remove broken #ifdef KADB code block in subr_prf.
kdbpanic() was seemingly MIPS only and removed back in 1997,
since mips/locore.S rev 1.31.
should fix builds with KADB option enabled (tested on arc).

entropy(9): Simplify stages. Split interrupt vs non-interrupt paths.

- Nix the entropy stage (cold, warm, hot). Just use the usual kernel
`cold' (cold: single-core, single-thread; interrupts may happen),
and don't make any three-way distinction about whether interrupts
or threads or other CPUs can be running.

Instead, while cold, use splhigh/splx or forbid paths to come from
interrupt context, and while warm, use mutex or the per-CPU hard
and soft interrupt paths for low latency. This comes at a small
cost to some interrupt latency, since we may stir the pool in
interrupt context -- but only for a very short window early at boot
between configure and configure2, so it's hard to imagine it
matters much.

- Allow rnd_add_uint32 to run in hard interrupt context or with spin
locks held, but defer processing to softint and drop samples on the
floor if buffer is full. This is mainly used for cheaply tossing
samples from drivers for non-HWRNG devices into the entropy pool,
so it is often used from interrupt context and/or under spin locks.

- New rnd_add_data_intr provides the interrupt-like data entry path
for arbitrary buffers and driver-specified entropy estimates: defer
processing to softint and drop samples on the floor if buffer is
full.

- Document that rnd_add_data is forbidden under spin locks outside
interrupt context (will crash in LOCKDEBUG), and inadvisable in
interrupt context (but technically permitted just in case there are
compatibility issues for now); later we can forbid it altogether in
interrupt context or under spin locks.

- Audit all uses of rnd_add_data to use rnd_add_data_intr where it
might be used in interrupt context or under a spin lock.

This fixes a regression from last year when the global entropy lock
was changed from IPL_VM (spin) to IPL_SOFTSERIAL (adaptive). Thought
I'd caught all the problems from that, but another one bit three
different people this week, presumably because of recent changes that
led to more non-HWRNG drivers entering the entropy consolidation
path from rnd_add_uint32.

In my attempt to preserve the rnd(9) API for the (now long-since
abandoned) prospect of pullup to netbsd-9 in my rewrite of the
entropy subsystem in 2020, I didn't introduce a separate entry point
for entering entropy from interrupt context or equivalent, i.e., spin
locks held, and instead made rnd_add_data rely on cpu_intr_p() to
decide whether to process the whole sample under a lock or only take
as much as there's buffer space for before scheduling a softint. In
retrospect, that was a mistake (though perhaps not as much of a
mistake as other entropy API decisions...), a mistake which is
finally getting rectified now by rnd_add_data_intr.

XXX pullup-10

device_printf(9): Lock to avoid interleaving output.

XXX pullup-9
XXX pullup-10

ttycheckoutq(9): wait=0 always, parameter no longer useful, nix it.

XXX kernel revbump

kern: KASSERT(A && B) -> KASSERT(A); KASSERT(B)

fix logic-reversing tpyo in putone()

avoid pserialize usage in early boot

there are DEBUG-only aprint_normal() calls early in eg, ksyms
setup that may happen before eg curcpu() is setup. this is the
case in sparc64, where it sets up ksyms as early as it can so
that DDB has symbols early, which is before the curcpu() setup
is created, and thus the calls to pserialize_read_enter() and
pserialize_read_exit() attempt to access unmapped cpu_info and
due to being so early, the system faults to the prom.

simply use "cold" to determine whether to skip these pserialize
calls or not.

ok riastradh

XXX: pullup-10

branches: 1.196.2;
Fix (invalid) gcc uninitialised warning with i386 gcc using -Os.

sys/msgbuf.h: New home for extern log_open.

constty(4): Make MP-safe, take three.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Changes third time around:
- Initialize ttyref_cv so we don't panic when trying to use it,
leading to infinite loop when panic tries to take tty_lock to print
the panic message while we already hold tty_lock.

Revert "constty(4): Make MP-safe."

Something is still busted and this is interfering with the releng
amd64 testbed.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Revert "constty(4): Make MP-safe."

Something appears to be wrong with this.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

subr_prf.c & luasystm.c: s/panicing/panicking/ in comments

panic(9): Serialize panicstr access and printing `panic:' message.

This isn't riskier than before -- previously we took kprintf_lock
inside each separate printf/vprintf call here. Now we just take it
once around access to panicstr and printing the message.

With any luck, this should help avoid interleaving panic messages
with each other and with other output -- and maybe cut down on the
number of syzkaller duplicates.

s/paniced/panicked/ and s/borken/broken/ in comments.

Add printf_nostamp(9), kernel printf() without prepending a timestamp.

branches: 1.185.2;
Remove support for '%n' in the kernel printf functions.

It makes vulnerabilities too easily exploitable, is unused and as a sanity
rule should not be used in the kernel to begin with.

Now, "printf(unfiltered_string);" is much less of a problem.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Rewrite entropy subsystem.

Primary goals:

1. Use cryptography primitives designed and vetted by cryptographers.
2. Be honest about entropy estimation.
3. Propagate full entropy as soon as possible.
4. Simplify the APIs.
5. Reduce overhead of rnd_add_data and cprng_strong.
6. Reduce side channels of HWRNG data and human input sources.
7. Improve visibility of operation with sysctl and event counters.

Caveat: rngtest is no longer used generically for RND_TYPE_RNG
rndsources. Hardware RNG devices should have hardware-specific
health tests. For example, checking for two repeated 256-bit outputs
works to detect AMD's 2019 RDRAND bug. Not all hardware RNGs are
necessarily designed to produce exactly uniform output.

ENTROPY POOL

- A Keccak sponge, with test vectors, replaces the old LFSR/SHA-1
kludge as the cryptographic primitive.

- `Entropy depletion' is available for testing purposes with a sysctl
knob kern.entropy.depletion; otherwise it is disabled, and once the
system reaches full entropy it is assumed to stay there as far as
modern cryptography is concerned.

- No `entropy estimation' based on sample values. Such `entropy
estimation' is a contradiction in terms, dishonest to users, and a
potential source of side channels. It is the responsibility of the
driver author to study the entropy of the process that generates
the samples.

- Per-CPU gathering pools avoid contention on a global queue.

- Entropy is occasionally consolidated into global pool -- as soon as
it's ready, if we've never reached full entropy, and with a rate
limit afterward. Operators can force consolidation now by running
sysctl -w kern.entropy.consolidate=1.

- rndsink(9) API has been replaced by an epoch counter which changes
whenever entropy is consolidated into the global pool.
. Usage: Cache entropy_epoch() when you seed. If entropy_epoch()
has changed when you're about to use whatever you seeded, reseed.
. Epoch is never zero, so initialize cache to 0 if you want to reseed
on first use.
. Epoch is -1 iff we have never reached full entropy -- in other
words, the old rnd_initial_entropy is (entropy_epoch() != -1) --
but it is better if you check for changes rather than for -1, so
that if the system estimated its own entropy incorrectly, entropy
consolidation has the opportunity to prevent future compromise.

- Sysctls and event counters provide operator visibility into what's
happening:
. kern.entropy.needed - bits of entropy short of full entropy
. kern.entropy.pending - bits known to be pending in per-CPU pools,
can be consolidated with sysctl -w kern.entropy.consolidate=1
. kern.entropy.epoch - number of times consolidation has happened,
never 0, and -1 iff we have never reached full entropy

CPRNG_STRONG

- A cprng_strong instance is now a collection of per-CPU NIST
Hash_DRBGs. There are only two in the system: user_cprng for
/dev/urandom and sysctl kern.?random, and kern_cprng for kernel
users which may need to operate in interrupt context up to IPL_VM.

