kdmsg: protect connection-state publication and ownership
Autoinitiate can create a connection transaction after the writer has
stopped. The state can survive into the next connection, where replacing
conn_state loses its held reference. An old close callback can also drop
the replacement state's reference instead of its own.
Hold msglk across creation, publication and queuing, and do not initiate
a connection once EXITNOACC is set. Use a locked allocator helper for
this call path so the allocator does not need recursive lock acquisition.
Release the previous conn_state reference before replacing it. On DELETE,
clear and release the slot only when it still points to the callback's
state, independently of whether a closing reply is needed.
Dropping the previous conn_state reference is now only needed when two
autoinitiates race on a live connection; otherwise the old transaction is
cleaned up through the state tree.
Bug: https://bugs.dragonflybsd.org/issues/3435
axge(4): reject register reads for other PHY addresses
The adapter has one PHY at sc_phyno. It can answer reads at other
addresses with the same PHY data, so MII probing finds it 32 times.
Return zero for other addresses before locking or sending a USB request.
This matches the existing write callback and the axe driver pattern.
This is a driver-local fix rather than an import of the broader FreeBSD
MII framework change (see their commit
a55fb8a458d67348d723bc947914873f25b947de)
Reported-by: mneumann
Bug: https://bugs.dragonflybsd.org/issues/3405
iwm(4): reset and rescan after a fatal firmware error
On a firmware error (SW_ERR) the driver calls ieee80211_restart_all().
That does not bring the link back on a 9260: after the reset the VAP
is still in RUN, and with manual roaming (wpa_supplicant)
ieee80211_start_all() does not scan again, so Wi-Fi stays down until
the interface is brought down and up.
Do a full iwm_stop()/iwm_init() from the task queue instead, serialised
with IWM_FLAG_BUSY like iwm_init_task(), then move each VAP to SCAN so
that wpa_supplicant reassociates.
See commit df45c061928f in OpenBSD.
Bug: https://bugs.dragonflybsd.org/issues/3453
iwm(4): mask closed_rb_num to the RX ring size
The 9000-series firmware can report a closed_rb_num at or beyond the
ring size (9000 step A0 wrap-around). iwm_notif_intr() compares it
against the local consumer index, which is always below the ring size,
so the two would never become equal; the loop would cycle through stale
ring entries and the write-pointer update would use a bogus index.
See commits 5eae443eb5e2 in Linux and 3287dca4fa10 in OpenBSD.
Bug: https://bugs.dragonflybsd.org/issues/3449
iwm(4): allow 36-bit DMA for the RX/TX data buffers
The RX and TX data buffer DMA tags were limited to
BUS_SPACE_MAXADDR_32BIT. With more than 4 GB of RAM every frame is
then bounced through busdma, and under load the bounce zone can be
exhausted, dropping RX replenishments and TX frames.
iwlwifi uses 36-bit DMA for non-gen2 devices (7000/8000/9000; only
gen2 uses 64-bit). The hardware can represent such addresses: the
9000-series MQ RX free descriptor stores a full 64-bit address and
the legacy RX descriptor stores addr >> 8, while the TX TFD carries
the address bits [35:32] in the hi_n_len field. The descriptor,
status, firmware, keep-warm, ICT and scheduler allocations keep their
32-bit limit because the registers that point at them are narrower.
See tfd.addr_size in iwlwifi gen1_2/trans.c in Linux.
Bug: https://bugs.dragonflybsd.org/issues/3448
iwm(4): Replenish the RX ring before modifying the mbuf
iwm_rx_mpdu_mq() changed m_data and m_len of the RX ring mbuf before
calling iwm_rx_addbuf(). When the replenishment failed, for example
with ENOMEM from exhausted busdma bounce pages, it returned with the
modified mbuf still in the ring. The next frame received into that
slot was then parsed 56 bytes too far in: payload was taken for
notifications, bogus command completions drained the command queue,
and the "ring->queued is empty?" assertion in iwm_cmd_done() fired.
Replenish first, as iwm_rx_rx_mpdu() already does.
See commits 96eaecf93d9f in DragonFly and 0acc104f88cc in OpenBSD.
Bug: https://bugs.dragonflybsd.org/issues/3447
drm: implement pci_set_dma_mask() and pci_set_consistent_dma_mask()
The two compat functions returned -EIO unconditionally since their
introduction in 2014 (9ca0d65ea7), so every drm driver that asks for a
DMA mask at attach time fails: i915's gen8_gmch_probe() logs
"Can't set DMA mask/consistent mask (-5)" on every boot, and
radeon/amdgpu silently downgrade their DMA limit to 32 bits.
No mask was ever recorded or enforced: this compat layer maps DMA
addresses 1:1 to physical addresses, and dma_alloc_coherent() keeps all
consistent allocations below 4GB. Honor a requested mask when it
covers the installed memory (ptoa(Maxmem)); refuse only what cannot
actually work, so drivers still see an honest error on machines whose
memory exceeds their GPU's addressing limit.
Bug: https://bugs.dragonflybsd.org/issues/3455
cat(1): Remove UNIX domain socket support in favor of nc(1)
This feature was inherited from FreeBSD and added by Matthew Dillon in
2001, before nc(1) was ported from OpenBSD in 2005. Now remove this
feature in favor of nc(1), which also handles such scenarios better.
