There's no COMPAT_60 code left here, so no need for conditional
inclusion of header file.

tty(9): Make ttwrite update uio with only how much it has consumed.

As is, it leaves uio in an inconsistent state. Good enough for the
write(2) return value to be correct for a userland caller to restart
write(2) where it left off, but not good enough for a loop in the
kernel to reuse the same uio.

Reported-by: syzbot+e0f56178d0add0d8be20@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=6290eb02b8fe73361dc15c7bc44e1208601e6af8

Reported-by: syzbot+7caa189e8fccd926357e@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=c0a3b77b4831dfa81fc855857bde81755d246bd3

Reported-by: syzbot+4a1eff91eb4e7c1970b6@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=10523a633a4ad9749f57dc7cf03f9447d518c5b8

Reported-by: syzbot+1d3c280f59099dc82e17@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=8e02ebb0da76a8e286461f33502117a1d30275c6

Reported-by: syzbot+080d51214d0634472b12@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=1f617747db8087e5554d3df1b79a545dee26a650

Reported-by: syzbot+dd50b448e49e5020131a@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=f71c8cef4110b7eeac6eca67b6a4d1f4a8b3e96f

Reported-by: syzbot+26b675ecf0cc9dfd8586@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=57b1901f5b3e090a964d08dd0d729f9909f203be

Reported-by: syzbot+87f0df2c9056313a5c4b@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=67994a3da32d075144e25d1ac314be1d9694ae6e

Reported-by: syzbot+e5bc98e18aa42f0cb25d@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=6374bd286532423c63f2b331748280729134224c

Reported-by: syzbot+7e587f4c5aaaf80e84b3@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=976210ed438d48ac275d77d7ebf4a086e43b5fcb

ttycheckoutq(9): wait=0 always, parameter no longer useful, nix it.

XXX kernel revbump

ttwrite(9): Assert we mangle uio_resid only if we also return error.

ttycheckoutq(9): wait is always 0. Assert it; prune dead branches.

There appear to have been no callers with wait=1 since NetBSD 1.0
from a cursory search. Let's nix the parameter altogether on the
next kernel revbump. This logic is probably broken anyway in the
presence of ttycancel, which is necessary for, e.g., yanking USB
serial adapters.

tty(9): New ttylock, ttyunlock, ttylocked functions.

These are wrappers around the global tty_lock for now (and the
continued existence of the tty_lock variable is why the ttylock
function has no underscore in its name). They will assist in
converting drivers to per-tty locking later on.

constty(4): Make MP-safe, take three.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Changes third time around:
- Initialize ttyref_cv so we don't panic when trying to use it,
leading to infinite loop when panic tries to take tty_lock to print
the panic message while we already hold tty_lock.

Revert "constty(4): Make MP-safe."

Something is still busted and this is interfering with the releng
amd64 testbed.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Revert "constty(4): Make MP-safe."

Something appears to be wrong with this.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

tty(9): New function tty_unit for struct cdevsw::d_devtounit.

tty(9): New ttycancel function.

This causes any current and future ttyopens to fail until ttyclose.

This is necessary for revoke to work reliably for device detach like
ucom(4) removable USB devices. A tty driver for a removable device
needs some way to interrupt a pending .d_open so it returns promptly.
But ttyclose only interrupts ttyopen if it's already sleeping; it
won't cause a concurrent .d_open call which _will call_ but _hasn't
yet called_ ttyopen to avoid sleeping. Using ttycancel in the tty
driver's .d_cancel makes this work.

s/runable/runnable/

ttyread_filtops, ttywrite_filtops, ptcread_filtops, and ptcwrite_filtops
are MPSAFE.

Consistently reference kn->kn_data only within the lock perimeter in
the filtops f_event() callback.

Change the kqueue filterops::f_isfd field to filterops::f_flags, and
define a flag FILTEROP_ISFD that has the meaning of the prior f_isfd.
Field and flag name aligned with OpenBSD.

This does not constitute a functional or ABI change, as the field location
and size, and the value placed in that field, are the same as the previous
code, but we're bumping __NetBSD_Version__ so 3rd-party module source code
can adapt, as needed.

NetBSD 9.99.89

Use sel{record,remove}_knote().

branches: 1.294.2;
remove extra break

remove broken copy of TIOCGSID.

