Adapt to recent posix_spawn extensions.

GCC 10 does not like casting from one identical anonymous enum
to another enum. supply some quietening cast.

branches: 1.42.4;
- Only increment nprocs when we're creating a new process, not just
when allocating a PID.
- Per above, proc_free_pid() no longer decrements nprocs. It's now done
in proc_free() right after proc_free_pid().
- Ensure nprocs is accessed using atomics everywhere.

branches: 1.41.6;
Add a boolean argument to indicate if we have a path/true (execve) or an
fd/false (fexecve). This is needed to differentiate between them because
NULL/-1 can be readily passed from userland.

fix fexecve

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28; 1.38.30;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.

GCC 10 does not like casting from one identical anonymous enum
to another enum. supply some quietening cast.

- Only increment nprocs when we're creating a new process, not just
when allocating a PID.
- Per above, proc_free_pid() no longer decrements nprocs. It's now done
in proc_free() right after proc_free_pid().
- Ensure nprocs is accessed using atomics everywhere.

branches: 1.41.6;
Add a boolean argument to indicate if we have a path/true (execve) or an
fd/false (fexecve). This is needed to differentiate between them because
NULL/-1 can be readily passed from userland.

fix fexecve

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28; 1.38.30;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.

- Only increment nprocs when we're creating a new process, not just
when allocating a PID.
- Per above, proc_free_pid() no longer decrements nprocs. It's now done
in proc_free() right after proc_free_pid().
- Ensure nprocs is accessed using atomics everywhere.

branches: 1.41.6;
Add a boolean argument to indicate if we have a path/true (execve) or an
fd/false (fexecve). This is needed to differentiate between them because
NULL/-1 can be readily passed from userland.

fix fexecve

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28; 1.38.30;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.

Add a boolean argument to indicate if we have a path/true (execve) or an
fd/false (fexecve). This is needed to differentiate between them because
NULL/-1 can be readily passed from userland.

fix fexecve

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28; 1.38.30;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.

fix fexecve

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28; 1.38.30;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.38.28;
Limit the amount of kernel memory a posix_spawn syscall can use (for handling
the file action list) by limiting the maximum number of file actions to
twice the current file descriptor limit.
Fix a few bugs in the support functions and document the new limit.
From Maxime Villard.

branches: 1.37.2;
netbsd32_posix_spawn_fa_alloc: use the right length for path allocation.

This error lead to memory pool corruption when freeing kmem with wrong size.

branches: 1.36.2;
Revert posix_spawn() clean up for now, there are some bugs.

posix_spawn:
- Remove copy-pasting in error paths, use execve_free_{vmspace,data}().
- Move some code (both in the init and exit paths) out of the locks.
- Slightly simplify do_posix_spawn() callers.
- Add few asserts and comments.

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

branches: 1.33.2;
Add missing *at syscalls among others

branches: 1.32.12; 1.32.34; 1.32.38;
remove clause #3 from my license where there are no other
copyright holders involved.

branches: 1.31.6; 1.31.8; 1.31.10; 1.31.12;
Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.30.8; 1.30.16; 1.30.20;
Change the way that emulations locate files within the emulation root to
avoid having to allocate space in the 'stackgap'
- which is very LWP unfriendly.
The additional code for non-emulation namei() is trivial, the reduction for
the emulations is massive.
The vnode for a processes emulation root is saved in the cwdi structure
during process exec.
If the emulation root the TRYEMULROOT flag are set, namei() will do an initial
search for absolute pathnames in the emulation root, if that fails it will
retry from the normal root.
".." at the emulation root will always go to the real root, even in the middle
of paths and when expanding symlinks.
Absolute symlinks found using absolute paths in the emulation root will be
relative to the emulation root (so /usr/lib/xxx.so -> /lib/xxx.so links
inside the emulation root don't need changing).
If the root of the emulation would be returned (for an emulation lookup), then
the real root is returned instead (matching the behaviour of emul_lookup,
but being a cheap comparison here) so that programs that scan "../.."
looking for the root dircetory don't loop forever.
The target for symbolic links is no longer mangled (it used to get the
CHECK_ALT_xxx() treatment, so could get /emul/xxx prepended).
CHECK_ALT_xxx() are no more. Most of the change is deleting them, and adding
TRYEMULROOT to the flags to NDINIT().
A lot of the emulation system call stubs could now be deleted.

