nvme: Fix default is_storage_device kobj method
makeobjops.awk only accepts an uppercase DEFAULT before a default kobj
method. This commit fixes a typo introduced in 949804c81909 so non-PCI
drivers actually use nvme_is_storage_device_default instead of
kobj_error_method. Note that even though kobj_error_method returns
ENXIO (6), it does not get implicitly cast to a bool due to the function
pointer casting in the nvme_if.h generated by makeobjops. Instead the
codegen for the NVME_IS_STORAGE_DEVICE callsite shows that only the
lowest bit is being checked as if it were always a bool. Without this
any nvme driver that doesn't implement is_storage_device is not treated
as a storage device.
Reviewed by: imp, kevans
Differential Revision: https://reviews.freebsd.org/D60112
netipsec: Fix V_spd_size updates
key_unregister_ifnet() was erroneously decrementing the size of the
global security policy database, V_sptree, but it doesn't modify that
database. V_sptree_ifnet is for policies attached to if_ipsec
interfaces. Note also that key_register_ifnet() was not incrementing
the counter.
Move the definition of V_spd_size up to the rest of the SPD definitions.
Its inclusion among the SPD cache definitions was confusing to me.
Reviewed by: ae
Reported by: Stephan de Wit and Cedrik Pischem from OPNsense
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60418
(cherry picked from commit 6b1d5fec57f9604a447864ec5e66940126b38df4)
gve: fix kernel panic on attach failure
When device initialization fails during attach (for instance, if device
resource configuration or firmware negotiation fails), the driver aborts
and unrolls partial state via its detach routine. However, the teardown
path assumes transmit and receive queues have already been created. If
attach aborts before queue allocation, tearing down the uninitialized
queues triggers a NULL pointer dereference and panics the kernel during
boot.
Guard queue teardown against uninitialized queue state so that early
attach failures unwind safely, allowing the driver to report the failure
gracefully without crashing the operating system.
Signed-off-by: Jasper Tran O'Leary <jtranoleary at google.com>
Reviewed by: adrian, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60385
[2 lines not shown]
amd64/vmm: Don't advertise support for performance counters
vmm doesn't implement them, and after commit 2272fac218a8
("hwpmc: Add support for AMD-only IRPERF in hwpmc PERF class"), FreeBSD
guests fail to boot since they access the unimplemented IRPERF MSR.
MFC after: 1 week
(cherry picked from commit c83e075d72f62c91cb27dd644a62d6a6f5bd56ba)
gve: fix double free on ring allocation failure
When gve_alloc_rings fails (such as when failing to acquire MSI-X
vectors or during partial ring allocation), ring cleanup can be
executed multiple times across nested error paths (e.g. within
gve_alloc_rings abort and gve_attach abort).
Because gve_free_counters invoked counter_u64_free without nullifying
the pointer in the stats array, repeated invocation caused a double-free
panic when freeing the same counter references.
Check for non-NULL before freeing and nullify each counter pointer
upon release in gve_free_counters.
Signed-off-by: Jasper Tran O'Leary <jtranoleary at google.com>
Reviewed by: adrian, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60386
[2 lines not shown]
epair: Make vnet_epair_uninit() run earlier
I can't see a reason for vnet_epair_init() and vnet_epair_uninit() to be
inconsistent in the sys(un)init run order. Move vnet_epair_uninit() to
SI_SUB_PSEUDO, which is more appropriate for software ifnet drivers.
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60388
(cherry picked from commit 5c20c75b67e3c96d58c1bbfe82472a8371bfa161)
sysctl: Return ECAPMODE when trying to access sysctls in capability mode
We have always returned EPERM in this case, but it's incorrect, we
should return ECAPMODE for capability mode violations. Fix the errno
value.
Reviewed by: emaste
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59887
(cherry picked from commit a76e986470f86731dd3a5f9eeae1ba28b8b160fb)
dtrace/arm64: Fix copyout and copyoutstr
Calling dtrace_copy and dtrace_copystr with the kaddr and uaddr
arguments inversed does not work with PAN. Rename them
dtrace_copyin_pan and dtrace_copyinstr_pan, respectively, and
implement dtrace_copyout_pan and dtrace_copyoutstr_pan.
Avoid excessive faulting by checkin DTrace's CPU flags. Implement the
trick from OpenSolaris/Illumos of only checking the flags when
crossing into a new page, altough more effectively by examining the
vaddr instead of the count.
Reviewed by: markj
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D59449
(cherry picked from commit a6deeaa2fb3b28a61ae56a85f2275f67fcf23262)
icmp: Limit routing table updates to the FIB of the redirect
When we receive an ICMP redirect, rib_add_redirect() is used to apply
the redirect to all FIBs. This has been the case since support for
multiple FIBs was added. However, it seems rather dubious: the new
gateway might not be routable from all FIBs, and the validation done for
v4 redirects in icmp_verify_redirect_gateway() is only applied to the
FIB from which the redirect originated.
