FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F12.4 2022-09-07T07:55:40Z 2022-09-07T07:55:40Z Gordon Bergling gbe@FreeBSD.org 2022-09-04T11:48:21Z urn:sha1:4f4afebc8e13e9531314d8379d8ed56b0ff870c6 - s/the the/the/ (cherry picked from commit d6f9a3c0a8b11fa0e26e364266e37805ca1dcca2) 2022-04-04T00:46:34Z Ed Maste emaste@FreeBSD.org 2022-03-28T13:33:54Z urn:sha1:56d0638c738e3f9b7fbc7f78bd49590523e01ada *_CFG_PAGE ioctl handlers in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Add checks that the size is at least the required minimum. Note that the device nodes are owned by root:operator with 0640 permissions so the ioctls are not available to unprivileged users. This change includes suggestions from scottl, markj and mav. Two of the mpt cases were reported by Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative; scottl reported the third case in mpt. Same issue found in mpr and mps after discussion with imp. Reported by: Lucas Leong (@_wmliang_), Trend Micro Zero Day Initiative Reviewed by: imp, mav MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D34692 (cherry picked from commit 8276c4149b5fc7c755d6b244fbbf6dae1939f087) 2021-12-01T18:52:36Z Edward Tomasz Napierala trasz@FreeBSD.org 2021-05-21T06:42:08Z urn:sha1:a1e06684e708cca9eba2c3978c20a9552a55283f Reviewed By: imp Sponsored by: NetApp, Inc. Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D30301 (cherry picked from commit 7608b98c4394590840a53d2b38b908582253de32) 2021-12-01T18:51:24Z Alexander Motin mav@FreeBSD.org 2021-04-24T03:18:01Z urn:sha1:9d842d84f49af6d4aacaea694dcaea4173522684 Allow new enclosure to replace previously existing one if there is no completely unused table entry, same as it is done for devices. If we can not process DPM due to corruption -- wipe it and restart from scratch. Otherwise I don't see a way to recover persistence if something go wrong and there is no BIOS to recover it for us. Together this solves a problem that appeared when 9300-8i firmware update to 16.00.10.00 somehow switched its mapping mode from Device Persistence to Enclosure/Slot without wiping the DPM table. It made HBA completely unusable, since overflowed and conflicting mapping table was unable to map any of enclosures and so devices. Also while there make some enclosure mapping errors more informative. MFC after: 1 month Sponsored by: iXsystems, Inc. (cherry picked from commit b99419aee49e2cc53747730be4d0ec4f9b330eb2) 2021-12-01T18:46:48Z John Baldwin jhb@FreeBSD.org 2021-03-12T17:47:58Z urn:sha1:9d98b001a8c5dad3735796e22ad0e4e776c91d4e Reviewed by: imp, kib MFC after: 1 week Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D29205 (cherry picked from commit 645b15e558dc102ff70a6332b1d0b0aa733fd2bb) 2021-01-11T14:43:37Z Mark Johnston markj@FreeBSD.org 2021-01-08T18:32:04Z urn:sha1:ed6fa9d618bff47dcd3fb000e5805e29d331578d Previously we copied in the request into a stack-allocated structure that could be smaller than the request size. Furthermore, we checked the request size only after doing the copyin. Fix this by allocating a buffer to hold the request, then copying the buffer's contents into a command descriptor. This is a bit heavy-handed but I expect the overhead will not be noticeable. The approach of coping the header in first is susceptible to TOCTOU problems. Reviewed by: imp Reported by: maxpl0it@protonmail.com Differential Revision: https://reviews.freebsd.org/D27963 (cherry picked from commit de828a91db29fb20440e0d92f3d3136b314a9584) 2021-01-11T14:43:17Z Mark Johnston markj@FreeBSD.org 2021-01-08T18:32:05Z urn:sha1:ee01a1e7d862a5a33b43b8ae9da220d83f089c21 The device mapping table contains sc->max_devices entries, so only indices in [0, sc->max_devices) are valid. Differential Revision: https://reviews.freebsd.org/D27964 (cherry picked from commit adc0dcc352bb9f5a67a054d95c6959ea5aa26d91) 2020-11-24T13:17:12Z Alexander Motin mav@FreeBSD.org 2020-11-24T13:17:12Z urn:sha1:4b74fa5dd5aef9786aee4f9359be15b9da9a096d SAM-3 specification introduced concept of Task Priority, that was renamed to Command Priority in SAM-4, and supported by all modern SCSI transports. It provides 15 levels of relative priorities: 1 - highest, 15 - lowest and 0 - default. SAT specification for SATA devices translates priorities 1-3 into NCQ high priority. This change adds new "priority" field into empty spots of struct ccb_scsiio and struct ccb_accept_tio of CAM and struct ctl_scsiio of CTL. Respective support is added into iscsi(4), isp(4), mpr(4), mps(4) and ocs_fc(4) drivers for both initiator and where applicable target roles. Minimal support was added to CTL to receive the priority value from different frontends, pass it between HA controllers and report in few places. This patch does not add consumers of this functionality, so nothing should really change yet, since the field is still set to 0 (default) on initiator and not actively used on target. Those are to be implemented separately. I've confirmed priority working on WD Red SATA disks connected via mpr(4) and properly transferred to CTL target via iscsi(4), isp(4) and ocs_fc(4). While there, added missing tag_action support to ocs_fc(4) initiator role. 2020-08-11T00:41:48Z Alexander Motin mav@FreeBSD.org 2020-08-11T00:41:48Z urn:sha1:0611f3541ea76c9498330a78f6abd7cca4795321 This memset() wiped MPI2_FUNCTION_SCSI_TASK_MGMT set by mprsas_alloc_tm(), that broke target reset on device removal, making later re-insertion into the same slot impossible, since firmware was still waiting for the driver to finish with the removed device. 2020-08-03T23:06:33Z Mark Johnston markj@FreeBSD.org 2020-08-03T23:06:33Z urn:sha1:9c4a78a41a2cdce7b1a749ad9a295a8953faa9ab mpr(4), mps(4): Stop checking for failures from malloc(M_WAITOK).