CVS log for src/sys/kern/kern_descrip.c

Up to [cvs.NetBSD.org] / src / sys / kern

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Pull up following revision(s) (requested by riastradh in ticket #1921):

	sys/kern/kern_event.c: revision 1.106
	sys/kern/sys_select.c: revision 1.51
	sys/kern/subr_exec_fd.c: revision 1.10
	sys/kern/sys_aio.c: revision 1.46
	sys/kern/kern_descrip.c: revision 1.244
	sys/kern/kern_descrip.c: revision 1.245
	sys/ddb/db_xxx.c: revision 1.72
	sys/ddb/db_xxx.c: revision 1.73
	sys/miscfs/fdesc/fdesc_vnops.c: revision 1.132
	sys/kern/uipc_usrreq.c: revision 1.195
	sys/kern/sys_descrip.c: revision 1.36
	sys/kern/uipc_usrreq.c: revision 1.196
	sys/kern/uipc_socket2.c: revision 1.135
	sys/kern/uipc_socket2.c: revision 1.136
	sys/kern/kern_sig.c: revision 1.383
	sys/kern/kern_sig.c: revision 1.384
	sys/compat/netbsd32/netbsd32_ioctl.c: revision 1.107
	sys/miscfs/procfs/procfs_vnops.c: revision 1.208
	sys/kern/subr_exec_fd.c: revision 1.9
	sys/kern/kern_descrip.c: revision 1.252
	(all via patch)

Load struct filedesc::fd_dt with atomic_load_consume.

Exceptions: when fd_refcnt <= 1, or when holding fd_lock.

While here:
- Restore KASSERT(mutex_owned(&fdp->fd_lock)) in fd_unused.
  => This is used only in fd_close and fd_abort, where it holds.
- Move bounds check assertion in fd_putfile to where it matters.
- Store fd_dt with atomic_store_release.
- Move load of fd_dt under lock in knote_fdclose.
- Omit membar_consumer in fdesc_readdir.
  => atomic_load_consume serves the same purpose now.
  => Was needed only on alpha anyway.

Load struct fdfile::ff_file with atomic_load_consume.
Exceptions: when we're only testing whether it's there, not about to
dereference it.

Note: We do not use atomic_store_release to set it because the
preceding mutex_exit should be enough.

(That said, it's not clear the mutex_enter/exit is needed unless
refcnt > 0 already, in which case maybe it would be a win to switch
from the membar implied by mutex_enter to the membar implied by
atomic_store_release -- which I would generally expect to be much
cheaper.  And a little clearer without a long comment.)
kern_descrip.c: Fix membars around reference count decrement.

In general, the `last one out hit the lights' style of reference
counting (as opposed to the `whoever's destroying must wait for
pending users to finish' style) requires memory barriers like so:

        ... usage of resources associated with object ...
        membar_release();
        if (atomic_dec_uint_nv(&obj->refcnt) != 0)
                return;
        membar_acquire();
        ... freeing of resources associated with object ...

This way, all usage happens-before all freeing.  This fixes several
errors:
- fd_close failed to ensure whatever its caller did would
  happen-before the freeing, in the case where another thread is
  concurrently trying to close the fd (ff->ff_file == NULL).
  Fix: Add membar_release before atomic_dec_uint(&ff->ff_refcnt) in
  that branch.
- fd_close failed to ensure all loads its caller had issued will have
  happened-before the freeing, in the case where the fd is still in
  use by another thread (fdp->fd_refcnt > 1 and ff->ff_refcnt-- > 0).
  Fix: Change membar_producer to membar_release before
  atomic_dec_uint(&ff->ff_refcnt).
- fd_close failed to ensure that any usage of fp by other callers
  would happen-before any freeing it does.
  Fix: Add membar_acquire after atomic_dec_uint_nv(&ff->ff_refcnt).
- fd_free failed to ensure that any usage of fdp by other callers
  would happen-before any freeing it does.
  Fix: Add membar_acquire after atomic_dec_uint_nv(&fdp->fd_refcnt).

While here, change membar_exit -> membar_release.  No semantic
change, just updating away from the legacy API.

Pull up following revision(s) (requested by kre in ticket #1003):

	sys/kern/kern_descrip.c: revision 1.264 (via patch)

Make O_CLOEXEC always close specified files on exec

It turns out that close-on-exec doesn't always close on exec.

If all close-on-exec fd's were made close-on-exec via dup3() or
fcntl(F_DUPFD_CLOEXEC) or use of the internal fd_clone() (whose uses

I did not fully investigate but I think is used to create a fd for
the open of a cloner device, and perhaps other things) then none
of the close-on-exec file descriptors will be closed when an exec
happens - but will be passed through to the new process (still marked,
apparently, as close-on-exec - but still won't be closed if another exec
happens) - that is unless...

If at least one fd in the process has close-on-exec set some other way
(fcntl(F_SETFD), open(O_CLOEXEC) (and the similar functions for sockets,
and epoll) and perhaps others then all close-on-exec file descriptors
in the process will be correctly closed when an exec happens (however
they obtained the close-on-exec status).

There are two steps that need to be taken (in the kernel) when turning
on close on exec - the obvious one of setting the ff_exclose field in
the struct fdfile for the fd.   And second, marking the file descriptor
table (which holds the fdfile's for one or more processes) as containing
file descriptors with close-on-exec set (it is a simple yes/no, and once
set is never cleared until an actual exec happens).  If it was set during
an exec, all the file descriptors are examined, and those marked
close-on-exec are closed.   If the file descriptor table doesn't indicate
that close-on-exec fds exist in the table, none of that happens.

Several places were setting ff_exclose in the struct fdfile but
not bothering to set the fd_exclose field in the file descriptor table.

There's even a function (fd_set_exclose()) whose whole purpose is to do
this properly - but it wasn't being used.

Now it is, everywhere (I hope).

Pull up following revision(s) (requested by kre in ticket #1003):

	sys/kern/kern_descrip.c: revision 1.264

Make O_CLOEXEC always close specified files on exec

It turns out that close-on-exec doesn't always close on exec.

If all close-on-exec fd's were made close-on-exec via dup3() or
fcntl(F_DUPFD_CLOEXEC) or use of the internal fd_clone() (whose uses

I did not fully investigate but I think is used to create a fd for
the open of a cloner device, and perhaps other things) then none
of the close-on-exec file descriptors will be closed when an exec
happens - but will be passed through to the new process (still marked,
apparently, as close-on-exec - but still won't be closed if another exec
happens) - that is unless...

If at least one fd in the process has close-on-exec set some other way
(fcntl(F_SETFD), open(O_CLOEXEC) (and the similar functions for sockets,
and epoll) and perhaps others then all close-on-exec file descriptors
in the process will be correctly closed when an exec happens (however
they obtained the close-on-exec status).

There are two steps that need to be taken (in the kernel) when turning
on close on exec - the obvious one of setting the ff_exclose field in
the struct fdfile for the fd.   And second, marking the file descriptor
table (which holds the fdfile's for one or more processes) as containing
file descriptors with close-on-exec set (it is a simple yes/no, and once
set is never cleared until an actual exec happens).  If it was set during
an exec, all the file descriptors are examined, and those marked
close-on-exec are closed.   If the file descriptor table doesn't indicate
that close-on-exec fds exist in the table, none of that happens.

Several places were setting ff_exclose in the struct fdfile but
not bothering to set the fd_exclose field in the file descriptor table.

There's even a function (fd_set_exclose()) whose whole purpose is to do
this properly - but it wasn't being used.

Now it is, everywhere (I hope).

Make O_CLOEXEC always close specified files on exec

It turns out that close-on-exec doesn't always close on exec.

If all close-on-exec fd's were made close-on-exec via dup3() or
fcntl(F_DUPFD_CLOEXEC) or use of the internal fd_clone() (whose uses
I did not fully investigate but I think is used to create a fd for
the open of a cloner device, and perhaps other things) then none
of the close-on-exec file descriptors will be closed when an exec
happens - but will be passed through to the new process (still marked,
apparently, as close-on-exec - but still won't be closed if another exec
happens) - that is unless...