TIOCGSID is used by tcgetsid() so it is not really compat :-)
This should reduce loading the compat module.

tty: Negating INT_MIN will overflow int, bail out with EINVAL

Detected by UBSan

Reported-by: syzbot+92c0fca82b74a9798b78@syzkaller.appspotmail.com

tty: Avoid undefined behaviour (left shift of 1 by 31 places overflows int)

The valid sizes of the tty input and output queues (according to the man page)
are between 1024 and 65536 and input values are converted to a power of two.

The check on the validity of the range is done after the input values are
converted, however, which means that a hostile program can attempt to set
the queue size to a negative value, and cause integer overflow before
the range is validated.

Detected by UBSan

Reported-by: syzbot+521b73969fd233c49e58@syzkaller.appspotmail.com

Add a check to prevent shift by -1. Not really important in this case,
but to appease KUBSAN.

Reported-by: syzbot+4026e8201b6b484b8cb4@syzkaller.appspotmail.com

Don't leak an unused sysctl log. Found by kLSan.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Don't crash if we are on a hippie trail, head full of zombie

branches: 1.285.2;
Appease gcc

ttygetinfo(): avoid crash with zombies. From skrll@, tweaked by me.

KNF

Trailing whitespace

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Normalize all the compat hooks' names to the form

<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

- provide a hook for the 43 tty ioctls
- make the 60 tty ioctl hook look the same
- fix the tty code to call both hooks and remove unused lock

Merge the [pgoyette-compat] branch

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.276.2;
correct typo: and and -> and

from chris28.

branches: 1.275.2;
Use C99 initializer for filterops

Mostly done with spatch with touchups for indentation

@@
expression a;
identifier b,c,d;
identifier p;
@@
const struct filterops p =
- { a, b, c, d
+ {
+ .f_isfd = a,
+ .f_attach = b,
+ .f_detach = c,
+ .f_event = d,
};

branches: 1.274.6;
Require exact credential match; this way even if we su to the original user
that created the session, we won't match his credentials.

Weaken the test a bit to still allow non-root to use TIOCSTI; we need to have
the same creds as the session leader process for the tty session.

Only allow root to use TIOCSTI. Don't eat the kauth error number.
It is unexpected for an unprivileged process to gain privs by
typing to root's tty:

$ cat installer
#!/bin/sh
whoami
/usr/sbin/sti /dev/tty whoami\\n

$ su unprivileged -c ./installer
unprivileged
$ whoami
root

branches: 1.271.2;
KNF. Remove extra spaces. No functional change.

Add console-related ioctls.

add the pty ioctls to pass through.

handle the hardware layer tty ioctls directly so that we don't need to load
the compat module for normal operations.

In ttywait_timo(), break out of loop on all errors, not just
EWOULDBLOCK, as ttywait() did prior to 1.265.

to garnish, dust with _KERNEL_OPT

When closing a tty, limit the amount of time spent waiting for the
output to drain to five seconds so that exiting processes with
buffered output for a serial port blocked by flow control or a pty
that is not being read do not hang indefinitely. Should fix PRs
kern/12534 and kern/17171. This is an updated version of the change
of tty.c 1.263.

Revert previous; it broke the lib/libc/ttyio/t_ttyio/ioctl test case.

When closing a tty, limit the amount of time spent waiting for the
output to drain to five seconds so that exiting processes with
buffered output for a serial port blocked by flow control do not
hang indefinitely. Should fix PR kern/12534. OK christos.

branches: 1.262.2;
Don't use catch as a varible name.

Use accessor functions for the tty's table of control characters.
(at least from outside the core tty sources)

Move some xon/xoff code from net/ppp_tty.c to kern/tty.c.

Define TTY_ALLOW_PRIVATE in tty.c, tty_pty.c, and tty_conf.c.

These modules are the core of the tty code that in the long term needs
access to struct tty. (It may be that in the future this can be cut
back to just tty.c; we'll see. For now I'll settle for keeping drivers
out of struct tty.)

branches: 1.259.2;
Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

ttioctl always gets a valid lwp reference. Replace attempt to handle a NULL
reference in only one place with a regular assertion.

branches: 1.257.2;
printflike maintenance.

Add COMPAT_60 versions of the TIOCPTMGET and TIOCPTSNAME ioctls.

