Home | History | Annotate | Download | only in dev
History log of /src/sys/dev/cgd.c
RevisionDateAuthorComments
 1.146  02-Apr-2022  riastradh cgd(4): Omit technically-correct-but-broken adiantum dependency again.

It is true that cgd_crypto.c depends on sys/crypto/adiantum now, and
transitively on sys/crypto/aes.

However, there's a problem with the cgd module having a formal
(transitive) module dependency on the aes module.

Yesterday I thought the problem with this was that fpu_kern_enter was
artificially restricted while cold -- to detect, and noisily crash
on, reentrance, it raises the IPL to IPL_VM, asserts that the IPL is
not _higher_ (so it can't be re-entered by an IPL_SCHED or IPL_HIGH
interrupt), and asserts that it's not currently in use on the current
CPU.

Early at boot, the IPL is at IPL_HIGH, and no interrupts are possible
anyway, so the assertions tripped for artificial reasons, which I
fixed in:

https://mail-index.netbsd.org/source-changes/2022/04/01/msg137840.html

However, I had forgotten that there's a deeper problem for the cgd
module dependency on aes. The ordering of events is:

1. Initialize builtin MODULE_CLASS_DRIVER modules -- including cgd.

2. Run configure -- including detecting CPUs, which on aarch64 is
where the decision of which AES (and ChaCha) implementation to use
based on supported CPU features.

3. Initialize builtin MODULE_CLASS_MISC modules -- including aes,
_if_ there are no driver-class modules that depend on it.

There's a tangle of ordering dependencies here:

- MODULE_CLASS_DRIVER modules providing _autoconf_ drivers generally
have to be initialized _before_ configure, because you need the
driver to be initialized before configure can attach its devices.

- configure must run _before_ aes is initialized because the decision
of which AES implementation to choose depends on CPU features
detected in configure, and the prospect of dynamically changing the
AES implementation is too painful to contemplate (it may change the
key schedule, so it would invalidate any existing key schedules
precomputed by callers like uvm_swap or configured cgd devices,
which raises a host of painful concurrency issues to invalidate
these cached key schedules on all CPUs in all subsystems using
them).

- cgd doesn't figure into the configure stage of autoconf, but it
nevertheless has to be MODULE_CLASS_DRIVER because specfs autoloads
MODULE_CLASS_DRIVER modules in case they provide _devsw_ drivers
(i.e., /dev nodes), as cgd does. And we don't have a mechanism for
identifying `autoconf driver modules' separately from `devsw driver
modules' because some modules provide both and each module can have
only one class.

For now, this is breaking boot on several tier I architectures so
let's nix the cgd->adiantum->aes module dependency as a stop-gap
measure.
 1.145  01-Apr-2022  pgoyette Create a loaable adiantum module, and make cgd require it.

This enablees use of a loadable cgd module, rather thtan requiring
it to be built-in.

Partially resolves kern/56772
 1.144  01-Apr-2022  riastradh cgd(4): Remove recently added dependency on adiantum.

While this dependency is technically correct, it triggers a problem
with module initialization for builtin modules that manifests as an
instant crash on boot for x86 (and likely arm) kernels, and that
problem is not trivial to solve immediately. See the top of
sys/crypto/aes/aes_impl.c for a summary of the problem and why it's
tricky.

So as a stop-gap measure, we'll remove this dependency for now; we
can reinstate it later once the underlying problem with module
initialization order is resolved.

Reported-by: syzbot+e9b3550af985b6557414@syzkaller.appspotmail.com
(actually first reported, to my knowledge, by pgoyette@, but this
line tells syzkaller that we fixed the problem)
 1.143  31-Mar-2022  pgoyette For device modules that provide both auto-config and /dev/xxx
interfaces, make sure that initialization and destruction
follow the proper sequence. This is triggered by the recent
changes to the devsw stuff; per riastradh@ the required call
sequence is:

devsw_attach()
config_init_component() or config_cf*_attach()
...
config_fini_component() or config_cf*_detach()
devsw_detach()

While here, add a few missing calls to some of the detach
routines.

Testing of these changes has been limited to:
1. compile without build break
2. no related test failures from atf
3. modload/modunload work as well as
before.

No functional device testing done, since I don't have any
of these devices. Let me know of any damage I might cause
here!

XXX Some of the modules affected by this commit are already
XXX broken; see kern/56772. This commit does not break
any additional modules (as far as I know).
 1.142  27-Dec-2021  riastradh cgd(4): Fix criterion for detach when wedgies are held.

The somewhat confusingly named DK_BUSY(dksc, pmask) answers the
following question:

Suppose I hold either the character or the block device (but
not both) of all of the partitions in pmask. Is anyone else
using the disk, rendering it unsafe to detach?

This is useful for ioctls like CGDIOCCLR and VNDIOCCLR, which must be
issued on open file descriptors for the disk, so the question cannot
simply be answered by testing whether dk_openmask != 0.

Instead, DK_BUSY breaks the question into the following criteria:

1. Are there any _other_ partitions than those in pmask open
at all? If so, it must be someone else, since I only hold
partitions in pmask -- hence the disk is busy.

2. Are any of the partitions in pmask open _both_ as a block
device _and_ as a character device? If so, it must be
someone else, since I only hold _either_ the character
_or_ the block device open but not both -- hence the disk
is busy.

When config_detach_all runs at shutdown time, it tries to detach
cgd(4), which has DVF_DETACH_SHUTDOWN; this is important so we submit
queued writes to the underlying disk and wait for them to complete
with dk_drain.

If cgd(4) has any dk wedges with file systems mounted still
configured on it, it isn't ready to detach yet. But asking
DK_BUSY(dksc, 1 << RAW_PART) returns false, because the dk wedges
only hold RAW_PART open as a block device -- so if nobody has
RAW_PART open as a character device, or any other partitions open,
cgd_detach blithely goes on its way to forcibly detach the wedges.

Instead, ask DK_BUSY(dksc, 0), because the caller -- cgd_detach
issued by config_detach_all -- does not, in fact, hold any partitions
open, so it doesn't need to work around them like ioctl(CGDIOCCLR)
does. Fixes hang in zfs on dk on cgd during shutdown (and probably
also zfs on cgd without any intervening dk but I haven't tested).

(This change might have the side effect that `drvctl -d cgdN' doesn't
work, but I don't care.)

XXX pullup-9
XXX pullup-8 (...-7, -6, -5...)
 1.141  13-Dec-2021  riastradh cgd(4): Wait for worker threads to complete before destroying mutex.

Fixes PR kern/56546 (probably!).
 1.140  17-Oct-2021  jmcneill Upgrade cgd self-test output from verbose to debug.
 1.139  01-Aug-2020  riastradh Fix whitespace.
 1.138  01-Aug-2020  riastradh Run cgd(4) crypto threads with the FPU/SIMD units pre-enabled.

Improves cgd throughput on systems with vectorized crypto by ~20%.
 1.137  29-Jun-2020  riastradh cgd(4): Align IVs on the stack.

This will make it easier for some hardware crypto support.
 1.136  29-Jun-2020  riastradh cgd(4): Print which key size is broken when a self-test fails.

Can be gleaned from the test index but this is a little quicker.
 1.135  17-Jun-2020  riastradh Spell `blowfish-cbc' as such, not like `bf-cbc'.

Gotta match the name we actually use for this to work!

Should fix the cgd blowfish-cbc encblkno8 test failures reported at

https://mail-index.netbsd.org/current-users/2020/06/15/msg038871.html
 1.134  13-Jun-2020  riastradh Fix encblkno8 legacy support. Add a test vector while here.

What a crock!

This is deliberately _not_ neatly abstracted because the whole
configurable `iv method' mechanism is a mistake and should never be
used for anything new.
 1.133  13-Jun-2020  riastradh Constify.
 1.132  13-Jun-2020  riastradh Eliminate uio indirection for cgd crypto.

