Rick Macklem [Wed, 22 Apr 2020 21:08:08 +0000 (21:08 +0000)]
MFC: r359720
Fix an interoperability issue w.r.t. the Linux client and the NFSv4 server.
Luoqi Chen reported a problem on freebsd-fs@ where a Linux NFSv4 client
was able to open and write to a file when the file's permissions were
not set to allow the owner write access.
Since NFS servers check file permissions on every write RPC, it is standard
practice to allow the owner of the file to do writes, regardless of
file permissions. This provides POSIX like behaviour, since POSIX only
checks permissions upon open(2).
The traditional way NFS clients handle this is to check access via the
Access operation/RPC and use that to determine if an open(2) on the
client is allowed.
It appears that, for NFSv4, the Linux client expects the NFSv4 Open (not a
POSIX open) operation to fail with NFSERR_ACCES if the file is not being
created and file permissions do not allow owner access, unlike NFSv3.
Since both the Linux and OpenSolaris NFSv4 servers seem to exhibit this
behaviour, this patch changes the FreeBSD NFSv4 server to do the same.
A sysctl called vfs.nfsd.v4openaccess can be set to 0 to return the
NFSv4 server to its previous behaviour.
Since both the Linux and FreeBSD NFSv4 clients seem to exhibit correct
behaviour with the access check for file owner in Open enabled, it is enabled
by default.
Alexander Motin [Tue, 21 Apr 2020 16:52:56 +0000 (16:52 +0000)]
MFC r348996 (by jtl):
The current IPMI KCS code is waiting 100us for all transitions (roughly
between each byte either sent or received). However, most transitions
actually complete in 2-3 microseconds.
By polling the status register with a delay of 4us with exponential
backoff, the performance of most IPMI operations is significantly
improved:
- A BMC update on a Supermicro x9 or x11 motherboard goes from ~1 hour
to ~6-8 minutes.
- An ipmitool sensor list time improves by a factor of 4.
Testing showed no significant improvements on a modern server by using
a lower delay.
The changes should also generally reduce the total amount of CPU or
I/O bandwidth used for a given IPMI operation.
Rick Macklem [Tue, 21 Apr 2020 04:47:42 +0000 (04:47 +0000)]
MFC: r359679
Fix noisy NFSv4 server printf.
Peter reported that his dmesg was getting cluttered with
nfsrv_cache_session: no session
messages when he rebooted his NFS server and they did not seem useful.
He was correct, in that these messages are "normal" and expected when
NFSv4.1 or NFSv4.2 are mounted and the server is rebooted.
This patch silences the printf() during the grace period after a reboot.
It also adds the client IP address to the printf(), so that the message
is more useful if/when it occurs. If this happens outside of the
server's grace period, it does indicate something is not working correctly.
Instead of adding yet another nd_XXX argument, the arguments for
nfsrv_cache_session() were simplified to take a "struct nfsrv_descript *".
I believe this was introduced in the original '-r' commit, r231911 (2012).
At the time, the scope was limited to a 1 second sleep. r332518 (2018)
added '-R', which increased the potential duration of the affected interval
(from 1 to N seconds) by permitting arbitrary restart intervals.
Instead, handle SIGTERM normally during restart-sleep, when the monitored
process is not running, and shut down promptly.
(I noticed this behavior when debugging a child process that exited quickly
under the 'daemon -r -R 30' environment. 'kill <daemonpid>' had no
immediate effect and the monitor process slept until the next restart
attempt. This was annoying.)
MFC r360040: jail(8): improve manual and usage information
with more clear description for "jail -e" mode
to show that it does not take additional jail name argument.
Reported by: David Marec <david.marec@davenulle.org>
Rick Macklem [Mon, 20 Apr 2020 01:17:00 +0000 (01:17 +0000)]
MFC: r359643
Change the xid for client side krpc over UDP to a global value.
Without this patch, the xid used for the client side krpc requests over
UDP was initialized for each "connection". A "connection" for UDP is
rather sketchy and for the kernel NLM a new one is created every 2minutes.
A problem with client side interoperability with a Netapp server for the NLM
was reported and it is believed to be caused by reuse of the same xid.
Although this was never completely diagnosed by the reporter, I could see
how the same xid might get reused, since it is initialized to a value
based on the TOD clock every two minutes.
