MFC r318734:
Fix possible double releasing for SA reference.
There are two possible ways how crypto callback are called: directly from
caller and deffered from crypto thread.
For inbound packets the direct call chain is the following:
IPSEC_INPUT() method -> ipsec_common_input() -> xform_input() ->
-> crypto_dispatch() -> crypto_invoke() -> crypto_done() ->
-> xform_input_cb() -> ipsec[46]_common_input_cb() -> netisr_queue().
The SA reference is held while crypto processing is not finished.
The error handling code wrongly expected that crypto callback always called
from the crypto thread context, and it did SA reference releasing in
xform_input_cb(). But when the crypto callback called directly, in case of
error (e.g. data authentification failed) the error handling in
ipsec_common_input() also did SA reference releasing.
To fix this, remove error handling from ipsec_common_input() and do it
in xform_input() before crypto_dispatch().
PR: 219356
MFC r318738:
Fix possible double releasing for SA and SP references.
There are two possible ways how crypto callback are called: directly from
caller and deffered from crypto thread.
For outbound packets the direct call chain is the following:
IPSEC_OUTPUT() method -> ipsec[46]_common_output() ->
-> ipsec[46]_perform_request() -> xform_output() ->
-> crypto_dispatch() -> crypto_invoke() -> crypto_done() ->
-> xform_output_cb() -> ipsec_process_done() -> ip[6]_output().
The SA and SP references are held while crypto processing is not finished.
The error handling code wrongly expected that crypto callback always called
from the crypto thread context, and it did references releasing in
xform_output_cb(). But when the crypto callback called directly, in case of
error the error handling code in ipsec[46]_perform_request() also did
references releasing.
To fix this, remove error handling from ipsec[46]_perform_request() and do it
in xform_output() before crypto_dispatch().
ngie [Fri, 2 Jun 2017 01:00:40 +0000 (01:00 +0000)]
MFC r318210,r318211:
Approved by: re (gjb)
r318210:
ssp_test:read:: query the value of MAXPATHLEN via getconf(1)
In the event the value of PATH_MAX was changed, the assumption that
MAXPATHLEN is 1024 (and hence the buffer length required to trigger
SSP to fail for read(2)) would be invalidated. Query getconf(1) for
the actual value of MAXPATHLEN via _XOPEN_PATH_MAX instead, and
increment the value by 1 to ensure that the SSP support tests the
stack smashing support properly.
r318211:
Fix up previous commit
- Apply the logic to the FreeBSD block
- Fix a typo with the getconf(1) call that I would have caught, were
it not for the fact that I got the blocks wrong.
- Consolidate the hardcoded buffer sizes to the NetBSD block.
This would have been discovered had I run the test on a system where
PATH_MAX != 1024 (I don't have that at my disposal right at this moment).
slm [Thu, 1 Jun 2017 16:55:03 +0000 (16:55 +0000)]
MFC r318895: Fix several problems with mapping code in mps(4).
MFC r318896: Fix several problems with mapping code in mpr(4).
-Add several comments describing what the mapping code is doing.
-Added a callout timer to improve check for missing devices when discovery has
completed so that missing counts are incremented correctly.
-Fix problems with missing counts not being saved to the HBA.
-Update man pages mps(4) and mpr(4) to include a description of the use
use_phy_num sysctl variable.
-Remove channel field in the mapping structure because it's not used.
-Improve logging by using mps_dprint or mpr_dprint instead of printf and adding
more logging where appropriate.
-Add check for a bad index before writing mapping entries to controller.
-The high missing count check in the mapping table was using the incorrect
initial value, which could lead to a bad result.
-The usage of the IN_USE flag for volume mapping was changed to be more
intuitive, and was not being used correctly.
-The check for a free DPM entry was changed, as this was completely wrong.
-Updates to the missing count for volumes were not being done correctly, so this
function was completely rewritten.
-_mapping_add_to_removal_table() was overly complicated and incorrectly used, so
this function was rewritten.
-Missing counts for all devices were not being incremented properly, so this
functionality was added.