We don't actually use it, and we only ever used it kludgily in the
CBC encryption direction in the past anyway.
 1.131  13-Jun-2020  riastradh Move cgd selftest from module init to cgdattach.

This defers it until considerably later at boot, after cpu_attach has
run, which will be needed in order to make AES-NI work.
 1.130  13-Jun-2020  riastradh Specify which cgd self-test failed and dump the mismatch.
 1.129  13-Jun-2020  riastradh Tidy up includes.
 1.128  13-Jun-2020  riastradh Print cgd self-test noise only with verbose boot.
 1.127  13-Jun-2020  riastradh Fold `cipher prep' into `cipher' in cgd.

Simplify some logic along the way and u_int*_t -> uint*_t.
 1.126  04-Jun-2020  riastradh Add self-tests for 3des and blowfish too.

Nobody should use these on new disks but it is good to have them so
we don't break decrypting old disks.
 1.125  13-Apr-2020  maxv constify
 1.124  20-Mar-2020  tnn branches: 1.124.2;
cgd: switch from malloc(9) to kmem(9)

XXX might be worthwhile to use pool_cache(9) in the write path
 1.123  11-Mar-2020  mlelstv Don't wait for data buffer.
 1.122  09-Mar-2020  mlelstv Defer crypto operations to a workqueue and make it utilize all CPUs.
Make device mpsafe.
Some code cleanup.
 1.121  02-Mar-2020  riastradh New ioctl DIOCGSECTORALIGN returns sector alignment parameters.

struct disk_sectoralign {
/* First aligned sector number. */
uint32_t dsa_firstaligned;

/* Number of sectors per aligned unit. */
uint32_t dsa_alignment;
};

- Teach wd(4) to get it from ATA.
- Teach cgd(4) to pass it through from the underlying disk.
- Teach dk(4) to pass it through with adjustments.
- Teach zpool (zfs) to take advantage of it.
=> XXX zpool doesn't seem to understand when the vdev's starting
sector is misaligned.

Missing:

- ccd(4) and raidframe(4) support -- these should support _using_
DIOCGSECTORALIGN to decide where to start putting ccd or raid
stripes on disk, and these should perhaps _implement_
DIOCGSECTORALIGN by reporting the stripe/interleave factor.

- sd(4) support -- I don't know any obvious way to get it from SCSI,
but if any SCSI wizards know better than I, please feel free to
teach sd(4) about it!

- any ld(4) attachments -- might be worth teaching the ld drivers for
nvme and various raid controllers to get the aligned sector size

There's some duplicate logic here for now. I'm doing it this way,
rather than gathering the logic into a new disklabel_sectoralign
function or something, so that this change is limited to adding a new
ioctl, without any new kernel symbols, in order to make it easy to
pull up to netbsd-9 without worrying about the module ABI.
 1.120  01-Mar-2020  riastradh Add a flag to dk_dump for virtual disk devices.

If a disk is backed by a physical medium other than itself, such as
cgd(4), then it passes DK_DUMP_RECURSIVE to disable the recursion
detection for dk_dump.

If, however, a device represents a physical medium on its own, such
as wd(4), then it passes 0 instead.

With this, I can now dump to dk on cgd on dk on wd.
 1.119  17-Jan-2020  ad Acquire kernel_lock in the bp->b_iodone callback.
 1.118  14-Dec-2019  riastradh branches: 1.118.2;
Just use KASSERTMSG and panic. No need for custom wrappers.
 1.117  08-Dec-2019  mlelstv Switch to vn_bdev_open* functions.
 1.116  23-Jan-2018  pgoyette branches: 1.116.4; 1.116.10;
Add "bufq_fcfs" requirement to all those driver modules that explicitly
request it in their calls to bufq_alloc().
 1.115  28-Oct-2017  riastradh Kill some more extern cfdriver xyz_cd in favour of #include "ioconf.h".
 1.114  27-Feb-2017  jdolecek branches: 1.114.4; 1.114.6;
pass also DIOCGCACHE to underlying device, so that upper layers would be able
to get device cache properties without knowing the topology
 1.113  22-Dec-2016  kamil branches: 1.113.2;
The cgd(4) module requires des and blowfish symbols

This has been exposed with the MODULAR kernel.

kobj_checksyms, 979: [cgd]: linker error: symbol `BF_set_key' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_key_sched' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_ede3_cbc_encrypt' not found
WARNING: module error: unable to affix module `cgd', error 8

Reviewed by <riastradh>
 1.112  11-Dec-2016  alnsn Add XTS mode to cgd(4).
 1.111  14-Sep-2016  mlelstv Fix error handling in cgdstrategy().

- check cgd_softc != NULL, may happen in rare memory shortage situations.
- no longer test geometry, the same check is done in dk_strategy which
knows to check for an uninitialized geometry.
 1.110  05-Aug-2016  pgoyette Ignore return values when restoring what has just been undone. We're
really just putting back something that was there before, so we should
not get any errors, and a panic() would be rather severe.

This and the corresponding commit to vnd.c address newly reported
Coverity CID 1364761 and CID 1364760
 1.109  25-Jul-2016  pgoyette When initializing the rump cgd component, use the correct driver name
(as found in the devsw_conv[] table). This will get us the "official"
major numbers for the cgd device.

After creating the rump file-space nodes for /dev/cgd* we then need to
detach the [bc]devsw's because normal module initialization will do its
own attachment, and we don't want that to fail.

While here, since we're doing the devsw_attach() twice, share the
results from the first call rather than starting from scratch.
 1.108  10-Jul-2016  riastradh branches: 1.108.2;
Make kernel core dumps on cgd(4) work.
 1.107  07-Jul-2016  msaitoh KNF. Remove extra spaces. No functional change.
 1.106  28-Nov-2015  mlelstv Remove bogus dk_getdisklabel call.

- there is no need to read the label in the attach routine
- passing a (dev_t)0 may cause havoc.

This fixes PR 41704.
 1.105  28-Nov-2015  mlelstv Inherit sector size from underlying disk to support disks with
sector sizes other than 512 bytes.

The CGD disk image depends on disk geometry as it encodes the block
number into each block. You cannot copy an image between disks
with different sector sizes.
 1.104  27-Aug-2015  mlelstv Make dksubr use a spin-mutex again, since some drivers still call dk_done
from hardware interrupt. Instead, release mutex while calling start routine.

The buffer peek/use/get sequence which can no longer be atomic. So consume
the buffer directly and on error privately save and retry the buffer later.
The dk_drain function is used to flush such a deferred buffer together with
the buffer queue.
Adjust drivers to use dk_drain.

Fix an error path where dk_done was called while the lock was already held.
 1.103  21-Aug-2015  christos don't allow STRATEGY if we are not inited.
 1.102  20-Aug-2015  christos include "ioconf.h" to get the 'void <driver>attach(int count);' prototype.
 1.101  19-Aug-2015  mlelstv restart queue when a request completes
 1.100  18-Aug-2015  mlelstv restore deleted lines that kept buffer fields resid,count and error consistent.
 1.99  16-Aug-2015  mlelstv Two changes to the dksubr interface.

- d_diskstart callback now processes a single buffer only.
The new wrapper function dk_start processes the queue,
performs other buffer handling and also provides locking
for the the data structures.

- add d_discard callback to handle device specific function inside
the new dk_discard helper function.

Replace splbio with mutex to protect queue and disk structure.
Refactor common code in dk_strategy and dk_discard into dk_translate.

Adjust and simplify ld(4), cgd(4) and xbd(4) drivers accordingly.

ld(4) now becomes MP_SAFE.

