Remove svn:mergeinfo carried over from stable/9.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC r260913,266895:
Add a new flag to /etc/ttys: onifconsole. This is equivalent to "on" if the
device is an active kernel console and "off" otherwise. This is designed to
allow serial-booting x86 systems to provide a login prompt on the serial line
by default without providing one on all systems by default. Set this flag
on x86 systems for ttyu0.

Comments and suggestions by: grehan, dteske, jilles
Approved by: re (gjb)
Relnotes: yes

MFC r266411:
Fix LD_LIBMAP.

Approved by: re (gjb)

MFC r264481:
Add dwarf annotations to the amd64 _rtld_bind_start to allow debuggers
to unwind around the calls from PLT to binder.

MFC: r263121

Re-format the license to conform to our BSD license template as much
as possible. This does not change the wording in any way.

Remove the 3rd clause ("advertising clause") of the BSD license as
permitted by the University of Berkeley on July 22, 1999. While the
clause itself mentions Lawrence Berkeley Laboratory, UCB is the sole
copyright holder of this file.

Reviewed by: imp, emaste, eadler

MFH (r251810): fix installation from read-only .OBJDIR
MFH (r255384): add PRIVATELIB for internal-use shred libraries
MFH (r255385, r255413): add a stock libmap32.conf
MFH (r255765): always support directory mapping; rewrite libmap man page

MFC r262277:

malloc_aligned() may not leave enough space for pointer to allocated memory,
saving the pointer will overwrite bytes belongs to another memory block
unexpectly, to fix the problem, use (allocated address + sizeof(void *)) as
initial value, and slip to next aligned address, so maximum extra bytes is
sizeof(void *) + align - 1.

Tested by: Andre Albsmeier < mail at ma17 dot ata dot myota dot orgndre >

MFC r262334:

Increase alignment to size of pointer if the alignment is too small.
Some modules do not align data at least to size of pointer, they uses a
smaller alignment, but our pointer should be aligned to its native
boundary, otherwise on some platforms, hardware alignment checking
will cause bus error.

MFC: r261885

In sgetpwnam(), save and free pw_class like all other char members
of struct passwd. This fixes spurious "login_getclass: unknown class"
errors.

PR: 186439
Submitted by: UEMURA Tetsuya <t_uemura at macome.co.jp>

MFC r259044:
For variant II static TLS, properly align tls segments.

MFC r259072:
Cast Elf_Addr to void * to match the free_aligned() argument type.

MFC r259043:
Build an allocator for the aligned memory on top of the rtld-private
malloc.

MFC r256101:
Implement support for the interpose dso flag.

MFC r250075:
Properly terminate the result string for intermediate results.

MFC r249525:
Rewrite origin_subst_one() to get rid of the wrong limit on the length
of the resulting string.

MFC r247396:

Map libraries linked with -Ttext-segment=base_addr at base_addr.
Normal libraries have base address 0 and are unaffected by this change.

PR: 176216
Submitted by: Damjan Jovanovic <damjan.jov@gmail.com>
Reviewed by: kib

MFC: r235857

mdoc: Only use macros inside a reference block.

MFC: r246106, r246139

Mark tftp_log() as __printflike() and deal with the fallout.

MFC: r229780 (partial)

Spelling fixes for libexec/

MFC: r241720 (partial)

Fix warnings found by -Wmising-variable-declarations.

MFC: r235643

Properly use LDADD & DPADD to link against libwrap.

MFC r246880:

Since clang 3.2 now has an option to suppress warnings about implicitly
promoted K&R parameters, remove the workarounds added for sendmail
components in r228558.

MFC r244686 to stable/9:
Use correct size in snprintf.
Remove unused buffer.

PR: 174631
Submitted by: Henning Petersen

MFC r242372:
atrun(8): scale default load average limit with the number of CPUs

Previously atrun refused to run jobs if load average was not below fixed limit of 1.5.

PR: 173175
Approved by: trasz (mentor)

MFC r241848:
Check the return error of set[e][ug]id. While this can never fail in the
current version of FreeBSD, this isn't guarenteed by the API.
Custom security modules, or future implementations of the setuid and
setgid may fail.

Approved by: cperciva (implicit)

MFC r240974: atrun: Do not assume that MAXLOGNAME <= 100.

The reserved space for fmt was exactly sufficient for a two-digit value of
MAXLOGNAME - 1.

PR: bin/171815
Submitted by: Jeremy Huddleston Sequoia

MFC r240090:

Improve file rotation

MFC r240686:
Do not reference z_nodeflib for !objgiven case, thus fixing LD_PRELOAD
for a non-absolute path.

PR: bin/171604

MFC r240506:
Bump date missed in r202756

PR: docs/171624
Approved by: cperciva (implicit)

MFC r238471:
Implement DT_RUNPATH and -z nodefaultlib.

MFC note: The ld_library_path_rpath default value was flipped to true,
effectively reverting rtld back to the pre-patch behaviour, unless
LD_LIBRARY_PATH_RPATH environment variable is set and its value is 0/N/n.

MFC r239470: Do not call process_nodelete with NULL object pointer.

The place where the function is called can be reached if object loading
and relocation fails too, in which case obj pointer will be NULL. Do not
call process_nodelete then, or crash will follow.

Pointy hat to: kan

MFC r239253: Pospone the DF_1_NODELETE processing until object DAG is
fully loaded.

Trying to up the reference from the load loop risks missing
dependencies that have not been loaded yet.

MFC r239019: Parse notes only after object structure had been allocated.

MFC r231973: Avoid error log for transfer stop w/o error code.

A number of tftp clients, including the one in Intel's pxe boot loader,
may intentionally stop a transfer using error code 0 (i.e., EUNDEF).
These are not real errors. Avoid spamming log files with these by
logging them at level LOG_DEBUG instead.

Discussed on -hackers with an initial patch proposal; this change is an
improved approach suggested by kan@.

MFH r236751: document sha256 / sha512 support
MFH r236892: remove mention of auth.conf from programs that don't use it
MFH r236963: remove dead code relating to auth.conf
MFH r236965 r236966 r236967 r237005 r237006 r237011: retire auth.conf

Approved by: re

MFC r237659:
Ensure that for the object which is a dependency for some filtee,
relocations are performed before the object's initializer is called.

Approved by: re (kensmith)

MFC r237058:
Eliminate the static buffer used to read the first page of the mapped
object, and eliminate the pread(2) call as well. Mmap the first
page of the object temporaly, and unmap it on error or last use.
Potentially, this leaves one-page gap between succeeding dlopen(3),
but there are other mmap(2) consumers as well.

Fix several cases were the whole mapping of the object leaked on error.

Use MAP_PREFAULT_READ for mmap(2) calls which map real object pages

MFC: r231618, r233231 (partial)

Add thread-local storage support for ARM to rtld-elf

Reviewed by: cognet
Obtained from: NetBSD

MFC r233648:
Remove trailing whitespace per mdoc lint warning

Approved by: cperciva (implicit)

MFC: 234851, 235059

Add two special directives to libmap.conf:
include <file>:
Parse the contents of file before continuing with the current file.
includedir <dir>:
Parse the contents of every file in dir that ends in .conf before continuing
with the current file.
Any file or directory encountered while processing include or includedir
directives will be parsed exactly once, even if it is encountered multiple
times.

Approved by: des (mentor)

MFC r234840:
Split the symlook_obj1 into a loop iterating over the ELF object symbol
hash elements, and a helper matched_symbol() which match the given hash
entry and request, performing needed type and version checks.

MFC r234841:
Add GNU hash support for rtld.

MFC r235054:
Work around a situation where symlook_obj() could be called for the
object for which digest_dynamic1() was not done yet. Just return
EINVAL and do not try to dereference NULL buckets hash array.

MFC r234170:
Propagate the current state of rtld_bind_lock to dlopen_object() calls
through the filter loading call chain. This fixes attempts to
write-lock the already locked rtld_bind_lock when filter loading is
initiated by relocation of dlopening dso.

MFC r233927:
Properly handle absent AT_CANARY aux entry.

MFC r233431:
Remove libssp_nonshared from the rtld linking set. The only use for the
library was definition for the weak alias of __stack_chk_fail.

MFC r233430:
Provide short-circuit exit(3) implementation for rtld.

MFC r233361:
Remove superfluous extern keywords.

MFC r233360:
Centralize the calculation of the top source directory.

MFC r233357:
Implement xstrdup() using strlen()/xmalloc()/memcpy() already
presented in rtld, instead of pulling in libc strdup().

MFC r233307:
Use xmalloc() instead of malloc() in the places where malloc() calls
are assumed to not fail.

Make the xcalloc() calling conventions follow the calloc(3) calling
conventions and replace unchecked calls to calloc() with calls to
xcalloc().

Remove redundand declarations from xmalloc.c, which are already
present in rtld.h.

MFC r233306:
Remove the fragments which are not needed on FreeBSD.

MFC r233655:
Add a special case in do_dlsym() for TLS stored symbols.

MFC r233674:
Fix ia64 build after r233655.

MFC r233546:
Prevent rtld_verify_object_versions() from being called several times
for the same object.

MFC r233231:
Fix several problems with our ELF filters implementation.

Do not relocate twice an object which happens to be needed by loaded
binary (or dso) and some filtee opened due to symbol resolution when
relocating need objects. Record the state of the relocation
processing in Obj_Entry and short-circuit relocate_objects() if
current object already processed.

Do not call constructors for filtees loaded during the early
relocation processing before image is initialized enough to run
user-provided code. Filtees are loaded using dlopen_object(), which
normally performs relocation and initialization. If filtee is
lazy-loaded during the relocation of dso needed by the main object,
dlopen_object() runs too earlier, when most runtime services are not
yet ready.

Postpone the constructors call to the time when main binary and
depended libraries constructors are run, passing the new flag
RTLD_LO_EARLY to dlopen_object(). Symbol lookups callers inform
symlook_* functions about early stage of initialization with
SYMLOOK_EARLY. Pass flags through all functions participating in
object relocation.

Use the opportunity and fix flags argument to find_symdef() in
arch-specific reloc.c to use proper name SYMLOOK_IN_PLT instead of
true, which happen to have the same numeric value.

MFC r233777 (by kan):
Do not try to adjust stacks if dlopen_object is called too early.

MFC r233778 (by kan):
Remove extra blank line from revious commit.

MFC note: the ARM and MIPS TLS support is not merged back, so the chunks
from r233231 which fix misuse of flags in calls to find_symdef() in
the corresponding relocation type handlers were not applied. When TLS
support is merged, the rest of r233231 should be applied too.

MFC r232974:
Stop using strerror(3) in rtld, which brings in msgcat and stdio.
Directly access sys_errlist array of errno messages with private
rtld_strerror() function.

MFC r232862:
Do not use stdio for libmap.conf read. Directly map the file and
parse lines from the mappings.

MFC r232861:
Provide rtld-private implementations of __stack_chk_guard,
__stack_chk_fail() and __chk_fail() symbols, to be used by functions
linked from libc_pic.a.

MFC r232831:
Add support for preinit, init and fini arrays to rtld.
Only binaries marked with proper ABI note gets array ctr/dtrs called.

MFC r232856:
When iterating over the dso program headers, the object is not initialized
yet, and object segments are not yet mapped. Only parse the notes that
appear in the first page of the dso (as it should be anyway), and use
the preloaded page content.

MFC r232857 (by dim):
Fix a warning/error with clang.

MFC r232859 (by dim):
Amend r232857, now dropping the casts entirely, as they were not
necessary at all.

MFC r233041:
Remove write-only variable.

MFC r232777:
Optimize tls_get_addr_common().

MFC r232729:
Remove the use of toupper() from rtld_printf.c.

MFC r232263:

Define several extra macros in bsd.sys.mk and sys/conf/kern.pre.mk, to
get rid of testing explicitly for clang (using ${CC:T:Mclang}) in
individual Makefiles.