Don't call ureadc() with a spinlock held because ureadc() may fault when
writing to userspace.

Provide consistent locking around getc() in ttread(). This is necessary
to prevent crashes in MPSAFE tty drivers like ucom.

branches: 1.253.2;
Better (not racy fix) from Paul Goyette.

Use the queue of the tty not garbage from the stack (Paul Goyette)

PR/46780: Dennis Ferguson: Take the easy way out and return EBUSY when changing
the queue size if the output queue is not empty. Other solutions seemed too
complex/fragile.

PR/41673: Stathis Kamperis: tcsetpgrp returns EINVAL, but should return EPERM.

branches: 1.249.2; 1.249.6; 1.249.8;
extract broken proc_compare. lwp compares against self.

- Introduce a sysctl to control the default tty queue size kern.tty.qsize,
which defaults to 1024 as before.
- Add two ioctls TIOC{G,S}QSIZE to read and adjust the queue size on
individual ptys.

NB: ttys (and ptys) still silently (or beepingly (IMAXBEL)) drop
characters if the queue size is exceeded. I.e. you can appear
to succeed writing to the {p,t}ty, but not all characters will
have made it if the queue overflows. CVS:

Change obsolete CBSIZE constant (48), to a power of two constant (64) that
is close enough to match the original assumptions.

stop using lbolt in tty

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

Rename ttymalloc() to tty_alloc(), and ttyfree() to tty_free() for
consistency. Remove some unnecessary malloc.h inclusions as well.

In ttymalloc() explicitly initialize t_dev to NODEV.
In ptcwakeup() do not bother to wake up a client side if it has not been
opened yet.
The old code would spuriously wakeup the client minor(0) [i.e. ttyp0
typically] or crash the kernel if that wasn't open, see PR kern/40688.
(Old names used to match the PR and test case, adjust names for
/dev/ptm[x] resp. /dev/pts/* accordingly)

fix locking and remove duplicate code.

Cast arguments to vaddr_t when using PRIxVADDR in the printf format string.

Change ^T/SIGINFO to print the PC/CPU# or PC instead of "running"/"runable"
if a port provide LWP_PC.

branches: 1.239.2; 1.239.4;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Update the rest of the kernel to conform to the module subsystem's new
locking protocol.

Remove pfind() and pgfind(), fix locking in various broken uses of these.
Rename real routines to proc_find() and pgrp_find(), remove PFIND_* flags
and have consistent behaviour. Provide proc_find_raw() for special cases.
Fix memory leak in sysctl_proc_corename().

COMPAT_LINUX: rework ptrace() locking, minimise differences between
different versions per-arch.

Note: while this change adds some formal cosmetics for COMPAT_DARWIN and
COMPAT_IRIX - locking there is utterly broken (for ages).

Fixes PR/43176.

update a comment.

Feed dust to a few linkset uses and explicitly call the constructor.

branches: 1.234.2; 1.234.4;
Check for zero length read here - and return zero.
Most times we've come through spec_read() which has already done the test,
but not always (eg pty with ptsfs mounted).
Without this there is a simple local-user panic in ureadc().
Noted Matthew Mondor on tech-kern.

Put the tty opening policy back in the subsystem.

Remove include we don't need from the secmodel code.

Don't return EWOULDBLOCK on an O_NONBLOCK tty file descriptor that has vmin > 0
and vtime > 0. It should be allowed to go to sleep for the sleep interval
indicated in vtime. Reported by der Mouse a long while ago, and this is what
other unixes do.

- Rearrange pg_delete() and pg_remove() (renamed pg_free), thus
proc_enterpgrp() with proc_leavepgrp() to free process group and/or
session without proc_lock held.
- Rename SESSHOLD() and SESSRELE() to to proc_sesshold() and
proc_sessrele(). The later releases proc_lock now.

Quick OK by <ad>.

branches: 1.230.2;
Avoid deadlock in tty code if a terminal emulation responds to
type/status/etc inquiries. (PR kern/37915)
This is clearly a design problem in tty, but we need a cheap fix now.
The problem is that ttyinput() tries to pull a spinlock which
is already held on calls to t_oproc.
The workaround is based on the fact that within wscons code, the
wsdisplay_emulinput() function is only called directly from
wsdisplaystart(). So we can be sure that the tty lock is held,
and use an inofficial entry point in ttc.c which avoids the locking.
These ate certainly more assumptions than needed by the fix
proposed in the PR, but it doesn't affect (and slow down) other
tty drivers.

malloc -> kmem_alloc

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.227.2; 1.227.4;
ttywrite: g/c an unused variable (cnt).