Bump kernel version.
 1.98  02-May-2015  mlelstv Merge dk_intf and dkdriver interfaces.
Merge common disk driver functionality in ld.c with dksubr.c.
Adjust the two previous users of dk_intf (cgd and xbd) to
the changes.

bump kernel version to 7.99.14
 1.97  25-Apr-2015  riastradh Use explicit_memset to zero key material.
 1.96  02-Jan-2015  christos We have three sets of DTYPE_ constants in the kernel:
altq Drop Type
disklabel Disk Type
file Descriptor Type
(not to mention constants that contain the string DTYPE).
Let's make them two, by changing the disklabel one to be DisK TYPE since the
other disklabel constants seem to do that. Not many userland programs use
these constants (and the ones that they do are mostly in ifdefs). They will
be fixed shortly.
 1.95  02-Jan-2015  christos these call dk_ioctl, no need to call disk_ioctl anymore.
 1.94  31-Dec-2014  christos make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.
 1.93  30-Dec-2014  christos return quickly from the GET ioctl to avoid playing with NULL.
 1.92  29-Dec-2014  mlelstv use disk_ioctl to provide DIOCGDISKINFO.
 1.91  02-Oct-2014  justin branches: 1.91.2;
devmajor_t not int
 1.90  25-Jul-2014  dholland branches: 1.90.2; 1.90.4;
Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.
 1.89  25-Jul-2014  dholland Add d_discard to all struct bdevsw instances I could find.

I've set them all to nodiscard. Some of them (wd, dk, vnd, ld,
raidframe, maybe cgd) should be implemented for real.
 1.88  14-Jun-2014  hannken Change dk_lookup() to return an anonymous vnode not associated with
any file system. Change all consumers of dk_lookup() to get the
device from "v_rdev" instead of VOP_GETATTR() as specfs does not
support VOP_GETATTR(). Devices obtained with dk_lookup() will no
longer disappear on forced unmounts.

Fix for PR kern/48849 (root mirror raid fails on shutdown)

Welcome to 6.99.44
 1.87  25-May-2014  bouyer As proposed in
https://mail-index.netbsd.org/tech-kern/2014/05/21/msg017098.html
remove dk_start() and dk_iodone() from dksubr.c and move the related code
to the underlying driver.
This increase complexity only marginally: the underlying drivers have
to do the while() loop themselves, but this can now be done properly with
bufq_peek()/bufq_get(), removing the buffer from the queue at the right time.
This handle both the recursion and reordering issues (the reordering
issue is described here:
https://mail-index.netbsd.org/tech-kern/2014/05/19/msg017089.html
the recursion isssue is PR #25240).

Difference with the patch posted to tech-kern@: KASSERT() that the
buffer we remove with bufq_get() is the same as the one we bufq_peek()'d
just before.
Hopefully this will allow more disk drivers to use dksubr.c
 1.86  25-May-2014  christos create on attach needs destroy on detach.
 1.85  18-Mar-2014  skrll branches: 1.85.2;
Remove a simplelock and replace with a kmutex
 1.84  16-Mar-2014  dholland Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.
 1.83  28-Dec-2013  pgoyette Make dksubr.c into a module, and make the cgd and dm modules depend on
it.

Now that cgd is completely modularized, descend into modules/cgd to
actually create the module.
 1.82  12-Sep-2013  martin #ifdef variable declarations/initializations like their use
 1.81  30-May-2013  martin branches: 1.81.2;
Avoid dereferencing an uninitialized pointer
 1.80  29-May-2013  christos eliminare dk_geom
 1.79  29-May-2013  christos phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.
 1.78  05-Dec-2012  christos add cgdconfig -l like vnconfig -l
 1.77  25-May-2012  elric branches: 1.77.2;
Modify dksubr.c to add a function that sets the disk properties in
the drvctl framework. And call this new functionality from cgd(4),
the consumer of dksubr.c. We do this to allow gpt(8) to be able
to label cgd(4) disks. We also add in some DIOCGSECTORSIZE logic
and we ensure that the WEDGE ioctls are not called on either
uninitialised disks or disks which have not been opened for write
access.
 1.76  13-Nov-2011  christos branches: 1.76.4; 1.76.6; 1.76.10; 1.76.12;
use getdisksize() instead of homebrew()
 1.75  14-Oct-2011  hannken branches: 1.75.2;
Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.
 1.74  21-Jun-2011  jruoho Adjust the #ifdefs such that ccd(4) and cgd(4) show in
modstat(8) even if built into the kernel.
 1.73  12-Jun-2011  rmind Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.
 1.72  19-May-2011  riastradh branches: 1.72.2;
Reject unaligned writes to cgd.

Fixes the following PRs:

PR kern/44515 (cgd dies on non-aligned writes to the raw device)
PR kern/44964 (cgd seems to panic on unaligned writes instead of giving EINVAL)

ok christos
 1.71  19-Nov-2010  dholland branches: 1.71.2;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.
 1.70  11-Feb-2010  joerg branches: 1.70.2;
Register with pmf.
 1.69  23-Jan-2010  bouyer branches: 1.69.2;
struct buf::b_iodone is not called at splbio() any more.
Make sure non-MPsafe iodone callbacks raise the SPL as appropriate.
Fix buffer corruption issue I noticed in dk(4), and probable similar
issues in vnd(4) and cgd(4).
 1.68  20-Jan-2010  dyoung Cosmetic: get out of cgdioctl() early. Instead of

int ret;

switch (...) {
case ...:
ret = ...;
break;
}
return ret;

write:

switch (...) {
case ...:
return ...;
}
 1.67  20-Jan-2010  dyoung Get out of cgd_detach() early on error. Do not call disk_destroy(9)
on error, that leaves the cgd_softc in an inconsistent state.

Fixes a crash during shutdown reported by Patrick Welche. Thanks
to Patrick for reporting and for testing the fix.
 1.66  12-Jan-2010  dyoung Provide a more complete modules hook, cgd_modcmd(), derived from
vnd_modcmd().
 1.65  12-Jan-2010  dyoung Make cgd(4) into a detachable pseudo-device. Thanks, Jan Danielsson,
for the patches!

I've lightly tested the basics: create cgd0 on vnd0d, initialize with
zeros, newfs /dev/cgd0a, mount, copy files on, unmount, drvctl -d
cgd0. Works fine. I also shutdown with a cgd0 configured: detached as
expected.
 1.64  10-Nov-2009  christos avoid doing extra work by just zeroing/printing real blocksize.
 1.63  10-Nov-2009  christos add a missing c.
 1.62  10-Nov-2009  christos avoid variable array stack allocation by enforcing and allocating always the
maximum.
 1.61  10-Nov-2009  tron Backout the last two revisions because the cause panic on LOCKDEBUG
kernels. Problem reported by David Young.
 1.60  11-Sep-2009  tron Fix incomplete conversion from stack buffers to heap buffers.
 1.59  11-Sep-2009  tron Don't allocate block buffers on the stack. This can cause stack overflows
in the kernel and breaks SSP builds.
 1.58  05-Jun-2009  haad Add work in support for compiling ccd and cgd drivers as a modules. I forgot
to committ when I have written device module autoloading stuff.
 1.57  14-Mar-2009  apb Pass DIOCCACHESYNC ioctl down to the underlying disk.
Addresses PR 41016.
 1.56  11-Jan-2009  cegger branches: 1.56.2;
make this compile
 1.55  11-Jan-2009  christos merge christos-time_t
 1.54  21-Nov-2008  christos PR/38735: Jonathan A. Kollasch: add the ability for cgd to be used on top of wedges
 1.53  12-Sep-2008  christos branches: 1.53.2; 1.53.4;
PR/39525: Joachim Schueth, Frederik Sausmikat:
cgd inadvertently encrypts blkno eight times to generate IV
Add "encblkno1" IV type to encrypt only once, rename old "encblkno" to
"encblkno8" for clarity, and make "encblkno" an alias for "encblkno8"
for backward compatibility.
 1.52  28-Apr-2008  martin branches: 1.52.2; 1.52.6;
Remove clause 3 and 4 from TNF licenses
 1.51  21-Mar-2008  ad branches: 1.51.2; 1.51.4; 1.51.6;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.
 1.50  04-Jan-2008  ad branches: 1.50.6;
Start detangling lock.h from intr.h. This is likely to cause short term
breakage, but the mess of dependencies has been regularly breaking the
build recently anyhow.
 1.49  02-Jan-2008  ad Merge vmlocking2 to head.
 1.48  26-Nov-2007  pooka branches: 1.48.2; 1.48.6;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern
 1.47  08-Oct-2007  ad branches: 1.47.4;
Merge disk init changes from the vmlocking branch. These seperate init /
destroy of 'struct disk' from attach / detach.
 1.46  29-Jul-2007  ad branches: 1.46.4; 1.46.6; 1.46.8; 1.46.10;
It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.
 1.45  26-Jun-2007  cube branches: 1.45.2;
Change dk_lookup() to accept an additional argument of the type enum uio_seg
that tells whether the given path is in user space or kernel space, so it
can tell NDINIT().

