CVS log for src/sys/kern/kern_exec.c

Up to [cvs.NetBSD.org] / src / sys / kern

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

sys/kern/kern_exec.c, exec_*.c: Nix trailing whitespace.

No functional change intended.

sys/kern/kern_exec.c, exec_*.c: Sprinkle SET_ERROR dtrace probes.

PR kern/58378: Kernel error code origination lacks dtrace probes

sys/kern/kern_exec.c, exec_*.c: Sort includes.

No functional change intended.

Pull up following revision(s) (requested by mlelstv in ticket #1000):

	sys/kern/kern_exec.c: revision 1.522

Add missing rw_exit() in error path.

Add missing rw_exit() in error path.

Defer some wakeups till lock release.

kauth_cred_hold(): return cred verbatim so that donating a reference to
another data structure can be done more elegantly.

Eliminate l->l_biglocks.  Originally I think it had a use but these days a
local variable will do.

posix_spawn(2): Plug leak in proc_alloc error branch.

sys: Use membar_release/acquire around reference drop.

This just goes through my recent reference count membar audit and
changes membar_exit to membar_release and membar_enter to
membar_acquire -- this should make everything cheaper on most CPUs
without hurting correctness, because membar_acquire is generally
cheaper than membar_enter.

sys: Membar audit around reference count releases.

If two threads are using an object that is freed when the reference
count goes to zero, we need to ensure that all memory operations
related to the object happen before freeing the object.

Using an atomic_dec_uint_nv(&refcnt) == 0 ensures that only one
thread takes responsibility for freeing, but it's not enough to
ensure that the other thread's memory operations happen before the
freeing.

Consider:

	  Thread A			  Thread B
	obj->foo = 42;			obj->baz = 73;
	mumble(&obj->bar);		grumble(&obj->quux);
	/* membar_exit(); */		/* membar_exit(); */
	atomic_dec -- not last		atomic_dec -- last
					/* membar_enter(); */
					KASSERT(invariant(obj->foo,
					    obj->bar));
					free_stuff(obj);

The memory barriers ensure that

	obj->foo = 42;
	mumble(&obj->bar);

in thread A happens before

	KASSERT(invariant(obj->foo, obj->bar));
	free_stuff(obj);

in thread B.  Without them, this ordering is not guaranteed.

So in general it is necessary to do

	membar_exit();
	if (atomic_dec_uint_nv(&obj->refcnt) != 0)
		return;
	membar_enter();

to release a reference, for the `last one out hit the lights' style
of reference counting.  (This is in contrast to the style where one
thread blocks new references and then waits under a lock for existing
ones to drain with a condvar -- no membar needed thanks to mutex(9).)

I searched for atomic_dec to find all these.  Obviously we ought to
have a better abstraction for this because there's so much copypasta.
This is a stop-gap measure to fix actual bugs until we have that.  It
would be nice if an abstraction could gracefully handle the different
styles of reference counting in use -- some years ago I drafted an
API for this, but making it cover everything got a little out of hand
(particularly with struct vnode::v_usecount) and I ended up setting
it aside to work on psref/localcount instead for better scalability.

I got bored of adding #ifdef __HAVE_ATOMIC_AS_MEMBAR everywhere, so I
only put it on things that look performance-critical on 5sec review.
We should really adopt membar_enter_preatomic/membar_exit_postatomic
or something (except they are applicable only to atomic r/m/w, not to
atomic_load/store_*, making the naming annoying) and get rid of all
the ifdefs.

Prevent escallation of privilege due to poor handling of argc == 0 in set*id
binaries by refusing to execute them.

Fix anonymous memory object leak for sigcode.

- Repeating "modload compat_linux && /emul/linux/bin/ls && modunload compat_linux"
  will reproduce this problem.
- It cause in exec_sigcode_map(), anon-object for sigcode was created at
  first exec, but it remained even after exec_remove.
- Fixed that the anon-object for sigcode is created at exec_add(), and the
  anon-object reference is removed at exec_remove().
- sigobject_lock is no longer needed since it is locked by exec_lock.
- The compat_16 module rewrites the e_sigcode entry in emul_netbsd directly and
  does not use exec_add()/exec_remove(), so it needs to call
  sigcode_alloc()/sigcode_free() on its own.

Reverte my previous changes kern_exec.c r1.512. It panics.

This changes was insufficient because es_emul is referenced by multiple execsw.

Fix anonymous memory object leak for sigcode.

- Repeating "modload compat_linux && /emul/linux/bin/ls && modunload compat_linux"
  will reproduce this problem.
- It cause in exec_sigcode_map(), anon-object for sigcode was created at
  first exec, but it remained even after exec_remove.
- Fixed that the anon-object for sigcode is created at exec_add(), and the
  anon-object reference is removed at exec_remove().
- sigobject_lock is no longer needed since it is locked by exec_lock.

Merge the kernel portion of the posix-spawn-chdir project by Piyush Sachdeva.

Changes to make EVFILT_PROC MP-safe:

Because the locking protocol around processes is somewhat complex
compared to other events that can be posted on kqueues, introduce
new functions for posting NOTE_EXEC, NOTE_EXIT, and NOTE_FORK,
rather than just using the generic knote() function.  These functions
KASSERT() their locking expectations, and deal with other complexities
for each situation.

knote_proc_fork(), in particiular, needs to handle NOTE_TRACK, which
requires allocation of a new knote to attach to the child process.  We
don't want to be allocating memory while holding the parent's p_lock.
Furthermore, we also have to attach the tracking note to the child
process, which means we have to acquire the child's p_lock.

So, to handle all this, we introduce some additional synchronization
infrastructure around the 'knote' structure:

- Add the ability to mark a knote as being in a state of flux.  Knotes
  in this state are guaranteed not to be detached/deleted, thus allowing
  a code path drop other locks after putting a knote in this state.

- Code paths that wish to detach/delete a knote must first check if the
  knote is in-flux.  If so, they must wait for it to quiesce.  Because
  multiple threads of execution may attempt this concurrently, a mechanism
  exists for a single LWP to claim the detach responsibility; all other
  threads simply wait for the knote to disappear before they can make
  further progress.

- When kqueue_scan() encounters an in-flux knote, it simply treats the
  situation just like encountering another thread's queue marker -- wait
  for the flux to settle and continue on.

(The "in-flux knote" idea was inspired by FreeBSD, but this works differently
from their implementation, as the two kqueue implementations have diverged
quite a bit.)

knote_proc_fork() uses this infrastructure to implement NOTE_TRACK like so:

- Attempt to put the original tracking knote into a state of flux; if this
  fails (because the note has a detach pending), we skip all processing
  (the original process has lost interest, and we simply won the race).

- Once the note is in-flux, drop the kq and forking process's locks, and
  allocate 2 knotes: one to post the NOTE_CHILD event, and one to attach
  a new NOTE_TRACK to the child process.  Notably, we do NOT go through
  kqueue_register() to do this, but rather do all of the work directly
  and KASSERT() our assumptions; this allows us to directly control our
  interaction with locks.  All memory allocations here are performed with
  KM_NOSLEEP, in order to prevent holding the original knote in-flux
  indefinitely.

- Because the NOTE_TRACK use case adds knotes to kqueues through a
  sort of back-door mechanism, we must serialize with the closing of
  the destination kqueue's file descriptor, so steal another bit from
  the kq_count field to notify other threads that a kqueue is on its
  way out to prevent new knotes from being enqueued while the close
  path detaches them.

In addition to fixing EVFILT_PROC's reliance on KERNEL_LOCK, this also
fixes a long-standing bug whereby a NOTE_CHILD event could be dropped
if the child process exited before the interested process received the
NOTE_CHILD event (the same knote would be used to deliver the NOTE_EXIT
event, and would clobber the NOTE_CHILD's 'data' field).

Add a bunch of comments to explain what's going on in various critical
sections, and sprinkle additional KASSERT()s to validate assumptions
in several more locations.

Make sure the robust futex head is zeroed out, since this LWP
will live on with a different program image.  (Thanks ryo@ for
pointing out my mistake.)

futex_release_all_lwp(): No need to pass the "tid" argument separately; that
is a vestige of an older version of the code.  Also, move a KASSERT() that
both futex_release_all_lwp() call sites had inside of futex_release_all_lwp()
itself.

In the exec path, multi-LWP programs dispose of their robust futexes
by calling exit_lwps(), except for the last LWP.  So, dispose of that
LWP's robust futexes right before calling lwp_ctl_exit().

Fixes a "WARNING: ... : unmapped robust futex list head" message when
running bash under Linux emulation on aarch64.

Root caused and patch proposed by ryo@.  I have tweaked it slightly,
just to add a comment and a KASSERT().

Sync w/ HEAD.

Fix the order of handling of posix_spawn attributes and file actions.
The standard is explicit about it and it matters if e.g. RESETIDS is
used as an attribute and file actions depend on the group rights for
opening a file.

Sync with HEAD.

Pull up following revision(s) (requested by martin in ticket #1677):
	sys/kern/kern_exec.c: revision 1.505 via patch
Fix copy&pasto in handling of POSIX_SPAWN_RESETIDS in posix_spawn(3)

Pull up following revision(s) (requested by martin in ticket #1265):
	sys/kern/kern_exec.c: revision 1.505 via patch
Fix copy&pasto in handling of POSIX_SPAWN_RESETIDS in posix_spawn(3)

Fix copy&pasto in handling of POSIX_SPAWN_RESETIDS in posix_spawn(3)

Sync w/ HEAD.

Refactor interval timers to make it possible to support types other than
the BSD/POSIX per-process timers:

- "struct ptimer" is split into "struct itimer" (common interval timer
  data) and "struct ptimer" (per-process timer data, which contains a
  "struct itimer").

- Introduce a new "struct itimer_ops" that supplies information about
  the specific kind of interval timer, including it's processing
  queue, the softint handle used to schedule processing, the function
  to call when the timer fires (which adds it to the queue), and an
  optional function to call when the CLOCK_REALTIME clock is changed by
  a call to clock_settime() or settimeofday().

- Rename some fuctions to clearly identify what they're operating on
  (ptimer vs itimer).

- Use kmem(9) to allocate ptimer-related structures, rather than having
  dedicated pools for them.

Welcome to NetBSD 9.99.77.

Define LMSG outside the MAXTSIZ check so it also exists in non-MAXTSIZ kernels.

Make MAXTSIZ optional.

Move proc_lock into the data segment.  It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

On debugger attach to a prestarted process don't report SIGTRAP

Introduce PSL_TRACEDCHILD that indicates tracking of birth of a process.
A freshly forked process checks whether it is traced and if so, reports
SIGTRAP + TRAP_CHLD event to a debugger as a result of tracking forks-like
events. There is a time window when a debugger can attach to a newly
created process and receive SIGTRAP + TRAP_CHLD instead of SIGSTOP.