Display t_outcv* channels as "ttyout*", not "ttycan*".

branches: 1.225.2;
- PPWAIT is need only be locked by proc_lock, so move it to proc::p_lflag.
- Remove a few needless lock acquires from exec/fork/exit.
- Sprinkle branch hints.

No functional change.

branches: 1.224.2;
Properly fix the "hanging in tty" bug that was worked around with cv_wakeup()
some time again.

branches: 1.223.2;
use sigismasked. no functional change.

Remove clause 3 and 4 from TNF licenses

branches: 1.221.2;
Merge proc::p_mutex and proc::p_smutex into a single adaptive mutex, since
we no longer need to guard against access from hardware interrupt handlers.

Additionally, if cloning a process with CLONE_SIGHAND, arrange to have the
child process share the parent's lock so that signal state may be kept in
sync. Partially addresses PR kern/37437.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

Give callout_halt() an additional 'kmutex_t *interlock' argument. If there
is a need to block and wait for the callout to complete, and there is an
interlock, it will be dropped while waiting and reacquired before return.

Fix TIOCSIG handling for SIGINFO.

ttygetinfo: fix a locking error in rev.1.215.

ttys are allocated/freed infrequently enough that there is no point having
a seperate pool for them.

Improve ^T / SIGINFO handling:

- Restore code removed during LWPification.
- Don't touch proc state from a hardware interrupt handler.
- Fix the locking.

branches: 1.214.2;
- l_wmesg is not always valid. check l_wchan when using l_wmesg.
should fix a crash reported by Juan RP on current-users@.
- ttyinfo: lock lwp when accessing l_wmesg.
- fill_lwp: add an assertion.

Welcome to 4.99.55:

- Add a lot of missing selinit() and seldestroy() calls.

- Merge selwakeup() and selnotify() calls into a single selnotify().

- Add an additional 'events' argument to selnotify() call. It will
indicate which event (POLL_IN, POLL_OUT, etc) happen. If unknown,
zero may be used.

Note: please pass appropriate value of 'events' where possible.
Proposed on: <tech-kern>

branches: 1.212.2; 1.212.6;
Tons of process scope changes.

- Add a KAUTH_PROCESS_SCHEDULER action, to handle scheduler related
requests, and add specific requests for set/get scheduler policy and
set/get scheduler parameters.

- Add a KAUTH_PROCESS_KEVENT_FILTER action, to handle kevent(2) related
requests.

- Add a KAUTH_DEVICE_TTY_STI action to handle requests to TIOCSTI.

- Add requests for the KAUTH_PROCESS_CANSEE action, indicating what
process information is being looked at (entry itself, args, env,
open files).

- Add requests for the KAUTH_PROCESS_RLIMIT action indicating set/get.

- Add requests for the KAUTH_PROCESS_CORENAME action indicating set/get.

- Make bsd44 secmodel code handle the newly added rqeuests appropriately.

All of the above make it possible to issue finer-grained kauth(9) calls in
many places, removing some KAUTH_GENERIC_ISSUSER requests.

- Remove the "CAN" from KAUTH_PROCESS_CAN{KTRACE,PROCFS,PTRACE,SIGNAL}.

Discussed with christos@ and yamt@.

Merge vmlocking2 to head.

Hang the correct processes when no output/input available. PR kern/37603.
From christos@.

Merge more changes from vmlocking2, mainly:

- Locking improvements.
- Use pool_cache for more items.

branches: 1.208.4;
Remove cn_lwp from struct componentname. curlwp should be used
from on. The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

ttysigintr: proclist_lock can be taken now.

branches: 1.206.2;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

Call ttstart() with tty_lock held.

Work around another funny until I figure out what is going wrong: somehow,
tp->t_rawq.c_cv.cv_waiters is dropping to zero while there are still LWPs
waiting on the queue. dtrace would be really handy here :-/

- Factor out too many copies of the same bit of tty code.
- Fix another tty signalling/wakeup problem.

Fix some problems with the tty signalling code.

Merge tty changes from the vmlocking branch.