While the raidframe calls were ok, both ccd(4) and cgd(4) were passing
pointers to user space data, which leads to strange error on i386, as
reported by Jukka Salmi on current-users.

The issue has been there since last august, I'm actually a bit surprised
that no one in the meantime has used ccd(4) or cgd(4) on an arch where it
would have simply faulted.
 1.44  04-Mar-2007  christos branches: 1.44.2; 1.44.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.
 1.43  19-Jan-2007  cbiere branches: 1.43.2;
cgd_ioctl_set():
* Corrected type of keybytes to size_t to prevent a potential buffer
overflow on 64-bit archs.
* Fixed incorrect but harmless use of sizeof.
hexprint():
* Corrected cast to prevent sign extension if char is signed.
 1.42  01-Dec-2006  christos branches: 1.42.2; 1.42.4;
- remove size check; the init functions do it.
- fix size_t/int confusion
- caddr_t -> void *
 1.41  25-Nov-2006  christos prevent blocksizes > 4K.
 1.40  16-Nov-2006  christos __unused removal on arguments; approved by core.
 1.39  12-Oct-2006  xtraeme Use __unused in function arguments where appropiate. (hi christos)
 1.38  12-Oct-2006  christos - sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386
 1.37  21-Jul-2006  ad branches: 1.37.4; 1.37.6;
- Use the LWP cached credentials where sane.
- Minor cosmetic changes.
 1.36  20-Jun-2006  christos don't allocate too much stuff on the stack.
 1.35  14-May-2006  elad branches: 1.35.4;
integrate kauth.
 1.34  04-Jan-2006  xtraeme branches: 1.34.2; 1.34.4; 1.34.6; 1.34.8; 1.34.10;
Make this build again (remove unused variable).
 1.33  04-Jan-2006  yamt - add simple functions to allocate/free a buffer for i/o.
- make bufpool static.
 1.32  11-Dec-2005  christos branches: 1.32.2;
merge ktrace-lwp.
 1.31  18-Oct-2005  yamt dksubr: do b_blkno -> b_rawblkno translation earlier so that bufq can uses it.
 1.30  15-Oct-2005  yamt - change the way to specify a bufq strategy. (by string rather than by number)
- rather than embedding bufq_state in driver softc,
have a pointer to the former.
- move bufq related functions from kern/subr_disk.c to kern/subr_bufq.c.
- rename method to strategy for consistency.
- move some definitions which don't need to be exposed to the rest of kernel
from sys/bufq.h to sys/bufq_impl.h.
(is it better to move it to kern/ or somewhere?)
- fix some obvious breakage in dev/qbus/ts.c. (not tested)
 1.29  20-Aug-2005  yamt add wedge support to xbd and cgd.
 1.28  20-Aug-2005  yamt use pseudo_disk_{init,attach,detach} where appropriate.
 1.27  28-Jun-2005  drochner branches: 1.27.2;
constification fallout
 1.26  31-May-2005  drochner cast-qual fallout
 1.25  31-May-2005  xtraeme Make this build with "-Wcast-qual -Wshadow".
 1.24  31-Mar-2005  explorer Looks like a 'struct buf *bp' was left over from a previosu commit. Since kernel builds stop on this, removing it.
 1.23  31-Mar-2005  yamt introduce a function to drain bufq and use it where appropriate.
 1.22  27-Feb-2005  perry branches: 1.22.2;
nuke trailing whitespace
 1.21  28-Oct-2004  yamt branches: 1.21.4; 1.21.6;
move buffer queue related stuffs from buf.h to their own header, bufq.h.
 1.20  04-Oct-2004  yamt fix debug printf formats to match with the recent sys/buf.h.
a patch provided by Ryo HAYASAKA. PR/27138.
 1.19  23-Aug-2004  thorpej Remove a comment that doesn't really make sense.
 1.18  23-Aug-2004  thorpej Use static in a few more places.
 1.17  19-Jul-2004  dbj . eliminate cgd specific buffer pool, use bufpool instead
and store previous buffer in bp->b_private.
. don't bother to raise splbio in cgdiodone
. use V_INCR_NUMOUTPUT
 1.16  27-Mar-2004  elric Modified the dksubr routines to:

o expect the disk's start routine to return an int. If the
int is non-zero, we enqueue the request and try again
later.
o have a dk_start() routine which runs the request queue.
o have a dk_iodone() function which should be called by the
driver using the framwork from its iodone. dk_iodone will
retry the queue since presumably further progress may be
possible once a request is complete. It is required that
the underlying driver have the resources to keep at least
one transaction in flight at any time.

Modified cgd to:

o be able to keep one transaction in flight at any time
(almost) by keeping a buffer of size MAXPHYS in its softc
and use it.

We still need to make the cgd_cbufpool per device rather than global
and provide a low water mark for it.

Addresses PR: kern/24715
(at least according to the submitter.)
 1.15  18-Mar-2004  dan Fix a longstanding bug in key-handling for the blowfish cipher.

This is an incompatible change, and will break all existing cgd images
encrypted with blowfish. Users will need to dump their data before
booting a kernel with this change, and recreate cgd's and restore data
afterwards.

I believe this affects a very small number of users other than myself;
indeed after several alert mails in an attempt to find them, only 2
such users have come forward. They have both agreed the requirement
for backwards compatibility does not warrant the effort nor the mess
in the code. This code does exist, if it should later prove to be
needed, but will not be in the tree.

Further, by the nature of the issue, I have strong reasons to believe
that, even if they missed these mails, there would be few other users
of blowfish who update their systems with any regularity; any such
users would have tripped over the problem in the same way I did when
it was first found over a year ago.

The problem stems from two issues with the underlying blowfish
encryption routines used by cgd:
- they take key length arguments counted in bytes, rather than bits
like all the opther ciphers.
- they silently truncate any keys longer than an internal limit,
rather than returning an error (which would have exposed the
previous discrepancy immediately).

As a result, the kernel reads too much data as the key from cgdconfig,
and then truncates most of it. This can easily be demonstrated/tested.
Currently, Blowfish users will find that if they mis-enter the cgd
passphrase on the first attempt, when validation fails and cgdconfig
prompts for the passphrase again, the cgd will not correctly configure
even when given a correct passphrase.
 1.14  25-Jan-2004  hannken Make VOP_STRATEGY(bp) a real VOP as discussed on tech-kern.

VOP_STRATEGY(bp) is replaced by one of two new functions:

- VOP_STRATEGY(vp, bp) Call the strategy routine of vp for bp.
- DEV_STRATEGY(bp) Call the d_strategy routine of bp->b_dev for bp.

