Get the link offset using the zfs_dnode_sa_lookup helper now.
Recently, the symbolic links we rely on in the boot loader have stopped
working.
Prior to OpenZFS commit e90badec11 ("Inherit the project ID for every
object type", Matt Turner, 2026-08-14), symbolic link information was
written at a fixed offset in the SA data. Since that commit, the
inherited PROJIDs mean that all pools with quota enabled have started
writing symbolic links with a new, non-fixed offset. Old symbolic links
remained unchanged, but new ones were written with a different
offset. At work, we have all these things: rewritten BEs, quotas, and a
dependence on symbolic links in our boot path.
This came in on 2026-08-24 OpenZFS merge (22649d4dba). This was 12
hours after stab week for August, so we didn't hit this until the
September stab week. Since the new kernel has to write links at the new
offset, the initial tests worked, but the second ones didn't.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60268
Find the SA values with the zfs_dnode_sa_lookup and read out the
relevant bits for the stat buffer.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60267
zfs_dnode_sa_lookup will look in the bonus part of the dnode for the
requested SA values, and fall back to the spill as if it's not there.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60266
Compute the offset for the data for this bundle and the requested data
type.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60265
zfs_sa_load looks up all the system attribute offsets and stores them in
the mountpoint.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60264
For the dynamic system attributes, we'll need the mount argument. Adjust
zfs_dnode_readlink to take that argument.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60262
When reading dynamic system attributes, we'll need the mount argument
since we can no longer hard-code the offsets. Adjust zfs_dnode_stat to
take it.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60261
Dynamic system attribute layout can require modifications to the mount
structure on lookup. Drop the const to allow that.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60260
Ability to override DHCP options with command-line arguments
was affected by intoduction of initmd support. Initmd discovery
configures the network before loader arguments
were parsed, so a dhcp.root-path override was unavailable
during the first network configuration. Move parsing
arguments earlier and apply dhcp.root-path even if DHCP response
does not contain option 17. This allows providing a dynamic NFS
root e.g. by chain loading loader.efi from iPXE.
Signed-off-by: Krzysztof Galazka <[email protected]>
Reviewed by: imp
Assisted by: Github Copilot (GPT-5.6 Sol)
Sponsored by: Intel Corporation
Differential Revision: https://reviews.freebsd.org/D59998
Request FreeBSD RFC 3925 PEM 2238 DHCP 125 option. Use suboption 1 to
specify a ramdisk image to load and use to load the kernel and as the
root file system.
Differential Revision: https://reviews.freebsd.org/D59428
Sponsored by: Netflix
Add parse_uri(), a helper for devices whose devspec can take a
"[N]://host[:port][/path]" form in addition to the traditional "N:path"
form. It returns EINVAL when devspec doesn't match that pattern, so a
caller's own dv_parsedev can fall back to the traditional form.
Un-static default_parsedev() so it can serve as that fallback.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D59422
To avoid any sort of POLA violation, this commit restores old
guards and defines the C23 feature test macros in addition to
them. This is to close off whole class of possible breakage,
rather than patching it case by case.
Reported by: dim
Reviewed by: dim, dteske, fuz
Approved by: dim, dteske (mentor), fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58911
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
with no hashing. A memset() at the top of zfs_dnode_stat() zeroes the
remaining fields so they no longer hold stack garbage.
Tested on 16.0-CURRENT (amd64), ZFS-on-GELI root: rebuilt and re-signed
the EFI loader; the system boots under UEFI Secure Boot with
mac_veriexec active.
(boot1 segment was modified by kevans)
PR: 295935
Sponsored by: Defenso
Reviewed-by: kevans
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2271
Define the __STDC_VERSION_STDIO_H__ feature test macro now that
the header fully conforms to C23.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D58842
Populate stand/libsa/bootp.c's bootp_response global from the UEFI PXE
Base Code Protocol's cached DhcpAck, so bootp() can enter RFC 2131
INIT-REBOOT and skip DISCOVER/OFFER instead of running a fresh DHCP
transaction after the firmware has already done one.