Fixes races in t_ptrace_wait* tests when a test hangs or misbehaves,
especially the ones reported in tracer_sysctl_lookup_without_duplicates.

Sync with bouyer-xenpvh-base2 (HEAD)

Overhaul the way LWP IDs are allocated.  Instead of each LWP having it's
own LWP ID space, LWP IDs came from the same number space as PIDs.  The
lead LWP of a process gets the PID as its LID.  If a multi-LWP process's
lead LWP exits, the PID persists for the process.

In addition to providing system-wide unique thread IDs, this also lets us
eliminate the per-process LWP radix tree, and some associated locks.

Remove the separate "global thread ID" map added previously; it is no longer
needed to provide this functionality.

Nudged in this direction by ad@ and chs@.

Revert the changes made in February to make cwdinfo use mostly lockless,
which relied on taking extra vnode refs.

Having benchmarked various experimental changes over the past few months it
seems that it's better to avoid vnode refs as much as possible.  cwdi_lock
as a RW lock already did that to some extent for getcwd() and will permit
the same for namei() too.

Sync with HEAD

Sync with HEAD

- Only increment nprocs when we're creating a new process, not just
  when allocating a PID.
- Per above, proc_free_pid() no longer decrements nprocs.  It's now done
  in proc_free() right after proc_free_pid().
- Ensure nprocs is accessed using atomics everywhere.

Set p_oppid always, not just when a parent is traced

PR kern/55151 by Martin Husemann

Mostly merge changes from HEAD upto 20200411

Reintroduce struct proc::p_oppid

Relying on p_opptr is not safe as there is a race between:
 - spawner giving a birth to a child process and being killed
 - spawnee accessng p_opptr and reporting TRAP_CHLD

PR kern/54786 by Andreas Gustafsson

- Untangle spawn_return by splitting it up to sub-functions.
- Merge the eventswitch parent notification code which was copied in two
  places (eventswitchchild)
- Fix bugs in the eventswitch parent notification code:
  1. p_slflags should be accessed holding both proc_lock and p->p_lock
  2. p->p_opptr can be NULL if the parent was PSL_CHTRACED and exited.

Fixes random crashes the posix_spawn_kill_spawner unit test which tried
to dereference a NULL pptr.

Sync with head.

Merge from ad-namecache:

- Have a stab at clustering the members of vnode_t and vnode_impl_t in a
  more cache-conscious way.  With that done, go back to adjusting v_usecount
  with atomics and keep vi_lock directly in vnode_impl_t (saves KVA).

- Allow VOP_LOCK(LK_NONE) for the benefit of VFS_VGET() and VFS_ROOT().
  Make sure LK_UPGRADE always comes with LK_NOWAIT.

- Make cwdinfo use mostly lockless.

PR kern/54922: 9.99.45@20200202 panic: diagnostic assertion linux ldconfig triggers vpp != NULL in exit1()->radixtree.c line 674

Create an lwp_renumber() from the code in emulexec() and use in
linux_e_proc_exec() and linux_e_proc_fork() too.

- check for errors in exec_resolvename() and fail
- put back the compat_linux modules in the exec array (commented out)
- remove extra parens

- Track LWPs in a per-process radixtree.  It uses no extra memory in the
  single threaded case.  Replace scans of p->p_lwps with lookups in the
  tree.  Find free LIDs for new LWPs in the tree.  Replace the hashed sleep
  queues for park/unpark with lookups in the tree under cover of a RW lock.

- lwp_wait(): if waiting on a specific LWP, find the LWP via tree lookup and
  return EINVAL if it's detached, not ESRCH.

- Group the locks in struct proc at the end of the struct in their own cache
  line.

- Add some comments.

Sync with head.

Make cwdinfo use mostly lockless, and largely hide the details in vfs_cwd.c.

exec_lock: declare it in the header, and mark with __cachline_aligned.

Sync with head.

A final set of scheduler tweaks:

- Try hard to keep vfork() parent and child on the same CPU until execve(),
  failing that on the same core, but in all other cases scatter new LWPs
  among the different CPU packages, round robin, to try and get the best out
  of the available cache and bus bandwidth.

- Remove attempts at balancing.  Replace with a rate-limited skim of other
  CPU's run queues in sched_idle(), starting in the current package and
  moving outwards.  Add a sysctl tunable to change the interval.

- Make the cacheht_time tuneable take a milliseconds value.

- It's possible to configure things such that there's no CPU allowed to run
  an LWP.  Defeat this by always having a default:

Reported-by: syzbot+46968944dd9359ab93bc@syzkaller.appspotmail.com
Reported-by: syzbot+7f750a4cc230d1e831f9@syzkaller.appspotmail.com
Reported-by: syzbot+88d7675158f5cb4684db@syzkaller.appspotmail.com
Reported-by: syzbot+d409c2338150e9a8ae1e@syzkaller.appspotmail.com
Reported-by: syzbot+e152dc5bff188f67358a@syzkaller.appspotmail.com

Tidy up the vnode locking around execve() on ELF images to acquire and
release the locks fewer times.  Proposed on tech-kern a very long time go.

Hopefully fix some problems seen with MP support on non-x86, in particular
where curcpu() is defined as curlwp->l_cpu:

- mi_switch(): undo the ~2007ish optimisation to unlock curlwp before
  calling cpu_switchto().  It's not safe to let other actors mess with the
  LWP (in particular l->l_cpu) while it's still context switching.  This
  removes l->l_ctxswtch.

- Move the LP_RUNNING flag into l->l_flag and rename to LW_RUNNING since
  it's now covered by the LWP's lock.

- Ditch lwp_exit_switchaway() and just call mi_switch() instead.  Everything
  is in cache anyway so it wasn't buying much by trying to avoid saving old
  state.  This means cpu_switchto() will never be called with prevlwp ==
  NULL.

- Remove some KERNEL_LOCK handling which hasn't been needed for years.

Make it possible to call mi_switch() and immediately switch to another CPU.
This seems to take about 3us on my Intel system.  Two changes required:

- Have the caller to mi_switch() be responsible for calling spc_lock().
- Avoid using l->l_cpu in mi_switch().

While here:

- Add a couple of calls to membar_enter()
- Have the idle LWP set itself to LSIDL, to match softint_thread().
- Remove unused return value from mi_switch().

Minor scheduler cleanup:

- Adapt to cpu_need_resched() changes. Avoid lost & duplicate IPIs and ASTs.
  sched_resched_cpu() and sched_resched_lwp() contain the logic for this.
- Changes for LSIDL to make the locking scheme match the intended design.
- Reduce lock contention and false sharing further.
- Numerous small bugfixes, including some corrections for SCHED_FIFO/RT.
- Use setrunnable() in more places, and merge cut & pasted code.

Pull up following revision(s) (requested by kamil in ticket #311):

	sys/sys/siginfo.h: revision 1.34
	sys/kern/sys_ptrace_common.c: revision 1.59
	sys/kern/sys_lwp.c: revision 1.70
	sys/compat/sys/siginfo.h: revision 1.8
	sys/kern/kern_sig.c: revision 1.365
	sys/kern/kern_lwp.c: revision 1.203
	sys/sys/signalvar.h: revision 1.96
	sys/kern/kern_exec.c: revision 1.482
	sys/kern/kern_fork.c: revision 1.214

Move TRAP_CHLD/TRAP_LWP ptrace information from struct proc to siginfo

Storing struct ptrace_state information inside struct proc was vulnerable
to synchronization bugs, as multiple events emitted in the same time were
overwritting other ones.

Cache the original parent process id in p_oppid. Reusing here p_opptr is
in theory prone to slight race codition.

Change the semantics of PT_GET_PROCESS_STATE, reutning EINVAL for calls
prompting for the value in cases when there wasn't registered an
appropriate event.

Add an alternative approach to check the ptrace_state information, directly
from the siginfo_t value returned from PT_GET_SIGINFO. The original
PT_GET_PROCESS_STATE approach is kept for compat with older NetBSD and
OpenBSD. New code is recommended to keep using PT_GET_PROCESS_STATE.
Add a couple of compile-time asserts for assumptions in the code.

No functional change intended in existing ptrace(2) software.

All ATF ptrace(2) and ATF GDB tests pass.

This change improves reliability of the threading ptrace(2) code.

Remove p_oppid from struct proc

This field is not needed as it duplicated p_opptr that is alread safe to
use, unless proven otherwise.

eventswitch() already contained a check for != initproc (pid1).

Ride ABI bump for 9.99.16.

Move TRAP_CHLD/TRAP_LWP ptrace information from struct proc to siginfo

Storing struct ptrace_state information inside struct proc was vulnerable
to synchronization bugs, as multiple events emitted in the same time were
overwritting other ones.

Cache the original parent process id in p_oppid. Reusing here p_opptr is
in theory prone to slight race codition.

Change the semantics of PT_GET_PROCESS_STATE, reutning EINVAL for calls
prompting for the value in cases when there wasn't registered an
appropriate event.

Add an alternative approach to check the ptrace_state information, directly
from the siginfo_t value returned from PT_GET_SIGINFO. The original
PT_GET_PROCESS_STATE approach is kept for compat with older NetBSD and
OpenBSD. New code is recommended to keep using PT_GET_PROCESS_STATE.

Add a couple of compile-time asserts for assumptions in the code.

No functional change intended in existing ptrace(2) software.

All ATF ptrace(2) and ATF GDB tests pass.

This change improves reliability of the threading ptrace(2) code.

Add a boolean argument to indicate if we have a path/true (execve) or an
fd/false (fexecve). This is needed to differentiate between them because
NULL/-1 can be readily passed from userland.

- Add support for fexecve
	- get the vnode from the fd passed instead of calling namei() on the
	  path
	- try to reverse resolve the vnode to extract the pathname
	- deal with not having a resolved path available
- rename variable that was not a pathbuf

- move quadruplicated code into a function
- delete #if 1 and #if 0 code

Fix editor mistake in previous

Backout the pullup of r1.476:

	remove offs initialization and XXX gcc comment.

While actually the "offs" variable is always initialized when used, the
gcc version on this branch is not smart enough to recognize that.

Pull up the following revisions, requested by maxv in ticket #1324:

	sys/kern/kern_exec.c	1.469-1.478 (via patch)

Fix off-by-one and info leak.

Fix info leak. The padding of 'sigact' is not initialized, it gets copied
in the proc, and can later be obtained by userland.