DEV_STRATEGY(bp) is used only for block-to-block device situations.
 1.13  10-Jan-2004  yamt store a i/o priority hint in struct buf for buffer queue discipline.
 1.12  29-Jun-2003  fvdl branches: 1.12.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.
 1.11  28-Jun-2003  darrenr Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V
 1.10  17-May-2003  agc Test the right variable after allocating space, and then get rid of an
unused local variable.
 1.9  21-Mar-2003  dsl Use 'void *' instead of 'caddr_t' in prototypes of VOP_IOCTL, VOP_FCNTL
and VOP_ADVLOCK, delete casts from callers (and some to copyin/out).
 1.8  25-Feb-2003  thorpej Add a new BUF_INIT() macro which initializes b_dep and b_interlock, and
use it. This fixes a few places where either b_dep or b_interlock were
not properly initialized.
 1.7  05-Feb-2003  pk Make the buffer cache code MP-safe.
 1.6  02-Feb-2003  bouyer Fix DEBUG printf warning.
 1.5  01-Nov-2002  mrg implement separate read/write disk statistics:
- disk_unbusy() gets a new parameter to tell the IO direction.
- struct disk_sysctl gets 4 new members for read/write bytes/transfers.
when processing hw.diskstats, add the read&write bytes/transfers for
the old combined stats to attempt to keep backwards compatibility.

unfortunately, due to multiple bugs, this will cause new kernels and old
vmstat/iostat/systat programs to fail. however, the next time this is
change it will not fail again.

this is just the kernel portion.
 1.4  24-Oct-2002  jdolecek put back the D_DISK tag for cdevsw mistakely removed in previous
revision
 1.3  24-Oct-2002  augustss Make it compile after the kq changes.
XXX I'm not sure what kqfilter cgd should have, it gets nokqfilter for now.
 1.2  14-Oct-2002  elric branches: 1.2.2;
Allow debugging to work on LP64 arches.
 1.1  04-Oct-2002  elric The CryptoGraphic Disk Driver.
 1.2.2.3  11-Nov-2002  nathanw Catch up to -current
 1.2.2.2  18-Oct-2002  nathanw Catch up to -current.
 1.2.2.1  14-Oct-2002  nathanw file cgd.c was added on branch nathanw_sa on 2002-10-18 02:41:25 +0000
 1.12.2.10  10-Nov-2005  skrll Sync with HEAD. Here we go again...
 1.12.2.9  01-Apr-2005  skrll Sync with HEAD.
 1.12.2.8  04-Mar-2005  skrll Sync with HEAD.

Hi Perry!
 1.12.2.7  02-Nov-2004  skrll Sync with HEAD.
 1.12.2.6  19-Oct-2004  skrll Sync with HEAD
 1.12.2.5  21-Sep-2004  skrll Fix the sync with head I botched.
 1.12.2.4  18-Sep-2004  skrll Sync with HEAD.
 1.12.2.3  25-Aug-2004  skrll Sync with HEAD.
 1.12.2.2  03-Aug-2004  skrll Sync with HEAD
 1.12.2.1  02-Jul-2003  darrenr Apply the aborted ktrace-lwp changes to a specific branch. This is just for
others to review, I'm concerned that patch fuziness may have resulted in some
errant code being generated but I'll look at that later by comparing the diff
from the base to the branch with the file I attempt to apply to it. This will,
at the very least, put the changes in a better context for others to review
them and attempt to tinker with removing passing of 'struct lwp' through
the kernel.
 1.21.6.1  19-Mar-2005  yamt sync with head. xen and whitespace. xen part is not finished.
 1.21.4.1  29-Apr-2005  kent sync with -current
 1.22.2.2  06-Apr-2005  tron Pull up revision 1.24 (requested by yamt in ticket #112):
Looks like a 'struct buf *bp' was left over from a previosu commit. Since kernel builds stop on this, removing it.
 1.22.2.1  06-Apr-2005  tron Pull up revision 1.23 (requested by yamt in ticket #112):
introduce a function to drain bufq and use it where appropriate.
 1.27.2.8  24-Mar-2008  yamt sync with head.
 1.27.2.7  21-Jan-2008  yamt sync with head
 1.27.2.6  07-Dec-2007  yamt sync with head
 1.27.2.5  27-Oct-2007  yamt sync with head.
 1.27.2.4  03-Sep-2007  yamt sync with head.
 1.27.2.3  26-Feb-2007  yamt sync with head.
 1.27.2.2  30-Dec-2006  yamt sync with head.
 1.27.2.1  21-Jun-2006  yamt sync with head.
 1.32.2.1  15-Jan-2006  yamt sync with head.
 1.34.10.1  24-May-2006  tron Merge 2006-05-24 NetBSD-current into the "peter-altq" branch.
 1.34.8.1  08-Mar-2006  elad Adapt to kernel authorization KPI.
 1.34.6.3  11-Aug-2006  yamt sync with head
 1.34.6.2  26-Jun-2006  yamt sync with head.
 1.34.6.1  24-May-2006  yamt sync with head.
 1.34.4.1  01-Jun-2006  kardel Sync with head.
 1.34.2.1  09-Sep-2006  rpaulo sync with head
 1.35.4.1  13-Jul-2006  gdamore Merge from HEAD.
 1.37.6.2  10-Dec-2006  yamt sync with head.
 1.37.6.1  22-Oct-2006  yamt sync with head
 1.37.4.3  01-Feb-2007  ad Sync with head.
 1.37.4.2  12-Jan-2007  ad Sync with head.
 1.37.4.1  18-Nov-2006  ad Sync with head.
 1.42.4.1  03-Sep-2007  wrstuden Sync w/ NetBSD-4-RC_1
 1.42.2.1  01-Jul-2007  bouyer Pull up following revision(s) (requested by cube in ticket #748):
sys/dev/dksubr.c: revision 1.29
sys/dev/ccd.c: revision 1.120
sys/dev/raidframe/rf_disks.c: revision 1.66
sys/dev/raidframe/rf_reconstruct.c: revision 1.96
sys/dev/cgd.c: revision 1.45
sys/dev/dkvar.h: revision 1.11
sys/dev/raidframe/rf_copyback.c: revision 1.38
Change dk_lookup() to accept an additional argument of the type enum uio_seg
that tells whether the given path is in user space or kernel space, so it
can tell NDINIT().
While the raidframe calls were ok, both ccd(4) and cgd(4) were passing
pointers to user space data, which leads to strange error on i386, as
reported by Jukka Salmi on current-users.
 1.43.2.1  12-Mar-2007  rmind Sync with HEAD.
 1.44.4.1  11-Jul-2007  mjf Sync with head.
 1.44.2.7  24-Aug-2007  ad Sync with buffer cache locking changes. See buf.h/vfs_bio.c for details.
Some minor portions are incomplete and needs to be verified as a whole.
 1.44.2.6  20-Aug-2007  ad Sync with head.
 1.44.2.5  20-Aug-2007  ad - Alter disk attach/detach to fix a panic when closing a vnd device.
- Sync with HEAD.
 1.44.2.4  19-Aug-2007  ad - Back out the biodone() changes.
- Eliminate B_ERROR (from HEAD).
 1.44.2.3  15-Jul-2007  ad Sync with head.
 1.44.2.2  01-Jul-2007  ad V_INCR_NUMOUTPUT() is no more.
 1.44.2.1  13-May-2007  ad - Pass the error number and residual count to biodone(), and let it handle
setting error indicators. Prepare to eliminate B_ERROR.
- Add a flag argument to brelse() to be set into the buf's flags, instead
of doing it directly. Typically used to set B_INVAL.
- Add a "struct cpu_info *" argument to kthread_create(), to be used to
create bound threads. Change "bool mpsafe" to "int flags".
- Allow exit of LWPs in the IDL state when (l != curlwp).
- More locking fixes & conversion to the new API.
 1.45.2.1  15-Aug-2007  skrll Sync with HEAD.
 1.46.10.2  29-Jul-2007  ad It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.
 1.46.10.1  29-Jul-2007  ad file cgd.c was added on branch matt-mips64 on 2007-07-29 12:50:19 +0000
 1.46.8.1  14-Oct-2007  yamt sync with head.
 1.46.6.2  09-Jan-2008  matt sync with HEAD
 1.46.6.1  06-Nov-2007  matt sync with HEAD
 1.46.4.2  27-Nov-2007  joerg Sync with HEAD. amd64 Xen support needs testing.
 1.46.4.1  26-Oct-2007  joerg Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.
 1.47.4.2  18-Feb-2008  mjf Sync with HEAD.
 1.47.4.1  08-Dec-2007  mjf Sync with HEAD.
 1.48.6.2  08-Jan-2008  bouyer Sync with HEAD
 1.48.6.1  02-Jan-2008  bouyer Sync with HEAD
 1.48.2.1  04-Dec-2007  ad Pull the vmlocking changes into a new branch.
 1.50.6.5  17-Jan-2009  mjf Sync with HEAD.
 1.50.6.4  28-Sep-2008  mjf Sync with HEAD.
 1.50.6.3  02-Jun-2008  mjf Sync with HEAD.
 1.50.6.2  05-Apr-2008  mjf - add "file-system DEVFS" and "pseudo-device devfsctl" to conf/std seeing
as these are always needed.