Change all the NETBSD32PTR64(SCARG(uap, xxx))) to SCARG_P32(uap, xxx).

branches: 1.28.2; 1.28.4; 1.28.6;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2;
Merge newlock2 to head.

branches: 1.26.2; 1.26.12;
Clean up fallout proc_is_traced_p() change:
- proc_is_traced_p() -> trace_is_enabled(), to match trace_enter() and
trace_exit().
- trace_is_enabled() becomes a real function.
- Remove unnecessary include files from various files that used to care
about KTRACE and SYSTRACE, but do no more.

branches: 1.25.4; 1.25.6; 1.25.8;
merge ktrace-lwp.

Do the CHECK_ALT_EXIST dance again in netbsd32_execve(). It was lost in
previous commit.

Split sys_execve() and add execve1() that does most of the work, and takes
as an argument a function that will retrieve an element of the pointer
arrays in user space. This allows COMPAT_NETBSD32 to share the code for
the emulated version of execve(2), and fixes various issues that came from
the slow drift between the two implementations.

Note: when splitting up a syscall function, I'll use two different ways
of naming the resulting helper function. If it stills does
copyin/out operations, it will be named <syscall>1(). If it does
not (as it was the case for get/setitimer), it will be named
do<syscall>.

branches: 1.22.2;
- add const
- avoid shadowed variables.

Some changes in veriexec.

New features:

- Add a veriexec_report() routine to make most reporting consistent and
remove some common code.
- Add 'strict' mode that controls how veriexec behaves.
- Add sysctl knobs:
o kern.veriexec.verbose controls verbosity levels. Value: 0, 1.
o kern.veriexec.strict controls strict level. Values: 0, 1, 2. See
documentation in sysctl(3) for details.
o kern.veriexec.algorithms returns a string with a space separated
list of supported hashing algorithms in veriexec.
- Updated documentation in man pages for sysctl(3) and sysctl(8).

Bug fixes:

- veriexec_removechk(): Code cleanup + handle FINGERPRINT_NOTEVAL
correctly.
- exec_script(): Don't pass 0 as flag when executing a script; use the
defined VERIEXEC_INDIRECT - which is 1. Makes indirect execution
enforcement work.
- Fix some printing formats and types..

merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

branches: 1.19.2;
nuke trailing whitespace

branches: 1.18.8; 1.18.10;
allow to start other emulations (eg native code)
from here: set p_execsw to the new thing, and call
the new emulation's syscall_intern()

XXX there are more differences to kern_exec.c, sa/ras
related afaics, this is harmliss for now since
netbsd32 doesn't support multithreaded programs yet --
one day one execve() implementation should be shared
by native and netbsd32 code.

branches: 1.17.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

struct proc * -> struct lwp *

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Merge the nathanw_sa branch.

branches: 1.13.2;
p->p_sigacts -> p->p_sigctx

Implement passing AT_{E,R}{U,G}ID in the elf aux vector, like solaris.
- pass struct proc to copyargs.
- eliminate svr4_copyargs, since it is the same as ours now.

Fix some signed/unsigned comparison warnings from GCC 3.3.

Fix wrong psstr computation.
(XXX why is there an entire copy of sys_execve here?)

branches: 1.9.2; 1.9.4;
invoke setregs hooks correctly, as in sys_execve()
Problem noted and fix tested by Eduardo Horvath

make the stackgap_{init,alloc} functions MP friendly (i.e. pass struct proc *
in, instead of using curproc). While there add an optional size argument to
stackgap_init.

branches: 1.7.4;
if the LKM support is not compiled in, don't bother using exec_lock
at all, it's only needed in LKM case

use #if defined(LKM) || defined(_LKM) condition for netbsd32_execve.c,
to DTRT when either compiled statically into kernel with LKM support,
or compiled as a LKM

add RCSIDs (including regeneration of files as appropriate)

carry on the copyargs() and exit1() changes from kern_exec.c

branches: 1.4.2;
In check_exec(), don't bother checking P_TRACED along with
MNT_NOSUID, just check MNT_NOSUID to clear the S{U,G}ID bits
in the attributes for the vnode we're about to exec.

We now check P_TRACED right before we would actually perform
the s{u,g}id function in the exec code.

This closes a race condition between exec of a setuid binary
and ptrace(2).

use _KERNEL_OPT.

branches: 1.2.2;
be more verbose about failed vmcmds.

branches: 1.1.2;
split up netbsd32_netbsd.c into 9 new files, leaving only those syscalls that
have no special interpretations besides simple syscall args conversion.