autofs_lookup(): busy the mount point around autofs_trigger()
Since autofs_lookup() calls into autofs_trigger_vn() to perform
automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
for the unmount to start meantime. Then autofs_trigger() accesses freed
memory.
At this point, busy can be only done unblocking, and the transient
failure must abort the trigger operation. This would cause spurious
automounter errors, but at least should prevent accesses to the freed
memory.
PR: 294361
Reviewed by: markj, rew
Tested by: rew
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58626
ixl: enforce the assigned VF MAC address
When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.
Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.
Fixes: 7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
(cherry picked from commit d2309d9d6dc6d5a9141314652d6c96ab46a9a62c)
ixl: enforce the assigned VF MAC address
When allow-set-mac is disabled, the MAC filter validation condition
rejects the assigned VF unicast address while allowing any different
unicast address. The equality test was accidentally inverted when this
code moved to the boolean address helper.
Accept multicast and the assigned unicast address, and reject other
unicast addresses as intended.
Fixes: 7d4dceec1030 ("ixl(4): Fix VLAN HW filtering")
(cherry picked from commit d2309d9d6dc6d5a9141314652d6c96ab46a9a62c)
iflib: clear the deferred TX descriptor state when a queue is stopped
Stopping an interface frees the queued mbufs and zeroes a transmit
queue's descriptor accounting, but the three counters that track
descriptors deferred to a later doorbell write or report-status
request are not cleared there: they only reach zero when the code
that acts on them runs. After a reset they therefore describe
descriptors that no longer exist, until enough new traffic flushes
them.
The consequences are small - one doorbell written from a stale
count, and a report-status request on the first packet after the
reset - but the state is simply wrong, and the transmit-hang check
in iflib_timer() reads one of them.
MFC after: 1 week
Assisted-by: Claude Code (Opus 5)
iflib: remove the unused TX queue state machine
The previous commit stopped using ift_qstatus and the IFLIB_QUEUE_*
states for the TX watchdog decision, leaving only dead stores.
Remove the field, the states, and all assignments. The byte the
field frees stays behind as explicit padding. No functional change.
Reviewed by: gallatin, markj
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58282
Assisted-by: Claude Code (Fable 5, Opus 5)
iflib: restore TX watchdog functionality
Since f6afed726b00 the TX-hang check in iflib_timer() has required a
queue state other than IFLIB_QUEUE_IDLE, but nothing ever sets
IFLIB_QUEUE_WORKING, so IFLIB_QUEUE_HUNG has been unreachable ever
since: stalled TX queues are not detected, not reported, and not
reset - the TX watchdog of every iflib(4) driver has been dead code.
Instead of resurrecting the queue-state machine, detect the hang
directly. A transmit queue is frozen while it holds descriptors the
hardware has not reported as completed and none were reclaimed over a
timer period. Being frozen is not a fault: the hardware may defer
marking descriptors as completed indefinitely. The check therefore
arms only when a frozen queue also takes on new work, while the link
is up, no pause frames were received and no doorbell is pending; and
it acts only after the queue has stayed frozen for
net.iflib.tx_watchdog_periods consecutive periods. It then asks the
hardware through the driver's read-only credits peek
(isc_txd_credits_update with clear=false, the same call the mp_ring
[46 lines not shown]
fix p9fs_vget_common() panics
This addresses a race when two vnodes attempt to call vfs_hash_insert(),
but only one succeeds. Also, in case of an error from
p9fs_reload_stats_dotl(), it marks the vnode for deletion.
Reviewed by: kib
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58632
nfs_commonkrpc.c: Get rid of NFSv4.0 delegation cruft
Delegations in NFSv4.0 never worked well and, since
the NFSv4.0 protocol is now deprecated, use of delegations
for NFSv4.0 is disabled as far as the client can do so.
It turns out that some Illumos NFSv4.0 server issues
delegations anyhow (even when the callback path is
specified as 0.0.0.0) and this can cause use after free
problems.
This patch deleted some cruft that did an nfsrpc_openrpc()
call recursively when an NFSv4.0 server failed to issue
a delegation when it had previously done so.
This code was only meant to be an optimization and
would have been rarely exercised. Since this recursive
call of nfsrpc_openrpc() is in some of the backtraces
in the bugzilla PR, getting rid of the cruft makes sense.
[5 lines not shown]
manuals: Fix more Fx and nearby mechanical typos
Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.
The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Others had other parts of
the sentence supplied as an argument to Fx.