- When cached response is available, actually use xid from one
instead of using its byte-swapped value for BIOS and 1 for UEFI.
- If cached response is not available, generate pseudo-random xid,
since use of a constant may cause conflicts if two systems are
booting same time, and server sends responses as broadcast.
- When cached response is available, skip DHCP DISCOVER/OFFER
and just send REQUEST to the DHCP server from the cached response.
We could skip this phase too and just use the cached response, but
we don't know whether firmware requested all of DHCP options we'd
like to get.
Tested on amd64 Supermicro X11DPI-NT for both BIOS and EFI, with
and without cached response packet.
These were overlooked when I added compression support.
Fixes: 86d719ae68 ("loader: Add xzfs, like gzipfs but with xz.")
Fixes: c61ee49cd0 ("loader: zstd based filesystem, zstdfs like gzipfs")
Sponsored by: Netflix
We can now decompress .xz compressed memory disks, like
FreeBSD-15.1-RELEASE-amd64-disc1.iso.xz
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D58073
These are scattered in several places, so centralize the setting of
these flags.
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D57861
When pxeboot gets a 0 as a port number from portmapper (indicating an
error), it currently happily sends NFS packets to the server's port 0
in an endless loop. Change this to instead bail out with a useful
message.
This happens, for example, with recent Linux NFS servers as many
distributions switched to TCP only NFS serving by default. FreeBSD's
pxeboot must have UDP. In this situation pxeboot asks the server's
portmapper for the UDP NFS port and since there is none gets 0.
Also add a hint to the manpage explaining this and how to fix it.
Reviewed by: ziaee, kevans, imp
Enabling ZSTD_TRACE leaves behind undefined weak symbols, which causes a
problem for gcc builds. The bfd linker emits an obscure error about
overlapping FDEs. We don't need ZSTD_TRACE for libsa, so just disable
it.
Also disable BMI2 instruction optimizations. The addition of the
optional BMI2 code paths caused the boot loader binaries to grow larger
(28 KiB for clang, 32 KiB for gcc). The boot loader binaries are size
constrained, and this pushed the gcc-generated lua_loader.bin over the
500000 byte limit, and the clang one to within 4k of the limit.
Fixes: 8a62a2a565 ("zfs: merge openzfs/zfs@f8e5af53e")
Reviewed by: delphij, imp, mm
Differential Revision: https://reviews.freebsd.org/D56866
Move is_restricted_var() to libsa/environment.c so it can be leveraged
by boot_setenv called from subr_boot with not truted input.
Also, allow for local tuning via ENV_IS_RESTRICTED_ALLOWED_LIST and
ENV_IS_RESTRICTED_LIST
Sponsored by: Hewlett Packard Enterprise Development LP.
