use SMBIOS for inteldrm panel orientation quirks
Use SMBIOS data for panel orientation. Uses BIOS dates when other
strings are generic.
There are orientation quirks in drm_panel_orientation_quirks.c for:
Acer One 10 (S1003)
Asus T100HA
GPD MicroPC (generic strings, also match on bios date)
GPD Pocket 2 (generic strings, also match on bios date)
GPD Win (same note on DMI match as GPD Pocket)
I.T.Works TW891
Lenovo Ideapad Miix 320
VIOS LTH17
This codepath is also called from
i915/vlv_dsi.c with the call to
drm_connector_init_panel_orientation_property().
Index: arch/amd64/amd64/bios.c
===
RCS file: /cvs/src/sys/arch/amd64/amd64/bios.c,v
retrieving revision 1.37
diff -u -p -r1.37 bios.c
--- arch/amd64/amd64/bios.c 23 Oct 2018 17:51:32 - 1.37
+++ arch/amd64/amd64/bios.c 12 Jul 2019 01:57:08 -
@@ -67,6 +67,8 @@ const char *smbios_uninfo[] = {
"SYS-"
};
+char smbios_bios_date[64];
+
int
bios_match(struct device *parent, void *match , void *aux)
{
@@ -141,8 +143,11 @@ bios_attach(struct device *parent, struc
printf(" version \"%s\"",
fixstring(scratch));
if ((smbios_get_string(, sb->release,
- scratch, sizeof(scratch))) != NULL)
+ scratch, sizeof(scratch))) != NULL) {
+ strlcpy(smbios_bios_date, fixstring(scratch),
+ sizeof(smbios_bios_date));
printf(" date %s", fixstring(scratch));
+ }
}
smbios_info(sc->sc_dev.dv_xname);
Index: arch/i386/i386/bios.c
===
RCS file: /cvs/src/sys/arch/i386/i386/bios.c,v
retrieving revision 1.120
diff -u -p -r1.120 bios.c
--- arch/i386/i386/bios.c 23 Oct 2018 17:51:32 - 1.120
+++ arch/i386/i386/bios.c 12 Jul 2019 03:45:03 -
@@ -140,6 +140,8 @@ const char *smbios_uninfo[] = {
};
+char smbios_bios_date[64];
+
int
biosprobe(struct device *parent, void *match, void *aux)
{
@@ -305,8 +307,12 @@ biosattach(struct device *parent, struct
printf(" version \"%s\"",
fixstring(scratch));
if ((smbios_get_string(, sb->release,
- scratch, sizeof(scratch))) != NULL)
+ scratch, sizeof(scratch))) != NULL) {
+ strlcpy(smbios_bios_date,
+ fixstring(scratch),
+ sizeof(smbios_bios_date));
printf(" date %s", fixstring(scratch));
+ }
}
smbios_info(sc->sc_dev.dv_xname);
Index: dev/pci/drm/drm_linux.c
===
RCS file: /cvs/src/sys/dev/pci/drm/drm_linux.c,v
retrieving revision 1.43
diff -u -p -r1.43 drm_linux.c
--- dev/pci/drm/drm_linux.c 10 Jul 2019 16:43:19 - 1.43
+++ dev/pci/drm/drm_linux.c 12 Jul 2019 03:46:54 -
@@ -394,6 +394,34 @@ dmi_found(const struct dmi_system_id *ds
return true;
}
+const struct dmi_system_id *
+dmi_first_match(const struct dmi_system_id *sysid)
+{
+ const struct dmi_system_id *dsi;
+
+ for (dsi = sysid; dsi->matches[0].slot != 0 ; dsi++) {
+ if (dmi_found(dsi))
+ return dsi;
+ }
+
+ return NULL;
+}
+
+#ifdef CONFIG_DMI
+extern char smbios_bios_date[];
+#endif
+
+const char *
+dmi_get_system_info(int slot)
+{
+ WARN_ON(slot != DMI_BIOS_DATE);
+#ifdef CONFIG_DMI
+ if (slot == DMI_BIOS_DATE)
+ return smbios_bios_date;
+#endif
+ return NULL;
+}
+
int
dmi_check_system(const struct dmi_system_id *sysid)
{
Index: dev/pci/drm/i915/i915_drv.c
===
RCS file: /cvs/src/sys/dev/pci/drm/i915/i915_drv.c,v
retrieving revision 1.118