Fix this fucking shit once and for all, for fuck's sake.

remove offs initialization and XXX gcc comment. Offs should always be
initialized. Pointed out by maxv.

Return an error if the path was too long. Pointed out by maxv

Remove useless debugging messages which achieved nothing but hiding bugs.

whitespace around operators

Fail if getcwd fails. Pointed out by maxv@

Fix word (direct -> directory) in comment.

add a comment explaining what this does.

Fix buffer overflow. It seems that some people need to go back to the
basics of C programming.

Reported-by: syzbot+8665827f389a9fac5cc9@syzkaller.appspotmail.com

Add support for KTR logs of SIGTRAP for TRAP_CHILD events

Previously it was disabled due to vfork(2) synchronization issues.
These problems are now gone.

While there, set l_vforkwaiting to false in posix_spawn. This is not very
needed but it does not make harm to keep it initialized explicitly.

Correct use-after-free issue in vfork(2)

In the previous behavior vforking parent was keeping pointer to a child
and checking whether it clears a PL_PPWAIT in its bitfield p_lflag. However
a child can go invalid between exec/exit event from child and waking up
vforked parent and this can cause invalid pointer read and in the worst
scenario kernel crash.

In the new behavior vforked child keeps a reference to vforked parent LWP
and sets a value l_vforkwaiting to false. This means that vforked child
can finish its work, exec/exit and be terminated and once parent will be
woken up it will read its own field whether its child is still blocking.

Add new field in struct lwp: l_vforkwaiting protected by proc_lock.
In future it should be refactored and all PL_PPWAIT users transformed to
l_vforkwaiting and next l_vforkwaiting probably transformed into a bit
field.

This is another attempt of fixing this bug after <rmind> from 2012 in
commit:

Author: rmind <rmind@NetBSD.org>
Date:   Sun Jul 22 22:40:18 2012 +0000

    fork1: fix use-after-free problems.  Addresses PR/46128 from Andrew Doran.
    Note: PL_PPWAIT should be fully replaced and modificaiton of l_pflag by
    other LWP is undesirable, but this is enough for netbsd-6.

The new version no longer performs unsafe access in l_lflag changing the
LP_VFORKWAIT bit.

Verified with ATF t_vfork and t_ptrace* tests and they are no longer
causing any issues in my local setup.

Fixes PR/46128 by Andrew Doran

Add support for PTRACE_POSIX_SPAWN to report posix_spawn(3) events

posix_spawn(3) is a first class syscall in NetBSD, different to
(V)FORK+EXEC as these operations are executed in one go. This differs to
Linux and FreeBSD, where posix_spawn(3) is implemented with existing kernel
primitives (clone(2), vfork(2), exec(3)) inside libc.

Typically LLDB and GDB software is aware of FORK/VFORK events. As discussed
with the LLDB community, instead of slicing the posix_spawn(3) operation
into phases emulating (V)FORK+EXEC(+VFORK_DONE) and returning intermediate
state to the debugger, that might have abnormal state, introduce new event
type: PTRACE_POSIX_SPAWN.

A debugger implementor can easily map it into existing fork+exec semantics
or treat as a distinct event.

There is no functional change for existing debuggers as there was no
support for reporting posix_spawn(3) events on the kernel side.

Sync with HEAD

Report TRAP_EXEC (for exec()) to a debugger in the PT_SYSCALL mode

Orignally exec() reporting was disabled in the NetBSD version as there
was no support for fine-grained reporting. Meanwhile PT_SYSCALL was broken
for years and there is no software that depends on this behavior.

There is need to catch exec() events in syscall tracers using ptrace(2).
Instead of adding workarounds of guessing that exec() happened, report the
event directly from the kernel.

All ATF ptrace(2) tests pass.

Register KTR events for debugger related signals

Register signals for:

 - crashes (FPE, SEGV, FPE, ILL, BUS)
 - LWP events
 - CHLD (FORK/VFORK/VFORK_DONE) events -- temporarily disabled
 - EXEC events

While there refactor related functions in order to simplify the code.

Add missing comment documentation for recently added kernel functions.

Add eventswitch() in signal code

Route all crash and debugger related signal through eventswitch(), that
calls sigswitch() with preprocessed arguments.

This code avoids code duplication and allows to introduce changes that
will affect all callers of sigswitch() in debugger-related events.

No functional change intended.

Pull up following revision(s) (requested by maxv in ticket #1658):

	sys/kern/kern_exec.c: revision 1.462

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.

[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

Pull up following revision(s) (requested by maxv in ticket #1658):

	sys/kern/kern_exec.c: revision 1.462

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.

[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

Pull up following revision(s) (requested by maxv in ticket #1658):

	sys/kern/kern_exec.c: revision 1.462

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.

[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

Sync with HEAD, resolve a couple of conflicts

Pull up following revision(s) (requested by maxv in ticket #1100):

	sys/kern/kern_exec.c: revision 1.462

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.
[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.

[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int.  The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER!  Some subsystems have

	#define min(a, b)	((a) < (b) ? (a) : (b))
	#define max(a, b)	((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX.  Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate.  But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all.  (Who knows, maybe in some cases integer
truncation is actually intended!)

Allow syscall_establish() to install new syscalls when the existing
entry-point is either sys_nomodule or sys_nosys.  Update the
makesyscalls.sh script to create a const array of bits to allow
syscall_disestablish() to properly restore the original entry-point.
Update all the initializers of struct emul to initialize the pointer
to the bit array struct emul.

XXX Regen of all files created by makesyscalls.sh will come soon,
XXX followed by a kernel version bump (since struct emul is being
XXX modified).

This commit should address PR kern/45781 and also removes the need
for the work-around for that PR in file

	sys/arch/usermode/modules/syscallemu/syscallemu.c

Sync with HEAD

Correct reporting SIGTRAP TRAP_EXEC when SIGTRAP is masked

Switch from kpsignal(9) to sigswitch() as it allows to bypass signal
masking rules of a crash signal.

There are no regressions in existing tests.

Sponsored by <The NetBSD Foundation>

Apply patch requested by maxv in ticket #1500:

 * disable compat_svr4 and compat_svr4_32 everywhere
 * disable compat_ibcs2 everywhere but on Vax
 * remove the svr4/svr4_32/ibcs2/freebsd entries from the autoload list

Apply patch requested by maxv in ticket #1500:

 * disable compat_svr4 and compat_svr4_32 everywhere
 * disable compat_ibcs2 everywhere but on Vax
 * remove the svr4/svr4_32/ibcs2/freebsd entries from the autoload list

Apply patch requested by maxv in ticket #1500:

 * disable compat_svr4 and compat_svr4_32 everywhere
 * disable compat_ibcs2 everywhere but on Vax
 * remove the svr4/svr4_32/ibcs2/freebsd entries from the autoload list

Sync with HEAD

Remove an element from struct emul: e_tracesig

e_tracesig used to be implemented for Darwin compat. Nowadays the Darwin
compatiblity layer is gone and there are no other users.

This functionality isn't used where it shall be used in the existing
codebase.

If we want to emulate debugging interfaces in compat layers we would need
to implement that from scratch anyway. We would need to be bug compatible
with other OSes too.

Proposed on tech-kern@.

Welcome to NetBSD 8.99.16!

Sponsored by <The NetBSD Foundation>

Synch with HEAD

Canonicalize the interpreter path in #! scripts since check_exec() expects
an absolute path, and we KASSERT if that's not the case later.

Pull up the following revision, requested by maxv as part of ticket #637:

	sys/kern/kern_exec.c	1.456

Fix off-by-one, we don't want the entry point to equal the maximum
address.

Apply patch (requested by maxv in ticket #1499):
- disable compat_svr4 and compat_svr4_32 everywhere
- disable compat_ibcs2 everywhere but on Vax
- remove svr4/svr4_32/ibcs2/freebsd from the module autoload list

Apply patch (requested by maxv in ticket #1499):
- disable compat_svr4 and compat_svr4_32 everywhere
- disable compat_ibcs2 everywhere but on Vax
- remove svr4/svr4_32/ibcs2/freebsd from the module autoload list

Apply patch (requested by maxv in ticket #1499):
- disable compat_svr4 and compat_svr4_32 everywhere
- disable compat_ibcs2 everywhere but on Vax
- remove svr4/svr4_32/ibcs2/freebsd from the module autoload list

Fix off-by-one, we don't want the entry point to equal the maximum
address.

remove struct emul's e_fault.

It used to be used by COMPAT_IRIX for the purpose of overriding
uvm_fault (only implemented in MIPS), now removed.

Ride 8.99.12 version bump.

don't print for ENOEXEC

update from HEAD

grab a copy of the absolute pathbuf, before namei() munges it.

Use the pathbuf which we pass to namei() (which is always absolute) as the
resolved pathname. We need this in the case of scripts where p_path needs
to point to the interpreter and not the script itself. Otherwise things
like perl script that depend on /proc/$$/exe to re-exec themselves end up
being fork bombs.

In reality we should be using the fully resolved/canonicalized path here, but
namei is not giving it back to us.

hack around namei problem.

Store full executable path in p->p_path as discussed in tech-kern.
This means that the full executable path is always available.

- exec_elf.c: use p->path to set AT_SUN_EXECNAME, and since this is
  always set, do so unconditionally.
- kern_exec.c: simplify pathexec, use kmem_strfree where appropriate
  and set p->p_path
- kern_exit.c: free p->p_path
- kern_fork.c: set p->p_path for the child.
- kern_proc.c: use p->p_path to return the executable pathname; the
  NULL check for p->p_path, should be a KASSERT?
- exec.h: gc ep_path, it is not used anymore
- param.h: bump version, 'struct proc' size change

TODO:
1. reference count the path string, to save copy at fork and free
   just before exec?
2. canonicalize the pathname by changing namei() to LOCKPARENT
   vnode and then using getcwd() on the parent directory?

Initialize the in/out parameter vmin.

vmin is only an optional hint since we're not passing UVM_FLAG_FIXED,
but that doesn't mean we should use uninitialized stack garbage as
the hint.

Noted by chs@.

Carve out KVA for execargs on boot from an exec_map like we used to.

Candidate fix for PR kern/45718: `processes sometimes get stuck and
spin in vm_map', a problem that has been plaguing all our 32-bit
ports for years.

Since we currently use large (256k) buffers for execargs, and since
nobody has stepped up to tackle breaking them into bite-sized (or at
least page-sized) chunks, after KVA gets sufficiently fragmented we
can't allocate new execargs buffers from kernel_map.