Reviewed by: kevans, imp
Differential Revision: https://reviews.freebsd.org/D56287
Notable upstream pull request merges:
#17000 -multiple cmd/zfs: support creating parents with canmount=no
#17926b481a8bbb Make zpool status dedup table support raw bytes -p output
#18238 -multiple Report space metrics per allocation class
#182405dad9459d Add --no-preserve-encryption flag
#182571eace5906 libzfs: use mount_setattr for selective remount including
legacy mounts
#182591e2c94a04 More consistent use of TREE_* macros in AVL comparators
#18262c58b8b7dc Fix check for .cfi_negate_ra_state on aarch64
#18264f109c7bb9 Add the --file-layout (-f) option to zdb(8)
#18268304de7f19 libzfs: handle EDOM error in zpool_create
#18275753f1e1e2 zstream: add a drop_record subcommand
#182760f90a797d Fix vdev_rebuild_range() tx commit
#182771e1d64d66 Fix log vdev removal issues
#1827806b0abfe6 Fix the send --exclude option to work with encryption
#18281e73ada771 libzpool: lift zfs_file ops out to separate source file
#18284d97945776 zstream: consolidate shared code
#18285 -multiple Separate SIMD compile checks for userspace and kernel
#18288c5905b2cb Implement lzc_send_progress
#18289 -multiple L2ARC: Add depth cap and write budget fairness for
persistent markers
#18290d45c8d648 FreeBSD: Improve dmesg kernel message prefix
#18294b403040c4 draid: fix data corruption after disk clear
#18296 -multiple libzfs: mnttab cleanup
#18300d35951b18 zpool clear: remove undocumented rewind flags
#18301ae7fcd5f9 fix libzfs diff mem leak in an error path
#1830365165df12 zilstat: add man page
#183147f65e04ab libzfs: scrub: only include start and end nv pairs if
needed for scrub
#18315 -multiple Sync ZVOLs block cloning conditions with file systems
#18330f80338fac zarcsummary: add man page
#18337f259a47c7 zpool-iostat.8: clarify first report shows per-second
averages
Obtained from: OpenZFS
OpenZFS commit: 3ee08abd2f
Notable upstream pull request merges:
#173584975430cf Add vdev property to disable vdev scheduler
#18031c77f17b75 Add snapshots_changed_nsecs dataset property
#18080dbb3f247e cmd/zfs: clone: accept `-u` to not mount newly created
datasets
#18089 -multiple Zstd: Update bundled library to version 1.5.7
#180912301755df Fix zfs_open() to skip zil_async_to_sync() for the
snapshot
#18093 -multiple L2ARC: Rework write throttling with DWPD rate limiting
and parallel writes
#180952dbd6af5e Rename several printf attributes declarations to
__printf__
#180968605bdfdd FreeBSD: unbreak compilation on i386
#18105794f1587d When receiving a stream with the large block flag,
activate feature
#18115765929cb4 DDT: Add locking for table ZAP destruction
#1811809e4e01e9 Fix history logging for `zpool create -t`
#181192f1f25217 icp: emit .note.GNU-stack section for all ELF targets
#181313fffe4e70 Fix --enable-invariants on FreeBSD
#18133d2f5cb3a5 Move range_tree, btree, highbit64 to common code
#1813654b141fab FreeBSD: Remove references to DEBUG_VFS_LOCKS
#18138cdf89f413 Flush RRD only when TXGs contain data
#18139a157ef62a Make sure we can still write data to txg
#18140cd895f0e5 remove thread unsafe debug code causing FreeBSD double
free panic
#181444f180e095 Fix activating large_microzap on receive
#1814635b2d3970 Lock db_mtx around arc_release() in couple places
#18154b36472052 nvpair: chase FreeBSD xdrproc_t definition
#1816021bbe7cb6 Improve caching for dbuf prefetches
#18177 -multiple Multihost Improvements
#181792646bd558 Allow rewrite skip cloned and snapshotted blocks
#18180aa29455dd Restrict cloning with different properties
#18184040ba7a7c libzfs: improve error message for zpool create with
ENXIO
#181881412bdc6c zfs_vnops_os.c: Move a vput() to after
zfs_setattr_dir()
#18198cc184fe98 Fix `send:raw` permission for send `-w -I`
#18208ba970eb20 Cleanup allocation class selection
#182120f9564e85 Simplify dnode_level_is_l2cacheable()
#18214370570890 Remove parent ZIO from dbuf_prefetch()
#18218bfb276e55 freebsd: Fix TIMESPEC_OVERFLOW for PowerPC
#18222d06a1d9ac Fix available space accounting for special/dedup
#18225d48967728 ICP: AES-GCM VAES-AVX2: fix typos and document
source files
#18226c8a72a27e ICP: AES-GCM assembly: remove unused Gmul functions
#18230 -multiple Fix zdb --key crash for unencrypted datasets, and
teach tests to understand this better
#18233 -multiple icp: add SHA-512 implementation using Intel SHA512
extension
#18245991fc56fa Introduce dedupused/dedupsaved pool properties
#182516a717f31e Improve misleading error messages for
ZPOOL_STATUS_CORRUPT_POOL
#182547744f0496 SIMD: libspl: test the correct CPUID bit for AVX512VL
#182556495dafd5 range_tree: use zfs_panic_recover() for
partial-overlap remov
#182563408332d7 zhack: Fix importing large allocation profiles on
small pools
#18258f8457fbdc Fix deadlock on dmu_tx_assign() from vdev_rebuild()
#18263f8e5af53e Fix redundant declaration of dsl_pool_t
Obtained from: OpenZFS
OpenZFS commit: f8e5af53e9
re-wrap the function calls in a couple of ifs in get_zfs_root so they
are more readable. They really didn't need to be wrapped like this in
the first place.
