usb: preserve error when doing request
Currently, USB request not distinguished different error and always return EIO.
However, some error are recoverable or ignorable in userspace.
Therefore, we preserve the meaning of different error to userspace then
allow userspace to decide how to use the return error.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52244
ietp: guard iicbus_get_addr with devclass check
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58432
xhci: Refactor xhci_generic_setup code
Our USB TRB buildup subroutines were previously difficult to follow. In
setup_generic_chain_sub(), the routine filled TRB packets based on the
characteristics passed by the caller and the current state (for example,
whether the TRB was the last in the TD).
However, most TRB types (except Normal TRBs) cannot be shared across TDs.
To simplify the logic, refactor xhci_setup_generic() so that TRBs are
constructed according to their transfer type, with dedicated helper
functions for each TRB type.
Sponsored by: The FreeBSD Foundation
Assisted-by: Claude Code (Opus 4.6, Opus 4.8(1M) and Sonet 5.0)
Differential Revision: https://reviews.freebsd.org/D57130
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
linux_firmware: reformat error print-out
This makes it easier to grep for the error message to better understand
the call stack when loading firmware modules fails.
Fix a cosmetic-only style(9) bug while here in the same function related
to another logging message.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58380
uma: Enqueue full buckets in FIFO order when KASAN is configured
We want to defer reuse of free objects, and this is a trivial way to
promote that.
Suggested by: rlibby
Reviewed by: rlibby, alc
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58312
uma: Avoid allocating from free buckets when KASAN is enabled
When uma_zalloc_arg() hits an empty alloc bucket in the per-CPU cache,
it tries swapping the alloc and free buckets in the hope that the free
bucket has some items available. If not, it has to lock the zone.
Disable this behaviour when KASAN is configured in order to further
defer reuse of freed items. This forces a free item to go to the
per-domain full bucket cache before it becomes accessible to the
allocator.
Reviewed by: rlibby
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58270
uma: Make an effort to defer reuse of items when KASAN is enabled
When KASAN is configured, make uma_zfree_arg() free items to the per-CPU
free bucket, rather than to the alloc bucket. This means that the item
won't be recycled immediately the next time a thread goes to allocate an
item from that zone on the same CPU. In other words, the item will stay
in a quarantine state longer, which helps make KASAN's use-after-free
detection more reliable.
Reviewed by: rlibby
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58269
uma: Factor out the implementations of uma_zfree_{arg,smr}()
The two function both free an item to a UMA zone, but uma_zfree_arg()
does so in such as way as to ensure that the item will be the first one
returned by a subsequent allocation, while uma_zfree_smr() must defer
reuse of the item and therefore never frees to the per-CPU alloc bucket.
When KASAN is enabled, we actually want uma_zfree_arg() to behave like
uma_zfree_smr(): to improve the reliability of use-after-free detection,
reuse of the newly freed item should be deferred for some time.
Refactor a bit to make it easier to improve KASAN along these lines:
introduce two helper functions, cache_free_item() and cache_free_smr(),
which handle most of the work of interacting with the per-CPU caches.
A subsequent commit will let uma_zfree_arg() use cache_free_smr() when
KASAN is enabled.
No functional change intended.
[4 lines not shown]
git-mfc: Improve handling of remotes
If we can't figure out which remote to use, print a useful error instead
of assuming that "freebsd" is the right remote to use.
kqueue: Allocate marker knotes on the stack
The scan marker was originally stack-allocated. In commit
1c0f9af5b5224, it became heap-allocated since the marker is visible to
other threads and a scanning thread's stack may be swapped out. Now
that kernel stacks can no longer be swapped out, we can avoid these heap
allocations.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58402
procdesc: Remove dead code
As far as I can see, it is impossible for procdesc_exit() to observe
pd->pd_fpcount == 0: if procdesc_close() decrements that counter to
zero, then it will clean up the procdesc structure too, and this is
atomic with respect to the proctree lock.
No functional change intended.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58396
unix: Preserve FD_RESOLVE_BENEATH when passing an fd
The FD_RESOLVE_BENEATH flag is supposed to be sticky. It's set when you
receive an fd from a different jail and preserved by openat(<dfd>) etc..
However, if you send the fd to yourself, the flag is stripped since
SCM_RIGHTS message don't preserve file descriptor flags.
Fix this by preserving those flags and checking for UF_RESOLVE_BENEATH
in restrict_rights().
Fixes: 350ba9672a7f ("unix: Set O_RESOLVE_BENEATH on fds transferred between jails")
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58317
netinet6/nd6: Sprinkle missing prefix refcounting
When we drop the prefix lock to call nd6_prefix_offlink() or
nd6_prefix_onlink(), make sure to keep the correpsonding prefix
structure alive. It is possible for a concurrent nd6_timer() to expire
the prefix while the lock is dropped.
Reported by: Maik Muench of Secfault Security
Reviewed by: pouria, zlei
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58423
kthread: Fix a thread leak
Fixes: 963629923308 ("kthread_add(): do not allow to attach the thread to a dead or dying process")
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58433
LinuxKPI: page pool updates and add to the build
Split implementation out from the header files.
This "page pool" is the very minimalistic version we need in order to
support packets on mt76.
We allocate the page pool in order to have the meta data available of
which we only make limited use.
This implementation does no pooling, it does no page fragments for now,
it always hands out a full page and frees it upon return.
It is written in a way that it can be in the tree before the 'struct page'
work it depends on has landed in order to reduce friction for people who
want to try mt7921 (or others later) upfront. We use the same #ifdef
as in the struct page work for that reason so one knob will turn everything
on or off.
Once the struct page work has landed and settled we can start filling this
with more complexity.
[8 lines not shown]
LinuxKPI: page.h: resort lines
Two of the "page macros" can be abstracted elsewhere in the upcoming
struct page work, so sort them away from the four which are here to
stay.
No functional change.
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D58299
LinuxKPI: page.h: use atop() and ptoa() instead of PAGE_SHIFT
With upcoming changes to 'struct page' this will make the lines
easier to read by using the predefined macros from param.h.
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D58298
LinuxKPI: prefer struct page [*] over struct vm_page[_t]
LinuxKPI is based on Linux 'struct page' which is currently aliased
to struct vm_page. Upcoming changes may change that so start using
'struct page *' instead vm_page_t to make future changes transparent.
This is a continuation of 9e9c682ff3a1 and should be a NOP.
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reviewed by: emaste (no objections)
Differential Revision: https://reviews.freebsd.org/D58297
LinuxKPI: move clear_page() within the linux/page.h file
clear_page() would normally live in asm/page.h but adding the file
and fixing the dependencies would be too much for a single line.
Move the function to the end of the file with a clear separator
and make it clear that it does not operate on a 'struct page'
but on a page address by changing the argument name and leaving
a comment.
The function is currently used by at least mthca(4) as the only
in-tree consumer, and drm-kmod ttm_pool.c.
No functional changes.
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D58296
LinuxKPI: pci: fix dma handle type in match function
dma_addr_t is a vm_paddr_t which is a uint of some width. Rather than
passing pointers of it around pass the value.
Comparing the addresses of different storage for the same dma handle
(the actual bug here) will not work when passed to the devres match
function.
Sponsored by: The FreeBSD Foundation
Fixes: 0a575891211ef ("implement dmam_free_coherent()")
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D58285
