MFC r254651:

Update Bind to 9.9.3-P2

Notable new features:

*  Elliptic Curve Digital Signature Algorithm keys and signatures in
   DNSSEC are now supported per RFC 6605. [RT #21918]

*  Introduces a new tool "dnssec-verify" that validates a signed zone,
   checking for the correctness of signatures and NSEC/NSEC3 chains.
   [RT #23673]

*  BIND now recognizes the TLSA resource record type, created to
   support IETF DANE (DNS-based Authentication of Named Entities)
   [RT #28989]

*  The new "inline-signing" option, in combination with the
   "auto-dnssec" option that was introduced in BIND 9.7, allows
   named to sign zones completely transparently.

Approved by:	delphij (mentor)
Sponsored by:	DK Hostmaster A/S
MFC mps(4) driver changes 253460, 253549, 253550 and 254615.

There are some slight changes here from the version in head.

__FreeBSD_version has been bumped to 902502 for the inclusion of the
PIM_RESCAN CAM path inquiry flag.  The ifdefs in the mps(4) driver
have been changed accordingly.

In head, the TDP_NOSLEEPING thread flag has been removed but it
still exists in stable/9.

  ------------------------------------------------------------------------
  r253460 | scottl | 2013-07-18 18:12:41 -0600 (Thu, 18 Jul 2013) | 5 lines

  Overhaul error, information, and debug logging.

  Obtained from:	Netflix

  ------------------------------------------------------------------------
  r253549 | ken | 2013-07-22 12:37:07 -0600 (Mon, 22 Jul 2013) | 57 lines

  CAM and mps(4) driver scanning changes.

  Add a PIM_NOSCAN flag to the CAM path inquiry CCB.  This tells CAM
  not to perform a rescan on a bus when it is registered.

  We now use this flag in the mps(4) driver.  Since it knows what
  devices it has attached, it is more efficient for it to just issue
  a target rescan on the targets that are attached.

  Also, remove the private rescan thread from the mps(4) driver in
  favor of the rescan thread already built into CAM.  Without this
  change, but with the change above, the MPS scanner could run before
  or during CAM's initial setup, which would cause duplicate device
  reprobes and announcements.

  sys/param.h:
  	Bump __FreeBSD_version to 1000039 for the inclusion of the
  	PIM_RESCAN CAM path inquiry flag.

  sys/cam/cam_ccb.h:
  sys/cam/cam_xpt.c:
  	Added a PIM_NOSCAN flag.  If a SIM sets this in the path
  	inquiry ccb, then CAM won't rescan the bus in
  	xpt_bus_regsister.

  sys/dev/mps/mps_sas.c
  	For versions of FreeBSD that have the PIM_NOSCAN path
  	inquiry flag, don't freeze the sim queue during scanning,
  	because CAM won't be scanning this bus.  Instead, hold
  	up the boot.  Don't call mpssas_rescan_target in
  	mpssas_startup_decrement; it's redundant and I don't
  	know why it was in there.

  	Set PIM_NOSCAN in path inquiry CCBs.

  	Remove methods related to the internal rescan daemon.

  	Always use async events to trigger a probe for EEDP support.
  	In older versions of FreeBSD where AC_ADVINFO_CHANGED is
  	not available, use AC_FOUND_DEVICE and issue the
  	necessary READ CAPACITY manually.

  	Provide a path to xpt_register_async() so that we only
  	receive events for our own SCSI domain.

  	Improve error reporting in cases where setup for EEDP
  	detection fails.

  sys/dev/mps/mps_sas.h:
  	Remove softc flags and data related to the scanner thread.

  sys/dev/mps/mps_sas_lsi.c:
  	Unconditionally rescan the target whenever a device is added.

  Sponsored by:	Spectra Logic

  ------------------------------------------------------------------------
  r253550 | ken | 2013-07-22 12:41:53 -0600 (Mon, 22 Jul 2013) | 93 lines

  Merge in phase 14+ -> 16 mps driver fixes from LSI:

  ---------------------------------------------------------------
  System panics during a Port reset with ouststanding I/O
  ---------------------------------------------------------------
  It is possible to call mps_mapping_free_memory after this
  memory is already freed, causing a panic. Removed this extra
  call to mps_mappiing_free_memory and call mps_mapping_exit
  in place of the mps_mapping_free_memory call so that any
  outstanding mapping items can be flushed before memory is
  freed.