If at least one fd in the process has close-on-exec set some other way
(fcntl(F_SETFD), open(O_CLOEXEC) (and the similar functions for sockets,
and epoll) and perhaps others then all close-on-exec file descriptors
in the process will be correctly closed when an exec happens (however
they obtained the close-on-exec status).

There are two steps that need to be taken (in the kernel) when turning
on close on exec - the obvious one of setting the ff_exclose field in
the struct fdfile for the fd.   And second, marking the file descriptor
table (which holds the fdfile's for one or more processes) as containing
file descriptors with close-on-exec set (it is a simple yes/no, and once
set is never cleared until an actual exec happens).  If it was set during
an exec, all the file descriptors are examined, and those marked
close-on-exec are closed.   If the file descriptor table doesn't indicate
that close-on-exec fds exist in the table, none of that happens.

Several places were setting ff_exclose in the struct fdfile but
not bothering to set the fd_exclose field in the file descriptor table.

There's even a function (fd_set_exclose()) whose whole purpose is to do
this properly - but it wasn't being used.

Now it is, everywhere (I hope).

Pull up following revision(s) (requested by kre in ticket #1859):

	sys/kern/kern_proc.c: revision 1.276 (via patch)
	sys/kern/kern_ktrace.c: revision 1.185 (via patch)
	sys/kern/sys_sig.c: revision 1.58 (via patch)
	sys/kern/kern_descrip.c: revision 1.263 (via patch)
	lib/libc/compat-43/killpg.c: revision 1.10
	sys/kern/tty.c: revision 1.313 (via patch)
	tests/lib/libc/sys/t_kill.c: revision 1.2

PR kern/58425 --  Disallow INT_MIN as a (negative) pid arg.
Since -INT_MIN is undefined, and to point of negative pid args is
to negate them, and use the result as a pgrp id instead, we need
to avoid accidentally negating INT_MIN.

Since pid_t is just an integral type, of unspecified width, when
testing pid_t value test for <= INT_MIN (or > INT_MIN sometimes)
rather than == INT_MIN.   When testing int values, just == INT_MIN
is all that is needed, < INT_MIN cannot occur.

tests/lib/libc/sys/t_kill: Test kill(INT_MIN, ...) fails with ESRCH.
PR kern/58425

Pull up following revision(s) (requested by kre in ticket #773):

	sys/kern/kern_proc.c: revision 1.276
	sys/kern/kern_ktrace.c: revision 1.185
	sys/kern/sys_sig.c: revision 1.58
	sys/kern/kern_descrip.c: revision 1.263
	lib/libc/compat-43/killpg.c: revision 1.10
	sys/kern/tty.c: revision 1.313
	tests/lib/libc/sys/t_kill.c: revision 1.2

PR kern/58425 --  Disallow INT_MIN as a (negative) pid arg.

Since -INT_MIN is undefined, and to point of negative pid args is
to negate them, and use the result as a pgrp id instead, we need
to avoid accidentally negating INT_MIN.

Since pid_t is just an integral type, of unspecified width, when
testing pid_t value test for <= INT_MIN (or > INT_MIN sometimes)
rather than == INT_MIN.   When testing int values, just == INT_MIN
is all that is needed, < INT_MIN cannot occur.

tests/lib/libc/sys/t_kill: Test kill(INT_MIN, ...) fails with ESRCH.
PR kern/58425

PR kern/58425 --  Disallow INT_MIN as a (negative) pid arg.

Since -INT_MIN is undefined, and to point of negative pid args is
to negate them, and use the result as a pgrp id instead, we need
to avoid accidentally negating INT_MIN.

Since pid_t is just an integral type, of unspecified width, when
testing pid_t value test for <= INT_MIN (or > INT_MIN sometimes)
rather than == INT_MIN.   When testing int values, just == INT_MIN
is all that is needed, < INT_MIN cannot occur.

XXX pullup -9, -10

kauth_cred_hold(): return cred verbatim so that donating a reference to
another data structure can be done more elegantly.

Repply this change with a couple of bugs fixed:

- Do away with separate pool_cache for some kernel objects that have no special
  requirements and use the general purpose allocator instead. On one of my
  test systems this makes for a small (~1%) but repeatable reduction in system
  time during builds presumably because it decreases the kernel's cache /
  memory bandwidth footprint a little.
- vfs_lockf: cache a pointer to the uidinfo and put mutex in the data segment.

Back out recent change to replace pool_cache with then general allocator.
Will return to this when I have time again.

- Do away with separate pool_cache for some kernel objects that have no special
  requirements and use the general purpose allocator instead.  On one of my
  test systems this makes for a small (~1%) but repeatable reduction in system
  time during builds presumably because it decreases the kernel's cache /
  memory bandwidth footprint a little.
- vfs_lockf: cache a pointer to the uidinfo and put mutex in the data segment.

It's easy to exhaust the open file limit on a system with many CPUs due to
caching.  Allow a bit of leeway to reduce the element of surprise.

Pull up following revision(s) (requested by riastradh in ticket #262):

	sys/kern/kern_descrip.c: revision 1.252
	sys/kern/kern_descrip.c: revision 1.253
	sys/kern/kern_descrip.c: revision 1.254

kern_descrip.c: Fix membars around reference count decrement.

In general, the `last one out hit the lights' style of reference
counting (as opposed to the `whoever's destroying must wait for
pending users to finish' style) requires memory barriers like so:
        ... usage of resources associated with object ...
        membar_release();
        if (atomic_dec_uint_nv(&obj->refcnt) != 0)
                return;
        membar_acquire();
        ... freeing of resources associated with object ...

This way, all usage happens-before all freeing.  This fixes several
errors:
- fd_close failed to ensure whatever its caller did would
  happen-before the freeing, in the case where another thread is
  concurrently trying to close the fd (ff->ff_file == NULL).
  Fix: Add membar_release before atomic_dec_uint(&ff->ff_refcnt) in
  that branch.
- fd_close failed to ensure all loads its caller had issued will have
  happened-before the freeing, in the case where the fd is still in
  use by another thread (fdp->fd_refcnt > 1 and ff->ff_refcnt-- > 0).
  Fix: Change membar_producer to membar_release before
  atomic_dec_uint(&ff->ff_refcnt).
- fd_close failed to ensure that any usage of fp by other callers
  would happen-before any freeing it does.
  Fix: Add membar_acquire after atomic_dec_uint_nv(&ff->ff_refcnt).
- fd_free failed to ensure that any usage of fdp by other callers
  would happen-before any freeing it does.
  Fix: Add membar_acquire after atomic_dec_uint_nv(&fdp->fd_refcnt).

While here, change membar_exit -> membar_release.  No semantic
change, just updating away from the legacy API.

kern_descrip.c: Use atomic_store_relaxed/release for ff->ff_file.
1. atomic_store_relaxed in fd_close avoids the appearance of race in
   sanitizers (minor bug).
2. atomic_store_release in fd_affix is necessary because the lock
   activity was not, in fact, enough to guarantee ordering (real bug
   some architectures like aarch64).
   The premise appears to have been that the mutex_enter/exit earlier
   in fd_affix is enough to guarantee that initialization of fp (A)
   happens before use of fp by a user once fp is published (B):
        fp->f_... = ...;                // A
        /* fd_affix */
        mutex_enter(&fp->f_lock);
        fp->f_count++;
        mutex_exit(&fp->f_lock);
        ...
        ff->ff_file = fp;               // B
   But actually mutex_enter/exit allow the following reordering by
   the CPU:
        mutex_enter(&fp->f_lock);
        ff->ff_file = fp;               // B
        fp->f_count++;
        fp->f_... = ...;                // A
        mutex_exit(&fp->f_lock);
   The only constraints they imply are:
        1. fp->f_count++ and B cannot precede mutex_enter
        2. mutex_exit cannot precede A and fp->f_count++
   They imply no constraint on the relative ordering of A, B, and
   fp->f_count++ amongst each other, however.
   This affects any architecture that has a native load-acquire or
   store-release operation in mutex_enter/exit, like aarch64, instead
   of explicit load-before-load/store and load/store-before-store
   barrier.

