Commit Graph

109740 Commits

Author SHA1 Message Date
Conrad Meyer
1940692911 drm2(4): Fix double-free in low-memory error path
Reallocf frees 'block'; don't attempt to free it again.

Reported by:	Coverity
CID:		1091165
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 03:45:45 +00:00
Conrad Meyer
8691cc73d1 Make Racct macro slightly more gracious given RACCT_UNDEFINED
rctl_string_to_rule could previously index below the zeroth element of
racct_types via the macro.  Maybe it shouldn't use the macro on
RACCT_UNDEFINED.  But given every other RACCT_ definition is non-negative, it
seems pretty easy to foot-shoot this one without the check.

Reported by:	Coverity
CID:		1305574
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 03:24:59 +00:00
Conrad Meyer
c564824193 aesni(4): Initialize error before use
Reported by:	Coverity
CID:		1331554
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 03:05:32 +00:00
Conrad Meyer
cd1cdbb58b i915kms intel_pm: Read from actual tsc_freq instead of uninitialized local
The local of the same name would alias the global, but we didn't even include
the header that defines tsc_freq.  Include it and rename the local.

Reported by:	Coverity
CID:		1331559
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 02:58:22 +00:00
Conrad Meyer
b483e111c4 kern_rctl: Fix resource leak in error path
Ordinarily, rctl_write_outbuf frees 'sb'.  However, if we are in low memory
conditions we skip past the rctl_write_outbuf.  In that case, free 'sb'.

Reported by:	Coverity
CID:		1338539
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 02:09:38 +00:00
Conrad Meyer
856d8ddbb3 radix rn_inithead: Fix minor leak in low memory conditions
R_Zalloc is essentially a malloc(M_NOWAIT) wrapper.  It is possible that 'rnh'
failed to allocate, but 'rmh' succeeds.  In that case, we bail out of
rn_inithead() but previously did not free 'rmh'.

Introduced in r287073 (projects/routing) / MFP r294706.

Reported by:	Coverity
CID:		1350258
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 02:01:45 +00:00
Conrad Meyer
5412ec6e3f bpf_getdltlist: Don't overrun 'lst'
'lst' is allocated with 'n1' members.  'n' indexes 'lst'.  So 'n == n1' is an
invalid 'lst' index.  This is a follow-up to r296009.

Reported by:	Coverity
CID:		1352743
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 01:39:31 +00:00
Conrad Meyer
523af57ea2 nctgpio(4): Don't index past the end of sc->pins array
This driver thinks that the NCT_MAX_PIN index is a valid index in a few places
(nct_attach() for-loop, as well as NCT_IS_VALID_PIN()).  Allocate room for
NCT_MAX_PIN as an index, that is, NCT_MAX_PIN + 1 elements.

Reported by:	Coverity
CIDs:		1353806, 1353807, 1353808, 1353809, 1353810
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 01:17:18 +00:00
Conrad Meyer
3765b80993 SRAT: Don't overflow domain_pxm table
If we reached MAXMEMDOM, we would previously try to insert an additional
element and only detect overflow after causing (probably trivial) memory
overflow.  Instead, detect the ndomain > MAXMEMDOM case before we write past
the end.

Reported by:	Coverity
CID:		1354783
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 01:10:07 +00:00
Conrad Meyer
8d340432aa linprocfs_doproclimits: Initialize error return before use
Reported by:	Coverity
CID:		1354623
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 01:03:06 +00:00
Conrad Meyer
e78adba3fe linprocfs: Don't print uninitialized values
Reported by:	Coverity
CID:		1354624
Sponsored by:	EMC / Isilon Storage Division
2016-04-20 01:00:13 +00:00
Pedro F. Giffuni
02abd40029 kernel: use our nitems() macro when it is available through param.h.
No functional change, only trivial cases are done in this sweep,