I suspect initializing the value for every "connection" was inherited from
userland library code, where having a global xid was not practical.
However, implementing a global "xid" for the kernel rpc is straightforward
and will ensure that an xid value is not reused for a long time. This
patch does that and is hoped it will fix the Netapp interoperability
problem.
Untangle TPR shadowing and APIC virtualization.
This speeds up Windows guests tremendously.
The patch does:
Add a new tuneable 'hw.vmm.vmx.use_tpr_shadowing' to disable TLP shadowing.
Also add 'hw.vmm.vmx.cap.tpr_shadowing' to be able to query if TPR shadowing is used.
Detach the initialization of TPR shadowing from the initialization of APIC virtualization.
APIC virtualization still needs TPR shadowing, but not vice versa.
Any CPU that supports APIC virtualization should also support TPR shadowing.
When TPR shadowing is used, the APIC page of each vCPU is written to the VMCS_VIRTUAL_APIC field of the VMCS
so that the CPU can write directly to the page without intercept.
On vm exit, vlapic_update_ppr() is called to update the PPR.
Geänderte Pfade:
M /head/sys/amd64/vmm/intel/vmx.c M /head/sys/amd64/vmm/io/vlapic.c M
/head/sys/amd64/vmm/io/vlapic.h
MFC r348873: Enable touch and trackpads by default
Enable synaptics and elantech touchpads, as well as IBM/Lenovo TrackPoints
by default, instead of having users find and toggle a loader tunable.
This makes things like two finger scroll and other modern features work out
of the box with X. By enabling these settings by default, we get a better
desktop experience in X, since xserver and evdev can make use of the more
advanced synaptics and elantech features.
The geli(8) manual page has an example for preloading keyfiles during boot.
There is no detail though on how the lookup of these variables actually
works.
Let's document that the name of a device does not have to be a part
of the variable.
MFC r359428:
evdev: Add COMPAT_FREEBSD32 support for amd64 arch
Incompatibility between i386 and amd64 evdev ABIs was caused by presence of
'struct timeval' in evdev protocol. Replace it with 'struct timeval32' for
32 bit binaries.
Big-endian platforms may require additional work due to bitstr_t (array of
unsigned longs) usage in ioctl interface.
MFC r359429:
evdev: return error rather than zero-length data on blocked read()
if blocked process has been woken up by evdev device destruction.
MFC r359446:
Add support for multiple playback and recording devices per physical USB audio
device. This requires some structural refactoring inside the driver, mostly
about converting existing audio channel structures into arrays.
The main audio mixer is provided by the first PCM instance.
The non-first audio instances may only have a software mixer for PCM playback.
Tested by: Horse Ma <Shichun.Ma@dell.com>
Sponsored by: Mellanox Technologies
MFC r359355:
Improve USB audio mixer support for USB audio class 1 and 2.
- make sure volume controls are correctly mapped to "pcm" and "rec" depending
on how they deliver audio to the USB host.
- make sure there are no duplicate record selections.
- remove internal only mixer class type.
- don't add software volume controls for recording only.
- some minor mixer code cleanup.
Tested by: Horse Ma <Shichun.Ma@dell.com>
Sponsored by: Mellanox Technologies
MFC r359655:
Don't drop packets having too many TCP option headers in mlx5en(4).
When using SACK it can happen there are multiple option headers.
Don't drop these packets, but instead limit the amount of inlining
to the maximum supported.
David Bright [Sun, 12 Apr 2020 22:11:29 +0000 (22:11 +0000)]
MFC r359717:
Add a basic test for nvmecontrol
I recently made some bug fixes in nvmecontrol. It occurred to me that
since nvmecontrol lacks any kyua tests, I should convert the informal
testing I did into a more formal automated test. The test in this
change should be considered just a starting point; it is neither
complete nor thorough. While converting the test to ATF/kyua, I
discovered a small bug in nvmecontrol; the nvmecontrol devlist command
would always exit with an unsuccessful status. So I included the fix
for that, too, so that the test won't fail.
r359585:
Fix calculation of the recurring weekdays
Both the result of the first_dayofweek_of_year and the target
weekday are zero-based (0 fo sunday) while the target month-day
or year-day is 1-based. Adjust logic accordingly.