diff -u -p -r1.118 i915_drv.c
--- dev/pci/drm/i915/i915_drv.c 8 May 2019 15:55:56 - 1.118
+++ dev/pci/drm/i915/i915_drv.c 12 Jul 2019 03:50:53 -
@@ -45,6 +45,7 @@
#include
#include
#include
+#include
#include "i915_drv.h"
#include "i915_trace.h"
@@ -3598,6 +3599,7 @@ inteldrm_attachhook(struct device *self)
struct wsemuldisplaydev_attach_args aa;
const struct drm_pcidev *id = dev_priv->id;
struct drm_device *dev = _priv->drm;
+ int orientation_quirk;
if (i915_driver_load(dev_priv, id))
goto fail;
@@ -3613,24 +3615,14 @@ inteldrm_attachhook(struct device *self)
inteldrm_init_backlight(dev_priv);
ri->ri_flg
Re: rtable_walk(9)
Hi Martin, Martin Pieuchot wrote on Thu, Jul 11, 2019 at 05:18:41PM -0300: > Index: rtable_walk.9 > === > RCS file: rtable_walk.9 > diff -N rtable_walk.9 > --- /dev/null 1 Jan 1970 00:00:00 - > +++ rtable_walk.9 11 Jul 2019 20:16:23 - > @@ -0,0 +1,68 @@ > +.\" $OpenBSD$ > +.\" > +.\" Copyright (c) 2019 Martin Pieuchot > +.\" > +.\" Permission to use, copy, modify, and distribute this software for any > +.\" purpose with or without fee is hereby granted, provided that the above > +.\" copyright notice and this permission notice appear in all copies. > +.\" > +.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES > +.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF > +.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR > +.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES > +.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN > +.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF > +.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. > +.\" > +.Dd $Mdocdate$ > +.Dt RTABLE_WALK 9 > +.Os > +.Sh NAME > +.Nm rtable_walk > +.Nd iterate over a routing table > +.Sh SYNOPSIS > +.In net/rtable.h > +.Ft int > +.Fn rtable_walk "unsigned int rtableid" "sa_family_t af" \ > +"struct rtentry **prt" "int (*func)(struct rtentry *, void *, unsigned int)" > \ > +"void *arg" While this isn't incorrect, i suggest the more readable .Ft int .Fo rtable_walk .Fa "unsigned int rtableid" .Fa "sa_family_t af" .Fa "struct rtentry **prt" .Fa "int (*func)(struct rtentry *, void *, unsigned int)" .Fa "void *arg" .Fc for functions with long arguments or with more than one or two arguments. > +.Sh DESCRIPTION > +The > +.Fn rtable_walk > +function iterates over the routing table > +.Fa rtableid > +and applies > +.Fa func > +to all entries of address family > +.Fa af . > +.Pp > +The iteration is interrupted as soon as > +.Fa func > +returns a non-zero value. > +If > +.Fa prt > +is non-null Please consider the more usual form: is not .Dv NULL These are not objections but merely suggestions. Yours, Ingo > when the iteration is interrupted, it is set to the current > +routing entry. > +In that case > +.Fn rtfree > +must be called on the routing entry pointed by > +.Fa prt . > +.Sh CONTEXT > +.Fn rtable_walk > +can be called during autoconf or from process context. > +.Sh RETURN VALUES > +.Fn rtable_walk > +returns any non-zero value returned by > +.Fa func . > +It may also fail with: > +.Pp > +.Bl -tag -width Er -compact > +.It Bq Er EAFNOSUPPORT > +A routing table with ID of > +.Fa rtableid > +and address family of > +.Fa af > +doesn't exist. > +.El > +.Sh SEE ALSO > +.Xr rtfree 9
