ZIL: Don't acknowledge commits after a failed log block
After a log block (lwb) fails to write, a later fsync() or O_DSYNC
write can return success, and then be lost in a crash.
When an lwb's write fails, its waiters fall back to txg_wait_synced().
zil_lwb_set_zio_dependency() passes the error on to the next lwb only
while the failed one is still in flight. An lwb issued after the
failed one reached LWB_STATE_FLUSH_DONE has no dependency on it, so it
completes without error and its waiters return success. But on disk,
the log chain ends at the failed lwb, because zil_parse() can't read
it. Until the txg holding the failed lwb's records syncs and
zil_sync() moves zh_log past it, a crash loses every record after it,
including ones zil_commit() reported as stable.
The same happens when the lwb itself is written but a dmu_sync() write
for one of its WR_INDIRECT records fails. That error also reaches the
lwb's root zio, so the lwb's own waiters fall back, and again later
lwbs complete without error. After a crash, zil_claim_log_record()
[48 lines not shown]
Fix user accounting after incremental receives into encrypted datasets
Until now, user, group and project accounting was skipped while any
receive into an encrypted dataset was in progress. A raw receive can't
account for the objects it changes, because their owners and sizes are
encrypted, and non-raw receives skipped it too so that a raw
incremental could be received on top of them later.
Since 63a26454ba, a raw incremental stream can be received into a
dataset whose base snapshot already has accounting, which happens when
sending changes back to the dataset they came from (for example,
failing back after a failover). The receive leaves the accounting
objects and each object's DNODE_FLAG_USER*USED_ACCOUNTED flags as they
were, and the upgrade that runs at the next mount only dirties every
object again. For an object that is already marked as accounted, the
old and new charges both come from the received state, so they cancel.
Objects that the stream changed or freed keep their old charges: a
chown isn't reflected, freed space stays charged, and later frees can
wrap the counts below zero. A non-raw incremental onto a base snapshot
[38 lines not shown]
Add vendor support for Macaroni OS
Macaroni OS is a source-based OpenRC distribution (a Funtoo Linux
derivative). Its zfs packages currently have to force
--with-vendor=gentoo, because the auto-detection chain in
ZFS_AC_DEFAULT_PACKAGE probes no marker file that Macaroni ships.
Add a 'macaroni' vendor, detected via /etc/macaroni-release (being
added to the OS baselayout:
https://github.com/macaroni-os/core-kit/pull/710), with behavior
identical to the existing 'gentoo' entries:
- DEFAULT_PACKAGE: tgz
- DEFAULT_INIT_SHELL: /sbin/openrc-run (IS_SYSV_RC=false)
- initconfdir: /etc/conf.d
- bashcompletiondir: /usr/share/bash-completion/completions
No behavior changes for existing vendors: each touched case only adds
one alternative to an existing pattern, and the new detection entry
[12 lines not shown]
devel/github-act-runner: Add new port
github-act-runner is a self-hosted GitHub Actions runner implemented
in Go. It speaks the GitHub Actions runner protocol and executes
workflow steps directly on the host, including shell and JavaScript
actions.
Reviewed by: jrm
Differential Revision: https://reviews.freebsd.org/D61143
[mlir][Presburger] NFC: factor out removeRedundantConstraintsFromSimplex (#235955)
Split the compaction loops of
IntegerRelation::removeRedundantConstraints
into a new protected helper, removeRedundantConstraintsFromSimplex,
which
removes the constraints of the relation that are marked redundant in a
given Simplex, where the relation's constraints start at a given offset
in the Simplex (inequalities first, then each equality as a pair).
This allows reusing the same compaction logic when the relation's
constraints have been added to a Simplex that already contains other
constraints, e.g., for context-based simplification (gist), where the
context's constraints come first and are never marked redundant.
---
<sub>Stack created with <a
href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a
[4 lines not shown]
CI: quote QEMU OS configuration expansions
Preserve the OS selection JSON and output-file path instead of applying
shell word splitting and globbing. Read the CI type and source without
interpreting backslash escapes.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Tony Hutter <hutter2 at llnl.gov>
Signed-off-by: Giuseppe Piscitelli <ooonea at gmail.com>
Assisted-by: OpenAI Codex
Closes #19619
mqueuefs: set *a_eofflag in VOP_READDIR
mqfs_readdir() never reported end of directory. Since 77b273d8f5f4
VOP_READDIR_APV() asserts that a readdir which returns no entries also
sets *a_eofflag, so with INVARIANTS the final zero-length
getdirentries(2) that ls(1) issues on a mounted mqueuefs panics:
panic: VOP_READDIR: eofflag not set
Report end of directory when the child list was walked to its end;
leave the flag clear when the walk stopped because the buffer was full.