(Calling cprng_strong in interrupt context does not strike me as a
particularly good idea, so I added an event counter to see whether
anything actually does.)

- Event counters provide operator visibility into when reseeding
happens.

INTEL RDRAND/RDSEED, VIA C3 RNG (CPU_RNG)

- Unwired for now; will be rewired in a subsequent commit.

- Introduce a new global kernel variable "shutting_down" to indicate that
the system is shutting down or rebooting.
- Set this global in a new function called kern_reboot(), which is currently
just a basic wrapper around cpu_reboot().
- Call kern_reboot() instead of cpu_reboot() almost everywhere; a few
places remain where it's still called directly, but those are in early
pre-main() machdep locations.

Eventually, all of the various cpu_reboot() functions should be re-factored
and common functionality moved to kern_reboot(), but that's for another day.

put back line accidentally removed.

undo the unintended part of the previous commit.

va_copy list needs va_end; pointed out by kre@

Need <sys/kmem.h> for kmem_alloc()

Add a simple vasprintf() implementation that uses 2 passes, one to compute
the length and a second to place the data. Requested by rmind@

add KASSERT()s to ensure aprint_*_dev() and aprint_*_ifp() is not called
with NULL dv or ifp respectively

related to PR kern/53789

Introduce new helper printf functions that get passed output
flags. Add a new kprintf flag to avoid adding time stamps
when outputing to the console. Mostly from Christos, any bugs
added by me.

Use above to print the "twiddle" (when using boot -z) without
timestamps.

More ipkdb removal

Revert previous

When cold, manually update timecounters before calling getnanouptime. Now
kernel printf timestamps are updated properly before interrupts are
enabled.

branches: 1.171.2;
Make identification of accounted aprint_error()s possible by putting a
big ugly "autoconfiguration error: " in the log when they occur.

Change the default precision of timestamps from 9 digits (nanosecs)
to 7 (100's of nanosecs). This should perhaps depend upon the
port (what resolution is rational) the CPU speed, and the clock
update frequency (no point printing nanoseconds if the value being
brinted is only updated every few microseconds).

Eventually it should be able to be controlled by a sysctl, but
the default still matters, as that's what the autoconf (boot time,
before init starts) messages will use.

Allow the precision of the sub-second field of timestamps to
be controlled - for now that is done by editing this file and
recompiling (or using gdb or equiv to patch /netbsd or /dev/kmem)
but adding a sysctl to allow dynamic userland control should be easy.

Also reduce the initial seconds field width of timestamp from 5 to 4
(it grows wider as needed.)

Avoid printing timestamps if we cannot be sure there will be
a message to accompany them. (Observed happening...)

make this narrower by popular request.

fix type confusion on 32 bits

flip the default and enable kernel timestamps.

Add the ability to prepend a timestamp [ sec.nsec] relative to boottime
in kernel messages if KLOG_TIMESTAMP is enabled.

Instead of expanding the syslog level into <level> early, defer expansion
inside putchar; extract the actual character addition function to a separate
function.

factor out some repeated code and simplify the logputchar function.

branches: 1.162.2;
Revert printf return value change.

[syzkaller] Cast all the printf's to (void *)
> as a result of new printf(9) declaration.

branches: 1.160.8;
Bump size of scratchstr - some KASSERTMGS exceed 256 characters

branches: 1.159.2;
to garnish, dust with _KERNEL_OPT

Convert remaining MI <sys/rnd.h> stragglers. Many MD ones left.

Remove useless semicolon reported by Henning Petersen in PR#49635.

branches: 1.156.2;
If mutex_tryenter() fails, don't call mutex_exit().

avoid calling into time code when cold, and avoid calling nanotime()
if we're not going to use the result anyway.

XXX: not necessarily the best fix, but better than crashing *early*
boot due to too-early nanotime() calls.

XXX: pullup.

branches: 1.154.2;
Merge tls-earlyentropy branch into HEAD.

branches: 1.153.2;
remove {v,}sprintf

Revert, breaks the build due to missing rumpns_delay in librump.so.

Sleep 10 seconds before rebooting due to panic()
To give an opportunity to screencap a panic(), or pause a VM to attach
a debugger. (Richard Hansen)

branches: 1.150.2;
Move the DDB-specific part of vpanic() to a new db_panic() function,
defined in ddb/db_panic.c and declared in ddb/ddbvar.h. No functional
change.

The copyright years in db_panic.c are the years in which changes were
made to the code that has now been moved to db_panic.c. No pre-NetBSD
copyright notice is needed because revision 1.12 of subr_prf.c had only
the trivial "#ifdef DDB \\ Debugger(); \\ #endif"

branches: 1.149.2;
Repeated typo/varargs anachronism in comments.

branches: 1.148.2;
- fixed signed/unsigned comparison
- don't write/increment sbuf if NULL

- don't let arguments in macros have side effects
- nul terminate properly

Increment the source buffer when we overflow so that we don't get stuck in
an infinite loop.

- use va_copy where needed
- always nul terminate vsnprintf()
- make snprintf() call vsnprintf()

snprintf/vsnprintf can accept NULL/0 buffers and work properly as expected.
Before they used to return incorrect length on short buffers. Remove unused
error path.

branches: 1.143.2;
Add vpanic()

Use a scratch space in panic(9) so we can store a more meaningful
message for panicstr instead of just the format string.

Keep setting the panicstr to fmt beforehand though for safety precaution.

ok joerg@.

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

- Replace few malloc(9) uses with kmem(9).
- Rename buf_malloc() to buf_alloc(), fix comments.
- Remove some unnecessary inclusions.

Move device_printf() from ath_netbsd.c to subr_prf.c for reuse in a new
driver.

branches: 1.138.4; 1.138.6; 1.138.8;
On a recursive panic(), don't try to take a dump, as that may very
well have triggered the recursive panic.
Fix the comment for panic() to reflect now-current reality: the code
was already changed never to sync() on panic(), now we avoid dumping
core on a recursive panic.

Add a kernel configuration flag, SPLDEBUG, that activates a per-CPU log
of transitions to IPL_HIGH from lower IPLs. SPLDEBUG is only available
on i386 and Xen kernels, today.

'options SPLDEBUG' adds instrumentation to spllower() and splraise() as
well as routines to start/stop debugging and to record IPL transitions:
spldebug_start(), spldebug_stop(), spldebug_raise(), spldebug_lower().

panic: use MI cpu_index(), instead of cpu_number(), which could be sparse.

Return type of cpu_number(9) is cpuid_t which is effectively unsigned long.
So cast return type to unsigned long.
Fixes build for alpha GENERIC kernel.

when printing a ddb stack trace when entering ddb, include the cpu number

- Rearrange pg_delete() and pg_remove() (renamed pg_free), thus
proc_enterpgrp() with proc_leavepgrp() to free process group and/or
session without proc_lock held.
- Rename SESSHOLD() and SESSRELE() to to proc_sesshold() and
proc_sessrele(). The later releases proc_lock now.

Quick OK by <ad>.

ansify function definitions

Make curlwp accesses conditional on wether the data structures
have been initialized. Fixes PR kern/38599.

branches: 1.130.2;
Quote PR number in XXX comment. No functional change.

My clever hack was not enough. Disable DELAY via ifndef _RUMPKERN in
subr_prf until I manage to get all archs in line with a proper MI
signature.