Instead, use the following extra macros, for use with clang:
- NO_WERROR.clang (disables -Werror)
- NO_WCAST_ALIGN.clang (disables -Wcast-align)
- NO_WFORMAT.clang (disables -Wformat and friends)
- CLANG_NO_IAS (disables integrated assembler)
- CLANG_OPT_SMALL (adds flags for extra small size optimizations)

As a side effect, this enables setting CC/CXX/CPP in src.conf instead of
make.conf! For clang, use the following:

CC=clang
CXX=clang++
CPP=clang-cpp

MFC r232572:
Use hand-made isspace1() macro which is enough to detect spaces in
libmap.conf.

MFC r232590 (by pluknet):
Rename isspace1() macro to the more appropriate rtld_isspace().

MFC r231582:
Add missed EOL when die() was converted to use rtld_fdputstr() instead
of errx().

PR: bin/165075

MFC r22990[45] and r229907-r229919:

- fix a variety of warnings produced by gcc46 when compiling world

Approved by (cperciva)

MFC r231118:

Consistently set RPCGEN_CPP when running rpcgen, so the C preprocessor
set via ${CPP} is used, instead of always using hardcoded /usr/bin/cpp.

MFC r230784:
Add support for GNU RELRO.

MFC r229768:
Implement fdlopen(3), an rtld interface to load shared object by file
descriptor.

MFC r229508:
Postpone the resolution of IRELATIVE relocations and IFUNC-targeted
relocations until tls is initialized and stacks permissions correctly
set. This allows the ifunc to call malloc(3) and some other heavy
services.

Add debug banner.

MFC r228435:
Add support for STT_GNU_IFUNC and R_MACHINE_IRELATIVE GNU extensions to
rtld on 386 and amd64.

MFC r228503:
Postpone the resolution for irelative/ifunc right before initializers
are called, and drop bind lock around calls to dispatcher. Use
initlist to iterate over the objects instead of the ->next, due to
drop of the bind lock in iteration.

For i386/reloc.c:reloc_iresolve(), fix calculation of the dispatch
function address for dso, by taking into account possible non-zero
relocbase.

MFC r228635 (by nwhitehorn):
Fix RTLD on PowerPC after r228435. Changing the order of init_pltgot()
caused the icache to be invalidated at the wrong time, resulting in
an icache full of nonsense in the PLT section.

MFC r227458, r226436:

- change "is is" to "is" or "it is"
- change "the the" to "the"
- other typo fixes

Approved by: lstewart

MFC r228600:

Fix the incompatible enum conversions in libexec/ypxfr in another, more
messy way, so as to not disrupt other yp programs: just add casts to
convert the incompatible enums, as the numerical values are the same
(either by accident, design, or the phase of the moon at that time).

MFC r228587:

In libexec/rbootd/utils.c, use the correct printf length modifiers for
u_int32_t and size_t.

MFC r228586:

In libexec/pppoed/pppoed.c, use the correct printf length modifier for a
size_t.

MFC r228584:

In libexec/bootpd/tools/bootptest/print-bootp.c, use the correct printf
length modifier for the difference between two pointers.

MFC r228582:

In libexec/getty/chat.c, replace && with & in chat_send(). The intent
is to test if the CHATDEBUG_SEND bit is set in the chat_debug global.

MFC r228581:

In libexec/bootpd/bootpgw/bootpgw.c, add a cast for the remaining
minutes of activity, to avoid a warning on platforms where time_t is a
32-bit integer.

MFC r228646:
Additional icache paranoia: non-PLT relocations can modify the text segment.
It is then important to make sure the icache is synchronized again to
prevent (rare) random seg faults and illegal instructions.

MFC r228558, r228585, r228588, r228652, r228707:

Unfortunately, clang gives warnings about sendmail code that cannot be
turned off yet. Since this is contrib code, and we don't really care
about the warnings, just make them non-fatal for now.

MFC r228590:

Fix typos in the comments about clang warnings in several
sendmail-related Makefiles.

Spotted by: arundel

MFC r228708:

In usr.bin/vacation/Makefile, fix a typo in the comment about clang
warnings.

Spotted by: arundel

MFC r228375:
Typo.

Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06]

Add an API for alerting internal libc routines to the presence of
"unsafe" paths post-chroot, and use it in ftpd. [11:07]

Fix a buffer overflow in telnetd. [11:08]

Make pam_ssh ignore unpassphrased keys unless the "nullok" option is
specified. [11:09]

Add sanity checking of service names in pam_start. [11:10]

Approved by: so (cperciva)
Approved by: re (bz)
Security: FreeBSD-SA-11:06.bind
Security: FreeBSD-SA-11:07.chroot
Security: FreeBSD-SA-11:08.telnetd
Security: FreeBSD-SA-11:09.pam_ssh
Security: FreeBSD-SA-11:10.pam

MFC r227660:
Fix fd leak.

Approved by: re (bz)

MFC: r227006, r227281, r227282

Add a PCI front-end to esp(4) allowing it to support AMD Am53C974 and
replace amd(4) with the former in the amd64, i386 and pc98 GENERIC kernel
configuration files. Besides duplicating functionality, amd(4), which
previously also supported the AMD Am53C974, unlike esp(4) is no longer
maintained and has accumulated enough bit rot over time to always cause
a panic during boot as long as at least one target is attached to it
(see PR 124667).

PR: 124667
Approved by: re (kib)
Obtained from: NetBSD (based on)

MFC: r226937

Fix a misplaced parenthesis.

Approved by: re (kib)

MFC r226156:
Handle the R_386_TLS_TPOFF32 relocation.

Approved by: re (bz)

MFC r226155:
Setting up TLS block for the main thread must be done after the
relocations are processed.

Approved by: re (bz)

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Restore the writing of the .bss sections of the dsos (not the main
executable) after r190885. The whole region for the dso is mmaped with
MAP_NOCORE flag, doing only mprotect(2) over .bss prevented it from
writing .bss to core files.

Revert the optimization of using mprotect(2) to establish .bss, overlap
the section with mmap(2).

Reported by: attilio
Reviewed by: attilio, emaste
Approved by: re (bz)
MFC after: 2 weeks

Use the proper dynamic tls block to calculate the tls variable address
in case tls data generation was updated.

PR: misc/160721
Submitted by: "Thinker K.F. Li" <thinker codemud net>
Tested by: flo
Approved by: re (bz)
MFC after: 1 week

Do not use the function pointers for the internal operation of rtld_printf()
functions. The _rtld_error() function might be called early during the rtld
bootstrap, in which case function pointers are not yet functional on ia64
due to required relocations not yet performed.

Reported, reviewed and tested by: marcel
Approved by: re (bz)

When libexec/rtld-elf/rtld.c is compiled with clang, the r_debug_state()
function (a hook necessary for gdb support), is inlined, but since the
function contains no code, no calls to it are generated. When gdb is
debugging a dynamically linked program, this causes backtraces to be
corrupted.

Fix it by marking the function __noinline, and inserting an empty asm
statement, that pretends to clobber memory. This forces the compiler to
emit calls to r_debug_state() throughout rtld.c.

Approved by: re (kib)

Rtld links with the specially built pic static libc library to get some
C runtime services, like printf(). Unfortunately, the multithread-safeness
measures in the libc do not work in rtld environment.

Rip the kernel printf() implementation and use it in the rtld instead of
libc version. This printf does not require any shared global data and thus
is mt-safe. Systematically use rtld_printf() and related functions, remove
the calls to err(3).

Note that stdio is still pulled from libc due to libmap implementaion using
fopen(). This is safe but unoptimal, and can be changed later.

Reported and tested by: pgj
Diagnosed and reviewed by: kan (previous version)
Approved by: re (bz)

Pull in some wording to the tftpd.8 man page
from NetBSD, with some slight changes:

=========================================================================================
http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/tftpd/tftpd.8?only_with_tag=MAIN#rev1.22

Revision 1.22 or diffs], Fri Jan 8 21:05:14 2010 UTC (18 months, 2 weeks ago) by christos

Patrick Welche <prlw1@cam.ac.uk>
- add -p pathsep option
- make wrap to zero work, but produce a warning
While here:
- fix gcc warnings, in particular variable clobbered warnings
(compiling with fewer warnings does not really fix the problem)
=========================================================================================

These wording changes clarify the default rollover behavior
as a "kludge". Also, the block numbers and octet counts for 65535 blocks
and 32767 blocks are more accurate than the existing documented numbers.

Requested by: Pawan Gupta <pawang at juniper dot net>
Obtained from: Juniper Networks
Approved by: re (kib)

In the old TFTP server, there was an undocumented behavior where
the block counter would rollover to 0 if a file larger
than 65535 blocks was transferred. With the default block size
of 512 octets per block, this is a file size of approximately 32 megabytes.

The new TFTP server code would report an error and stop transferring
the file if a file was larger than 65535 blocks.

This patch restores the old TFTP server's behavior to the new
TFTP server code. If a TFTP client transfers a file larger
than 65535 blocks, and does *not* specify the "rollover" option,
then automatically rollover the block counter to 0 every time
we reach 65535 blocks.

This restores interoperability with the FreeBSD 6 TFTP client.
Without this change, if a FreeBSD 6 TFTP client tried to
retrieve a file larger than 65535 blocks from a FreeBSD 9 TFTP server
, the transfer would fail.
The same file could be retrieved successfully if the same FreeBSD 6
TFTP client was used against a FreeBSD 6 TFTP server.

Approved by: re (kib)
Tested by: Pawan Gupta <pawang at juniper dot net>,
Obtained from: Juniper Networks

Acknowledge Edwin Groothuis for the major rewrite he
did of the tftpd and tftp code to support TFTP blocksize.

Bring back synchnet() implementation from older
tftp implementation. The synchnet() function
was converted to a no-op when the new TFTP implementation
was committed to FreeBSD. However, this function, as it was
in the older code, is needed
in order to synchronize between the tftpd server and tftp clients,
which may be buggy.

Specifically, we had a buggy TFTP client which would send
TFTP ACK packets for non-TFTP packets, which would cause
the count of packets to get out of whack, causing transfers
to fail with the new TFTPD implementation.

Obtained from: Juniper Networks
Submitted by: Santhanakrishnan Balraj <sbalraj at juniper dot net>

Update references to RFC's that the newer TFTP implementation supports.

Fix typo.

Reported by: Nick Mann <njm at njm dot me dot uk>

Clarify tftpd's -d flag in the new TFTP implementation.
Bump date.

Add LOGIN_SETCPUMASK and LOGIN_SETLOGINCLASS to the setusercontext(3)
calls in ftpd(8).

Minor cleanups to ulog-helper:

- Remove unneeded linking against libmd. libulog depends on this
library, but the ulog-helper tool itself does not.

- Change the comment at the top to mention utmpx instead of utmp, wtmp
and lastlog.

- Simply use user_from_uid() to translate to a username string.

- Put variable declarations together.

Fix clang warnings.

Approved by: philip (mentor)

Clarify that the TFTP blocksize (RFC2348) or non-standard
TFTP rollover option can be used to transfer larger files.

Compile RTLD with global dot symbols on 64-bit PowerPC, as a crutch for
GDB's ability to locate r_debug_state (which is actually the only function
that need be compiled this way).

Remove a gratuitous newline. This should be a non-functional change.

PR: bin/153667
Submitted by: Craig Leres
MFC after: 1 week

Fix tftp_log() usage.

rtld: eliminate double call to close(2) that may occur in load_object

The second close(2) call resulted in heisenbugs in some multi-threaded
applications where e.g. dlopen(3) call in one thread could close a file
descriptor for a file having been opened in other thread concurrently.

My litmus test for this issue was an openoffice.org build.

Reviewed by: jhb
MFC after: 2 weeks

- Add support for TLS relocations.
- Emitt an error when encountering an unsupported and in case of the
kernel also for unaligned relocations.
- Fix R_SPARC_LOX10 relocations. Apparently these are hardly ever used.

- Remove clause 3 and 4 from TNF licenses. [1]
- Add the _RF_X committed in r212998 also to the tables in the sparc64
reloc.c in order reduce differences between the kernel and the userland
source. This results in no functional change though.
- Fix further inconsistencies in the abbreviations of the names of the
relocations.
- Further whitespace fixes.

Obtained from: NetBSD [1]

Remove dead code that snuck in from the 32-bit PowerPC version of this
file. The error being checked for does not exist on 64-bit systems.