No need for atomic_store_* in fd_copy or fd_free because we have
exclusive access to ff as is.

kern_descrip.c: Change membar_enter to membar_acquire in fd_getfile.
membar_acquire is cheaper on many CPUs, and unlikely to be costlier
on any CPUs, than the legacy membar_enter.
Add a long comment explaining the interaction between fd_getfile and
fd_close and why membar_acquire is safe.

fcntl(2), flock(2): Assert FHASLOCK is clear if no fo_advlock.

file(9): New fo_advlock operation.

This moves the vnode-specific logic from sys_descrip.c into
vfs_vnode.c, like we did for fo_seek.

XXX kernel revbump -- struct fileops API and ABI change

kern: Eliminate most __HAVE_ATOMIC_AS_MEMBAR conditionals.

I'm leaving in the conditional around the legacy membar_enters
(store-before-load, store-before-store) in kern_mutex.c and in
kern_lock.c because they may still matter: store-before-load barriers
tend to be the most expensive kind, so eliding them is probably
worthwhile on x86.  (It also may not matter; I just don't care to do
measurements right now, and it's a single valid and potentially
justifiable use case in the whole tree.)

However, membar_release/acquire can be mere instruction barriers on
all TSO platforms including x86, so there's no need to go out of our
way with a bad API to conditionalize them.  If the procedure call
overhead is measurable we just could change them to be macros on x86
that expand into __insn_barrier.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2023/02/23/msg028729.html

kern_descrip.c: Change membar_enter to membar_acquire in fd_getfile.

membar_acquire is cheaper on many CPUs, and unlikely to be costlier
on any CPUs, than the legacy membar_enter.

Add a long comment explaining the interaction between fd_getfile and
fd_close and why membar_acquire is safe.

XXX pullup-10

kern_descrip.c: Use atomic_store_relaxed/release for ff->ff_file.

1. atomic_store_relaxed in fd_close avoids the appearance of race in
   sanitizers (minor bug).

2. atomic_store_release in fd_affix is necessary because the lock
   activity was not, in fact, enough to guarantee ordering (real bug
   some architectures like aarch64).

   The premise appears to have been that the mutex_enter/exit earlier
   in fd_affix is enough to guarantee that initialization of fp (A)
   happens before use of fp by a user once fp is published (B):

	fp->f_... = ...;		// A

	/* fd_affix */
	mutex_enter(&fp->f_lock);
	fp->f_count++;
	mutex_exit(&fp->f_lock);
	...
	ff->ff_file = fp;		// B

   But actually mutex_enter/exit allow the following reordering by
   the CPU:

	mutex_enter(&fp->f_lock);
	ff->ff_file = fp;		// B
	fp->f_count++;
	fp->f_... = ...;		// A
	mutex_exit(&fp->f_lock);

   The only constraints they imply are:

	1. fp->f_count++ and B cannot precede mutex_enter
	2. mutex_exit cannot precede A and fp->f_count++

   They imply no constraint on the relative ordering of A, B, and
   fp->f_count++ amongst each other, however.

   This affects any architecture that has a native load-acquire or
   store-release operation in mutex_enter/exit, like aarch64, instead
   of explicit load-before-load/store and load/store-before-store
   barrier.

No need for atomic_store_* in fd_copy or fd_free because we have
exclusive access to ff as is.

XXX pullup-9
XXX pullup-10

kern_descrip.c: Fix membars around reference count decrement.

In general, the `last one out hit the lights' style of reference
counting (as opposed to the `whoever's destroying must wait for
pending users to finish' style) requires memory barriers like so:

	... usage of resources associated with object ...
	membar_release();
	if (atomic_dec_uint_nv(&obj->refcnt) != 0)
		return;
	membar_acquire();
	... freeing of resources associated with object ...

This way, all usage happens-before all freeing.  This fixes several
errors:

- fd_close failed to ensure whatever its caller did would
  happen-before the freeing, in the case where another thread is
  concurrently trying to close the fd (ff->ff_file == NULL).

  Fix: Add membar_release before atomic_dec_uint(&ff->ff_refcnt) in
  that branch.

- fd_close failed to ensure all loads its caller had issued will have
  happened-before the freeing, in the case where the fd is still in
  use by another thread (fdp->fd_refcnt > 1 and ff->ff_refcnt-- > 0).

  Fix: Change membar_producer to membar_release before
  atomic_dec_uint(&ff->ff_refcnt).

- fd_close failed to ensure that any usage of fp by other callers
  would happen-before any freeing it does.

  Fix: Add membar_acquire after atomic_dec_uint_nv(&ff->ff_refcnt).

- fd_free failed to ensure that any usage of fdp by other callers
  would happen-before any freeing it does.

  Fix: Add membar_acquire after atomic_dec_uint_nv(&fdp->fd_refcnt).

While here, change membar_exit -> membar_release.  No semantic
change, just updating away from the legacy API.

XXX pullup-8
XXX pullup-9
XXX pullup-10

Sync with HEAD.

Add containment for the cloning devices hack in vn_open.

Cloning devices (and also things like /dev/stderr) work by allocating
a struct file, stuffing it in the file table (which is a layer
violation), stuffing the file descriptor number for it in a magic
field of struct lwp (which is gross), and then "failing" with one of
two magic errnos, EDUPFD or EMOVEFD.

Before this commit, all callers of vn_open in the kernel (there are
quite a few) were expected to check for these errors and handle the
situation. Needless to say, none of them except for open() itself did,
resulting in internal negative errnos being returned to userspace.

This hack is fairly deeply rooted and cannot be eliminated all at
once. This commit adds logic to handle the magic errnos inside
vn_open; now on success vn_open returns either a vnode or an integer
file descriptor, along with a flag that says whether the underlying
code requested EDUPFD or EMOVEFD. Callers not prepared to cope with
file descriptors can pass NULL for the extra return values, in which
case if a file descriptor would be produced vn_open fails with
EOPNOTSUPP.

Since I'm rearranging vn_open's signature anyway, stop exposing struct
nameidata. Instead, take three arguments: an optional vnode to use as
the starting point (like openat()), the path, and additional namei
flags to use, restricted to NOCHROOT and TRYEMULROOT. (Other namei
behavior, e.g. NOFOLLOW, can be requested via the open flags.)

This change requires a kernel bump. Ride the one an hour ago.
(That was supposed to be coordinated; did not intend to let an hour
slip by. My fault.)

Sync w/ HEAD.

Avoid negating the minimum size of pid_t (this overflows).

Reported-by: syzbot+e2eb02f9dfaf4f2e6626@syzkaller.appspotmail.com

We already zeroed the struct, no point in zeroing things twice.

Just zero out struct file::f_lock when exposed to userland.

Userland has no business examining a snapshot of the lock state, even
if pseudonymized.  Should fix hppa build, where kmutex_t is somewhat
larger than anticipated by recent changes.

Instead of returning 0 when sysctl kern.expose_address=0, return a random
hashed value of the data. This allows sockstat to work without exposing
kernel addresses or being setgid kmem.

Move proc_lock into the data segment.  It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Merge changes from current as of 20200406

Sync with head.

Load struct fdfile::ff_file with atomic_load_consume.

Exceptions: when we're only testing whether it's there, not about to
dereference it.

Note: We do not use atomic_store_release to set it because the
preceding mutex_exit should be enough.

(That said, it's not clear the mutex_enter/exit is needed unless
refcnt > 0 already, in which case maybe it would be a win to switch
from the membar implied by mutex_enter to the membar implied by
atomic_store_release -- which I would generally expect to be much
cheaper.  And a little clearer without a long comment.)

Load struct filedesc::fd_dt with atomic_load_consume.

Exceptions: when fd_refcnt <= 1, or when holding fd_lock.

While here:

- Restore KASSERT(mutex_owned(&fdp->fd_lock)) in fd_unused.
  => This is used only in fd_close and fd_abort, where it holds.
- Move bounds check assertion in fd_putfile to where it matters.
- Store fd_dt with atomic_store_release.
- Move load of fd_dt under lock in knote_fdclose.
- Omit membar_consumer in fdesc_readdir.
  => atomic_load_consume serves the same purpose now.
  => Was needed only on alpha anyway.

