Commit graph

72 commits

Author SHA1 Message Date
gordon
adce02c0de Mitigations for Microarchitectural Data Sampling.
Approved by:	so
Security:	FreeBSD-SA-19:07.mds
Security:	CVE-2018-12126
Security:	CVE-2018-12127
Security:	CVE-2018-12130
Security:	CVE-2019-11091
2019-05-15 07:56:29 +02:00
Franco Fichtner
2850267886 re: compile on arm 2019-02-13 23:08:35 +01:00
Ad Schellevis
31af16db12 MMC, HS200/HS400 support seems to break mmc legacy support, clock probing seems to have issues.
Original source 398d5fc6af

This commit resets mmc_calculate_clock() to it's original behaviour.
2019-01-27 10:45:04 +01:00
Ad Schellevis
b91790ab56 pull https://reviews.freebsd.org/D17896 to fix netmap tx / bpf packet tap hook, closes https://github.com/opnsense/core/issues/1632
tested locally with intel igb driver, seems to be working fine, lets give this some time in our dev version.
2018-12-12 22:57:04 +01:00
Franco Fichtner
700c1a0421 hn: do not discard UDP6 traffic
Taken from: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=231797
2018-10-18 09:19:31 +02:00
Franco Fichtner
affaa76ca1 re: update to vendor version 1.95
Taken from: http://www.realtek.com
2018-10-07 18:52:33 +02:00
Franco Fichtner
c689ecc1ec run: add AE3000 and AE6000; closes #17 2018-10-07 17:43:08 +02:00
sbruno
94f9f4e0ad Do not initialize the adapter on MTU change when adapter status is down.
This fixes long-standing problems when changing settings of the adapter.

Discussed in:
https://lists.freebsd.org/pipermail/freebsd-net/2016-June/045509.html

Submitted by:	arnaud.ysmal@stormshield.eu
Reviewed by:	erj@freebsd.org
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D7030
2018-10-07 17:42:28 +02:00
Franco Fichtner
cd1c670224 netmap: ring size limit not enough for multi-queue em(4)
Also mutes a spammy message.  Bravely going where no man
has gone before.  :)
2018-10-07 17:34:21 +02:00
Franco Fichtner
0c0e584f24 HBSD: cleanups, smaller reverts and review
* Remove default HT disable hardening for now
* Remove default tempaddr IPv6 for now
* Whitespace changes vs. FreeBSD
2018-10-07 17:29:46 +02:00
Franco Fichtner
12706d45cb HBSD: sync up with hardened/11.2-releng/master branch
Commit: b8dead303184bcbd695cdb20407f5677f2424092
2018-10-07 14:26:34 +02:00
Franco Fichtner
0dc4b34cbd src: switch to release/11.2.0
Taken from: FreeBSD commit 62a489e1688b21b7cbdab9ffdb449a67bacc770c
2018-10-07 14:26:34 +02:00
Franco Fichtner
b59bcb97ec re: it looks like re(4) does not have this issue at all 2018-09-23 12:24:37 +02:00
Franco Fichtner
6fcf512a07 re: allow bpf listener to see outgoing packet
PR: https://github.com/opnsense/core/issues/1632
2018-09-23 01:39:22 +02:00
Franco Fichtner
8bf726ec98 re: update to upstream version 1.95
Taken from: http://www.realtek.com
2018-09-09 15:01:31 +02:00
Franco Fichtner
cfa8a767ac Revert "ixgbe: move this block back to where it was via sbruno@"
This reverts commit 57b43db540.
It has no effect whatsoever.
2018-09-08 14:22:14 +02:00
Franco Fichtner
57b43db540 ixgbe: move this block back to where it was via sbruno@
Strictly speaking, the netmap init was below the block, but
now is above it as published in the FreeBSD PR.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=221146
2018-08-15 19:42:57 +02:00
Franco Fichtner
a1ae90d788 Revert "Revert "MFC r316541, r316544, and r320688 from HEAD to stable/11.""
Not enough info to go on. We'llgo on with this for the moment.