Also add testcase for this PR to the kyua test suite
PR: 201062
Submitted by: Richard Narron <comet.berkeley@gmail.com>
r359587:
Remove hardcoded US Election Day from calendar.usholiday
calendar(1) syntax is not capable of representing the rules for the
US Election Day. The hardcoded date was set in r15066 in 1996 and
hasn't changed since then.
PR: 173389
Reported by: Steve Ames <steve@energistic.com>
Simon J. Gerraty [Fri, 10 Apr 2020 05:13:15 +0000 (05:13 +0000)]
veloader use vectx API for kernel and modules
The vectx API, computes the hash for verifying a file as it is read.
This avoids the overhead of reading files twice - once to verify, then
again to load.
For doing an install via loader, avoiding the need to rewind
large files is critical.
This API is only used for modules, kernel and mdimage as these are the
biggest files read by the loader.
The reduction in boot time depends on how expensive the I/O is
on any given platform. On a fast VM we see 6% improvement.
For install via loader the first file to be verified is likely to be the
kernel, so some of the prep work (finding manifest etc) done by
verify_file() needs to be factored so it can be reused for
vectx_open().
For missing or unrecognized fingerprint entries, we fail
in vectx_open() unless verifying is disabled.
Otherwise fingerprint check happens in vectx_close() and
since this API is only used for files which must be verified
(VE_MUST) we panic if we get an incorrect hash.
MFC r359680: mail/gprof/tip: tap with the ugly stick
The ugly stick here is this bit in the respective headers:
#ifndef EXTERN
#define EXTERN extern
#endif
with a follow-up #define EXTERN in a single .c file to push all of their
definitions into one spot. A pass should be made over these three later to
push these definitions into the correct files instead, but this will suffice
for now and at a more leisurely pace.
MFC r359689: config(8): "fix" a couple of buffer overflows
Recently added/changed lines in various kernel configs have caused some
buffer overflows that went undetected. These were detected with a config
built using -fno-common as these line buffers smashed one of our arrays,
then further triaged with ASAN.
Double the sizes; this is really not a great fix, but addresses the
immediate need until someone rewrites config. While here, add some bounds
checking so that we don't need to detect this by random bus errors or other
weird failures.
MFC r359688: stand: -fno-common fixes for !x86 loaders
- beriloader: archsw is declared extern and defined elsewhere
- ofwloader: ofw_elf{,64} are defined in elf_freebsd.c and
ppc64_elf_freebsd.c respectively
- ubldr: syscall_ptr is defined in start.S for whichever ubldr platform is
building
-fno-common will become the default in GCC10/LLVM11.
Compiling with -fno-common complains as this header's included in multiple
compilation units. In fact, the proper definition of dwarf2_loc_mark_labels
already exists in dwarf2dbg.c, so simply mark this declaration with extern.
This removes an extra variable definition that causes the -fno-common build
to fail, which will be a new default in GCC10/LLVM11.
r359397:
zfs: fix -fno-common issues
A similar (or identical?) fix has already landed in OpenZFS.
-fno-common will become the default in GCC10/LLVM11.
r359398:
sh: remove duplicate el definition
el is declared extern in myhistedit.h and defined in histedit.c. Remove the
duplicate definition in input.c to appease the -fno-common build.
-fno-common will become the default in GCC10/LLVM11.
r359399:
telnet: remove some duplicate definitions, mark terminaltype extern
Most of these were already properly declared and defined elsewhere, this is
effectively just a minor cleanup that fixes the -fno-common build.
-fno-common will become the default in GCC10/LLVM11.
r359403:
Revert 359399: telnet -fno-common bits
There was a large misfire from my local diff that I need to investigate, and
this version committed did not build.
r359404:
Re-apply r359399: telnet -fno-common fix
line and auth_level's redefinitions are just extraneous
telnetd will #define extern and then include ext.h to allocate storage for
all of these extern'd vars; however, two of them are actually defined in
libtelnet instead. Instead of doing an #ifdef extern dance around those
function pointers, just add an EXTERN macro to make it easier to
differentiate by sight which ones will get allocated in globals.c and which
ones are defined elsewhere.
r359406:
telnet: kill off remaining duplicate definition
r359413:
ipfilter: remove duplicate definition of 'thishost'
thishost is already defined in lib/initparse.c; no need for this one. This
fixes the ipfilter build with -fno-common.
