summaryrefslogtreecommitdiffstats
path: root/sys/modules
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'origin/stable/11' into devel-11Luiz Souza2017-07-17791-1025/+1105
|\
| * MFC r316541, r316544, and r320688 from HEAD to stable/11.erj2017-07-112-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r316541: Fix a double free in ixgbe_rxeof() r316544: Don't overwrite vf->flags variable at the end of ixgbe(4) ixgbe_add_vf() r320688: ixgbe(4): Update HEAD (p3) to 3.2.12-k Includes: - Support for X550EM devices. - Support for Bypass adapters. - Flow Director code moved to separate files - SR-IOV code moved to separate files - Netmap code moved to separate files Sponsored by: Intel Corporation
| * MFC r317518, r318647, r319197, r319198, r319199, r319200, r320625, r320626,zbb2017-07-062-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r320628, r319201, r320629, r320630, r320631, r320632. r317518: Import Amazon Elastic Network Adapter (ENA) HAL to sys/contrib/ Import from vendor-sys/ena-com/1.1.4.1 SVN rev.: 317516 Version: 1.1.4.1 r318647: Add support for Amazon Elastic Network Adapter (ENA) NIC ENA is a networking interface designed to make good use of modern CPU features and system architectures. The ENA device exposes a lightweight management interface with a minimal set of memory mapped registers and extendable command set through an Admin Queue. The driver supports a range of ENA devices, is link-speed independent (i.e., the same driver is used for 10GbE, 25GbE, 40GbE, etc.), and has a negotiated and extendable feature set. Some ENA devices support SR-IOV. This driver is used for both the SR-IOV Physical Function (PF) and Virtual Function (VF) devices. ENA devices enable high speed and low overhead network traffic processing by providing multiple Tx/Rx queue pairs (the maximum number is advertised by the device via the Admin Queue), a dedicated MSI-X interrupt vector per Tx/Rx queue pair, and CPU cacheline optimized data placement. The ENA driver supports industry standard TCP/IP offload features such as checksum offload and TCP transmit segmentation offload (TSO). Receive-side scaling (RSS) is supported for multi-core scaling. The ENA driver and its corresponding devices implement health monitoring mechanisms such as watchdog, enabling the device and driver to recover in a manner transparent to the application, as well as debug logs. Some of the ENA devices support a working mode called Low-latency Queue (LLQ), which saves several more microseconds. This feature will be implemented for driver in future releases. r319197: Add mbuf defragmentation to the ENA driver When mbuf chain is too long and device cannot handle that number of segments in DMA transaction, mbuf chain will be defragmented. Initially, driver was dropping all mbuf chains that were exceeding supported number of segments. r319198: Add locks before each ena_up and ena_down Lock only ena_up and ena_down calls in ioctl handler, instead of whole ioctl. Locking ioctl with sx lock that is sleepable, is not allowed in some cases, e.g. when multicast options are being changed. Additional locking was added in deatch function to prevent race condition with ioctl function. r319199: Add error handling to the ENA driver if init of the reset task fails Also, to simplify cleaning routine, reset task is initialized before allocating statistics and other resources. r319200: Move ENA's hw stats updating routine to separate task Initially, stats were being updated each time OS was requesting for the first statistic. To read statistics from hw, condvar was used. cv_timedwait cannot be called when unsleepable lock is held, and this happens when FreeBSD is requesting statistic. Seperate task is reading statistics from NIC each 1 second. r319201: Introduce additional locks when releasing TX resources and buffers in ENA There could be race condition with TX cleaning routine when cleaning mbufs, when it was called directly from main sending thread (ena_mq_start). r320625: Add missing lock upon initialization of the interface Lack of this lock was causing crash if down was called in parallel with the initialization routine. r320626: Acquire locks before calling drbr_flush() It is required to hold lock that is associated with buffer ring before flushing drbr. r320628: Unmask all IO irqs after driver state is set as running If driver left MSI-x handlling routine because interface was put down, it is not unmasking IRQs, so any requesting interrupt will be awaiting for unmasking. On ena_up() routine all interrupts are being unmasked and any awaiting interrupt will be handled right away. If handler was executed before driver state was set as running, handling routine is being ended immediately, leaving IO irqs for given queue masked. r320629: Call drbr_advance() before leaving TX routine If drbr_advance() is not called before doing cleanup and packet is already enqueued for sending (tx_info is holding pointer to mbuf), then mbuf is cleaned both in drbr_flush() and in cleanup routine, when all mbufs hold by tx_buffer_info are being released. This causes panic, because mbuf is released twice. r320630: Remove RX mtx from ENA driver RX lock is no longer required. There can only be one RX cleanup task running at a time, RX cleanup cannot be executed if interface is not yet initialized and ena_down() will not free any RX resources if any io interrupt is being handled - RX cleanup task is only called from an interrupt handler. r320631: Fix creation of dma tags and TSO settings TSO settings were not reflecting real HW capabilities. DMA tags were created with wrong window - high address was the same as low, so excluding window was not working. Capabilities of TX dma transaction were not set properly - TSO max size had been increased and size of one segment had been adjusted. r320632: Replace mbuf defragmentation with collapse Collapse should be more effective than defragmentation. Added missing declaration of ena_check_and_collapse_mbuf(). Submitted by: Michal Krawczyk <mk@semihalf.com> Jakub Palider <jpa@semihalf.com> Jan Medala <jan@semihalf.com> Obtained from: Semihalf, Amazon.com Inc. Sponsored by: Amazon.com Inc.
