awg: Stop the controller and power down the PHY on shutdown
On the Pine H64 model B the PHY is supplied by a regulator of the
AXP805, which keeps its state over a reset of the SoC. After a reboot
the PHY is still powered and U-Boot finds it, while after a power cycle
it does not. When U-Boot finds the PHY the kernel hangs or panics at a
random place very early, before any driver is attached, most of the
time. When it does not, the boot is fine. The reason is not known, the
Ethernet controller of the SoC being left running by U-Boot is one
possibility.
Stop the controller and disable the PHY supply when shutting down, so
that the next boot starts like after a power cycle. This is a
workaround, the problem should be fixed in U-Boot.
Tested on: H6
auditdistd, bhyve: drop OPENSSL_API_COMPAT
Neither uses any OpenSSL function deprecated in 3.0 or later. Both build
with no deprecation warnings against OpenSSL 3.5 and 4.1 without it.
Fix direct reads of blocks pending free
Direct reads only check the on-disk block pointer for holes, so they
can read stale data after a block has been freed but before the free
has synced. Share buffered read hole detection with direct reads to
honor pending frees as well.
Keep cached data ahead of hole detection and preserve the transaction
ordering of block clone and direct write overrides. Retain the block
pointer recheck after dnode_block_freed() for concurrent syncing.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Wale Zhang <wale.zhang.ftd at gmail.com>
Closes #19633
Approved by: kevans (mentor)
(cherry picked from commit 924b8c89c04e324649855b05986f686b58ca4cb9)
dbuf: restore BP_IS_HOLE() recheck after dnode_block_freed()
Commit 79cf54582 ("Fix reads for blocks freed after being cloned")
reworked the level-0 check in dbuf_read_hole() and dropped the
BP_IS_HOLE() recheck that followed dnode_block_freed(), together with
the comment explaining it. That recheck was not about overrides: it
closes a race with dnode_sync().
dnode_sync_free_ranges() drops dn_mtx, clears the bps through
dnode_sync_free_range_impl() -> free_blocks(), then retakes dn_mtx and
removes the range from dn_free_ranges. For blkptrs held in the dnode
(dn_nlevels == 1), free_blocks() writes the bp without the parent's
db_rwlock, so holding that lock in dbuf_read() does not serialize
against it. A reader that saw a non-hole bp, then waited on dn_mtx in
dnode_block_freed() until the range was removed, gets "not freed" while
the bp it is about to copy is already a hole (with HOLE_BIRTH, lsize
and birth preserved). dbuf_read_impl() then hands that hole to
arc_read(): no child I/O is issued, checksum verification fails with
EINVAL, and without ZIO_FLAG_CANFAIL the pool is suspended.
[24 lines not shown]
Fix double free when cloning a block with a pending free
dmu_read_l0_bps() captures the source block pointers for a clone
without consulting dnode_block_freed(). A block whose free is recorded
but not yet synced still has a valid on-disk pointer, so the clone
registers a BRT reference to a block about to be returned to the
allocator, and it is freed twice. On a debug build this trips the
metaslab double-free verifier; on a release build the space map is
silently corrupted.
Check for a pending free and return EAGAIN, as dbuf_read_hole() already
does for buffered reads. zfs_clone_range() waits a TXG and retries, by
which point the block reads as a hole.
Two cases need more than the plain check. A hole has nothing to free,
so guard with !BP_IS_HOLE(bp), otherwise a hole inside a pending free
range fails a FICLONE that master cloned. When the head dirty record
already overrode the BP, only frees after the override count against
it, so use dnode_block_freed_after(); dbuf_free_range() leaves the
[17 lines not shown]
loader.efi: Measure boot policy and loaded contents with a TPM
Use the EFI TCG2 protocol, or the legacy TCG protocol on TPM 1.2
firmware, to extend the loader PCRs and record EV_IPL events in the
firmware event log.
Extend PCR 8 with the final kernel environment and the type, name, and
arguments of each loaded boot input. Prefix both record types with
versioned, NUL-terminated domain strings. These make the records
self-identifying and define an explicit measured policy encoding. Store
the complete measured pre-images in the event data so attestation and
diagnostic tools can audit the values without an out of band copy.
Extend PCR 9 with the initialized contents of kernels, modules, and raw
boot inputs, but record only descriptive labels rather than copying file
contents into the event log.
The Lua module table has no defined traversal order. Retain content
ranges as loader-private metadata, then sort the final file list before
[27 lines not shown]
tests: Improve vn_io_fault1 test
* Declare that the test needs 4 GB of memory so it can be automatically
skipped on systems with low memory.