Merge scheduler changes from the vmlocking branch. All discussed on
tech-kern:

- Invert priority space so that zero is the lowest priority. Rearrange
number and type of priority levels into bands. Add new bands like
'kernel real time'.
- Ignore the priority level passed to tsleep. Compute priority for
sleep dynamically.
- For SCHED_4BSD, make priority adjustment per-LWP, not per-process.

branches: 1.199.2;
Initialise the callbacks for tty.t_rstrt_ch in ttymalloc
as all drivers but Sun/SPARC's kd.c use the same arguments.
Separate callout_reset into callout_schedule and the initial
callout_setfunc using that.

branches: 1.198.2;
Use selinit() / seldestroy().

branches: 1.197.6; 1.197.8; 1.197.10;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

merge yamt-idlelwp branch. asked by core@. some ports still needs work.

from doc/BRANCHES:

idle lwp, and some changes depending on it.

1. separate context switching and thread scheduling.
(cf. gmcgarry_ctxsw)
2. implement idle lwp.
3. clean up related MD/MI interfaces.
4. make scheduler(s) modular.

Use mutexes/condvars.

branches: 1.194.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.193.2;
- Make the proclist_lock a mutex. The write:read ratio is unfavourable,
and mutexes are cheaper use than RW locks.
- LOCK_ASSERT -> KASSERT in some places.
- Hold proclist_lock/kernel_lock longer in a couple of places.

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Acquire proclist_lock across the p_find() and pg_find() calls while
processing FIOSETOWN and TIOCSPGRP ioctls.

branches: 1.190.2;
Merge newlock2 to head.

Consistent usage of KAUTH_GENERIC_ISSUSER.

Avoid NULL deref (this is called with lwp=NULL from ppp interrupt context)

branches: 1.187.2; 1.187.4;
PR/34129: Andreas Gustafsson: Nonblocking write to pty can return 0
If we cannot write on the slave side, always return EWOULDBLOCK in the
non-blocking case, because we don't know that the buffer we started
writing is actually in a system call boundary.

Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

Grr, change the code so that it compiles with gcc-3. It was ok with gcc-4.

Introduce SA_NOKERNINFO, a flag for SIGINFO not to print kernel messages.

branches: 1.182.2;
integrate kauth.

quell GCC 4.1 uninitialised variable warnings.

XXX: we should audit the tree for which old ones are no longer needed
after getting the older compilers out of the tree..

branches: 1.180.2; 1.180.4;
Move ISSET/SET/CLR macros to sys/types.h

branches: 1.179.4; 1.179.6; 1.179.8;
u_intN_t -> uintN_t

merge ktrace-lwp.

Overhaul how TTY line disciplines are handled:
- Replace references to linesw[0] with a ttyldisc_default() function
that returns the default ("termios") line discipline.
- The linesw[] array is gone, replaced by a linked list.
- ttyldisc_add() and ttyldisc_remove() have been replaced by
ttyldisc_attach() and ttyldisc_detach().
- Things that provide line disciplines are now responsible for
registering those disciplines with the system. The linesw
structures are no longer declared in tty_conf.c
- Line disciplines are now refcounted; a lookup causes a reference to
be held. ttyldisc_release() releases the reference. Attempts to
detach an in-use line discipline result in EBUSY.
- Fix function signature lossage in if_sl.c, if_strip.c, and tty_tb.c
that was masked by the old tty_conf.c
- tty_init() is no longer necessary; delete it and its call from main().

branches: 1.176.6;
- lock the tty when playing with the kqueue list.
- don't return 1, when we expect to return errno [EPERM is kind of stupid
in this case :-)]

In the SIGIO case, only check that we are the controlling tty if we are a
session leader.

Allow F{G,S}OWN to succeed on a tty that has no session associated with it,
and it is not the controlling tty. This change allows us to use SIGIO on
a non-controlling tty (eg. debug ntpd with a refclock on a tty).

branches: 1.173.2;
Remove an extraneous TTY_UNLOCK. With a LOCKDEBUG kernel, sending FLUSHO
causes a locking assertion.

Panic strings should not end with \n.

nuke trailing whitespace

branches: 1.170.4; 1.170.6;
Add support for FIONWRITE and FIONSPACE ioctls. FIONWRITE reports
the number of bytes in the send queue, and FIONSPACE reports the
number of free bytes in the send queue. These ioctls permit applications
to monitor file descriptor transmission dynamics.