We use CPU_INFO_FOREACH here -> include sys/cpu.h

Include kernel printf routines in rump instead of relying on the
magic libc symbol. This also allows to bid farewell to subr_prf2.c
and merge the contents back to subr_prf.c. The host kernel bridging
is now done via rumpuser_putchar().

* unexpose kprintf locking internals
* migrate from simplelock to kmutex

Don't bother to bump kernel version, since nothing outside of subr_prf
used KPRINTF_MUTEX_ENXIT()

Don't try to sync if panicing:

- It doesn't work and a dead system that can't be reset from the console is
worse than a system that has painced and rebooted. If you can make it work
reliably please do so.

- If the system is paniced there is every reason to suspect VM structures
and the contents of the buffer cache.

branches: 1.124.2; 1.124.4;
Move [hH][eE][xX][dD][iI][gG][iI][tT][sS](*) from subr_prf to subr_prf2
for use with rumps.

*) yes, I just had to. Notably though, there were only two
symbols instead of 128.

branches: 1.123.2; 1.123.4;
Add printf_tolog(), which writes to the kernel message buffer,
only. I believe this is the safest way to log serious conditions
indicated by NMI.

Reduce ifdefs due to MULTIPROCESSOR slightly.

In panic, we busy wait if another CPU is already panicking. Don't spl0(),
because we could recurse and run off the end of the stack. Pointed out by
chs@.

branches: 1.120.2; 1.120.4;
- Rename crit_enter/crit_exit to kpreempt_disable/kpreempt_enable.
DragonflyBSD uses the crit names for something quite different.
- Add a kpreempt_disabled function for diagnostic assertions.
- Add inline versions of kpreempt_enable/kpreempt_disable for primitives.
- Make some more changes for preemption safety to the x86 pmap.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

branches: 1.118.2;
acquire proclist_lock for SESSHOLD/SESSRELE.

Move the LW_BOUND flag into the thread-private flag word. It can be tested
by other threads/CPUs but that is only done when the LWP is known to be in a
quiescent state (for example, on a run queue).

branches: 1.116.6;
Always include <sys/cpu.h>, to pick up CPU_INFO_ITERATOR et al.

panic: allow only one CPU to panic. Try to make the panicing thread bound
and try take all CPUs offline, in case we can block at some point in the
future.

Start detangling lock.h from intr.h. This is likely to cause short term
breakage, but the mess of dependencies has been regularly breaking the
build recently anyhow.

- Always include kprintf_slock.
- sys/lock.h -> sys/simplelock.h

tablefull: subr_prf -> subr_prf2

branches: 1.111.2; 1.111.6;
Merge from vmlocking.

branches: 1.110.2;
machine/{bus,cpu,intr}.h -> sys/{bus,cpu,intr}.h

branches: 1.109.2;
Add an explicit include of <sys/device.h> to make sparc64 and sun2
build. Needed for device_xname() and device_t, use added by previous
change.

Extend the aprint family with _dev and _ifnet versions that take
a device_t or struct ifnet * as first argument and prefix the log
message with the corresponding device/interface name.

branches: 1.107.4; 1.107.6; 1.107.8; 1.107.10;
Move bitmask_snprintf() from subr_prf.c to subr_prf_bitmask.c to permit
standalone compilation. No functional change.

branches: 1.106.2;
Fix format of the combination of 'F\B\L' and ':\V' in
bitmask_snprintf(9).

branches: 1.105.4; 1.105.6;
TRUE -> true, FALSE -> false

branches: 1.104.2;
Merge newlock2 to head.

branches: 1.103.2;
Fix %X in kernel printf, from Arnaud Degroote in PR kern/34459.

branches: 1.102.2; 1.102.6;
if db_onpanic is -1, do not invoke any ddb functions at all when handling
a panic. This allows ddb's behaviour on a panic to be controlled via
sysctl rather than just compiling it in/out.

Introduce a new style of behaviour for ddb_onpanic == 2.
When set to 0 or 1, behaviour is normal (today)
When set to 2, kernel will display a stack trace and then enter ddb.

branches: 1.100.2;
merge ktrace-lwp.

branches: 1.99.2;
Use ANSI function decls.

- add const.
- remove unnecessary casts.
- add __UNCONST casts and mark them with XXXUNCONST as necessary.

Yes, it was a cool trick >20 years ago to use "0123456789abcdef"[a] to
implement, xtoa(), but I think defining the samestring 50 times is a bit
too much. Defined HEXDIGITS and hexdigits in subr_prf.c and use it...

nuke trailing whitespace

branches: 1.95.4; 1.95.6;
Implement ddb setting that allows all ddb output to be teed into the
kernel message buffer/log. Its off by default and can be switched on in the
kernel configuration on build time, be set as a variable in ddb and be set
using sysctl.

This adds the sysctl value
ddb.tee_msgbuf = 0
by default.

The functionality is especially added and aimed for developers who are not
blessed with a serial console and wish to keep all their ddb output in the
log. Specifying /l as a modifier to some selected commands will also put
the output in the log but not all commands provide one nor has the same
meaning for all commands.

This feature could in the future also be implemented as an ddb command but
that could lead to more bloat allthough maybe easier for non developpers to
use when mailing their backtraces from kernel crashes.

Nuke __P().

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.92.2;
Make sure to flush each line after printf.

- remove __STDC__ crap. It did not work anyway with pre-ansi compilers, since
va_start() takes one arg, and va_alist must be the only argument of a
varyadic in the K&R world.
- pass flags to tputchar.

Add a kern.dump_on_panic sysctl variable (and documentation, and a
kernel config option) that controls whether the kernel dumps to the
dump device on panic. Dumps can still be forced via the ``sync''
command from ddb. Defaults to ``on''.

Add aprint_error(), which is like aprint_normal(), but also records
the number of times it is called. This allows subsystems to report
the number of errors that occurred during a quiet/silent subsystem
startup. aprint_get_error_count() reports this count and resets it
to 0.

Also add printf_nolog(), which is like printf(), but prevents the
output from hitting the system log.

Add the following message printing routines, designed for printing
autoconfiguration messages:

aprint_normal: Send to console unless AB_QUIET. Always goes to the log.
aprint_naive: Send to console only if AB_QUIET. Never goes to the log.
aprint_verbose: Send to console only if AB_VERBOSE. Always goes to the log.
aprint_debug: Send to console and log only if AB_DEBUG.

API inspired by the same routines in BSD/OS.

Will be used to address kern/5155.

Partially expose some of the kernel printf internals in the new
<sys/kprintf.h> header file. This allows subsystems that need
printf semantics other than what are provided by the standard
kernel printf routines to implement exactly what they want.

/*CONTCOND*/ while (0)'ed macros

Casting from a pointer, to a db_expr_t, has to go via an intptr_t.
(db_expr_t == int64_t on sh5, for example).

provide a db_vprintf() which is exactly what the name suggests

branches: 1.83.8;
Protect multi statement macro with do {} while (0). This is not cosmetic.

add RCSIDs

branches: 1.81.4;
Check msgbufenabled before referencing msgbufp in panic. Avoids
a NULL ptr reference if there is an early panic (i.e. before
initmsgbuf() was called).

branches: 1.80.2;
add missing #include "opt_kgdb.h"

Save the start and end positions in the message buffer of the formatted
panic string.

Suggested by Jason Thorpe eons ago.

Add %j, %t and %z modifiers.