Until 2008, we always carved out KVA for execargs on boot with a uvm
submap exec_map of kernel_map.  Then ad@ found that the uvm_km_free
call, to discard them when done, cost about 100us, which a pool
avoided:

https://mail-index.NetBSD.org/tech-kern/2008/06/25/msg001854.html
https://mail-index.NetBSD.org/tech-kern/2008/06/26/msg001859.html

ad@ _simultaneously_ introduced a pool _and_ eliminated the reserved
KVA in the exec_map submap.  This change preserves the pool, but
restores exec_map (with less code, by putting it in MI code instead
of copying it in every MD initialization routine).

Patch proposed on tech-kern:
https://mail-index.NetBSD.org/tech-kern/2017/10/19/msg022461.html

Patch tested by bouyer@:
https://mail-index.NetBSD.org/tech-kern/2017/10/20/msg022465.html

I previously discussed the issue on tech-kern before I knew of the
history around exec_map:
https://mail-index.NetBSD.org/tech-kern/2012/12/09/msg014695.html

The candidate workaround I proposed of using pool_setlowat to force
preallocation of KVA would also force preallocation of physical RAM,
which is a waste not incurred by using exec_map, and which is part of
why I never committed it.

There may remain a general problem that if thread A calls pool_get
and tries to service that request by a uvm_km_alloc call that hangs
because KVA is scarce, and thread B does pool_put, the pool_put in
thread B will not notify the pool_get in thread A that it doesn't
need to wait for KVA, and so thread A may continue to hang in
uvm_km_alloc.  However,

(a) That won't apply here, because there is exactly as much KVA
available in exec_map as exec_pool will ever try to use.

(b) It is possible that may not even matter in other cases as long as
the page daemon eventually tries to shrink the pool, which will cause
a uvm_km_free that can unhang the hung uvm_km_alloc.

XXX pullup-8
XXX pullup-7
XXX pullup-6
XXX pullup-5, perhaps...

Make check_exec() errors print the name of the binary that fails to
execute.

Remove compat_linux32 from the autoload list and add a enable/disable
sysctl, like compat_linux.

Remove compat_linux from the autoload list, and add a sysctl to enable or
disable it - which defaults to disabled. The following command is now
required to use linux binaries:

	sysctl -w emul.linux.enabled=1

After a discussion on tech-kern@. All the other ideas to reduce the attack
surface have drawbacks, and this sysctl seems to be the best option.

Pull up following revision(s) (requested by maxv in ticket #256):
	sys/arch/i386/conf/GENERIC: revision 1.1159 via patch
	sys/arch/i386/conf/XEN3_DOMU: revision 1.78 via patch
	sys/arch/i386/conf/XEN3_DOM0: revision 1.114 via patch
	sys/kern/kern_exec.c: 1.443-1.444 via patch
Disable svr4 and ibcs2 by default.
These options are not well-tested, of a limited use case, and the potential
for damage is too high. Vulnerabilities were presented at DEFCON 25 - I see
that at least one of them can be exploited to get ring0 privileges.
--
Remove compat_freebsd from the list of autoloaded modules. Interested users
will now have to type 'modload' to use it, or uncomment the entry in
GENERIC. I should have removed it when I disabled COMPAT_FREEBSD by
default, sorry about that.
--
Remove compat_svr4, compat_svr4_32 and compat_ibcs2 from the list of
autoloaded modules. These options are disabled everywhere (except ibcs2
on Vax, but Vax does not support kernel modules, so doesn't matter),
therefore there is no issue in removing them from the list. Interested
users will now have to do a 'modload' first, or uncomment the entries in
GENERIC.

apply paych, requested by maxv in ticket #237:
	sys/arch/amiga/conf/DRACO		patch
	sys/arch/amiga/conf/GENERIC		patch
	sys/arch/amiga/conf/GENERIC.in		patch
	sys/arch/i386/conf/ALL			patch
	sys/arch/i386/conf/GENERIC		patch
	sys/arch/i386/conf/XEN3_DOM0		patch
	sys/arch/i386/conf/XEN3_DOMU		patch
	sys/arch/sparc/conf/GENERIC		patch
	sys/arch/sparc/conf/KRUPS		patch
	sys/arch/sparc/conf/MRCOFFEE		patch
	sys/arch/sparc/conf/TADPOLE3GX		patch
	sys/arch/sparc64/conf/GENERIC		patch
	sys/arch/sparc64/conf/NONPLUS64		patch
	sys/kern/kern_exec.c			patch

Disables compat_svr4 and compat_svr4_32 on each architecture,
and removes the associated module autoload entries.

Sync with HEAD

Remove compat_svr4, compat_svr4_32 and compat_ibcs2 from the list of
autoloaded modules. These options are disabled everywhere (except ibcs2
on Vax, but Vax does not support kernel modules, so doesn't matter),
therefore there is no issue in removing them from the list. Interested
users will now have to do a 'modload' first, or uncomment the entries in
GENERIC.

Remove compat_freebsd from the list of autoloaded modules. Interested users
will now have to type 'modload' to use it, or uncomment the entry in
GENERIC. I should have removed it when I disabled COMPAT_FREEBSD by
default, sorry about that.

Sync with HEAD

Sync with HEAD

- Propagate the signal mask from the ucontext_t to the newly created thread
  as specified by _lwp_create(2)
- Reset the signal stack for threads created with _lwp_create(2)

Sync with HEAD

Sync with HEAD

es_arglen is already in bytes...

Cleanup dead code after revert of racy vfork(2) commit

This removes dead code introduced with the following commit:

date: 2012-07-27 22:52:49 +0200;  author: christos;  state: Exp;  lines: +8 -2;
revert racy vfork() parent-blocking-before-child-execs-or-exits code.
ok rmind

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Introduce new SIGTRAP code: TRAP_EXEC

On exec() events under a debugger generate the SIGTRAP signal with
TRAP_EXEC property. This allows tracer to distinguish exec() events easily.

Sponsored by <The NetBSD Foundation>

Sync with HEAD

Sync with HEAD

Prefer modern simple past tense and past participle of catch

The "catched" form is obsolete and nonstandard, prefer "caught".

Sync with HEAD

m68k binaries load @ pagesize. unbreak.

The way the kernel tries to prevent a userland process from allocating page
zero is hugely flawed. It is easy to demonstrate that one can trick UVM
into chosing a NULL hint after the user_va0_disable check from uvm_map.
Such a bypass allows kernel NULL pointer dereferences to be exploitable on
architectures with a shared userland<->kernel VA, like amd64.

Fix this by increasing the limit of the vm space made available for
userland processes. This way, UVM will never chose a NULL hint, since it
would be outside of the vm space.

The user_va0_disable sysctl still controls this feature.

Sync with HEAD

KNF. Remove extra spaces. No functional change.

put back commented out name resolution code that was gc'ed after previous
refactoring.

fix variable name

ignore EACCES

Sync with HEAD

Give 0,1,2 for security.pax.mprotect.ptrace and make it default to 1
as documented in sysctl(7):
0 - ptrace does not affect mprotect
1 - (default) mprotect is disabled for processes that start executing from
    the debugger (being traced)
2 - mprotect restrictions are relaxed for traced processes

reduce #ifdef mess caused by PaX

Fix builds of ALL kernels that define DEBUG_EXEC

Enable DEBUG_EXEC, if we have DEBUG (since it only fires on errors) and
disable the super verbose printing by protecting it against TRACE_EXEC.

Move all the randomization inside kern_pax.c so we can control it directly.
Add debugging flags to be able to set the random number externally.

Sync with HEAD

no need to pass the coredump flag to exit1() since it is set and known
in one place.

Split p_xstat (composite wait(2) status code, or signal number depending
on context) into:
1. p_xexit:		exit code
2. p_xsig:		signal number
3. p_sflag & WCOREFLAG	bit to indicated that the process core-dumped.

Fix the documentation of the flag bits in <sys/proc.h>

Let PaX ASLR know about the current emulation

This effectively fixes PaX ASLR with 32-bits emulation on 64-bits
platforms. Without this knowledge, the offset applied for 32-bits
programs was really meant for a 64-bits address space - thus
shifting the address up to 12 bits, with a success rate of about
1/4096. This offset is calculated once in the lifetime of the
process, which therefore behaved normally when able to start.

Fixes kern/50469, probably also kern/50986

Tested on NetBSD/amd64 (emul_netbsd32)

Sync with HEAD (as of 26th Dec)

Make the list of syscalls which can trigger a module autoload an
attribute of each emulation, rather than having a single global
list which applies only to the default emulation.

This changes 'struct emul' so

        Welcome to 7.99.23 !

We never exec(2) with a kernel vmspace, so do not test for that, but instead
KASSERT() that we don't.
When calculating the load address for the interpreter (e.g. ld.elf_so),
we need to take into account wether the exec'd process will run with
topdown memory or bottom up. We can not use the current vmspace's flags
to test for that, as this happens too early. Luckily the execpack already
knows what the new state will be later, so instead of testing the current
vmspace, pass the info as additional argument to struct emul
e_vm_default_addr.
Fix all such functions and adopt all callers.

Pull up following revision(s) (requested by pgoyette in ticket #1333):
	sys/kern/kern_exec.c: revision 1.420
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revision 1.246
	sys/kern/kern_exit.c: revision 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).
If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.
This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.
Fixes PR kern/50330
Pullups will be requested for NetBSD-7, -6, -6-0, and -6-1

Pull up following revision(s) (requested by pgoyette in ticket #1333):
	sys/kern/kern_exec.c: revision 1.420
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revision 1.246
	sys/kern/kern_exit.c: revision 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).
If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.
This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.
Fixes PR kern/50330
Pullups will be requested for NetBSD-7, -6, -6-0, and -6-1

Pull up following revision(s) (requested by pgoyette in ticket #1333):
	sys/kern/kern_exec.c: revision 1.420
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revision 1.246
	sys/kern/kern_exit.c: revision 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308
Pullups will be requested for:
        NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2
In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).
If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.
This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.
Fixes PR kern/50330
Pullups will be requested for NetBSD-7, -6, -6-0, and -6-1

Pull up following revision(s) (requested by pgoyette in ticket #1979):
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revisions 1.246, 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
--
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
--
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
--
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308

Pull up following revision(s) (requested by pgoyette in ticket #1979):
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revisions 1.246, 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
--
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
--
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
--
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308

Pull up following revision(s) (requested by pgoyette in ticket #1979):
	sys/kern/kern_synch.c: revision 1.309
	sys/kern/kern_exit.c: revisions 1.246, 1.247
	sys/kern/kern_exec.c: revision 1.419
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
--
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
--
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
--
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308

Pull up following revision(s) (requested by pgoyette in ticket #996):
	sys/kern/kern_exec.c: revisions 1.419, 1.420
	sys/kern/kern_exit.c: revisions 1.246, 1.247
	sys/kern/kern_synch.c: revision 1.309
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
--
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
--
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
--
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308
--
In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).
If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.
This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.
Fixes PR kern/50330

Pull up following revision(s) (requested by pgoyette in ticket #996):
	sys/kern/kern_exec.c: revisions 1.419, 1.420
	sys/kern/kern_exit.c: revisions 1.246, 1.247
	sys/kern/kern_synch.c: revision 1.309
In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.
Fixes PR kern/50298
--
When clearing out the scheduler queues during system shutdown, we move
all processes to the SSTOP state.  Make sure we update each process's
p_waited and the parents' p_nstopchild counters to maintain consistent
values.  Should not make any real difference this late in the shutdown
process, but we should still be consistent just in case.
Fixes PR kern/50318
--
Currently, if a process is exiting and its parent has indicated no intent
of reaping the process (nor any other children), the process wil get
reparented to init.  Since the state of the exiting process at this point
is SDEAD, proc_reparent() will not update either the old or new parent's
p_nstopchild counters.
This change causes both old and new parents to be properly updated.
Fixes PR kern/50300
--
For processes marked with PS_STOPEXIT, update the process's p_waited
value, and update its parent's p_nstopchild value when marking the
process's p_stat to SSTOP.  The process needed to be SACTIVE to get
here, so this transition represents an additional process for which
the parent needs to wait.
Fixes PR kern/50308
--
In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).
If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.
This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.
Fixes PR kern/50330

Reset the PaX flags, make sure ep_emul_arg is NULL, and add a comment.