- With the addition of TLS support binutils started to make the addend
values for resolved symbols relative to relocbase instead of sections
so detect this case and handle as appropriate, which allows using
kernel modules linked with affected versions of binutils. Actually I
think this is a bug in binutils but given that apparently nobody
complained for nearly six years and powerpc has basically the same
workaround I decided to put it in for the sparc64 kernel, too.
- Fix R_SPARC_HIX22 relocations. Apparently these are hardly ever used.

- Consistently abbreviate the names of the relocations.
- End sentences with dots.
- Fix whitespace.

Remove a hack made obsolete by the binutils 2.17 merge.

Turn off default generation of userland dot symbols on powerpc64 now that
we have a binutils that supports it. Kernel dot symbols remain on to assist
DDB.

Use sigsetjmp/siglongjmp with disabled signal mask access for
lock upgrade in rtld. There is no need to care about the mask,
which causes a lot of unneeded sigprocmask(2) calls during each
symbol lookup.

Fix grammar in comment.

Pointy hat to: kib
MFC after: 1 week

Make ldd(1) work when versioned dependency file is cannot be loaded.
Instead of aborting in locate_dependency(), propagate the error to
caller. The rtld startup function does the right thing with an error
from rtld_verify_versions(), depending on the mode of operation.

Reported by: maho
In collaboration with: kan
MFC after: 1 week

Eliminate the use of symlook_needed function in favor of DAGS.

Place elements on DAG lists in breadth-first order. This allows us to
walk pre-built list in all cases where breadth-first dependency chain
enumeration is required.

Fix dlsym on special handle obtained by dlopen(NULL, ...) to do what
comment claims it does. Take advantage of recently added symlook_global
function to iterate over main objects and global DAGs lists properly in
search of a symbol. Since rtld itself provides part of the global
namespace, search rtld_obj too.

Remove recursion from init_dag and symlook_needed functions. Use
symlook_needed for ELF filtee processing only and change lookup order
used in the function to match the order used by Solaris runtime linker
under same circumstances. While there, fix weak symbol handling in the
loop so that we return the first weak symbol definition if no strong one
was found, instead of the last one.

Reviewed by: kib
MFC after: 1 month

Remove SuperH architecture from a comment as we do not support it.
Presumably it was leaked from NetBSD together with rtld-elf mips support.

Approved by: kib (mentor)
MFC after: 3 days

When loading dso without PT_GNU_STACK phdr, only call
__pthread_map_stacks_exec() on architectures that allow executable
stacks.

Reported and tested by: marcel (ia64)

Fix get_program_var_addr() when type of the resolved symbol is functional.
Use make_function_pointer then, otherwise ia64 is broken.

Reported and tested by: marcel

Add my copyright.

Discussed with: kan

Mark rtld on PowerPC as not requiring executable stack.

Reviewed and tested by: nwhitehorn

get_program_var_addr() must prefer the strong symbol to the weak
one. Search global objects, together with main object and
dependencies, for the requested symbol.

Move the common code from symlook_default() into new helper
symlook_global(), and use it both in symlook_global() and
get_program_var_addr().

Supply lock state to get_program_var_addr().

Reviewed by: kan
Tested by: Mykola Dzham <i levsha me>

In rtld, read the initial stack access mode from AT_STACKPROT as set
by kernel, and parse PT_GNU_STACK phdr from linked and loaded dsos.

If the loaded dso requires executable stack, as specified by PF_X bit
of p_flags of PT_GNU_STACK phdr, but current stack protection does not
permit execution, the __pthread_map_stacks_exec symbol is looked up
and called. It should be implemented in libc or threading library and
change the protection mode of all thread stacks to be executable.

Provide a private interface _rtld_get_stack_prot() to export the stack
access mode as calculated by rtld.

Reviewed by: kan

Add section .note.GNU-stack for assembly files used by 386 and amd64.

Sort -mno-(mmx|3dnow|sse|sse2|sse3) options consistently throughout the
tree.

Submitted by: arundel

On amd64 and i386, tell the compiler to refrain from generating SSE,
3DNow, MMX and floating point instructions in rtld-elf.

Otherwise, _rtld_bind() (and whatever it calls) could possibly clobber
function arguments that are passed in SSE/3DNow/MMX/FP registers,
usually floating point values. This can happen, for example, when clang
generates SSE code for memset() or memcpy() calls.

One symptom of this is sshd dying early on amd64 with "PRNG not seeded",
which is ultimately caused by libcrypto.so.6 calling RAND_add() with a
double parameter. That parameter is passed via %xmm0, which gets wiped
out by an SSE memset() in _rtld_bind().

Reviewed by: kib, kan

Remove '-elf' from build flags for libexec/rtld-elf for amd64 and i386.
ELF has been the default format for almost 12 years now.

Make format string a string literal. (Discovered by clang.)

MFC After: 1 week

Handle failure from ftpd_popen in statfilecmd().

Reviewed by: attilio
MFC after: 1 week

Add support for R_PPC64_UADDR64 relocations.

expand checkuser() to support the propagation of error codes back to
the caller. Currently, checkuser() does not differentiate between the
failure to open the file and the absence of a user in the file. Check
to see if there was an error opening the file. If there are any errors,
terminate the connection. Currently, the only exception to this rule
is ENOENT, since there is nothing that says the /etc/ftpuser
and /etc/ftpchroot has to exist.

MFC after: 3 weeks

Fix an error in the ABI in rtld_bind_start(). When passing arguments to a
C function, the caller's stack frame must have room to store all of the
arguments to that function. While here, fix stack frame alignment issues.

Without this change, the compiler will save r3 and r4 into the caller's
stack frame before calling setjmp() in _rtld_bind(). These would then
overwrite arguments to the newly-bound function, causing eventual failures.

Fix an apparent cop-and-paste mistake in previous commit.

This makes dlsym(RTLD_DEFAULT) work properly again.

Implement support for ELF filters in rtld. Both normal and auxillary
filters are implemented.

Filtees are loaded on demand, unless LD_LOADFLTR environment variable
is set or -z loadfltr was specified during the linking. This forces
rtld to upgrade read-locked rtld_bind_lock to write lock when it
encounters an object with filter during symbol lookup.

Consolidate common arguments of the symbol lookup functions in the
SymLook structure. Track the state of the rtld locks in the
RtldLockState structure. Pass local RtldLockState through the rtld
symbol lookup calls to allow lock upgrades.

Reviewed by: kan
Tested by: Mykola Dzham <i levsha me>, nwhitehorn (powerpc)

Add a hook to pass debug flags to the build of rtld when doing make in
the rtld directory.

Reviewed by: kan

Add __unused

Add __unused

Add __unused. Ansi prototypes.

add __unused

If dlclose() is called recursively from a _fini() function, the inner
dlclose() call may unload the object of the outer call prematurely
because objects are unreferenced before _fini() calls.

Fix this by unreferencing objects after calling objlist_call_fini() in
dlclose(). Therefore objlist_call_fini() now calls the fini function if
the reference count of an object is 1. In addition we must restart the
list_fini traversal after every _fini() call because another dlclose()
call might have modified the reference counts.

Add an XXX comment to objlist_call_fini() about possible race with
dlopen().

PR: 133246, 149464
Reviewed by: kan, kib

Fix double ;;

Catch up with kernel using time_uptime to drive ARP timeouts.

Noticed by: jilles

Use -fPIC to build libexec/rtld-elf on sparc64, so it will also be able
to link with newer binutils, without overflowing the GOT.

Obtained from: projects/binutils-2.17

Fix typos.

PR: bin/148894
Submitted by: olgeni

In r214728, if dlopen() is called for the object that has been already
loaded as a dependency and marked -z nodlopen, object' DAG is already
initialized by load_needed_objects(). Due to this, the init_dag() call
from dlopen() does not increment refcount for the object [1].

Change init_dag() to not increment DAG refcount. Require explicit calls
to ref_dag() to increment, and assert that ref_dag() and unref_dag()
are called for root that has dag initialized. To fix the noted issue,
unconditionally call both init_dag() and ref_dag() in dlopen() for the
case when the object was already loaded, making it similar to the case
of newly loaded object.

Noted by: jh [1]
Reviewed by: jh, kan
MFC after: 6 days

Fix style.

MFC after: 6 days

If dlopen() is called for the dso that has been already loaded as a
dependency, then the dso never has its DAG initialized. Empty DAG
makes ref_dag() call in dlopen() a nop, and the dso refcount is off
by one.

Initialize the DAG on the first dlopen() call, using a boolean flag
to prevent double initialization.

From the PR (edited):
Assume we have a library liba.so, containing a function a(), and a
library libb.so, containing function b(). liba.so needs functionality
from libb.so, so liba.so links in libb.so.

An application doesn't know about the relation between these libraries,
but needs to call a() and b(). It dlopen()s liba.so and obtains a
pointer to a(), then it dlopen()s libb.so and obtains a pointer to b().

As soon as the application doesn't need a() anymore, it dlclose()s liba.so.

Expected result: the pointer to b() is still valid and can be called
Actual result: the pointer to b() has become invalid, even though the
application did not dlclose() the handle to libb.so. On calling b(), the
application crashes with a segmentation fault.

PR: misc/151861
Based on patch by: jh
Reviewed by: kan
Tested by: Arjan van Leeuwen <freebsd-maintainer opera com>
MFC after: 1 week

Add a new libc function: cfmakesane(3).

I've noticed various terminal emulators that need to obtain a sane
default termios structure use very complex `hacks'. Even though POSIX
doesn't provide any functionality for this, extend our termios API with
cfmakesane(3), which is similar to the commonly supported cfmakeraw(3),
except that it fills the termios structure with sane defaults.

Change all code in our base system to use this function, instead of
depending on <sys/ttydefaults.h> to provide TTYDEF_*.

Unbreak ia64.

With r169630 I disabled symbol versioning because it broke rtld. With
r211706 rtld got broken for ia64 & powerpc64. It was fixed for powerpc64
with r212497. In between, r211749 removed the exports table because the
version script handled the exports. But wait, symbol versioning was
disabled on ia64.

With exports controlled by the version script and symbol versioning
disabled, all symbols are exported and too many symbols bind to the
definition in rtld. Let's just say that waird things happen.

So, enable symbol versioning on ia64 and apply a work-around for the
SIGSEGV that triggered r169630 to begin with: when rtld relocates
itself, it comes across r_debug_state and for some reason can't find the
definition. This causes a failure, relocation aborts and null pointers
galore. The work-around is to ignore the missing definition when rtld
is relocating itself and keep going.

Maybe with the next binutils this will all go away. Maybe not, in
which case I still need to figure out why r_debug_state cannot be found.

BTW: r_debug_state is in the symbol map -- I don't think any other rtld
symbols that rtld references are in the symbol map...

mdoc: drop even more redundant .Pp calls

No change in rendered output, less mandoc lint warnings.

Tool provided by: Nobuyuki Koganemaru n-kogane at syd.odn.ne.jp

mdoc: drop redundant .Pp and .LP calls

They have no effect when coming in pairs, or before .Bl/.Bd

Use a defined FreeBSD version.

MFC after: 3 days

Fix two subtle problems in PPC32 RTLD. The first is a concurrency issue
where long PLT calls in multi-threaded environments could end up with
incorrect jmptab values. The second is that, after the addition of extended
PLT support, I forgot to update the PLT icache synchronization code to cover
the extended PLT instead of just the basic PLT.

MFC after: 10 days

Remove the duplicate logging of failed read requests, whose error message
also was inappropriate as it triggered for every EACCESS and ENOTFOUND, not
just the case the -n option is intended to deal with and thus really spammed
us with ~20 messages in the default configuration when booting a diskless
FreeBSD client, introduced with r207608 again.

MFC after: 1 week

Make WARNS=6 clean.

MFC after: 1 week

Try to adhere to style.Makefile(5).

MFC after: 3 days

Move the pfrom initialization from before the setjmp to after the
setjmp to avoid warnings on the powerpc build...

Remove an explicit assignment of the CFLAGS variable intended for
debugging purposes only.