Sync with HEAD

handle O_NOSIGPIPE too.

Synch with HEAD

Add KASSERT.

Sync with HEAD, resolve a couple of conflicts

Fix kernel pointer leaks in the kern.file sysctl, same as kern.file2.

Rename fill_file -> fill_file2, since that's the KERN_FILE2 sysctl.

Add LIST_INIT for filehead.

Sync with head

Provide a sysctl kern.expose_address to expose kernel addresses in
sysctl structure returns for non-root. Defaults to off. Turning it
on will restore sockstat/fstat and friends for regular users.

Ssync with HEAD

Don't leak kernel pointers to userland in kern.file2, same as kern.proc2.

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int.  The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER!  Some subsystems have

	#define min(a, b)	((a) < (b) ? (a) : (b))
	#define max(a, b)	((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX.  Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate.  But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all.  (Who knows, maybe in some cases integer
truncation is actually intended!)

Sync with HEAD

Avoid unportable signed integer left shift in fd_unused()

Detected with Kernel Undefined Behavior Sanitizer.

There were at least a single place reported, for consistency fix all the
left bit shift operations.
sys/kern/kern_descrip.c:345:2, left shift of 1 by 31 places cannot be represented in type 'int'
sys/kern/kern_descrip.c:346:28, left shift of 1 by 31 places cannot be represented in type 'int'

Reported by <Harry Pantazis>

Avoid unportable signed integer left shift in fd_copy()

Detected with Kernel Undefined Behavior Sanitizer.

There were at least a single place reported, for consistency fix all the
left bit shift operations.
sys/kern/kern_descrip.c:1492:3, left shift of 1 by 31 places cannot be represented in type 'int'
sys/kern/kern_descrip.c:1493:28, left shift of 1 by 31 places cannot be represented in type 'int'

Reported by <Harry Pantazis>

Avoid unportable signed integer left shift in fd_isused()

Detected with Kernel Undefined Behavior Sanitizer.

sys/kern/kern_descrip.c:188:34, left shift of 1 by 31 places cannot be represented in type 'int'

Reported by <Harry Pantazis>

Avoid unportable signed integer left shift in fd_used()

Detected with Kernel Undefined Behavior Sanitizer.

There were at least a single place reported, for consistency fix all the
left bit shift operations.
sys/kern/kern_descrip.c:302:26, left shift of 1 by 31 places cannot be represented in type 'int'

Reported by <Harry Pantazis>

update from HEAD

Sync with HEAD

Pull up following revision(s) (requested by riastradh in ticket #1425):
	sys/kern/kern_descrip.c: revision 1.230
Explicitly set the flags instead of masking set values in.
This fixes FNONBLOCK weirdness seen in audio.c
OK christos@ and martin@.

Pull up following revision(s) (requested by riastradh in ticket #1425):
	sys/kern/kern_descrip.c: revision 1.230
Explicitly set the flags instead of masking set values in.
This fixes FNONBLOCK weirdness seen in audio.c
OK christos@ and martin@.

Pull up following revision(s) (requested by riastradh in ticket #1425):
	sys/kern/kern_descrip.c: revision 1.230
Explicitly set the flags instead of masking set values in.
This fixes FNONBLOCK weirdness seen in audio.c
OK christos@ and martin@.

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Resolve conflicts from previous merge (all resulting from $NetBSD
keywork expansion)

Explicitly set the flags instead of masking set values in.

This fixes FNONBLOCK weirdness seen in audio.c

OK christos@ and martin@.

Sync with HEAD

Pull up following revision(s) (requested by christos in ticket #933):
	sys/kern/kern_descrip.c: revision 1.229
1. mask fflags so we don't tack on whateve oflags were passed from userland
2. honor O_CLOEXEC, so the children of daemons that use cloning devices, don't
   end up with the parents descriptors
fd_clone and in general the fd approach of 'allocate' > 'play with guts' >
'attach' should be converted to be more constructor like.

1. mask fflags so we don't tack on whateve oflags were passed from userland
2. honor O_CLOEXEC, so the children of daemons that use cloning devices, don't
   end up with the parents descriptors
fd_clone and in general the fd approach of 'allocate' > 'play with guts' >
'attach' should be converted to be more constructor like.
XXX: pullup-{6,7}

remove casts to the same type.

Try not to use f_data, use f_{vnode,socket,pipe,mqueue,kqueue,ksem} to get
a correctly typed pointer.

Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Rebase to HEAD as of a few days ago.

Rebase.

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

Remove __CT_LOCAL_.. hack

Avoid warnings for a local CTASSERT

In fd_abort(), reset ff_exclose to preserve invariants expected by fd_free()

resync with head

sync with (a bit old) head

Pull up revisions:
  src/sys/kern/kern_event.c revision 1.79
  src/sys/kern/kern_descrip.c revision 1.219
  src/lib/libc/sys/kqueue.2 revision 1.33
  src/tests/lib/libc/sys/t_kevent.c revision 1.2-1.5
(requested by christos in ticket #716).

- initialize kn_id
- in close, invalidate f_data and f_type early to prevent accidental re-use
- add a DIAGNOSTIC for when we use unsupported fd's and a KASSERT for f_event
  being NULL.

Return EOPNOTSUPP for fnullop_kqfilter to prevent registration of unsupported
fds. XXX: We should really fix the fd's to be supported in the future.
Unsupported fd's have a NULL f_event, so registering crashes the kernel with
a NULL function dereference of f_event.

mention that kevent returns now EOPNOTSUPP.

Move the references to PRs from code comments to the test description. Once
ATF has the ability to output the metadata in the HTML reports, it should be
easy to traverse between releng and gnats -reports via links.

Add a (skipped for now) test case for PR 46463

adapt to new reality

Add a test for adding an event to an unsupported fd.

Pull up revisions:
  src/sys/kern/kern_event.c revision 1.79
  src/sys/kern/kern_descrip.c revision 1.219
  src/lib/libc/sys/kqueue.2 revision 1.33
  src/tests/lib/libc/sys/t_kevent.c revision 1.2-1.5
(requested by christos in ticket #716).

- initialize kn_id
- in close, invalidate f_data and f_type early to prevent accidental re-use
- add a DIAGNOSTIC for when we use unsupported fd's and a KASSERT for f_event
  being NULL.

Return EOPNOTSUPP for fnullop_kqfilter to prevent registration of unsupported
fds. XXX: We should really fix the fd's to be supported in the future.
Unsupported fd's have a NULL f_event, so registering crashes the kernel with
a NULL function dereference of f_event.

mention that kevent returns now EOPNOTSUPP.

Move the references to PRs from code comments to the test description. Once
ATF has the ability to output the metadata in the HTML reports, it should be
easy to traverse between releng and gnats -reports via links.

Add a (skipped for now) test case for PR 46463

adapt to new reality

Add a test for adding an event to an unsupported fd.

Return EOPNOTSUPP for fnullop_kqfilter to prevent registration of unsupported
fds. XXX: We should really fix the fd's to be supported in the future.
Unsupported fd's have a NULL f_event, so registering crashes the kernel with
a NULL function dereference of f_event.

sync with head

merge to -current.

As discussed in tech-kern, provide the means to prevent delivery of SIGPIPE
on EPIPE for all file descriptor types:

- provide O_NOSIGPIPE for open,kqueue1,pipe2,dup3,fcntl(F_{G,S}ETFL) [NetBSD]
- provide SOCK_NOSIGPIPE for socket,socketpair [NetBSD]
- provide SO_NOSIGPIPE for {g,s}seckopt [NetBSD/FreeBSD/MacOSX]
- provide F_{G,S}ETNOSIGPIPE for fcntl [MacOSX]

in fd_allocfile(), free the fd if we fail to allocate a file.

fail with EINVAL if flags not are not O_CLOEXEC|O_NONBLOCK in pipe2(2) and
dup3(2)

* Arrange for interfaces that create new file descriptors to be able to
  set close-on-exec on creation (http://udrepper.livejournal.com/20407.html).