Declare constty extern.

branches: 1.76.2;
Strip %b and DDB formats out of kprintf, as they are no longer supported.

change tablefull() to accept one more parameter - optional hint

use that to inform about way to raise current limit when we reach maximum
number of processes, descriptors or vnodes

XXX hopefully I catched all users of tablefull()

branches: 1.74.2;
Fix assorted bugs around shutdown/reboot/panic time.
- add a new global variable, doing_shutdown, which is nonzero if
vfs_shutdown() or panic() have been called.
- in panic, set RB_NOSYNC if doing_shutdown is already set on entry
so we don't reenter vfs_shutdown if we panic'ed there.
- in vfs_shutdown, don't use proc0's process for sys_sync unless
curproc is NULL.
- in lockmgr, attribute successful locks to proc0 if doing_shutdown
&& curproc==NULL, and panic if we can't get the lock right away; avoids the
spurious lockmgr DIAGNOSTIC panic from the ddb reboot command.
- in subr_pool, deal with curproc==NULL in the doing_shutdown case.
- in mfs_strategy, bitbucket writes if doing_shutdown, so we don't
wedge waiting for the mfs process.
- in ltsleep, treat ((curproc == NULL) && doing_shutdown) like the
panicstr case.

Appears to fix: kern/9239, kern/10187, kern/9367.
May also fix kern/10122.

Ensure that a fault inside the traceback printing code
(i.e. db_stack_trace_print()) does not cause an infinite loop of
faults.

branches: 1.72.2;
If db_onpanic is unset and DDB is compiled in, panic() now calls
db_stack_trace_print(__builtin_frame_address(0),...), to printf() the
stack trace to the message bufffer and console. Idea from SunOS/Solaris.
Useful when dumping fails.

Support ddb-specific nonstandard printf formats %r and %z in kprintf(),
even when not called with (flags&TODDB != 0), such that ddb print routines
can use them when printing elsewhere, such as to the message buffer.

Lock internals have changed, and we depend on those in here.

Get rid of register declarations.

Remove declaration of db_radix - <ddb/db_output.h> has one.
Also remove <sys/conf.h> - don't need it here.

Make IPKDB working again.
Add support for i386 debugging and pci-based ne2000 boards.

Remove unused global `consintr'. Rob Black, kern/3841.

bitmask_snprintf: avoid returning too soon if we're using the
new-style format.

branches: 1.64.2; 1.64.8;
Implement vlog() (varargs version of log()).

Make sure the kprintf_slock is initialized, and use the low-level atomic
locking primitive directly to lock it, since those will never attempt
to call printf() to display debugging information (and thus deadlock
on recursion into the kprintf_slock).

branches: 1.62.4;
Fix some printf format problems on Alpha.

no need to set tailp twice.

rewrite usage of tailp slightly, to convince gcc that it really isn't used
initialized.

fix compiler warning

Implement [v]snprintf()

make console_debugger() a macro - no need to waste a stackframe

Add options DDB_FROMCONSOLE and sysctl ddb.fromconsole, analagous to
DDB_ONPANIC. Lets user ignore breaks but enter DDB on panic. Intended
for machines where debug on panic is useful, but DDB entry is not,
(public-access console, or terminal-servers which send spurious breaks)

Add new ddb hook, console_debugger(), which decides whether or not to
ignore console ddb requests. Console drivers should be updated to call
console_debugger(), not Debugger(), in response to serial-console
break or ddb keyboard sequence.

Implement vsprintf().

If MULTIPROCESSOR, add a spin lock around the kernel printf (in the
appropriate places). This makes debugging messages work a LOT better
on my multiprocessor Alpha.

Nuke spurious pointer incrementation.

minor KNF nit

Merge Chris Torek's new `%b' bit-field format into bitmask_snprintf().

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

defopt DDB.

Merge with Lite2 + local changes

Put it back the way it was.

A new kprintf was imported on 10/24, and it will cause a kernel panic
whenever the %: format is used on NetBSD/Alpha. Disable %: for __alpha__.
Note: the "correct" (but untested on other architectures) fix is to
change the wrong: kprintf(cp, oflags, tp, NULL, va_arg(ap, va_list));
to the right: kprintf(cp, oflags, tp, NULL, ap);

import chris torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats. examples:
%#x - previously only supported by db_printf [not printf/sprintf]
%8.8s - printf would print "000chuck" for "chuck" before
%5p - printf would print "0x 1" for value 1 before

XXX: new kprintf still supports several non-standard '%' formats that
are supposed to eventually be removed:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

Implement the kernel part of pr-1891. This allows for a more flexible sized
msgbuf. Note that old 'dmesg' and 'syslogd' binaries will continue running,
though old 'dmesg' binaries will output a few bytes of junk at the start of
the buffer, and will miss a few bytes at the end of the buffer.

branches: 1.43.4;
Avoid running off the end of the format string if the caller botched
the format modifer. Reported by and suggested fix from Daniel G. Pouzzner
in PR #2633. Final fix is slightly different now that we support the %q
modifier. This fix also includes the equivalent fix for sprintf().

If KGDB is defined, pull in <sys/kgdb.h> for prototypes.

Implement quad_t (%qx, %qd, %qo) printf formats.
Closes pr kern/3747.

XXX Kludge for PowerPC; needs a kernel vfprintf().

Renames: /dumpconf/cpu_dumpconf/, /boot/cpu_reboot/

Only call Debugger() on panic if "db_onpanic" is set.

Implement bitmask_snprintf(), which takes a value and a string
representing the names of those bits, prints them into a buffer
provided by the caller, and returns a pointer to that buffer.
Functionality is identical to that of the (non-standard) `%b' printf()
format, which will be deprecated.

Rename the non-exported function ksprintn() to ksnprintn(), and change
it to use a buffer provided by the caller, rather than at static
buffer.

Minor nit in my change regarding const and non-ansi code...

Oops, part of that last commit was not meant to go in.
The definitions of va_alist, va_dcl belong elsewhere.

The hack-ish tricks to make the ANSI-style va_start macro work in
non-ANSI mode were not quite complete. This makes non-ANSI work.
Perhaps it would be better to eliminate this hack altogether...

don't assign non-const pointers from const pointers; make the appropriate
pointers 'const'. (-Wcast-qual)

Rename recently checked in KGDB to IPKDB to resolve conflicts with older KGDB

panic must print a newline

backout previous kprintf change

printf -> kprintf, sprintf -> ksprintf

Enter new KGDB on panic just like other kernel debuggers

Recognize %.2x as %02x

Change reboot(2) to take two arguments: bootopt like normal and also
a boot string for firmware that can do this, such as the SPARC and
the sun3 models. It is currently silently ignored on all other
hardware now, however. The MD function "boot()" has been changed to
also take a char *.

remove include of <sys/cpu.h>

Change %r -> %: as for recursive printf's

Fix printf() formats.

- fdopen -> filedescopen
- bring kgdb prototype in scope.

More proto fixes

First pass at prototyping

copy some format specifiers from kprintf to sprintf. b & r still missing

Actually, do the previous differently.

Add a `%p' format.

Handle null pointers like libc.

New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

update; minor clean, cruft removal.

Make logpri() non-static.

lots of changes: prototype migration, move lots of variables, definitions,
and structure elements around. kill some unnecessary type and macro
definitions. standardize clock handling. More changes than you'd want.

Rename a lot of process flags.

make panic a varargs function

Canonicalize all #includes.

branches: 1.8.2;
Machine independant changes to VM for handling non-contiguous memory.

