Sync with head: When copying out the kld_stat structure to userland, only
copy out the size of the user's buffer. In the case of a program using
the older (smaller) structure, the previous code would trash memory after
the end of the user's kld_stat struct. This was missed in the DTrace
MFC.
Submitted by: Jaakko Heinonen jh saunalahti.fi
Approved by: re (kib)
MFC r183383:
Save previous content of the td_fpop before storing the current
filedescriptor into it. Make sure that td_fpop is NULL when calling
d_mmap from dev_pager_getpages().
When an inpcb doesn't have a socket but the inpcb is passed to ipfw
in the transmit path, such as TCPS_TIMEWAIT, fail the credential
extraction immediately rather than acquiring locks and looking up
the inpcb on the global lists in order to reach the conclusion that
the credential extraction has failed.
This is more efficient, but more importantly, it avoids lock
recursion on the inpcbinfo, which is no longer allowed with rwlocks.
This appears to have been responsible for at least two reported
panics.
Rather than shadowing global variable 'lookup' in check_uidgid(), rename
it to ugid_lookupp. This should make debugging issues with ipfw uid
rules easier.
As a follow-on to r183323, correct another case where ip_output() was
called without an inpcb pointer despite holding the tcbinfo global
lock, which lead to a deadlock or panic when ipfw tried to further
acquire it recursively.
Reported by: Stefan Ehmann <shoesoft at gmx dot net>
When dropping a packet and issuing a reset during TCP segment handling,
unconditionally drop the tcbinfo lock (after all, we assert it lines
before), but call tcp_dropwithreset() under both inpcb and inpcbinfo
locks only if we pass in an tcpcb. Otherwise, if the pointer is NULL,
firewall code may later recurse the global tcbinfo lock trying to look
up an inpcb.
This is an instance where a layering violation leads not only
potentially to code reentrace and recursion, but also to lock
recursion, and was revealed by the conversion to rwlocks because
acquiring a read lock on an rwlock already held with a write lock is
forbidden. When these locks were mutexes, they simply recursed.
Reported by: Stefan Ehmann <shoesoft at gmx dot net>
MFC r183264:
Add workaround for occasional packet loss issue of JMC250 A2
when it runs on half-duplex media.
While I'm here add register definition for GPREG1. ATM the GPREG1
register is only valid for JMC250 A1/A2.
MFC: 178280
- Clean up the code that checks the types of address so that it is
done by understandable macros.
- Fix the bug that prevented the system from responding on interfaces with
link local addresses assigned.
MFC:
Lockf was exiting with status 1 if the command did not exit normally.
This is easy to confuse with the actual exit status of the program.
Instead exit with EX_SOFTWARE if the command doesn't exit normally.
MFC: 176526,176596
- Correct a long-standing error in vm_object_deallocate(). Specifically,
only anonymous default (OBJT_DEFAULT) and swap (OBJT_SWAP) objects should
ever have OBJ_ONEMAPPING set. However, vm_object_deallocate() was
setting it on device (OBJT_DEVICE) objects. As a result,
vm_object_page_remove() could be called on a device object and if that
occurred pmap_remove_all() would be called on the device object's pages.
However, a device object's pages are fictitious, and fictitious pages do
not have an initialized pv list (struct md_page).
- Correct a long-standing error in vm_object_page_remove(). Specifically,
pmap_remove_all() must not be called on fictitious pages. To date,
fictitious pages have been allocated from zeroed memory, effectively
hiding this problem because the fictitious pages appear to have an empty
pv list.
- Rewrite the comments describing vm_object_page_remove() to better
describe what it does. Add an assertion.
When invoking the udp_send() from udp6_send() due to use of a v6-mapped
IPv4 address, first drop the udbinfo and inpcb locks, which will otherwise
be recursed. This leads to a potential minor race, but is preferable to a
deadlock when acquiring a read lock after a write lock on the inpcb.
MFC after: 3 days
Reported by: Norbert Papke <fbsd-ml@scrapper.ca>, lioux
Approved by: re (kib)
Tested by: Norbert Papke <fbsd-ml@scrapper.ca>, lioux
MFC r182961:
When doing rfork(0), i.e. separating curproc VM from any other user of
the same vmspace, decrement the reference count of the shared LDT instead
of a newly-made copy. Code factually removed LDT from the process that
did rfork(0).