Re: rtable_walk(9)
On Thu, Jul 11, 2019 at 05:18:41PM -0300, Martin Pieuchot wrote: > Document this complex function. Any wording suggestion? > hi. the page reads fine. i have one tweak inline. oh, and you might want to cross Xr back from rtfree. > Index: Makefile > === > RCS file: /cvs/src/share/man/man9/Makefile,v > retrieving revision 1.295 > diff -u -p -r1.295 Makefile > --- Makefile 21 Jun 2019 09:39:48 - 1.295 > +++ Makefile 11 Jul 2019 20:16:54 - > @@ -29,7 +29,8 @@ MAN=aml_evalnode.9 atomic_add_int.9 ato > pmap.9 pool.9 pool_cache_init.9 ppsratecheck.9 printf.9 psignal.9 \ > RBT_INIT.9 \ > radio.9 arc4random.9 rasops.9 ratecheck.9 refcnt_init.9 resettodr.9 \ > - rssadapt.9 route.9 rt_ifa_add.9 rt_timer_add.9 rtalloc.9 rtable_add.9 \ > + rssadapt.9 route.9 rt_ifa_add.9 rt_timer_add.9 \ > + rtalloc.9 rtable_add.9 rtable_walk.9 \ > rtlabel_id2name.9 rtrequest.9 rwlock.9 SRPL_EMPTY_LOCKED.9 SipHash24.9 \ > sensor_attach.9 sigio_init.9 \ > SMR_LIST_INIT.9 SMR_PTR_GET.9 smr_call.9 \ > Index: rtable_walk.9 > === > RCS file: rtable_walk.9 > diff -N rtable_walk.9 > --- /dev/null 1 Jan 1970 00:00:00 - > +++ rtable_walk.9 11 Jul 2019 20:16:23 - > @@ -0,0 +1,68 @@ > +.\" $OpenBSD$ > +.\" > +.\" Copyright (c) 2019 Martin Pieuchot > +.\" > +.\" Permission to use, copy, modify, and distribute this software for any > +.\" purpose with or without fee is hereby granted, provided that the above > +.\" copyright notice and this permission notice appear in all copies. > +.\" > +.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES > +.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF > +.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR > +.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES > +.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN > +.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF > +.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. > +.\" > +.Dd $Mdocdate$ > +.Dt RTABLE_WALK 9 > +.Os > +.Sh NAME > +.Nm rtable_walk > +.Nd iterate over a routing table > +.Sh SYNOPSIS > +.In net/rtable.h > +.Ft int > +.Fn rtable_walk "unsigned int rtableid" "sa_family_t af" \ > +"struct rtentry **prt" "int (*func)(struct rtentry *, void *, unsigned int)" > \ > +"void *arg" > +.Sh DESCRIPTION > +The > +.Fn rtable_walk > +function iterates over the routing table > +.Fa rtableid > +and applies > +.Fa func > +to all entries of address family > +.Fa af . > +.Pp > +The iteration is interrupted as soon as > +.Fa func > +returns a non-zero value. > +If > +.Fa prt > +is non-null when the iteration is interrupted, it is set to the current > +routing entry. > +In that case > +.Fn rtfree > +must be called on the routing entry pointed by pointed *to* i guess. jmc > +.Fa prt . > +.Sh CONTEXT > +.Fn rtable_walk > +can be called during autoconf or from process context. > +.Sh RETURN VALUES > +.Fn rtable_walk > +returns any non-zero value returned by > +.Fa func . > +It may also fail with: > +.Pp > +.Bl -tag -width Er -compact > +.It Bq Er EAFNOSUPPORT > +A routing table with ID of > +.Fa rtableid > +and address family of > +.Fa af > +doesn't exist. > +.El > +.Sh SEE ALSO > +.Xr rtfree 9 >