ANSIfications - removed all implicit function return types and argument
definitions. Ensured that all files include "systm.h" to gain access to
general prototypes. Casts where necessary.

add include of select.h if necessary for protos, or delete if extraneous

make kernel select interface be one-stop shopping & clean it all up.

fix kernel printf %b format.
from Gordon Burditt <gordon@sneaky.lonestar.org>

fixed to be compliant, subservient, and to take advantage of the newly
hacked config(8)

if PANICWAIT defined, will always wait for a key press before reboot
after panic. (note that this only makes a difference if DDB is not
installed.)

branches: 1.1.1;
Initial revision

entropy(9): Simplify stages. Split interrupt vs non-interrupt paths.

- Nix the entropy stage (cold, warm, hot). Just use the usual kernel
`cold' (cold: single-core, single-thread; interrupts may happen),
and don't make any three-way distinction about whether interrupts
or threads or other CPUs can be running.

Instead, while cold, use splhigh/splx or forbid paths to come from
interrupt context, and while warm, use mutex or the per-CPU hard
and soft interrupt paths for low latency. This comes at a small
cost to some interrupt latency, since we may stir the pool in
interrupt context -- but only for a very short window early at boot
between configure and configure2, so it's hard to imagine it
matters much.

- Allow rnd_add_uint32 to run in hard interrupt context or with spin
locks held, but defer processing to softint and drop samples on the
floor if buffer is full. This is mainly used for cheaply tossing
samples from drivers for non-HWRNG devices into the entropy pool,
so it is often used from interrupt context and/or under spin locks.

- New rnd_add_data_intr provides the interrupt-like data entry path
for arbitrary buffers and driver-specified entropy estimates: defer
processing to softint and drop samples on the floor if buffer is
full.

- Document that rnd_add_data is forbidden under spin locks outside
interrupt context (will crash in LOCKDEBUG), and inadvisable in
interrupt context (but technically permitted just in case there are
compatibility issues for now); later we can forbid it altogether in
interrupt context or under spin locks.

- Audit all uses of rnd_add_data to use rnd_add_data_intr where it
might be used in interrupt context or under a spin lock.

This fixes a regression from last year when the global entropy lock
was changed from IPL_VM (spin) to IPL_SOFTSERIAL (adaptive). Thought
I'd caught all the problems from that, but another one bit three
different people this week, presumably because of recent changes that
led to more non-HWRNG drivers entering the entropy consolidation
path from rnd_add_uint32.

In my attempt to preserve the rnd(9) API for the (now long-since
abandoned) prospect of pullup to netbsd-9 in my rewrite of the
entropy subsystem in 2020, I didn't introduce a separate entry point
for entering entropy from interrupt context or equivalent, i.e., spin
locks held, and instead made rnd_add_data rely on cpu_intr_p() to
decide whether to process the whole sample under a lock or only take
as much as there's buffer space for before scheduling a softint. In
retrospect, that was a mistake (though perhaps not as much of a
mistake as other entropy API decisions...), a mistake which is
finally getting rectified now by rnd_add_data_intr.

XXX pullup-10

device_printf(9): Lock to avoid interleaving output.

XXX pullup-9
XXX pullup-10

ttycheckoutq(9): wait=0 always, parameter no longer useful, nix it.

XXX kernel revbump

kern: KASSERT(A && B) -> KASSERT(A); KASSERT(B)

fix logic-reversing tpyo in putone()

avoid pserialize usage in early boot

there are DEBUG-only aprint_normal() calls early in eg, ksyms
setup that may happen before eg curcpu() is setup. this is the
case in sparc64, where it sets up ksyms as early as it can so
that DDB has symbols early, which is before the curcpu() setup
is created, and thus the calls to pserialize_read_enter() and
pserialize_read_exit() attempt to access unmapped cpu_info and
due to being so early, the system faults to the prom.

simply use "cold" to determine whether to skip these pserialize
calls or not.

ok riastradh

XXX: pullup-10

branches: 1.196.2;
Fix (invalid) gcc uninitialised warning with i386 gcc using -Os.

sys/msgbuf.h: New home for extern log_open.

constty(4): Make MP-safe, take three.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Changes third time around:
- Initialize ttyref_cv so we don't panic when trying to use it,
leading to infinite loop when panic tries to take tty_lock to print
the panic message while we already hold tty_lock.

Revert "constty(4): Make MP-safe."

Something is still busted and this is interfering with the releng
amd64 testbed.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Revert "constty(4): Make MP-safe."

Something appears to be wrong with this.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

subr_prf.c & luasystm.c: s/panicing/panicking/ in comments

panic(9): Serialize panicstr access and printing `panic:' message.

This isn't riskier than before -- previously we took kprintf_lock
inside each separate printf/vprintf call here. Now we just take it
once around access to panicstr and printing the message.

With any luck, this should help avoid interleaving panic messages
with each other and with other output -- and maybe cut down on the
number of syzkaller duplicates.

s/paniced/panicked/ and s/borken/broken/ in comments.

Add printf_nostamp(9), kernel printf() without prepending a timestamp.

branches: 1.185.2;
Remove support for '%n' in the kernel printf functions.

It makes vulnerabilities too easily exploitable, is unused and as a sanity
rule should not be used in the kernel to begin with.

Now, "printf(unfiltered_string);" is much less of a problem.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Rewrite entropy subsystem.

Primary goals:

1. Use cryptography primitives designed and vetted by cryptographers.
2. Be honest about entropy estimation.
3. Propagate full entropy as soon as possible.
4. Simplify the APIs.
5. Reduce overhead of rnd_add_data and cprng_strong.
6. Reduce side channels of HWRNG data and human input sources.
7. Improve visibility of operation with sysctl and event counters.

Caveat: rngtest is no longer used generically for RND_TYPE_RNG
rndsources. Hardware RNG devices should have hardware-specific
health tests. For example, checking for two repeated 256-bit outputs
works to detect AMD's 2019 RDRAND bug. Not all hardware RNGs are
necessarily designed to produce exactly uniform output.

ENTROPY POOL

- A Keccak sponge, with test vectors, replaces the old LFSR/SHA-1
kludge as the cryptographic primitive.

- `Entropy depletion' is available for testing purposes with a sysctl
knob kern.entropy.depletion; otherwise it is disabled, and once the
system reaches full entropy it is assumed to stay there as far as
modern cryptography is concerned.

- No `entropy estimation' based on sample values. Such `entropy
estimation' is a contradiction in terms, dishonest to users, and a
potential source of side channels. It is the responsibility of the
driver author to study the entropy of the process that generates
the samples.

- Per-CPU gathering pools avoid contention on a global queue.

- Entropy is occasionally consolidated into global pool -- as soon as
it's ready, if we've never reached full entropy, and with a rate
limit afterward. Operators can force consolidation now by running
sysctl -w kern.entropy.consolidate=1.

- rndsink(9) API has been replaced by an epoch counter which changes
whenever entropy is consolidated into the global pool.
. Usage: Cache entropy_epoch() when you seed. If entropy_epoch()
has changed when you're about to use whatever you seeded, reseed.
. Epoch is never zero, so initialize cache to 0 if you want to reseed
on first use.
. Epoch is -1 iff we have never reached full entropy -- in other
words, the old rnd_initial_entropy is (entropy_epoch() != -1) --
but it is better if you check for changes rather than for -1, so
that if the system estimated its own entropy incorrectly, entropy
consolidation has the opportunity to prevent future compromise.

- Sysctls and event counters provide operator visibility into what's
happening:
. kern.entropy.needed - bits of entropy short of full entropy
. kern.entropy.pending - bits known to be pending in per-CPU pools,
can be consolidated with sysctl -w kern.entropy.consolidate=1
. kern.entropy.epoch - number of times consolidation has happened,
never 0, and -1 iff we have never reached full entropy

CPRNG_STRONG

- A cprng_strong instance is now a collection of per-CPU NIST
Hash_DRBGs. There are only two in the system: user_cprng for
/dev/urandom and sysctl kern.?random, and kern_cprng for kernel
users which may need to operate in interrupt context up to IPL_VM.