    - Add F_DUPFD_CLOEXEC to fcntl(2).
    - Add MSG_CMSG_CLOEXEC to recvmsg(2) for unix file descriptor passing.
    - Add dup3(2) syscall with a flags argument for O_CLOEXEC, O_NONBLOCK.
    - Add pipe2(2) syscall with a flags argument for O_CLOEXEC, O_NONBLOCK.
    - Add flags SOCK_CLOEXEC, SOCK_NONBLOCK to the socket type parameter
      for socket(2) and socketpair(2).
    - Add new paccept(2) syscall that takes an additional sigset_t to alter
      the sigmask temporarily and a flags argument to set SOCK_CLOEXEC,
      SOCK_NONBLOCK.
    - Add new mode character 'e' to fopen(3) and popen(3) to open pipes
      and file descriptors for close on exec.
    - Add new kqueue1(2) syscall with a new flags argument to open the
      kqueue file descriptor with O_CLOEXEC, O_NONBLOCK.

* Fix the system calls that take socklen_t arguments to actually do so.

* Don't include userland header files (signal.h) from system header files
  (rump_syscallargs.h).

* Bump libc version for the new syscalls.

Sync with HEAD.

sync with head

Drop extern inline for fd_getfile().  Apparently, GCC already ignores it.

- Sprinkle __cacheline_aligned and __read_mostly in file descriptor code.
- While here, remove trailing whitespaces, KNF.

sync with head

- Add O_CLOEXEC to open(2)
- Add fd_set_exclose() to encapsulate uses of FIO{,N}CLEX, O_CLOEXEC, F{G,S}ETFD
- Add a pipe1() function to allow passing flags to the fd's that pipe(2)
  opens to ease implementation of linux pipe2(2)
- Factor out fp handling code from open(2) and fhopen(2)

sync with head

Sync with HEAD

Support FD_CLOEXEC in rump kernels.

Sync with HEAD

Move sysctl routines from init_sysctl.c to kern_descrip.c (for
descriptors) and kern_proc.c (for processes).  This makes them
usable in a rump kernel, in case somebody was wondering.

Update comment and inspired by that update variable naming too.
no functional change.

update some comments

Sync with HEAD.

Attach implicit threads to initproc instead of proc0.  This way
applications which alter, by purpose or by accident, the uid in an
implicit thread are don't affect kernel threads.

from discussion with njoly

Sync with HEAD (-D20101022).

sync with head

Actually, the comment probably meant "would be nice to KASSERT here,
but can't".  So turn it into a KASSERT now that it's possible.

Remove XXX comment.  I'm not sure what it precisely means, but I'm
guessing it's from a time when rump used filedesc0 for everything
(and that isn't true anymore).

Sync with HEAD.

sync with head.

Remove overzealous KASSERT: the refcount can be non-zero if another
thread attempts to use a non-open file descriptor.  from ad

fixes PR kern/43694

sync with head

Remove pfind() and pgfind(), fix locking in various broken uses of these.
Rename real routines to proc_find() and pgrp_find(), remove PFIND_* flags
and have consistent behaviour.  Provide proc_find_raw() for special cases.
Fix memory leak in sysctl_proc_corename().

COMPAT_LINUX: rework ptrace() locking, minimise differences between
different versions per-arch.

Note: while this change adds some formal cosmetics for COMPAT_DARWIN and
COMPAT_IRIX - locking there is utterly broken (for ages).

Fixes PR/43176.

sync with head

If a multithreaded app closes an fd while another thread is blocked in
read/write/accept, then the expectation is that the blocked thread will
exit and the close complete.
Since only one fd is affected, but many fd can refer to the same file,
the close code can only request the fs code unblock with ERESTART.
Fixed for pipes and sockets, ERESTART will only be generated after such
a close - so there should be no change for other programs.
Also rename fo_abort() to fo_restart() (this used to be fo_drain()).
Fixes PR/26567

Rename fo_drain() to fo_abort(), 'drain' is used to mean 'wait for output
do drain' in many places, whereas fo_drain() was called in order to force
blocking read()/write() etc calls to return to userspace so that a close()
call from a different thread can complete.
In the sockets code comment out the broken code in the inner function,
it was being called from compat code.

- Amend fd_hold() to take an argument and add assert (reflects two cases,
  fork1() and the rest, e.g. kthread_create(), when creating from lwp0).

- lwp_create(): do not touch filedesc internals, use fd_hold().

sync with head.

assertion

Sync with HEAD.

sync with head.

Update fd_freefile when kqueue descriptors are not copied from
parent to child. From Wolfgang Solfrank in PR kern/41651.
Approved by Andrew Doran.

sync with head

fd_free: fix posix advisory locks.  PR/41549 from HITOSHI OSADA.

shut up the following assertion failure and add a comment.

	panic: kernel diagnostic assertion "!fd_isused(fdp, fd)" failed: file "/siro/nbsd/src/sys/kern/kern_descrip.c", line 175

fd_free: reset fd_himap/lomap to make fd_checkmaps comfortable.  PR/41487.

wrap a long line.

PR kern/41487: kern_descrip.c assertion failure

Remove bogus assertion.

More changes to improve kern_descrip.c.

- Avoid atomics in more places.
- Remove the per-descriptor mutex, and just use filedesc_t::fd_lock.
  It was only being used to synchronize close, and in any case we needed
  to take fd_lock to free the descriptor slot.
- Optimize certain paths for the <NDFDFILE case.
- Sprinkle more comments and assertions.
- Cache more stuff in filedesc_t.
- Fix numerous minor bugs spotted along the way.
- Restructure how the open files array is maintained, for clarity and so
  that we can eliminate the membar_consumer() call in fd_getfile().  This is
  mostly syntactic sugar; the main functional change is that fd_nfiles now
  lives alongside the open file array.

Some measurements with libmicro:

- simple file syscalls are like close() are between 1 to 10% faster.
- some nice improvements, e.g. poll(1000) which is ~50% faster.

Make descriptor access and file allocation cheaper in many cases,
mostly by avoiding a bunch of atomic operations.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Sync with HEAD.

Pull up following revision(s) (requested by ad in ticket #661):
	sys/arch/xen/xen/xenevt.c: revision 1.32
	sys/compat/svr4/svr4_net.c: revision 1.56
	sys/compat/svr4_32/svr4_32_net.c: revision 1.19
	sys/dev/dmover/dmover_io.c: revision 1.32
	sys/dev/putter/putter.c: revision 1.21
	sys/kern/kern_descrip.c: revision 1.190
	sys/kern/kern_drvctl.c: revision 1.23
	sys/kern/kern_event.c: revision 1.64
	sys/kern/sys_mqueue.c: revision 1.14
	sys/kern/sys_pipe.c: revision 1.109
	sys/kern/sys_socket.c: revision 1.59
	sys/kern/uipc_syscalls.c: revision 1.136
	sys/kern/vfs_vnops.c: revision 1.164
	sys/kern/uipc_socket.c: revision 1.188
	sys/net/bpf.c: revision 1.144
	sys/net/if_tap.c: revision 1.55
	sys/opencrypto/cryptodev.c: revision 1.47
	sys/sys/file.h: revision 1.67
	sys/sys/param.h: patch
	sys/sys/socketvar.h: revision 1.119
Add fileops::fo_drain(), to be called from fd_close() when there is more
than one active reference to a file descriptor. It should dislodge threads
sleeping while holding a reference to the descriptor. Implemented only for
sockets but should be extended to pipes, fifos, etc.
Fixes the case of a multithreaded process doing something like the
following, which would have hung until the process got a signal.
thr0	accept(fd, ...)
thr1	close(fd)

Add fileops::fo_drain(), to be called from fd_close() when there is more
than one active reference to a file descriptor. It should dislodge threads
sleeping while holding a reference to the descriptor. Implemented only for
sockets but should be extended to pipes, fifos, etc.