While here, fix the other mechanical typos visible on those specific
screenfulls. Correct section typo AUTHOR to AUTHORS, markup utilities
with Sy, and apply line break after the end of a sentence.
PR: 297248
MFC after: 3 days
Reported by: wosch (are you sure that's all of the broken Fx'es?)
[5 lines not shown]
arm64: Use the fault handler when one is provided
In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.
MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426
(cherry picked from commit c6f5d8fb269fd67a8206420b4e7d67a93bc80733)
Signed-off-by: Olivier Houchard <cognet at FreeBSD.org>
(cherry picked from commit 60dd46db19f473af7aa505c0d8dcf9bb69847019)
Signed-off-by: Olivier Houchard <cognet at FreeBSD.org>
arm64: Use the fault handler when one is provided
In align_abort() and tag_check_abort(), if we got a fault while in kernel,
do not panic if a fault handler has been provided. We may get such a fault
when trying to read or write userland data, it can at least happen with
_umtx_op() if an unaligned pointer is provided. Instead, just let the
fault handler deal with it.
MFC After: 1 week
Approved by: andrew
Differential Revision: https://reviews.freebsd.org/D58426
(cherry picked from commit c6f5d8fb269fd67a8206420b4e7d67a93bc80733)
Signed-off-by: Olivier Houchard <cognet at FreeBSD.org>
sys/socket.h: Fix AF_MAX
AF_MAX was always intended to be one more than the greatest allocated
value. Jeff broke this in 2013. Unfortunately, a bunch of people then
decided to adapt to the mistake instead of correcting it.
Fixes: 863c7e45628d (" - Reserve a special AF for SDP. The one we were incorrectly using before was taken by another AF.")
MFC after: 3 days
Sponsored by: Klara, Inc.
Sponsored by: NetApp, Inc.
Reviewed by: kevans, glebius
Differential Revision: https://reviews.freebsd.org/D58597
e1000: report UDP RSS hash type on igb/em
{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.
Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.
Reviewed by: kbowling, gallatin
Approved by: kbowling
MFC after: 1 week
MFC to: stable/14, stable/15
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58513
(cherry picked from commit 285c749f575ed7f9e60555037f23ac673084c62a)
hwpmc: fix event allocation on pre-Zen AMD CPUs
amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.
Reviewed by: mhorne
Approved by: mhorne
MFC after: 1 week
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58468
(cherry picked from commit 6c4d9b9af1a3b247bf82a4228c835d106f535613)
e1000: report UDP RSS hash type on igb/em
{em,igb}_determine_rsstype() mapped only the TCP and bare-IP RSS descriptor
types; the UDP types returned M_HASHTYPE_NONE.
The hardware does hash UDP, but with a NONE hashtype iflib skips its
flowid-based TX queue spread, so all forwarded UDP egressed on a single queue
and serialized transmit on one core.
Add the three UDP cases (IPV4_UDP, IPV6_UDP, IPV6_UDP_EX) so egress spreads
across all TX queues.
Reviewed by: kbowling, gallatin
Approved by: kbowling
MFC after: 1 week
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58513
(cherry picked from commit 285c749f575ed7f9e60555037f23ac673084c62a)
hwpmc: fix event allocation on pre-Zen AMD CPUs
amd_allocate_pmc() chose the pmu-events code path whenever pmc_cpuid was
non-empty, and rejected any allocation lacking PMC_F_EV_PMU.
But pmc_cpuid is set for every AMD CPU, while the pmu-events tables only cover
Zen and later.
On older families (K8, Bobcat, Jaguar/16h, Bulldozer) libpmc finds no
pmu-events entry and falls back to the legacy path, which never sets
PMC_F_EV_PMU.
Reviewed by: mhorne
Approved by: mhorne
MFC after: 1 week
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58468
(cherry picked from commit 6c4d9b9af1a3b247bf82a4228c835d106f535613)
stand: consume UEFI PXE Base Code cache to seed DHCP
Populate stand/libsa/bootp.c's bootp_response global from the UEFI PXE
Base Code Protocol's cached DhcpAck, so bootp() can enter RFC 2131
INIT-REBOOT and skip DISCOVER/OFFER instead of running a fresh DHCP
transaction after the firmware has already done one.
manuals: Fix Fx and nearby mechanical typos
Fix compiler warnings related to the Fx macro, as well as all other
mechanical typos that were visible within one screenful of them. These
cause rendering glitches on various toolchains with various of the five
and a half decades of rich output formats and tooling manpages scale to.