-The search for space in the mapping table for missing enclosures was not
calculating the found space correctly due to not breaking out of a loop when
required, and the num_found variable was not being reset when needed.
-Retries when a device fails to get added due to a full mapping table were
removed because this is unneccessary.
-mps_mapping_is_reinit_required() and mpr_mapping_is_reinit_required() were
removed because they were not being used.
-Some functions were renamed to avoid confusion between Target IDs and SAS IDs.
-_mapping_check_update_ir_mt_idx() was removed because it was overly
complicating volume mapping.
-The setting of the maxtargets variable was changed to include max volumes.
-The setting of the initiator_id variable was changed to be the invalid target
ID after all targets, including volumes. Previously, this was set to the last
valid target ID.
-Don't exclude target IDs of RAID components or check for a reuse of a target ID
for RAID components.
-Some endienness was added.
r308217:
Add a fallback to the device mapper logic. We've seen systems in the field
that are apparently misconfigured by the manufacturer and cause the mapping
logic to fail. The fallback allows drive numbers to be assigned based on the
PHY number that they're attached to. Add sysctls and tunables to overrid
this new behavior, but they should be considered only necessary for debugging.
r308301:
Record the LogInfo field when reporting the IOCStatus. Helps in
debugging errors.
Submitted by: slm
Obtained from: Netflix
MFC after: 3 days
r311958:
Print out the number of queues/MSIx vectors.
Sponsored by: Netflix
r312437:
Rework the debug print API. Event printing no longer gets special handling.
All of the printing from the tables file now has wrappers so that the
handling is cleaner and it's possible to print something out (say, during
development) without having to fight the global debug flags. This re-org
will also make it easier to have the tables be compiled out at build time
if desired.
Other than fixing some minor bugs, there are no user-visible changes from
this change
Sponsored by: Netflix, Inc.
Differential Revision: D9238
r318188:
Improve error messages during command timeout for the mpr and mps
drivers.
Sponsored by: Netflix
r318427:
Add tri-mode support (SAS/SATA/PCIe).
This includes NVMe device support and adds support for the following adapters:
SAS 3408
SAS 3416
SAS 3508
SAS 3516
SAS 3616
SAS 3708
SAS 3716
tuexen [Thu, 1 Jun 2017 14:58:26 +0000 (14:58 +0000)]
When a SYN-ACK is received in SYN-SENT state, RFC 793 requires the
validation of SEG.ACK as the first step. If the ACK is not acceptable,
a RST segment should be sent and the segment should be dropped.
Up to now, the segment was partially processed.
This patch moves the check for the SEG.ACK validation up to the front
as required.
Fix warnings about the following when WARNS=6 (which I will commit soon):
- casting away const
- no previous 'extern' declaration for non-static variable
- others as explained by #pragmas and comments
- unused parameters
libthr: disable thread-safety warnings
These warnings don't make sense for code that implements
the locking primitives.
libthr: change CHECK_AND_INIT_RWLOCK to an inline function
This was prompted by a compiler warning about 'ret' shadowing
a local variable in the callers of the macro.
libthr: Use CLI flags instead of pragmas to disable warnings
People tweaking the build system or compilers tend to look into
the Makefile and not into the source. Having some warning controls
in the Makefile and some in the source code is surprising.
Pragmas have the advantage that they leave the warnings enabled
for more code, but that advantage isn't very relevant in these cases.
libthr: fix warnings from GCC when WARNS=6
Fix warnings about:
- redundant declarations
- a local variable shadowing a global function (dlinfo)
- an old-style function definition (with an empty parameter list)
- a variable that is possibly used uninitialized
libthr: prevent setcontext() from masking SIGTHR
__thr_setcontext() mistakenly tested for the presence of SIGCANCEL
in its local ucontext_t instead of the parameter. Therefore,
if a thread calls setcontext() with a context whose signal mask
contains SIGTHR (a.k.a. SIGCANCEL), that signal will be blocked,
preventing the thread from being cancelled or suspended.
gjb [Thu, 1 Jun 2017 14:39:11 +0000 (14:39 +0000)]
Document r305837, readelf(1) ARM program and section header reporting.