Check for undefined weak symbols during PLT binding on powerpc64, and do
not attempt to copy NULL function descriptors. This fixes LD_BIND_NOW on
powerpc64 after r211706.

Reviewed by: kib

Fix incorrect usage of 'assure' and 'insure'.

Approved by: rrs (mentor)

Make RTLD work on powerpc64 again. If there is a sub-directory named
MACHINE_ARCH, use that specific one, otherwise use MACHINE_CPUARCH.

Reviewed by: imp

Remove exports table. Export control by the version script is enough.

Reviewed by: kan
MFC after: 3 weeks

MFtbemd:

Prefer MACHNE_CPUARCH to MACHINE_ARCH in most contexts where you want
to test of all the CPUs of a given family conform.

On shared object unload, in __cxa_finalize, call and clear all installed
atexit and __cxa_atexit handlers that are either installed by unloaded
dso, or points to the functions provided by the dso.

Use _rtld_addr_phdr to locate segment information from the address of
private variable belonging to the dso, supplied by crtstuff.c. Provide
utility function __elf_phdr_match_addr to do the match of address against
dso executable segment.

Call back into libthr from __cxa_finalize using weak
__pthread_cxa_finalize symbol to remove any atfork handler which
function points into unloaded object.

The rtld needs private __pthread_cxa_finalize symbol to not require
resolution of the weak undefined symbol at initialization time. This
cannot work, since rtld is relocated before sym_zero is set up.

Idea by: kan
Reviewed by: kan (previous version)
MFC after: 3 weeks

Introduce implementation-private rtld interface _rtld_addr_phdr, which
fills struct dl_phdr_info for the shared object that contains the
specified address, if any.

Idea and reviewed by: kan
MFC after: 3 weeks

Provide the starting image with the pointer to ELF aux vector. It is
written into the __elf_aux_vector variable, if the symbol is present.

Idea from: kan
Tested by: marius (sparc64)
MFC after: 1 month

Use the newly provided aux vectors to get pagesize and osreldate information.
Use local version of getpagesize(), rtld_getpagesize() in private allocator.
Override the __getosreldate() previously fetched from libc_pic.a with
local version that uses aux value if present. Note that __getosreldate()
is used by rtld indirectly, by mmap(2) libc wrapper.

To be able to utilize aux, split digest_dynamic() for use by init_rtld()
into two parts, where the first one does not call malloc(), and the
second part uses it. init_rtld() is able to initialize global variables
before digest_dynamic2() calls. In particular, pagesize and osreldate are
set up from the aux values.

Now, rtld avoids (two) sysctl calls in startup.

Tested by: marius (sparc64)
MFC after: 1 month

Add parentheses around the argument 'x' used in the __bswapXX(x) macros. Revert
r211130 in favor of this more general fix.

This fixes a compilation error for mips 64-bit little endian build.
libexec/rtld-elf/mips/reloc.c:196: warning: right shift count >= width of type

Suggested by: stefanf, jchandra, bde

Fix compilation error for 64-bit little endian build:
libexec/rtld-elf/mips/reloc.c:196: warning: right shift count >= width of type

When the expression '(r_info) >> 32' was passed to bswap32() it was promptly
changed to '(uint32_t)(r_info) >> 32' which is not what we intended.

Remove unneeded use of struct timezone.

We can safely call gettimeofday() without passing a struct timezone.
We're not using it at all.

Fix typos and spelling mistakes.

Fix typo.

64 bit support for MIPS rtld.

- Handle the case where pltgot[1] is 64 bit.
- use 'ifdef __mips_n64' instead of 'ELFSIZE == 64' to detect 64 bit compile.

RTLD support for powerpc64. A few small modifications to the Makefile
and symbol map are required to support various consequences of the dot
symbol scheme:

- Symbols beginning with a dot are reserved, so start private symbols with
an underscore.
- In order to set RTLD breakpoints, gdb must be able to locate the text
entry point, not the data section function descriptor, so add
.r_debug_state to the symbol map on powerpc64.

Obtained from: projects/ppc64

Revert r209544. It papers over a binutils bug, and is not even a reliable
fix for it.

The bug occurs when using the --as-needed flag to ld in the presence of
synthetic linker-generated symbols that reference symbols defined in
linked-to shared libraries with versioned symbols. When the only symbols
used from a library fall into this category, ld will drop the DT_NEEDED
entry for it, but retain the versioning information. This bug is best
fixed/hacked around in binutils, not in rtld.

Discussed with: kan

Ignore versioned dependencies on shared objects to which we do not link.
This fixes an error with files like this created by GNU ld under certain
circumstances.

Merge jmallett@'s n64 work into HEAD - changeset 3

Update rtld MIPS code to use assembly macros that work on o32/n64.

Changes from http://svn.freebsd.org/base/user/jmallett/octeon

Approved by: rrs(mentor), jmallett

Plug possible memory leak.

Found by: Coverity
MFC after: 2 weeks

mdoc: use literal text, not a column table to present the
configuration file snippet.

Only use the cache after the early stage of loading. This is
because calling mmap() etc. may use GOT which is not set up
yet. Use calloc() instead of mmap() in cases where this
was the case before (sparc64, powerpc, arm).

Submitted by: Dimitry Andric (dimitry andric com)
Reviewed by: kan
Approved by: ed (mentor)

Merger of the quota64 project into head.

This joint work of Dag-Erling Smørgrav and myself updates the
FFS quota system to support both traditional 32-bit and new 64-bit
quotas (for those of you who want to put 2+Tb quotas on your users).

By default quotas are not compiled into the kernel. To include them
in your kernel configuration you need to specify:

options QUOTA # Enable FFS quotas

If you are already running with the current 32-bit quotas, they
should continue to work just as they have in the past. If you
wish to convert to using 64-bit quotas, use `quotacheck -c 64';
if you wish to revert from 64-bit quotas back to 32-bit quotas,
use `quotacheck -c 32'.

There is a new library of functions to simplify the use of the
quota system, do `man quotafile' for details. If your application
is currently using the quotactl(2), it is highly recommended that
you convert your application to use the quotafile interface.
Note that existing binaries will continue to work.

Special thanks to John Kozubik of rsync.net for getting me
interested in pursuing 64-bit quota support and for funding
part of my development time on this project.

Bring in new files from edwin's tftp

Go ahead and merge the work edwin@ on tftpd into the tree. It is a
lot better than what's in the tree now. Edwin tested it at a prior
employer, but can't test it today. I've found that it works a lot
better with the various uboot versions that I've used in my embedded
work. Here's the pkg-descr from the port that describes the changes:

It all started when we got some new routers, which told me the
following when trying to upload configuration or download images
from it: The TFTP server doesn't support the blocksize option.

My curiousity was triggered, it took me some reading of RFCs and
other documentation to find out what was possible and what could
be done. Was plain TFTP very simple in its handshake, TFTP with
options was kind of messy because of its backwards capability: The
first packet returned could either be an acknowledgement of options,
or the first data packet.

Going through the source code of src/libexec/tftpd and going through
the code of src/usr.bin/tftp showed that there was a lot of duplicate
code, and the addition of options would only increase the amount
of duplicate code. After all, both the client and the server can
act as a sender and receiver.

At the end, it ended up with a nearly complete rewrite of the tftp
client and server. It has been tested against the following TFTP
clients and servers:

- Itself (yay!)
- The standard FreeBSD tftp client and server
- The Fedora Core 6 tftp client and server
- Cisco router tftp client
- Extreme Networks tftp client

It supports the following RFCs:

RFC1350 - THE TFTP PROTOCOL (REVISION 2)
RFC2347 - TFTP Option Extension
RFC2348 - TFTP Blocksize Option
RFC2349 - TFTP Timeout Interval and Transfer Size Options
RFC3617 - Uniform Resource Identifier (URI) Scheme and Applicability
Statement for the Trivial File Transfer Protocol (TFTP)

It supports the following unofficial TFTP Options as described at
http://www.compuphase.com/tftp.htm:

blksize2 - Block size restricted to powers of 2, excluding protocol headers
rollover - Block counter roll-over (roll back to zero or to one)

From the tftp program point of view the following things are changed:

- New commands: "blocksize", "blocksize2", "rollover" and "options"
- Development features: "debug" and "packetdrop"

If you try this tftp/tftpd implementation, please let me know if
it works (or doesn't work) and against which implementaion so I can
get a list of confirmed working systems.

Author: Edwin Groothuis <edwin@FreeBSD.org>

Forgot to initialize the debug variable.

MFC after: 2 weeks

Add a debugging option (-d)
Add a -k option which fingerd(8) passes through to finger(1).

MFC after: 2 weeks

Check that gl_pathc is bigger than zero before derefencing gl_pathv.
When gl_pathc == 0, the content of gl_pathv is undefined.

PR: bin/144761
Submitted by: David BERARD <contact davidberard fr>
Obtained from: OpenBSD
MFC after: 1 week

- Remove const'ness from dlerror(3) prototype, for consistency with POSIX.

Approved by: cognet
MFC after: 1 week

Fix several typos in macros or macro misusage.

Found by: make manlint
Reviewed by: ru
Approved by: philip (mentor)

Updated rtld for n32 support.

Submitted by: jmallet@
Obtained from: NetBSD

Fixed static linkage.

Support the extended PLT format used when objects have more than 8192
PLT relocations on PPC32.

The NetBSD Foundation has granted permission to remove clauses 3 and 4.

Obtained from: NetBSD

Improve TLS variant I:
o Use obj->tlsinitsize to determine whether there's initialized data.
o If obj->tlssize > obj->tlsinitsize, then bzero uninitialized data.
o Don't exclude variant I from the work-around in free_tls_offset().

Set ut_line to "ftpd" for ftpd.

This makes it a little easier to figure out which application was
responsible for this log entry. Ideally we should add an ut_process or
something similar.

Suggested by: Vincent Poy <vincepoy gmail com>

Remove stale references to utmp(5) and its corresponding filenames.

I removed utmp and its manpage, but not other manpages referring to it.

Really disable wtmp logging when chrooting.

Also perform a small cleanup to ftpd_logwtmp(). Just use a NULL
parameter for the username to indicate a logout, instead of an empty
string.

Reported by: Alexey Shuvaev <shuvaev physik uni-wuerzburg de>

Phase out ttyslot(3).

The ttyslot() function was originally part for SUSv1, marked LEGACY in
SUSv2 and removed later on. This function only makes sense when using
utmp(5), because it was used to determine the offset of the record for
the controlling TTY. It makes little sense to keep it here, because the
new utmpx file format doesn't index based on TTY slots.

Port all apps in libexec/ from libulog to utmpx.

Port ftpd to utmpx.

Unfortunately I have to partially wreck its functionality, though. ftpd
used to keep a file descriptor to the wtmp, which allowed it to work
from within a chroot. The current utmpx implementation doesn't offer a
way to do this. Maybe we can address this in the future, if it turns out
to be a real issue.

Port comsat to utmpx.

It seems comsat stats the utmpx database each 15 seconds to see whether
it has been changed. I am changing this behaviour to look at the utmpx
database upon processing. I don't want to allow direct interference with
the database files. I also wonder whether this optimization has any
measurable performance benefit nowadays.

Remove `dead code' from rlogind.

- It shouldn't call logwtmp(). Applications like login(1) already make
sure both login and logout entries are written to the storage.
- There's no need to restore permissions on the pseudo-terminal, since
it should be garbage collected by the kernel.

Make WARNS=6 the default for libexec/.

Just like bin/ and sbin/, I think setting WARNS to the highest value
possible will make it more attractive for people to fix warnings.

- The WARNS variable is set in the Makefile in the directory of the
application itself, making it more likely that it will be removed out
of curiosity to see what happens.
- New applications will most likely build with WARNS=6 out of the box,
because the author would more likely fix the warnings during
development than lower WARNS.

Unfortunately almost all apps in libexec require a lowered value of
WARNS.

Fix several warnings.

- Add __unused keywords.
- Don't shadow a global variable called cr.
- Make the global cr variable const.

ANSIfy ldconfig and the aout bits it still uses from rtld-aout.

(Why is aout support still there?)

Make rpc.ruserd work with utmpx/libulog.