(Calling cprng_strong in interrupt context does not strike me as a
particularly good idea, so I added an event counter to see whether
anything actually does.)

- Event counters provide operator visibility into when reseeding
happens.

INTEL RDRAND/RDSEED, VIA C3 RNG (CPU_RNG)

- Unwired for now; will be rewired in a subsequent commit.

- Introduce a new global kernel variable "shutting_down" to indicate that
the system is shutting down or rebooting.
- Set this global in a new function called kern_reboot(), which is currently
just a basic wrapper around cpu_reboot().
- Call kern_reboot() instead of cpu_reboot() almost everywhere; a few
places remain where it's still called directly, but those are in early
pre-main() machdep locations.

Eventually, all of the various cpu_reboot() functions should be re-factored
and common functionality moved to kern_reboot(), but that's for another day.

put back line accidentally removed.

undo the unintended part of the previous commit.

va_copy list needs va_end; pointed out by kre@

Need <sys/kmem.h> for kmem_alloc()

Add a simple vasprintf() implementation that uses 2 passes, one to compute
the length and a second to place the data. Requested by rmind@

add KASSERT()s to ensure aprint_*_dev() and aprint_*_ifp() is not called
with NULL dv or ifp respectively

related to PR kern/53789

Introduce new helper printf functions that get passed output
flags. Add a new kprintf flag to avoid adding time stamps
when outputing to the console. Mostly from Christos, any bugs
added by me.

Use above to print the "twiddle" (when using boot -z) without
timestamps.

More ipkdb removal

Revert previous

When cold, manually update timecounters before calling getnanouptime. Now
kernel printf timestamps are updated properly before interrupts are
enabled.

branches: 1.171.2;
Make identification of accounted aprint_error()s possible by putting a
big ugly "autoconfiguration error: " in the log when they occur.

Change the default precision of timestamps from 9 digits (nanosecs)
to 7 (100's of nanosecs). This should perhaps depend upon the
port (what resolution is rational) the CPU speed, and the clock
update frequency (no point printing nanoseconds if the value being
brinted is only updated every few microseconds).

Eventually it should be able to be controlled by a sysctl, but
the default still matters, as that's what the autoconf (boot time,
before init starts) messages will use.

Allow the precision of the sub-second field of timestamps to
be controlled - for now that is done by editing this file and
recompiling (or using gdb or equiv to patch /netbsd or /dev/kmem)
but adding a sysctl to allow dynamic userland control should be easy.

Also reduce the initial seconds field width of timestamp from 5 to 4
(it grows wider as needed.)

Avoid printing timestamps if we cannot be sure there will be
a message to accompany them. (Observed happening...)

make this narrower by popular request.

fix type confusion on 32 bits

flip the default and enable kernel timestamps.

Add the ability to prepend a timestamp [ sec.nsec] relative to boottime
in kernel messages if KLOG_TIMESTAMP is enabled.

Instead of expanding the syslog level into <level> early, defer expansion
inside putchar; extract the actual character addition function to a separate
function.

factor out some repeated code and simplify the logputchar function.

branches: 1.162.2;
Revert printf return value change.

[syzkaller] Cast all the printf's to (void *)
> as a result of new printf(9) declaration.

branches: 1.160.8;
Bump size of scratchstr - some KASSERTMGS exceed 256 characters

branches: 1.159.2;
to garnish, dust with _KERNEL_OPT

Convert remaining MI <sys/rnd.h> stragglers. Many MD ones left.

Remove useless semicolon reported by Henning Petersen in PR#49635.

branches: 1.156.2;
If mutex_tryenter() fails, don't call mutex_exit().

avoid calling into time code when cold, and avoid calling nanotime()
if we're not going to use the result anyway.

XXX: not necessarily the best fix, but better than crashing *early*
boot due to too-early nanotime() calls.

XXX: pullup.

branches: 1.154.2;
Merge tls-earlyentropy branch into HEAD.

branches: 1.153.2;
remove {v,}sprintf

Revert, breaks the build due to missing rumpns_delay in librump.so.

Sleep 10 seconds before rebooting due to panic()
To give an opportunity to screencap a panic(), or pause a VM to attach
a debugger. (Richard Hansen)

branches: 1.150.2;
Move the DDB-specific part of vpanic() to a new db_panic() function,
defined in ddb/db_panic.c and declared in ddb/ddbvar.h. No functional
change.

The copyright years in db_panic.c are the years in which changes were
made to the code that has now been moved to db_panic.c. No pre-NetBSD
copyright notice is needed because revision 1.12 of subr_prf.c had only
the trivial "#ifdef DDB \\ Debugger(); \\ #endif"

branches: 1.149.2;
Repeated typo/varargs anachronism in comments.

branches: 1.148.2;
- fixed signed/unsigned comparison
- don't write/increment sbuf if NULL

- don't let arguments in macros have side effects
- nul terminate properly

Increment the source buffer when we overflow so that we don't get stuck in
an infinite loop.

- use va_copy where needed
- always nul terminate vsnprintf()
- make snprintf() call vsnprintf()

snprintf/vsnprintf can accept NULL/0 buffers and work properly as expected.
Before they used to return incorrect length on short buffers. Remove unused
error path.

branches: 1.143.2;
Add vpanic()

Use a scratch space in panic(9) so we can store a more meaningful
message for panicstr instead of just the format string.

Keep setting the panicstr to fmt beforehand though for safety precaution.

ok joerg@.

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

- Replace few malloc(9) uses with kmem(9).
- Rename buf_malloc() to buf_alloc(), fix comments.
- Remove some unnecessary inclusions.

Move device_printf() from ath_netbsd.c to subr_prf.c for reuse in a new
driver.

branches: 1.138.4; 1.138.6; 1.138.8;
On a recursive panic(), don't try to take a dump, as that may very
well have triggered the recursive panic.
Fix the comment for panic() to reflect now-current reality: the code
was already changed never to sync() on panic(), now we avoid dumping
core on a recursive panic.

Add a kernel configuration flag, SPLDEBUG, that activates a per-CPU log
of transitions to IPL_HIGH from lower IPLs. SPLDEBUG is only available
on i386 and Xen kernels, today.

'options SPLDEBUG' adds instrumentation to spllower() and splraise() as
well as routines to start/stop debugging and to record IPL transitions:
spldebug_start(), spldebug_stop(), spldebug_raise(), spldebug_lower().

panic: use MI cpu_index(), instead of cpu_number(), which could be sparse.

Return type of cpu_number(9) is cpuid_t which is effectively unsigned long.
So cast return type to unsigned long.
Fixes build for alpha GENERIC kernel.

when printing a ddb stack trace when entering ddb, include the cpu number

- Rearrange pg_delete() and pg_remove() (renamed pg_free), thus
proc_enterpgrp() with proc_leavepgrp() to free process group and/or
session without proc_lock held.
- Rename SESSHOLD() and SESSRELE() to to proc_sesshold() and
proc_sessrele(). The later releases proc_lock now.

Quick OK by <ad>.

ansify function definitions

Make curlwp accesses conditional on wether the data structures
have been initialized. Fixes PR kern/38599.

branches: 1.130.2;
Quote PR number in XXX comment. No functional change.

My clever hack was not enough. Disable DELAY via ifndef _RUMPKERN in
subr_prf until I manage to get all archs in line with a proper MI
signature.