  ---------------------------------------------------------------
  Correct memory leak during a Port reset with ouststanding I/O
  ---------------------------------------------------------------
  In mps_reinit function, the mapping memory was not being
  freed before being re-allocated. Added line to call the
  memory free function for mapping memory.

  ---------------------------------------------------------------
  Use CAM_SIM_QUEUED flag in Driver IO path.
  ---------------------------------------------------------------
  This flag informs the XPT that successful abort of a CCB
  requires an abort ccb to be issued to the SIM.  While
  processing SCSI IO's, set the CAM_SIM_QUEUED flag in the
  status for the IO. When the command completes, clear this
  flag.

  ---------------------------------------------------------------
  Check for CAM_REQ_INPROG in I/O path.
  ---------------------------------------------------------------
  Added a check in mpssas_action_scsiio for the In Progress
  status for the IO. If this flag is set, the IO has already
  been aborted by the upper layer (before CAM_SIM_QUEUED was
  set) and there is no need to send the IO. The request will
  be completed without error.

  ---------------------------------------------------------------
  Improve "doorbell handshake method" for mps_get_iocfacts
  ---------------------------------------------------------------
  Removed call to get Port Facts since this information is
  not used currently.

  Added mps_iocfacts_allocate function to allocate memory
  that is based on IOC Facts data.  Added mps_iocfacts_free
  function to free memory that is based on IOC Facts data.
  Both of the functions are used when a Diag Reset is performed
  or when the driver is attached/detached. This is needed in
  case IOC Facts changes after a Diag Reset, which could
  happen if FW is upgraded.

  Moved call of mps_bases_static_config_pages from the attach
  routine to after the IOC is ready to process accesses based
  on the new memory allocations (instead of polling through
  the Doorbell).

  ---------------------------------------------------------------
  Set TimeStamp in INIT message in millisecond format Set the IOC
  ---------------------------------------------------------------

  ---------------------------------------------------------------
  Prefer mps_wait_command to mps_request_polled
  ---------------------------------------------------------------
  Instead of using mps_request_polled, call mps_wait_command
  whenever possible. Change the mps_wait_command function to
  check the current context and either use interrupt context
  or poll if required by using the pause or DELAY function.
  Added a check after waiting 50mSecs to see if the command
  has timed out. This is only done if polliing, the msleep
  command will automatically timeout if the command has taken
  too long to complete.

  ---------------------------------------------------------------
  Integrated RAID: Volume Activation Failed error message is
  displayed though the volume has been activated.
  ---------------------------------------------------------------
  Instead of failing an IOCTL request that does not have a
  large enough buffer to hold the complete reply, copy as
  much data from the reply as possible into the user's buffer
  and log a message saying that the user's buffer was smaller
  than the returned data.

  ---------------------------------------------------------------
  mapping_add_new_device failure due to persistent table FULL
  ---------------------------------------------------------------
  When a new device is added, if it is determined that the
  device persistent table is being used and is full, instead
  of displaying a message for this condition every time, only
  log a message if the MPS_INFO bit is set in the debug_flags.

  Submitted by:	LSI

  ------------------------------------------------------------------------
  r254615 | ken | 2013-08-21 15:30:56 -0600 (Wed, 21 Aug 2013) | 32 lines

  Fix mps(4) driver breakage that came in in change 253550 that
  manifested itself in out of chain frame conditions.

  When the driver ran out of chain frames, the request in question
  would get completed early, and go through mpssas_scsiio_complete().

  In mpssas_scsiio_complete(), the negation of the CAM status values
  (CAM_STATUS_MASK | CAM_SIM_QUEUED) was ORed in instead of being
  ANDed in.  This resulted in a bogus CAM CCB status value.  This
  didn't show up in the non-error case, because the status was reset
  to something valid (e.g. CAM_REQ_CMP) later on in the function.

  But in the error case, such as when the driver ran out of chain
  frames, the CAM_REQUEUE_REQ status was ORed in to the bogus status
  value.  This led to the CAM transport layer repeatedly releasing
  the SIM queue, because it though that the CAM_RELEASE_SIMQ flag had
  been set.  The symptom was messages like this on the console when
  INVARIANTS were enabled:

  xpt_release_simq: requested 1 > present 0
  xpt_release_simq: requested 1 > present 0
  xpt_release_simq: requested 1 > present 0

  mps_sas.c:	In mpssas_scsiio_complete(), use &= to take status
  		bits out.  |= adds them in.