In spawn_return() we temporarily move the process state to SSTOP, but
without updating its p_waited value or its parent's p_nstopchild
counter.  Later, we restore the original state, again without any
adjustment of the related values.  This leaves a relatively short
window when the values are inconsistent and could interfere with the
proper operation of sys_wait() for the parent (if it manages to be
scheduled;  it's not totally clear what, if anything, prevents
scheduling/execution of the parent).

If during this window, any of the checks being made result in an
error, we call exit1() which will eventually migrate the process's
state to SDEAD (with an intermediate transition to SDYING).  At
this point the other variables get updated, and we finally restore
a consistent state.

This change updates the p_waited and parent's p_nstopchild at each
step to eliminate any windows during which the values could lead to
incorrect decisions.

Fixes PR kern/50330

Pullups will be requested for NetBSD-7, -6, -6-0, and -6-1

In execve_runproc(), update the p_waited entry for the process being
moved to SSTOP state, not for its parent.  (It is correct to update
the parent's p_nstopchild count.)  If the value is not already zero,
it could prevent its parent from waiting for the process.

Fixes PR kern/50298

Pullups will be requested for:

       NetBSD-7, -6, -6-0, -6-1, -5, -5-0, -5-1, and -5-2

Change SDT (Statically Defined Tracing) probes to use link sets so that it
is easier to add probes. (From FreeBSD)

Revamp the way processes are PaX'ed in the kernel. Sent on tech-kern@ two
months ago, but no one reviewed it - probably because it's not a trivial
change.

This change fixes the following bug: when loading a PaX'ed binary, the
kernel updates the PaX flag of the calling process before it makes sure
the new process is actually launched. If the kernel fails to launch the
new process, it does not restore the PaX flag of the calling process,
leaving it in an inconsistent state.

Actually, simply restoring it would be horrible as well, since in the
meantime another thread may have used the flag.

The solution is therefore: modify all the functions used by PaX so that
they take as argument the exec package instead of the lwp, and set the PaX
flag in the process *right before* launching the new process - it cannot
fail in the meantime.

Sync with HEAD

gcc does not detect initialization correctly on all platforms (hpcsh)

- preserve the error number returned from copyin.
- preserve the original pathname in ep_kname, because this is what gets passed
  to userland in exec_script.c

On non absolute exec pathnames, prepend the working directory if
possible so that we can provide in most situations the absolute
pathname in the AUX vector so that $ORIGIN works. The following
are implementation issues:
    1. deep path execs still don't work (can't provide path to the AUX vector)
    2. the returned path is not normalized (cosmetic)

Small changes:
 - rename pax_aslr_init() to pax_aslr_init_vm()
 - remove the PAX_ flags (unused)
 - fix a comment in pax.h

Pull up following revision(s) (requested by christos in ticket #686):
	sys/kern/kern_exec.c: revision 1.411
	sys/sys/exec.h: revision 1.147
PR/49287: Masao Uebayashi: Handle exec_script argument vector from the 32 ->
64 bit case. When execing a 64 bit shell from a 32 bit binary the argument
vector was still incorrect.

Sync with HEAD

Pull up following revision(s) (requested by maxv in ticket #427):
	sys/compat/svr4/svr4_schedctl.c: revision 1.8
	sys/netinet/tcp_timer.c: revision 1.88
	sys/miscfs/genfs/layer_vfsops.c: revision 1.45
	sys/compat/svr4/svr4_ioctl.c: revision 1.37
	sys/ufs/chfs/chfs_vfsops.c: revision 1.14
	sys/miscfs/fdesc/fdesc_vfsops.c: revision 1.91
	sys/compat/linux/arch/i386/linux_ptrace.c: revision 1.30
	sys/compat/common/kern_time_50.c: revision 1.28
	sys/netinet6/ip6_forward.c: revision 1.74
	sys/miscfs/umapfs/umap_vnops.c: revision 1.57
	sys/compat/svr4/svr4_fcntl.c: revision 1.74
	distrib/sets/lists/comp/mi: revision 1.1931
	sys/netinet6/udp6_output.c: revision 1.46
	sys/fs/puffs/puffs_compat.c: revision 1.3
	sys/fs/udf/udf_rename.c: revision 1.11
	sys/compat/svr4/svr4_filio.c: revision 1.24
	sys/fs/udf/udf_rename.c: revision 1.12
	sys/netinet/tcp_usrreq.c: revision 1.202
	sys/miscfs/umapfs/umap_subr.c: revision 1.29
	sys/compat/linux/common/linux_fadvise64.c: revision 1.3
	sys/netinet/if_atm.c: revision 1.34
	sys/miscfs/procfs/procfs_subr.c: revision 1.106
	sys/miscfs/genfs/layer_subr.c: revision 1.37
	sys/netinet/tcp_sack.c: revision 1.30
	sys/compat/freebsd/freebsd_misc.c: revision 1.33
	sys/compat/freebsd/freebsd_file.c: revision 1.33
	sys/ufs/chfs/chfs_vnode.c: revision 1.12
	sys/compat/svr4/svr4_ttold.c: revision 1.34
	sys/compat/linux/common/linux_file.c: revision 1.114
	sys/compat/linux/arch/mips/linux_machdep.c: revision 1.43
	sys/compat/linux/common/linux_signal.c: revision 1.76
	sys/compat/common/compat_util.c: revision 1.46
	sys/compat/linux/arch/arm/linux_ptrace.c: revision 1.18
	sys/compat/svr4/svr4_sockio.c: revision 1.36
	sys/compat/linux/arch/arm/linux_machdep.c: revision 1.32
	sys/compat/svr4/svr4_signal.c: revision 1.66
	sys/kern/kern_exec.c: revision 1.410
	sys/fs/puffs/puffs_vfsops.c: revision 1.115
	sys/compat/svr4/svr4_exec_elf64.c: revision 1.15
	sys/compat/linux/arch/i386/linux_machdep.c: revision 1.159
	sys/compat/linux/arch/alpha/linux_machdep.c: revision 1.50
	sys/compat/linux32/common/linux32_misc.c: revision 1.24
	sys/netinet/in_pcb.c: revision 1.153
	sys/sys/malloc.h: revision 1.116
	sys/compat/common/if_43.c: revision 1.9
	share/man/man9/Makefile: revision 1.380
	sys/netinet/tcp_vtw.c: revision 1.12
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.95
	sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.186
	sys/compat/common/uipc_syscalls_43.c: revision 1.46
	sys/ufs/ext2fs/ext2fs_vnops.c: revision 1.115
	sys/fs/puffs/puffs_msgif.c: revision 1.97
	sys/compat/svr4/svr4_ipc.c: revision 1.27
	sys/compat/linux/common/linux_exec.c: revision 1.117
	sys/ufs/ext2fs/ext2fs_readwrite.c: revision 1.66
	sys/netinet/tcp_output.c: revision 1.179
	sys/compat/svr4/svr4_termios.c: revision 1.28
	sys/fs/udf/udf_strat_bootstrap.c: revision 1.4
	sys/fs/puffs/puffs_subr.c: revision 1.67
	sys/fs/puffs/puffs_node.c: revision 1.36
	sys/miscfs/overlay/overlay_vnops.c: revision 1.21
	sys/fs/cd9660/cd9660_node.c: revision 1.34
	sys/netinet/raw_ip.c: revision 1.146
	sys/sys/mallocvar.h: revision 1.13
	sys/miscfs/overlay/overlay_vfsops.c: revision 1.63
	share/man/man9/malloc.9: revision 1.50
	sys/netinet6/dest6.c: revision 1.18
	sys/compat/linux/common/linux_uselib.c: revision 1.33
	sys/compat/linux/common/linux_socket.c: revision 1.120
	share/man/man9/malloc.9: revision 1.51
	sys/netinet/tcp_subr.c: revision 1.257
	sys/compat/linux/common/linux_socketcall.c: revision 1.45
	sys/compat/linux/common/linux_fadvise64_64.c: revision 1.3
	sys/compat/freebsd/freebsd_ipc.c: revision 1.17
	sys/compat/linux/common/linux_misc_notalpha.c: revision 1.109
	sys/compat/linux/arch/alpha/linux_pipe.c: revision 1.17
	sys/netinet6/in6_pcb.c: revision 1.132
	sys/netinet6/in6_ifattach.c: revision 1.94
	sys/compat/svr4/svr4_exec_elf32.c: revision 1.15
	sys/miscfs/nullfs/null_vfsops.c: revision 1.90
	sys/fs/cd9660/cd9660_util.c: revision 1.12
	sys/compat/linux/arch/powerpc/linux_machdep.c: revision 1.48
	sys/compat/freebsd/freebsd_exec_elf32.c: revision 1.20
	sys/miscfs/procfs/procfs_vfsops.c: revision 1.94
	sys/compat/linux/arch/powerpc/linux_ptrace.c: revision 1.28
	sys/compat/linux/common/linux_sched.c: revision 1.67
	sys/compat/linux/common/linux_exec_aout.c: revision 1.67
	sys/compat/linux/common/linux_pipe.c: revision 1.67
	sys/compat/linux/common/linux_llseek.c: revision 1.34
	sys/compat/linux/arch/mips/linux_ptrace.c: revision 1.10
Do not uselessly include <sys/malloc.h>.
Cleanup:
 - remove struct kmembuckets (dead)
 - correctly deadify MALLOC_XX
 - remove MALLOC_DEFINE_LIMIT and MALLOC_JUSTDEFINE_LIMIT (dead)
 - remove malloc_roundup(), malloc_type_setlimit(), MALLOC_DEFINE_LIMIT()
   and MALLOC_JUSTDEFINE_LIMIT() from man 9 malloc
New sentence, new line. Bump date for previous.
Obsolete malloc_roundup(9), malloc_type_setlimit(9) and MALLOC_DEFINE_LIMIT(9)
man pages.

remove ep_name, change the last reference to use ep_kname instead.