rtable_walk(9)
Document this complex function. Any wording suggestion? Index: Makefile === RCS file: /cvs/src/share/man/man9/Makefile,v retrieving revision 1.295 diff -u -p -r1.295 Makefile --- Makefile21 Jun 2019 09:39:48 - 1.295 +++ Makefile11 Jul 2019 20:16:54 - @@ -29,7 +29,8 @@ MAN= aml_evalnode.9 atomic_add_int.9 ato pmap.9 pool.9 pool_cache_init.9 ppsratecheck.9 printf.9 psignal.9 \ RBT_INIT.9 \ radio.9 arc4random.9 rasops.9 ratecheck.9 refcnt_init.9 resettodr.9 \ - rssadapt.9 route.9 rt_ifa_add.9 rt_timer_add.9 rtalloc.9 rtable_add.9 \ + rssadapt.9 route.9 rt_ifa_add.9 rt_timer_add.9 \ + rtalloc.9 rtable_add.9 rtable_walk.9 \ rtlabel_id2name.9 rtrequest.9 rwlock.9 SRPL_EMPTY_LOCKED.9 SipHash24.9 \ sensor_attach.9 sigio_init.9 \ SMR_LIST_INIT.9 SMR_PTR_GET.9 smr_call.9 \ Index: rtable_walk.9 === RCS file: rtable_walk.9 diff -N rtable_walk.9 --- /dev/null 1 Jan 1970 00:00:00 - +++ rtable_walk.9 11 Jul 2019 20:16:23 - @@ -0,0 +1,68 @@ +.\" $OpenBSD$ +.\" +.\" Copyright (c) 2019 Martin Pieuchot +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +.\" +.Dd $Mdocdate$ +.Dt RTABLE_WALK 9 +.Os +.Sh NAME +.Nm rtable_walk +.Nd iterate over a routing table +.Sh SYNOPSIS +.In net/rtable.h +.Ft int +.Fn rtable_walk "unsigned int rtableid" "sa_family_t af" \ +"struct rtentry **prt" "int (*func)(struct rtentry *, void *, unsigned int)" \ +"void *arg" +.Sh DESCRIPTION +The +.Fn rtable_walk +function iterates over the routing table +.Fa rtableid +and applies +.Fa func +to all entries of address family +.Fa af . +.Pp +The iteration is interrupted as soon as +.Fa func +returns a non-zero value. +If +.Fa prt +is non-null when the iteration is interrupted, it is set to the current +routing entry. +In that case +.Fn rtfree +must be called on the routing entry pointed by +.Fa prt . +.Sh CONTEXT +.Fn rtable_walk +can be called during autoconf or from process context. +.Sh RETURN VALUES +.Fn rtable_walk +returns any non-zero value returned by +.Fa func . +It may also fail with: +.Pp +.Bl -tag -width Er -compact +.It Bq Er EAFNOSUPPORT +A routing table with ID of +.Fa rtableid +and address family of +.Fa af +doesn't exist. +.El +.Sh SEE ALSO +.Xr rtfree 9
Re: problems with libm
Hi, I made the FreeBSD msun regression tests compile on OpenBSD. https://github.com/moritzbuhl/msun-regress 3 out of 19 test files pass. 14 files die after the first error case. Two files (ctrig_test.c and trig_test.c) use atf and after some hacks they report all error cases. 840 for ctrig_test and 88 for trig_test. These test files should be reviewed carefully as I know for sure that many don't work on i386 (adding some volatile keywords usually helps). I believe all these errors paint a good picture. I will be looking into fixing what I can.
Re: problems with libm
Moritz Buhl wrote:
> ... I noticed that some floating point operations cause failures of other
> tests.