In examining prior art, FIONWRITE exists with the semantics given
here. FIONSPACE is provided so that programs may easily determine how
much space is left in the send queue; they do not need to know the
send queue size.

The fact that a write may block even if there is enough space in the
send queue for it is noted in the documentation.

FIONWRITE functionality may be used to implement TIOCOUTQ for Linux
emulation - Linux extended this ioctl to sockets, even though they are
not ttys.

Don't initialize ttylist or tty_count in tty_init().

Remaining sysctl descriptions under kern subtree

Initialise (most) pools from a link set instead of explicit calls
to pool_init. Untouched pools are ones that either in arch-specific
code, or aren't initialiased during initial system startup.

Convert struct session, ucred and lockf to pools.

Constify the table argument to ttspeedtab.

branches: 1.165.2;
Tango on sysctl_createv() and flags. The flags have all been renamed,
and sysctl_createv() now uses more arguments.

add more spltty() calls around TTY_LOCK/UNLOCK where needed

add some spltty() calls around TTY_LOCK() calls that didn't have them

use the new NOTE_SUBMIT to flag if the locking is necessary
for EVFILT_READ/EVFILT_WRITE knotes

fixes PR kern/23915 by Martin Husemann (pipes), and similar locking problem
in tty code

Uppercase CPU, plural is CPUs.

ioctl TIOCSCTTY: re-arrange SESSHOLD() calls to allow for better code generation.

Dynamic sysctl.

Gone are the old kern_sysctl(), cpu_sysctl(), hw_sysctl(),
vfs_sysctl(), etc, routines, along with sysctl_int() et al. Now all
nodes are registered with the tree, and nodes can be added (or
removed) easily, and I/O to and from the tree is handled generically.

Since the nodes are registered with the tree, the mapping from name to
number (and back again) can now be discovered, instead of having to be
hard coded. Adding new nodes to the tree is likewise much simpler --
the new infrastructure handles almost all the work for simple types,
and just about anything else can be done with a small helper function.

All existing nodes are where they were before (numerically speaking),
so all existing consumers of sysctl information should notice no
difference.

PS - I'm sorry, but there's a distinct lack of documentation at the
moment. I'm working on sysctl(3/8/9) right now, and I promise to
watch out for buses.

cleanup & uniform descriptor owner handling:
* introduce fsetown(), fgetown(), fownsignal() - this sets/retrieves/signals
the owner of descriptor, according to appropriate sematics
of TIOCSPGRP/FIOSETOWN/SIOCSPGRP/TIOCGPGRP/FIOGETOWN/SIOCGPGRP ioctl; use
these routines instead of custom code where appropriate
* make every place handling TIOCSPGRP/TIOCGPGRP handle also FIOSETOWN/FIOGETOWN
properly, and remove the translation of FIO[SG]OWN to TIOC[SG]PGRP
in sys_ioctl() & sys_fcntl()
* also remove the socket-specific hack in sys_ioctl()/sys_fcntl() and
pass the ioctls down to soo_ioctl() as any other ioctl

change discussed on tech-kern@

Extra sanity checks: all char devices won't have an associated tty.

Rework VTIME calculations so that they don't hit numeric overflow (ok now
for hz < ~200kHz). Old code failed VTIME > 214 even with hz=100.
Fixes kern/12285.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.154.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

use VREAD instead of VWRITE, this ioctl is used to redirect console output.

PR/732: Matt Green: TIOCCONS should work if the user owns /dev/console.

Alternative pid/proc allocater, removes all searches associated with pid
lookup and allocation, and any dependency on NPROC or MAXUSERS.
NO_PID changed to -1 (and renamed NO_PGID) to remove artificial limit
on PID_MAX.
As discussed on tech-kern.

Add a ttyprintf_nolock() to be called when we are printing the ttyinfo
stuff, since we already have the lock.
Adjust tputchar so that it does not lock, when NOLOCK is passed in flags.

XXX ttioctl(): some drivers call back on us from t_param(), so delay acquiring
tty spin lock until after t_param() returns.

Require t_param() to unlock upon callback?

Make the tty subsystem MP-safe..

..as far as mere mortals are able to, since this code illustrates the finest
points that Italian haute cuisine has to offer.