Bug: https://bugs.dragonflybsd.org/issues/2933
Makefile.inc1: Improve handling of default and alternative compilers
This makes it much easier for adding another alternative compiler and
switching the default compiler in the future.
Switch the default compiler from gcc80 to gcc120 (2)
Missed the WORLD_ALTCOMPILER update in the previous default compiler
switch commit f832cd76a838d30fcf0743178ef47129113ff095. That caused the
nrelease failure in the package building phase (see below), because it
still uses CCVER=gcc80 but gcc80 was unavailable due to
WORLD_ALTCOMPILER not being updated.
```
===> Configuring for pkg-2.2.0
No installed jimsh or tclsh, building local bootstrap jimsh0
Host System...x86_64-unknown-dragonfly6.5
Build System...x86_64-unknown-dragonfly6.5
C compiler... cc -pipe -Wno-error -I/usr/include/priv -O2 -fno-strict-aliasing
C++ compiler... c++ -pipe -Wno-error -I/usr/include/priv -O2 -fno-strict-aliasing
Build C compiler...cc
Checking for stdlib.h...not found
Error: Compiler does not work. See config.log
Try: 'configure --help' for options
[6 lines not shown]
dsynth - Apply the "debug" directive to ports-mgmt/pkg
The debug directive was not being applied to ports-mgmt/pkg,
so we couldn't retain the mounts for debugging purposes when
explicitly building that target.
Adjust the (s4) string to recognize multiple flags, since fixing
this requires two flags to be passed in.
Reported-by: aly
drm: Improve dmabuf_close() and dma_buf_fd()
* Reset fp fields before releasing the dmabuf.
* Support O_CLOEXEC in dma_buf_fd().
Obtained-from: https://apollo.backplane.com/DFlyMisc/drm98.patch
Suggested-by: servik
bsd.sys.mk: Clean up a bit
* Remove the obsolete check for "_gccver >= 49" because gcc47 has been
removed.
* Remove the duplicate "CWARNFLAGS += -Werror" inside WFORMAT condition.
This is a minor behavior change, but I think it makes more sense for
FORMAT_AUDIT to control the -Wformat warnings without adding -Werror.
contrib/tre: Fix a use-after-free bug and a memory leak bug
The 'tags', 'pmatch' and 'states_seen' are interior pointers into a
single 'buf' allocation, so calling xfree() on each of them was a
use-after-free bug.
While there, there was another memory leak bug in handling 'buf'
allocation failure, where the previously allocated 'mem' was not freed
before return.
Fix both bugs by using 'goto error_exit' for proper memory free.
The use-after-free bug was caught by the '-Wuse-after-free' warnings
from GCC 12.5, e.g.,
```
In file included from /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:78:
/usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c: In function 'tre_tnfa_run_backtrack':
/usr/src/lib/libc/../../contrib/tre/lib/xmalloc.h:69:20: warning: pointer 'tmp_buf' used after 'free' [-Wuse-after-free]
69 | #define xfree(ptr) free(ptr)
[19 lines not shown]
Check required kvm(3) symbols before reading
Check required symbols in dconschat, ipcs, netstat and legacy pstat TTY
paths. Keep optional IPC subsystems usable. Check IPC reads and
allocations before using their data.
Use buffered IPC errors and report short reads explicitly instead of
relying on an error buffer that may not describe the incomplete read.
Bug: https://bugs.dragonflybsd.org/issues/3444
libkvm(3): clear failed lookups and report lookup errors
Clear requested symbol results before lookup. Keep the live failure
count and continue looking up later entries. Report lookup errors
without relying on the last errno, and preserve table errors in internal
callers.
Bug: https://bugs.dragonflybsd.org/issues/3444
kern: avoid reading a disk label while dumping
Checking an unlabelled dump slice can trigger a disk-label read through
normal buffered I/O. During a crash dump, that read can wait indefinitely
before the dump writer reaches its polled I/O path.
Skip the label read while dumping and use the slice bounds already held
in memory, keeping the normal label probe outside the dump path.
Bug: https://bugs.dragonflybsd.org/issues/3441
nd6: keep foreign-CPU neighbors off the timer and purge list
Route requests create neighbor entries on each network CPU, but timers
and purge run on CPU 0. Purging a foreign-CPU entry deletes the matching
local route and can follow its freed neighbor entry. Link only CPU 0
entries into the list and unlink only linked entries; keep other CPUs
route-local neighbor data.
Bug: https://bugs.dragonflybsd.org/issues/3439
pf.conf.5: describe IPv6 fragment filtering without reassembly
IPv6 fragments are filtered as the Fragment header protocol, not blocked
unconditionally. State that port/type rules cannot pass them and that a
broad pass rule does not enforce those restrictions.
Bug: https://bugs.dragonflybsd.org/issues/3438
pf: fix IPv6 fragment length checks
ip6_plen excludes the IPv6 header, but off includes it. Check packet and
fragment-header bounds, use matching length units, and reject misaligned
non-final fragments. Include pre-fragment extension headers in the
reassembled payload limit.
Bug: https://bugs.dragonflybsd.org/issues/3437
ndp(8): avoid deleting covering routes and report socket errors
RTM_GET can return a covering route for an absent neighbor. Require the
requested address and an NDP route before deletion. Return failure for
routing-socket write, read and reply errors, and pass deletion failure
to the exit status.
Bug: https://bugs.dragonflybsd.org/issues/3436