We use CPU_INFO_FOREACH here -> include sys/cpu.h

Include kernel printf routines in rump instead of relying on the
magic libc symbol. This also allows to bid farewell to subr_prf2.c
and merge the contents back to subr_prf.c. The host kernel bridging
is now done via rumpuser_putchar().

* unexpose kprintf locking internals
* migrate from simplelock to kmutex

Don't bother to bump kernel version, since nothing outside of subr_prf
used KPRINTF_MUTEX_ENXIT()

Don't try to sync if panicing:

- It doesn't work and a dead system that can't be reset from the console is
worse than a system that has painced and rebooted. If you can make it work
reliably please do so.

- If the system is paniced there is every reason to suspect VM structures
and the contents of the buffer cache.

branches: 1.124.2; 1.124.4;
Move [hH][eE][xX][dD][iI][gG][iI][tT][sS](*) from subr_prf to subr_prf2
for use with rumps.

*) yes, I just had to. Notably though, there were only two
symbols instead of 128.

branches: 1.123.2; 1.123.4;
Add printf_tolog(), which writes to the kernel message buffer,
only. I believe this is the safest way to log serious conditions
indicated by NMI.

Reduce ifdefs due to MULTIPROCESSOR slightly.

In panic, we busy wait if another CPU is already panicking. Don't spl0(),
because we could recurse and run off the end of the stack. Pointed out by
chs@.

branches: 1.120.2; 1.120.4;
- Rename crit_enter/crit_exit to kpreempt_disable/kpreempt_enable.
DragonflyBSD uses the crit names for something quite different.
- Add a kpreempt_disabled function for diagnostic assertions.
- Add inline versions of kpreempt_enable/kpreempt_disable for primitives.
- Make some more changes for preemption safety to the x86 pmap.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

branches: 1.118.2;
acquire proclist_lock for SESSHOLD/SESSRELE.

Move the LW_BOUND flag into the thread-private flag word. It can be tested
by other threads/CPUs but that is only done when the LWP is known to be in a
quiescent state (for example, on a run queue).

branches: 1.116.6;
Always include <sys/cpu.h>, to pick up CPU_INFO_ITERATOR et al.

panic: allow only one CPU to panic. Try to make the panicing thread bound
and try take all CPUs offline, in case we can block at some point in the
future.

Start detangling lock.h from intr.h. This is likely to cause short term
breakage, but the mess of dependencies has been regularly breaking the
build recently anyhow.

- Always include kprintf_slock.
- sys/lock.h -> sys/simplelock.h

tablefull: subr_prf -> subr_prf2

branches: 1.111.2; 1.111.6;
Merge from vmlocking.

branches: 1.110.2;
machine/{bus,cpu,intr}.h -> sys/{bus,cpu,intr}.h

branches: 1.109.2;
Add an explicit include of <sys/device.h> to make sparc64 and sun2
build. Needed for device_xname() and device_t, use added by previous
change.

Extend the aprint family with _dev and _ifnet versions that take
a device_t or struct ifnet * as first argument and prefix the log
message with the corresponding device/interface name.

branches: 1.107.4; 1.107.6; 1.107.8; 1.107.10;
Move bitmask_snprintf() from subr_prf.c to subr_prf_bitmask.c to permit
standalone compilation. No functional change.

branches: 1.106.2;
Fix format of the combination of 'F\B\L' and ':\V' in
bitmask_snprintf(9).

branches: 1.105.4; 1.105.6;
TRUE -> true, FALSE -> false

branches: 1.104.2;
Merge newlock2 to head.

branches: 1.103.2;
Fix %X in kernel printf, from Arnaud Degroote in PR kern/34459.

branches: 1.102.2; 1.102.6;
if db_onpanic is -1, do not invoke any ddb functions at all when handling
a panic. This allows ddb's behaviour on a panic to be controlled via
sysctl rather than just compiling it in/out.

Introduce a new style of behaviour for ddb_onpanic == 2.
When set to 0 or 1, behaviour is normal (today)
When set to 2, kernel will display a stack trace and then enter ddb.

branches: 1.100.2;
merge ktrace-lwp.

branches: 1.99.2;
Use ANSI function decls.

- add const.
- remove unnecessary casts.
- add __UNCONST casts and mark them with XXXUNCONST as necessary.

Yes, it was a cool trick >20 years ago to use "0123456789abcdef"[a] to
implement, xtoa(), but I think defining the samestring 50 times is a bit
too much. Defined HEXDIGITS and hexdigits in subr_prf.c and use it...

nuke trailing whitespace

branches: 1.95.4; 1.95.6;
Implement ddb setting that allows all ddb output to be teed into the
kernel message buffer/log. Its off by default and can be switched on in the
kernel configuration on build time, be set as a variable in ddb and be set
using sysctl.

This adds the sysctl value
ddb.tee_msgbuf = 0
by default.

The functionality is especially added and aimed for developers who are not
blessed with a serial console and wish to keep all their ddb output in the
log. Specifying /l as a modifier to some selected commands will also put
the output in the log but not all commands provide one nor has the same
meaning for all commands.

This feature could in the future also be implemented as an ddb command but
that could lead to more bloat allthough maybe easier for non developpers to
use when mailing their backtraces from kernel crashes.

Nuke __P().

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.92.2;
Make sure to flush each line after printf.

- remove __STDC__ crap. It did not work anyway with pre-ansi compilers, since
va_start() takes one arg, and va_alist must be the only argument of a
varyadic in the K&R world.
- pass flags to tputchar.

Add a kern.dump_on_panic sysctl variable (and documentation, and a
kernel config option) that controls whether the kernel dumps to the
dump device on panic. Dumps can still be forced via the ``sync''
command from ddb. Defaults to ``on''.

Add aprint_error(), which is like aprint_normal(), but also records
the number of times it is called. This allows subsystems to report
the number of errors that occurred during a quiet/silent subsystem
startup. aprint_get_error_count() reports this count and resets it
to 0.

Also add printf_nolog(), which is like printf(), but prevents the
output from hitting the system log.

Add the following message printing routines, designed for printing
autoconfiguration messages:

aprint_normal: Send to console unless AB_QUIET. Always goes to the log.
aprint_naive: Send to console only if AB_QUIET. Never goes to the log.
aprint_verbose: Send to console only if AB_VERBOSE. Always goes to the log.
aprint_debug: Send to console and log only if AB_DEBUG.

API inspired by the same routines in BSD/OS.

Will be used to address kern/5155.

Partially expose some of the kernel printf internals in the new
<sys/kprintf.h> header file. This allows subsystems that need
printf semantics other than what are provided by the standard
kernel printf routines to implement exactly what they want.

/*CONTCOND*/ while (0)'ed macros

Casting from a pointer, to a db_expr_t, has to go via an intptr_t.
(db_expr_t == int64_t on sh5, for example).

provide a db_vprintf() which is exactly what the name suggests

branches: 1.83.8;
Protect multi statement macro with do {} while (0). This is not cosmetic.

add RCSIDs

branches: 1.81.4;
Check msgbufenabled before referencing msgbufp in panic. Avoids
a NULL ptr reference if there is an early panic (i.e. before
initmsgbuf() was called).

branches: 1.80.2;
add missing #include "opt_kgdb.h"

Save the start and end positions in the message buffer of the formatted
panic string.

Suggested by Jason Thorpe eons ago.

Add %j, %t and %z modifiers.

