| Age | Commit message (Collapse) | Author |
|
There's no important state that needs to be recorded, or resources
that need to be relinquished, so detach-on-shutdown isn't necessary.
At the moment, detach-on-shutdown is actually harmful here: if
shutdown is triggered by a sysmon power switch event, then
config_detach will be called from the sysmon taskqueue, but
thinkpad_detach has to wait for ACPI notifiers to finish running
which means waiting for the sysmon taskqueue -> deadlock or crash.
We should maybe arrange to do config_detach from a thread other than
the sysmon taskqueue thread to avoid this class of problems -- but
for now, thinkpad(4) has no reason to detach on shutdown anyway, so
let's take the easy path.
Note: There are many drivers that set DVF_DETACH_SHUTDOWN which
probably shouldn't; the flag means the kernel _will_ detach on
shutdown, not that it _may_. Even those that do need to record state
or relinquish resources might be better served by pmf shutdown hooks
which can skip freeing software resources for faster shutdown.
|
|
In usbnet.c rev. 1.16, usbnet_newbuf was first passed a buffer length
to verify it fits within MCLBYTES. It also changed m_adj to go
before, not after, setting m_len and m_pkthdr.len -- which had the
effect of making the m_adj a no-op, because after MGETHDR the mbuf
has zero length and m_adj stops at the length of the mbuf, so nothing
was aligned as intended.
To make this aligned as intended, we require the buffer length to be
_below_ MCLBYTES, by ETHER_ALIGN, so there's room for the ethernet
header in a maximum-length payload. Once we do that, it is safe to
initialize m_len = m_pkthdr.len = ETHER_ALIGN + buflen, which is
below the actual size of the mbuf (MHLEN or MCLBYTES, depending), and
_then_ do m_adj to align the pointer.
|
|
viocon* at virtio?
/dev/ttyVI??
Tested under qemu with:
qemu-system-aarch64 ... \
-device virtio-serial \
-chardev socket,path=/tmp/ttyVI00,server=on,wait=off,id=ttyVI00 \
-device virtconsole,chardev=ttyVI00,name=org.NetBSD.dev.ttyVI00 \
...
I updated MAKEDEV.conf to create /dev/ttyVI?? on all ports where it
looks likely to work based on:
(a) having pci or a non-pci virtio attachment,
(b) `qemu-system-$ARCH -M ?' mentioned something resembling the port,
and
(c) `qemu-system-$ARCH -device virtio-serial' launched without
complaining about the virtio-serial device.
(Criterion (c) excluded sparc and sparc64.)
|
|
- Where we had #ifndef WM_MPSAFE splnet(), we also had WM_CORE_LOCK,
which implies splnet, so just remove the conditional splnet.
- Make the core lock unconditional and remove macro indirections.
- Pass CALLOUT_MPSAFE, SOFTINT_MPSAFE, and WQ_MPSAFE directly without
macro indirections.
|
|
The return value must be used, because some of the acquire/release
pairs hold a mutex from acquire to release, and failing to call
release, or calling release twice, leads to an inconsistent state.
|
|
needs a reset.
Author: Nick Hudson <skrll@netbsd.org>
Committer: Taylor R Campbell <riastradh@NetBSD.org>
|
|
Don't touch if_flags without IFNET_LOCK:
- If only core lock is held, use sc_if_flags.
- If only txq lock is held, use txq_stopping.
=> Verified all paths guarantee !txq_stopping, so assert.
- Make sure sc_if_flags is updated on stop.
- Make wm_init fail once we enter wm_detach.
- Sprinkle assertions.
Author: Taylor R Campbell <riastradh@NetBSD.org>
|
|
|
|
Don't touch if_flags without IFNET_LOCK:
- If only core lock is held, use sc_if_flags.
- If only txq lock is held, use txq_stopping.
=> Verified all paths guarantee !txq_stopping, so assert.
- Make sure sc_if_flags is updated on stop.
- Sprinkle assertions.
|
|
- Don't use membar_* for DMA.
- Sync only the header and payload of the rings separately as needed.
If we bounce, this avoids large memcpy when we only care about the
header.
- Sync uring with PREREAD before triggering anything that will return
data in it.
=> Move uring PREREAD in virtio_enqueue_commit to _before_ updating
vq->vq_avail->idx, which is the pointat which the DMA read is
triggered in the `device' (host).
=> Omit needless membar_consumer in virtio_enqueue_commit -- may not
work with DMA memory, and even if it does, redundant with
bus_dmamap_sync uring PREREAD here.
=> XXX Does the device/host ever return unsolicited entries in the
queue, or only solicited ones? If only solicited ones, the
PREREAD in virtio_init_vq is redundant.
- Sync uring with POSTREAD before we read from it. This way the DMA
read into our buffer has finished before we read from the buffer.
=> Add missing uring POSTREAD in virtio_vq_is_enqueued, between read of
vq->vq_used_idx and return to caller, so that the caller can
safely use virtio_dequeue.
