IABSD.fr/src/sys
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
194cc25f | 2026-05-19 12:23:13 | add a Navi 33 id 7481 rev c7 is used in the Steam Machine found in libdrm amdgpu.ids | |
 |
b4a3c836 | 2026-05-19 10:36:02 | Make qwx(4) send the PMF good-bye deauth frame when hopping out of RUN state. In addition to sending the PMF good-bye deauth frame from qwx_stop() we must also send it when leaving RUN state for other reasons. Provided we are still running with IFF_RUNNING since otherwise qwx_stop() has already sent the deauth frame. And provided the AP did not just send a deauth frame to us, which also covers the background-scan/roaming case where a deauth frame is sent via ieee80211_node_tx_stopped() and net80211 is faking our old AP's deauth event. | |
|
ba7ac8c7 | 2026-05-19 10:10:03 | Only send the PMF good-bye deauth frame if the WPA handshake has succeeded. If the RSN port is not marked valid then we have never exchanged keys with our access point and sending a correctly encrypted deauth frame is impossible. | |
|
d2f03c44 | 2026-05-19 10:06:35 | Ensure no new tasks get scheduled while IFF_RUNNING is set in qwx_stop(). This should prevent a crash I've seen happen once where the newstate task was scheduled after an incoming auth response frame while userland was in qwx_stop() (i.e. ifconfig qwx0 down). The newstate task then crashed because qwx_stop() had already begun to tear down driver state. Fix interlock between the (badly named) CRASH_FLUSH flag which prevents new tasks, and IFF_RUNNING which indicates whether the device is ready. qwx_stop() now clears IFF_RUNNING before the CRASH_FLUSH flag is cleared. There was a small window in qwx_stop() where IFF_RUNNING was still set while CRASH_FLUSH was clear again. To make this work with PMF we need to send our good-bye deauth frame earlier since sending management frames requires IFF_RUNNING to be set. | |
 |
901b347b | 2026-05-19 09:29:08 | sys/qwz: implement regulatory domain for 2.4Ghz and 5Ghz without regulatory domain support it uses world, and some chanells not available from firmware point of view when AP can actually use it. OK: mglocker@ | |
|
5aa5248c | 2026-05-19 09:00:11 | Prefer ic_bss over the ephemeral node in the scan tree, if possible. From mglocker@ via qwz(4) | |
|
3ebe00ef | 2026-05-19 08:57:27 | Add missing dma syncs after copying firmware images to DMA buffers. From mglocker@ via qwz(4). | |
|
093a32d2 | 2026-05-19 08:55:46 | The firmware listen_intval is in units of beacons, not TU. Set it properly. From mglocker@ via qwz(4). | |
|
5f55f2ba | 2026-05-19 08:53:41 | Add peer to qwx(4) firmware after starting the vdev, not before. From mglocker@ via qwz(4) On ath12k this fixed a firmware crash by avoiding the peer getting created with a half-initialized vdev. The fix does not hurt on ath11k so apply it to qwx(4) as well. | |
 |
e36bcaa7 | 2026-05-19 04:49:33 | Enable sambat(4). ok deraadt@ | |
|
2a284807 | 2026-05-19 04:40:45 | Add sambat(4), a battery monitor for the SAM060B EC, like found on the Samsung Galaxy Book4 Edge. Thanks to Maxim Storetvedt for pointing us to the reversed engineering specs. Initial feedback and input from kettenis@. ok deraadt@ | |
|
6abe2b0f | 2026-05-19 04:17:51 | Avoid calling bus_dmamap_destroy() from interrupt context in qwz(4). From stsp@ via qwx(4). ok kettenis@ | |
|
eda1c51e | 2026-05-18 13:47:32 | sys/qwz: add 802.11n support Advertise HT capabilities and pass HT/QoS peer association. OK: stsp@ | |
|
08041194 | 2026-05-18 13:35:49 | Ask qwx(4) firmware to move into M3 state before resetting the device. From mglocker@ via qwz(4). | |
|
a4f3abd8 | 2026-05-18 13:32:43 | Reset unified_ready flag before sending WMI init command to qwx(4) firmware. From mglocker@ via qwz(4) | |