> ...
> Many edge cases for complex floating point operations are not covered at all.
Hi,
https://marc.info/?l=openbsd-tech=150737856618497=2 is another example of
an edge case for complex floating point operations.
https://github.com/wch/r-source/blob/trunk/src/main/complex.c#L452-L455 gives
a solution by checking if the imaginary part of the input complex number is
too large (as otherwise sinh() is called which grows exponentially (see e.g.
https://www.wolframalpha.com/input/?i=sinh(x) ) resulting in an overflow.)
Note that the ctan() implementation in R is under GPL, so I am unsure if the
check can be taken as is and committed to OpenBSD.
s_ctanf.c probably needs a similar treatment.
Best regards,
Ingo
Index: s_ctan.c
===
RCS file: /cvs/src/lib/libm/src/s_ctan.c,v
retrieving revision 1.7
diff -u -p -r1.7 s_ctan.c
--- s_ctan.c12 Sep 2016 19:47:02 - 1.7
+++ s_ctan.c11 Jul 2019 12:31:41 -
@@ -135,9 +135,11 @@ double complex
ctan(double complex z)
{
double complex w;
- double d;
+ double d, wy, x, y;
- d = cos (2.0 * creal (z)) + cosh (2.0 * cimag (z));
+ x = 2.0 * creal(z);
+ y = 2.0 * cimag(z);
+ d = cos(x) + cosh(y);
if (fabs(d) < 0.25)
d = _ctans (z);
@@ -148,7 +150,12 @@ ctan(double complex z)
return (w);
}
- w = sin (2.0 * creal(z)) / d + (sinh (2.0 * cimag(z)) / d) * I;
+ if (isnan(y) || fabs(y) < 50.0)
+ wy = sinh(y) / d;
+ else
+ wy = (y < 0 ? -1.0 : 1.0);
+
+ w = sin(x) / d + wy * I;
return (w);
}
DEF_STD(ctan);
Re: “aTHeros AR9565” rev 0x01 at pci3 dev 0 function 0 not configured
On Thu, Jul 11, 2019 at 04:32:48AM +0300, unwillex...@cock.li wrote: > This is how AR9565 identified in dmesg I saw few in mailing list who waiting > support for OpenBSD, FreeBSD already supports it, Is there any chance of > support for this card ? > A new driver needs to be written or an existing one needs to be ported. It is a lot of work which could take several weeks/months.
Re: Remove duplicate pledge(2) from tsort(1)
On Thu, Jul 11, 2019 at 01:20:11PM +0100, Ricardo Mestre wrote:
> Hi,
>
> pledge "stdio rpath" is already called in main(), so we can remove the
> duplicate from parse_args(), along with the pledge commented out from another
> era!
>
> The second part is about placing pledge "stdio" in main() instead for better
> readability (at least for me).
>
> No functional change is intended here and regress still pass, comments ok?
Sure, I did notice it a few days ago, but did not have time to fix it.
Thanks
> Index: tsort.c
> ===
> RCS file: /cvs/src/usr.bin/tsort/tsort.c,v
> retrieving revision 1.36
> diff -u -p -u -r1.36 tsort.c
> --- tsort.c 20 May 2017 09:31:19 - 1.36
> +++ tsort.c 11 Jul 2019 12:13:00 -
> @@ -879,10 +879,6 @@ parse_args(int argc, char *argv[], struc
>
> files[i] = NULL;
>
> -/* if (pledge("stdio rpath", files) == -1) */
> - if (pledge("stdio rpath", NULL) == -1)
> - err(1, "pledge");
> -
> nodes_init(pairs);
> order = 0;
>
> @@ -910,9 +906,6 @@ parse_args(int argc, char *argv[], struc
> order = read_pairs(stdin, pairs, reverse_flag, "stdin",
> order, hints_flag == 2);
> }
> -
> - if (pledge("stdio", NULL) == -1)
> - err(1, "pledge");
> }
>
> static int
> @@ -1003,6 +996,10 @@ main(int argc, char *argv[])
> err(1, "pledge");
>
> parse_args(argc, argv, );
> +
> + if (pledge("stdio", NULL) == -1)
> + err(1, "pledge");
> +
> return tsort();
> }
>
“aTHeros AR9565” rev 0x01 at pci3 dev 0 function 0 not configured
This is how AR9565 identified in dmesg I saw few in mailing list who waiting support for OpenBSD, FreeBSD already supports it, Is there any chance of support for this card ?