Modify the handler to apply the redirect only in the originating FIB.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Reviewed by: pouria, zlei, glebius, melifaro
MFC after: 3 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59567
(cherry picked from commit 01a95394abfdef2adb3216e74d88b9c33321260e)
inotify.2: Add some entries to the BUGS section
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit fa6fe034a73c8b17320d1e68767ad2aa99eaa8bf)
tcp: Preserve borrowed ICMPv6 error mbufs
The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned
by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP
header even though that API frees the complete chain when the requested
range is unavailable. The callback could then return without
propagating the lost ownership, leaving raw ICMP delivery to read and
free a stale head.
Validate that the complete UDP header was quoted, copy it through the
chain with m_copydata(), and temporarily advance the parser offset
instead of consuming bytes from the caller-owned packet.
A remote sender can reach the old path when TCP UDP tunneling is enabled
by quoting the configured local UDP source port in an ICMPv6 error and
including only four through seven UDP-header bytes.
Signed-off-by: Andrew Griffiths <andrew at calif.io>
[5 lines not shown]
ssp: Make the panic string more accurate
"stack overflow detected" sounds like the thread faulted because it
ran out of stack space.
Reported by: Andrew <xxx.sys at protonmail.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 0f4b7d28ccb5c8edd0e4aad8135a4356f8a31961)
bhyve: Validate VirtIO queue guest addresses
paddr_guest2host() returns NULL when a range does not fit within guest
RAM. An unmappable queue address previously left the queue marked
allocated with ring pointers computed from the failed mapping. Check
the legacy virtqueue ring mapping before updating the queue state, and
ignore an unmappable PFN write after printing a diagnostic. This leaves
an unallocated queue unallocated and preserves an existing queue's PFN,
ring pointers, flags, and indices.
Also check the indirect descriptor table mapping before dereferencing
it, returning an error if the table is unmappable, and ignore guest
queue notifications for unallocated queues.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59904
(cherry picked from commit 4485bfaed2145e88911bd3522d6fee5c0f8ceb39)
bhyve: Defer virtio-console PORT_NAME until the guest is ready
pci_vtcon_announce_port() sends VIRTIO_CONSOLE_PORT_NAME immediately
after VIRTIO_CONSOLE_DEVICE_ADD, without waiting for the guest to
initialize the port. The Windows virtio-serial driver ignores the
name if the port is not yet available, which can prevent the QEMU
guest agent from finding org.qemu.guest_agent.0.
Send the name after the guest reports successful port initialization
with VIRTIO_CONSOLE_PORT_READY, as QEMU does.
While here, validate the guest-supplied port ID before forming a
pointer into vsc_ports[].
This ports the PORT_NAME ordering fix from illumos change 18082.
Obtained from: illumos 643ee887be44404b690eeaff14f20a27ad3c715c
Reviewed by: markj
MFC after: 2 weeks
[3 lines not shown]
vmm: Suspend the VM on a hardware triple fault
The VMX backend did not handle EXIT_REASON_TRIPLE_FAULT, so a hardware
triple fault fell through as an unhandled exit: bhyve printed a raw VMX
exit dump and aborted, instead of suspending the VM with the
reason the software exception path already uses.
Add the missing case so the VM suspends with VM_SUSPEND_TRIPLEFAULT and
bhyve exits with BHYVE_EXIT_TRIPLEFAULT. This matches illumos change 14664.
Obtained from: illumos 83b49c54d9c0766e810b6c8ff849dfb6693fc68a
Reviewed by: bnovkov, markj
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59840
(cherry picked from commit 873508de1eb6ee3e73a92a25dc769baffd3d3f64)
vm_swapout: Restore handling of RLIMIT_RSS
In commit 13a1129d700c, I removed the mechanism by which the pagedaemon
signals the swapout thread when page reclamation is unable to keep up
with demand. This is because the swapout thread's main action in this
case is to swap out sleeping processes, but we removed this support.
However, it had the secondary effect of causing the swapout thread to
enforce RLIMIT_RSS when racct is not enabled. Without it, if
racct_enabled is false, nothing ever kicks the swapout thread.
Restore the old behaviour of trying to enforce RLIMIT_RSS when the page
daemon is unable to keep up with demand. I'm not at all convinced this
is a good way to implement the limit, but the change wasn't intentional,
so let's restore it for now.
Fixes: 13a1129d700c ("vm: Remove kernel stack swapping support, part 1")
Reviewed by: olce, kib
MFC after: 2 weeks
[3 lines not shown]
netinet6: Fix the OSIOCAIFADDR_IN6 handler
We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
struct in6_aliasreq: the latter is larger. In particular, the store to
ifra->ifra_vhid is out of bounds.
Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
simply use a struct in6_ifaliasreq on the stack.