|
7f7474d2 | 2026-05-18 12:26:14 | Avoid calling bus_dmamap_destroy() from interrupt context in qwx(4). Keep Rx TID DMA memory allocated until the interface goes down, rather than freeing DMA memory in interrupt context. Fixes splassert failures reported in dmesg because of qwx(4), such as: splassert: vm_map_assert_wrlock_ln: want 0 have 4 splassert: uvm_mapent_alloc: want 0 have 4 splassert: assertwaitok: want 0 have 4 Root cause of problem in qwx(4) pointed out by kettenis@, who also reviewed several diffs until I arrived at a correct fix. ok kettenis@ phessler@ | |
|
72e036fa | 2026-05-18 12:14:38 | Add support for Intel E610 Ethernet devices to the ix(4) driver. Build fix for sparc64 and arm64 contributed by jmatthew@ ok deraadt@ | |
|
f90d01dc | 2026-05-18 12:12:17 | regen | |
|
571ebc8c | 2026-05-18 12:11:50 | add PCI IDs for Intel E610 products | |
|
5767a144 | 2026-05-18 06:45:53 | 0X20 -> 0x20, matching the other hex constants | |
 |
b4ae1308 | 2026-05-18 03:11:34 | Intended behaviour should not have a XXX XXX XXX XXX ok beck | |
|
105bfc3f | 2026-05-18 02:14:18 | drm/amdgpu/vcn4: Avoid overflow on msg bound check From Benjamin Cheng 271cd5429513ff9b364a9bf8903e5b65b687eb25 in linux-6.18.y/6.18.32 65bce27ea6192320448c30267ffc17ffa094e713 in mainline linux | |
|
d871183a | 2026-05-18 02:12:30 | drm/amdgpu/vcn3: Avoid overflow on msg bound check From Benjamin Cheng 016b64a0313ea5346cf526e30c8d3e66aca10175 in linux-6.18.y/6.18.32 e6e9faba8100628990cccd13f0f044a648c303cf in mainline linux | |
|
5d42ee71 | 2026-05-18 02:10:30 | drm/amdgpu: rework how we handle TLB fences From Alex Deucher f0d3bb6f5125c69ce872a7574afd6d9e1f7ea349 in linux-6.18.y/6.18.32 69c5fbd2b93b5ced77c6e79afe83371bca84c788 in mainline linux | |
|
9388ffb0 | 2026-05-18 02:07:48 | Revert "drm/amdgpu: don't attach the tlb fence for SI" From Prike Liang 13e9ea445191390269a6f092d009b68e086e601b in linux-6.18.y/6.18.32 9163fe4d790fb4e16d6b0e23f55b43cddd3d4a65 in mainline linux | |
|
eab97c57 | 2026-05-18 02:05:49 | drm/amdgpu: Fix validating flush_gpu_tlb_pasid() From Timur Kristof 576b73b246564c8fa75572d45c1ed9b053b4be5b in linux-6.18.y/6.18.32 e3a6eff92bbd960b471966d9afccb4d584546d17 in mainline linux | |
|
b94d5434 | 2026-05-18 02:03:52 | drm/amdgpu: validate the flush_gpu_tlb_pasid() From Prike Liang fd78e63459ab6fe99b9fd026c420808d09eaa8be in linux-6.18.y/6.18.32 f4db9913e4d3dabe9ff3ea6178f2c1bc286012b8 in mainline linux | |
|
b77f7f2a | 2026-05-18 02:01:28 | drm/amdgpu/pm: align Hawaii mclk workaround with radeon From Alex Deucher f8f546883e8777493157ccc4fac5794c502fcbd2 in linux-6.18.y/6.18.32 1987c79b4fe5789dfa14423e78b5c25f6acf3e9d in mainline linux | |
|
8eaabadb | 2026-05-18 01:58:48 | drm/amdgpu/pm: add missing revision check for CI From Alex Deucher 6fed6e9f10622db34a18ee6ce155cbe0fa211b23 in linux-6.18.y/6.18.32 2a561b361b7681509710f3cfc3d95d54c87ac69f in mainline linux | |
|
58e58478 | 2026-05-18 01:56:19 | drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission From John B. Moore 0b91ea46bb68abf98a082bf239092253bbd6aaa2 in linux-6.18.y/6.18.32 78d2e624fa073c14970aa097adcf3ea31c157a66 in mainline linux | |
|
4151472c | 2026-05-18 01:54:17 | drm/amdkfd: Make all TLB-flushes heavy-weight From Felix Kuehling 6fbd52d210c15f3987e04d8fa2cf6ca3ace2d0d8 in linux-6.18.y/6.18.32 9b4e3495d1bd2469bf94b74930c153c2d534ddb7 in mainline linux | |
|
5628d567 | 2026-05-18 01:52:29 | drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ From John B. Moore 71614ab2a683490bf7f43bf25afcf0d2a57a8403 in linux-6.18.y/6.18.32 7bbfb2559bcec39d1a4e1182d931a2046112c352 in mainline linux | |
|