Introduce user_ldt_deref() function that does decrement of refcount for
the struct proc_ldt, and call it in the rfork(0) case on the shared LDT.
MFC r182960 (with XEN-related chunks removed):
The user_ldt_alloc() function shall return with dt_lock locked.
The user_ldt_free() function shall return with dt_lock unlocked.
Error handling code in both functions do not handle this, fix it by
doing necessary lock/unlock.
MFC r182959:
Remove warning about static LDT segment allocation. Applications
continue using it after ~7 years since warning was introduced, and there
is no reason to discourage them.
MFC: 179296
To date, our implementation of munmap(2) has required that the
entirety of the specified range be mapped. Specifically, it has
returned EINVAL if the entire range is not mapped. There is not,
however, any basis for this in either SuSv2 or our own man page.
Moreover, neither Linux nor Solaris impose this requirement. This
revision removes this requirement.
MFC: 179623
Essentially, neither madvise(..., MADV_DONTNEED) nor madvise(..., MADV_FREE)
work. (Moreover, I don't believe that they have ever worked as intended.)
The explanation is fairly simple. Both MADV_DONTNEED and MADV_FREE perform
vm_page_dontneed() on each page within the range given to madvise(). This
function moves the page to the inactive queue. Specifically, if the page is
clean, it is moved to the head of the inactive queue where it is first in
line for processing by the page daemon. On the other hand, if it is dirty,
it is placed at the tail. Let's further examine the case in which the page
is clean. Recall that the page is at the head of the line for processing by
the page daemon. The expectation of vm_page_dontneed()'s author was that
the page would be transferred from the inactive queue to the cache queue by
the page daemon. (Once the page is in the cache queue, it is, in effect,
free, that is, it can be reallocated to a new vm object by vm_page_alloc()
if it isn't reactivated quickly enough by a user of the old vm object.) The
trouble is that nowhere in the execution of either MADV_DONTNEED or
MADV_FREE is either the machine-independent reference flag (PG_REFERENCED)
or the reference bit in any page table entry (PTE) mapping the page cleared.
Consequently, the immediate reaction of the page daemon is to reactivate the
page because it is referenced. In effect, the madvise() was for naught.
The case in which the page was dirty is not too different. Instead of being
laundered, the page is reactivated.
Note: The essential difference between MADV_DONTNEED and MADV_FREE is
that MADV_FREE clears a page's dirty field. So, MADV_FREE is always
executing the clean case above.
This revision changes vm_page_dontneed() to clear both the machine-
independent reference flag (PG_REFERENCED) and the reference bit in all PTEs
mapping the page.
MFC r180607 (by jeff):
Check whether we've recorded this tick in ts_ticks on another cpu in
sched_tick() to prevent multiple increments for one tick. This pushes
the value out of range and breaks priority calculation.
MFH: 182818, 182823, 182825, 183012 - IPFW_DEFAULT_RULE related fixes.
New Revision: 182818
URL: http://svn.freebsd.org/changeset/base/182818
Log:
Export the IPFW_DEFAULT_RULE outside ip_fw2.c. This number in not only
the default rule number but also the maximum rule number. User space
software such as ipfw and natd should be aware of its value. The
software that already includes ip_fw.h should use the defined value. All
other a expected to use sysctl (as discussed on net@).
Merge r182892 from head to stable/7, I had to manually
change the code to include "thread" argument to the vn_lock()
which got removed in HEAD:
Getdents requires padding with 2 bytes instead of 1 byte
as with getdents64. The last byte is used for storing
the d_type, add this to plain getdents case where it was
missing before. Also change the code to use strlcpy instead
of plain strcpy. This changes fix the getdents crash we
had reports about (hl2 server etc.)
MFC r182193:
Implement WNOWAIT flag for wait4(2). It specifies that process whose status
is returned shall be kept in the waitable state.
Add WSTOPPED as an alias for WUNTRACED.
MFC r182424 (by davidxu):
Don't remove queued SIGCHLD if options contain WNOWAIT, so other
threads still can be notified by the signal.
