Commit Graph

116528 Commits

Author SHA1 Message Date
Peter Wemm
235a54de9d Switch AMD64 and i386 platforms to using ELF as their kernel crash
dump format.  The key reason to do this is so that we can dump sparse
address space.  For example, we need to be able to skip the PCI hole
just below the 4GB boundary.  Trying to destructively dump MMIO device
registers is Really Bad(TM).  The frequent result of trying to do a
crash dump on a machine with 4GB or more ram was ugly (lockup or reboot).

This code has been taken directly from the IA64 dump_machdep.c code,
with just a few (mostly minor) mods.

Introduce a dump_avail[] array in the machdep.c code so that we have a
source of truth for what memory is present in a machine that needs to be
dumped.  We can't use phys_avail[] because all sorts of things slice
memory out of it that we really need to dump.  eg: the vm page array
and the dmesg buffer.  dump_avail[] is pretty much an unmolested version
of phys_avail[].  It does have Maxmem correction.

Bump the i386 and amd64 dump format to version 2, but nothing actually
uses this.  amd64 was actually using the i386 dump version number.

libkvm support to follow.

Approved by:	re
2005-06-29 22:28:46 +00:00
Simon L. B. Nielsen
0a389eab22 Fix ipfw packet matching errors with address tables.
The ipfw tables lookup code caches the result of the last query.  The
kernel may process multiple packets concurrently, performing several
concurrent table lookups.  Due to an insufficient locking, a cached
result can become corrupted that could cause some addresses to be
incorrectly matched against a lookup table.

Submitted by:	ru
Reviewed by:	csjp, mlaier
Security:	CAN-2005-2019
Security:	FreeBSD-SA-05:13.ipfw

Correct bzip2 permission race condition vulnerability.

Obtained from:	Steve Grubb via RedHat
Security:	CAN-2005-0953
Security:	FreeBSD-SA-05:14.bzip2
Approved by:	obrien

Correct TCP connection stall denial of service vulnerability.

A TCP packets with the SYN flag set is accepted for established
connections, allowing an attacker to overwrite certain TCP options.

Submitted by:	Noritoshi Demizu
Reviewed by:	andre, Mohan Srinivasan
Security:	CAN-2005-2068
Security:	FreeBSD-SA-05:15.tcp

Approved by:	re (security blanket), cperciva
2005-06-29 21:36:49 +00:00
Andrew Thompson
49808fa4fc Sync if_bridge to NetBSD r1.31
Rename conflicting variables when handling SNAP Ethernet frames.

Obtained from:	NetBSD
Approved by:	mlaier (mentor)
Approved by:	re (blanket)
2005-06-29 19:23:32 +00:00
Damien Bergamini
0e8975d715 o Fix a write mbuf-after-free bug. The duration field of the 802.11 header
was written in the old fragmented mbuf chain instead of the defragmented
  one.  Thus, the duration field of outgoing frames was incorrect.

o Only call m_defrag() if the mbuf fragmentation threshold is greater
  than what is currently supported by the driver.

Reviewed by:    silby (mentor)
Approved by:    re (scottl)
2005-06-29 17:54:01 +00:00
Robert Watson
269c49d31b Regenerate after addition of audit event type number to syscalls.master
file format.

Approved by:	re (scottl)
2005-06-29 17:29:06 +00:00
Robert Watson
e099829817 During the system call table format change adding audit record event
fields for each system call, I missed two system call files because
they weren't named syscalls.master.  Catch up with this last two,
mapping the system calls to the NULL event for now.

Spotted by:	jhb
Approved by:	re (scottl)
2005-06-29 17:27:40 +00:00
John Baldwin
19042f9cce - Change the commented out freebsd32_xxx() example to use kern_xxx() along
with a single copyin() + translate and translate + copyout() rather than
  using the stackgap.
- Remove implementation of the stackgap for freebsd32 since it is no longer
  used for that compat ABI.

Approved by:	re (scottl)
2005-06-29 15:16:20 +00:00
John Baldwin
014693eb89 Increase MAXCPU to 16 in SMP kernels so that APIC IDs from 0 to 15 are
allowed for CPUs.

Tested by:	amd64 at cybernetwork dot org
Approved by:	re (scottl)
MFC after:	1 week
2005-06-29 15:13:25 +00:00
Mike Silbersack
a7b844d2be Fix the false memory modified after free messages some users have been
reporting - in my previous change, I missed the case where a mbuf
from the packet zone was freed back to the mbuf/packet keg, where
it was subsequently put into the mbuf zone and found not to contain
the expected trash.  This change adds the necessary trash_dtor call inside
mb_fini_pack so that everything is correct.

Thanks for Bosko for finding the bug and showing me how secondary zones
work.