fb7175ad | 2026-05-18 01:50:17 | drm/amdgpu: zero-initialize GART table on allocation From Philip Yang b17175d0a375b3ed5e81597dac4983fdb46e478d in linux-6.18.y/6.18.32 e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741 in mainline linux | |
|
58e22c43 | 2026-05-18 01:47:50 | drm/radeon: add missing revision check for CI From Alex Deucher 264ee64cf86794353e4fcb363282e3f9cf5249b3 in linux-6.18.y/6.18.32 17223816498f7b117d138d18eb0eba63604dc74e in mainline linux | |
|
33d3fd64 | 2026-05-18 01:45:24 | drm: Set old handle to NULL before prime swap in change_handle From Francis, David 672464dd53231509c9c771110798c56d4660e19e in linux-6.18.y/6.18.32 5e28b7b94408897e41c63477aabc9e1db439bc8c in mainline linux | |
|
6cdbf480 | 2026-05-18 01:42:51 | drm/amdkfd: validate SVM ioctl nattr against buffer size From Alysa Liu db9530a9873a7c85d2266a922589ebcf427fa631 in linux-6.18.y/6.18.32 045e0ff208f0838a246c10204105126611b267a1 in mainline linux | |
|
1931944c | 2026-05-18 01:39:29 | drm/amd/display: Change dither policy for 10 bpc output back to dithering From Mario Kleiner 158def957199b6c0b4d578f369ad05cbd7789fe9 in linux-6.18.y/6.18.32 d65bfb1782304b03862c8c725fac608015dffd36 in mainline linux | |
|
24cbbbb2 | 2026-05-18 01:37:36 | drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg From Benjamin Cheng 638e48ee39d0f2af9336f917a6f5d6692dd64d93 in linux-6.18.y/6.18.32 b193019860d61e92da395eae2011f2f6716b182f in mainline linux | |
|
3071a36f | 2026-05-18 01:35:56 | drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg From Benjamin Cheng 63b51e8a9d54317d31cc3856c1e12407070d5fc2 in linux-6.18.y/6.18.32 0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648 in mainline linux | |
|
c3392a02 | 2026-05-18 01:34:06 | drm/amdgpu/vce: Prevent partial address patches From Benjamin Cheng b3d1a0a45c4aec484fa2a5b060b611e3d3064470 in linux-6.18.y/6.18.32 de2a02cc28d6d5d37db07d00a9a684c754a5fd74 in mainline linux | |
|
39050f1e | 2026-05-18 01:32:16 | drm/amdgpu/vcn4: Prevent OOB reads when parsing IB From Benjamin Cheng a6d5563ba1f03a049561cd347574613167294e8d in linux-6.18.y/6.18.32 2444eb0ec8283f4a3845eb7febad378476e1ba3c in mainline linux | |
|
c0188197 | 2026-05-18 01:30:08 | drm/amdgpu: Add bounds checking to ib_{get,set}_value From Benjamin Cheng fec8b11b55e53ff51a741e56894fe331a516f5c6 in linux-6.18.y/6.18.32 66085e206431ef88ce36f53c1f53d570790ccc9e in mainline linux | |
|
607ab0fb | 2026-05-18 01:27:04 | drm/amdkfd: Add upper bound check for num_of_nodes From Alysa Liu 44d5a450c04d3d734c13a03561c3131020d66edf in linux-6.18.y/6.18.32 74b73fa56a395d46745e4f245225963e9f8be7f1 in mainline linux | |
|
91d1283c | 2026-05-18 01:25:33 | drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x From Yang Wang de137adccf7ade2d06e46bf9f0960ecc6be6ef13 in linux-6.18.y/6.18.32 504f0098ebd074ac8c0ce3471795d79f68e3d265 in mainline linux | |
|
187086bf | 2026-05-18 01:25:10 | Since libc (currently and probably forever) only calls __pledge_open() with 3 flags (O_RDONLY, O_RDWR, and O_CLOEXEC) validate this before calling deeper kernel code. It is not trivial to check O_RDONLY because the flag isn't a bit in the 3 (valid) states represented inside O_ACCMODE (which are converted more carefully to FREAD|FWRITE nowadays). This brings me back to my youth with the open(,3) bug... ok beck | |
|
453e3248 | 2026-05-18 01:22:31 | drm/amdgpu: gate VM CPU HDP flush on reset lock From Chenglei Xie f34eda3ff33d351a9d9c078420cbe1bd258b413e in linux-6.18.y/6.18.32 ddda81c4d7e71e41b1be91d921fd85747eddbd12 in mainline linux | |
|
0832f673 | 2026-05-18 01:20:09 | drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. From Ramalingeswara Reddy, Kanala 2795d325bb5c133ff7f32d9272eea4877f42f358 in linux-6.18.y/6.18.32 574b3b14f7d1b329fc6e67b79328f0e6f4d4b3d4 in mainline linux | |