PR/49287: Masao Uebayashi: Handle exec_script argument vector from the 32 ->
64 bit case. When execing a 64 bit shell from a 32 bit binary the argument
vector was still incorrect.

XXX: Pullup 7

Do not uselessly include <sys/malloc.h>.

Pull up following revision(s) (requested by dholland in ticket #156):
	sys/kern/kern_exec.c: revision 1.409
PR/49287: David Holland: Skip the right number of bytes to go over the first
argument in the argv vector. Fixes netbsd32 script execution, where you lost
the first argument because it skipped 8 bytes instead of 4.

PR/49287: David Holland: Skip the right number of bytes to go over the first
argument in the argv vector. Fixes netbsd32 script execution, where you lost
the first argument because it skipped 8 bytes instead of 4.

Rebase to HEAD as of a few days ago.

Rebase.

A KASSERT() is better.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Correct type of i in execve_dovmcmds.  Fixes DEBUG_EXEC build.

Pull up following revision(s) (requested by maxv in ticket #1048):
	sys/kern/kern_exec.c: revision 1.403
'error' is not set on failure. This is a true bug: everything is freed
and unlocked while zero is returned. Since there's no error, execve_runproc()
will get called and will try to use those freed things.

Pull up following revision(s) (requested by maxv in ticket #1048):
	sys/kern/kern_exec.c: revision 1.403
'error' is not set on failure. This is a true bug: everything is freed
and unlocked while zero is returned. Since there's no error, execve_runproc()
will get called and will try to use those freed things.

Pull up following revision(s) (requested by maxv in ticket #1048):
	sys/kern/kern_exec.c: revision 1.403
'error' is not set on failure. This is a true bug: everything is freed
and unlocked while zero is returned. Since there's no error, execve_runproc()
will get called and will try to use those freed things.

execve_runproc: Isolate emul specific code into a function.

copyinargs: Shorten a local var name.

copyinargs: Plug theoretical memory leak when fakearg is too long.

Pointed out & reviewed by Maxime Villard.

'error' is not set on failure. This is a true bug: everything is freed
and unlocked while zero is returned. Since there's no error, execve_runproc()
will get called and will try to use those freed things.

PS: This bug was here before uebayasi@'s changes

calcargs: Correct the size of "argc" in the stack size calculation.

(The old code has worked because it is compensated by wrong size calculation
of "auxinfo" (multiplied by sizeof(void *)).)

execve_runproc: Isolate vmcmd execution code into a function.

execve_runproc: Isolate path / commandname (proc:p_comm) related code into a function.

execve_runproc: Isolate new stack arg filling code into a function.

execve_runproc: Isolate ps_strings filling code into a function.

execve_runproc: Simplify &argc address calc.  The set of (argc, argv, ...)
is located just "behind" the initial SP.  SHRINK, then ALLOC, and you get
&argc.

exec_loadvm: Isolate stack size calc logic into separate functions.

copyinargs: Redo previous; if given fakearg is longer than arg buf (which is
very unlikely to happen), there's no point to continue with truncated arg.
Just give up and return E2BIG.

copyinargs: Replace a hand-written string copy loop with strlcpy(3).  Carefully
reuse return value of strlcpy(3) to iterate.

Revert braces.

copyinargs: Refactor.  Share code.

execve_loadvm: Move long code block reading passed arguments() into a function.
This needs further clean up.  (See the XXX comment.)  No functional changes.

execve_runproc: Correct thinko in Rev. 1.386; the new SP always points to
after (higher adderss) argc/argv/env/aux/strings regardless of stack growing
direction .  Machines with grow-up stack will detect the top of
argc/argv/env/aux/strings by the address of *argv[] via ps_strings:ps_argvstr.

This means that old comments about RTLD_GAP are all obsolete.

With help from Nick Hudson.

Don't #define DEBUG_EXEC.

execve_runproc: Refactor debug code.

execve_runproc: Move a long code block handling credential into a separate
function.  No functional changes.

execve_runproc: Unbreak __MACHINE_STACK_GROWS_UP machines.  Clarify the stack
address allocation code.  Summarize an awful big comment about the _rtld()
"gap".

(The log message in Rev. 1.384 was wrong; the new stack address is passed
not via the 3rd register argument, but via the SP.  The 3rd is for ps_strings.)

Reorder a new lines.  Comments.

execve_runproc: The stack address passed to the newly execve()'ed process,
via the 3rd register argument, always points to the stack base address (==
minsaddr (min stack address) + ssize (stack size)).  Clarify that.

execve_runproc: Reorder a few local vars.  Avoid reuse.  No functional changes.

Clarify stack size calculation in copyargs().  Comments.

Clean up assertions.

Protect not only proc::p_flag but also lwp::l_ctxlink and proc::p_acflag with
proc:p_lock.

Try to decrypt stack size calculation code in execve_loadvm().

No functional changes.  Two potential miscalculations remain.

Cache struct exec_package * for readability.  No functional changes.

Pull up following revision(s) (requested by manu in ticket #1026):
	share/man/man4/options.4: revision 1.433
	sys/kern/kern_exec.c: revision 1.371- 1.372
Add EMUL_NATIVEROOT so that native binaries can be told to search an
"emulation" directory before the real root. This makes easier to test
an amd64 kernel on the top of an i386 root filesystem prior a full
migration.

We need VMCMDs for a binary and its interpreter, so make sure we have
at least one VMCMD. This also prevents the kernel from using an
uninitialized pointer as entry point for the execution.

From me and Christos

ok christos@

Cosmetic; just replace whitespaces by tabs

explain why the innocent sigaction1 call now works.

Pull up the following revisions(s) (requested by martin in ticket #1023):
	lib/libc/gen/posix_spawn.3:			revision 1.5
	lib/libc/gen/posix_spawn_file_actions_addopen.3:	revision 1.4
	lib/libc/gen/posix_spawn_file_actions_init.3:	revision 1.4
	lib/libc/gen/posix_spawn_fileactions.c:		revision 1.3
	sys/compat/netbsd32/netbsd32_execve.c:		revision 1.38
	sys/kern/kern_exec.c:				revision 1.373

Limit the amount of kernel memory a posix_spawn syscall can use (for
handling the file action list) by limiting the maximum number of file
actions to twice the current file descriptor limit. Fix a few bugs in
the support functions and document the new limit. From Maxime Villard.

Pull up the following revisions(s) (requested by martin in ticket #1023):
	lib/libc/gen/posix_spawn.3:			revision 1.5
	lib/libc/gen/posix_spawn_file_actions_addopen.3:	revision 1.4
	lib/libc/gen/posix_spawn_file_actions_init.3:	revision 1.4
	lib/libc/gen/posix_spawn_fileactions.c:		revision 1.3
	sys/compat/netbsd32/netbsd32_execve.c:		revision 1.38
	sys/kern/kern_exec.c:				revision 1.373

Limit the amount of kernel memory a posix_spawn syscall can use (for
handling the file action list) by limiting the maximum number of file
actions to twice the current file descriptor limit. Fix a few bugs in
the support functions and document the new limit. From Maxime Villard.

Pull up the following revisions(s) (requested by martin in ticket #1023):
	lib/libc/gen/posix_spawn.3:			revision 1.5
	lib/libc/gen/posix_spawn_file_actions_addopen.3:	revision 1.4
	lib/libc/gen/posix_spawn_file_actions_init.3:	revision 1.4
	lib/libc/gen/posix_spawn_fileactions.c:		revision 1.3
	sys/compat/netbsd32/netbsd32_execve.c:		revision 1.38
	sys/kern/kern_exec.c:				revision 1.373

Limit the amount of kernel memory a posix_spawn syscall can use (for
handling the file action list) by limiting the maximum number of file
actions to twice the current file descriptor limit. Fix a few bugs in
the support functions and document the new limit. From Maxime Villard.

Cosmetics: return is an operator, not a function: remove ().

Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

Delete duplicate symbol definition introduced in 1.371. Now builds again.

Add EMUL_NATIVEROOT so that native binaries can be told to search an
"emulation" directory before the real root. This makes easier to test
an amd64 kernel on the top of an i386 root filesystem prior a full
migration.

__USING_TOPDOWN_VM is no more, __USE_TOPDOWN_VM...

Simplify error path and fix typos. From Maxime Villard and me.

replace strcpy with copystr and remove useless strcpy (Maxime Villard)

Explain where this will fail.

convert vmem, signals, powerhooks from CIRCLEQ -> TAILQ.

oops, remove accidently commited debug code

As discussed on tech-kern: make TOPDOWN-VM runtime selectable per process
(offer MD code or emulations to override it).

What's the point of having a module exec class if exec is not using it?

Support an optional MARCH ELF tag.
Store the MACHINE_ARCH of the executable in mdproc and override sysctl
so that value returned.

resync from head

Add another field to the SDT_PROBE_DEFINE macro, so our DTrace probes
can named the same as those on other platforms.

For example, proc:::exec-success, not proc:::exec_success.

Implementation follows the same basic principle as FreeBSD's; add
another field to the SDT_PROBE_DEFINE macro which is the name
as exposed to userland.

revert previous, you can run on mips 64 bit binaries with a 32 bit kernel.

don't attempt to load elf64 on 32 bit machines

sync with (a bit old) head

Pull up following revision(s) (requested by christos in ticket #670):
	sys/kern/kern_exec.c: revision 1.358
If you are going to dick around with p_stat, remember to put it
back so that spawn processes with attributes don't end up starting
up stopped!
XXX: pullup to 6.

Pull up following revision(s) (requested by christos in ticket #670):
	sys/kern/kern_exec.c: revision 1.358
If you are going to dick around with p_stat, remember to put it
back so that spawn processes with attributes don't end up starting
up stopped!
XXX: pullup to 6.

