nfscl: A few more fixes for the NFS over RDMA client glue
A couple of additional fixes for the NFS client side RDMA glue:
- For Readdirplus, the reply needs to be a large chunk, so set
M_PROTO9 instead of M_PROTO8.
- The nfsclrdma.ko module now uses xprt_rdma_unmap_chunk()
instead of xprt_rdma_rekey_chunk().
Hopefully, this is it for the NFS over RDMA client glue changes.
MFC after: 3 months
Fixes: 884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA")
fsck_msdosfs: add tests for lost cluster chain repair accounting
Add an ATF test suite covering Phase 3 ("Checking for Lost Files")
error accounting. Test images are created using newfs_msdos(8),
and lost cluster chains are injected directly into FAT copies at
offsets derived from the BPB. The LOST.DIR directory required by
reconnect() is constructed similarly: a root directory entry with
ATTR_DIRECTORY set and its first cluster pointing to a zero-filled
cluster containing "." and ".." entries.
The lost_chain_cleared and corrupted_lost_chain_reconnected test
cases provide regression coverage for the preceding commit:
- lost_chain_cleared verifies that clearing a lost chain (the fallback
taken when LOST.DIR is absent) exits with status 0 rather than 8
(unrecovered error).
- corrupted_lost_chain_reconnected verifies that FAT modifications
from a chain truncated by checkchain() prior to reconnection are
written back to disk, requiring "Update FATs? yes" and ensuring a
clean second pass.
[8 lines not shown]
fsck_msdosfs: fix status accounting for lost cluster chains
checklost() scans for lost cluster chains and attempts to
repair each one, first by reconnecting it to LOST.DIR,
and falling back to clearing it if reconnection fails.
However, checklost() incorrectly updates the modification
status flags (mod), which checkfilesys() relies on to
determine whether to write back changes and what exit
status to return.
The current code have three issues:
1. A reconnect() failure immediately sets FSERROR in mod
via "mod |= ret = reconnect(...)". If reconnect() failed
(e.g., because LOST.DIR is missing, or full) but the
fallback clear operation succeeds, clearchain() frees the
chain and sets FSFATMOD. However, the leftover FSERROR
remains in mod: checkfilesys() skips marking the file system
clean and exits with status 8, even though the file system was
[30 lines not shown]
bhyve: Keep passthrough PCI power state virtual
The passthrough Command register is emulated, but PMCSR writes were
sent directly to the physical function. A guest D3hot-to-D0 transition
can perform an internal reset and clear physical Command while its
emulated copy remains enabled.
Cache the Power Management capability and keep the physical D-state
host-owned. Emulate the guest D-state and advertise No_Soft_Reset so
the guest is not promised a function reset by a virtual power cycle.
Restore the assignment-time virtual state after a managed FLR.
Reviewed by: markj
Sponsored by: BBOX.io
(cherry picked from commit 3b90096cf9bcaec70b717e9ff0a9e23d14b600b6)
bhyve: Manage passthrough devices across guest FLR
bhyve emulates the guest PCI Command register so BAR sizing does not
disable physical decoding. However, PCIe Device Control was passed
through. A guest VFIO reset therefore performed a physical FLR, which
cleared physical Command, while the guest restored only its emulated
copy. The device remained assigned with bus mastering disabled and
could not fetch DMA descriptors.
Intercept guest FLR writes and issue a PPT-managed reset. Stop all
vCPUs, verify ownership, quiesce the function, perform only an FLR, and
restore the host-owned PCI configuration, decode, and bus-master state.
Keep the IOMMU domain in place. bhyve removes guest BAR mappings before
this ioctl; a later guest MEMEN write recreates them. Never escalate a
guest FLR to a power reset.
Reset the guest-owned Command, MSI, MSI-X, MSI-X table, INTx, and MRRS
state. PCIe 6.2 section 6.6.2 explicitly preserves MPS across FLR.
Virtualize MPS, MRRS, and Completion Timeout. Keep physical MPS and
[27 lines not shown]
e1000: Report 82571 packet buffer ECC errors
The 82571 PBA_ECC register contains a 12-bit count of packet buffer ECC
detections. The shared code enables single-bit correction, but neither
FreeBSD nor the DPDK base driver consumes the counter.
Sample it with the ordinary statistics timer, accumulate the value under
dev.em.N.memory_errors.detected_packet_buffer, and clear the hardware
counter while preserving correction and reserved register state. Do not
enable its shared interrupt: the register does not distinguish corrected
from uncorrectable events and does not provide a safe fatal recovery
policy.
Validated on a dual port 82571EB. Both functions reported zero after a
clean boot, and a controlled link down/up cycle left the counter at zero
while the management link recovered at 1 Gb/s without issue.