Discussed in:	freebsd-current
2016-04-19 23:48:27 +00:00
Pedro F. Giffuni
2464bbf05a sys/boot: use our nitems() macro when it is available through param.h.
No functional change, only trivial cases are done in this sweep,

Discussed in:	freebsd-current
2016-04-19 23:44:33 +00:00
Pedro F. Giffuni
ea24b0561f X86: use our nitems() macro when it is avaliable through param.h.
No functional change, only trivial cases are done in this sweep,

Discussed in:	freebsd-current
2016-04-19 23:41:46 +00:00
Pedro F. Giffuni
73a1170a8c sys/dev: use our nitems() macro when it is avaliable through param.h.
No functional change, only trivial cases are done in this sweep,
Drivers that can get further enhancements will be done independently.

Discussed in:	freebsd-current
2016-04-19 23:37:24 +00:00
Pedro F. Giffuni
4ec642f1d6 dev/agp: use our nitems() macro when it is avaliable through param.h.
Consistently capitalize the macros used in the driver.

No functional change.
2016-04-19 23:31:35 +00:00
Oleksandr Tymoshenko
e4ad736f4d Fix build for Pi kernels with syscons enabled 2016-04-19 23:30:22 +00:00
Pedro F. Giffuni
432157dc67 dev/usb: use our nitems() macro when param.h is available.
Reviewed by: hselasky
2016-04-19 22:07:36 +00:00
Allan Jude
3db33b0a8c Link bcache into userboot.so, was not added in r298230
This should help speed up bhyve boots too

Reviewed by:	olivier
2016-04-19 20:56:45 +00:00
David C Somayajulu
6f39c760f8 1. modify fwdump (a.k.a grcdump) so that grcdump memory is allocated
and freed on as needed basis.
2. grcdump can be taken at failure points by invoking bxe_grc_dump()
   when trigger_grcdump sysctl flag is set. When grcdump is taken
   grcdump_done sysctl flag is set.
3. grcdump_done can be monitored by the user to retrieve the grcdump.

Submitted by:vaishali.kulkarni@qlogic.com
2016-04-19 20:28:30 +00:00
Andriy Voskoboinyk
2cd9502778 net80211: do not reschedule scan_curchan_task() if the scan was canceled.
This should fix possible use-after-free in the scheduled task.

PR:		208605
2016-04-19 20:19:21 +00:00
Sean Bruno
f4a18258b0 aacraid(4): Sanely copyin userland pointers and ensure that we don't get
anything janky from a user. (cturt)

aac(4): landergriffith+freebsdbugzilla@gmail.com pointed out that aacraid(4)
had the same issue and handling of pointers, so let's change that too.

PR:		206573
Submitted by:	cturt@hardenedbsd.org
Obtained from:	HardenedBSD
MFC after:	1 week
2016-04-19 18:27:28 +00:00
Sean Bruno
bbea316cc8 Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non-
null terminated ASCII string.

PR:		207626
Submitted by:	cturt@hardenedbsd.org
MFC after:	2 days
2016-04-19 16:48:14 +00:00
Adrian Chadd
36e4410ab0 [bhnd] Standardize bhnd device tables and quirk matching.
This add a bhnd device table mechanism that standardizes matching of
devices on the bhnd(4) bus, discovery of device quirk flags, and should
be pluggable into the new PNPINFO machinery.

Submitted by:	Landon Fuller <landonf@landonf.org>
Differential Revision:	https://reviews.freebsd.org/D5759
2016-04-19 15:56:39 +00:00
Adrian Chadd
386fb140a6 [bhnd] Clean up bhnd resource handling and inherited bus methods
To facilitate use by SoC implementors working with bhnd-inheriting fdt/nexus
drivers:

* Splits bhnd_bus method implementations into generic bus implementations
  (bhnd_bus_generic) and generic bhnd(4) driver implementations (bhnd_generic)
* Simplifies bhnd resource handling, allowing bhnd bus implementations to
  support bhnd resource activation by implementing the standard BUS_*
  resource APIs and BHND_BUS_ACTIVATE_RESOURCE().