=> Add missing uring POSTREADs in virtio_start_vq_intr:
. between entry from caller and the read of vq->vq_used_idx
. between the read of vq->vq_used_idx and return to caller,
so that the caller can safely use virtio_dequeue, just like
virtio_vq_is_enqueued
=> Move uring POSTREADs in virtio_enqueue_commit to _before_ reading
vq->vq_used->flags or *vq->vq_avail_event, not after.
- After we write to aring, sync it with PREWRITE. This way we finish
writing to our buffer before the DMA write from it.
=> Omit needless PREWRITE in virtio_init_vq -- we do the appropriate
PREWRITE in virtio_enqueue_commit now.
=> Convert membar_producer to bus_dmamap_sync PREWRITE in
virtio_enqueue_commit.
=> Omit incorrect aring POSTWRITE in virtio_enqueue_commit -- no need
because the DMA write may not have completed yet at this point,
and we already do a POSTWRITE in virtio_vq_is_enqueued.
=> Omit needless membar_producer in virtio_postpone_intr -- may not
work with DMA memory, and even if it does, redundant with
bus_dmamap_sync PREWRITE here.
- After xfers to aring have completed, sync it with POSTWRITE.
=> Add missing aring POSTWRITE in virtio_free_vq, in case there are
paths from virtio_enqueue_commit to here that don't go through
virtio_is_enqueued. (If there are no such paths, then maybe we
should KASSERT(vq->vq_queued == 0) in virtio_free_vq.)
|
|
|
|
numCol and numSpares are "int" so they can be "-1" internally,
which means negative values need to be rejected, as well as
values higher than RF_MAXCOL/RF_MAXSPARES.
explicitly nul-terminate all strings coming from userland.
some minor CSE that avoids signed arith.
this fixes issues in the RAIDFRAME_ADD_HOT_SPARE,
RAIDFRAME_CONFIGURE, RAIDFRAME_DELETE_COMPONENT,
RAIDFRAME_INCORPORATE_HOT_SPARE, and RAIDFRAME_REBUILD_IN_PLACE
ioctl commands.
Reported-by: syzbot+b584943ad1f8ab9d4fe0@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=61e07e418261f8eec8a37a9226725fe31820edd0
https://syzkaller.appspot.com/bug?id=ca0c997b40de81c0f0b44790217731f142003149
https://syzkaller.appspot.com/bug?id=6fc452d228453494655a85264591dd9054cc0b08
https://syzkaller.appspot.com/bug?id=873f0271682713a27adc9a49dd7109c70b35fda3
XXX: pullup-8, pullup-9.
ok oster@ riastradh@
|
|
bytes.
ether_input() can now trust M_HASFCS to accurately represent the packet
contents.
Discussed on tech-net@
|
|
No functional change intended.
|
|
|
|
|
|
This is not a real bug because the return value is not used.
|
|
|
|
|
|
|
|
We're going to unconditionally destroy them on detach.
Reported-by: syzbot+6b8aea3a51d8b1e5ab61@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=ec5ed628986cba5aab5705691596a2d27b0301fc
|
|
mainly s/paramater/parameter/ and s/reduntant/redundant/.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
block size is zero.
|
|
|
|
- No membar_producer in sip_init_rxdesc -- use bus_dmamap_sync with
BUS_DMASYNC_PREWRITE to order updates to the DMA descriptors.
- Omit needless membar_producer in sip_init_txdesc -- the hardware
will not look at any of these descriptors until we set CMDSTS_OWN
on the first one in the sequence, which is done later in the
caller, sipcom_start.
- In gsip_rxintr, make sure to read cmdsts _before_ extsts, by
separating them with BUS_DMASYNC_PREREAD. Otherwise, the CPU might
reorder the loads and read a stale extsts first before witnessing
an updated cmdsts with the CMDSTS_OWN bit that transfers ownership
of the rx packet to us.
|
|
(such as AppleTalk).
Instead, remove/preserve the final four bytes in the packet ourselves on a per-
protocol basis, as we do in arch/arm/xscale/ixp425_if_npe.c (and dev/ic/gem.c,
and so forth).
|
|
|
|
|
|
There are some environments where size 0 blocks are passed from the loader.
|
|
Read the interface up/down status from sc_if_flags (under WM_CORE_LOCK)
when deciding if the multicast filter needs to be updated.
Discussed with msaitoh@, knakahara@ and riastradh@
|
|
Discussed with msaitoh@, knakahara@ and riastradh@
|
|
This can happen due to janky MD kludgerosity like x86
x86_genfb_ddb_trap_callback, which should really be cleaned up, but
at least this might help with the recursive traps we've been seeing
in syzbot.
|
|
|
|
|
|
committed in 1.206, and the total disaster that the attempt to
revert those in 1.207 created.
|
|
|
|
|
|
|
|
|
|
|
|
for global commands is 0xffffffff. While the driver only supports 16bit
numbers (device minor & 0xffff), we need to use the full value for pass
through commands.
This fixes e.g. logpage requests on the controller level.
|
|
to the correct bit position.
|
|
|