-fno-common will become the default in GCC10/LLVM11.
r359414:
iscontrol: move definition of vflag/iscsidev to iscontrol.c
Mark the declaration extern as these are used elsewhere; this fixes the
build with -fno-common.
r359415:
userboot: mark host_fsops as extern
This is already defined elsewhere; mark this declaration extern to the fix
the -fno-common build.
r359416:
systat: remove redundant definition of kd
kd is already properly declared in extern.h and defined in main.c, rendering
this definition useless. This fixes the -fno-common build.
r359424:
openssh: -fno-common fix from upstream f47d72ddad
This is currently staged in vendor/ as part of the 8.0p1 import, which isn't
quite ready to land. Given that this is a simple one-line fix, apply it now
as the fallout will be pretty minimal.
-fno-common will become the default in GCC10/LLVM11.
r359425:
locate: fix -fno-common build
Just a single variable declaration to extern and define elsewhere here,
myctype.
-fno-common will become a default in GCC10/LLVM11.
r359427:
fsck_ffs/fsdb: fix -fno-common build
This one is also a small list:
- 3x duplicate definition (ufs2_zino, returntosingle, nflag)
- 5x 'needs extern', 3/5 of which are referenced in fsdb
-fno-common will become the default in GCC10/LLVM11.
r359432:
gdb: compile with -fcommon explicitly
As described in the comment, gdb relies on some of the linker magic that
happens with -fcommon. I suspect the life expectancy of gdb-in-base is low
enough that this isn't worth spending much time addressing, especially given
the vintage. Hit it with the -fcommon hammer so that it continues to just
work.
r359433:
bmake: fix -fno-common build
debug was declared extern, but debug_file was not; correct this and define
debug_file in main.c (as debug is) to fix the -fno-common build.
-fno-common will become the default with GCC10/LLVM11.
r359443:
MFV r359442: bmake: import -fno-common fix build back from upstream
sjg@ committed the local patch previously committed upstream; pull it in to
vendor/ to ease any potential stress of future imports.
r359675:
kqueue tests: fix -fno-common build
vnode_fd and kqfd are both shared among multiple CU; define them exactly
once.
In the case of vnode_fd, it was simply the declaration that needed
correction.
-fno-common will become the default in GCC10/LLVM11.
r359676:
ntpd: fix build with -fno-common
Only a small nit here: psl should be declared extern and defined exactly
once.
-fno-common will become the default in GCC10/LLVM11.
r359677:
yp*: fix -fno-common build
This is mostly two problems spread out far and wide:
- ypldap_process should be declared properly
- debug is defined differently in many programs
For the latter, just extern it and define it everywhere that actually needs
it. This mostly works out nicely for ^/libexec/ypxfr, which can remove the
assignment at the beginning of main in favor of defining it properly.
-fno-common will become the default in GCC10/LLVM11.
r359678:
indent: fix the -fno-common build
Spread the globals far and wide, hopefully to the files that make the most
sense.
-fno-common will become the default in GCC10/LLVM11.
David Bright [Thu, 9 Apr 2020 18:17:07 +0000 (18:17 +0000)]
MFC r359562:
Fix various Coverity-detected errors in nvmecontrol
This fixes several Coverity-detected errors in nvmecontrol. While in
here, a couple additional errors with shift/mask confusion that were
not diagnosed by Coverity are also fixed.
MFC r359644: llvm: add a build knob for enabling assertions
For head/, this will remain eternally default-on to maintain the status quo.
For stable/ branches, it should be flipped to default-off to maintain the
status quo.
There's value in being able to flip it one way or the other easily on head
or stable branches, whether you want to gain some performance back on head/
(for machines there's little chance you'll actually hit an assertion) or
potentially diagnose a problem with the version of llvm on an older branch.
Currently, stable branches get the CFLAGS+= -ndebug line uncommented; going
forward, they will instead have the default of LLVM_ASSERTIONS flipped.
[MFC note: that last comment just happened for these two branches]
MFC r359327,359328:
Add property-based filters for syslogd.
Property-based filters allow substring and regular expressions
(see re_format(7)) matching against various message attributes.