The *x macro set specifies operating systems. These macros take the rest
of the line as an argument. Sometimes, a space was not used to separate
the argument of Fx and the trailing period. Another, FreeBSD Foundation
was misrepresented as an operating system version instead of an author.
Two more had other parts of the sentence supplied as an argument to Fx.
While I had those open, fix the other mechancial typos visible on those
specific screenfulls. Fix a list width glitch, correct section typo
AUTHOR to AUTHORS, and switch AUTHORS sections containing prose to
prose-mode so that they wrap freely when rendered.
PR: 297248
[5 lines not shown]
nfs_commonkrpc.c: Fix recovery that was broken by 4d80d4913e79
Commit 4d80d4913e79 added a check for nfsess_defunct already
being set. This was incorrect because, once set, nfsess_defunct
remains set and an additional recovery might be needed.
This patch reverts this part of 4d80d4913e79.
PR: 297252
Suggested by: olivier
MFC after: 3 days
Fixes: 4d80d4913e79 ("nfs: Fix argument typo to avoid a crash")
ng_ipfw: provide a tree for faster hook lookup
This should assist setups that connect a lot of nodes to ipfw: and then
distribute traffic with ipfw(4) tablearg feature.
Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D58547
uexterr_gettext(3): support dynamic kernel categories
Add an uncached sysctl based implementation which retrieves individual
categories. A cache would be an obvious extension should this optional
feature that can only be enabled by an environmental varible have a
noticable performance impact in a case that matters.
Reviewed by: kib
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58238
kdump(1): minimally adapt to exterror category sources
Add some minimal handling of category sources other than static kernel
sources. We don't actually look up dynamic sources yet (that would
require extended trace records to add the file names to the trace file
since we can't assume the trace file is running on a kernel with the
same numbers.)
Make the decision to append a "src/" prefix to each file name
dependent on the category source.
Reviewed by: kib
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58412
exterror(9): dynamic kernel categories
Make it possible to define categories without compiling their
paths into libc (important for third-party modules). The
EXTERR_CATEGORY_DYNAMIC macro can be defined to a string describing the
compilation unit (generally the path relative to src/sys) which takes
the place of EXTERR_CATEGORY.
These strings are assembled in linker sets with category numbers
assigned at system startup or module load time. The strings can be
retrieved from the kern.exterr.categories.<category> sysctl.
Reviewed by: kib
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58237
exterror(9): split category into multiple sources
The static, global index into an array of strings is simple, cheap,
and works for the base kernel, but is unworkable for (potentially
third-party) kernel modules or for arbitrary userspace code. Swipe a
few of the top bits of category to indicate a source with all-zeros
being the current model (EXTERR_CAT_SRC_KERN_STATIC). Add two
additional sources EXTERR_CAT_SRC_KERN_DYNAMIC and EXTERR_CAT_SRC_USER
with stub implementations.
Reviewed by: kib
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D58236
bin/sh: Fix history long line truncation/corruption
When reading from standard input with editline history enabled, increase
buffer size to accomodate long lines so that history is recorded
correctly. Cleanup el_gets() handling avoiding potentially dangerous
retention of pointers to editline buffers across calls. Ensure struct
parsefile objects are properly zero initialised when created. Remove
push argument from setinputstring() and simplify logic as it was always
called with a value of one and as was written was potentially dangerous
if ever called with a value of zero.
This commit does not fix long lines when history is enabled but editing
is not (e.g. if there is no terminal).
MFC after: 3 weeks
Pull Request: https://github.com/freebsd/freebsd-src/pull/2028
Signed-off-by: Kristofer Peterson <kris at tranception.com>
(cherry picked from commit 95e4fce8f0c4fc6bf828288b1d63faf0f1300198)
ip_mroute: Don't assume that a multicast router is running
The SIOCGETSGCNT handler may be invoked in this scenario, and if no
router has initialized the lookup table, we'll have
mfct->mfchashtbl == NULL.
PR: 297148
Reported by: Robert Morris
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
sys/ofed: don't stop removing stale RoCE GIDs at the first hole
When cleaning up stale GIDs the scan stopped as soon as
rdma_get_gid_attr() failed. But that can also happen for empty entries
in the middle of the table, so a single gap left everything after it
behind and the GID entries could eventually run out.
Now the whole table is scanned and the empty slots are simply skipped.
Reviewed by: kib, jhb
Sponsored by: Nvidia networking
Fixes: 6a75471dbcf0 ("OFED: Various changes from Linux 4.19")
Differential revision: https://reviews.freebsd.org/D58510