Fixes the case of a multithreaded process doing something like the
following, which would have hung until the process got a signal.

thr0	accept(fd, ...)
thr1	close(fd)

Pull up following revision(s) (requested by rmind in ticket #619):
	sys/kern/kern_descrip.c: revision 1.189
fownsignal: pre-check for zero pgid, avoids locking of proc_lock.

fownsignal: pre-check for zero pgid, avoids locking of proc_lock.

Pull up following revision(s) (requested by mrg in ticket #577):
	sys/kern/kern_descrip.c: revision 1.188
	sys/kern/uipc_usrreq.c: revision 1.121
	sys/sys/fcntl.h: revision 1.35
	sys/sys/file.h: revision 1.66
	sys/sys/param.h: patch
	sys/sys/un.h: revision 1.45
completely rework the way that orphaned sockets that are being fdpassed
via SCM_RIGHTS messages are dealt with:
1. unp_gc: make this a kthread.
2. unp_detach: go not call unp_gc directly. instead, wake up unp_gc kthread.
3. unp_scan: do not close files here. instead, put them on a global list
   for unp_gc to close, along with a per-file "deferred close count". if
   file is already enqueued for close, just increment deferred close count.
   this eliminates the recursive calls.
3. unp_gc: scan files on global deferred close list. close each file N
   times, as specified by deferred close count in file. continue processing
   list until it becomes empty (closing may cause additional files to be
   queued for close).
4. unp_gc: add additional bit to mark files we are scanning. set during
   initial scan of global file list that currently clears FMARK/FDEFER.
   during later scans, never examine / garbage collect descriptors that
   we have not marked during the earlier scan. do not proceed with this
   initial scan until all deferred closes have been processed. be careful
   with locking to ensure no races are introduced between deferred close
   and file scan.
5. unp_gc: use dummy file_t to mark position in list when scanning. allow
   us to drop filelist_lock. in turn allows us to eliminate kmem_alloc()
   and safely close files, etc.
6. prohibit transfer of descriptors within SCM_RIGHTS messages if
   (num_files_in_transit > maxfiles / unp_rights_ratio)
7. fd_allocfile: ensure recycled filse don't get scanned.
this is 97% work done by andrew doran, with a couple of minor bug fixes
and a lot of testing by yours truly.

Pull up following revision(s) (requested by mrg in ticket #566):
	sys/kern/init_sysctl.c: revision 1.157
	sys/kern/kern_descrip.c: revision 1.187
	usr.sbin/pstat/pstat.c: revision 1.112
Don't bother with file_t::f_iflags any more, as it's not used.
Noted by mrg@.

completely rework the way that orphaned sockets that are being fdpassed
via SCM_RIGHTS messages are dealt with:

1. unp_gc: make this a kthread.

2. unp_detach: go not call unp_gc directly. instead, wake up unp_gc kthread.

3. unp_scan: do not close files here. instead, put them on a global list
   for unp_gc to close, along with a per-file "deferred close count". if
   file is already enqueued for close, just increment deferred close count.
   this eliminates the recursive calls.

3. unp_gc: scan files on global deferred close list. close each file N
   times, as specified by deferred close count in file. continue processing
   list until it becomes empty (closing may cause additional files to be
   queued for close).

4. unp_gc: add additional bit to mark files we are scanning. set during
   initial scan of global file list that currently clears FMARK/FDEFER.
   during later scans, never examine / garbage collect descriptors that
   we have not marked during the earlier scan. do not proceed with this
   initial scan until all deferred closes have been processed. be careful
   with locking to ensure no races are introduced between deferred close
   and file scan.

5. unp_gc: use dummy file_t to mark position in list when scanning. allow
   us to drop filelist_lock. in turn allows us to eliminate kmem_alloc()
   and safely close files, etc.

6. prohibit transfer of descriptors within SCM_RIGHTS messages if
   (num_files_in_transit > maxfiles / unp_rights_ratio)

7. fd_allocfile: ensure recycled filse don't get scanned.


this is 97% work done by andrew doran, with a couple of minor bug fixes
and a lot of testing by yours truly.

Don't bother with file_t::f_iflags any more, as it's not used.
Noted by mrg@.

Sync with HEAD.

Pull up following revision(s) (requested by rmind in ticket #542):
	sys/kern/kern_descrip.c: revision 1.186
fd_copy: fix off-by-one bug in a race condition path and assert.
Should fix PR/40625.  OK by <ad>.

fd_copy: fix off-by-one bug in a race condition path and assert.
Should fix PR/40625.  OK by <ad>.

Pull up following revision(s) (requested by ad in ticket #358):
	sys/kern/kern_descrip.c: revision 1.185
- Fix a bug where we trashed descriptor zero in the old open files array
  while ironically trying to preserve the same during copy. Would only have
  occurred if a multithreaded program expanded the descriptor table and,
  within a tiny window of exposure, another thread in the program tried to
  access descriptor zero.
- Convert to use kmem_alloc/kmem_free.

Sync with HEAD.

Sync with HEAD.

- Fix a bug where we trashed descriptor zero in the old open files array
  while ironically trying to preserve the same during copy. Would only have
  occurred if a multithreaded program expanded the descriptor table and,
  within a tiny window of exposure, another thread in the program tried to
  access descriptor zero.

- Convert to use kmem_alloc/kmem_free.

Update haad-dm branch to haad-dm-base2.

Move fd_closeexec() and fd_checkstd() from kern_descrip to their
own file, subr_exec_fd.c (they're used only by exec).

After this change, the kernel source modules are in a partitioned
enough state to allow building a system without vfs at all.

cwd is logically a vfs concept, so take it out from the bosom of
kern_descrip and into vfs_cwd.  No functional change.

Sync with wrstuden-revivesa-base-2.

Sync with head.

Sync with HEAD.

Change {ff,fd}_exclose and ff_allocated to bool.  Change exclose arg to
fd_dup to bool.  Switch assignments from 1/0 to true/false.

This make alpha kernels compile.  Bump kern to 4.99.69 since structure
changed.

Switch from KASSERT to CTASSERT for those asserts testing sizes of types.

Sync with HEAD.

Sync with head.

ioctl commands are unsigned long.  Changes ABI for fsetown() and fgetown() on 64-bit architectures.

Sync with HEAD.

sync with head.

sync with head.

Per discussion with ad, remove most of the #include <sys/sa.h> lines
as they were including sa.h just for the type(s) needed for syscallargs.h.

Instead, create a new file, sys/satypes.h, which contains just the
types needed for syscallargs.h. Yes, there's only one now, but that
may change and it's probably more likely to change if it'd be difficult
to handle. :-)

Per discussion with matt at n dot o, add an include of satypes.h to
sigtypes.h. Upcall handlers are kinda signal handlers, and signalling
is the header file that's already included for syscallargs.h that
closest matches SA.

This shaves about 3000 lines off of the diff of the branch relative
to the base. That also represents about 18% of the total before this
checkin.

I think this reduction is very good thing.

Initial checkin of re-adding SA. Everything except kern_sa.c
compiles in GENERIC for i386. This is still a work-in-progress, but
this checkin covers most of the mechanical work (changing signalling
to be able to accomidate SA's process-wide signalling and re-adding
includes of sys/sa.h and savar.h). Subsequent changes will be much
more interesting.

Also, kern_sa.c has received partial cleanup. There's still more
to do, though.

- Convert hashinit() to use kmem_alloc(). The hash tables can be large
  and it's better to not have them in kmem_map.
- Convert a couple of minor items along the way to kmem_alloc().
- Fix some memory leaks.

Remove clause 3 and 4 from TNF licenses

Merge proc::p_mutex and proc::p_smutex into a single adaptive mutex, since
we no longer need to guard against access from hardware interrupt handlers.

Additionally, if cloning a process with CLONE_SIGHAND, arrange to have the
child process share the parent's lock so that signal state may be kept in
sync. Partially addresses PR kern/37437.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
  be sent from a hardware interrupt handler. Signal activity must be
  deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
  and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

Commit fix for the fdfile leak described in PR 38374.

Patch provided by YAMAMOTO Takashi.