Remove the alignment of the align parameter. This is up to the caller to pass
in and it breaks tap(4) on strict alignment machines as m_uiotombuf is called
with ETHER_ALIGN.
MFC: 180352
In FreeBSD 7.0 and beyond, pmap_growkernel() should pass VM_ALLOC_INTERRUPT
to vm_page_alloc() instead of VM_ALLOC_SYSTEM. VM_ALLOC_SYSTEM was the
logical choice before FreeBSD 7.0 because VM_ALLOC_INTERRUPT could not
reclaim a cached page. Simply put, there was no ordering between
VM_ALLOC_INTERRUPT and VM_ALLOC_SYSTEM as to which "dug deeper" into the
cache and free queues. Now, there is; VM_ALLOC_INTERRUPT dominates
VM_ALLOC_SYSTEM.
While I'm here, teach pmap_growkernel() to request a prezeroed page.
MFC: 174104
Improve get_pv_entry()'s handling of low-memory conditions. After page
allocation fails and pv entries are reclaimed, there may be an unused pv
entry in a pv chunk that survived the reclamation. However, previously,
after reclamation, get_pv_entry() did not look for an unused pv entry in
a surviving pv chunk; it simply retried the page allocation. Now, it
does look for an unused pv entry before retrying the page allocation.
Note: This only applies to RELENG_7. Earlier branches use a different
pv entry allocator.
MFC: Account for pv entry pages in the total number of wired pages.
(Note: pv entry pages have always been included in the total number of
wired pages on i386 just not amd64.)
MFC: 173901,173918
- Tidy up: Add comments. Eliminate the pointless
malloc_type_allocated(..., 0) calls that occur when contigmalloc() has
failed. Eliminate the acquisition and release of the page queues lock
from vm_page_release_contig(). Rename contigmalloc2() to
contigmapping(), reflecting what it does.
- Make contigmalloc(9)'s page laundering more robust. Specifically, use
vm_pageout_fallback_object_lock() in vm_contig_launder_page() to better
handle a lock-ordering problem. Consequently, trylock's failure on the
page's containing object no longer implies that the page cannot be
laundered.
MFC r182887-182888:
r182887:
Fix typo which resulted in invalid configuration for JMC260.
r182888:
Add workaround for CRC errors seen at 100Mbps on JMC250 A2.
While here update chip revision number of JMC250/JMC260 from the
latest datasheet.
MFC: Adjust the probe order further so that Host-PCI bridges are probed
in the same order that they used to be probed. Now we just give CPUs a
rediculously high order to ensure they are last.
Conditionalize setting udp6_usrreqs.pru_soreceive to soreceive_dgram
on #ifdef INET, as we don't define udp6_usrreqs when IPv6 isn't
compiled into the kernel.
Reported by: bf <bf2006a at yahoo dot com>,
Kovacs Robert <robi at datanet.hu>
Approved by: re (kib)
Merge r180198, r180211, r180365, r182682 from head to stable/7:
Add soreceive_dgram(9), an optimized socket receive function for use by
datagram-only protocols, such as UDP. This version removes use of
sblock(), which is not required due to an inability to interlace data
improperly with datagrams, as well as avoiding some of the larger loops
and state management that don't apply on datagram sockets.
This is experimental code, so hook it up only for UDPv4 for testing; if
there are problems we may need to revise it or turn it off by default,
but it offers *significant* performance improvements for threaded UDP
applications such as BIND9, nsd, and memcached using UDP.
Tested by: kris, ps
Update copyright date in light of soreceive_dgram(9).
Use soreceive_dgram() and sosend_dgram() with UDPv6, as we do with UDPv4.
Tested by: ps
Remove XXXRW in soreceive_dgram that proves unnecessary.
Remove unused orig_resid variable in soreceive_dgram.
Submitted by: alfred
Note: in the MFC, we do enable sosend_dgram for UDPv6 by default (it was
already used for UDPv4), but use of soreceive_dgram for both UDPv4 and
UDPv6 is controlled by a new loader tunable,
net.inet.udp.soreceive_dgram_enabled as soreceive_dgram has less testing
exposure than sosend_dgram. We may wish to change the default (and
eliminate the tunable) in 7.2.