MFC after: 1 week
i2ctinyusb: do not list i2ctinyusb.c twice in SRCS
The module Makefile named its only source file in both the SRCS= line
and the SRCS+= line that follows. bsd.kmod.mk tolerates the duplicate
in a normal build, but when the kernel is built with -flto=thin the
linker sees the same bitcode object twice and refuses to link the
module ("Expected at most one ThinLTO module per bitcode file").
Fixes: 54e231b373ef
MFC after: 1 week
Linux: free the range on a zvol write-zeroes request
Zvols advertised no write-zeroes limit, so blkdev_issue_zeroout() fell
back to writing zero-filled pages. BLKZEROOUT, fallocate --zero-range
and a guest's zero-fill became data writes, which with compression off
took as much space as the data they replaced. fallocate --punch-hole,
which has no such fallback, failed with EOPNOTSUPP.
Accept REQ_OP_WRITE_ZEROES and handle it as a discard that keeps the
unaligned ends. dnode_free_range() zeroes the partial blocks there, so
the whole range reads back as zeroes, and the ZIL logs the same
TX_TRUNCATE a discard does. The limit is the discard limit. On 6.17
and later the zvol also reports that its write-zeroes frees the range.
REQ_NOUNMAP, set by BLKZEROOUT and zero-range, asks that the blocks
stay allocated. Copy-on-write allocates a new block on every
overwrite, so writing zeroes would reserve nothing; refreservation is
what reserves space. The range is freed anyway, as
zpl_fallocate_common() does for FALLOC_FL_ZERO_RANGE on files.
[9 lines not shown]
CodeGen: Remove -verify-machineinstrs from llc -passes MIR tests (#238157)
With the new pass manager, -verify-machineinstrs does not add a
verifier after each pass; only -verify-each does. Bizarrely, instead
it suppresses the verifier llc runs at the end of the pipeline, so
removing it enables verification of the output. This is probably a
bug, but I think the plan is to replace this flag in the new PM
anyway.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
zed: don't count solved cases as peers of a new diagnosis
Since ddf5f34f0 the diagnosis engine skips faulting a vdev when another
leaf under the same parent has an active SERD case, on the grounds that
errors on several drives at once point at something above the drives.
A solved case also counts: its engine has fired. But a solved case
stays open for as long as its vdev stays faulted, so once ZED has
faulted one leaf of a mirror or raidz and a hot spare has replaced it,
no other leaf under that parent can be faulted by ZED again until the
first one is repaired or replaced. The second failing disk keeps its
errors, gets no spare, and the case is retired over and over ("pool ...
is tracking 1 other io error cases -- skip faulting the vdev").
Skip solved cases when counting peers. A faulted vdev gets no more
I/O, so its case no longer says anything about errors happening now.
Cases that are still accumulating errors, or whose fault is pending,
still hold off a diagnosis as before.
This makes auto_spare_multiple pass.
[5 lines not shown]
ZTS: expect auto_spare_multiple to pass
auto_spare_multiple has failed on every Linux CI run for a long time,
hidden by its "maybe" entry: after ZED faults the first device and a
hot spare replaces it, the second device's I/O errors never fault it,
and the test times out waiting for FAULTED. Remove the entry so the
failure shows.
Past that point the test also races with the scans the pool starts by
itself. Before its second scrub it polled "scrub in progress" and then
"resilver in progress" with two zpool status calls and started a scrub
once both were false. A dRAID rebuild starts a scrub in the same sync
task that ends it, so the poll could see neither and the scrub failed
with "currently scrubbing". The resilver onto the first spare, deferred
behind the first scrub, is started from the async thread after that
scrub ends, and can replace a scrub started just before it.
Wait for those with zpool wait, retry a scrub that finds one running,
and scrub again if the scrub did not run to the end.
[4 lines not shown]
iavf: Honor negotiated VLAN offload capabilities
The driver advertised VLAN offload unconditionally, even when the PF
did not grant it, as observed with an E835 VF under Hyper-V. This
tells the stack to rely on hardware tag insertion and sends the PF
unsupported VLAN filter requests.
Advertise hardware VLAN tagging and filtering only when GET_VF_RESOURCES
grants the legacy VLAN capability. Do not allocate filter shadow entries
or send ADD_VLAN/DEL_VLAN requests without that capability. Retain VLAN
MTU and checksum/TSO support for software-tagged packets.
Keep advertised capabilities stable across resets, since existing VLAN
interfaces may already rely on them. If resource rediscovery removes
previously advertised VLAN offload, leave the VF stopped and require
reattachment rather than resume with a stale offload contract. A newly
granted capability is not exposed until reattach.
MFC after: 2 weeks
Sponsored by: BBOX.io
[ORC] Ignore non-prefixed strings in InProcessDylibManager. (#238143)
InProcessDylibManager::lookupSymbolsAsync was unconditionally dropping
the first character from symbol names whenever a global prefix was set,
without checking that the first character matched the prefix. E.g. on
Darwin, where the global prefix is '_', a lookup of `printf` should
generate a SymbolsNotFound error (the C function is `_printf`), but
instead it generated a lookup of `rintf`, which binds against a rounding
function from math.h.