Sponsored by: Netflix
ZFSSRC is abiguous on its surface and too clos to ZFSTOP, so rename it
to SAZFSSRC.
Sponsored by: Netflix
Reviewed by: tsoome
Differential Revision: https://reviews.freebsd.org/D53901
Use ZFSTOP instead of OZFS. They are the saame thing.
Sponsored by: Netflix
Reviewed by: tsoome
Differential Revision: https://reviews.freebsd.org/D53900
There is a pool feature, dynamic_gang_header, that is enabled by default
in new pools. When this feature is active, gang headers may be larger
than 512 bytes. The loader needs to be taught to cope with that.
Try using the vdev ashift to pick the gang block header size. If the
checksum fails, fall back to the old gang block header size.
This is based on a patch by Paul Dagnelie, with testing, bug-fixing and
some simplifications from me.
PR: 289690
Co-authored by: Paul Dagnelie <[email protected]>
Reviewed by: imp
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D53578
The reimplementation is a bit cleaner than the original code,
although it is also slightly slower. This shouldn't matter too
much as we will have asm code for the major platforms.
The code is unrolled when built in the kernel or user space, but
not when in libsa, as to reduce the code size.
Differential Revision: https://reviews.freebsd.org/D45670
Reviewed by: jrtc27, imp
Approved by: markj (mentor)
MFC after: 1 month
Both files are used by kernel and userspace.
Move them to sys/crypto where they belong.
No functional changes intended.
In preparation of D45670.
Reviewed by: markj
Approved by: markj (mentor)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D52909
What we really want here is to know if pointers can refer to 64-bit
addresses, regardless of whether they also hold other information (such
as capabilities in CHERI). __SIZEOF_SIZE_T__ is probably the closest
indication to that piece of information, so let's use it. __ILP32__
wasn't wrong in practice though, as we don't support 32-bit CHERI
hardware (and likely never will).
Consistently with this change, test whether we can actually address the
64-bit SMBIOS's structure table by converting the end address to
'size_t' and checking whether its value is preserved.
Suggested by: jhb (for the __ILP32__ => __SIZEOF_SIZE_T__ part)
Reviewed by: jhb, imp
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D49318
A directory with a zero-valued d_reclen causes boot to hang, This
patch checks for directory entries with value zero and bails out
rather than spin forever. The hope is that the user has other options.
Sadly this was reported on Jun 16 2015 and is just now attended to
as part of a sweep of old unclosed phabricator reports.
Reported-by: Daniel O'Connor darius-dons.net.au
Differential Revision: https://reviews.freebsd.org/D2844
MFC-after: 1 week
Sponsored-by: Netflix
Our only user of this at the moment is teken.{fg,bg}_color. These are
special because teken is a library common to both the kernel and the
loader, and we want to avoid having special vars to control the loader
vs. the kernel. Ideally, if a user wants a different set of console
colors, then they set the appropriate teken variable and it
Just Works(TM) everywhere. We can't just avoid setting the env vars,
because we specifically want to install a hook to adjust how loader is
drawn.