Approved by:	re (dwhite)
2005-06-29 08:18:26 +00:00
Brooks Davis
b97b7bab6b Remove isc-dhcp files from HEAD now that we're using the OpenBSD
dhclient.

Reminded by:	ru
Approved by:	re (blanket dhclient)
2005-06-29 01:46:40 +00:00
Qing Li
16a2e0a6c8 Require gateways for routes to be of the same address family as the
route itself.

It fixes a bug where an IPv4 route for example has an IPv6 gateway
specified:

     route add 10.1.1.1 -inet6 fe80::1%fxp0

     Destination  Gateway       Flags  Refs  Use  Netif Expire
     10.1.1.1     fe80::1%fxp0  UGHS   0     0    fxp0

The fix rejects these illegal combinations:

     route: writing to routing socket: Invalid argument
     add host 10.1.1.1: gateway fe80::1%fxp0: Invalid argument

Reviewed by:	KAME jinmei@isl.rdc.toshiba.co.jp
Reviewed by:	andre (mentor)
Approved by:	re
MFC after:	5
2005-06-28 23:32:22 +00:00
Warner Losh
cdcf928a55 Add a chipset field to the lookup. Use this chipset type to determine
which command to use to read the eeprom and which devices have an MII.
Simplify code by no longer using the OLDCARD compat rouintes (I don't
know if this breaks OLDCARD on pc98 or not, but OLDCARD on pc98 days
are numbered, I hope).  This also removes a number of kludges that we
had before because they are OBE.  Add a convenience routine to lookup
the device to avoid many casts in many places.

Tested with: 3C589D-TP, 3CCSH572BT
Approved by: re (scottl, blanket ep)
2005-06-28 21:56:04 +00:00
Eric Anholt
324f92b9af Disable the drm_initmap calls in radeon_cp.c, due to them resulting in improper
handling of pci resources, and mapping framebuffer leading to panics on X
startup.  The proper solution involves use of bus_alloc_resource without
RF_ACTIVE, but this code is being rewritten in DRM CVS currently, and disabling
for now doesn't remove any features, so take the easy route.

PR:		kern/80718
Approved by:	re (scottl)
2005-06-28 21:38:08 +00:00
Hiten Pandya
571dba6ec9 Use 'manual page' instead of 'man page' for consistency.
Approved by:	re (hrs)
2005-06-28 20:15:19 +00:00
Søren Schmidt
c782b027b4 Zero donecount on auto request sense.
PR:		81450
Approved by:	re@ (scottl)
2005-06-28 09:06:52 +00:00
Bjoern A. Zeeb
066b192e3b Fix panic after ifnet changes in rev. 1.30. sc->sc_ifp is a
pointer now and needs to be allocated before using.

Reviewed by:	gnn
Approved by:	re (scottl), rwatson (mentor)
2005-06-28 06:55:45 +00:00
Xin LI
67c7ede6d2 Correct a comment in ucred.h.
Submitted by:	Wojciech A. Koszek <dunstan at freebsd czest pl>
PR:		kern/82708
Approved by:	re (scottl)
2005-06-28 02:23:56 +00:00
Marcel Moolenaar
c31450b00d Handle B-unit break instructions. The break.b is unique in that the
immediate is not saved by the architecture. Any of the break.{mifx}
instructions have their immediate saved in cr.iim on interruption.
Consequently, when we handle the break interrupt, we end up with a
break value of 0 when it was a break.b. The immediate is important
because it distinguishes between different uses of the break and
which are defined by the runtime specification.
The bottomline is that when the GNU debugger replaces a B-unit
instruction with a break instruction in the inferior, we would not
send the process a SIGTRAP when we encounter it, because the value
is not one we recognize as a debugger breakpoint.

This change adds logic to decode the bundle in which the break
instruction lives whenever the break value is 0. The assumption
being that it's a break.b and we fetch the immediate directly out
of the instruction. If the break instruction was not a break.b,
but any of break.{mifx} with an immediate of 0, we would be doing
unnecessary work. But since a break 0 is invalid, this is not a
problem and it will still result in a SIGILL being sent to the
process.

Approved by: re (scottl)
2005-06-27 23:51:38 +00:00
Marcel Moolenaar
fc37111e5d Replace the existing copyright notice with my own. Over the years I've
changed this file so much that it's equivalent to a rewrite, and I'm not
talking about any of the cosmetic changes of course.

Approved by: re (scottl)
2005-06-27 23:34:35 +00:00
Marcel Moolenaar
9701d67eb8 Cosmetic: s/u_int64_t/uint64_t/g
Approved by: re (scottl)
2005-06-27 23:29:06 +00:00
Paul Saab
5a53ca1627 - Postpone SACK option processing until after PAWS checks. SACK option
processing is now done in the ACK processing case.
- Merge tcp_sack_option() and tcp_del_sackholes() into a new function
  called tcp_sack_doack().
- Test (SEG.ACK < SND.MAX) before processing the ACK.