Because strings are now null-terminated, I've decided to just use an
array of utmpx structures, instead of the separated strings. This means
we just copy the entire utmpx structure and point to the strings within
the structures directly.

Perform cleanups to rpc.rusersd:

- Perform whitespace fixes. Use tabs instead of 8 spaces.
- Make it build at WARNS=6.

Modify the sources to make WARNS=6 work.

Unbreak the build.

I increased the WARNS, but it looks like it breaks certain architectures
with more strict alignment requirements (mips, sparc64, ia64).

Pointy hat to: me

Let talkd use utmpx instead of utmp.

Because strings are null terminated now, there is no need to copy
ut_line into a separate buffer first. Also enable WARNS.

Don't use UT_NAMESIZE here to determine the maximum username length.

Repair breakage to last-minute API change.

I changed ulog_log{in,out} to return a void, but forgot to change
ulog-helper as well.

Reported by: stefanf

Add a new library: libulog.

One of the things I really want to do, is to get rid of the limitations
of our current utmp(5) mechanism:

- It only allows 8 byte TTY device names.
- The hostname only allows 16 bytes of storage.

I'm not a big fan of <utmpx.h>, but I think we should at least try to
add parts of it. Unfortunately we cannot implement <utmpx.h>, because we
miss various fields, such as ut_id, ut_pid, etc. The API provided by
libulog shares some similarities with <utmpx.h>, so it shouldn't be too
hard to port these applications eventually. In most simple cases, it
should just be a matter of removing the ulog_ prefix everywhere.

As a bonus, it also implements a function called ulog_login_pseudo(),
which allows unprivileged applications to write log entries, provided
they have a valid file descriptor to a pseudo-terminal master device.

libulog will allow a smoother transition to a new file format by adding
a library interface to deal with utmp/wtmp/lastlog files. I initially
thought about adding the functionality to libutil, but because I'm not
planning on keeping this library around forever, we'd better keep it
separated.

Next items on the todo list:

1. Port applications in the base system (and ports) to libulog, instead
of letting them use <utmp.h>.
2. Remove <utmp.h>, implement <utmpx.h> and reimplement this library on
top.
3. Port as many applications as possible back to <utmpx.h>.

Fix local root vulnerability.

Security: Advisory will be coming soon.
X-MFC-After: 30 seconds

Allow to load not-openable dso when tracing. This fixes ldd on such dso or
dso linked to non-openable object.
Remove '\n' at the end of error message.
End comments with dot.

MFC after: 3 weeks (together with r199829)

Implement rtld part of the support for -z nodlopen (see ld(1)).

Reviewed by: kan
MFC after: 3 weeks

Flag controlling origin expansion in DT_FLAGS is DF_ORIGIN, not DF_1_ORIGIN.

Reviewed by: kan
MFC after: 3 days

Fix white space in rtld runtime error printf.

MFC after: 3 days

Calculate relocation base for the main object, and apply the relocation
adjustment for all virtual addresses encoded into the ELF structures of
it. PIE binary could and should be loaded at non-zero mapbase.

For sym_zero pseudosymbol used as a return value from find_symdef()
for undefined weak symbols, st_value also should be adjusted, since
_rtld_bind corrects symbol values by relocbase.

Discussed with: bz
Reviewed by: kan
Tested by: bz (i386, amd64), bsam (linux)
MFC after: some time

In rtld's map_object(), use pread(..., 0) rather than read() to read the
ELF header from the front of the file. As all other I/O on the binary
is done using mmap(), this avoids the need for seek privileges on the
file descriptor during run-time linking.

MFC after: 1 month
Sponsored by: Google

printerr_reply() has never been used for as long as we've had this code in
our tree (13+ years). This is an excellent argument for aggressive use
of "static".

Other minor style issues.

Slight style cleanup.

Do the first step in removing lukemftpd from the base system. Disconnect
it from the build.

If you are using the FTP daemon, please consider using the port ftp/tnftpd
which is the same FTP server, but newer and might have more/better
functionality.

This results in us providing only one ftp daemon by default.

Reviewed by: bz
Approved by: imp (mentor, implicit)
MFC after: 3 days
Silence from: obrien

Implement RTLD_NOLOAD flag for dlopen(3).

Requested and tested by: jkim
Reviewed by: kan
Approved by: re (kensmith)

Only perform .bss mapping and cleaning operations when segment file size
is not equal to its memory size.

This eliminates unneeded clearing of the text segment that often
happens due to text end not being page-aligned.

For instance,
$ readelf -l /lib/libedit.so.6
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000000 0x00000000 0x00000000 0x139e1 0x139e1 R E 0x1000
LOAD 0x014000 0x00014000 0x00014000 0x00f04 0x00f14 RW 0x1000
DYNAMIC 0x014cc4 0x00014cc4 0x00014cc4 0x000d0 0x000d0 RW 0x4
$ procstat -v $$ (for /bin/sh)
68585 0x28097000 0x280aa000 r-x 6 0 21 14 CN vn /lib/libedit.so.6
68585 0x280aa000 0x280ab000 r-x 1 0 1 0 CN vn /lib/libedit.so.6 <==
68585 0x280ab000 0x280ac000 rwx 1 0 1 0 CN vn /lib/libedit.so.6
Note the splitted map entry marked by '<=='.

Reviewed by: kan
Approved by: re (kensmith)
MFC after: 1 month

Second attempt at eliminating .text relocations in shared libraries
compiled with stack protector.

Use libssp_nonshared library to pull __stack_chk_fail_local symbol into
each library that needs it instead of pulling it from libc. GCC
generates local calls to this function which result in absolute
relocations put into position-independent code segment, making dynamic
loader do extra work every time given shared library is being relocated
and making affected text pages non-shareable.

Reviewed by: kib
Approved by: re (kib)

Back out previous revision until better tested fix is ready.

Approved by: re (impliciti, by approving previos check-in)

Eliminate .text relocations in shared libraries compiled with stack protector.

Use libssp_nonshared library to pull __stack_chk_fail_local symbol into
each library that needs it instead of pulling it from libc. GCC generates
local calls to this function which result in absolute relocations put into
position-independent code segment, making dynamic loader do extra work everys
time given shared library is being relocated and making affected text pages
non-shareable.

Reviewed by: kib
Approved by: re (kensmith)

Fix a typo in the same comment, one line below.

Submitted by: bf1783 googlemail com

Fix typo in comment.

Submitted by: Christoph Mallon

Allow order of initialization of loaded shared objects to be
altered through their .init code. This might happen if init
vector calls dlopen on its own and that dlopen causes some not
yet initialized object to be initialized earlier as part of that
dlopened DAG.

Do not reset module reference counts to zero on final fini vector
run when process is exiting. Just add an additional parameter to
force fini vector invocation regardless of current reference count
value if object was not destructed yet. This allows dlclose called
from fini vector to proceed normally instead of failing with handle
validation error.

Reviewed by: kib
Reported by: venki kaps

FreeBSD returns main object handle from dlopen(NULL, ...) calls.
dlsym seaches using this handle are expected to look for symbol
definitions in all objects loaded at the program start time along
with all objects currently in RTLD_GLOBAL scope.

Discussed with: kib
Reported by: Maho NAKATA
MFC after: 2 weeks

Increase the size of the static TLS area slightly (required for the NVidia's
OpenGL driver on amd64).

Per the man page:
The makekey utility has been deprecated and will be removed in a future
release of FreeBSD.

Actually removing it was approved back on 10/29/2007 by re (kensmith) but
I dropped the ball on actually removing it. It's doubtful that it's become
more relevant/useful in the intervening time.

Remove empty directories from the HEAD.

Discussed with: developers, imp

Prefer <sys/param.h> to <machine/param.h> for the definition of
CACHE_LINE_SIZE.

Submitted by: bde
MFC after: 2 weeks

Explicitly include machine/param.h for CACHE_LINE_SIZE.

MFC after: 2 weeks

Now that the kernel defines CACHE_LINE_SIZE in machine/param.h, use
that definition in the custom locking code for the run-time linker
rather than local definitions.

Pointed out by: tinderbox
MFC after: 2 weeks

Currently, when mapping an object, rtld reserves the whole address space
for the mapping by the object' file with the protection and mode of
the first loadable segment over the whole region. Then, it maps other
segments at the appropriate addresses inside the region.

On amd64, due to default alignment of the segments being 1Gb, the
subsequent segment mappings leave the holes in the region, that usually
contain mapping of the object' file past eof. Such mappings prevent
wiring of the address space, because the pages cannot be faulted in.

Change the way the mapping of the ELF objects is constructed, by first
mapping PROT_NONE anonymous memory over the whole range, and then
mapping the segments of the object over it. Take advantage of this new
order and allocate .bss by changing the protection of the range instead
of remapping.

Note that we cannot simply keep the holes between segments, because
other mappings may be made there. Among other issues, when the dso is
unloaded, rtld unmaps the whole region, deleting unrelated mappings.

The kernel ELF image activator does put the holes between segments, but
this is not critical for now because kernel loads only executable image
and interpreter, both cannot be unloaded. This will be fixed later, if
needed.

Reported and tested by: Hans Ottevanger <fbsdhackers beasties demon nl>
Suggested and reviewed by: kan, alc

Update comment to the reality, rtld supports any number of loadable segments.
Fix spacing.

Reviewed by: kan

Move variable externs into extern.h so they are checked against the definitions.

Allow the NULL, RTLD_SELF and RTLD_NEXT handles to work with dlfunc(3).
dlfunc() called dlsym() to do the work, and dlsym() determines the dso
that originating the call by the return address. Due to this, dlfunc()
operated as if the caller is always the libc.

To fix this, move the dlfunc() to rtld, where it can call the internal
implementation of dlsym, and still correctly fetch return address.
Provide usual weak stub for the symbol from libc for static binaries.
dlfunc is put to FBSD_1.0 symver namespace in the ld.so export to
override dlfunc@FBSD_1.0 weak symbol, exported by libc.

Reported, analyzed and tested by: Tijl Coosemans <tijl ulyssis org>
PR: standards/133339
Reviewed by: kan

Document RTLD_NODELETE, -z nodelete and -z origin support.

Use RTF_LLDATA.

Implement support for RTLD_NODELETE flag for dlopen() and -z nodelete
static linker option. Do it by incrementing reference count on the loaded
object and its dependencies.

Reviewed by: davidxu, kan

Do not dereference NULL pointer. refobj is NULL for the objects that are
preloaded.

Reported and tested by: ed

Support for a new environment variable, LD_ELF_HINTS_PATH for overriding
the rtld hints file. This environment variable would be unset if the
process is considered as tainted with setuid/setgid. This feature gives
a convenient way of using a custom set of shared library that is not
located in the default location and switch back.

Feature requested by: iXsystems
Original patch by: John Hixson
MFC after: 2 weeks

Implement the dynamic string token substitution in the rpath and
soneeded pathes. The $ORIGIN, $OSNAME, $OSREL and $PLATFORM tokens
are supported. Enabling the substitution requires DF_ORIGIN flag in
DT_FLAGS or DF_1_ORIGIN if DF_FLAGS_1, that may be set with -z origin
gnu ld flag. Translation is unconditionally disabled for setuid/setgid
processes.

The $ORIGIN translation relies on the AT_EXECPATH auxinfo supplied
by kernel.

Requested by: maho
Tested by: maho, pho
Reviewed by: kan

Fix build when WITH_SSP is set explicitly.

Submitted by: Jeremie Le Hen

o Fix typo: indentical -> identical.

PR: docs/131149
Submitted by: Patrick Oonk
MFC after: 1 week

Fix handling of pts(4) device names in comsat(8). Also catch fork() errors.

Pseudo-terminals allocated with posix_openpt(2) will have more slashes
in their path names than comsat(8) allows, so allow slashes when the
character device name starts with "pts/".

This patch is loosely based on NetBSD's changes, revision 1.33. Because
it also included the changes to fork(), I imported them here as well.
Maybe we could import even more fixes from the other BSD's?

Original commit message from the NetBSD folks:

PR/30170: Markus W Kilbinger: src/libexec/comsat complains
about: '/' in "/dev/pts/1"

Reported by: Robert Huff <roberthuff rcn com>

Prevent cross-site forgery attacks on ftpd(8) due to splitting
long commands into multiple requests. [08:12]

Avoid calling uninitialized function pointers in protocol switch
code. [08:13]

Merry Christmas everybody...

Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-08:12.ftpd, FreeBSD-SA-08:13.protosw

This main goals of this project are:
1. separating L2 tables (ARP, NDP) from the L3 routing tables
2. removing as much locking dependencies among these layers as
possible to allow for some parallelism in the search operations
3. simplify the logic in the routing code,

The most notable end result is the obsolescent of the route
cloning (RTF_CLONING) concept, which translated into code reduction
in both IPv4 ARP and IPv6 NDP related modules, and size reduction in
struct rtentry{}. The change in design obsoletes the semantics of
RTF_CLONING, RTF_WASCLONE and RTF_LLINFO routing flags. The userland
applications such as "arp" and "ndp" have been modified to reflect
those changes. The output from "netstat -r" shows only the routing
entries.

Quite a few developers have contributed to this project in the
past: Glebius Smirnoff, Luigi Rizzo, Alessandro Cerri, and
Andre Oppermann. And most recently:

- Kip Macy revised the locking code completely, thus completing
the last piece of the puzzle, Kip has also been conducting
active functional testing
- Sam Leffler has helped me improving/refactoring the code, and
provided valuable reviews
- Julian Elischer setup the perforce tree for me and has helped
me maintaining that branch before the svn conversion

Provide custom simple allocator for rtld locks in libthr. The allocator
does not use any external symbols, thus avoiding possible recursion into
rtld to resolve symbols, when called.

Reviewed by: kan, davidxu
Tested by: rink
MFC after: 1 month

Add two rtld exported symbols, _rtld_atfork_pre and _rtld_atfork_post.
Threading library calls _pre before the fork, allowing the rtld to
lock itself to ensure that other threads of the process are out of
dynamic linker. _post releases the locks.

This allows the rtld to have consistent state in the child. Although
child may legitimately call only async-safe functions, the call may
need plt relocation resolution, and this requires working rtld.

Reported and debugging help by: rink
Reviewed by: kan, davidxu
MFC after: 1 month (anyway, not before 7.1 is out)

Convert telnetd(8) to use posix_openpt(2).

Some time ago I got some reports MPSAFE TTY broke telnetd(8). Even
though it turned out to be a different problem within the TTY code, I
spotted a small issue with telnetd(8). Instead of allocating PTY's using
openpty(3) or posix_openpt(2), it used its own PTY allocation routine.
This means that telnetd(8) still uses /dev/ptyXX-style devices.

I've also increased the size of line[]. Even though 16 should be enough,
we already use 13 bytes ("/dev/pts/999", including '\0'). 32 bytes gives
us a little more freedom.

Also enable -DSTREAMSPTY. Otherwise telnetd(8) strips the PTY's pathname
to the latest slash instead of just removing "/dev/" (e.g. /dev/pts/0 ->
0, instead of pts/0).

Reviewed by: rink

Whitespace and style fixes, build at WARNS level 6.

MFC after: 3 weeks

This code has no copyright. It is fairly obvious to me that we're a
derivitive of NetBSD's mips_reloc.c, so pull in the copyright notice
from there.

Also, a minor tweak to load/store pointers. Other changes from NetBSD
likely would be useful too...

Obtained from: NetBSD

MFp4: Fix a bug in the mips relocation code that prevents shared images
from working.

From p4 filelog of the upstream file in p4

//depot/projects/mips2-jnpr/src/libexec/rtld-elf/mips/reloc.c
... #6 change 140737 edit on 2008/04/27 by gonzo@gonzo_jeeves (text+ko)

o Looks like handler for R_MIPS_REL32 brought by CS 137942
is broken for tradmips. Code from NetBSD's
libexec/ld.elf_so/arch/mips/mips_reloc.c works just fine.

... #3 change 137942 edit on 2008/03/17 by rrs@rrs-mips2-jnpr (text+ko)

Any relocation symbol lookup if its 0. It looks like
this is the way the compiler indicates you need to
look in another shared library. When we hit these
as we relocate a object we will do the symbol
lookups and setup the relocation table with the
right value.

Submitted by: rrs@, gonzo@

Allow strong symbols to override weak ones for lookups done through
dlsym with RTLD_NEXT/RTLD_SELF handles.

Allow symbols from ld-elf.so to be located this way too.

Based on report and original patch from sobomax@.

add new build knobs and jigger some existing controls to improve
control over the result of buildworld and installworld; this especially
helps packaging systems such as nanobsd

Reviewed by: various (posted to arch)
MFC after: 1 month

Allow multiple locks to be acquired by detecting corresponding
bit flag, otherwise if a thread acquired a lock, another thread
or the current thread itself can no longer acquire another lock
because thread_mask_set() return whole flag word, this results
bit leaking in the word and misbehavior in later locking and
unlocking.

Make sure internal rtld malloc routines are not called from unlocked
contexts as rtld's malloc is not thread safe and is only supposed to be
called with exclusive bind lock already held.

The originating PR submitted a patch on top of different pre-requisite
workaroud for unsafe dlopen calls, and the patch was midief slighlty to apply
to stock sources for the purpose of this commit. Running rtld malloc from
unlocked contexts is a bug on its own.

PR: 126950
Submited by: Oleg Dolgov

Remove the now unneeded pt_chown utility.

Before we had a posix_openpt() that allocated PTY's with proper
permissions in place, we used this set-uid utility to change the
ownership of PTY slave devices to the real user ID of the process. This
utility was used to implement grantpt().

In my first designs of the MPSAFE TTY layer, I replaced this by adding
an ioctl() called TIOCGRANTPT, which was used to change the ownership.
I left the pt_chown utility, because older C libraries needed it to work
properly.

After some discussions back in June I changed the PTY code to set
permissions properly upon creation. Fortunately the previous grantpt()
implementation changed permissions by hand when pt_chown is not
installed, which always succeeds. This means grantpt() still works
properly, even though the set-uid utility is missing.

I've done tests with FreeBSD 5.2.1, FreeBSD 6.3 and FreeBSD 7.0 jails.
All of them still work if I remove pt_chown.

Reviewed by: philip (ex-mentor)

Mark functions as __dead2 in order to help the LLVM static checker
understand which code paths aren't possible.

This commit eliminates 117 false positive bug reports of the form
"allocate memory; error out if pointer is NULL; use pointer".

Enable GCC stack protection (aka Propolice) for userland:
- It is opt-out for now so as to give it maximum testing, but it may be
turned opt-in for stable branches depending on the consensus. You
can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
It is harmless to steal the knob as SSP symbols have been provided
by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
(sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
libc will be automatically downgraded to -fstack-protector because it
breaks rtld otherwise.
- This option is unavailable on ia64.

Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.

Submitted by: Jeremie Le Hen <jeremie@le-hen.org>

Use sysctl to fetch stats from the kernel instead of reading variables
directly via libkvm.

PR: kern/122875, bin/123014
Tested by: Danny Braniss danny cs.huji.ac.il
MFC after: 1 week

Make the meaning of the %A format specifier, as passed to
LD_TRACE_LOADED_OBJECTS_FMT[12], more obvious for users like me.

Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.

Fix the problem with the C++ exception handling for the multithreaded
programs.

From the PR description:
The gcc runtime's _Unwind_Find_FDE function, invoked during exception
handling's stack unwinding, is not safe to execute from within multiple
threads. FreeBSD' s dl_iterate_phdr() however permits multiple threads
to pass through it though. The result is surprisingly reliable infinite
looping of one or more threads if they just happen to be unwinding at
the same time.

Introduce the new lock that is write locked around the dl_iterate_pdr,
thus providing required exclusion for the stack unwinders.

PR: threads/123062
Submitted by: Andy Newman <an at atrn org>
Reviewed by: kan
MFC after: 2 weeks

MFp4: Add mips support for dynamic linking.

This code came from the merged mips2 and Juniper mips repositories.
Warner Losh, Randall Seager, Oleksandr Tymoshenko and Olivier Houchard
worked to merge, debug and integrate this code. This code may also
contain code derived from NetBSD.

Fix some "in in" typos in comments.

PR: 121490
Submitted by: Anatoly Borodin <anatoly.borodin@gmail.com>
Approved by: rwatson (mentor), jkoshy
MFC after: 3 days

For un-prototyped static inline functions declared in pthread_md.h on
sparc64, use ANSI function headers and specifically indicate the lack of
arguments with 'void'. Otherwise, warnings are generated at WARNS=3 for
libkse, leading to a compile failure with -Werror.

Add "with" to make the line go smoother.

Add the -W options, which acts the same as -w but will generate
unique names based on the submitted filename, a strftime(3) format
string and a two digit sequence number.

By default the strftime(3) format string is %Y%m%d (YYYYMMDD), but
this can be changed by the -F option.

PR: bin/106049 (based on patch in that PR)
Approved by: grog@ (mentor)

Include an extra header to get a function prototype.

Add a hackish knob to skip rtld, NO_RTLD. In conjunction with
src/Makefile.inc1 rev. 1.590, it can allow installing a world
cross-built for a different arch over the live system. The procedure
is more or less as follows:

cp -R /rescue /rescue.old
make installkernel TARGET_ARCH=foo
make -DNO_RTLD installworld TARGET_ARCH=foo
^^^^^^^^^
PATH=/rescue.old
chflags noschg /libexec/ld-elf.so.1
cp /usr/obj/foo/usr/src/libexec/rtld/ld-elf.so.1 /libexec
chflags schg /libexec/ld-elf.so.1
<ditto for ld-elf32.so.1 if installing for amd64>
reboot

- Fix the handling of R_SPARC_OLO10, which is a bit of a special case
in the way we implement handling of relocations.
As for the kernel part this fixes the loading of lots of modules,
which failed to load due to unresolvable symbols when built after
the GCC 4.2.0 import. This wasn't due to a change in GCC itself
though but one of several changes in configuration done along the
import. Specfically, HAVE_AS_REGISTER_PSEUDO_OP, which causes GCC
to denote global registers used for scratch purposes and in turn
GAS uses R_SPARC_OLO10 relocations for, is now defined.
While at it replace some more ELF_R_TYPE which should have been
ELF64_R_TYPE_ID but didn't cause problems so far.
- Sync a sanity check between kernel and rtld(1) and change it to be
maintenance free regarding the type used for the lookup table.
- Sprinkle const on lookup tables.
- Use __FBSDID.

Reported and tested by: yongari
MFC after: 5 days

Fixed static linkage (build with -DNO_SHARED).

Approved by: re (kensmith)

Stop mentioning /usr/X11R6.

Approved by: re (hrs)

Unbreak the dynamic linker by not creating a cache for rtld-elf
itself. It needs mmap(2), which now needs getosreldate(3) and
which in turn uses a global variable to cache the result. This
cannot be done before linking is done.

See also: ../sparc64/reloc.c:1.15
Approved by: re (kensmith)

Cache does not serve any purpose when rtld is relocating itself, do
not bother allocating one.

Submitted by: kan
Approved by: re (bmah)

Add r_debug_state to the list of symbols exported from rtld. GDB needs to
be able to find it in order to trap shared library events from rtld.

Approved by: re (rwatson)

Significantly reduce the memory leak as noted in BUGS section for
setenv(3) by tracking the size of the memory allocated instead of using
strlen() on the current value.

Convert all calls to POSIX from historic BSD API:
- unsetenv returns an int.
- putenv takes a char * instead of const char *.
- putenv no longer makes a copy of the input string.
- errno is set appropriately for POSIX. Exceptions involve bad environ
variable and internal initialization code. These both set errno to
EFAULT.

Several patches to base utilities to handle the POSIX changes from
Andrey Chernov's previous commit. A few I re-wrote to use setenv()
instead of putenv().

New regression module for tools/regression/environ to test these
functions. It also can be used to test the performance.

Bump __FreeBSD_version to 700050 due to API change.

PR: kern/99826
Approved by: wes
Approved by: re (kensmith)

Link pf 4.1 to the build:
- move ftp-proxy from libexec to usr.sbin
- add tftp-proxy
- new altq mtag link

Approved by: re (kensmith)

Note PAM support in atrun(8).
Sort FILES section while there.
Touch document date.