Remove duplicate pledge(2) from tsort(1)
Hi,
pledge "stdio rpath" is already called in main(), so we can remove the
duplicate from parse_args(), along with the pledge commented out from another
era!
The second part is about placing pledge "stdio" in main() instead for better
readability (at least for me).
No functional change is intended here and regress still pass, comments ok?
Index: tsort.c
===
RCS file: /cvs/src/usr.bin/tsort/tsort.c,v
retrieving revision 1.36
diff -u -p -u -r1.36 tsort.c
--- tsort.c 20 May 2017 09:31:19 - 1.36
+++ tsort.c 11 Jul 2019 12:13:00 -
@@ -879,10 +879,6 @@ parse_args(int argc, char *argv[], struc
files[i] = NULL;
-/* if (pledge("stdio rpath", files) == -1) */
- if (pledge("stdio rpath", NULL) == -1)
- err(1, "pledge");
-
nodes_init(pairs);
order = 0;
@@ -910,9 +906,6 @@ parse_args(int argc, char *argv[], struc
order = read_pairs(stdin, pairs, reverse_flag, "stdin",
order, hints_flag == 2);
}
-
- if (pledge("stdio", NULL) == -1)
- err(1, "pledge");
}
static int
@@ -1003,6 +996,10 @@ main(int argc, char *argv[])
err(1, "pledge");
parse_args(argc, argv, );
+
+ if (pledge("stdio", NULL) == -1)
+ err(1, "pledge");
+
return tsort();
}
powerpc atomic.h fix for clang
Clang's inline assembler implementation inists that an explicit constant is used for "n", whereas "i" allows a variable that ends up being a constant after optimization, which is what we need here. ok? Index: arch/powerpc/include/atomic.h === RCS file: /cvs/src/sys/arch/powerpc/include/atomic.h,v retrieving revision 1.11 diff -u -p -r1.11 atomic.h --- arch/powerpc/include/atomic.h 12 May 2017 08:47:48 - 1.11 +++ arch/powerpc/include/atomic.h 11 Jul 2019 11:40:48 - @@ -246,7 +246,7 @@ _atomic_addic_int_nv(volatile unsigned i " stwcx. %0, 0, %2 \n" " bne-1b \n" : "=" (rv), "+m" (*p) - : "r" (p), "n" (v) + : "r" (p), "i" (v) : "cc", "xer"); return (rv); @@ -265,7 +265,7 @@ _atomic_addic_long_nv(volatile unsigned " stwcx. %0, 0, %2 \n" " bne-1b \n" : "=" (rv), "+m" (*p) - : "r" (p), "n" (v) + : "r" (p), "i" (v) : "cc", "xer"); return (rv);
Re: unveil(2) switchd(8)
Of course when I mention in the second option to "unveil" / it's just to
call pledge with rpath, not actually calling unveil(2).
On 10:20 Thu 11 Jul , Ricardo Mestre wrote:
> Hi,
>
> switchd(8)'s main proc needs to open the following paths, and which can be
> unveiled:
>
> / -> read, it will open config files from anywhere in the system, and also
> needs to open /etc/services
>
> /dev -> read/write, in order to open /dev/tap* and /dev/switch*
>
> Just before the main loop the devices were already opened so we can drop wpath
> from pledge(2). We still need to keep rpath since the daemon may receive a
> SIGHUP and reload the config files again, along with /etc/services.