Document r305844, ELF Tool Chain updated to r3490.
Document r309125, strings(1) exit status fix.
Submitted by: emaste
Sponsored by: The FreeBSD Foundation
tuexen [Thu, 1 Jun 2017 10:03:41 +0000 (10:03 +0000)]
MFC r318649:
The connect() system call should return -1 and set errno to EAFNOSUPPORT
if it is called on a TCP socket
* with an IPv6 address and the socket is bound to an
IPv4-mapped IPv6 address.
* with an IPv4-mapped IPv6 address and the socket is bound to an
IPv6 address.
Thanks to Jonathan T. Leighton for reporting this issue.
tuexen [Thu, 1 Jun 2017 09:21:25 +0000 (09:21 +0000)]
MFC r317597:
Allow SCTP to use the hostcache.
This patch allows the MTU stored in the hostcache to be used as an
initial value for SCTP paths. When an ICMP PTB message is received,
store the MTU in the hostcache.
tuexen [Thu, 1 Jun 2017 09:00:38 +0000 (09:00 +0000)]
MFC r317512:
armv8 has support for optional CRC32C instructions. This patch checks if they are
available and if that is true make use of them.
Thank you very much to Andrew Turner for providing help and review the patch!
Reviewed by: andrew
Differential Revision: https://reviews.freebsd.org/D10499
tuexen [Thu, 1 Jun 2017 08:42:53 +0000 (08:42 +0000)]
MFC r317244:
Represent "a syncache overflow hasn't happend yet" by using
-(SYNCOOKIE_LIFETIME + 1) instead of INT64_MIN, since it is
good enough and works when time_t is int32 or int64.
This fixes the issue reported by cy@ on i386.
tuexen [Thu, 1 Jun 2017 08:32:35 +0000 (08:32 +0000)]
MFC r317208:
Syncoockies can be used in combination with the syncache. If the cache
overflows, syncookies are used.
This patch restricts the usage of syncookies in this case: accept
syncookies only if there was an overflow of the syncache recently.
This mitigates a problem reported in PR217637, where is syncookie was
accepted without any recent drops.
Thanks to glebius@ for suggesting an improvement.
tuexen [Thu, 1 Jun 2017 08:29:08 +0000 (08:29 +0000)]
MFC r316743:
The sysctl variable net.inet.tcp.drop_synfin is not honored in all states,
for example not in SYN-SENT.
This patch adds code to check the sysctl variable in other states than
LISTEN.
Thanks to ae and gnn for providing comments.
tuexen [Thu, 1 Jun 2017 08:19:45 +0000 (08:19 +0000)]
MFC r314155:
TCP window updates are only sent if the window can be increased by at
least 2 * MSS. However, if the receive buffer size is small, this might
be impossible. Add back a criterion to send a TCP window update if
the window can be increased by at least half of the receive buffer size.
This condition was removed in r242252. This patch simply brings it back.
tuexen [Thu, 1 Jun 2017 08:12:44 +0000 (08:12 +0000)]
MFC r313031:
Take the SCTP common header into account when computing the
space available for chunks. This unbreaks the handling of
ICMPV6 packets indicating "packet too big". It just worked
for IPv4 since we are overbooking for IPv4.
tuexen [Thu, 1 Jun 2017 08:04:09 +0000 (08:04 +0000)]
MFC r312063:
Ensure that the buffer length and the length provided in the IPv4
header match when using a raw socket to send IPv4 packets and
providing the header. If they don't match, let send return -1
and set errno to EINVAL.
Before this patch is was only enforced that the length in the header
is not larger then the buffer length.
ngie [Thu, 1 Jun 2017 06:56:32 +0000 (06:56 +0000)]
MFC r314579,r314785:
r314579 (by np):
Add cxgbetool(8) to the base system.