| * MFC r319052:dchagin2017-06-042-0/+3
| | | | | | | | | | | | | | Strip _binary_linux_locore_o_size from ${VDSO}.so as it is a low absolute symbol, and this breaks symbol lookup in ddb. Approved by: re (kib)
| * MFC r316038:tuexen2017-06-012-7/+24
| | | | | | | | | | Tweak the Makefiles a bit to allow using "tcp" in MODULES_OVERRIDE to build the tcp modules.
| * MFC r318762:np2017-05-313-3/+3
| | | | | | | | | | | | | | | | | | | | | | cxgbe(4): Update the T4, T5, and T6 firmwares to 1.16.45.0. The latest firmware has a number of link related fixes, support for a new custom card, and the fix for a bug that affected rate limiting on FreeBSD. Relnotes: Yes Sponsored by: Chelsio Communications
| * MFC r318439:ngie2017-05-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | Normalize .PATH on SRCTOP This will help Jenkins dedupe 9 warnings between the static build and the module build of ipsec(4). Missed in SRCTOP conversion in r314651. MFC with: r314651
| * MFC r314651,r318439,r318440:ngie2017-05-30785-994/+987
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r314651: sys/modules: normalize .CURDIR-relative paths to SRCTOP This simplifies make output/logic Tested with: `cd sys/modules; make ALL_MODULES=` on amd64 r318439: Normalize .PATH on SRCTOP This will help Jenkins dedupe 9 warnings between the static build and the module build of ipsec(4). Missed in SRCTOP conversion in r314651. MFC with: r314651 r318440: Normalize SYSDIR on SRCTOP instead of .CURDIR This is being done to simplify pathing for CFLAGS and source files.
| * MFC r307698:ngie2017-05-301-1/+1
| | | | | | | | | | | | r307698 (by lwhsu): - Add required header for fixing `make` in sys/modules/gpio
| * MFC r318007,r318008,r318009,r318011:ngie2017-05-302-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r318007: Add intermediary Makefile for compiling all items in the directory r318008: Only compile tests/ if MK_TESTS != no or ALL_MODULES is defined r318009: Add MK_TESTS to kern.opts.mk to support r31800 MFC with: r318008 Pointyhat to: ngie r318011: Mark this Makefile SUBDIR_PARALLEL I inserted the necessary SUBDIR+= .WAIT in the previous commit
| * MFC r314659,r314676:ngie2017-05-293-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r314659: usr.sbin: normalize paths using SRCTOP-relative paths or :H when possible This simplifies make logic/output r314676: Fix build after r314656 Some of the changes I introduced to use .ALLSRC were correct in spirit, but incorrect in reality -- in particular, ../Makefile.inc hadn't been pulled in via bsd.init.mk (via bsd.lib.mk, bsd.prog.mk), so the value of .ALLSRC (evaluated immediately) was empty. .include bsd.init.mk explicitly so we can be certain that the values used as dependencies in the targets are defined when the target recipe has been evaluated. Reminder: thou shalt separate out separate functional changes before committing them. (YUGE) Pointyhat to: ngie In collaboration with: bdrewery
| * MFC r317702, r317847, r318307np2017-05-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r317702: cxgbe(4): Support routines for Tx traffic scheduling. - Create a new file, t4_sched.c, and move all of the code related to traffic management from t4_main.c and t4_sge.c to this file. - Track both Channel Rate Limiter (ch_rl) and Class Rate Limiter (cl_rl) parameters in the PF driver. - Initialize all the cl_rl limiters with somewhat arbitrary default rates and provide routines to update them on the fly. - Provide routines to reserve and release traffic classes. r317847: cxgbe(4): The Tx scheduler initialization either works or doesn't. It doesn't need a refresh in either case. r318307: cxgbe(4): Avoid an out of bounds access when an attempt to unbind a tx queue from a traffic class fails. Sponsored by: Chelsio Communications
| * MFC r318382davidcs2017-05-221-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Move Rx Processing to fp_taskqueue(). With this CPU utilization for processing interrupts drops to around 1% for 100G and under 1% for other speeds. 2. Use sysctls for TRACE_LRO_CNT and TRACE_TSO_PKT_LEN 3. remove unused mtx tx_lock 4. bind taskqueue kernel thread to the appropriate cpu core 5. when tx_ring is full, stop further transmits till at least 1/16th of the Tx Ring is empty. In our case 1K entries. Also if there are rx_pkts to process, put the taskqueue thread to sleep for 100ms, before enabling interrupts. 6. Use rx_pkt_threshold of 128.