>
> Another option is to just remove the current pledge(2) placement and add the
> one I have below, this way there's no need to unveil /dev, just / .
>
> Comments? OK?
>
> Index: switchd.c
> ===
> RCS file: /cvs/src/usr.sbin/switchd/switchd.c,v
> retrieving revision 1.16
> diff -u -p -u -r1.16 switchd.c
> --- switchd.c 10 Sep 2018 13:21:39 - 1.16
> +++ switchd.c 11 Jul 2019 09:08:07 -
> @@ -191,6 +191,10 @@ main(int argc, char *argv[])
>
> log_procinit("parent");
>
> + if (unveil("/", "r") == -1)
> + fatal("unveil");
> + if (unveil("/dev", "rw") == -1)
> + fatal("unveil");
> /*
>* pledge in the parent process:
>* stdio - for malloc and basic I/O including events.
> @@ -221,6 +225,9 @@ main(int argc, char *argv[])
>
> if (parent_configure(sc) == -1)
> fatalx("configuration failed");
> +
> + if (pledge("stdio rpath inet dns sendfd", NULL) == -1)
> + fatal("pledge");
>
> event_dispatch();
>
>
unveil(2) switchd(8)
Hi,
switchd(8)'s main proc needs to open the following paths, and which can be
unveiled:
/ -> read, it will open config files from anywhere in the system, and also
needs to open /etc/services
/dev -> read/write, in order to open /dev/tap* and /dev/switch*
Just before the main loop the devices were already opened so we can drop wpath
from pledge(2). We still need to keep rpath since the daemon may receive a
SIGHUP and reload the config files again, along with /etc/services.
Another option is to just remove the current pledge(2) placement and add the
one I have below, this way there's no need to unveil /dev, just / .
Comments? OK?
Index: switchd.c
===
RCS file: /cvs/src/usr.sbin/switchd/switchd.c,v
retrieving revision 1.16
diff -u -p -u -r1.16 switchd.c
--- switchd.c 10 Sep 2018 13:21:39 - 1.16
+++ switchd.c 11 Jul 2019 09:08:07 -
@@ -191,6 +191,10 @@ main(int argc, char *argv[])
log_procinit("parent");
+ if (unveil("/", "r") == -1)
+ fatal("unveil");
+ if (unveil("/dev", "rw") == -1)
+ fatal("unveil");
/*
* pledge in the parent process:
* stdio - for malloc and basic I/O including events.
@@ -221,6 +225,9 @@ main(int argc, char *argv[])
if (parent_configure(sc) == -1)
fatalx("configuration failed");
+
+ if (pledge("stdio rpath inet dns sendfd", NULL) == -1)
+ fatal("pledge");
event_dispatch();
Re: ldpd(8): unveil(2) main proc / reduce pledge(2) on ldpe
The third's the charm? :)
OK?
On 20:23 Fri 14 Jun , Ricardo Mestre wrote:
> ping?
>
> On 12:33 Wed 22 May , Ricardo Mestre wrote:
> > Hi,
> >
> > Like we did on other daemons that cannot be pledged due to forbidden ioctls
> > the
> > main process can be unveiled to restrict filesystem access. In this case we
> > can
> > restrict it to only read, although it must be the entire / since the daemon
> > is
> > able to include config files from anywhere.
> >
> > Additionally the ldpe process currently has cpath promise to unlink the
> > socket,
> > nevertheless the socket is actually unlinked from the main proc so this
> > permission can be removed. As we discussed before leaving the socket behind
> > doesn't do any harm that's why I didn't unveil it in the main proc.
> >
> > Comments? OK?