This allows us to avoid breaking a kernel config(5) that has some
default teken colors set with our defaults. That's a valid
configuration, even if it might seem weird that they don't want to set
colors in both loader and the kernel -- they may not anticipate spending
any time in loader, and thus prefer to just let it do its default
behavior.
NOKENV is expected to be unset if the value is overwritten, rather than
acting as a persistent marker that we do not want the value to persist
under any circumstance. We can always add another flag bit later for
persistence if we find a use for that, but most variables are fine to
carry over. This is mostly needed for environment variables that we
really just want to set a hook for.
Future work could expand this to break it out to the scripted
interfaces. We have discussed some options like a new built-in command,
or adding a flag to the existing `set` command, but haven't really come
up with a concrete plan to avoid confusion.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D50888
When doing file verification, tftp needs to be able to handle multiple
open files concurrently.
We also need tftp_stat() to provide useful values for st_dev and st_ino.
Allow an architecture to define NETPROTO_DEFAULT.
The default is NET_NFS for backwards compatability.
In net_parse_rootpath() fix parsing of
<scheme>://<ip>[:<port]/<path>
and ensure we return INADDR_NONE unless we successfully
parsed an addr, so we don't end up clobbering rootip obtained
from bootp().
Sponsored by: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D51187
Attempting to mount or even open / with some tftp servers
causes a several minute delay in boot.
Since opening a directory via TFTP does not make sense, we
avoid it. We don't know if using TFTP until after net_open()
has been called.
Add an is_tftp() accessor to avoid everyone having to include
all the net* headers.
Sponsored by: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D51447
To avoid a layering violation in open() allow fs_ops to
indicate that devopen() should be skipped.
This is only true for pkgfs.
Sponsored by: Juniper Networks, Inc.
Differential Revision: https://reviews.freebsd.org/D51684
This function is used only once and also pulls three variables from the
nvlist that the only caller have already pulled out.
Reviewed by: mav, imp
Differential Revision: https://reviews.freebsd.org/D52031
Fix two problems with 6dd0803ffd. First problem is that situation when
newer label was read before stale one, was handled differently to reverse
order case. Second problem is that vdev_free() would free the fully
initialized leaf vdev that carried stale label. In a case when vdev
carries a stale label, but is still referenced by a different label with
new a configuration, we don't want to free it, but rather insert it into
the new configuration.
o Provide a helper function nvlist_find_vdev_guid() that checks presence
of certain GUID in a label.
o In top level vdev store the GUID of vdev used to instantiate top vdev.
o Cover all possible cases in the block in vdev_probe() where we encounter
a known configuration. Make the diagnostic print more informative and
looking same regardless of probe order. Make this whole block easier to
read reducing one level of indentation for a price of a single comparison
at runtime.
Reviewed by: mav, imp
Differential Revision: https://reviews.freebsd.org/D51913
Fixes: 6dd0803ffd
Before this change in vdev_insert() we would avoid inserting a duplicate
vdev to the list of children, however this duplicate being unlinked from
the parent is still stored on the global list with initialized v_guid.
Such leaked duplicate can later be returned by vdev_find(). After
6dd0803ffd such leaked vdev may be freed or pointing to a freed parent,
which leads to a loader crash. Note that the leak problem was there
before 6dd0803ffd.
First, in vdev_insert() free conflicting vdev and return the existing one.
Update callers accordingly. There is only one caller that actually may
encounter this condition.
Second, eliminate global list of vdevs and make vdev_find() to work
recursively on the tree that a caller must provide. Of course, a chance
of GUID collision between members of different pools is extremely low. The
main motivation here is just to increase code robustness and fully isolate
the data structures of different pools being tasted by the loader, and
make easier debugging of bugs like the one being fixed.
Reviewed by: mav, imp
Differential Revision: https://reviews.freebsd.org/D51912
Fixes: 6dd0803ffd
An empty list case is properly covered by the cycle.
Don't pass pointer to vdev being looked up, pass just id.
Reviewed by: mav, imp
Differential Revision: https://reviews.freebsd.org/D51911
Warner Losh