Submitted by:	Landon Fuller <landonf@landonf.org>
Differential Revision:	https://reviews.freebsd.org/D5758
2016-04-19 15:53:57 +00:00
Adrian Chadd
e9378f456a [bhnd] Add support for specifying the address space used by bhndb children
This adds support for specifying the address space used by a bridge child;
this will either be the bridged SoC address space, or the host address space
required by children that map non SoC-address ranges from the PCI BAR.

This is necessary to support SROM/OTP child devices that live directly
beneath the bhndb device and require access to host resources, instead
of the standard behavior of delegating access to the bridged SoC address
space.

Submitted by:	Landon Fuller <landonf@landonf.org>
Differential Revision:	https://reviews.freebsd.org/D5757
2016-04-19 15:52:55 +00:00
Allan Jude
cad5a2e468 Fix pc98 build error introduced in r298230
Submitted by:	Toomas Soome <tsoome@me.com>
Spotted by:	bz
Differential Revision:	https://reviews.freebsd.org/D6002
2016-04-19 15:46:21 +00:00
Ruslan Bukin
a0814c1586 Revert r298268 (Add optional chip_select/deselect methods).
None of supported hardware do require that.
2016-04-19 15:39:46 +00:00
Ruslan Bukin
d1bdbe1259 Assert CS for single transfers. 2016-04-19 15:36:18 +00:00
Luiz Otavio O Souza
df20515d58 Add PCI ID for family 10h model 30h to amdtemp(4).
This adds support to CPU found in PC Engines APU2 series.

MFC after:	3 weeks
Sponsored by:	Rubicon Communications (Netgate)
2016-04-19 15:07:04 +00:00
Ruslan Bukin
e72dd8d78f Add driver for Xilinx AXI Quad SPI device. The device was found in
lowRISC hardware.

Sponsored by:	DARPA, AFRL
Sponsored by:	HEIF5
2016-04-19 14:47:08 +00:00
Ruslan Bukin
af8c306065 Add optional chip_select/deselect methods. This is required
when we want to keep CS asserted for multiple transfers.
2016-04-19 14:18:12 +00:00
Edward Tomasz Napierala
74a7305a91 Fix debugging printf.
MFC after:	1 month
Sponsored by:	The FreeBSD Foundation
2016-04-19 13:36:31 +00:00
Konstantin Belousov
2cfddaa6ff Fix umtx lock/trylock for compat32.
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
2016-04-19 11:37:43 +00:00
Sepherosa Ziehau
adc9edf341 hyperv/vmbus: Make device probe/attach synchronous w/ vmbus attach/SYSINIT
Discussed with:	Jun Su <junsu microsoft com>, Dexuan Cui <decui microsoft com>
MFC after:	1 week
Sponsored by:	Microsoft OSTC
2016-04-19 09:42:48 +00:00
Sepherosa Ziehau
55a1cfa16b hyperv: Remove two assign-only local variables
Submitted by:	Jun Su <junsu microsoft com>
MFC after:	1 week
Sponsored by:	Microsoft OSTC
2016-04-19 09:25:56 +00:00
Justin Hibbits
f60708c9f7 Fix SMP booting for PowerPC Book-E
Summary:
PowerPC Book-E SMP is currently broken for unknown reasons.  Pull in
Semihalf changes made c2012 for e500mc/e5500, which enables booting SMP.

This eliminates the shared software TLB1 table, replacing it with
tlb1_read_entry() function.

This does not yet support ePAPR SMP booting, and doesn't handle resetting CPUs
already released (ePAPR boot releases APs to a spin loop waiting on a specific
address).  This will be addressed in the near future by using the MPIC to reset
the AP into our own alternate boot address.

This does include a change to the dpaa/dtsec(4) driver, to mark the portals as
CPU-private.