- convert many, many drivers over to the New Devfs World Order. For a
list of device drivers yet to be converted see,
http://www.netbsd.org/~mjf/devfs-todo.html.

- add a new device_unregister_all(device_t) function to remove all device
names associated with a device_t, which saves us having to construct
device names when the driver is detached.

- add a DEV_AUDIO type for devices.
 1.50.6.1  03-Apr-2008  mjf Sync with HEAD.
 1.51.6.5  11-Mar-2010  yamt sync with head
 1.51.6.4  16-Sep-2009  yamt sync with head
 1.51.6.3  20-Jun-2009  yamt sync with head
 1.51.6.2  04-May-2009  yamt sync with head.
 1.51.6.1  16-May-2008  yamt sync with head.
 1.51.4.1  18-May-2008  yamt sync with head.
 1.51.2.3  27-Dec-2008  christos merge with head.
 1.51.2.2  01-Nov-2008  christos Sync with head.
 1.51.2.1  29-Mar-2008  christos Welcome to the time_t=long long dev_t=uint64_t branch.
 1.52.6.2  13-Dec-2008  haad Update haad-dm branch to haad-dm-base2.
 1.52.6.1  19-Oct-2008  haad Sync with HEAD.
 1.52.2.1  24-Sep-2008  wrstuden Merge in changes between wrstuden-revivesa-base-2 and
wrstuden-revivesa-base-3.
 1.53.4.3  30-Jan-2010  snj Pull up following revision(s) (requested by bouyer in ticket #1269):
sys/dev/cgd.c: revision 1.69
sys/dev/vnd.c: revision 1.206
sys/dev/dkwedge/dk.c: revision 1.53
struct buf::b_iodone is not called at splbio() any more.
Make sure non-MPsafe iodone callbacks raise the SPL as appropriate.
Fix buffer corruption issue I noticed in dk(4), and probable similar
issues in vnd(4) and cgd(4).
 1.53.4.2  04-Apr-2009  snj branches: 1.53.4.2.2; 1.53.4.2.4;
Pull up following revision(s) (requested by apb in ticket #653):
sys/dev/cgd.c: revision 1.57
Pass DIOCCACHESYNC ioctl down to the underlying disk.
Addresses PR 41016.
 1.53.4.1  23-Nov-2008  riz Pull up following revision(s) (requested by jakllsch in ticket #111):
sys/dev/cgd.c: revision 1.54
PR/38735: Jonathan A. Kollasch: cgd cannot be used on top of wedges
 1.53.4.2.4.1  21-Apr-2010  matt sync to netbsd-5
 1.53.4.2.2.1  30-Jan-2010  snj Pull up following revision(s) (requested by bouyer in ticket #1269):
sys/dev/dkwedge/dk.c: revision 1.53
sys/dev/cgd.c: revision 1.69
sys/dev/vnd.c: revision 1.206
struct buf::b_iodone is not called at splbio() any more.
Make sure non-MPsafe iodone callbacks raise the SPL as appropriate.
Fix buffer corruption issue I noticed in dk(4), and probable similar
issues in vnd(4) and cgd(4).
 1.53.2.2  28-Apr-2009  skrll Sync with HEAD.
 1.53.2.1  19-Jan-2009  skrll Sync with HEAD.
 1.56.2.2  23-Jul-2009  jym Sync with HEAD.
 1.56.2.1  13-May-2009  jym Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.
 1.69.2.1  30-Apr-2010  uebayasi Sync with HEAD.
 1.70.2.3  31-May-2011  rmind sync with head
 1.70.2.2  05-Mar-2011  rmind sync with head
 1.70.2.1  16-Mar-2010  rmind Change struct uvm_object::vmobjlock to be dynamically allocated with
mutex_obj_alloc(). It allows us to share the locks among UVM objects.
 1.71.2.1  06-Jun-2011  jruoho Sync with HEAD.
 1.72.2.1  23-Jun-2011  cherry Catchup with rmind-uvmplock merge.
 1.75.2.4  22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.75.2.3  16-Jan-2013  yamt sync with (a bit old) head
 1.75.2.2  30-Oct-2012  yamt sync with head
 1.75.2.1  17-Apr-2012  yamt sync with head
 1.76.12.1  21-Jul-2017  snj Apply patch (requested by chs in ticket #1455):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.76.10.1  21-Jul-2017  snj Apply patch (requested by chs in ticket #1455):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.76.6.2  21-Jul-2017  snj Apply patch (requested by chs in ticket #1455):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.76.6.1  03-Jun-2014  sborrill Pull up the following revisions(s) (requested by bouyer in ticket #1075):
sys/arch/xen/xen/xbd_xenbus.c: revision 1.63 via patch
sys/dev/cgd.c: revision 1.87 via patch
sys/dev/dksubr.c: revision 1.50 via patch
sys/dev/dkvar.h: revision 1.19 via patch