Add PAM support to atrun(8).

Actually use new features of perr() and perrx().

Catch up with perr() becoming variadic.

Make perr() variadic and add perrx() to use in cases where
errno is irrelevant. Some code duplication can be reduced
if perr() is variadic and perrx() is available.

Use a single setusercontext(3) instead of a bunch of basic syscalls.
Besides aesthetic benefits, that makes at(1) jobs subject to such
login.conf(5) settings as resource limits.

Spotted another copy of the loony error message.

Fix an error message that was beside the point.

Fix a typical off-by-one error that can result in an unterminated string:

strncpy(dst, src, sizeof(dst));

by substituting the safer strlcpy() for strncpy().

X-Security: none (the source string isn't user-supplied)

Correct a typo.

PR: 106049
Submitted by: edwin (as part of a larger patch)

Update the man page to reflect that certain variables will be unset in
the case that the program is set-user-ID or set-group-ID. Add missing
annotations for LIBMAP and LIBMAP_DISABLE.

In the event a process is tainted (setuid/setgid binaries), un-set any
potentially dangerous environment variables all together. It should be
noted that the run-time linker will not honnor these environment variables
if the process is tainted currently. However, once a child of the tainted
process calls setuid(2), it's status as being tainted (as defined by
issetugid(2)) will be removed. This could be problematic because
subsequent activations of the run-time linker could honnor these
dangerous variables.

This is more of an anti foot-shot mechanism, there is nothing I am
aware of in base that does this, however there may be third party
utilities which do, and there is no real negative impact of clearing
these environment variables.

Discussed on: secteam
Reviewed by: cperciva
PR: kern/109836
MFC after: 2 weeks

Don't enable symbol versioning on ia64 for now. It causes
symbol lookup failures that later result in null-pointer
dereferences. This needs looking into, but since we're
close to release it's possible that it's not resolved before
that time.

We don't need --export-dynamic for ld-elf.so.1, because it's a
shared object.

Enable symbol versioning by default. Use WITHOUT_SYMVER to disable it.
Warning, after symbol versioning is enabled, going back is not easy
(use WITHOUT_SYMVER at your own risk).

Change the default thread library to libthr.

There most likely still needs to be a version bump for at least the
thread libraries. If necessary, this will happen later.

Remove %m formatter, it's ifdef 0'ed in the code from the very beginning

MFC after: 1 week

Expand documentation for LD_TRACE_LOADED_OBJECTS_FMT? variables

PR: docs/66265 (inspired by)
Submitted by: Michel Lavondes <fox@vader.aacc.cc.md.us>
MFC after: 1 week

Fix a TLS memory leak.

PR: threads/112297
MFC: 1 week

Back out all POSIXified *env() changes.

Not because I admit they are technically wrong and not because of bug
reports (I receive nothing). But because I surprisingly meets so
strong opposition and resistance so lost any desire to continue that.

Anyone who interested in POSIX can dig out what changes and how
through cvs diffs.

Catch up with the private namespace change (s/FBSDprivate/FBSDprivate_1.0).

Prepare for upcoming POSIXed putenv() rewrite:
don't allow putenv() arg be on the stack, replace putenv() with setenv()

Retire rtld-specific Versions.def. Symbols exported by rtld are supposed
to override weak symbols exported by libc, so by definition these two
are using the same symbol version names.

Reflect the reality by referring to libc's Versions.def directly.

Give the private version namespace a number to match libc.

Use C comments since we now preprocess these files with CPP.

Remove references to S/Key and list OPIE.

Reword the description of the UTF8 option (-8) so I can swear
to myself that I understand it.

Bump document date.

Add support for RFC 2389 (FEAT) and RFC 2640 (UTF8) to ftpd(8).

The support for RFC 2640 (UTF8) is optional and rudimentary.
The server just advertises its capability to handle UTF-8 file
names and relies on its own 8-bit cleanness, as well as on
the backward compatibility of UTF-8 with ASCII. So uploaded
files will have UTF-8 names, but the initial server contents
should be prepared in UTF-8 by hand, no on-the-fly conversion
of file names will be done.

PR: bin/111714
Submitted by: Zhang Weiwu <see email in the PR>
MFC after: 1 week

Bring rtld exports in line with corresponding symbols exported from
libc.

Disable SYMVER_DEFAULT n rtld until its implications are understood
better.

Remove reference to FBSDprivate version. We do not use it in this
module yet.

Catch up on rtld's special status. Since it does not appear on
main object list, its versioning information needs to be examined
separately.

This hopefully fixes problems that people running with SYMVER_ENABLED
are experiencing.

Prepare rtld for symbol versioning. Disable it by default for now.

Implement dl_iterate_phdr function.
Convert boolean flags in internal Obj_Entry structure into bitfields.
Properly check for loaded segment alignment in map_object.

Use u_int for variable manipulated by atomic ops to match atomic
ops function prototypes.

Let automatic TCP send buffer sizing do its job for ftpd(8): stop
setting the SO_SNDBUF socket option. Using a hard-coded value for
it was a poor idea anyway in the face of diverse network conditions.

Document LD_UTRACE.

MFC after: 3 days

Add various utrace's for use with ktrace to the ELF runtime linker. To
activate the traces, set the LD_UTRACE (or LD_32_UTRACE) environment
variable. This also includes code in kdump(8) to parse the traces.

Reviewed by: kan, jdp
MFC after: 2 weeks

Fix TLS on sparc64 for statically and dynamically linked binaries
Approved by: rwatson (mentor)
Reviewed by: jmg and marcel

Clean up white spaces and fix style(9).

Fix the buggy rev. 1.117. dagmembers are only initialized for dlopen'ed
dso that are actually loading. If dso a.so depends on b.so, then dlsym
with handle from dlopen("b.so") will fail unconditionally.

Correct implementation shall use the Obj_Entry.needed list to walk
dependencies DAG.

Test provided by: jkim
Tested (prev. version) by: jkim, Nicolas Blais <nb_root at videotron ca>, h.blanke at chello nl
Pointy hat to: kib
Approved by: kan (mentor)

Markup fixes.

When looking up the symbol by dlsym, look it not only in the object
given as dso handle, but also in the implicit dependencies of that dso.

Also, const-ify the read-only parameter objlist of symlook_list.

Reported by: "Simon 'corecode' Schubert" <corecode at fs ei tum de>
Approved by: kan (mentor)
X-MFC-After: 6.2

Fix the variant I allocation for KSE: Allow a larger TCB and assume
that the documented TCB is at the tail of the extended TCB. In other
words, the base of the TCB has a negative offset from the TLS.

o Fix the static TLS relocation. We were subtracting the size of
the TCB.
o Use NULL for null pointer argument.
o Replace magic 8 with TLS_TCB_SIZE.

Use NULL for null-pointer argument.

Replace magic 16 with TLS_TCB_SIZE.

Not needed any more, vendor sources have PAM support.

Catch up with the import of ftpd.c rev 1.1.1.6.

FreeBSD doesn't have the simple pidfile(3), so craft it using FreeBSD's
primitives.

Prevent dead code elimination for the TP assignmient by using inline
assembly.

1. Attempt to take one bullet out of the foot-shooting gun by silently
ignoring errors when sourcing rc.conf* files. The most common error
occurs when users put a command of some sort into those files.
(ifconfig is a popular choice)

2. Make the file rotation logic simpler by starting one down from
the "top" of the list, rather than at the top.

3. Try to make file rotation more secure by calling unlink(1) on all
new file names before rotating an old file to the new name, rather than
merely calling 'rm -f' on any files that exceed the number of files
to save.

Remove alpha left-overs.

- Improve and extend mark-up.
- Don't use full path in .Nm (we just don't do that).
- Correct some frivolous and poorly rendering language,
such as using possessive case for .Nm or .Fl .
- Use the same capitalization for "user ID" as in setuid(2) and getuid(2).
- Bring SEE ALSO in accord with the text.

MFC after: 5 days

In symlook_obj(): fix _rtld_error output.

MFC After: 2 weeks

inetd and telnetd are not included in the standard release
crunched floppies, but they can be included as options in
src/release/picobsd (omitted by default though.) Therefore
preserve the RELEASE_CRUNCH knob in their Makefiles, but
tell its real purpose in a comment.

Stop enforcing dependencies between MK_* options at Makefile level.
All the dependencies are satisfied now in <bsd.own.mk>.

telnetd(8) doesn't really go to the crunched floppies,
so its Makefile needn't test for RELEASE_CRUNCH.

Suggested by: ru

The lukemftpd code depends on INET6. Therefore MK_INET6_SUPPORT
should be respected.

Respect MK_INET6_SUPPORT.
Apply style.Makefile(5).

Cook CFLAGS by the modern recipe:
- use WARNS;
- respect MK_INET6_SUPPORT.

Fix compilation of ftpcmd.y without -DINET6.
Respect MK_INET6_SUPPORT in Makefile.

Requested by: Attila Nagy <bra at fsn dot hu>
MFC after: 1 week

*thwack*! all the world's not i386.

Pointy hat to: des

Don't use dbg if it isn't defined (such as when this file is used by
code outside of rtld-elf)

Use C99's varadic macro syntax instead of gcc's.

Er, forgot to clear tls space to zero for Variant II.

Allocate space for thread pointer, this allows thread library to access
its pointer from begin, and simplifies _get_curthread() in libthr.

- Document LD_32_* environment variables
- Mention 32-bit files in FILES section

MFC after: 1 week

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

- Reduce needless DNS query by lookup only appropriate address
family. [1]
- Specify appropriate hints to getaddrinfo(3). [1]
- Obtain address family from peername in inet mode.

Submitted by: Rostislav Krasny <rosti.bsd__at__gmail.com> [1]
Tested by: yar, Rostislav Krasny <rosti.bsd__at__gmail.com>
MFC after: 1 week

Fix a malloc overrun in 32-bit compat libmap lookup code.

Touch .Dd because the last commit was content-related.

s/DT_IA64_PLT_RESERVE/DT_IA_64_PLT_RESERVE/

s/R_IA64_/R_IA_64_/

In the daemon code, check for and report possible errors
from accept(2) and fork(2). Also close all unneeded fds
in the child process, namely listening sockets for all
address families and the fd initially obtained from accept(2).
(The main ftpd code operates on stdin/stdout anyway as it
has been designed for running from inetd.)

MFC after: 5 days

The daemon's child shouldn't go on with the for loop
over ctl_sock's -- it is solely the parent daemon's
job. So just break out of the loop in the child.

MFC after: 5 days

Use pidfile(3) provided by libutil to manage the deamon's pid file.

By default, create a pid file at the standard location, /var/run/ftpd.pid,
in accord with the expected behavior of a stock system daemon.

MFC after: 5 days

s/R_IA64_/R_IA_64_/g as per the ia64 psABI.

In preparation for a new malloc implementation:

* Add posix_memalign().

* Move calloc() from calloc.c to malloc.c. Add a calloc() implementation in
rtld-elf in order to make the loader happy (even though calloc() isn't
used in rtld-elf).

* Add _malloc_prefork() and _malloc_postfork(), and use them instead of
directly manipulating __malloc_lock.

Approved by: phk, markm (mentor)

Don't be sexist - fix a typo.

Make tv_sec a time_t on all platforms but alpha. Brings us more in line with
POSIX. This also makes the struct correct we ever implement an i386-time64
architecture. Not that we need too.

Reviewed by: imp, brooks
Approved by: njl (acpica), des (no objects, touches procfs)
Tested with: make universe

Make lookups for relocations from old unversioned binaries return
oldest versioned symbol available. Do not accept hidden symbols for
all other versions.

Use "<obj->path>: <error message>" for all error messages in new
functions to make them more consistent.

Remove debugging statement that slipped into lone of the previous commits
unintentionally.

Initialize object dagmembers list before checking version dependencies.

Implement ELF symbol versioning using GNU semantics. This code aims
to be compatible with symbol versioning support as implemented by
GNU libc and documented by http://people.redhat.com/~drepper/symbol-versioning
and LSB 3.0.