Ok ad@

Sync with HEAD.

Replace use of CACHE_LINE_SIZE in some obvious places.

sync with head.

sync with HEAD

File descriptor changes, discussed on tech-kern:

- Redo reference counting to be sane.  LWPs accessing files take a short
  term reference on the local file descriptor.  This is the most common
  case.  While a file is in a process descriptor table, a reference is
  held to the file.  The file reference count only changes during control
  operations like open() or close().  Code that comes at files from an
  unusual direction (i.e. foreign to the process) like procfs or sysctl
  takes a reference on the file (f_count), and not on a descriptor.

- Remove knowledge of reference counting and locking from most code that
  deals with files.

- Make the usual case of file descriptor lookup lockless.

- Make kqueue MP and MT safe. PR kern/38098, PR kern/38137.

- Fix numerous file handling bugs, and bugs in the descriptor code that
  affected multithreaded processes.

- Split descriptor system calls out into sys_descrip.c.

- A few stylistic changes: KNF, remove unused casts now that caddr_t is
  gone. Replace dumb gotos with loop control in a few places.

- Don't do redundant pointer passing (struct proc, lwp, filedesc *) unless
  the routine is likely to be inlined.  Most of the time it's about the
  current process.

Sync with HEAD.

sync with head.

- Shrink 'struct file' to 60 bytes on 32-bit platforms.
- Align 'struct file' and 'struct filedesc' to CACHE_LINE_SIZE.

sync with head.

Move the prototype for do_posix_fadvise() somewhere useful.

Implement new version of posix_fadvise as a stub callinig the real
worker function, and compatibility stub doing the same with old argument
sturcture.

sync with head

sync with HEAD

Sync with HEAD

Add fgetdummy/fputdummy: allocate and free dummy 'struct file' entries
to be used when traversing filehead.

Use FILE_LOCK() and FILE_UNLOCK()

Sync with HEAD

Sync with HEAD.

Sync with head.

Merge more changes from vmlocking2, mainly:

- Locking improvements.
- Use pool_cache for more items.

Convert all the system call entry points from:
    int foo(struct lwp *l, void *v, register_t *retval)
to:
    int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

Unused var

Eliminate contention on filelist_lock.

Sync with HEAD.

Remove cn_lwp from struct componentname.  curlwp should be used
from on.  The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

Sync with HEAD.

sync with head

Sync with HEAD.

Use atomics to adjust filedesc::fd_refcnt.

Use atomics to adjust cwdi_refcnt.

Sync with HEAD.

sync with head.

Sync with HEAD

Sync with HEAD.

sync with -HEAD

Merge from vmlocking:

- pool_cache changes.
- Debugger/procfs locking fixes.
- Other minor changes.

sync with HEAD

sync with head.

Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.

sync with head.

Sync with head.

Sync with head.

Merge file descriptor locking, cwdi locking and cross-call changes
from the vmlocking branch.

Sync with HEAD.

Sync with HEAD.

Implementation of POSIX message queues.

Reviewed by: <ad>, <tech-kern>

sync with head.

Use pool_cache for allocating a few more types of objects.

Sync with head.

Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

closef: restore check for l == NULL removed in revision 1.153.2.4.
Noted by yamt.

Sync with head.

sync with head.

- Pass the error number and residual count to biodone(), and let it handle
  setting error indicators. Prepare to eliminate B_ERROR.
- Add a flag argument to brelse() to be set into the buf's flags, instead
  of doing it directly. Typically used to set B_INVAL.
- Add a "struct cpu_info *" argument to kthread_create(), to be used to
  create bound threads. Change "bool mpsafe" to "int flags".
- Allow exit of LWPs in the IDL state when (l != curlwp).
- More locking fixes & conversion to the new API.

Split the fcntl locking code out from its copyin/out.
Use to avoid all the stackgap stuff in compat code.

sync with head.

I'm not sure why I decided that cwdinit() shouldn't copy cwd_edir.
Since this is called in fork() it does rather need to give the child
process the parent's emulation root.
This means that (for example) an emulated shell will, by default, run
programs from the emulation root.

Change the way that emulations locate files within the emulation root to
  avoid having to allocate space in the 'stackgap'
  - which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
  the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
  during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
  search for absolute pathnames in the emulation root, if that fails it will
  retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
  of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
  relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
  inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
  the real root is returned instead (matching the behaviour of emul_lookup,
  but being a cheap comparison here) so that programs that scan "../.."
  looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
  CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
  TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

filedesc::fd_lock a reader/writer lock, for multithreaded processes.

Pullup to -current

sync with head.

Somehow a single K&R function definition was lurking - nuke it.

- Replace more simple_locks, and fix up in a few places.
- Use condition variables.
- LOCK_ASSERT -> KASSERT.

Sync with head.

Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

Sync with HEAD.

Split the work for sys_stat, sys_lstat, sys_fstat and sys_fhstat out into
separate functions that don't do the copyout.
This allows all the compat_xxx versions to convert the 'struct stat' to
the correct format without using the 'stackgap'.
The stackgap isn't at all LWP friendly, and needs to be removed from
any compat functions that might involve threads (inc. clone()).
The code is still binary compatible with existing LKMs.

- Make the proclist_lock a mutex. The write:read ratio is unfavourable,
  and mutexes are cheaper use than RW locks.
- LOCK_ASSERT -> KASSERT in some places.
- Hold proclist_lock/kernel_lock longer in a couple of places.

- sync with head.
- move sched_changepri back to kern_synch.c as it doesn't know PPQ anymore.

sync with head.

Change the process/lwp flags seen by userland via sysctl back to the
P_*/L_* naming convention, and rename the in-kernel flags to avoid
conflict. (P_ -> PK_, L_ -> LW_ ). Add back the (now unused) LSDEAD
constant.

Restores source compatibility with pre-newlock2 tools like ps or top.

Reviewed by Andrew Doran.

Merge newlock2 to head.

Sync with head.

ffree(): don't call kauth_cred_free() with a held simplelock.

Remove support for SA. Ok core@.

Sync with head.

sync with head.

sync with head.

use KSI_INIT rather than memset.  no functional changes.

Sync with head.

Checkpoint work in progress.

remove some __unused from function parameters.

sync with head

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

- Allocate and free turnstiles where needed.
- Split proclist_mutex and alllwp_mutex out of the proclist_lock,
  and use in interrupt context.
- Fix an MP race in enterpgrp()/setsid().
- Acquire proclist_lock and p_crmutex in some obvious places.

sync with head

sync with head.

add missing initializer

sync with head

Use the LWP cached credentials where sane.

sync with head.

Sync with head.

Merge 2006-05-24 NetBSD-current into the "peter-altq" branch.

sync with head.

integrate kauth.

- Move kauth_cred_t declaration to <sys/types.h>
- Cleanup struct ucred; forward declarations that are unused.
- Don't include <sys/kauth.h> in any header, but include it in the c files
  that need it.

Approved by core.

Sync with head.

sync with head.

Coverity CID 845: Make it clear that devnullfp != NULL.

sync with head.

Adapt to kernel authorization KPI.

file kern_descrip.c was added on branch elad-kernelauth on 2006-03-08 00:53:40 +0000

remove the no longer useful fdavail(), as proposed and (thankfully) not
discussed on tech-kern

sync with head.

falloc: grab fd_slock when calling fd_unused.

Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.

merge ktrace-lwp.

Sync with head.

merge yamt-readahead branch.

- associate read-ahead context to vnode, rather than file.
- revert VOP_READ prototype.

use UVM_ADV_ rather than POSIX_FADV_.

update a comment following posix_fadvise prototype change.

sys_posix_fadvise: correct how to return an error.

add posix_fadvise.

- setup/cleanup readahead context.
- adapt to the new VOP_READ prototype.

Sync with HEAD. Here we go again...

fix a bug pointed out by der mouse on tech-kern: in F_GETOWN, use a
pointer to a temporary "int" variable to pass to fo_ioctl(TIOCGPGRP), not
a register_t pointer.  (how did F_GETOWN ever work on sparc64 before?)

64 bit inode changes.