| * MFC efivar(8) (by imp):kib2017-05-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | List of revisions merged: r307070 r307071 r307072 r307074 r307189 r307224 r307339 r307390 r307391 r309776 r314231 r314232 r314615 r314616 r314617 r314618 r314619 r314620 r314621 r314623 r314890 r314925 r314926 r314927 r314928 r315770 r315771 Discussed with: gjb (re), imp Sponsored by: The FreeBSD Foundation
| * MFC 318136sephe2017-05-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hyperv/vmbus: Reorganize vmbus device tree For GEN1 Hyper-V, vmbus is attached to pcib0, which contains the resources for PCI passthrough and SR-IOV. There is no acpi_syscontainer0 on GEN1 Hyper-V. For GEN2 Hyper-V, vmbus is attached to acpi_syscontainer0, which contains the resources for PCI passthrough and SR-IOV. There is no pcib0 on GEN2 Hyper-V. The ACPI VMBUS device now only holds its _CRS, which is empty as of this commit; its existence is mainly for upward compatibility. Device tree structure is suggested by jhb@. Tested-by: dexuan@ Collabrated-wth: dexuan@ Sponsored by: Microsoft Differential Revision: https://reviews.freebsd.org/D10565
| * MFC r313497: ixl(4): Update to 1.7.12-k.erj2017-05-162-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refresh upstream driver before impending conversion to iflib. Major new features: - Support for Fortville-based 25G adapters - Support for I2C reads/writes (To prevent getting or sending corrupt data, you should set dev.ixl.0.debug.disable_fw_link_management=1 when using I2C [this will disable link!], then set it to 0 when done. The driver implements the SIOCGI2C ioctl, so ifconfig -v works for reading I2C data, but there are read_i2c and write_i2c sysctls under the .debug sysctl tree [the latter being useful for upper page support in QSFP+]). - Addition of an iWARP client interface (so the future iWARP driver for X722 devices can communicate with the base driver). - Add "options IXL_IW" to kernel config to enable this option. Sponsored by: Intel Corporation
| * MFC r314054: Exclude -flto when building *genassym.oemaste2017-05-154-5/+5
| | | | | | | | | | | | | | | | | | | | | | The build process generates *assym.h using nm from *genassym.o (which is in turn created from *genassym.c). When compiling with link-time optimization (LTO) using -flto, .o files are LLVM bitcode, not ELF objects. This is not usable by genassym.sh, so remove -flto from those ${CC} invocations. Sponsored by: The FreeBSD Foundation
| * MFC: r312939, r313250, r314811 (partial), r314887 (partial), r315760,marius2017-05-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r315845, 315430, r317981, r315466 o Fix some overly long lines, whitespace and other bugs according to style(9) as well as spelling etc. in mmc(4), mmcsd(4) and sdhci(4). o In the mmc(4) bridges and sdhci(4) (bus) front-ends: - Remove redundant assignments of the default bus_generic_print_child device method, - use DEVMETHOD_END, - use NULL instead of 0 for pointers. o Trim/adjust includes. o Add and use a MMC_DECLARE_BRIDGE macro for declaring mmc(4) bridges as kernel drivers and their dependency onto mmc(4). o Add support for eMMC "partitions". Besides the user data area, i. e. the default partition, eMMC v4.41 and later devices can additionally provide up to: 1 enhanced user data area partition 2 boot partitions 1 RPMB (Replay Protected Memory Block) partition 4 general purpose partitions (optionally with a enhanced or extended attribute) Besides simply subdividing eMMC devices, some Intel NUCs having UEFI code in the boot partitions etc., another use case for the partition support is the activation of pseudo-SLC mode, which manufacturers of eMMC chips typically associate with the enhanced user data area and/ or the enhanced attribute of general purpose partitions. CAVEAT EMPTOR: Partitioning eMMC devices is a one-time operation. o Now that properly issuing CMD6 is crucial (so data isn't written to the wrong partition for example), make a step into the direction of correctly handling the timeout for these commands in the MMC layer. Also, do a SEND_STATUS when CMD6 is invoked with an R1B response as recommended by relevant specifications. o Add an IOCTL interface to mmcsd(4); this is sufficiently compatible with Linux so that the GNU mmc-utils can be ported to and used with FreeBSD (note that due to the remaining deficiencies outlined above SANITIZE operations issued by/with `mmc` currently most likely will fail). These latter have been added to ports as sysutils/mmc-utils. Among others, the `mmc` tool of mmc-utils allows for partitioning eMMC devices (tested working). o For devices following the eMMC specification v4.41 or later, year 0 is 2013 rather than 1997; so correct this for assembling the device ID string properly. o Let mmcsd.ko depend on mmc.ko. Additionally, bump MMC_VERSION as at least for some of the above a matching pair is required. o In the ACPI front-end of sdhci(4) describe the Intel eMMC and SDXC controllers as such in order to match the PCI one. Additionally, in the entry for the 80860F14 SDXC controller remove the eMMC-only SDHCI_QUIRK_INTEL_POWER_UP_RESET.