This patch fixes the issue by checking that the first character in the
symbol name matches the prefix, returning std::nullopt if it does not.
See discussion at:
https://github.com/llvm/llvm-project/issues/5852#issuecomment-6362518329
Release the new znode when its ZIL commit fails
Since 967b15b88 ("ZIL: allow zil_commit() to fail with error"),
zfs_create(), zfs_mkdir() and zfs_symlink() return the result of the
zil_commit() they issue on a sync=always dataset, and since 72602f6ad
("ZIL: "crash" the ZIL if the pool suspends during fallback"), both
from #17398, that result is EIO when the pool suspends during the
commit with failmode=continue. These functions set *zpp to the held
znode before the commit, and their callers only take the znode over on
success, so the error leaks the reference: the inode is never evicted,
a removed entry stays on the delete queue, and a later unmount spins
forever in zfsvfs_teardown() waiting for z_all_znodes to drain. On
FreeBSD the leaked vnode is also left locked.
Set *zpp only once the commit succeeded, and release the znode
otherwise, unlocking the vnode first on FreeBSD. The entry itself is
kept: the transaction that created it is already committed and cannot
be undone on a suspended pool, and zfs_write() and zfs_fsync() likewise
return EIO for a change that stays applied.
[8 lines not shown]
zed: fix zpool handle leaks in zfs_retire agent
is_draid_fdomain_failure() looks up the pool twice per try, up to four
tries, via find_by_guid_impl(), but never closes the returned
zpool_handle_t. Since it is called for every removed/faulted vdev,
regardless of the pool type (the "not dRAID" check happens after the
handles are opened), zed leaks two pool handles, including their config
nvlists, on every such event, and up to eight when a dRAID with failure
domains is not (yet) in a domain failure state. The nfaults_map buffer
was also leaked on the early returns.
Rework it to open the pool only once per try, look up the top-level
vdev in the same config snapshot, and close the handle at the end of
each try. Also guard against a zero top-level guid, which previously
left nvtop uninitialized.
zfs_retire_recv() had similar leaks:
- In the resource.fs.zfs.removed/statechange path, the early returns
[20 lines not shown]
[libc] Add POSIX-mandated transitive header inclusion to three headers. (#237436)
Per POSIX standard:
* `<sys/sem.h>` shall include the `<sys/ipc.h>` header
* Inclusion of the `<threads.h>` header shall make
symbols defined in the header `<time.h>` visible.
* Inclusion of the `<pthread.h>` header shall make symbols
defined in the headers `<sched.h>` and `<time.h>` visible.
There are real-world programs which correctly rely on this
behavior.
Implement all of the above using `public_includes` feature in YAML
config
to add transitive inclusions to generated headers. Technically speaking,
we can "make symbols visible" using other mechanisms, but simple
transitive inclusion is by far the easiest one.
iavf: Reconcile VLAN filters with acknowledged requests
Track desired and acknowledged VLAN membership separately. Retain
pending deletions and uncertain state after failed requests instead of
losing the work when a message is submitted. Make repeated registration
idempotent.
Adapt DPDK's synchronous, single-VID virtchnl request shape and the
bounded desired-state reconciliation used by igbv and ixv. Serialize
VLAN requests under the existing virtchnl mutex, with filter-list
changes under the iflib context lock. Preserve an unresolved
transaction so a late reply cannot be mistaken for a newer operation,
including after the desired state changes.
Reconcile live membership changes without restarting healthy queues.
Limit each pass to 32 requests and a one-second reply deadline,
continuing live batches from the admin task. Down or recovering VFs
apply desired state at initialization; initialization batches continue
through the existing retry callout without rediscovering the mailbox or
[14 lines not shown]
[MachineOutliner] Skip returns_twice functions (#237875)
fixes: #237874
If a function returns twice, or calls a function that can return twice,
skip it. The context saved by functions such as `setjmp` will be
different if they take place within an outlined function. Ex: Saved
stack pointer will be different.
Was able to trigger a crash by outlining a call to a returns_twice
function.
Reject receive transfers whose descriptor frame length exceeds the data
actually transferred. The descriptor carries a 12-bit frame length and
the chip accepts frames up to 4095 bytes, but a receive transfer only has
MCLBYTES minus the descriptor for frame data.
Trusting the descriptor produced an mbuf extending past its cluster.
A fragmented IPv4 datagram then carried it into m_cat(), where a default
kernel panics on a DIAGNOSTIC assertion.
Report and diff from Acts1631.
ok miod@ claudio@ kettenis@
[clang][NFC] Test Linux/Windows Multilib Resource Dirs (#238147)
This is another follow-up to 78820cb91605693b7d768be4ebc8b66181d3e9c3 to
show the behaviour of resource dir resolution after that change.
Assisted-by: AI