|
e0ba0a8b | 2026-05-18 01:17:13 | drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure From Amir Shetaia 77d0b5d11387071770246fd0185a69fa28e8e109 in linux-6.18.y/6.18.32 ad52d61d82181dbdb7f05826de38352d5e550cc2 in mainline linux | |
|
ca98e806 | 2026-05-18 01:14:33 | drm/i915/psr: Init variable to avoid early exit from et alignment loop From Jouni Hogander 48fb2213e2c27f94dccf657a2ffd3c8256ad7729 in linux-6.18.y/6.18.32 314f6179e370988ac00dadf373a4f6166eb3db15 in mainline linux | |
|
3303272b | 2026-05-18 01:12:11 | drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages From Matthew Brost 7fbb3b4bef023903e66138c25b205b47be19612b in linux-6.18.y/6.18.32 556dba95473900073a6c03121361c11f646dc551 in mainline linux | |
 |
5590fb3c | 2026-05-17 05:02:31 | regen | |
|
443102b0 | 2026-05-17 05:01:45 | Add MT7920 pci id ok claudio@ | |
 |
120f2ab2 | 2026-05-17 04:23:09 | regen | |
|
96fb1004 | 2026-05-17 04:22:45 | add another Apple NVMe | |
 |
baf8777e | 2026-05-16 21:18:46 | Fix sys_shmat(). The shminfo.shmseg could be changed via sysctl during sleeping malloc(). It only grows, so we access memory outside of allocated chunk within the following 'for' loop. This issue was exposed by syzkaller [1]. Also, p->p_vmspace points to the ps_vmspace common to the whole process, so p->p_vmspace->vm_shm could be already set by concurrent sys_shmat() thread. We need to check this case, otherwise the pointer to concurrently allocated segment will be overwritten. 1. https://syzkaller.appspot.com/bug?extid=9669e87e543ae1f05884 ok deraadt | |
|
6bd2d231 | 2026-05-16 21:17:43 | Replace semid_ds with semid_ds_kern for in-kernel sysv semaphore implementation. Note, the buffer used for userland dlivery in sysctl_sysvipc() was filled with zeros during allocation, we don't need extra zeroing. ok deraadt millert | |
 |
77106d95 | 2026-05-16 13:27:03 | repair more prototypes for pseudo-device attach functions pppattach and spppattach should have a single int parameter to match what's in ioconf.c. also noticed independently by jsg@; ok jsg@ | |
|
927740b5 | 2026-05-16 12:59:37 | repair prototype for pseudo-device attach function The dtattach function was declared with an autoconf style prototype, but should have been declared with a single int parameter. Repair this. ok deraadt@, jsg@ | |
|
d74df432 | 2026-05-15 19:02:12 | After ifconfig qwz0 down followed by ifconfig qwz0 up, the second up would fail with SIOCSIFFLAGS: Resource temporarily unavailable, and after the first failure the device could not be brought up at all until reboot. The same symptom appeared when changing nwid while the interface was up (which internally does down+up). To fix this issue, we do following changes: 1. Keep the firmware running for the lifetime of the device attachment, matching what Linux ath12k does. ifconfig down/up no longer power-cycles the chip; it only tears down and re-establishes the per-BSS association. 2. Reset wmi.unified_ready before sending WMI_INIT so the host actually waits for the firmware's ready event instead of returning immediately from a stale flag. 3. Transition firmware to MHI state M3 before resetting the device in power_down, so the chip starts from a clean slate on the next power-up. | |
|
5c88c315 | 2026-05-15 15:26:35 | remove commented-out unused namei structure fields not used for a long time ok beck | |
 |