Submitted by:	Noritoshi Demizu
Reveiewed by:	Mohan Srinivasan, Raja Mukerji
Approved by:	re
2005-06-27 22:27:42 +00:00
Poul-Henning Kamp
dca9c930da Libalias incorrectly applies proxy rules to the global divert
socket: it should only look for existing translation entries,
not create new ones (no matter how it got the idea).

Approved by:	re(scottl)
2005-06-27 22:21:42 +00:00
Andrew Thompson
ca6c404ce3 Fix a panic when bringing up the bridge interface. We were casting a ifnet
pointer to a softc which is no longer valid since the ifnet struct was split
out from the softc.

Approved by:	mlaier (mentor)
Approved by:	re (blanket)
2005-06-27 21:58:12 +00:00
Hideyuki KURASHINA
e22225b87b Merge the following from the English version:
1.5   -> 1.7	hardware/common/artheader.sgml
	1.269 -> 1.281	hardware/common/dev.sgml

Update a Japanese override of dev-auto.sgml.

Approved by:		re (hrs)
Based on work by:	Ryusuke Suzuki <ryusuke at nucl.sci.hokudai.ac.jp>
2005-06-27 17:48:20 +00:00
John-Mark Gurney
522738a9a4 remove a few uses of the word `really'
Reviewed by:	hrs
Approved by:	re (scottl)
MFC after:	1 week
2005-06-27 17:10:22 +00:00
Hideyuki KURASHINA
d2adf18ed9 bs driver was already removed.
Approved by:	re (hrs)
Reviewed by:	nyan
MFC after:	1 week
2005-06-27 14:54:49 +00:00
Olivier Houchard
63825b2f74 Use -mno-apcs-frame if DEBUG isn't defined.
Approved by:	re (blanket)
2005-06-27 14:33:32 +00:00
Andrew Thompson
f7cbc4cc6e Fix a type-o in a bridging example.
Submitted by:	Niki Denev
Approved by:	mlaier (mentor)
Approved by:	re (blanket)
2005-06-27 10:58:22 +00:00
Søren Schmidt
4c2d9f25f3 Dont call ata_finish in ad_dump as that is no longer needed and causes panic.
Dont try to enable read/write caching on devices that doesn't support it,
this reduces the noise from ATA on flash devices and the like.

Approved by: re@ (scottl)
2005-06-27 09:12:11 +00:00
Gleb Smirnoff
961478afd1 Implement suspend/resume operation for snd_csa(4)
PR:		kern/82243
Submitted by:	Serge Semenenko
Approved by:	re (scottl)
MFC after:	1 month
2005-06-27 07:43:57 +00:00
Gleb Smirnoff
3a48a9fac9 - After LibAlias processing check for TCP packet with th_x2 field
set. If found, then recalculate its checksum.
- Remove debugging printfs.
- Slightly rearrange code in ng_nat_rcvdata().

Approved by:	re (scottl)
2005-06-27 07:39:13 +00:00
Ruslan Ermilov
ceeb3b43de Fixed troff warnings.
Approved by:	re (blanket manpages)
2005-06-27 07:37:01 +00:00
Gleb Smirnoff
59dde15e82 Disable checksum processing in LibAlias, when it works as a
kernel module. LibAlias is not aware about checksum offloading,
so the caller should provide checksum calculation. (The only
current consumer is ng_nat(4)). When TCP packet internals has
been changed and it requires checksum recalculation, a cookie
is set in th_x2 field of TCP packet, to inform caller that it
needs to recalculate checksum. This ugly hack would be removed
when LibAlias is made more kernel friendly.

Incremental checksum updates are left as is, since they don't
conflict with offloading.

Approved by:	re (scottl)
2005-06-27 07:36:02 +00:00
Ruslan Ermilov
4bdc233895 Fix markup in local FreeBSD additions.
Approved by:	re (blanket manpages)
2005-06-27 07:07:55 +00:00
Ruslan Ermilov
e516c0d97d Tidy up the markup (fixing some nearby content bugs).
Timeout from:	sam
Approved by:	re (blanket manpages)
2005-06-27 06:40:43 +00:00
Mike Silbersack
cb6e5c1aba Change the panic in trash_ctor into just a printf for now. Once the reports
of panics in trash_ctor relating to mbufs have been examined and a fix
found, this will be turned back into a panic.

Approved by: re (rwatson)
2005-06-26 23:44:07 +00:00
Max Laier
889ad0384e Properly initialize ifq_maxlen for the defered send queue and make it
actually work.  Also use the right semantics for IF_HANDOFF to get correct
stats.