* Switch back to mmap() as in my initial prototype. Using malloc() is
simpler, but on systems with malloc debugging enabled, malloc() will
prefault the entire buffer, resulting in a false positive. Using
mmap() also guarantees that the buffer is page-aligned, which renders
the test determinstic: we now only need to prefault exactly 2 GB, and
the difference between ret and len will be exactly the amount that we
prefaulted.
* To prefault the buffer, instead of a simple loop that writes zeroes
to it, which a compiler might recognize as dead stores and eliminate,
read the first INT_MAX bytes from the file into it.
PR: 298159
Fixes: ba02bbbe86ae ("tests: Add test for vn_io_fault1 bug")
[2 lines not shown]
powerpc64: don't reserve the red zone on the alternate signal stack
A 64-bit signal frame is 1552 bytes; rounded up and with the 512 byte
red zone added it needs 2096 bytes, more than MINSIGSTKSZ (2048), so a
handler on a minimum size alternate stack had its frame start 48 bytes
below the stack. The red zone only exists below the interrupted code's
stack pointer, so skip it only when the frame goes on that stack.
A handler on a MINSIGSTKSZ alternate stack overwrote the 48 bytes below
it; the frame stays within the stack now.
Reviewed by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61519
syncache.4: Align lists
Normally I am against tabbing them over so far to align the list, but
in these lists actually the page is 862 lines rendered aligned or using
indent, so aligning it improves readability without scolling regression.
MFC after: 3 days
ioctl: Add a macro for extracting the ioctl number from a command
Sprinkle it in various drivers which hard-coded the command layout.
No functional change intended.
Reviewed by: dumbbell, emaste
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61045
(cherry picked from commit 12b3c29a985d1753693d732372dafe915a890259)
vm_kern: wrap around in kmem_back() when the last domain is empty
kmem_back() picks the domain from the address and, when that domain has
no memory, steps forward until it finds one that does:
domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
while (VM_DOMAIN_EMPTY(domain))
domain++;
Nothing stops the walk at vm_ndomains. When the empty domain is the
last one, the loop runs through the unused tail of vm_dom[] (all empty)
and on into whatever follows vm_dom[MAXMEMDOM] in memory, until a word
there happens to look like a non-zero page count; kmem_back_domain()
then allocates from that garbage domain. Ordinary allocations never
get here, because the per-domain arenas and the domainset iterators
skip empty domains. Only the direct callers of kmem_back() do: kinst
(one trampoline per thread, allocated when the module loads) and
memguard.
[8 lines not shown]
malloc: Fix realloc() for large allocations
min() truncates its parameters.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit ca16e7a4920415bf9d09cf76bd2c3cda7447c098)
bhyve: Treat BAR registration failures as non-fatal
Some guest operating systems (at least 9front) will leave device I/O
space decoding enabled while probing BAR sizes. In this case, a
sufficiently large 32-bit BAR can overlap with the HPET MMIO region
fixed at 0xfed00000. This results in an assertion failure in
modify_bar_registration(), even though the collision is transient, i.e.,
the guest will promptly map the BAR elsewhere.
Tolerate such overlaps. Keep track of a BAR's registration state and
make sure that modify_bar_registration() doesn't try to unregister an
I/O space if registration failed.
This fixes a problem where a 32MB framebuffer ends up overlapping with
the HPET MMIO region, causing some guests to crash with an assertion
failure when probing BARs during boot.
PR: 290098
Reviewed by: bnovkov
[5 lines not shown]
hv_kvp: Fix some bugs and nits
- Use pending_mutex to synchronize several state flags. In particular,
ensure that two threads can't race to open the device file at the same
time.[1]
- Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a
one-byte OOB read if the caller supplied a large enough read buffer.[2]
- Change the device permissions to 0600: hv_kvp_dev_daemon_read()
returns an error until the owning process registers itself with a
write, so there's no sense in providing read-only access.
- Use bool instead of boolean_t.
- Don't return negative error numbers to userspace.
- Call seldrain() when closing the device.
Reported by: pixelpop [1][2]
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60387
(cherry picked from commit ebf1041fc854c531a27efd9f979e28d57306777d)
bhyve: Fix virtio-input event array resizing
Use the new array size when calling realloc(). Note that this queue
stores events read from a host evdev device, i.e., it is not
guest-controlled.
While here, use the cdefs.h __unused macro and use them correctly, i.e.,
don't mark "arg" as unused when it isn't.
Reported by: Brian Delgado from Intel using Anthropic Opus 4.8
Fixes: 054accac71e0 ("Add a virtio-input device emulation.")