Declare constty extern.

branches: 1.76.2;
Strip %b and DDB formats out of kprintf, as they are no longer supported.

change tablefull() to accept one more parameter - optional hint

use that to inform about way to raise current limit when we reach maximum
number of processes, descriptors or vnodes

XXX hopefully I catched all users of tablefull()

branches: 1.74.2;
Fix assorted bugs around shutdown/reboot/panic time.
- add a new global variable, doing_shutdown, which is nonzero if
vfs_shutdown() or panic() have been called.
- in panic, set RB_NOSYNC if doing_shutdown is already set on entry
so we don't reenter vfs_shutdown if we panic'ed there.
- in vfs_shutdown, don't use proc0's process for sys_sync unless
curproc is NULL.
- in lockmgr, attribute successful locks to proc0 if doing_shutdown
&& curproc==NULL, and panic if we can't get the lock right away; avoids the
spurious lockmgr DIAGNOSTIC panic from the ddb reboot command.
- in subr_pool, deal with curproc==NULL in the doing_shutdown case.
- in mfs_strategy, bitbucket writes if doing_shutdown, so we don't
wedge waiting for the mfs process.
- in ltsleep, treat ((curproc == NULL) && doing_shutdown) like the
panicstr case.

Appears to fix: kern/9239, kern/10187, kern/9367.
May also fix kern/10122.

Ensure that a fault inside the traceback printing code
(i.e. db_stack_trace_print()) does not cause an infinite loop of
faults.

branches: 1.72.2;
If db_onpanic is unset and DDB is compiled in, panic() now calls
db_stack_trace_print(__builtin_frame_address(0),...), to printf() the
stack trace to the message bufffer and console. Idea from SunOS/Solaris.
Useful when dumping fails.

Support ddb-specific nonstandard printf formats %r and %z in kprintf(),
even when not called with (flags&TODDB != 0), such that ddb print routines
can use them when printing elsewhere, such as to the message buffer.

Lock internals have changed, and we depend on those in here.

Get rid of register declarations.

Remove declaration of db_radix - <ddb/db_output.h> has one.
Also remove <sys/conf.h> - don't need it here.

Make IPKDB working again.
Add support for i386 debugging and pci-based ne2000 boards.

Remove unused global `consintr'. Rob Black, kern/3841.

bitmask_snprintf: avoid returning too soon if we're using the
new-style format.

branches: 1.64.2; 1.64.8;
Implement vlog() (varargs version of log()).

Make sure the kprintf_slock is initialized, and use the low-level atomic
locking primitive directly to lock it, since those will never attempt
to call printf() to display debugging information (and thus deadlock
on recursion into the kprintf_slock).

branches: 1.62.4;
Fix some printf format problems on Alpha.

no need to set tailp twice.

rewrite usage of tailp slightly, to convince gcc that it really isn't used
initialized.

fix compiler warning

Implement [v]snprintf()

make console_debugger() a macro - no need to waste a stackframe

Add options DDB_FROMCONSOLE and sysctl ddb.fromconsole, analagous to
DDB_ONPANIC. Lets user ignore breaks but enter DDB on panic. Intended
for machines where debug on panic is useful, but DDB entry is not,
(public-access console, or terminal-servers which send spurious breaks)

Add new ddb hook, console_debugger(), which decides whether or not to
ignore console ddb requests. Console drivers should be updated to call
console_debugger(), not Debugger(), in response to serial-console
break or ddb keyboard sequence.

Implement vsprintf().

If MULTIPROCESSOR, add a spin lock around the kernel printf (in the
appropriate places). This makes debugging messages work a LOT better
on my multiprocessor Alpha.

Nuke spurious pointer incrementation.

minor KNF nit

Merge Chris Torek's new `%b' bit-field format into bitmask_snprintf().

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

defopt DDB.

Merge with Lite2 + local changes

Put it back the way it was.

A new kprintf was imported on 10/24, and it will cause a kernel panic
whenever the %: format is used on NetBSD/Alpha. Disable %: for __alpha__.
Note: the "correct" (but untested on other architectures) fix is to
change the wrong: kprintf(cp, oflags, tp, NULL, va_arg(ap, va_list));
to the right: kprintf(cp, oflags, tp, NULL, ap);

import chris torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats. examples:
%#x - previously only supported by db_printf [not printf/sprintf]
%8.8s - printf would print "000chuck" for "chuck" before
%5p - printf would print "0x 1" for value 1 before

XXX: new kprintf still supports several non-standard '%' formats that
are supposed to eventually be removed:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

Implement the kernel part of pr-1891. This allows for a more flexible sized
msgbuf. Note that old 'dmesg' and 'syslogd' binaries will continue running,
though old 'dmesg' binaries will output a few bytes of junk at the start of
the buffer, and will miss a few bytes at the end of the buffer.

branches: 1.43.4;
Avoid running off the end of the format string if the caller botched
the format modifer. Reported by and suggested fix from Daniel G. Pouzzner
in PR #2633. Final fix is slightly different now that we support the %q
modifier. This fix also includes the equivalent fix for sprintf().

If KGDB is defined, pull in <sys/kgdb.h> for prototypes.

Implement quad_t (%qx, %qd, %qo) printf formats.
Closes pr kern/3747.

XXX Kludge for PowerPC; needs a kernel vfprintf().

Renames: /dumpconf/cpu_dumpconf/, /boot/cpu_reboot/

Only call Debugger() on panic if "db_onpanic" is set.

Implement bitmask_snprintf(), which takes a value and a string
representing the names of those bits, prints them into a buffer
provided by the caller, and returns a pointer to that buffer.
Functionality is identical to that of the (non-standard) `%b' printf()
format, which will be deprecated.

Rename the non-exported function ksprintn() to ksnprintn(), and change
it to use a buffer provided by the caller, rather than at static
buffer.

Minor nit in my change regarding const and non-ansi code...

Oops, part of that last commit was not meant to go in.
The definitions of va_alist, va_dcl belong elsewhere.

The hack-ish tricks to make the ANSI-style va_start macro work in
non-ANSI mode were not quite complete. This makes non-ANSI work.
Perhaps it would be better to eliminate this hack altogether...

don't assign non-const pointers from const pointers; make the appropriate
pointers 'const'. (-Wcast-qual)

Rename recently checked in KGDB to IPKDB to resolve conflicts with older KGDB

panic must print a newline

backout previous kprintf change

printf -> kprintf, sprintf -> ksprintf

Enter new KGDB on panic just like other kernel debuggers

Recognize %.2x as %02x

Change reboot(2) to take two arguments: bootopt like normal and also
a boot string for firmware that can do this, such as the SPARC and
the sun3 models. It is currently silently ignored on all other
hardware now, however. The MD function "boot()" has been changed to
also take a char *.

remove include of <sys/cpu.h>

Change %r -> %: as for recursive printf's

Fix printf() formats.

- fdopen -> filedescopen
- bring kgdb prototype in scope.

More proto fixes

First pass at prototyping

copy some format specifiers from kprintf to sprintf. b & r still missing

Actually, do the previous differently.

Add a `%p' format.

Handle null pointers like libc.

New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

update; minor clean, cruft removal.

Make logpri() non-static.

lots of changes: prototype migration, move lots of variables, definitions,
and structure elements around. kill some unnecessary type and macro
definitions. standardize clock handling. More changes than you'd want.

Rename a lot of process flags.

make panic a varargs function

Canonicalize all #includes.

branches: 1.8.2;
Machine independant changes to VM for handling non-contiguous memory.

ANSIfications - removed all implicit function return types and argument
definitions. Ensured that all files include "systm.h" to gain access to
general prototypes. Casts where necessary.

add include of select.h if necessary for protos, or delete if extraneous

make kernel select interface be one-stop shopping & clean it all up.