Resync to 2012-11-19 00:00:00 UTC

If you are going to dick around with p_stat, remember to put it
back so that spawn processes with attributes don't end up starting
up stopped!
XXX: pullup to 6.

sync with head

remove KERN_USRSTACK

add KERN_USRSTACK (this is not dynamically defined for FreeBSD compatibility)

Add missing newline to printf (in the disabled code for $ORIGIN).

revert racy vfork() parent-blocking-before-child-execs-or-exits code.
ok rmind

fork1: fix use-after-free problems.  Addresses PR/46128 from Andrew Doran.
Note: PL_PPWAIT should be fully replaced and modificaiton of l_pflag by
other LWP is undesirable, but this is enough for netbsd-6.

Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

sync to latest -current.

sync with head

Pull up following revision(s) (requested by martin in ticket #181):
	sys/kern/kern_exec.c: revision 1.350
Fix leak in a posix_spawn error path, from Greg Oster.

Fix leak in a posix_spawn error path, from Greg Oster.

Pull up following revision(s) (requested by martin in ticket #175):
	sys/kern/kern_exit.c: revision 1.238
	tests/lib/libc/gen/posix_spawn/t_fileactions.c: revision 1.4
	tests/lib/libc/gen/posix_spawn/t_fileactions.c: revision 1.5
	sys/uvm/uvm_extern.h: revision 1.183
	lib/libc/gen/posix_spawn_fileactions.c: revision 1.2
	sys/kern/kern_exec.c: revision 1.348
	sys/kern/kern_exec.c: revision 1.349
	sys/compat/netbsd32/syscalls.master: revision 1.95
	sys/uvm/uvm_glue.c: revision 1.159
	sys/uvm/uvm_map.c: revision 1.317
	sys/compat/netbsd32/netbsd32.h: revision 1.95
	sys/kern/exec_elf.c: revision 1.38
	sys/sys/spawn.h: revision 1.2
	sys/sys/exec.h: revision 1.135
	sys/compat/netbsd32/netbsd32_execve.c: revision 1.34
Rework posix_spawn locking and memory management:
 - always provide a vmspace for the new proc, initially borrowing from proc0
   (this part fixes PR 46286)
 - increase parallelism between parent and child if arguments allow this,
   avoiding a potential deadlock on exec_lock
 - add a new flag for userland to request old (lockstepped) behaviour for
   better error reporting
 - adapt test cases to the previous two and add a new variant to test the
   diagnostics flag
 - fix a few memory (and lock) leaks
 - provide netbsd32 compat
Fix asynchronous posix_spawn child exit status (and test for it).

Fix asynchronous posix_spawn child exit status (and test for it).

Rework posix_spawn locking and memory management:
 - always provide a vmspace for the new proc, initially borrowing from proc0
   (this part fixes PR 46286)
 - increase parallelism between parent and child if arguments allow this,
   avoiding a potential deadlock on exec_lock
 - add a new flag for userland to request old (lockstepped) behaviour for
   better error reporting
 - adapt test cases to the previous two and add a new variant to test the
   diagnostics flag
 - fix a few memory (and lock) leaks
 - provide netbsd32 compat

sync to latest -current.

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

    http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
    http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
    http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

sync to latest -current

Pull up following revision(s) (requested by martin in ticket #107):
	sys/kern/kern_exec.c: revision 1.345
	sys/kern/kern_exec.c: revision 1.346
Make sure the child of a posix_spawn operation is not preempted during
the times when it does not have any vm_space.
Should fix PR kern/46153.
Remove a KPREEMPT_ENABLE() in an error path I overlooked in the previous
change - pointed out by Manuel Bouyer.
While there, add a KASSERT() to make sure we have preemption enabled in
the success case.

Remove a KPREEMPT_ENABLE() in an error path I overlooked in the previous
change - pointed out by Manuel Bouyer.
While there, add a KASSERT() to make sure we have preemption enabled in
the success case.

Make sure the child of a posix_spawn operation is not preempted during
the times when it does not have any vm_space.
Should fix PR kern/46153.

sync to -current.

Pull up following revision(s) (requested by martin in ticket #17):
	sys/kern/kern_exec.c: revision 1.342
	sys/kern/kern_exec.c: revision 1.343
	sys/kern/kern_exec.c: revision 1.344
Posix spawn fixes:
- split the file actions allocation and freeing into separate functions
- use pnbuf
- don't play games with pointers (partially freeing stuff etc), only check
  fa and sa and free as needed using the same code.
- use copyinstr properly
- KM_SLEEP allocation can't fail
- if path allocation failed midway, we would be possibily freeing
  userland strings.
- use sizeof(*var) instead sizeof(type)
fix fae free'ing, from enami.
keep track of the original array length so we can pass it to kmem_free, from
enami

keep track of the original array length so we can pass it to kmem_free, from
enami

fix fae free'ing, from enami.

Pull up the following revisions(s) (requested by martin in ticket #14):
	include/spawn.h:		revision 1.2
	sys/kern/kern_exec.c:		revision 1.341
	sys/uvm/uvm_glue.c:		revision 1.157
	tests/lib/libc/gen/posix_spawn/t_fileactions.c:	revision 1.3

posix_spawn: fix kernel bug when passing empty fileactions (PR kern/46038)
and add a test case for this.  Fix potential race condition, doublefreeing
of memory and memory leaks in error cases.

Posix spawn fixes:
- split the file actions allocation and freeing into separate functions
- use pnbuf
- don't play games with pointers (partially freeing stuff etc), only check
  fa and sa and free as needed using the same code.
- use copyinstr properly
- KM_SLEEP allocation can't fail
- if path allocation failed midway, we would be possibily freeing
  userland strings.
- use sizeof(*var) instead sizeof(type)

More posix_spawn fallout:
Fix a kmem_alloc() call with zero size (PR kern/46038), allow file actions
to be passed, even if empty.
Rearange p_reflock locking for the child, avoid a double free in an
error case, avoid a memory leak in another error case - all pointed out
by yamt.
During blocking operations early in the child borrow the kernel vmspace
(as suggested by yamt).

Remove COMPAT_SA / KERN_SA.  Welcome to 6.99.3!
Approved by core@.

merge to -current.

Fix SDT_PROBE macro argument overlooked in argument renaming, noted by <chs>

Minor tweaks to posix_spawn error handling.
The standard allows "open" file actions for descriptors that are alreay
open, add support for that.

Add a posix_spawn syscall, as discussed on tech-kern.
Based on the summer of code project by Charles Zhang, heavily reworked
later by me - all bugs are likely mine.
Ok: core, releng.

Add a hook for freeing an ep_emul_arg.  Add a wrapper routine
(exec_free_emul_arg) to call the hook and then clear the ep_emul_arg
and ep_emul_arg_free members in the exec_package.
Change users/accessors to use these routines.
Approved by releng.

Add a macro to align the length of the stack, not the pointer itself, since
we always want the alignment to grow the length.

Use and define ALIGN() ALIGN_POINTER() and STACK_ALIGN() consistently,
and avoid definining them in 10 different places if not needed.

Revert Christos's accidental changes.

fix incomplete statement.

make the diagnostic messages more informative.

First step of random number subsystem rework described in
<20111022023242.BA26F14A158@mail.netbsd.org>.  This change includes
the following:

	An initial cleanup and minor reorganization of the entropy pool
	code in sys/dev/rnd.c and sys/dev/rndpool.c.  Several bugs are
	fixed.  Some effort is made to accumulate entropy more quickly at
	boot time.

	A generic interface, "rndsink", is added, for stream generators to
	request that they be re-keyed with good quality entropy from the pool
	as soon as it is available.

	The arc4random()/arc4randbytes() implementation in libkern is
	adjusted to use the rndsink interface for rekeying, which helps
	address the problem of low-quality keys at boot time.

	An implementation of the FIPS 140-2 statistical tests for random
	number generator quality is provided (libkern/rngtest.c).  This
	is based on Greg Rose's implementation from Qualcomm.

	A new random stream generator, nist_ctr_drbg, is provided.  It is
	based on an implementation of the NIST SP800-90 CTR_DRBG by
	Henric Jungheim.  This generator users AES in a modified counter
	mode to generate a backtracking-resistant random stream.

	An abstraction layer, "cprng", is provided for in-kernel consumers
	of randomness.  The arc4random/arc4randbytes API is deprecated for
	in-kernel use.  It is replaced by "cprng_strong".  The current
	cprng_fast implementation wraps the existing arc4random
	implementation.  The current cprng_strong implementation wraps the
	new CTR_DRBG implementation.  Both interfaces are rekeyed from
	the entropy pool automatically at intervals justifiable from best
	current cryptographic practice.

	In some quick tests, cprng_fast() is about the same speed as
	the old arc4randbytes(), and cprng_strong() is about 20% faster
	than rnd_extract_data().  Performance is expected to improve.

	The AES code in src/crypto/rijndael is no longer an optional
	kernel component, as it is required by cprng_strong, which is
	not an optional kernel component.

	The entropy pool output is subjected to the rngtest tests at
	startup time; if it fails, the system will reboot.  There is
	approximately a 3/10000 chance of a false positive from these
	tests.  Entropy pool _input_ from hardware random numbers is
	subjected to the rngtest tests at attach time, as well as the
	FIPS continuous-output test, to detect bad or stuck hardware
	RNGs; if any are detected, they are detached, but the system
	continues to run.

	A problem with rndctl(8) is fixed -- datastructures with
	pointers in arrays are no longer passed to userspace (this
	was not a security problem, but rather a major issue for
	compat32).  A new kernel will require a new rndctl.

	The sysctl kern.arandom() and kern.urandom() nodes are hooked
	up to the new generators, but the /dev/*random pseudodevices
	are not, yet.

	Manual pages for the new kernel interfaces are forthcoming.

Improve diagnostics message on entry point too low/high checking

Also fix DPRINTF()'s for DEBUG_EXEC

Fix DPRINTF()'s missing the extra parenteses

Enhance EXEC_DEBUG by also printing the UVM commands

defflag DEBUG_EXEC

Fix a typo in r1.243: test for STACKALIGN not STACKLALIGN:

"If STACKALIGN is defined, use it instead of ALIGN.  Some arches need a
 stack more aligned that ALIGN will give."

Provide a better fix for the checks

Change aprint_verbose() to a normal printf() surrounded by #ifdef DIAGNOSTIC

Fix check for VM_MIN_ADDRESS since it doesn't need to be a constant

fix compilation for VM_MIN_ADDRESS == 0

Move debug -> verbose

On a verbose kernel boot show why executables are denied due to their start
adresses. This will hardly ever occure in real-life.

First stage of support for Extended API set 2. Most of the think is
unimplemented, except enough of linkat(2) to hardlink to a symlink.