Reported and tested by:	Sascha Luck <sascha at c4inet dot net>
Approved by:		re (blanket)
2005-06-26 21:00:52 +00:00
David Malone
d446f3569c Add a quirk for a motherboard whose acpi timer runs too fast.
Approved by:	re (scottl)
Approved by:	nate
MFC after:	2 weeks
2005-06-26 18:19:14 +00:00
David Malone
01399f34a5 Fix some long standing bugs in writing to the BPF device attached to
a DLT_NULL interface. In particular:

        1) Consistently use type u_int32_t for the header of a
           DLT_NULL device - it continues to represent the address
           family as always.
        2) In the DLT_NULL case get bpf_movein to store the u_int32_t
           in a sockaddr rather than in the mbuf, to be consistent
           with all the DLT types.
        3) Consequently fix a bug in bpf_movein/bpfwrite which
           only permitted packets up to 4 bytes less than the MTU
           to be written.
        4) Fix all DLT_NULL devices to have the code required to
           allow writing to their bpf devices.
        5) Move the code to allow writing to if_lo from if_simloop
           to looutput, because it only applies to DLT_NULL devices
           but was being applied to other devices that use if_simloop
           possibly incorrectly.

PR:		82157
Submitted by:	Matthew Luckie <mjl@luckie.org.nz>
Approved by:	re (scottl)
2005-06-26 18:11:11 +00:00
Pawel Jakub Dawidek
7db9a6fcd1 Introduce new per-jail variable jail_<name>_flags, which allows to specify
jail(8) flags (before the change we had hardcoded "-l -U root").

Submitted by:	Frank Behrens <frank@pinky.sax.de>
PR:		conf/80244
Approved by:	re (scottl)
MFC after:	1 week
2005-06-26 16:30:20 +00:00
Warner Losh
c4af929fb7 o When calling ep_get_macaddr(), provide it a local buffer. Add a comment
that says why we do this (or rather, explains that it is some voodoo magic
  that's poorly understood).  The local buffer fixes the crash on attach.
o Rename get_e() to ep_get_e() to avoid namespace pollution.

Submitted by: mux
Approved by: re (scottl)
2005-06-26 04:19:45 +00:00
Eric Anholt
11b0d58251 Make the initialization in the AGPv3 case match that of Linux. Fixes hangs on
X startup with DRI enabled, with a v3-capable card.

Tested by:	Tom McLaughlin <tmclaugh@sdf.lonestar.org>
Approved by:	re (scottl)
2005-06-26 04:01:11 +00:00
Stephan Uphoff
68d376254c Fix a timer ticks wrap around bug for minmssoverload processing.
Approved by:	re (scottl,dwhite)
MFC after:	4 weeks
2005-06-25 22:24:45 +00:00
Stephan Uphoff
769c6708cb Disable the interrupts in trap_fatal before calling kdb_trap.
(required now that critical sections no longer block interrupts)

Reviewed by:	jhb@
Approved by:	re (scottl)
Tested by:	kris@,glebius@
2005-06-25 22:14:42 +00:00
Ruslan Ermilov
f9ba39e985 Install the dhcp-options.5 manpage.
Timeout from:	brooks
Approved by:	re (blanket manpages)
2005-06-25 11:03:06 +00:00
Ruslan Ermilov
05c89c23e9 Overhaul the markup.
OK'ed by:	imp
Approved by:	re (blanket)
2005-06-25 08:59:05 +00:00
Hiroki Sato
593a0617ea Document NetBSD 2.0.2.
Submitted by:	SODA Noriyuki (soda at NetBSD dot org)
PR:		doc/82619
Approved by:	re (implicitly)
2005-06-25 07:07:50 +00:00
Dima Dorfman
1ee6b74603 Fix fdcheckstd to pass the file descriptor along through vn_open. When
opening a device, devfs_open needs the file descriptor to install its
own fileops. Failing to pass the file descriptor causes the vnode to
be returned with the regular vnops, which will cause a panic on the
first read or write because devfs_specops is not meant to support
those operations.

This bug caused a panic after exec'ing any set[ug]id program with
fds 0..2 closed (i.e., if any action had to be taken by fdcheckstd, we
would panic if the exec'd program ever tried to use any of those
descriptors).

Reviewed by:	phk
Approved by:	re (scottl)
2005-06-25 03:34:49 +00:00
Olivier Houchard
758c41b8cc - Use a TAILQ instead of parsing the array to find a free dmamap.
- Inline busdma_alloc_dmamap, busdma_free_dmamap and bus_dmamap_sync_buf.

Approved by:	re (blanket)
2005-06-24 23:57:27 +00:00
Eric Anholt
f3eb3a3b13 Mark the permanent map for radeon registers read-only. Failure to set this flag
allowed writing to the registers by any user that can open the DRI device, and
therefore ability to initiate DMA.  This came in with the merge from DRI CVS on
2005-04-15.

Approved by:	re (scottl)
Obtained from:	DRM CVS
2005-06-24 22:21:28 +00:00