  		In the error case in mpssas_scsiio_complete(), set
  		the status to CAM_REQUEUE_REQ, don't OR it in.

  Sponsored by:	Spectra Logic

  ------------------------------------------------------------------------
Partial MFC of r253927 (by attilio):
Remove unnecessary soft busy of the page before to do vn_rdwr() in
kern_sendfile() which is unnecessary.

MFC note:
NFS implementation of VOP_READ() sometimes upgrades the vnode lock,
which causes drop of the shared lock and sleep for exclusive.  As
result, busying of the page before the call to vn_rdwr() makes NFS
code to wait for vnode lock while page is busy, which contradicts the
proper order of vnode lock -> busy.

The r250027, merged as part of r250907, started calling vm_page_grab()
under the vnode lock.  The page grab waits for the page busy state to
drain, which makes the parallel sendfile(2) invocations on the same
vnode vulnerable to the LOR described above.

Note that r250027 only exposed the problem, which might be caused by
other means as well, e.g. by parallel sendfile(2) and truncate(2).

Sponsored by:	The FreeBSD Foundation
MFC revisions 254942 and 254952:
Make alternate layout ``opt-in'' and add support for named releases.
Minor edit to version.4th(8) manual and stack-leak fixes while here.
Add missing mergeinfo from head for stabe/9 revisions: 252995 253168 253169
MFC 254372:

Export the maxio field in the CAM XPT_PATH_INQ CCB in the isp(4)
driver.

This tells consumers up the stack the maximum I/O size that the
controller can handle.

The I/O size is bounded by the number of scatter/gather segments
the controller can handle and the page size.  For an amd64 system,
it works out to around 5MB.

Reviewed by:	mjacob
Sponsored by:	Spectra Logic
MFC change 254389:

There are some slight differences from the version in FreeBSD/head.
__FreeBSD_version has been bumped to 902503 for the availability
of the SI_UNMAPPED cdev flag, and the D_UNMAPPED_IO cdevsw flag
remains in place.  D_UNMAPPED_IO no longer does anything.  Drivers that
use that flag will just wind up having mapped I/O by default.  The
impact will only be on performance, not functionality.

  Change the way that unmapped I/O capability is advertised.

  The previous method was to set the D_UNMAPPED_IO flag in the cdevsw
  for the driver.  The problem with this is that in many cases (e.g.
  sa(4)) there may be some instances of the driver that can handle
  unmapped I/O and some that can't.  The isp(4) driver can handle
  unmapped I/O, but the esp(4) driver currently cannot.  The cdevsw
  is shared among all driver instances.

  So instead of setting a flag on the cdevsw, set a flag on the cdev.
  This allows drivers to indicate support for unmapped I/O on a
  per-instance basis.

  sys/conf.h:	Remove the D_UNMAPPED_IO cdevsw flag and replace it
  		with an SI_UNMAPPED cdev flag.

  kern_physio.c:	Look at the cdev SI_UNMAPPED flag to determine
  		whether or not a particular driver can handle
  		unmapped I/O.

  geom_dev.c:	Set the SI_UNMAPPED flag for all GEOM cdevs.
  		Since GEOM will create a temporary mapping when
  		needed, setting SI_UNMAPPED unconditionally will
  		work.

  		Remove the D_UNMAPPED_IO flag.

  nvme_ns.c:	Set the SI_UNMAPPED flag on cdevs created here
  		if NVME_UNMAPPED_BIO_SUPPORT is enabled.

  vfs_aio.c:	In aio_qphysio(), check the SI_UNMAPPED flag on a
  		cdev instead of the D_UNMAPPED_IO flag on the cdevsw.

  sys/param.h:	Bump __FreeBSD_version to 1000045 for the switch from
  		setting the D_UNMAPPED_IO flag in the cdevsw to setting
  		SI_UNMAPPED in the cdev.

  Reviewed by:	kib, jimharris
  Sponsored by:	Spectra Logic
MFC 254416:

  ------------------------------------------------------------------------
  r254416 | ken | 2013-08-16 10:14:32 -0600 (Fri, 16 Aug 2013) | 24 lines

  Add unmapped I/O and larger I/O support to the sa(4) driver.