This reverts commit 7dbc9fc824.
2018-08-07 07:06:01 +02:00
Franco Fichtner
7dbc9fc824 Revert "MFC r316541, r316544, and r320688 from HEAD to stable/11."
It was mentioned that several ix(4) devices are stuck in "no
carrier", see https://github.com/opnsense/core/issues/2591

This reverts commit ae8c90cce6.
2018-08-02 08:51:56 +02:00
Franco Fichtner
4d136a0d91 ahci: merge several commits from 11.2
MFC r322308: Add new Intel Lewisburg and Union Point chipset PCI IDs.

While there, polish some old AHCI ones, since they are still reused.

MFC r322309, r322316:
Use "Ibex Peak" codename for "5 Series/3400 Series" chipsets.

This is shorter and unifies naming with later chipsets.

MFC r325571: Add some PCI IDs found on AMD Epyc system.

MFC r327094:  Add AHCI/XHCI device IDs found on AMD Ryzen+B350 system.

MFC r320178:

Add some device IDs for Intel Denverton SoCs.

MFC r324186:

Define a single instance of ahci_devclass and reference it from all the
attachment code for various SOCs and busses.  Remove all the static and
should-have-been-static and named-differently instances of it.

This should eliminate the recently-grown build warnings about multiple
definitions when building arm kernels.

MFC: r327364, r334293

- Add AHCI/XHCI device IDs found on AMD 1950X+X399 system
- Describe Fresco Logic FL1100 USB 3.0 controllers.

Approved by:	re (gjb)
2018-07-03 22:33:23 +02:00
Franco Fichtner
6f9578aef0 MFC: r308643, r312427
- Update WOL support for newer em(4) devices. [1]
- Add support for Kaby Lake generation i219 (4) and i219 (5) devices.

PR:     208343 [1]

MFC: r312641

Enable WOL features also for igb(4) class of devices.

PR:             208343
Submitted by:   Kaho Tashikazu <kaho@elam.kais.kyoto-u.ac.jp>

MFC: r322986

Don't set any WOL enabling hardware bits if WOL isn't requested
according to the enabled interface capability bits. Also remove
some dead code, which tried to preserve already set contents of
E1000_WUC while that register is completely overwritten shortly
after in all cases.

- Ever since the workaround for the silicon bug of TSO4 causing MAC hangs
  was committed in r295133, CSUM_TSO gets always disabled by em(4) on the
  first invocation of em_init_locked() given that at that point no link is
  established, yet. In turn, this causes CSUM_TSO also to be off when em(4)
  is used as a parent device for vlan(4), i. e. besides IFCAP_TSO4, also
  IFCAP_VLAN_HWTSO effectively doesn't work.

  In head an attempt to fix this was made with r308345, but that revision
  had several problems on its own. One of which was that r308345 caused
  IFCAP_TSO4 to also be cleared from both the interface capability and
  capability enable bits. Thus, once a link switched from gigabit to a
  lower speed, TSO no longer could be enabled, even not via ifconfig(8).
  So this change moves the aforementioned WAR to em_update_link_status()
  like r308345 did, but only alters the hardware assist bits accordingly,
  leaving IFCAP_TSO4 flags alone.

  Still, this isn't the only problem r308345 had. Another one is that there
  just is no way to atomically flush TSO-using descriptors already queued
  at the point in time a link speed switch to below GbE occurs. Thus, such
  in-flight descriptors still may hang the MAC. Moreover, at least currently
  there also is no way of triggering a reconfiguration of vlan(4) when the
  state of IFCAP_VLAN_HWTSO support changes at runtime, causing vlan(4) to
  continue employing TSO. Last but not least, testing shows that - despite
  all the WARs for TSO-related silicon bugs in em(4) - at least 82579 still
  may hang at gigabit speed with IFCAP_TSO4 enabled. Therefore, this change
  further removes IFCAP_TSO4 and IFCAP_VLAN_HWTSO from interface capability
  enable bits as set by em(4). While at it, the use of CSUM_TCP is replaced
  with CSUM_IP_TSO as em(4) only implements support for IFCAP_TSO4 but not
  IFCAP_TSO6 (although in principle available with a subset of the supported
  MACs).