Avoid xbd(4) reordering requests, which, depending on the underlying
hardware, can badly affect write performances. This can give up to a 5x
performance gain in sequencial writes.
 1.76.4.1  02-Jun-2012  mrg sync to latest -current.
 1.77.2.4  03-Dec-2017  jdolecek update from HEAD
 1.77.2.3  20-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.77.2.2  23-Jun-2013  tls resync from head
 1.77.2.1  25-Feb-2013  tls resync with head
 1.81.2.1  18-May-2014  rmind sync with head
 1.85.2.1  10-Aug-2014  tls Rebase.
 1.90.4.3  23-Oct-2017  snj Pull up following revision(s) (requested by kamil in ticket #1518):
sys/dev/cgd.c: revision 1.113
PR kern/52630: The cgd(4) module requires des and blowfish symbols
This has been exposed with the MODULAR kernel.
kobj_checksyms, 979: [cgd]: linker error: symbol `BF_set_key' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_key_sched' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_ede3_cbc_encrypt' not found
WARNING: module error: unable to affix module `cgd', error 8
Reviewed by <riastradh>
 1.90.4.2  08-Jul-2017  snj Apply patch (requested by chs in ticket #1429):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.90.4.1  04-Nov-2015  riz Pull up following revision(s) (requested by riastradh in ticket #899):
sys/dev/cgd.c: revision 1.97
Use explicit_memset to zero key material.
 1.90.2.3  23-Oct-2017  snj Pull up following revision(s) (requested by kamil in ticket #1518):
sys/dev/cgd.c: revision 1.113
PR kern/52630: The cgd(4) module requires des and blowfish symbols
This has been exposed with the MODULAR kernel.
kobj_checksyms, 979: [cgd]: linker error: symbol `BF_set_key' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_key_sched' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_ede3_cbc_encrypt' not found
WARNING: module error: unable to affix module `cgd', error 8
Reviewed by <riastradh>
 1.90.2.2  08-Jul-2017  snj Apply patch (requested by chs in ticket #1429):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.90.2.1  04-Nov-2015  riz branches: 1.90.2.1.4;
Pull up following revision(s) (requested by riastradh in ticket #899):
sys/dev/cgd.c: revision 1.97
Use explicit_memset to zero key material.
 1.90.2.1.4.2  23-Oct-2017  snj Pull up following revision(s) (requested by kamil in ticket #1518):
sys/dev/cgd.c: revision 1.113
PR kern/52630: The cgd(4) module requires des and blowfish symbols
This has been exposed with the MODULAR kernel.
kobj_checksyms, 979: [cgd]: linker error: symbol `BF_set_key' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_key_sched' not found
kobj_checksyms, 979: [cgd]: linker error: symbol `des_ede3_cbc_encrypt' not found
WARNING: module error: unable to affix module `cgd', error 8
Reviewed by <riastradh>
 1.90.2.1.4.1  08-Jul-2017  snj Apply patch (requested by chs in ticket #1429):
Avoid crashes by checking if a cgd device has been configured before
processing most ioctls, and failing with ENXIO if the device is not
configured.
 1.91.2.8  28-Aug-2017  skrll Sync with HEAD
 1.91.2.7  05-Feb-2017  skrll Sync with HEAD
 1.91.2.6  05-Oct-2016  skrll Sync with HEAD
 1.91.2.5  09-Jul-2016  skrll Sync with HEAD
 1.91.2.4  27-Dec-2015  skrll Sync with HEAD (as of 26th Dec)
 1.91.2.3  22-Sep-2015  skrll Sync with HEAD
 1.91.2.2  06-Jun-2015  skrll Sync with HEAD
 1.91.2.1  06-Apr-2015  skrll Sync with HEAD
 1.108.2.21  20-Mar-2017  pgoyette Sync with HEAD
 1.108.2.20  07-Jan-2017  pgoyette Sync with HEAD. (Note that most of these changes are simply $NetBSD$
tag issues.)
 1.108.2.19  04-Nov-2016  pgoyette Sync with HEAD
 1.108.2.18  06-Aug-2016  pgoyette Sync with HEAD
 1.108.2.17  28-Jul-2016  pgoyette Remove duplicated code (cut-and-paste error)
 1.108.2.16  26-Jul-2016  pgoyette Rename LOCALCOUNT_INITIALIZER to DEVSW_MODULE_INIT. This better describes
what we're doing, and why.
 1.108.2.15  26-Jul-2016  pgoyette Sync with HEAD
 1.108.2.14  25-Jul-2016  pgoyette Add a comment to describe why we didn't convert one caller of
device_lokup_private().
 1.108.2.13  24-Jul-2016  pgoyette Call device_release() in appropriate error paths.

In the module initialization code, make the bmajor/cmajor variables
global so they can be shared with the rump component initialization.
 1.108.2.12  24-Jul-2016  pgoyette Remove cgd_release() - it's not needed now that getcgd_softc() provides
access to the device_t

Restore original cgdattach() - seems to be needed after all.

Remove some debug printf's from GETCGD_SOFTC() macro.
 1.108.2.11  23-Jul-2016  pgoyette Remove debug printfs.

For MODULE builds, define cgd_cd via CFDRIVER_DECL
 1.108.2.10  23-Jul-2016  pgoyette Revert changes in revision 1.108.2.3

For pseudo-devices, config(1) doesn't provide a valid cfattach, so when
a modular driver calls config_pseudo_attach() it will fail. This is not
an issue for built-in drivers.
 1.108.2.9  22-Jul-2016  pgoyette Remove debug
 1.108.2.8  22-Jul-2016  pgoyette Call cgd_spawn() if the requested device doesn't exist, rather than if
the device exists but without any softc data.
 1.108.2.7  22-Jul-2016  pgoyette Pass correct arg to cgd_spawn()
 1.108.2.6  22-Jul-2016  pgoyette Use correct prototype.
 1.108.2.5  22-Jul-2016  pgoyette Make sure that whenever we're using the cgd device's softc, we maintain
a reference to the device so things won't get deleted out from under us!
 1.108.2.4  20-Jul-2016  pgoyette First pass at updating the cgd(4) driver for use with localcount(9)
ref-counts.

So far all I've done is to manage the ref-counts. This will defer
removal of the driver from the devsw tables and/or the autoconf tree
while anyone has a reference to any of the device's critical data
(mostly, the softc or the device_t). Note that these ref-counts will
only defer the removal; once the references are released, the removal
will proceed.

On-going work is needed to identify potentially blocking operations,
and to deny any removals if such operations are in-flight. We really
shouldn't be waiting (possibly indefinitely) for these operations to
complete, especially since removals could be attempted by the module(9)
subsystem while holding the kernel_config lock.
 1.108.2.3  20-Jul-2016  pgoyette Rather than manually manipulating individual autoconf data, just use
config_{init,fini}_component() to do it all at once.
 1.108.2.2  19-Jul-2016  pgoyette Instead of repeatedly typing the conditional initialization of the
.d_localcount members in the various {b,c}devsw, define an initializer
macro and use it. This also removes the need for defining new symbols
for each 'struct localcount'.

As suggested by riastradh@
 1.108.2.1  18-Jul-2016  pgoyette Rump drivers are always installed via devsw_attach() so we need to
always allocate a 'struct localcount' for these drivers whenever they
are built as modules.
 1.113.2.1  21-Apr-2017  bouyer Sync with HEAD
 1.114.6.1  30-Dec-2021  martin Pull up following revision(s) (requested by riastradh in ticket #1722):

sys/dev/cgd.c: revision 1.142

cgd(4): Fix criterion for detach when wedgies are held.

The somewhat confusingly named DK_BUSY(dksc, pmask) answers the
following question:

Suppose I hold either the character or the block device (but
not both) of all of the partitions in pmask. Is anyone else
using the disk, rendering it unsafe to detach?

This is useful for ioctls like CGDIOCCLR and VNDIOCCLR, which must be
issued on open file descriptors for the disk, so the question cannot
simply be answered by testing whether dk_openmask != 0.
Instead, DK_BUSY breaks the question into the following criteria:

1. Are there any _other_ partitions than those in pmask open
at all? If so, it must be someone else, since I only hold
partitions in pmask -- hence the disk is busy.
2. Are any of the partitions in pmask open _both_ as a block
device _and_ as a character device? If so, it must be
someone else, since I only hold _either_ the character
_or_ the block device open but not both -- hence the disk
is busy.

When config_detach_all runs at shutdown time, it tries to detach
cgd(4), which has DVF_DETACH_SHUTDOWN; this is important so we submit
queued writes to the underlying disk and wait for them to complete
with dk_drain.

If cgd(4) has any dk wedges with file systems mounted still
configured on it, it isn't ready to detach yet. But asking
DK_BUSY(dksc, 1 << RAW_PART) returns false, because the dk wedges
only hold RAW_PART open as a block device -- so if nobody has
RAW_PART open as a character device, or any other partitions open,
cgd_detach blithely goes on its way to forcibly detach the wedges.

Instead, ask DK_BUSY(dksc, 0), because the caller -- cgd_detach
issued by config_detach_all -- does not, in fact, hold any partitions
open, so it doesn't need to work around them like ioctl(CGDIOCCLR)
does. Fixes hang in zfs on dk on cgd during shutdown (and probably
also zfs on cgd without any intervening dk but I haven't tested).

(This change might have the side effect that `drvctl -d cgdN' doesn't
work, but I don't care.)

XXX pullup-9
XXX pullup-8 (...-7, -6, -5...)
 1.114.4.7  17-May-2017  pgoyette At suggestion of chuq@, modify config_attach_pseudo() to return with a
reference held on the device.