Test Plan:
Tested on Amiga X5000/20 (P5020).  Boots, prints the following
messages:

 Adding CPU 0, pir=0, awake=1
 Waking up CPU 1 (dev=1)
 Adding CPU 1, pir=20, awake=1
 SMP: AP CPU #1 launched

top(1) shows CPU1 active.

Obtained from:	Semihalf
Relnotes:	Yes
Differential Revision: https://reviews.freebsd.org/D5945
2016-04-19 01:48:18 +00:00
Sean Bruno
a0adbb3df1 hptmv(4) Fix potential buffer overflow in hpt_set_info.
While here, adjust some whitespace and yeild some useful debug info.

This is untested on this hardware, testing requests to -scsi went
unanswered.

PR:	206585
Submitted by:	cturt@hardenedbsd.org
MFC after:	2 weeks
2016-04-18 23:26:11 +00:00
Allan Jude
87ed2b7f5a A new implementation of the loader block cache
The block cache implementation in loader has proven to be almost useless, and in worst case even slowing down the disk reads due to insufficient cache size and extra memory copy.
Also the current cache implementation does not cache reads from CDs, or work with zfs built on top of multiple disks.
Instead of an LRU, this code uses a simple hash (O(1) read from cache), and instead of a single global cache, a separate cache per block device.
The cache also implements limited read-ahead to increase performance.
To simplify read ahead management, the read ahead will not wrap over bcache end, so in worst case, single block physical read will be performed to fill the last block in bcache.

Booting from a virtual CD over IPMI:
0ms latency, before: 27 second, after: 7 seconds
60ms latency, before: over 12 minutes, after: under 5 minutes.

Submitted by:	Toomas Soome <tsoome@me.com>
Reviewed by:	delphij (previous version), emaste (previous version)
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D4713
2016-04-18 23:09:22 +00:00
Sean Bruno
ae6bd5b7be Correct possible underflow conditions when checking for available space
in the tx h/w ring buffer.

Reviewed by:	gnn jeb.j.cramer@intel.com
MFC after:	1 week
Sponsored by:	Limelight Networks
Differential Revision:	https://reviews.freebsd.org/D5918
2016-04-18 20:33:44 +00:00
Michael Tuexen
b1deed45e6 Address issues found by the XCode code analyzer. 2016-04-18 20:16:41 +00:00
Alan Somers
f94033f407 Add the ability to read a SAS device's Target Port NAA designator
sys/cam/scsi/scsi_all.h
sys/cam/scsi/scsi_all.c
	Add the scsi_devid_is_port_naa helper function

Reviewed by:	ken
MFC after:	4 weeks
Sponsored by:	Spectra Logic Corp
Differential Revision:	https://reviews.freebsd.org/D5975
2016-04-18 15:01:59 +00:00
Michael Tuexen
f8ee69bf81 Fix signed/unsigned warnings. 2016-04-18 11:39:41 +00:00
Andrew Turner
9ca014f67b Pull the MSI/MSI-X handling functions out to help with INTRNG integration.
Obtained from:	ABT Systems Ltd
Sponsored by:	The FreeBSD Foundation
2016-04-18 10:37:50 +00:00
Michael Tuexen
a39ddef038 Fix a warning about an unused variable. 2016-04-18 09:39:46 +00:00
Michael Tuexen
98d5fd976b Put panic() calls under INVARIANTS. 2016-04-18 09:29:14 +00:00
Xin LI
b97b6d27f2 Fix tinderbox LINT build. 2016-04-18 08:24:13 +00:00
Michael Tuexen
f2ea2a2d5f Cleanup debug output. 2016-04-18 06:58:07 +00:00
Michael Tuexen
e187bac213 Don't use anonymous unions. 2016-04-18 06:38:53 +00:00
Michael Tuexen
24a9e1b53b Remove a left-over debug printf(). 2016-04-18 06:32:24 +00:00