Implement dlvsym() function to allow lookups for a specific version of
a given symbol.

Make our ELF64 type definitions match standards. In particular this
means:
o Remove Elf64_Quarter,
o Redefine Elf64_Half to be 16-bit,
o Redefine Elf64_Word to be 32-bit,
o Add Elf64_Xword and Elf64_Sxword for 64-bit entities,
o Use Elf_Size in MI code to abstract the difference between
Elf32_Word and Elf64_Word.
o Add Elf_Ssize as the signed counterpart of Elf_Size.

MFC after: 2 weeks

Explicitly cast ELF_R_TYPE() to the right type.

Fix a bug in dlinfo(RTLD_DI_SERINFOSIZE) requests. For each search path
we included the length of the path in the returned size but not the length
of the associated Dl_serpath structure. Without this fix, programs
attempting to allocate a structure to hold the search path information
would allocate too small of a buffer and rtld would overrun the buffer
while filling it via a subsequent RTLD_DI_SERINFO request.

Submitted by: "William K. Josephson" wkj at morphisms dot net
Reviewed by: jdp
MFC after: 2 weeks

Style: move .PATH to where it belongs.

Clean out the leftovers from the i386_set_gsbase() TLS conversion.

Like on libthr, there is an i386_set_gsbase() stub implementation here
to avoid libc.so.5 issues. This should likely be a weak symbol and I
expect this will be fixed soon.

Approved by: re

Removed trailing whitespace.

Approved by: re (blanket)

Bump document date on behalf of a recent change.

Approved by: re (blanket)

Remove rexecd(8), a server that implements a particularly insecure
method of executing commands remotely. There are no rexec clients in
the FreeBSD tree, and the client function rexec(3) is present only in
libcompat. It has been documented as "obsolete" since 4.3BSD, and its
use has been discouraged in the man page for over 10 years.

Remove kludges intended to support src trees with partial obj trees.

Discussed with: ru

MFNetBSD: src/libexec/ld.elf_so/arch/sparc64/mdreloc.c 1.26 (partial)

Fix an obvious bug in the 64-bit PLT fixup: the SLLX was by 12 bits, when
it should be 32.

MFC after: 1 month

Fix the load64 and store64 macros, created to handle 8-byte unaligned
loads and stores (resp.) The ldq_u and stq_u instruction mask off the
lower 3 bits of the final address before loading from or storing to
the address, so as to avoid unaligned loads and stores. They do not
themselves allow loads from or stores to unaligned addresses. Replace
the macro definitions by a packed struct dereference.

Submitted by: Richard Henderson (rth at twiddle dot net)

o Missed colon in getopt(3) argument makes tftpd(8) crash. Fix that.

PR: misc/81732
Submitted by: Denis Grudkin
MFC after: 2 weeks

Fixup of last commit: Use the name X instead of XFree86 for the server binary,
thus being compatible with both XFree86 and X.org.

Noticed by: danfe

Make the example for using xterm as a login manager to match the X of the
noughties, not eighties.

Align the stack to a 16 byte boundary before calling _rtld so that we can
safely initialise shared libraries that use SSE in their init sections.

MFC After: 1 week

Switch to WARNS=2 instead of tinkering directly with CFLAGS (level 2 was
picked because higher warn levels are broken for ftp-proxy at the moment).

Approved by: mlaier

Enable lukemftpd for 6.0-RELEASE.

NI_WITHSCOPEID cleanup. Neither RFC 2553 nor RFC 3493 defines
NI_WITHSCOPEID, and our getaddrinfo(3) does nothing special
for it, now.

Spell SHUT_RDWR as SHUT_RDWR not 2 as the how argument to shutdown(2).

Spell SHUT_RDWR as SHUT_RDWR not 1+1 as the how argument to shutdown(2).

Prevent usage of nested externs.

Fix compilation problem.

Stop calling _amd64_set_gsbase() for COMPAT_32BIT. The amd64 kernel
implements i386_set_gsbase(), so there is no need for the variation.

s/int/size_t/ as appropriate.

Noticed by: bde

Attempt to use i386_set_gsbase(), and gracefully fall back to LDT methods
if the direct access methods are not implemented.

The script mistakenly ignores the entropy_save_sz variable from
rc.conf[.local]. Fix this, and leave the default as 2048.

Update the copyright year to include the present.

Update the assignment of the copyright to be me personally,
instead of "The FreeBSD Project" which is not a legal entity,
and therefore not a proper assignee. My intention remains the
same however, that this code continue to be BSD licensed, and
freely available to anyone that wants it under those terms.

PR: conf/75722
Submitted by: Nicolas Rachinsky <list@rachinsky.de>

Revert parts of previous commits and use a temporary variable to avoid
an invalid type pun.

No need to provide atomic_cmpset_32() anymore.

An array was mistaken for a pointer in the previous commit.

Noticed by: tinderbox, stefanf
Pointy hat to: nectar

Include gettytab.h before extern.h so that the declarations of struct
gettyflags, gettynums and gettystrs are available.

Correct type mismatch introduced in last commit.

Noticed by: Steve Kargl <sgk@troutmask.apl.washington.edu>

DES pointed out that the PAM layer may change the target user name
during authentication. Thus we need to call getpwnam *after* the user
has been authenticated. Colin mentioned that we should also move the
check for root in that case.

When allocating TLS and DTV, make sure that any unused slots in the DTV
are initialised to zero. When freeing TLS, don't attempt to free DTV
slots which were not used.

Pointed out by: Joerg Sonnenberger
X-MFC-After: After the branch, probably

When PAM support was added to rexecd in revision 1.29 (just prior to
5.0-RELEASE), a visually elusive bug was introduced. A comparison
operator was changed to assignment. As a result, rexecd behaved
always as if the `-i' option had been specified. It would allow root
logins. This commit corrects the situation in the obvious way.

A separate bug was introduced at the same time. The PAM library
functions are called between the invocation of getpwnam(3) and the use
of the returned static object. Since many PAM library functions
result in additional getpwnam(3) calls, the contents of the returned
static object could be changed from under rexecd. With this commit,
getpwnam_r(3) is used instead.

Other PAM-using applications should be reviewed for similar errors in
getpw* usage.

Security: rexecd's documented default policy of disallowing root
logins was not enforced.
Reviewed by: cperciva

If "dangerous" environment variables (LD_PRELOAD, LD_LIBMAP,
LD_LIBMAP_DISABLE, LD_LIBRARY_PATH) are used, then make sure the
libraries being loaded aren't on a noexec-mounted filesystem.

This is a compromise position: I'm assuming that nobody will be silly
enough to set the noexec mount flag on part of the default library
path, in order to avoid adding extra overhead into the common case
(where those environment variables aren't used).

Discussed with: csjp, secteam
MFC after: 1 week

Use sysconf(_SC_ARG_MAX) instead of NCARGS.

Add locking code for tls routines.

Install rlogind(8). Pointy hat is available on request.

Wrap BSD r* commands in NO_RCMDS.
Change NO_RCMDNS to NO_RCMDS and do the switch in bsd.compat.mk.

Discussed with: ru, nectar

correct WARNS=6 fix to use cast to (void *).
use of struct sockaddr_strage * is thought as not good manner. :)

Attempt to free any static TLS space used by a shared library when it
is unloaded. This allows applications which load and unload libraries
like libGL.so.1 several times to work properly.

MFC after: 2 days

Only provide the dummy, non-atomic atomic_cmpset_32() if
ARM_HAS_ATOMIC_CMPSET_32 isn't defined.

If what we have is a struct sockaddr_storage * and what we want is a
struct sockaddr_storage *, there's no point in casting it prematurely
to a struct sockaddr *. This unbreaks WARNS=6 on sparc64.

Make WARNS=6-clean.

Add some consistency checks to the signal-related code.

MFC: along with rev. 1.202

A call to maskurg() makes sense only when a transfer is under way,
the function will emit an annoying log message otherwise.

Reported by: kris
MFC: along with rev. 1.202

- Use socklen_t.
- No need for 'fromlen' to have file scope.
- Remove an unused variable.

Fix most cases where the address of an int is passed to a function expecting a
socklen_t * argument.

Expand contractions.

Expand *n't contractions.

Sync program's usage() with manpage's SYNOPSIS.

Removed Kerberos remnants.

The only user of this utility (share/man/man0) was removed 2+ years ago.

Description from Dan:

Another handy libmap patch. Lets you do stuff like this:

LD_LIBMAP="libpthread.so.1=libthr.so.1" mythreadedapp

If you already have a program-specific override in libmap.conf, note
that you must use a program-specific override in LD_LIBMAP:

LD_LIBMAP="[mythreadedapp],libpthread.so.1=libthr.so.1" mythreadedapp

PR: bin/74471
Submitted by: Dan Nelson <dnelson AT allantgroup.com>
MFC after: 2 weeks

style(9)

Let bsd.prog.mk set SRCS and MAN to their default values.

Respect the `logging' flag.

Pointed out by: Nick Leuta
MFC after: 3 days

Improve handling SIGURG and OOB commands on the control channel.

The major change is to process STAT sent as an OOB command w/o
breaking the current data transfer. As a side effect, this gives
better error checking in the code performing data transfers.

A lesser, but in no way cosmetic, change is using the flag `recvurg'
in the only signal-safe way that has been blessed by SUSv3. The
other flag, `transflag,' becomes private to the SIGURG machinery,
serves debugging purposes only, and may be dropped in the future.

The `byte_count' global variable is now accounting bytes actually
transferred over the network. This can give status messages looking
strange, like "X of Y bytes transferred," where X > Y, but that has
more sense than trying to compensate for combinations of data formats
on the server and client when transferring ASCII type data. BTW,
getting the size of a file in advance is unreliable for a number of
reasons in the first place. See question 18.8 of the Infrequently
Asked Questions in comp.lang.c for details.

PR: bin/52072
Tested by: Nick Leuta (earlier versions), a stress-testing tool (final)
MFC after: 1 month

Sort sections.

64-bit clean + WARNS=6:
- Convert the (char *) cast+cast backs magic to
memcpy(3). Without this, the resulting code
is potentially risky with higher optimization
levels.
- Avoid same name when calling local variables,
as well as global symbols. This reduces
confusion for both human and compiler.
- Add necessary casts, consts
- Use new style function defination.
- Minor style.Makefile(5) tweak
- Bump WARNS?= from 0 to 6

** for the aout code: changes are intentionally limited
to ease maintaince.

Restore these files to make ldconfig(8) happy.

Remove a.out runtime linker. It doesn't build and was removed from the
build over two years ago by peter.

The binary a.out version of ld.so can be obtained from misc/compat22 or
src/lib/compat/compat22.

Discussed on: -arch
Voted yes: jhb, ru, linimon, delphij

Replace err(3) calls when in daemon mode by syslog(3), too.
A daemon has no stderr to send its complains to.

Pointed out by: Nick Leuta
MFC after: 1 week

NOPAM -> NO_PAM

NOINET6 -> NO_INET6

NOCRYPT -> NO_CRYPT

NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE

Start the dreaded NOFOO -> NO_FOO conversion.

OK'ed by: core

Do a small style(9) fix before I'm hacking the code itself.

free(3) is void already.

Never emit a message to stderr: use syslog instead.
When in inetd mode, this prevents bogus messages from
appearing on the control channel. When running as a
daemon, we shouldn't write to the terminal we used to
have at all.

PR: bin/74823
MFC after: 1 week

Implement a dummy atomic_cmpset_32(). It should be safe to use it in rtld as
the signals are masked anyway.

When looking for a virtual host to handle the connection,
stop the search on the first match for efficiency.

Submitted by: Nick Leuta

Calling pam_chauthtok() isn't really needed since
an FTP user has no chance to change password anyway.

Submitted by: Nick Leuta

Don't log the chroot dir on every command since it's constant for a session.
Log it once at the beginning of the session instead. OTOH, log wd each
time for the sake of better auditing and consistent log format.

Proposed by: Nick Leuta <skynick -at- mail.sc.ru>

Always log remote IP.

PR: bin/59773

Treat host name buffers consistently.

Make chrootdir global and use it in log messages
regarding restricted users.

MFC after: 2 weeks