Reported by: Andrew <xxx.sys at protonmail.com>
Reviewed by: pouria
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60184
(cherry picked from commit c109a681456d03fc0737ca83487995e28b759e3b)
devfs: Explicitly disable inotify
In principle, inotify can be used to leak timing information about I/O
device accesses by privileged process, which might be sensitive, e.g.,
in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing
In practice this does not work since I/O to devfs nodes does not go
through vnodes, so the INOTIFY() calls in various VOP hooks do not fire.
But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no
one tries to "fix" this bug.
Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify().
However, maybe someday it'll be desirable to enable inotify for specific
device files, in which case the filtering should live in devfs.
Add a regression test.
Reported by: Sudheendra Raghav Neela <sneela at tugraz.at>
Reviewed by: kib
[5 lines not shown]
jail: Fix a race in prison_deref()
If we're killing a jail which has some user refs pending, then we would
first drop our ref and then kill all processes in the prison. However,
it's possible for the prison to be freed before we finish that
operation, generally if the processes exit on their own before
prison_proc_iterate() returns.
Thus, defer the release of the prison refcount until after we've killed
all procs.
Reviewed by: jamie
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59984
(cherry picked from commit 79af745f4c29ab3df037fcf0a4b4fb1ea393825f)
tcp: Create fewer per-VNET zones
We have a problem in UMA where creating new zones requires a traversal
of all existing zones (in order to find a unique name for the vm.uma
sysctl subtree). This means that per-VNET UMA zones can be expensive to
create if one creates many VNET jails in a row. This itself is a
problem, but I don't see a quick solution.
Ideally we would avoid creating per-VNET zones in the first place
(except when the desire to impose per-VNET limits necessitates this),
and it turns out that the TCP fastopen and SACK code create several of
these for no apparent reason.
So: make fastopen and SACK zones global. Move some fastopen structure
definitions into tcp_fastopen.c, as they don't need to be public.
Reported by: bapt ("creating many VNET jails in a row is slow")
Reviewed by: tuexen, glebius
MFC after: 3 weeks
[3 lines not shown]
vmm: Normalize a zero PIT count before starting channel 0
pit_timer_start_cntr0() does not schedule a callout when the initial
count is zero. The counter write handler normalizes a programmed zero
count only after calling it, leaving an initially unarmed channel 0
without a scheduled timer event.
Move the existing normalization before the timer-start call. Retain the
historical 0xffff representation of a zero count.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59749
(cherry picked from commit 3330226fd33ae6b747c9edc97315244360ad5e54)
lockf: Truncate the active lock list earlier in lf_purgelocks()
Otherwise vfs_report_lockf() can race with lf_purgelocks() while the
latter is freeing active lock entries without any locks held.
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59768
(cherry picked from commit e20ed58d265cd6eba9b28efc8e8956324937d4c3)
jail: Simplify refcount manipulation routines
- refcount_acquire() returns the old value, use that to assert that the
old value was non-zero.
- refcount_release() already asserts that the refcount value is
non-zero, so don't bother asserting that again in the jail code.
- Use __diagused instead of having separate implementations for
INVARIANTS and !INVARIANTS.
No functional change intended.
Reviewed by: jamie
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59983
(cherry picked from commit de6ee1fde8bbcc3dde643ae9f2122c8e2499fe29)
igmp: Refresh the ip header pointer after m_pullup()
There is a chance that the m_pullup() call immediately above invalidated
the "ip" pointer, so refresh it as we do with the IGMP header.
Otherwise the test in igmp_input_v3_query() for whether the packet is an
IGMPv3 general query might use a pointer to a freed mbuf.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit dc47a6940d60d393b3d36ba0fc5cb84d06fafaea)
vmm: Re-arm the PIT callout for square wave mode
The 8254's square wave mode (mode 3) is periodic, with the same
interrupt rate as the rate generator mode (mode 2), but
vatpit_callout_handler() only re-arms the channel 0 callout for
TIMER_RATEGEN. A guest that programs mode 3 therefore receives a
single IRQ0 and no further timer interrupts.
Re-arm the callout for TIMER_SQWAVE as well, matching illumos
change 13301.
Reviewed by: markj
Obtained from: illumos 93d78aba5b32996fc2ae893a6237a0d3972f86b2
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59816
(cherry picked from commit fc44154841fc2ebb1530a10cad719edb58559a88)
vmm: Synchronize long-mode state when emulating CR0 writes
vmx_emulate_cr0_access() sets EFER.LMA and the IA-32e guest VM-entry
control when enabling paging with EFER.LME set, but does not clear them
when disabling paging. This can leave an inconsistent guest state that
fails VM entry.
Update both fields in either direction based on EFER.LME and the CR0
value written to the VMCS. Use the mask-adjusted CR0 value so the
resulting state remains consistent with the VMX fixed-bit requirements.
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59756
(cherry picked from commit d400b1ca31fd9b12655c83f9a7b3e8cdb68646dd)