Move cxgbetool from tools/tools to usr.sbin. Compile and install it on
platforms where cxgbe(4) is built by default. Knobs (WITH_CXGBETOOL and
WITHOUT_CXGBETOOL) have been added so that the user can override the
default setting.
ngie [Thu, 1 Jun 2017 06:41:24 +0000 (06:41 +0000)]
MFC r318436:
usr.bin/getconf: add some initial tests
Items tested via this commit are:
- Some basic POSIX constants.
- Some valid programming environments with -v.
- Some invalid programming environments via -v.
NOTE: this test makes assumptions about ILP32/LP32 vs LP64 that are
currently not true on all architectures to avoid hardcoding some
architectures in the tests. I'm working on improving getconf(1) to be
more sane about handling ILP32/LP32 vs LP64. Future commits are coming
soon to address this.
ngie [Thu, 1 Jun 2017 06:35:37 +0000 (06:35 +0000)]
MFC r319157:
fma_test: mute a warning about unreachable code on amd64 by restructuring
the #ifdef block to only handle the rest of the logic in the loop in the
#else case.
ngie [Thu, 1 Jun 2017 06:26:35 +0000 (06:26 +0000)]
MFC r318175,r318178,r318179:
r318175:
procstat(1): clarify the Signal Disposition section
- Fix a typo (SIGIGN -> SIG_IGN). Use .Dv when referencing SIG_IGN.
- Use semi-colons as soft breaks when separating sentences for
the FLAGS section.
- Tweak wording for C slightly to flow better and to be a bit
more technically correct (signals with handlers installed will
be caught by the target program).
- Reference signal(3) in the SEE ALSO section.
r318178:
procstat(1): document all possible `PRO` (network protocol) values
Reference the appropriate section 4 manpages for networking
protocols.
r318179:
procstat(1): also reference icmp(4) and sctp(4)
This was missed in the previous commit by accident.
vangyzen [Wed, 31 May 2017 21:20:42 +0000 (21:20 +0000)]
MFC r318586
dma.8: fix problems reported by igor and 'mandoc -Tlint'
dma.8:77:contraction:Queue the mail, but [don't] attempt to deliver it.
dma.8:85:repeated:s [are are] ignored.
dma.8:87:contraction:[Don't] run in the background.
dma.8:201:contraction:Use the catch-all alias only if you [don't] want any local mail to be
mandoc: dma.8:308:5: WARNING: macro neither callable nor escaped: Sm
vangyzen [Wed, 31 May 2017 21:16:10 +0000 (21:16 +0000)]
MFC r319022
Fix INSTALL_AS_USER with external nsswitch databases
The INSTALL_AS_USER option tells "install" to use the current
user name as the owner of the installed file. The "install"
command executed by the build is statically linked, so it does not
load nsswitch modules, such as nss_ldap.so, so it fails when
the user is only defined in such a database.
Fix it to use the current UID instead of user name. This works
for all users. I expect it is also slightly more efficient.
r318515:
The current qsort(3) implementation ignores the sizes of partitions, and
always perform recursion on the left partition, then use a tail call to
handle the right partition. In the worst case this could require O(N)
levels of recursions.
Reduce the possible recursion level to log2(N) by always recursing on the
smaller partition instead.
r315370:
The adj_free and max_free values of new_entry will be calculated and
assigned by subsequent vm_map_entry_link(), therefore, remove the
pointless copying.
emaste [Tue, 30 May 2017 16:55:15 +0000 (16:55 +0000)]
MFC r318316: uniq: allow -c to be used with -d or -u
Bring in some bits from NetBSD and lift the restriction in uniq(1) that
-c cannot be used with the -d and -u options. This restriction seems
unnecessary and is supported at least by GNU, OpenBSD, and NetBSD. Lift
the restriction and simplify the show() logic a little bit to maintain
functionality when -c is provided with -d/-u.
Also with this change, -d and -u are now actually a mutually exclusive,
albeit valid, combination. Given that they both indicate opposite
behavior, uniq(1) will no longer output anything if both -d and -u are
supplied. This is in line with NetBSD as well as GNU.
Adjust the man page and usage() to reflect that -c is its own standalone
option.