Adapt callers to expect the reference to exist, and to ensure that the
reference is released.
 1.114.4.6  29-Apr-2017  pgoyette Remove explicit inclusion of <sys/localcount.h> since there is no
explicit usage of localcounts here. <sys/conf.h> will take care of
including as needed.
 1.114.4.5  29-Apr-2017  pgoyette add a comment - NFC
 1.114.4.4  28-Apr-2017  pgoyette Introduce config_detach_release() which does all the work from the
former config_detach(). Now, config_detach() simply acquires a
reference to the device, which config_detach_release() can release!

This is needed because some drivers call config_detach() with a
reference, while other drivers have not been updated to use the
localcount reference mechanism. So we provide a shim to make
everyone equal.
 1.114.4.3  27-Apr-2017  pgoyette Once more let's try to fix the exit path in cgdclose()
 1.114.4.2  27-Apr-2017  pgoyette Fix checking of failure-to-spawn a unit (check the returned address for
NULL, vs the pointer to that address).

Ensure that that device_release() is called in all exit paths from cgd_close().

Update handling of CGDIOCCLR ioctl the same as CGDIOCSET. In particular,
don't return without calling device_release(), as any subsequent attempt to
detach the device will hang forever waiting for its localcount to drain.
 1.114.4.1  27-Apr-2017  pgoyette Restore all work from the former pgoyette-localcount branch (which is
now abandoned doe to cvs merge botch).

The branch now builds, and installs via anita. There are still some
problems (cgd is non-functional and all atf tests time-out) but they
will get resolved soon.
 1.116.10.5  30-Dec-2021  martin Pull up following revision(s) (requested by riastradh in ticket #1398):

sys/dev/cgd.c: revision 1.142

cgd(4): Fix criterion for detach when wedgies are held.

The somewhat confusingly named DK_BUSY(dksc, pmask) answers the
following question:

Suppose I hold either the character or the block device (but
not both) of all of the partitions in pmask. Is anyone else
using the disk, rendering it unsafe to detach?

This is useful for ioctls like CGDIOCCLR and VNDIOCCLR, which must be
issued on open file descriptors for the disk, so the question cannot
simply be answered by testing whether dk_openmask != 0.
Instead, DK_BUSY breaks the question into the following criteria:

1. Are there any _other_ partitions than those in pmask open
at all? If so, it must be someone else, since I only hold
partitions in pmask -- hence the disk is busy.
2. Are any of the partitions in pmask open _both_ as a block
device _and_ as a character device? If so, it must be
someone else, since I only hold _either_ the character
_or_ the block device open but not both -- hence the disk
is busy.

When config_detach_all runs at shutdown time, it tries to detach
cgd(4), which has DVF_DETACH_SHUTDOWN; this is important so we submit
queued writes to the underlying disk and wait for them to complete
with dk_drain.

If cgd(4) has any dk wedges with file systems mounted still
configured on it, it isn't ready to detach yet. But asking
DK_BUSY(dksc, 1 << RAW_PART) returns false, because the dk wedges
only hold RAW_PART open as a block device -- so if nobody has
RAW_PART open as a character device, or any other partitions open,
cgd_detach blithely goes on its way to forcibly detach the wedges.

Instead, ask DK_BUSY(dksc, 0), because the caller -- cgd_detach
issued by config_detach_all -- does not, in fact, hold any partitions
open, so it doesn't need to work around them like ioctl(CGDIOCCLR)
does. Fixes hang in zfs on dk on cgd during shutdown (and probably
also zfs on cgd without any intervening dk but I haven't tested).

(This change might have the side effect that `drvctl -d cgdN' doesn't
work, but I don't care.)

XXX pullup-9
XXX pullup-8 (...-7, -6, -5...)
 1.116.10.4  14-Dec-2021  martin Pull up following revision(s) (requested by riastradh in ticket #1393):

sys/dev/cgd.c: revision 1.141

cgd(4): Wait for worker threads to complete before destroying mutex.

Fixes PR kern/56546 (probably!).
 1.116.10.3  06-Apr-2020  martin Pull up following revision(s) (requested by riastradh in ticket #823):

sys/dev/cgdvar.h: revision 1.19
sys/dev/cgd.c: revision 1.122
sys/dev/cgd.c: revision 1.123
sys/dev/cgd.c: revision 1.124

Defer crypto operations to a workqueue and make it utilize all CPUs.

Make device mpsafe.

Some code cleanup.

Don't wait for data buffer.

cgd: switch from malloc(9) to kmem(9)
XXX might be worthwhile to use pool_cache(9) in the write path
 1.116.10.2  21-Mar-2020  martin Pull up following revision(s) (requested by riastradh in ticket #795):

sys/dev/dksubr.c: revision 1.112
sys/arch/xen/xen/xbd_xenbus.c: revision 1.95
sys/dev/scsipi/sd.c: revision 1.328
sys/dev/dkvar.h: revision 1.32
sys/dev/ld.c: revision 1.109
sys/dev/cgd.c: revision 1.120
sys/dev/raidframe/rf_netbsdkintf.c: revision 1.380
sys/dev/ata/wd.c: revision 1.458

Add a flag to dk_dump for virtual disk devices.

If a disk is backed by a physical medium other than itself, such as
cgd(4), then it passes DK_DUMP_RECURSIVE to disable the recursion
detection for dk_dump.

If, however, a device represents a physical medium on its own, such
as wd(4), then it passes 0 instead.

With this, I can now dump to dk on cgd on dk on wd.
 1.116.10.1  21-Mar-2020  martin Pull up following revision(s) (requested by riastradh in ticket #788):

sys/sys/dkio.h: revision 1.26
sys/dev/dkwedge/dk.c: revision 1.100
sys/sys/disk.h: revision 1.75
external/cddl/osnet/dist/uts/common/fs/zfs/vdev_disk.c: revision 1.14
external/cddl/osnet/dist/uts/common/fs/zfs/vdev_disk.c: revision 1.15
sys/dev/cgd.c: revision 1.121
sys/dev/ata/wdvar.h: revision 1.50
sys/kern/subr_disk_open.c: revision 1.15
sys/dev/ata/wd.c: revision 1.459

New ioctl DIOCGSECTORALIGN returns sector alignment parameters.

struct disk_sectoralign {
/* First aligned sector number. */
uint32_t dsa_firstaligned;
/* Number of sectors per aligned unit. */
uint32_t dsa_alignment;
};

- Teach wd(4) to get it from ATA.
- Teach cgd(4) to pass it through from the underlying disk.
- Teach dk(4) to pass it through with adjustments.
- Teach zpool (zfs) to take advantage of it.
=> XXX zpool doesn't seem to understand when the vdev's starting
sector is misaligned.

Missing:
- ccd(4) and raidframe(4) support -- these should support _using_
DIOCGSECTORALIGN to decide where to start putting ccd or raid
stripes on disk, and these should perhaps _implement_
DIOCGSECTORALIGN by reporting the stripe/interleave factor.
- sd(4) support -- I don't know any obvious way to get it from SCSI,
but if any SCSI wizards know better than I, please feel free to
teach sd(4) about it!
- any ld(4) attachments -- might be worth teaching the ld drivers for
nvme and various raid controllers to get the aligned sector size

There's some duplicate logic here for now. I'm doing it this way,
rather than gathering the logic into a new disklabel_sectoralign
function or something, so that this change is limited to adding a new
ioctl, without any new kernel symbols, in order to make it easy to
pull up to netbsd-9 without worrying about the module ABI.

Make getdiskinfo() compatible with a DIOCGWEDGEINFO.

dkw_parent is defined to hold the disk name as used by disk_find(), not
a partition (i.e. no partition letter appended).

Use utility functions to handle disk geometry.
 1.116.4.2  21-Apr-2020  martin Sync with HEAD
 1.116.4.1  08-Apr-2020  martin Merge changes from current as of 20200406
 1.118.2.1  17-Jan-2020  ad Sync with head.
 1.124.2.1  20-Apr-2020  bouyer Sync with HEAD

RSS XML Feed