Filter specification starts with '#:' or ':' followed by three
comma-separated fields property, operator, "value". Value must be
double-quoted. A double quote and backslash must be escaped by a
backslash.
Following properties are supported as test value:
o msg - body of the message received;
o programname - program name sent the message;
o hostname - hostname of message's originator;
o source - an alias for hostname.
Supported operators:
o contains - true if filter value is found as a substring of property;
o isequal - true if filter value is equal to property;
o startswith - true if property starts with filter value;
o regex - true if property matches basic regular expression defined
in filter value;
o ereregex - true if property matches extended regular expression
defined in filter value;
Operator may be prefixed by '!' to invert compare logic or by
'icase_' to make comparison function case insensitive.
Submitted by: Boris N. Lytochkin <lytboris at gmail com>
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D23468
The vectx API, computes the hash for verifying a file as it is read.
This avoids the overhead of reading files twice - once to verify, then
again to load.
For doing an install via loader, avoiding the need to rewind
large files is critical.
This API is only used for modules, kernel and mdimage as these are the
biggest files read by the loader.
The reduction in boot time depends on how expensive the I/O is
on any given platform. On a fast VM we see 6% improvement.
For install via loader the first file to be verified is likely to be the
kernel, so some of the prep work (finding manifest etc) done by
verify_file() needs to be factored so it can be reused for
vectx_open().
For missing or unrecognized fingerprint entries, we fail
in vectx_open() unless verifying is disabled.
Otherwise fingerprint check happens in vectx_close() and
since this API is only used for files which must be verified
(VE_MUST) we panic if we get an incorrect hash.
Fix pkgfs stat so it satisfies libsecureboot
We need a valid st_dev, st_ino and st_mtime
to correctly track which files have been verified
and to update our notion of time.
ve_utc_set(): ignore utc if it would jump our current time
by more than VE_UTC_MAX_JUMP (20 years).
Allow testing of install command via userboot.
Need to fix its stat implementation too.
bhyveload also needs stat fixed - due to change to userboot.h
Call ve_error_get() from vectx_close() when hash is wrong.
Track the names of files we have hashed into pcr
For the purposes of measured boot, it is important
to be able to reproduce the hash reflected in
loader.ve.pcr
so loader.ve.hashed provides a list of names in the order they
were added.
Avoid unused vars when VE_ECDSA_HASH_AGAIN undefined
Ryan Moeller [Wed, 8 Apr 2020 06:06:13 +0000 (06:06 +0000)]
MFC r359303
MFOpenZFS: ZVOLs should not be allowed to have children
zfs create, receive and rename can bypass this hierarchy rule. Update
both userland and kernel module to prevent this issue and use pyzfs
unit tests to exercise the ioctls directly.
Note: this commit slightly changes zfs_ioc_create() ABI. This allow to
differentiate a generic error (EINVAL) from the specific case where we
tried to create a dataset below a ZVOL (ZFS_ERR_WRONG_PARENT).
Reviewed-by: Paul Dagnelie <pcd@delphix.com> Reviewed-by: Matt Ahrens <mahrens@delphix.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Tom Caputi <tcaputi@datto.com> Signed-off-by: loli10K <ezomori.nozomu@gmail.com>
Approved by: mav (mentor)
openzfs/zfs@d8d418ff0cc90776182534bce10b01e9487b63e4
MFC r342168,357786: Allow ng_nat to be attached to a ethernet interface
Allow ng_nat to be attached to a ethernet interface directly via ng_ether(4)
or the likes. Add new control message types: setdlt and getdlt to switch
from default DLT_RAW (no encapsulation) to DLT_EN10MB (ethernet).
MFC r357092,357787: Add support for RFC 6598/Carrier Grade NAT subnets
to libalias and ipfw.
In libalias, a new flag PKT_ALIAS_UNREGISTERED_RFC6598 is added.
This is like PKT_ALIAS_UNREGISTERED_ONLY, but also is RFC 6598 aware.
Also, we add a new NAT option to ipfw called unreg_cgn, which is like
unreg_only, but also is RFC 6598-aware. The reason for the new
flags/options is to avoid breaking existing networks, especially those
which rely on RFC 6598 as an external address.
projects / FreeBSD / FreeBSD.git / log