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2017-05-1119-11/+217
|\ \ | |/
| * MFC: r314097marius2017-05-102-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Allow different slicers for different flash types to be registered with geom_flashmap(4) and teach it about MMC for slicing enhanced user data area partitions. The FDT slicer still is the default for CFI, NAND and SPI flash on FDT-enabled platforms. - In addition to a device_t, also pass the name of the GEOM provider in question to the slicers as a single device may provide more than one provider. - Build a geom_flashmap.ko. - Use MODULE_VERSION() so other modules can depend on geom_flashmap(4). - Remove redundant/superfluous GEOM routines that either do nothing or provide/just call default GEOM (slice) functionality. - Trim/adjust includes
| * MFC r316534:bdrewery2017-04-191-6/+1
| | | | | | | | Stop building assym.o into the module.
| * MFC r316485davidcs2017-04-193-0/+111
| | | | | | | | | | Add 25/40/100Gigabit Ethernet Driver version v1.3.0 for Cavium Inc's. Qlogic 45000 Series Adapters
| * MFC r316435:ae2017-04-172-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ipfw_pmod kernel module. The module is designed for modification of a packets of any protocols. For now it implements only TCP MSS modification. It adds the external action handler for "tcp-setmss" action. A rule with tcp-setmss action does additional check for protocol and TCP flags. If SYN flag is present, it parses TCP options and modifies MSS option if its value is greater than configured value in the rule. Then it adjustes TCP checksum if needed. After handling the search continues with the next rule. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D10150
| * MFC r314638: add a module that provides support for DRAM ECC error injectionavg2017-04-142-0/+10
| | | | | | | | on AMD CPUs
| * MFC r313959:trasz2017-04-092-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add USB Mass Storage CTL frontend. This makes it possible for USB OTG-capable hardware to implement device side of USB Mass Storage, ie pretend it's a flash drive. It's configured in the same way as other CTL frontends, using ctladm(8) or ctld(8). Differently from usfs(4), all the configuration can be done without rebuilding the kernel. Testing and review is welcome. Right now I'm still moving, and I don't have access to my test environment, so I'm somewhat reluctant to making larger changes to this code; on the other hand I don't want to let it sit on Phab until my testing setup is back, because I want to get it into 11.1-RELEASE. Relnotes: yes Sponsored by: The FreeBSD Foundation
| * MFC r304041:ae2017-04-033-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move logging via BPF support into separate file. * make interface cloner VNET-aware; * simplify cloner code and use if_clone_simple(); * migrate LOGIF_LOCK() to rmlock; * add ipfw_bpf_mtap2() function to pass mbuf to BPF; * introduce new additional ipfwlog0 pseudo interface. It differs from ipfw0 by DLT type used in bpfattach. This interface is intended to used by ipfw modules to dump packets with additional info attached. Currently pflog format is used. ipfw_bpf_mtap2() function uses second argument to determine which interface use for dumping. If dlen is equal to ETHER_HDR_LEN it uses old ipfw0 interface, if dlen is equal to PFLOG_HDRLEN - ipfwlog0 will be used. Obtained from: Yandex LLC Sponsored by: Yandex LLC MFC r304043: Add three helper function to manage tables from external modules. ipfw_objhash_lookup_table_kidx does lookup kernel index of table; ipfw_ref_table/ipfw_unref_table takes and releases reference to table. Obtained from: Yandex LLC Sponsored by: Yandex LLC MFC r304046, 304108: Add ipfw_nat64 module that implements stateless and stateful NAT64. The module works together with ipfw(4) and implemented as its external action module. Stateless NAT64 registers external action with name nat64stl. This keyword should be used to create NAT64 instance and to address this instance in rules. Stateless NAT64 uses two lookup tables with mapped IPv4->IPv6 and IPv6->IPv4 addresses to perform translation. A configuration of instance should looks like this: 1. Create lookup tables: # ipfw table T46 create type addr valtype ipv6 # ipfw table T64 create type addr valtype ipv4 2. Fill T46 and T64 tables. 3. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 4. Create NAT64 instance: # ipfw nat64stl NAT create table4 T46 table6 T64 5. Add rules that matches the traffic: # ipfw add nat64stl NAT ip from any to table(T46) # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96 6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Stateful NAT64 registers external action with name nat64lsn. The only one option required to create nat64lsn instance - prefix4. It defines the pool of IPv4 addresses used for translation. A configuration of instance should looks like this: 1. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 2. Create NAT64 instance: # ipfw nat64lsn NAT create prefix4 A.B.C.D/28 3. Add rules that matches the traffic: # ipfw add nat64lsn NAT ip from any to A.B.C.D/28 # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96 4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D6434 MFC r304048: Replace __noinline with special debug macro NAT64NOINLINE. MFC r304061: Use %ju to print unsigned 64-bit value. MFC r304076: Make statistics nat64lsn, nat64stl an nptv6 output netstat-like: "@value @description" and fix build due to -Wformat errors. MFC r304378 (by bz): Try to fix gcc compilation errors (which are right). nat64_getlasthdr() returns an int, which can be -1 in case of error, storing the result in an uint8_t and then comparing to < 0 is not helpful. Do what is done in the rest of the code and make proto an int here as well. MFC r309187: Fix ICMPv6 Time Exceeded error message translation. MFC r314718: Use new ipfw_lookup_table() in the nat64 too. MFC r315204,315233: Use memset with structure size.
| * MFC r303012:ae2017-04-032-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ipfw_nptv6 module that implements Network Prefix Translation for IPv6 as defined in RFC 6296. The module works together with ipfw(4) and implemented as its external action module. When it is loaded, it registers as eaction and can be used in rules. The usage pattern is similar to ipfw_nat(4). All matched by rule traffic goes to the NPT module. Reviewed by: hrs Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D6420 MFC r304049: Add `stats reset` command implementation to NPTv6 module to be able reset statistics counters. Obtained from: Yandex LLC Sponsored by: Yandex LLC MFC r304076: Make statistics nat64lsn, nat64stl an nptv6 output netstat-like: "@value @description" and fix build due to -Wformat errors. MFC r314507: Fix NPTv6 rule counters when one_pass is not enabled. Consider the rule matching when both @done and @retval values returned from ipfw_run_eaction() are zero. And modify ipfw_nptv6() to return IP_FW_DENY and @done=0 when addresses do not match. Obtained from: Yandex LLC Sponsored by: Yandex LLC
| * MFC ↵jhibbits2017-04-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r310146,r311912,r312369,r312617,r312614,r312659,r312974,r312977,r313005,r314826: A series of Clang-related powerpc commits r310146: Use the right bitwise OR operation for clearing single-step at trap time. r311912: Force all TOC references in asm to include '@toc' r312369: Use the explicit expanded form of cmp. r312617: Hide the 'MOREARGS' macro, it conflicts with contrib code, and is only used in one file. r312614: Don't pass -Wa,-many through clang, the integrated as doesn't support it. r312659: Avoid using non-zero argument for __builtin_frame_address(). r312974: Add a INTR_TRIG_INVALID, and use it in the powerpc interrupt code. r312977: Force the setting of bit 7 in the sysmouse packet byte 1 to be unsigned. r313005: Update CFLAGS for clang compatibility r314826: Clang in base now supports -mlongcall, so remove this hack
| * MFC r313769:trasz2017-04-011-1/+1
| | | | | | | | | | | | | | Fix definition of linux64 ptrace syscall. Relnotes: yes Sponsored by: DARPA, AFRL
| * MFC: 313176, 313177, 313359gnn2017-03-303-0/+4
| | | | | | | | | | | | | | | | Replace the implementation of DTrace's RAND subroutine for generating low-quality random numbers with a modern implementation (xoroshiro128+) that is capable of generating better quality randomness without compromising performance. Submitted by: Graeme Jenkinson
| * MFC r314048,r314194: reimplement zfsctl (.zfs) supportavg2017-03-231-1/+0
| |