450386e6 | 2026-05-15 09:42:46 | frag6_input(): must always decrement counter when dropping fragment Currently frag6_input() does not decrement counter in one case: - it is processing fragment with offset 0 which arrives after the last fragment (fragment with max. offset) - there are more IPv6 extension headers between IPv6 header and IPv6 fragment header - re-assembled packet exceeds IPV6_MAXPACKET size limit if conditions above are met, then fragment gets dropped without decrementing counters. This commit fixes that. The issue was pointed out by Frank Denis. OK bluhm@ | |
|
0e67b3de | 2026-05-15 00:39:21 | Make __pledge_open(2) of /etc/localtime and /usr/share/zoneinfo much more strict. If /etc/localtime is a symbolic link, allow one translation which must land cleanly in /usr/share/zoneinfo (.. is checked for) otherwise error with EACCES. In /usr/share/zoneinfo, do not allow symbolic links and error with ELOOP. Alfredo Ortega observed the non-strict handling, but agrees no specific exploitability exists. Changing this took almost a month with many discarded prototypes. ok beck dgl | |
|
3e6d065e | 2026-05-14 16:22:31 | Enable qwz(4) for amd64 and arm64 RAMDISK. | |
|
52e845de | 2026-05-14 16:20:27 | Enable qwz(4) for amd64 and arm64 GENERIC. | |
|
296b4ef3 | 2026-05-14 16:17:20 | Get qwz(4) in to an initial working state (assoc/rx/tx). Bug fixes (HAL/WMI drift vs. current ath12k): 1. RX_BE_PADDING0_BYTES 80 -> 8 -- fixes RX-descriptor misalignment (dlpager crash, Hexagon 0x23). 2. Send WMI_VDEV_PARAM_SET_HEMU_MODE = 0 before peer_assoc_cmd -- clears stale HE-MU state. 3. volatile cast on dst-ring hp_addr read in qwz_hal_srng_access_begin() -- matches SRC branch, fixes ARM64 hoist. 4. BUFFER_ADDR_INFO1: RET_BUF_MGR GENMASK(10,8) -> (11,8), SW_COOKIE (31,11) -> (31,12). 5. wbm2sw_cc_enable = WBM2SW3_EN only -- keeps HW Cookie Convert off the TX rings. 6. HTT_TX_WBM_COMP_INFO0_STATUS (12,9) -> (16,13); drop bogus INFO2_SW_PEER_ID/VALID; add INFO1_REINJECT_REASON, INFO1_EXCEPTION_FRAME, INFO2_ACK_RSSI. 7. REO/TX_RATE_STATS GENMASK shifts (HAL_REO_UPD_RX_QUEUE_INFO2_*, HAL_RX_REO_QUEUE_INFO0/1_* +2 bits; HAL_TX_RATE_STATS_INFO0_* +1 bit) + new HTT_RX_RING_SELECTION_CFG_CMD_INFO0/1. 8. qwz_dp_tx_get_tid() returns HAL_DESC_REO_NON_QOS_TID for non-QoS frames. X1E80100 workaround: - Multi-MSI ext vectors don't deliver: drive qwz_dp_service_srng() for all ext_irq groups from qwz_ce_intr(). Supporting changes to reach the working state: - MHI boot: wait for SBL EE + M0 before BHIE/AMSS in qwz_mhi_fw_load_handler(). - Capture single_chip_mlo_support and qmi_phy_cap_num_phy from QMI phy_cap. - Send WMI_TAG_MLO_{PEER,VDEV}_CREATE_PARAMS TLVs on peer/vdev create. - Peer assoc: trailing EHT TLVs; is_wme_set=1, qos_flag=1, peer_listen_intval=1. - RX TLV offset_valid=1 with packet/header/mpdu offsets for WCN7850. - Propagate AST hash/index from peer_map into arvif. - hal_desc_sz returns sizeof(struct hal_rx_desc_wcn7850). - Per-frame encrypt_type (CCMP-128 / TKIP-MIC) in qwz_dp_tx(). - Silent drop filter for stray RX (addr1 not us, 84:e1 prefix). Tested so far on the Samsung Galaxy Book4 Edge. ok deraadt@ | |
 |
9f6962b1 | 2026-05-14 12:26:58 | Transplant the EL2 virtual timer interrupt into the ACPI device tree if it is provided in the GTDT table. Based on a diff from Marc Zyngier. ok jsg@ | |
|
adeebfb5 | 2026-05-14 12:24:22 | regen | |
|
89292547 | 2026-05-14 12:23:30 | Add "interrupt-names" property to the timer node. ok jsg@ | |
|
290bb83e | 2026-05-14 01:39:38 | mitigate AMD Zen-2 operation cache corruption On Zen 2, the operation cache can be used to change instructions of a different privilege level. https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html The mitigation is setting a chicken bit in an MSR. This is not documented publicly, even in the security bulletin. The value comes from a patch submitted to Linux by AMD employees. ok deraadt@ brynet@ | |
|