  At the bottom line, this change allows IFCAP_TSO4 and IFCAP_VLAN_HWTSO to
  be used again with em(4), but these hardware offloading capabilities now
  need to be explicitly enabled via ifconfig(8). Beware that it's only
  considered safe to do so (and also only may work) in environments where
  the link speed is not to be expected to change from GbE. Moreover, em(4)
  appears to still be missing some more TSO workarounds for at least some
  models, specifically the 82579 (I could not find an errata sheet and
  "specification update" respectively for these latter, though, and the
  generic ICH8 one doesn't list any TSO related bugs).

- Let igb_tso_setup() handle EtherType protocols that are unsupported or
  for which support hasn't been compiled in gracefully instead of calling
  panic(9).

- Make em_allocate_{legacy,msix}() and lem_allocate_irq() match their
  prototypes WRT static.

This is a direct commit to stable/11 as corresponding code is no longer
present in head.

MFC r327231,r327232:

kernel: Fix several typos and minor errors
lib: Fix several typos and minor errors

- duplicate words
- typos
- references to old versions of FreeBSD

MFC: r327312, r327842, r327865

- Add initial support for Intel Ice Lake and Cannon Lake Ethernet MACs.
- Add workaround for Intel Sky Lake and Kabby Lake Ethernet MAC erratum
  1.5.4.5.
- Fix uses of 1 << 31.

MFC: r330803

Use FALLTHROUGH.

Activate Wake On Lan features for Ice Lake and Cannon Lake devices.

This is a direct commit to stable/11 as its not needed in -current.

PR:             228302
Submitted by:   Kaho Toshikazu <kaho@elam.kais.kyoto-u.ac.jp>
Approved by:    re (kib)
2018-06-13 12:47:25 +02:00
Franco Fichtner
ae8c90cce6 MFC r316541, r316544, and r320688 from HEAD to stable/11.
r316541:
Fix a double free in ixgbe_rxeof()

r316544:
Don't overwrite vf->flags variable at the end of ixgbe(4) ixgbe_add_vf()

r320688:
ixgbe(4): Update HEAD (p3) to 3.2.12-k

Includes:

- Support for X550EM devices.
- Support for Bypass adapters.
- Flow Director code moved to separate files
- SR-IOV code moved to separate files
- Netmap code moved to separate files

Sponsored by:	Intel Corporation
2018-06-11 22:39:04 +02:00
Franco Fichtner
4253924218 MFC r333149: ixl(4): Update to 1.9.9-k
Major changes:

- Support for descriptor writeback mode (required by ixlv(4) for AVF support)
- Ability to disable firmware LLDP agent by user
- Fix for TX queue hang when using TSO
- Separate descriptor ring sizes for TX and RX rings

Approved by:	re (marius)
Relnotes:	yes
Sponsored by:	Intel Corporation
2018-06-11 22:38:57 +02:00
gordon
8b50d38424 Fix multiple small kernel memory disclosures. [EN-18:05.mem]
Approved by:	so
Security:	CVE-2018-6920
Security:	CVE-2018-6921
Security:	FreeBSD-EN-18:05.mem
2018-05-08 21:23:36 +02:00
gordon
104e4674c6 Fix multiple small kernel memory disclosures. [EN-18:04.mem]
Reported by:	Ilja van Sprundel
Approved by:	so
Security:	CVE-2018-6919
Security:	FreeBSD-EN-18:04.mem
2018-04-04 08:52:33 +02:00
gordon
ec50e7cb61 Fix vt console memory disclosure. [SA-18:04.vt]
Bump newvers.sh and UPDATING for today's patches.