Sponsored by: BBOX.io
(cherry picked from commit aec0f1b85b54d14819747ed3364f366d21e76d88)
iflib: Plumb per-packet RX hardware timestamps to mbufs
Add iri_rcv_tstmp to if_rxd_info so an isc_rxd_pkt_get() driver can
report a hardware RX timestamp. Copy it into m_pkthdr.rcv_tstmp,
reusing the generic mbuf timestamp path.
Widen iri_flags from uint8_t to uint32_t and define the flags drivers
may supply. Mask the flags before copying them into the mbuf so no
other mbuf state can leak through the driver callback.
Place the timestamp next to iri_frags to avoid an alignment hole, and
document its nanoseconds-since-boot representation and validity flags.
Bump __FreeBSD_version because changing if_rxd_info breaks KBI.
Reviewed by: gallatin
Signed-off-by: Sreekanth Reddy <sreekanth.reddy at broadcom.com>
Differential Revision: https://reviews.freebsd.org/D58638
iflib: Do not hold the ifnet lock across registration
iflib_device_register() acquired IFNET_WLOCK to preserve lock order
when ether_ifattach() was called with the context lock held. The context
lock is now released around ether_ifattach(), making registration-wide
ifnet serialization unnecessary.
Keeping IFNET_WLOCK across driver attachment also allows synchronous
interface event handlers to recurse on it. The rtnetlink interface-group
dump does so through if_foreach_group() while handling the interface
attachment event.
Remove the outer lock and the corresponding failure-path unlock and
relock transitions. Continue to drop the context lock around
ether_ifattach() and taskqueue drains, and preserve context-lock coverage
for driver attach and detach.
Validated under WITNESS on 82576 and I226 controllers. Multiple VF
attach and detach cycles, netmap control operations, and every iflib
[12 lines not shown]
syslogd: Pipes need the CAP_PDGETPID right as well
While here, use caph_rights_limit(), as syslogd already uses
caph_enter().
PR: 298104
Reported by: mi
Fixes: 24816abb8740 ("syslogd: Limit rights on procdescs")
MFC after: 3 days
syslogd/tests: Amend a test to catch leaked process descriptors
This serves to catch the regression fixed by commit
1a669b66ddb4 ("syslogd: reap pipe children on config reload").
MFC after: 1 week
dtrace/tests: compile D sources at runtime on test target
Previously, we would precompile D test dependencies using the
host's dtrace, which unconditionally outputs ELF files in the
host's format. This breaks the cross-compile build with errors
like the following:
dtrace: failed to link script: incorrect ELF machine type for
object file: tst.usdt.pieo
--- usdt.o ---
*** Failed target: usdt.o
This patch moves compilation to runtime for all C-based testcases
that have a dependent D source file.
Reviewed by: markj
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59030
devstat: Fix a kernel stack disclosure
The 16-byte "device_name" field was not zero-filled, so could contain
uninitialized stack data. Zero the whole struct, as that's the
prevailing pattern for this kind of conversion code, and it's more
robust in the face of future revisions to struct devstat.
Reviewed by: olce, kib
Reported by: Reo Shiseki
Fixes: a11d132f6c62 ("devstat: Provide 32-bit compatibility")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59309
(cherry picked from commit 7cb1a76f88158fb690418336b736e66c238cd4f7)
mtw: fix zero-length queue array that can corrupt struct mtw_softc
The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
attaching a matching USB WLAN device can drive writes past the absent array and
corrupt adjacent softc fields.
This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
endpoint queues the driver initializes and uses.
Fixes: c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")
Reviewed by: bz
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58897
(cherry picked from commit 7e9e72bee359437b9f78c6a4056ef0a90337f341)
malloc: Use ckdint.h helpers instead of WOULD_OVERFLOW
This serves to demonstrate some usage of the ckdint.h helpers. The new
version also generates better machine code on amd64 and arm64.
Reviewed by: kib, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 2d67765f10e7da43ba2d4a7fc074c15d5354684b)
sys: Add sys/ckdint.h
We have a C23 stdckdint.h header for userspace, which provides checked
addition, subtraction and multiplication. We lack similar helpers in
the kernel, where they are regularly needed.
Let's just adopt the C23 macros. For bonus points, I added a wrapper to
ensure that ignored an return value is raised as an error by the
compiler.
Reviewed by: kib, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58773
(cherry picked from commit 37bd69d43c70346b9191f7ce07ee9ed783ce528f)
rsu: add a runtime TX buffer bound check for a kernel buffer overflow
The rsu driver currently relies on a `KASSERT` to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without `INVARIANTS`, an oversized raw 802.11 frame can reach
`m_copydata()` and overwrite past that buffer, causing local kernel memory
corruption.
This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return `EMSGSIZE`, leaving the existing
caller cleanup paths responsible for freeing `m0`, `ni`, and the unused
transfer buffer.