86898828 | 2026-05-13 21:05:23 | Limit the maximum value of shminfo.shmseg to prevent `size' overflow in sys_shmat(). The default value of 128 is safe, but overflow could happen on 32 bits machine while the value of shminfo.shmseg was raised too high. Discussed with deraadt. | |
|
77e7bd64 | 2026-05-13 15:14:51 | In the disklabel check for specific fields with value 0, and return early before trying to check for a byte-swapped label. This avoids a /0 in the byte-swapped partition check. ok krw, also discussed with krw | |
|
7ef9c5a3 | 2026-05-13 14:18:20 | The ktrace signal structure ktr_psig needs to be zero'd before filling in for providing to userland. from Stuart Thomas | |
|
db0e41b4 | 2026-05-13 06:24:20 | use nowake for sleep wait channel instead of an uninitialised stack variable avoids a -Wuninitialized-const-pointer warning with clang 22 ok jca@ | |
 |
8d2ac629 | 2026-05-12 14:49:35 | Fix buglet introduced in 1.85; from clang -Wsometimes-uninitialized via jsg@ | |
 |
ac50d6fb | 2026-05-12 09:34:00 | revert last KASSERT(x != 0) to prevent division by zero just after doesn't help anything, division by 0 blows up nicely by itself with a very clear message. excessive comments and things like useless KASSERTs just make it much harder to follow the actual code. ok sashan | |
|
9f06b4d0 | 2026-05-12 08:54:08 | make sure the command is set to config when writing config register bits prompted by a -Wuninitialized-const-pointer warning from clang 21 ok deraadt@ | |
|
6002e71c | 2026-05-12 01:39:42 | Fix signed overflow in ieee80211_40mhz_valid_secondary_below(). The secondary_chan variable should be uint8_t instead of int8_t, matching ieee80211_40mhz_valid_secondary_above(). ok phessler@ stsp@ | |
|
47daa359 | 2026-05-11 20:17:17 | regen | |
|
9444197c | 2026-05-11 20:16:46 | Add RK3576. | |
 |
5932f6b5 | 2026-05-11 12:58:52 | switch loop condition from pointer to integer arithmetic Otherwise LLVM 22 creates an infinite loop. ok jsg@ | |
|
94baf1f2 | 2026-05-11 10:25:52 | Improve error checking of received packets. ok jca@ | |
 |
9c536703 | 2026-05-11 06:41:29 | move bpf for outgoing packets later in the transmit path. the convention in openbsd is to have the bpf handling as close to the "wire" as possible so you can see what ends up being send to the network. wg was showing outgoing packets to bpf really early, before the wgaip peer selection was checked and before the packet was queued for transmission, so it gave a false impression about what it was doing. this moves the outgoing bpf stuff after the ifq dequeue. it could be moved a bit later still (after encryption), but this is an easy win for now. based on a discussion with sashan@ and mvs@ ok mvs@ sashan@ sthen@ deraadt@ | |
|
65040e2d | 2026-05-11 06:24:47 | sys/param.h includes machine/param.h, no need to include both | |
|
f5469ce0 | 2026-05-11 06:13:54 | sys/mutex.h includes machine/mutex.h, no need to include both | |
|
2948bb8c | 2026-05-11 06:09:45 | sys/exec.h includes machine/exec.h, no need to include both | |
|
59ecda1f | 2026-05-10 15:57:38 | Almost 26 years ago, when sti(4) was rewritten as an MI driver, some of the pci-related defines for the "bus support" field in the rom information were incorrectly defined. This was not noticed as there was no pci attachment for sti devices yet. Replace these with the correct values, as documented in the sti spec and also in stirom.h found in HP-UX 11i. While there, rework and simplify the logic deciding whether we need to make a ram copy of the rom on pci devices. No functional change, FireGL-UX still won't work. | |
|
12d23b4f | 2026-05-10 08:47:22 | Initialize ih_intrpin for regular (non-vector) MSI interrupts as well. Fixes regular MSIs on the SpacemiT K1 SoC. ok jsg@ | |
 |