  We now pay attention to the maxio field in the XPT_PATH_INQ CCB,
  and if it is set, propagate it up to physio via the si_iosize_max
  field in the cdev structure.

  We also now pay attention to the PIM_UNMAPPED capability bit in the
  XPT_PATH_INQ CCB, and set the new SI_UNMAPPED cdev flag when the
  underlying SIM supports unmapped I/O.

  scsi_sa.c:	Add unmapped I/O support and propagate the SIM's
  		maximum I/O size up.

  		Adjust scsi_tape_read_write() in the same way that
  		scsi_read_write() was changed to support unmapped
  		I/O.  We overload the readop parameter with bits
  		that tell us whether it's an unmapped I/O, and we
  		need to set the CAM_DATA_BIO CCB flag.  This change
  		should be backwards compatible in source and
  		binary forms.

  Sponsored by:	Spectra Logic
MFC r251587 (by marcel):
  Remove stub implementation.

MFC r251588 (by marcel):
  Change the set and unset ctlreqs by making the index argument optional.
  This allows setting attributes on tables. One simply does not provide
  an index in that case. Otherwise the entry corresponding the index has
  the attribute set or unset.

  Use this change to fix a relatively longstanding bug in our GPT scheme
  that's the result of rev 198097 (relatively harmless) followed by rev
  237057 (damaging). The damaging part being that our GPT scheme always
  has the active flag set on the PMBR slice. This is in violation with
  EFI. Existing EFI implementions for both x86 and ia64 reject the GPT.
  As such, GPT disks created by us aren't usable under EFI because of
  that.

  After this change, GPT disks never have the active flag set on the PMBR
  slice. In order to make the GPT disk bootable under some x86 BIOSes,
  the reason of rev 198097, one must now set the active attribute on the
  gpt table. The kernel will apply this to the PMBR slice For (S)ATA:
  	gpart set -a active ada0

  To fix an existing GPT disk that has the active flag set in the PMBR,
  and that does not need the flag, use (again for (S)ATA):
  	gpart unset -a active ada0

  The EBR, MBR & PC98 schemes, which also impement at least 1 attribute,
  now check to make sure the entry passed is valid. They do not have
  attributes that apply to the table.
MFC r253910: Add a tunable for the default timeout.

Requested by: rodrigc@, delphij@
MFC r254335: sh: Allow a lone redirection before '|', ';;' or ';&'.

Example: </dev/null | :

PR:		181240
MFC r254231: fnmatch(): Add test for r254353 (pattern with single backslash)

This test cannot be converted to an sh(1) test because the syntax would be
invalid.

r254091 was merged to stable/9 as r254353.

PR:		181129
MFC of 253973:

To better understand performance problems with journalled soft updates,
we need to collect the highest level of allocation for each of the
different soft update dependency structures. This change collects these
statistics and makes them available using `sysctl debug.softdep.highuse'.

Reviewed by: kib
Tested by:   Peter Holm

MFC of 253974:

With the addition of journalled soft updates, the "newblk" structures
persist much longer than previously. Historically we had at most 100
entries; now the count may reach a million. With the increased count
we spent far too much time looking them up in the grossly undersized
newblk hash table. Configure the newblk hash table to accurately reflect
the number of entries that it must index.

Reviewed by: kib
Tested by:   Peter Holm
MFC after:   2 weeks
MFC of 253998:

This bug fix is in a code path in rename taken when there is a
collision between a rename and an open system call for the same
target file. Here, rename releases its vnode references, waits for
the open to finish, and then restarts by reacquiring its needed
vnode locks. In this case, rename was unlocking but failing to
release its reference to one of its held vnodes. The effect was
that even after all the actual references to the vnode had gone,
the vnode still showed active references. For files that had been
removed, their space was not reclaimed until the filesystem was
forcibly unmounted.

This bug manifested itself in the Postgres server which would
leak/lose hundreds of files per day amounting to many gigabytes of
disk space. This bug required shutting down Postgres, forcibly
unmounting its filesystem, remounting its filesystem and restarting
Postgres every few days to recover the lost space.

Reported by: Dan Thomas and Palle Girgensohn
Bug-fix by:  kib
Tested by:   Dan Thomas and Palle Girgensohn