MFC requested by: gnn, kris, ps
Approved by: re (kib)
MFC r182868:
The pcb_gs32p should be per-cpu, not per-thread pointer. This is
location in GDT where the segment descriptor from pcb_gs32sd is
copied, and the location is in GDT local to CPU.
MFC r182849:
Segment registers are stored in the uc_mcontext member of the struct
l_ucontext. To restore the registers content, trampoline needs to
dereference uc_mcontext instead of taking some undefined values from
l_ucontext.
marius [Sat, 13 Sep 2008 15:17:21 +0000 (15:17 +0000)]
MFC: r182688
Bypass isa_probe_children(9) and directly call bus_generic_attach(9)
in order to avoid the invasive probes done by identify-routines of
ISA drivers, which may access unassigned addresses or those of
unrelated devices and thus in turn can trigger master/target aborts
as revealed by r182108 and ahc(4). I think that this is also the
cause of the hang previously seen on B100 blades during boot.
Bypassing isa_probe_children(9) also avoids adding ISA hints, which
just can be wrong for sparc64.
Extend global UNIX domain socket rwlock coverage to include incrementing
and decrementing unp_rights, which may otherwise be corrupted. Be
slightly more conversative in where we read unp_rights.
This relates to one of the symptoms reported in the noted PR, but may not
correct the actual high system time problem. The reporter has confirmed
stability but not that the problem is eliminated. However, this is a
useful fix to a clear locking bug.
Note that this is not an MFC as the UNIX domain socket garbage collector
has been replaced in 8.x.
PR: 127024
Reported by: Anton Yuzhaninov <citrin at citrin dot ru>
Reviewed by: kib
Approved by: re (kib)
MFH r182857:
Apply updated patch from bin/92839 to avoid two possible buffer overflows.
PR: bin/92839
Submitted by: Helge Oldach <freebsdntpd@oldach.net>
Approved by: re (gnn)
MFC: Remove the never-enabled attempt at using device cloning to provide
per-file descriptor storage and replace it with cdevpriv (and enable it)
instead.
MFC: Fix a spin lock LOR when waking up a thread from a process that is
swapped out by deferring the wakeup of the swapper kernel process until
after releasing sleepq chain locks.
Work around an integer division resulting in 0 and thus the
congestion window not being incremented, if cwnd > maxseg^2.
As suggested in RFC2581 increment the cwnd by 1 in this case.
See http://caia.swin.edu.au/reports/080829A/CAIA-TR-080829A.pdf
for more details.
Submitted by: Alana Huebner, Lawrence Stewart,
Grenville Armitage (caia.swin.edu.au)
Reviewed by: dwmalone, gnn, rpaulo, silby
Approved by: re (gnn)
MFC: Several changes (181759-181762) to allow the "simple" and "client"
firewall configurations to be configured (interfaces and attached networks)
from rc.conf rather than requiring users to edit /etc/rc.firewall directly.
Revert r180140 for 6.4 and 7.1 where the bridge mac address is taken from the
first member, there were problems reported in edge cases and using pppoe.
Validate scratch memory addresses for BPF_STX and BPF_LDX|BPF_MEM.
A badly written filter was able to reference invalid addresses,
even cause kernel crash.
- r182172:
Embed scratch memory in the filter structure.
- r182173:
Fix a typo in copyrights.
- r182220:
Move empty filter handling to MI source.
- r182376:
Initialize scratch memory for JIT-compiled filter when it is allocated.
Previously it may have contained unnecessary (even sensitive) data from
the previous allocation.
As a (good) side effect, scratch memory may be used to store the previous
filter state(s) safely because it is allocated and freed with filter itself.
However, use it carefully because bpf_filter(9) does not have this behavior.
MFC r182600:
In rev. 1.17 (r33548) of msdosfs_fat.c, relative cluster numbers were
replaced by file relative sector numbers as the buffer block number
when zero-padding a file during extension. Revert the change, it causes
wrong blocks filled with zeroes on seeking beyond end of file.
projects / FreeBSD / FreeBSD.git / log