Everything new in headers is guarded #ifdef _INCOMPLETE_XOPEN_C063 since
some software (e.g.: xcvs in our own tree) will assume they can use openat(2)
when AT_FDCWD is defined. _INCOMPLETE_XOPEN_C063 will go away once support
will be completed.

Catchup with rmind-uvmplock merge.

sync with head

Add some more MI hook points for PCU.  Discard the PCU state at lwp_exit and
at exec time.  Before forking, save the PCU state so that cpu_lwp_fork
doesn't have.  Remove MD code which did that before.

Sync with HEAD.

kern/42030 - tracking of file descriptors by ktrace/kdump

sync with head

Pull in lwp_setprivate/cpu_lwp_setprivate from -current.
Also pull in lwp_getpcb

Remove IRIX emulation

sync with head

Pull up following revision(s) (requested by spz in ticket #1421):
	sys/kern/kern_exec.c: revision 1.269 via patch
Check for number of processes resource violation in execve().

Pull up following revision(s) (requested by spz in ticket #1421):
	sys/kern/kern_exec.c: revision 1.269 via patch
Check for number of processes resource violation in execve().

Make debugging code compile.

fix debugging printfs.

sync with head

Sync with HEAD

Refactor ps_strings access. Based on PK_32, write either the normal
version or the 32bit compat layout in execve1. Introduce a new function
copyin_psstrings for reading it back from userland and converting it to
the native layout. Refactor procfs to share most of the code with the
kern.proc_args sysctl handler.

This material is based upon work partially supported by
The NetBSD Foundation under a contract with Joerg Sonnenberger.

better debugging messages.

Ensure that the LWP private area has a consistent value after exec.

Borrow the lwpctl data area from the parent for the vfork() child.
Otherwise the child will incorrectly see it is not running on any
CPU.  Among other things, this fixes crashes from having
LD_PRELOAD=libpthread.so set in the env.

reviewed by tech-kern

Sync with HEAD

fix snafu

Support FD_CLOEXEC in rump kernels.

Add more detailed debug printfs (one for each error case).

- Fix a few possible locking issues in execve1() and exit1().  Add a note
  that scheduler locks are special in this regard - adaptive locks cannot
  be in the path due to turnstiles.  Randomly spotted/reported by uebayasi@.
- Remove unused lwp_relock() and replace lwp_lock_retry() by simplifying
  lwp_lock() and sleepq_enter() a little.
- Give alllwp its own cache-line and mark lwp_cache pointer as read-mostly.

OK ad@

Abolish the SAVENAME and HASBUF flags. There is now always a buffer,
so the path in a struct componentname is now always valid during VOP
calls.

Abolish struct componentname's cn_pnbuf. Use the path buffer in the
pathbuf object passed to namei as work space instead. (For now a pnbuf
pointer appears in struct nameidata, to support certain unclean things
that haven't been fixed yet, but it will be going away in the future.)

This removes the need for the SAVENAME and HASBUF namei flags.

Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Sync with HEAD (-D20101022).

sync with head

Update the rest of the kernel to conform to the module subsystem's new
locking protocol.

Add some more debug printfs for various failures.

Sync with HEAD.

sync with head.

many changes for COMPAT_LINUX:
 - update the linux syscall table for each platform.
 - support new-style (NPTL) linux pthreads on all platforms.
   clone() with CLONE_THREAD uses 1 process with many LWPs
   instead of separate processes.
 - move the contents of sys__lwp_setprivate() into a new
   lwp_setprivate() and use that everywhere.
 - update linux_release[] and linux32_release[] to "2.6.18".
 - adjust placement of emul fork/exec/exit hooks as needed
   and adjust other emul code to match.
 - convert all struct emul definitions to use named initializers.
 - change the pid allocator to allow multiple pids to refer to the same proc.
 - remove a few fields from struct proc that are no longer needed.
 - disable the non-functional "vdso" code in linux32/amd64,
   glibc works fine without it.
 - fix a race in the futex code where we could miss a wakeup after
   a requeue operation.
 - redo futex locking to be a little more efficient.

sync with head

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

sync with head

execve1: move few PNBUF_PUT() outside the lock paths.

Blanking the path buffer only needs to be done when DIAGNOSTIC.
(I meant to set it back this way before committing but evidently forgot
last night. Thanks to rmind for noticing.)

Remove the nameidata from struct exec_package. It was used only for two
things: passing an argument to check_exec, which is better done explicitly,
and handing back the resolved pathname generated by namei, which we can
make an explicit slot for in struct exec_package instead. While here,
perform some related tidyup, and store the kernel-side copy of the path
to the executable as well as the pointer into userspace. (But the latter
should probably be removed in the future.)

Sync with HEAD.

sync to netbsd-5

sync with head

DTrace: Add an SDT (Statically Defined Tracing) provider framework, and
implement most of the proc provider.  Adds proc:::create, exec,
exec_success, exec_faillure, signal_send, signal_discard, signal_handle,
lwp_create, lwp_start, lwp_exit.

The VATTR_NULL/VREF/VHOLD/HOLDRELE() macros lost their will to live
years ago when the kernel was modified to not alter ABI based on
DIAGNOSTIC, and now just call the respective function interfaces
(in lowercase).  Plenty of mix'n match upper/lowercase has creeped
into the tree since then.  Nuke the macros and convert all callsites
to lowercase.

no functional change

Change u_long to vaddr_t/vsize_t in exec code where appropriate (mostly
involves setregs and vmcmds).  Should result in no code differences.

Initialise struct emul members by name (it is readable now and one can search
them in the tree).

Pull up following revision(s) (requested by dsl in ticket #1352):
	sys/kern/kern_exec.c: patch
Fix ktrace of data from iovec based system calls.
Fixes PR/41819

Pull up following revision(s) (requested by dsl in ticket #1352):
	sys/kern/kern_exec.c: patch
Fix ktrace of data from iovec based system calls.
Fixes PR/41819

sync with head.

ktrace the arguments to script interpreters that come from the script.
Fixes PR/33021

Sync with HEAD.

sync with head

Declare extern syscallnames in a header.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Sync with HEAD.

Pull up following revision(s) (requested by christos in ticket #573):
	sys/kern/kern_exec.c: revision 1.286
don't enforce maxproc resource limits for root.

Pull up following revision(s) (requested by mrg in ticket #622):
	bin/csh/csh.1: revision 1.46
	bin/csh/func.c: revision 1.37
	bin/ps/print.c: revision 1.111
	bin/ps/ps.c: revision 1.74
	bin/sh/miscbltin.c: revision 1.38
	bin/sh/sh.1: revision 1.92 via patch
	external/bsd/top/dist/machine/m_netbsd.c: revision 1.7
	lib/libkvm/kvm_proc.c: revision 1.82
	sys/arch/mips/mips/cpu_exec.c: revision 1.55
	sys/compat/darwin/darwin_exec.c: revision 1.57
	sys/compat/ibcs2/ibcs2_exec.c: revision 1.73
	sys/compat/irix/irix_resource.c: revision 1.15
	sys/compat/linux/arch/amd64/linux_exec_machdep.c: revision 1.16
	sys/compat/linux/arch/i386/linux_exec_machdep.c: revision 1.12
	sys/compat/linux/common/linux_limit.h: revision 1.5
	sys/compat/osf1/osf1_resource.c: revision 1.14
	sys/compat/svr4/svr4_resource.c: revision 1.18
	sys/compat/svr4_32/svr4_32_resource.c: revision 1.17
	sys/kern/exec_subr.c: revision 1.62
	sys/kern/init_sysctl.c: revision 1.160
	sys/kern/kern_exec.c: revision 1.288
	sys/kern/kern_resource.c: revision 1.151
	sys/sys/param.h: patch
	sys/sys/resource.h: revision 1.31
	sys/sys/sysctl.h: revision 1.184
	sys/uvm/uvm_extern.h: revision 1.153
	sys/uvm/uvm_glue.c: revision 1.136
	sys/uvm/uvm_mmap.c: revision 1.128
	usr.bin/systat/ps.c: revision 1.32
- - add new RLIMIT_AS (aka RLIMIT_VMEM) resource that limits the total
address space available to processes.  this limit exists in most other
modern unix variants, and like most of them, our defaults are unlimited.
remove the old mmap / rlimit.datasize hack.
- - adds the VMCMD_STACK flag to all the stack-creation vmcmd callers.
it is currently unused, but was added a few years ago.
- - add a pair of new process size values to kinfo_proc2{}. one is the
total size of the process memory map, and the other is the total size
adjusted for unused stack space (since most processes have a lot of
this...)
- - patch sh, and csh to notice RLIMIT_AS.  (in some cases, the alias
RLIMIT_VMEM was already present and used if availble.)
- - patch ps, top and systat to notice the new k_vm_vsize member of
kinfo_proc2{}.
- - update irix, svr4, svr4_32, linux and osf1 emulations to support
this information.  (freebsd could be done, but that it's best left
as part of the full-update of compat/freebsd.)
this addresses PR 7897.  it also gives correct memory usage values,
which have never been entirely correct (since mmap), and have been
very incorrect since jemalloc() was enabled.
tested on i386 and sparc64, build tested on several other platforms.
thanks to many folks for feedback and testing but most espcially
chuq and yamt for critical suggestions that lead to this patch not
having a special ugliness i wasn't happy with anyway :-)

- add new RLIMIT_AS (aka RLIMIT_VMEM) resource that limits the total
address space available to processes.  this limit exists in most other
modern unix variants, and like most of them, our defaults are unlimited.
remove the old mmap / rlimit.datasize hack.

- adds the VMCMD_STACK flag to all the stack-creation vmcmd callers.
it is currently unused, but was added a few years ago.

- add a pair of new process size values to kinfo_proc2{}. one is the
total size of the process memory map, and the other is the total size
adjusted for unused stack space (since most processes have a lot of
this...)

- patch sh, and csh to notice RLIMIT_AS.  (in some cases, the alias
RLIMIT_VMEM was already present and used if availble.)

- patch ps, top and systat to notice the new k_vm_vsize member of
kinfo_proc2{}.

- update irix, svr4, svr4_32, linux and osf1 emulations to support
this information.  (freebsd could be done, but that it's best left
as part of the full-update of compat/freebsd.)


this addresses PR 7897.  it also gives correct memory usage values,
which have never been entirely correct (since mmap), and have been
very incorrect since jemalloc() was enabled.

tested on i386 and sparc64, build tested on several other platforms.

thanks to many folks for feedback and testing but most espcially
chuq and yamt for critical suggestions that lead to this patch not
having a special ugliness i wasn't happy with anyway :-)

use kauth instead of uid != 0

don't enforce maxproc resource limits for root.