Submitted by:	emaste
Reported by:	Dr Silvio Cesare of InfoSect
Approved by:	so
Security:	CVE-2018-6917
Security:	FreeBSD-SA-18:04.vt
Sponsored by:	The FreeBSD Foundation
2018-04-04 08:52:25 +02:00
gordon
7664463d9e Add mitigations for two classes of speculative execution vulnerabilities
on amd64. [FreeBSD-SA-18:03.speculative_execution]

Approved by:	so
Security:	FreeBSD-SA-18:03.speculative_execution
Security:	CVE-2017-5715
Security:	CVE-2017-5754
2018-03-14 06:58:50 +01:00
Franco Fichtner
2e39d7d273 re: update to vendor version 1.94 2017-10-13 07:39:43 +02:00
Shawn Webb
9210b7788b
HBSD: Reimport HardenedBSD innovations
Please note that this is a work-in-progress and may not be complete,
yet. Initial testing shows success. More thorough testing needed.
2017-09-29 18:08:41 -04:00
Franco Fichtner
05dbf872ab re: update to vendor driver version 1.93 2017-09-14 21:32:30 +02:00
sbruno
0ea13b0728 Add Intel Atom Cherryview SOC HSUART support
PR:	207910
Submitted by:	johannes@brilliantservice.co.jp
MFC after:	1 week
2017-08-20 15:23:06 +02:00
Franco Fichtner
c1e3838d95 run: add AE3000 and AE6000; closes #17 2017-08-20 15:17:15 +02:00
sbruno
3f77fffb02 Do not initialize the adapter on MTU change when adapter status is down.
This fixes long-standing problems when changing settings of the adapter.

Discussed in:
https://lists.freebsd.org/pipermail/freebsd-net/2016-June/045509.html

Submitted by:	arnaud.ysmal@stormshield.eu
Reviewed by:	erj@freebsd.org
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D7030
2017-08-20 14:12:14 +02:00
Franco Fichtner
00bed2565c netmap: ring size limit not enough for multi-queue em(4)
Also mutes a spammy message.  Bravely going where no man
has gone before.  :)
2017-08-20 14:05:07 +02:00
Franco Fichtner
3c09b4c3de src: clean-cut move to release/11.1.0
Taken from: FreeBSD
Commit ref: 2f4b735c66d
2017-08-20 13:44:58 +02:00
hselasky
1bf5565150 Add new USB ID.
While at it remove some whitespaces.

Submitted by:	Jose Luis Duran <jlduran@gmail.com>
PR:		213110
MFC after:	1 week

(cherry picked from commit 0c22163daba4a8ecc287e6b2f7060383c5e1dcb1)
2017-08-18 18:37:12 +02:00
loos
ee7c8aecaa Add the ID for the Huawei ME909S LTE modem.
Submitted by:	svenauhagen at github
MFC after:	3 days
Sponsored by:	Rubicon Communications, LLC (Netgate)
2017-06-27 06:19:26 +02:00
sbruno
0357654fe9 Add Intel Atom Cherryview SOC HSUART support
PR:	207910
Submitted by:	johannes@brilliantservice.co.jp
MFC after:	1 week
2017-06-12 11:52:37 +02:00
delphij
c4839b2532 Fix multiple vulnerabilities of ntp. [SA-17:03]
Xen migration enhancements. [EN-17:05]

Approved by:	so
2017-04-16 11:26:43 +02:00
delphij
de57639d0e Fix multiple vulnerabilities of OpenSSL. [SA-17:02]
Fix system hang when booting when PCI-express HotPlug is enabled.
[EN-17:01]

Fix NIS master updates are not pushed to NIS slave. [EN-17:02]

Fix compatibility with Hyper-V/storage after KB3172614 or
KB3179574. [EN-17:03]

Make makewhatis output reproducible. [EN-17:04]