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60679
(cherry picked from commit f1986e5b88630b1404a202251499bca0f97f5f06)
pam_exec: fix the stderr close test and avoid a double close
The cleanup tested cherr[0] when closing cherr[1]. The parent also closed
chin[0]/chout[1]/cherr[1] after pdfork() without clearing them, so the out:
cleanup path closed them again. Clear each fd after closing and test the right
one.
Reviewed by: des, markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60924
(cherry picked from commit 06abe08de45d251410949eac1bbb025367275260)
dhclient: Avoid out-of-bounds reads in check_classless_option()
The loop did not verify that the option buffer is large enough before
reading an address.
Reported by: Andrew Griffiths <andrew at calif.io>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60484
(cherry picked from commit 368a1bfcd49315e8dd3e56ca6744ce5d74ef737b)
inetd: use snprintf() in inetd_setproctitle()
inetd_setproctitle() formats se_service (the service name taken verbatim
from inetd.conf) and the peer address into an 80-byte buffer with
sprintf(). A long service name can overflow it. Bound both calls with
snprintf().
MFC after: 1 week
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D60879
(cherry picked from commit 9ab2bf0f4296e8bfafe4dc70f2f200265e6933bd)
dhclient: Add some regression tests
Add tests for some recently fixed bugs in dhclient. All of these tests
set up two VNET jails connected by an epair. dhclient runs in one jail,
and the test code runs on the other end. It uses scapy to inject
"interesting" packets in response to DHCPDISCOVER messages from
dhclient, then checks the configured interface and lease file.
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60485
(cherry picked from commit a143197801c680b958ab662c88cf086668a1958b)
rtnetlink: Use default weight for unset weights in NHA_GROUP
newnhg() copied the weights of a nhgrp as is and a group
whose members all have a zero weight, which is what
userland sends when it leaves the weight unset, made
calc_min_mpath_slots_fast() divide by zero.
Therefore replace weight of zero with RT_DEFAULT_WEIGHT.
While here, return early from calc_min_mpath_slots_fast()
if all weights are zero.
MFC after: 3 days
Fixes: 7e5bf68495cc ("netlink: add netlink support")
kernel: Add -mindirect-branch-cs-prefix for WITH_KERNEL_RETPOLINE
-mindirect-branch-cs-prefix adds a CS segment-override prefix (0x2e)
to each call or jmp to a retpoline thunk. The CPU ignores the prefix,
but it extends the instruction to six bytes instead of five. This
leaves enough room for a future kernel change to patch all of the call
sites at boot time to disable retpoline if not required.
Support for this option arrived in GCC 12 and Clang/LLVM 16.
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61514
if_media: Add 100BASE-T1 and 1000BASE-T1 media types
100BASE-T1 (IEEE 802.3bw) and 1000BASE-T1 (IEEE 802.3bp) are Single-Pair
Ethernet (SPE) standards intended for use in automotive and industrial
applications.
Reviewed by: kbowling
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60864
(cherry picked from commit f69099fc0fc55262741621451a52de50f164271a)
tcp: count only the SACK blocks that fit in tcp_maxseg()
tcp_addoptions() sends only the SACK blocks that fit in TCP_MAXOLEN.
tcp_maxseg() counted every pending block and clamped the total, so
without timestamps and with five or more blocks pending it came out 4
bytes below the segment tcp_output() sends. Limited transmit after an
RTO then sent one full segment and failed the "sent too much" KASSERT.
PR: 282605
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
Reviewed by: tuexen, glebius, adrian
Differential Revision: https://reviews.freebsd.org/D60460
powerpc: don't drop FPU and VMX ownership in grab_mcontext()
grab_mcontext() saved the FP and vector registers with save_fpu() and
save_vec(), which drop ownership: PCPU(fputhread) becomes NULL while
PCB_FPU stays set and the thread keeps using the unit. A later
cpu_update_pcb(), at fork(2) or thr_new(2), then skipped the save,
since save_fpu_nodrop() only saves for the thread that owns the unit,
and the child got the registers as they were at the getcontext() or
signal rather than at the fork. Use the nodrop variants.
A child forked after getcontext() saw the parent's f14 as it was at
the getcontext(); it sees the current value now.
Reviewed by: adrian, jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60837
procctl: Zero the output structure for the compat32 syscall
Otherwise the freebsd32 implementation of PROC_REAP_STATUS leaks
uninitialized kernel stack memory.
Reviewed by: kib
Reported by: Dennys Kaluzny Pereira <dennyskaluzny at gmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61510
