based file systems.
 .Pp
 The most common usage follows:
 .Pp
@@ -43,9 +41,7 @@ that looks similar to:
 /dev/ada0sN/dosmsdosfs rw  0   0
 .Ed
 .Pp
-This will mount an
-.Tn MS-DOS
-based partition at the
+This will mount an MS-DOS based partition at the
 .Pa /dos
 mount point during system boot.
 Using
@@ -58,6 +54,15 @@ See
 for more information on
 .Fx
 directory layout.
+.Sh EXAMPLES
+Determine which FAT file system version (e.g, FAT16, FAT32)
+is a partition formatted with:
+.Bd -literal -offset indent
+file -s /dev/da0s1
+.Ed
+.Pp
+.Xr gpart 8
+may also be used to extract this information.
 .Sh SEE ALSO
 .Xr mount 2 ,
 .Xr unmount 2 ,
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"


svn commit: r338957 - in head/sys/amd64: include vmm vmm/intel

2018-09-27 Thread Andrew Turner
Author: andrew
Date: Thu Sep 27 11:16:19 2018
New Revision: 338957
URL: https://svnweb.freebsd.org/changeset/base/338957

Log:
  Handle a guest executing a vm instruction by trapping and raising an
  undefined instruction exception. Previously we would exit the guest,
  however an unprivileged user could execute these.
  
  Found with:   syzkaller
  Reviewed by:  araujo, tychon (previous version)
  Approved by:  re (kib)
  MFC after:1 week
  Differential Revision:https://reviews.freebsd.org/D17192

Modified:
  head/sys/amd64/include/vmm.h
  head/sys/amd64/vmm/intel/vmx.c
  head/sys/amd64/vmm/vmm.c

Modified: head/sys/amd64/include/vmm.h
==
--- head/sys/amd64/include/vmm.hWed Sep 26 21:28:14 2018
(r338956)
+++ head/sys/amd64/include/vmm.hThu Sep 27 11:16:19 2018
(r338957)
@@ -557,6 +557,7 @@ enum vm_exitcode {
VM_EXITCODE_SVM,
VM_EXITCODE_REQIDLE,
VM_EXITCODE_DEBUG,
+   VM_EXITCODE_VMINSN,
VM_EXITCODE_MAX
 };
 

Modified: head/sys/amd64/vmm/intel/vmx.c
==
--- head/sys/amd64/vmm/intel/vmx.c  Wed Sep 26 21:28:14 2018
(r338956)
+++ head/sys/amd64/vmm/intel/vmx.c  Thu Sep 27 11:16:19 2018
(r338957)
@@ -267,6 +267,9 @@ SDT_PROBE_DEFINE3(vmm, vmx, exit, monitor,
 SDT_PROBE_DEFINE3(vmm, vmx, exit, mwait,
 "struct vmx *", "int", "struct vm_exit *");
 
+SDT_PROBE_DEFINE3(vmm, vmx, exit, vminsn,
+"struct vmx *", "int", "struct vm_exit *");
+
 SDT_PROBE_DEFINE4(vmm, vmx, exit, unknown,
 "struct vmx *", "int", "struct vm_exit *", "uint32_t");
 
@@ -2637,6 +2640,19 @@ vmx_exit_process(struct vmx *vmx, int vcpu, struct vm_
case EXIT_REASON_MWAIT:
SDT_PROBE3(vmm, vmx, exit, mwait, vmx, vcpu, vmexit);
vmexit->exitcode = VM_EXITCODE_MWAIT;
+   break;
+   case EXIT_REASON_VMCALL:
+   case EXIT_REASON_VMCLEAR:
+   case EXIT_REASON_VMLAUNCH:
+   case EXIT_REASON_VMPTRLD:
+   case EXIT_REASON_VMPTRST:
+   case EXIT_REASON_VMREAD:
+   case EXIT_REASON_VMRESUME:
+   case EXIT_REASON_VMWRITE:
+   case EXIT_REASON_VMXOFF:
+   case EXIT_REASON_VMXON:
+   SDT_PROBE3(vmm, vmx, exit, vminsn, vmx, vcpu, vmexit);
+   vmexit->exitcode = VM_EXITCODE_VMINSN;
break;
default:
SDT_PROBE4(vmm, vmx, exit, unknown,

Modified: head/sys/amd64/vmm/vmm.c
==
--- head/sys/amd64/vmm/vmm.cWed Sep 26 21:28:14 2018(r338956)
+++ head/sys/amd64/vmm/vmm.cThu Sep 27 11:16:19 2018(r338957)
@@ -1737,6 +1737,7 @@ restart:
break;
case VM_EXITCODE_MONITOR:
case VM_EXITCODE_MWAIT:
+   case VM_EXITCODE_VMINSN:
vm_inject_ud(vm, vcpuid);
break;
default:
___
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"