| * MFC r304572 (by bz):ae2017-03-183-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the kernel optoion for IPSEC_FILTERTUNNEL, which was deprecated more than 7 years ago in favour of a sysctl in r192648. MFC r305122: Remove redundant sanity checks from ipsec[46]_common_input_cb(). This check already has been done in the each protocol callback. MFC r309144,309174,309201 (by fabient): IPsec RFC6479 support for replay window sizes up to 2^32 - 32 packets. Since the previous algorithm, based on bit shifting, does not scale with large replay windows, the algorithm used here is based on RFC 6479: IPsec Anti-Replay Algorithm without Bit Shifting. The replay window will be fast to be updated, but will cost as many bits in RAM as its size. The previous implementation did not provide a lock on the replay window, which may lead to replay issues. Obtained from: emeric.poupon@stormshield.eu Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D8468 MFC r309143,309146 (by fabient): In a dual processor system (2*6 cores) during IPSec throughput tests, we see a lot of contention on the arc4 lock, used to generate the IV of the ESP output packets. The idea of this patch is to split this mutex in order to reduce the contention on this lock. Update r309143 to prevent false sharing. Reviewed by: delphij, markm, ache Approved by: so Obtained from: emeric.poupon@stormshield.eu Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D8130 MFC r313330: Merge projects/ipsec into head/. Small summary ------------- o Almost all IPsec releated code was moved into sys/netipsec. o New kernel modules added: ipsec.ko and tcpmd5.ko. New kernel option IPSEC_SUPPORT added. It enables support for loading and unloading of ipsec.ko and tcpmd5.ko kernel modules. o IPSEC_NAT_T option was removed. Now NAT-T support is enabled by default. The UDP_ENCAP_ESPINUDP_NON_IKE encapsulation type support was removed. Added TCP/UDP checksum handling for inbound packets that were decapsulated by transport mode SAs. setkey(8) modified to show run-time NAT-T configuration of SA. o New network pseudo interface if_ipsec(4) added. For now it is build as part of ipsec.ko module (or with IPSEC kernel). It implements IPsec virtual tunnels to create route-based VPNs. o The network stack now invokes IPsec functions using special methods. The only one header file <netipsec/ipsec_support.h> should be included to declare all the needed things to work with IPsec. o All IPsec protocols handlers (ESP/AH/IPCOMP protosw) were removed. Now these protocols are handled directly via IPsec methods. o TCP_SIGNATURE support was reworked to be more close to RFC. o PF_KEY SADB was reworked: - now all security associations stored in the single SPI namespace, and all SAs MUST have unique SPI. - several hash tables added to speed up lookups in SADB. - SADB now uses rmlock to protect access, and concurrent threads can do SA lookups in the same time. - many PF_KEY message handlers were reworked to reflect changes in SADB. - SADB_UPDATE message was extended to support new PF_KEY headers: SADB_X_EXT_NEW_ADDRESS_SRC and SADB_X_EXT_NEW_ADDRESS_DST. They can be used by IKE daemon to change SA addresses. o ipsecrequest and secpolicy structures were cardinally changed to avoid locking protection for ipsecrequest. Now we support only limited number (4) of bundled SAs, but they are supported for both INET and INET6. o INPCB security policy cache was introduced. Each PCB now caches used security policies to avoid SP lookup for each packet. o For inbound security policies added the mode, when the kernel does check for full history of applied IPsec transforms. o References counting rules for security policies and security associations were changed. The proper SA locking added into xform code. o xform code was also changed. Now it is possible to unregister xforms. tdb_xxx structures were changed and renamed to reflect changes in SADB/SPDB, and changed rules for locking and refcounting. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9352 MFC r313331: Add removed headers into the ObsoleteFiles.inc. MFC r313561 (by glebius): Move tcp_fields_to_net() static inline into tcp_var.h, just below its friend tcp_fields_to_host(). There is third party code that also uses this inline. MFC r313697: Remove IPsec related PCB code from SCTP. The inpcb structure has inp_sp pointer that is initialized by ipsec_init_pcbpolicy() function. This pointer keeps strorage for IPsec security policies associated with a specific socket. An application can use IP_IPSEC_POLICY and IPV6_IPSEC_POLICY socket options to configure these security policies. Then ip[6]_output() uses inpcb pointer to specify that an outgoing packet is associated with some socket. And IPSEC_OUTPUT() method can use a security policy stored in the inp_sp. For inbound packet the protocol-specific input routine uses IPSEC_CHECK_POLICY() method to check that a packet conforms to inbound security policy configured in the inpcb. SCTP protocol doesn't specify inpcb for ip[6]_output() when it sends packets. Thus IPSEC_OUTPUT() method does not consider such packets as associated with some socket and can not apply security policies from inpcb, even if they are configured. Since IPSEC_CHECK_POLICY() method is called from protocol-specific input routine, it can specify inpcb pointer and associated with socket inbound policy will be checked. But there are two problems: 1. Such check is asymmetric, becasue we can not apply security policy from inpcb for outgoing packet. 2. IPSEC_CHECK_POLICY() expects that caller holds INPCB lock and access to inp_sp is protected. But for SCTP this is not correct, becasue SCTP uses own locks to protect inpcb. To fix these problems remove IPsec related PCB code from SCTP. This imply that IP_IPSEC_POLICY and IPV6_IPSEC_POLICY socket options will be not applicable to SCTP sockets. To be able correctly check inbound security policies for SCTP, mark its protocol header with the PR_LASTHDR flag. Differential Revision: https://reviews.freebsd.org/D9538 MFC r313746: Add missing check to fix the build with IPSEC_SUPPORT and without MAC. MFC r313805: Fix LINT build for powerpc. Build kernel modules support only when both IPSEC and TCP_SIGNATURE are not defined. MFC r313922: For translated packets do not adjust UDP checksum if it is zero. In case when decrypted and decapsulated packet is an UDP datagram, check that its checksum is not zero before doing incremental checksum adjustment. MFC r314339: Document that the size of AH ICV for HMAC-SHA2-NNN should be half of NNN bits as described in RFC4868. PR: 215978 MFC r314812: Introduce the concept of IPsec security policies scope. Currently are defined three scopes: global, ifnet, and pcb. Generic security policies that IKE daemon can add via PF_KEY interface or an administrator creates with setkey(8) utility have GLOBAL scope. Such policies can be applied by the kernel to outgoing packets and checked agains inbound packets after IPsec processing. Security policies created by if_ipsec(4) interfaces have IFNET scope. Such policies are applied to packets that are passed through if_ipsec(4) interface. And security policies created by application using setsockopt() IP_IPSEC_POLICY option have PCB scope. Such policies are applied to packets related to specific socket. Currently there is no way to list PCB policies via setkey(8) utility. Modify setkey(8) and libipsec(3) to be able distinguish the scope of security policies in the `setkey -DP` listing. Add two optional flags: '-t' to list only policies related to virtual *tunneling* interfaces, i.e. policies with IFNET scope, and '-g' to list only policies with GLOBAL scope. By default policies from all scopes are listed. To implement this PF_KEY's sadb_x_policy structure was modified. sadb_x_policy_reserved field is used to pass the policy scope from the kernel to userland. SADB_SPDDUMP message extended to support filtering by scope: sadb_msg_satype field is used to specify bit mask of requested scopes. For IFNET policies the sadb_x_policy_priority field of struct sadb_x_policy is used to pass if_ipsec's interface if_index to the userland. For GLOBAL policies sadb_x_policy_priority is used only to manage order of security policies in the SPDB. For IFNET policies it is not used, so it can be used to keep if_index. After this change the output of `setkey -DP` now looks like: # setkey -DPt 0.0.0.0/0[any] 0.0.0.0/0[any] any in ipsec esp/tunnel/87.250.242.144-87.250.242.145/unique:145 spid=7 seq=3 pid=58025 scope=ifnet ifname=ipsec0 refcnt=1 # setkey -DPg ::/0 ::/0 icmp6 135,0 out none spid=5 seq=1 pid=872 scope=global refcnt=1 Obtained from: Yandex LLC Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9805 PR: 212018 Relnotes: yes Sponsored by: Yandex LLC
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2017-03-137-3/+21
|\ \ | |/
| * MFC r314644:ngie2017-03-121-0/+1
| | | | | | | | Fix "make depend" with geom_uzip.ko: add opt_geom.h to SRCS
| * MFC r314645:ngie2017-03-121-0/+1
| | | | | | | | Fix "make depend" with nvme.ko: add opt_cam.h to SRCS
| * MFC r313898, r313902, r313903, r313934, r314087, r314252:kib2017-03-031-2/+5
| | | | | | | | Merge i386 and amd64 mtrr drivers.