Use ANSI function decls.  Apply some static.

- add const.
- remove unnecessary casts.
- add __UNCONST casts and mark them with XXXUNCONST as necessary.

Pull up revision 1.132 (requested by wrstuden in ticket #331):
The file being closed is (fdp->fd_lastfile - i), not i. So compare
(fdp->fd_lastfile - i) against fd_knlistsize. Otherwise we can
call knote_fdclose() on a file descriptor that doesn't have a knote.
This issue explains random panics I have had on process exit over the
past few years.

Pull up revision 1.132 (requested by wrstuden in ticket #1537):
The file being closed is (fdp->fd_lastfile - i), not i. So compare
(fdp->fd_lastfile - i) against fd_knlistsize. Otherwise we can
call knote_fdclose() on a file descriptor that doesn't have a knote.
This issue explains random panics I have had on process exit over the
past few years.

Pull up revision 1.132 (requested by wrstuden in ticket #1537):
The file being closed is (fdp->fd_lastfile - i), not i. So compare
(fdp->fd_lastfile - i) against fd_knlistsize. Otherwise we can
call knote_fdclose() on a file descriptor that doesn't have a knote.
This issue explains random panics I have had on process exit over the
past few years.

The file being closed is (fdp->fd_lastfile - i), not i. So compare
(fdp->fd_lastfile - i) against fd_knlistsize. Otherwise we can
call knote_fdclose() on a file descriptor that doesn't have a knote.

This issue explains random panics I have had on process exit over the
past few years.

sync with -current

sync with head.  xen and whitespace.  xen part is not finished.

Pull up revision 1.128 via patch (requested by cube in ticket #1089):
fd_lastfile should be -1 when there are no opened file descriptors.
Hence, make find_last_set return -1 in such situation, and initialize it
such.  Otherwise, with 0 meaning two things, it confused the F_CLOSEM
fcntl which could end up looping indifintely (PR#28929 by Brian Marcotte).
However, this change enlightens another bug in fdcopy(), where more entries
than needed were cleared in the new file descriptor table, so the memset()
call there is fixed too.
Analyzed with the help of Greg Oster.

Pull up revision 1.128 via patch (requested by cube in ticket #1089):
fd_lastfile should be -1 when there are no opened file descriptors.
Hence, make find_last_set return -1 in such situation, and initialize it
such.  Otherwise, with 0 meaning two things, it confused the F_CLOSEM
fcntl which could end up looping indifintely (PR#28929 by Brian Marcotte).
However, this change enlightens another bug in fdcopy(), where more entries
than needed were cleared in the new file descriptor table, so the memset()
call there is fixed too.
Analyzed with the help of Greg Oster.

Sync with HEAD.

Hi Perry!

nuke trailing whitespace

Reduce diff to HEAD

Sync with HEAD.

pass the flag to fdclone.

Sync with HEAD.

As fd_lastfile might be negative, we can't use the (u_int) cast trick to
compare fd and fdp->fd_lastfile in fdrelease(), so change the test to a
more explicit one.  Spotted by Matt Thomas.

Should fix the panic reported by Matthias Scheler.

fd_lastfile should be -1 when there are no opened file descriptors.
Hence, make find_last_set return -1 in such situation, and initialize it
such.  Otherwise, with 0 meaning two things, it confused the F_CLOSEM
fcntl which could end up looping indifintely (PR#28929 by Brian Marcotte).

However, this change enlightens another bug in fdcopy(), where more entries
than needed were cleared in the new file descriptor table, so the memset()
call there is fixed too.

Analyzed with the help of Greg Oster.

Sync with HEAD.

Cloning cleanup:
1. make fileops const
2. add 2 new negative errno's to `officially' support the cloning hack:
    - EDUPFD (used to overload ENODEV)
    - EMOVEFD (used to overload ENXIO)
3. Created an fdclone() function to encapsulate the operations needed for
   EMOVEFD, and made all cloners use it.
4. Centralize the local noop/badop fileops functions to:
   fnullop_fcntl, fnullop_poll, fnullop_kqfilter, fbadop_stat

Fix the sync with head I botched.

Sync with HEAD.

Sync with HEAD

Pull up revision 1.124 (requested by tls in ticket #634):
add assertions related to file descriptor allocation.

Implement mutexes for file descriptor and current working directory access.
Fix a potential race condition when reallocating storage for file descriptors
(even for non-SMP kernels).
Add missing locks for `struct file' ref count updates.

Initialise (most) pools from a link set instead of explicit calls
to pool_init.  Untouched pools are ones that either in arch-specific
code, or aren't initialiased during initial system startup.

 Convert struct session, ucred and lockf to pools.

add assertions related to file descriptor allocation.

fix F_MAXFD fcntl - it returned the value as errno instead
of return value from the syscall
from mouss <usebsd at free dot fr>

Ad F_CLOSEM, F_MAXFD from Matt Thomas.

fix off by one in find_last_set(); triggered for processes that have no
open file descriptors; found by tim robbins from freebsd

fdcopy: copy inline bitmaps properly.
hopefully fixes PR/23469.

fix typos in comments.

- fix an use-after-free bug in /dev/fd/* handling.
  specifically, don't keep a stale pointer in fd_ofiles.
  it isn't needed anymore as fd allocation is now done using bitmaps.
- clean up dupfdopen() a little.
- don't call fd_used() unnecessarily.

in the non-overwritten case of sys_dup2(),
call fd_used() by itsself rather than leaving it to finishdup().

use fdremove to remove kqueue file descriptor so that bitmap information
is maintained correctly; found by Juergen Hannken-Illjes

use a two-level bitmap as suggested by mogul and banga for fdalloc;
approved thorpej@

- pass signo to fownsignal [ok by jd]
- make urg signal handling use fownsignal
- remove out of band detection in sowakeup

cleanup & uniform descriptor owner handling:
* introduce fsetown(), fgetown(), fownsignal() - this sets/retrieves/signals
  the owner of descriptor, according to appropriate sematics
  of TIOCSPGRP/FIOSETOWN/SIOCSPGRP/TIOCGPGRP/FIOGETOWN/SIOCGPGRP ioctl; use
  these routines instead of custom code where appropriate
* make every place handling TIOCSPGRP/TIOCGPGRP handle also FIOSETOWN/FIOGETOWN
  properly, and remove the translation of FIO[SG]OWN to TIOC[SG]PGRP
  in sys_ioctl() & sys_fcntl()
* also remove the socket-specific hack in sys_ioctl()/sys_fcntl() and
  pass the ioctls down to soo_ioctl() as any other ioctl

change discussed on tech-kern@

move dupfd from struct proc to struct lwp - it's per-LWP, not per-process; we
use curlwp where the lwp is not directly available, i.e. in device open
routines

briefly discussed on tech-kern

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

Apply the aborted ktrace-lwp changes to a specific branch.  This is just for
others to review, I'm concerned that patch fuziness may have resulted in some
errant code being generated but I'll look at that later by comparing the diff
from the base to the branch with the file I attempt to apply to it.  This will,
at the very least, put the changes in a better context for others to review
them and attempt to tinker with removing passing of 'struct lwp' through
the kernel.

Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records.  The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

use strlcat

Correct rewinding if FIONBIO or FIOASYNC fail in F_SETFL
(code use to always turn off FIONBIO if FIOASYNC fails)
(approved by christos)

Change caddr_t to void *

When being passed bogus file descriptors make close(2) return EBADF.
From Stephen Ma in PR kern/20762.

make fdcheckstd f_slock friendly.

Make updating a file's reference and use count MP-safe.

Use a mutex to protect the global list of open files.

Add extensible malloc types, adapted from FreeBSD.  This turns
malloc types into a structure, a pointer to which is passed around,
instead of an int constant.  Allow the limit to be adjusted when the
malloc type is defined, or with a function call, as suggested by
Jonathan Stone.

Remove variable that is only assigned too but not referenced.

Merge the nathanw_sa branch.

Sync with HEAD.

descriptor, not decriptor.

Sync with HEAD.

Quell uninitialised variable warnings.

Catch up to -current