src/sys/amd64, branch stable/13

pkru: Fix handling of 1GB largepage mappings

2026-04-21T15:43:53Z

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS set. More generally, the SET_PKRU and CLEAR_PKRU sysarch implementations did not check whether the request covers a "boundary" vm map entry. Fix this, add the missing PG_PS test, and add some tests. Approved by: so Security: FreeBSD-SA-26:11.amd64 Security: CVE-2026-6386 Reported by: Nicholas Carlini Reviewed by: kib, alc Differential Revision: https://reviews.freebsd.org/D56184

amd64/conf: Remove a config committed by accident

2026-02-09T20:18:58Z

Reported by: kib, kp Fixes: 350ba9672a7f ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails") (cherry picked from commit 3ef39f58e5d63a78fd1c37e6c62d599bc68d5e1e)

unix: Set O_RESOLVE_BENEATH on fds transferred between jails

2026-02-09T17:48:55Z

If a pair of jails with different filesystem roots is able to exchange SCM_RIGHTS messages (e.g., using a unix socket in a shared nullfs mount), a process in one jail can open a directory outside of the root of the second jail and then pass the fd to that second jail, allowing the receiving process to escape the jail chroot. Address this using the new FD_RESOLVE_BENEATH flag. When externalizing an SCM_RIGHTS message into the receiving process, automatically set this flag on all new fds where a jail boundary is crossed. This ensures that the receiver cannot do more than access files underneath the directory; in particular, the received fd cannot be used to access vnodes not accessible by the sender. PR: 262179 Reviewed by: kib MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D50371 (cherry picked from commit 350ba9672a7f4f16e30534a603df577dfd083b3f)

vmm: Emulate testb imm8,r/m8

2025-03-11T00:42:30Z

Add support for "testb imm8,r/m8" emulation. PR: 261940 PR: 282852 Reviewed by: markj, emaste Approved by: emaste (mentor) Obtained from: Illumos (https://www.illumos.org/issues/14483) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49208 (cherry picked from commit 49a4838a0d94e145a826abf02aa03ff444e614e3)

x86 atomics: Remove unused WANT_FUNCTIONS

2025-01-17T12:24:53Z

This macro has not been in use since commit "inline atomics and allow tied modules to inline locks" (r335873, f4b3640475cec929). Reviewed by: markj, kib, emaste, imp MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D48061 (cherry picked from commit fa368cc86cebe7185b3a99d4f6083033da377eee)

atomics: Constify loads

2025-01-17T12:24:48Z

In order to match reality, allow using these functions with pointers on const objects, and bring us closer to C11. Remove the '+' modifier in the atomic_load_acq_64_i586()'s inline asm statement's constraint for '*p' (the value to load). CMPXCHG8B always writes back some value, even when the value exchange does not happen in which case what was read is written back. atomic_load_acq_64_i586() further takes care of the operation atomically writing back the same value that was read in any case. All in all, this makes the inline asm's write back undetectable by any other code, whether executing on other CPUs or code on the same CPU before and after the call to atomic_load_acq_64_i586(), except for the fact that CMPXCHG8B will trigger a #GP(0) if the memory address is part of a read-only mapping. This unfortunate property is however out of scope of the C abstract machine, and in particular independent of whether the 'uint64_t' pointed to is declared 'const' or not. Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46887 (cherry picked from commit 5e9a82e898d55816c366cfa3ffbca84f02569fe5)

x86: Remove invalid DEVMETHOD methods for leaf devices

2024-11-30T21:46:42Z

None of these drivers are for bus devices, so bus_generic_* is not appropriate. Most of these were nops except that detach would actually "succeed" (but not do any cleanup). Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D47374 (cherry picked from commit df615735960370255d3acc4ac2a6f4fd297b7461)

amd64: Use bool for booleans in getmemsize

2024-11-29T19:11:53Z

Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D43693 (cherry picked from commit 70539d5da600a65d34c8d965ef2a9d475cbc9c4e)

vmm: avoid potential KASSERT kernel panic in vm_handle_db

2024-10-06T15:02:51Z

If the guest VM emits the exit code VM_EXITCODE_DB the kernel will execute the function named vm_handle_db. If the value of rsp is not page aligned and if rsp+sizeof(uint64_t) spans across two pages, the function vm_copy_setup will need two structs vm_copyinfo to prepare the copy operation. For instance is rsp value is 0xFFC, two vm_copyinfo objects are needed: * address=0xFFC, len=4 * address=0x1000, len=4 The vulnerability was addressed by commit 51fda658baa ("vmm: Properly handle writes spanning across two pages in vm_handle_db"). Still, replace the KASSERT with an error return as a more defensive approach. Reported by: Synacktiv Reviewed by markj, emaste Security: HYP-09 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46133 (cherry picked from commit d19fa9c1b72bc52e51524abcc59ad844012ec365) (cherry picked from commit f8db6fb90e739293d6d72310fa554ede072f8232)

bhyve: initialize register value

2024-09-30T12:11:47Z

In case of an error in a code pattern like ``` uint64_t val; error = memread(vcpu, gpa, &val, 1, arg); error = vie_update_register(vcpu, reg, val, size); ``` uninitialized stack data would be used. Reported by: Synacktiv Reviewed by: markj Security: HYP-21 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46107 (cherry picked from commit 94693ec7c85363f9b0098247489cea3efdb183f9) (cherry picked from commit a03acfa43410b3a449fa8d5b1dbba20e0bf02d5a)