| * MFC r314535:gonzo2017-03-022-2/+2
| | | | | | | | | | | | | | | | | | [intelspi][bytgio] Fix buildworld with MODULES_WITH_WORLD set Add opt_platform.h and opt_acpi.h to the dependencies so modules can be built as a part of buildworld when MODULES_WITH_WORLD is set Reported by: Andre Albsmeier (for 11-stable)
| * MFC r313919: Add dtb files for Boundary Devices Nitrogen 6 family boards.ian2017-03-011-0/+3
| |
| * MFC r310645:gonzo2017-02-272-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [intelspi] Add SPI driver for Intel BayTrail SoC Add SPI mode (PIO-only) support for Intel Synchronous Serial Port that can be found in several Intel's products starting from PXA family. Most of implementations have slight differences in behavior and in addresses for registers subset. This driver covers only BayTrail SoC implementation for it's the only hardware I have to test it on. Driver attaches to ACPI bus only and does not have PCI or FDT support for now due to lack of hardware to test it on. "intelspi" is the best name I've managed to come up with. Linux driver name (spi-pxa2xx) does not make sense because current implementation does not support actual PXA2xx SoCs. And as far as I know there is no codename assigned to Intel SSP chip. Reviewed by: br, manu Differential Revision: https://reviews.freebsd.org/D8896
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2017-02-231-17/+17
|\ \ | |/
| * MFC r312513:ngie2017-02-101-17/+17
| | | | | | | | | | | | Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones This simplifies pathing in make/displayed output
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Luiz Otavio O Souza2017-02-094-3/+19
|\ \ | |/
| * MFC r312935:ngie2017-02-041-1/+0
| | | | | | | | | | | | Remove duplicate bhnd SUBDIR entry PR: 216413
| * MFC r308458, r311157 and r312347:loos2017-01-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the DTS for the Netgate SG-1000 (micro-Firewall). Remove a GPL licensed DTS. The micro-Firewall DTS is now a single BSD licensed file. The write-protect is not wired on uFW, disable it to allow writes to SD card. Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)
| * MFC r311911, r311923gonzo2017-01-232-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r311911: [sdhci] Add ACPI platform support for SDHCI driver - Create ACPI version of SDHCI attach/detach/accessors logic. Some platforms (e.g. BayTrail-based Minnowboard) expose SDHCI devices via ACPI, not PCI - Add sdchi_acpi kernel module Reviewed by: ian, imp Differential Revision: https://reviews.freebsd.org/D9112 r311923: Add acpi_if.h and opt_acpi.h to Makefile to unbreak "make depend" with sys/modules/sdhci_acpi X-MFC with: r311911 Reported by: Jenkins
| * MFC r303166:ngie2017-01-171-0/+1
| | | | | | | | | | | | r303166 (by imp): Add opt_ddb.h.
| * MFC r310621:gonzo2017-01-091-2/+7
| | | | | | | | | | | | | | | | | | | | [ig4] Add ACPI platform support for ig4 driver Add ACPI part for ig4 driver to make it work on Intel BayTrail SoC where ig4 device is available only through ACPI Reviewed by: avg Differential Revision: https://reviews.freebsd.org/D8742
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2017-01-096-7/+13
|\ \ | |/
| * MFC r310151 and r311173.np2017-01-063-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | r310151: cxgbe(4): Changes to the default T6 firmware configuration file. - Disable features that are not supported or not used on FreeBSD. - Increase the RSS table slice per interface. - Increase the share of the TCAM reserved for filtering. r311173: cxgbe(4): Update T4, T5 and T6 firmwares to 1.16.26.0. Sponsored by: Chelsio Communications
| * MFC r310817arybchik2017-01-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | sfxge(4): remove obsolete Wake-On-LAN support Wake-on-lan is not supported in production on any of our adapters, as they don't have the required AUX power connector. (It's possible that AUX power is supplied to some of our ALOM or mezz adapters, but if so then we've never implemented or tested WoL support.) Sponsored by: Solarflare Communications, Inc.
OpenPOWER on IntegriCloud