33e6d7cf | 2026-05-09 17:38:50 | Add kernel support for the vector extension on riscv64. The V extension (where supported) adds an additional 32 vector registers that are variable length (up to 65,536 bits, but more commonly 2048 bits). In order to support the use of the V extension (and additional vector extensions) we need to enable the vector extension and save/restore the vector registers. ok kettenis@ | |
 |
0dafc400 | 2026-05-09 12:13:15 | Simplify previous by shifting the rcpi value first then use a common mask. Also set ic_max_rssi = 0 since this driver will uses DBm reporting. | |
|
a91355d1 | 2026-05-09 11:49:46 | Implement RSSI reporting for mwx(4). Diff provided by Benjamin Lee McQueen (mcq at disroot.org) | |
|
6eb008e3 | 2026-05-09 11:20:54 | unifdef call into removed sparc-only tctrl(4) | |
|
a948fd09 | 2026-05-09 09:11:47 | remove unneeded ufs/ffs/fs.h includes added for BBSIZE and SBSIZE which are no longer used | |
|
5f126d4c | 2026-05-09 06:36:06 | remove unneeded mpls.h includes | |
|
fc4fe263 | 2026-05-09 05:50:33 | MT_DMASHDL_SW_CONTROL is accessed via remapping. Define it with the explicit address 0x7c026004 as Linux does to avoid confusion. While here, remove duplicate definitions of MT_PCIE_MAC_BASE and MT_PCIE_MAC_INT_ENABLE. ok claudio@ | |
|
ec14518e | 2026-05-09 01:47:12 | avoid leaking memory when mbuf chain allocations fail in tun_dev_write() the mbufs built by tun_dev_write used to be limited to a single mbuf and cluster, but has grown in complexity now that it supports tun_hdr and tso, which required building mbuf chains. some of the error handling when allocating mbuf bits wasnt adapted to free the preceding chain when later allocaitons failed, resulting in a memory leak. reported by frank denis | |
|
c207c8e9 | 2026-05-09 00:37:45 | detect out of bound reads from an int overflow in the bpf_mem backends. frank denis reported a problem in bpf_mem_ldw where a large indirect load offset could have the end of buffer calculation land at UINT_MAX and wrap, allowing a read of memory outside the buffer. this change tweaks the buffer checks by checking if the load offset is in range, taking that away from the buffer length, and then checking if the size of the load is in the remaining buffer length. this is the pattern that the bpf_mbuf_ops backend uses. this problem also exists in bpf_mem_ldh, so this code is factored out and used in all the bpf_mem_ops load backends. note that this issue is specific to the bpf_mem_ops backend used for running bpf filters against a vanilla memory buffer. this backend is largely unused in the kernel, which almost always uses the bpf_mbuf_ops backend to run filters against network packets in mbufs. the bpf_mem_ops are only used by ppp(4) for the "active-filter" and "pass-filter" config described in pppd(8). more generally, bpf is only really usable by root. in userland, bpf_filter is used by libpcap, and programs in base that use it are wary of it anyway and avoid running it in a privileged context. tcpdump is the most prominent example of this. discussed with djm@ claudio@ deraadt@ | |
|
34e7bded | 2026-05-08 12:25:33 | remove unused plic.h; ok kettenis@ | |
|
2d98a195 | 2026-05-08 09:38:07 | Do sleeping malloc() and copyin() before checks within sys_semop(). Otherwise the semaphore id referenced by `semaptr' could be destroyed or replaced during context switch. ok cludwig | |
|
592256e2 | 2026-05-08 06:31:51 | pf(4): load balancer rpool->weight is never zero, state that explicitly in code to make future reviews more smooth. OK @deraadt | |
|
d1081477 | 2026-05-08 03:45:29 | remove unused trunklacp code trunklacp.c is not built since January's 'remove lacp support from trunk(4)' ok dlg@ |