> >
> > Index: ldpd.c
> > ===
> > RCS file: /cvs/src/usr.sbin/ldpd/ldpd.c,v
> > retrieving revision 1.64
> > diff -u -p -u -r1.64 ldpd.c
> > --- ldpd.c 31 Mar 2019 03:36:18 - 1.64
> > +++ ldpd.c 22 May 2019 11:09:33 -
> > @@ -222,6 +222,11 @@ main(int argc, char *argv[])
> > pipe_parent2ldpe[1], debug, global.cmd_opts & LDPD_OPT_VERBOSE,
> > sockname);
> >
> > + if (unveil("/", "r") == -1)
> > + fatal("unveil");
> > + if (unveil(NULL, NULL) == -1)
> > + fatal("unveil");
> > +
> > event_init();
> >
> > /* setup signal handler */
> > Index: ldpe.c
> > ===
> > RCS file: /cvs/src/usr.sbin/ldpd/ldpe.c,v
> > retrieving revision 1.75
> > diff -u -p -u -r1.75 ldpe.c
> > --- ldpe.c 23 Jan 2019 02:02:04 - 1.75
> > +++ ldpe.c 22 May 2019 11:09:33 -
> > @@ -107,7 +107,7 @@ ldpe(int debug, int verbose, char *sockn
> > setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
> > fatal("can't drop privileges");
> >
> > - if (pledge("stdio cpath inet mcast recvfd", NULL) == -1)
> > + if (pledge("stdio inet mcast recvfd", NULL) == -1)
> > fatal("pledge");
> >
> > event_init();
Re: unveil dhclient (privileged process)
Looks solid to me.
Ricardo Mestre wrote:
> Since krw@ gave me feedback on yet another way to handle the defines I'd
> rather
> leave that alone for now, it can be left as an exercise later on as you point
> out.
>
> I'll go ahead and commit this instead if no one objects.
>
> Index: dhclient.c
> ===
> RCS file: /cvs/src/sbin/dhclient/dhclient.c,v
> retrieving revision 1.641
> diff -u -p -u -r1.641 dhclient.c
> --- dhclient.c1 Jul 2019 16:53:59 - 1.641
> +++ dhclient.c11 Jul 2019 06:23:49 -
> @@ -2232,6 +2232,13 @@ fork_privchld(struct interface_info *ifi
> if ((routefd = socket(AF_ROUTE, SOCK_RAW, 0)) == -1)
> fatal("socket(AF_ROUTE, SOCK_RAW)");
>
> + if (unveil("/etc/resolv.conf", "wc") == -1)
> + fatal("unveil");
> + if (unveil("/etc/resolv.conf.tail", "r") == -1)
> + fatal("unveil");
> + if (unveil(NULL, NULL) == -1)
> + fatal("unveil");
> +
> while (quit == 0) {
> pfd[0].fd = priv_ibuf->fd;
> pfd[0].events = POLLIN;
Re: unveil dhclient (privileged process)
Since krw@ gave me feedback on yet another way to handle the defines I'd rather
leave that alone for now, it can be left as an exercise later on as you point
out.
I'll go ahead and commit this instead if no one objects.
Index: dhclient.c
===
RCS file: /cvs/src/sbin/dhclient/dhclient.c,v
retrieving revision 1.641
diff -u -p -u -r1.641 dhclient.c
--- dhclient.c 1 Jul 2019 16:53:59 - 1.641
+++ dhclient.c 11 Jul 2019 06:23:49 -
@@ -2232,6 +2232,13 @@ fork_privchld(struct interface_info *ifi
if ((routefd = socket(AF_ROUTE, SOCK_RAW, 0)) == -1)
fatal("socket(AF_ROUTE, SOCK_RAW)");
+ if (unveil("/etc/resolv.conf", "wc") == -1)
+ fatal("unveil");
+ if (unveil("/etc/resolv.conf.tail", "r") == -1)
+ fatal("unveil");
+ if (unveil(NULL, NULL) == -1)
+ fatal("unveil");
+
while (quit == 0) {
pfd[0].fd = priv_ibuf->fd;
pfd[0].events = POLLIN;