Reachable via root / bpf access
Reviewed by: bz, adrian
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58898
(cherry picked from commit 81a67bfebc60055bbf19ce6e39537fb5f53eeee5)
amd64: Mark the trapframe as initialized in ipi_bitmap_handler()
Fixes: fdc1f3450634 ("x86: change signatures of ipi_{bitmap,swi}_handler() to take pointer")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b566e0a7232b4989e79df95c2f02bdedef3ac4e7)
tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts
37bd69d43c7 gave stdckdint.h two new includes, <sys/_visible.h> and
<sys/ckdint.h>. Neither reaches a non-FreeBSD host: _visible.h is
staged only under ${.MAKE.OS} == "FreeBSD" and ckdint.h is not staged at
all, so the libc bootstrap fails on reallocarray.o when cross-building
from macOS. Both headers are self-contained; stage them alongside
stdckdint.h.
Fixes: 37bd69d43c7 ("sys: Add sys/ckdint.h")
Reviewed by: rpaulo, markj
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58943
(cherry picked from commit 805c5004fa86e26486175cd3a0bb253dcb8ec7e0)
tools/build: Bring in stdckdint.h if needed
This is needed when bootstrapping libc, reallocarray.c and
recallocarray.c include stdckdint.h now.
Reviewed by: emaste
Fixes: 7233893e9496 ("lib{c,openbsd}: use ckd_mul() for overflow checking in re(c)allocarray")
Differential Revision: https://reviews.freebsd.org/D52932
(cherry picked from commit 687cb66411c7bc220ccb90cedc2f7486567d55b6)
devstat: Fix a kernel stack disclosure
The 16-byte "device_name" field was not zero-filled, so could contain
uninitialized stack data. Zero the whole struct, as that's the
prevailing pattern for this kind of conversion code, and it's more
robust in the face of future revisions to struct devstat.
Reviewed by: olce, kib
Reported by: Reo Shiseki
Fixes: a11d132f6c62 ("devstat: Provide 32-bit compatibility")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59309
(cherry picked from commit 7cb1a76f88158fb690418336b736e66c238cd4f7)
iflib: Require sustained demand for TX watchdog
The restored watchdog arms when the outstanding descriptor count
grows, but then continues counting based only on the queue remaining
frozen. A single growth sample can therefore leave a quiet, nearly
empty queue armed until the watchdog resets the interface. Lockless
sampling of the queue counters can also manufacture the initial growth
sample.
This matches watchdog reports from I354 queues with 979 or 980 of
1022 usable descriptors still available. Neither queue was under
transmit backpressure when the reset flapped its link.
Keep the watchdog armed only while the outstanding count continues
to grow, the software ring is stalled, or the hardware ring is at
iflib's backpressure threshold. The last condition preserves hang
detection with simple-TX, which bypasses the software ring. A busy hang
still reaches the verdict while a frozen but quiet tail disarms. Retain
the final driver completion peek so a missed completion interrupt
[14 lines not shown]
vmimage.subr: Use makefs -N
By default, makefs uses the host environment's user and group databases
when creating filesystems. This causes makefs to fail when trying to
create files owned by users or groups which don't exist in the host
environment, for example when creating a VM with packages pre-installed
which added their own users/groups.
Pass "-N ${DESTDIR}/etc" to makefs to point it at the user and group
databases from the image being created.
MFC after: 1 week
Sponsored by: Amazon
oci: Install FreeBSD-pam in the runtime image
In 16.0/15.1, the PAM modules were split from FreeBSD-runtime into a
new FreeBSD-pam package. FreeBSD-runtime does not install FreeBSD-pam,
which means if a user starts from runtime, then installs sshd, sshd will
fail to authenticate users because of missing PAM modules.
Since FreeBSD-pam is relatively small (about 230kB on amd64), and is
already part of FreeBSD-set-minimal, add it to the runtime image as
well. Users who absolutely don't want this can still build their
own images without it.
MFC after: 1 week
Reviewed by: dfr
Reported by: Michael Johnson <ahze at ahze.net>
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59194
syslogd: reap pipe children on config reload
On SIGHUP reload, closelogfiles() frees each F_PIPE filed even when its
pipe process is still running. close_filed() sets f_type to F_UNUSED
before the check, so the condition f_type != F_PIPE is always true and
the filed is freed while its process descriptor is still on the dead
queue and registered in the kqueue. When the child later exits, the
NOTE_EXIT handler dereferences the freed filed (use-after-free) and
never closes the process descriptor, leaving the pipe child as a
persistent zombie.
Capture whether the filed is a pipe with an active process descriptor
before calling close_filed(), and defer the free in that case so the
NOTE_EXIT handler can reap the child and free the filed.
Reviewed by: markj
Fixes: 95381c0139d6 (syslogd: Use process descriptors)
Differential Revision: https://reviews.freebsd.org/D59319