Approved by:	so
2017-02-23 11:39:29 +01:00
Franco Fichtner
cc26f593af Revert "hyperv: let there be IDE disks"
This reverts commit bdf347ea9d.
Addressed in the the FreeBSD advisoriy coming right up...
2017-02-23 11:39:02 +01:00
Franco Fichtner
c2a8bcd3b1 run: add AE3000 and AE6000; closes #17 2017-02-16 17:33:28 +01:00
Franco Fichtner
48b69b0bd5 re: update to upstream version 1.93, full FreeBSD 11.0 support
Taken from: http://www.realtek.com.tw/Downloads/
2017-02-15 21:44:23 +01:00
Franco Fichtner
59089894ed re: port driver to FreeBSD 11.0 2017-02-12 11:08:31 +01:00
Franco Fichtner
b5e9e2dcc4 re: use the upstream realtek driver 1.92
Taken from: http://www.realtek.com.tw/Downloads/
2017-02-12 11:08:31 +01:00
Franco Fichtner
bdf347ea9d hyperv: let there be IDE disks
Adapted from: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=212721
PR:           https://forum.opnsense.org/index.php?topic=4405.0
2017-02-02 15:01:50 +01:00
Franco Fichtner
175886459b netmap: manually backport multiple fixes
o Restore netmap emulation mode to working order, including
  fixing the destructor panics on detach.
o Omit pipe additions to these fixes, likely problematic for
  Suricata to pass traffic like it does on 11.0 without this
  patch.
o Allow to build the module without errors in the tree.

Many thanks to Vincenzo Maffione for assistance and review!  :)

From b497fe34fd275da6b850bf271f510d02b888b8bc Mon Sep 17 00:00:00 2001
From: Giuseppe Lettieri <g.lettieri@iet.unipi.it>
Date: Thu, 2 Jun 2016 00:21:40 +0200
Subject: [PATCH] allocate only the rings requested by the user

From 09936864fa5b67b82ef4a9907819b7018e9a38f2 Mon Sep 17 00:00:00 2001
From: Giuseppe Lettieri <g.lettieri@iet.unipi.it>
Date: Wed, 20 Jul 2016 20:35:12 +0000
Subject: [PATCH] freebsd: fix const-related warning

From ab90c6c10224fefbb6a6c6e0b92e6ba80e5b694d Mon Sep 17 00:00:00 2001
From: Vincenzo Maffione <v.maffione@gmail.com>
Date: Wed, 28 Sep 2016 18:39:55 +0200
Subject: [PATCH] freebsd: generic: change mbuf allocation management

From fe811e11b2c37fc274a1134e1c10b2f6ada1a91c Mon Sep 17 00:00:00 2001
From: Vincenzo Maffione <v.maffione@gmail.com>
Date: Thu, 29 Sep 2016 08:54:52 +0200
Subject: [PATCH] freebsd: generic: call m_extadd() only once for each mbuf
2017-01-16 10:47:49 +01:00
Franco Fichtner
d15d07f11b em: restore link state probing for 82574 chipsets
This matches the Intel 7.6.2 driver code to restore "no carrier"
state transitions in the 82574 chipsets.

PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=211219
Also see: https://svnweb.freebsd.org/base?view=revision&revision=286831
2017-01-11 08:47:18 +01:00
sbruno
48f2b91578 Do not initialize the adapter on MTU change when adapter status is down.
This fixes long-standing problems when changing settings of the adapter.

Discussed in:
https://lists.freebsd.org/pipermail/freebsd-net/2016-June/045509.html

Submitted by:	arnaud.ysmal@stormshield.eu
Reviewed by:	erj@freebsd.org
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D7030
2017-01-03 08:15:39 +01:00
sbruno
850e1e9622 The buffer address is always overwritten in the extended descriptor format,
we have to refresh it ... always.  This fixes problems reported in NetMap
with em(4) devices after conversion to extended descriptor format in
svn r293331.

Submitted by:	luigi@
Reported by:	franco@opnsense.org
MFC after:	2 days
2016-10-28 16:06:33 +02:00