Make the char_type array "unsigned char" since we stuff values > 0x80
into it.

Merge the nathanw_sa branch.

si_ -> sel_ to avoid conflicts with siginfo.

merge kqueue branch into -current

kqueue provides a stateful and efficient event notification framework
currently supported events include socket, file, directory, fifo,
pipe, tty and device changes, and monitoring of processes and signals

kqueue is supported by all writable filesystems in NetBSD tree
(with exception of Coda) and all device drivers supporting poll(2)

based on work done by Jonathan Lemon for FreeBSD
initial NetBSD port done by Luke Mewburn and Jason Thorpe

Merge the gehenna-devsw branch into the trunk.

This merge changes the device switch tables from static array to
dynamically generated by config(8).

- All device switches is defined as a constant structure in device drivers.

- The new grammer ``device-major'' is introduced to ``files''.

device-major <prefix> char <num> [block <num>] [<rules>]

- All device major numbers must be listed up in port dependent majors.<arch>
by using this grammer.

- Added the new naming convention.
The name of the device switch must be <prefix>_[bc]devsw for auto-generation
of device switch tables.

- The backward compatibility of loading block/character device
switch by LKM framework is broken. This is necessary to convert
from block/character device major to device name in runtime and vice versa.

- The restriction to assign device major by LKM is completely removed.
We don't need to reserve LKM entries for dynamic loading of device switch.

- In compile time, device major numbers list is packed into the kernel and
the LKM framework will refer it to assign device major number dynamically.

Use the queue macros from <sys/queue.h> instead of referring to the queue
members directly. Use *_FOREACH whenever possible.

Avoid signed/unsigned comparison warnings from GCC 3.3.

Make sure repeated TIOCSCTTY doesn't corrupt session hold count.
Fixes kern/17382 by David Laight.

branches: 1.138.2; 1.138.4;
- Fix more and more white space nits.
- ANSIfy the last K&R function definition in this file.

Fix a white-space nit.

Use SESSHOLD and SESSRELE consistently.
Add SESSHOLD and SESSRELE to the t_session, so that we don't have dangling
references [inspired by OpenBSD].

Print ttyinfo *before* (not after) sending SIGINFO to processes.
This generates more useful information of a process who catches SIGINFO,
rather than always printing "runnable" (the process is marked runnable
because of the signal).
Inspired by the behavior of BSD/OS.

Convert ioctl code to use EPASSTHROUGH instead of -1 or ENOTTY for
indicating an unhandled "command". ERESTART is -1, which can lead to
confusion. ERESTART has been moved to -3 and EPASSTHROUGH has been
placed at -4. No ioctl code should now return -1 anywhere. The
ioctl() system call is now properly restartable.

Pool deals fairly well with physical memory shortage, but it doesn't
deal with shortages of the VM maps where the backing pages are mapped
(usually kmem_map). Try to deal with this:

* Group all information about the backend allocator for a pool in a
separate structure. The pool references this structure, rather than
the individual fields.
* Change the pool_init() API accordingly, and adjust all callers.
* Link all pools using the same backend allocator on a list.
* The backend allocator is responsible for waiting for physical memory
to become available, but will still fail if it cannot callocate KVA
space for the pages. If this happens, carefully drain all pools using
the same backend allocator, so that some KVA space can be freed.
* Change pool_reclaim() to indicate if it actually succeeded in freeing
some pages, and use that information to make draining easier and more
efficient.
* Get rid of PR_URGENT. There was only one use of it, and it could be
dealt with by the caller.

From art@openbsd.org.

nlinesw is already declared in <sys/conf.h>.

Andrew Brown found that we overflowed all cases in the TTLINEDNAMELEN.
ouch.

Add sysctls to read tk_{nin,nout,cancc,rawcc} (under a kern.tkstat node).
"extern" those variables in <sys/dkstat.h>, and add declarations for them
in sys/tty.c

add RCSIDs

branches: 1.128.2; 1.128.4; 1.128.6;
Add `l_poll' to `struct linesw' and provide an xxxpoll() entry point
in each tty driver to indirect through it.

This allows tty line-disciplines to handle poll(2) system calls.

Remove unnecessary test of tp->t_linesw against NULL; they are results
of confusion while correcting compilation error after t_line is
replaced with t_linesw.

convert to ANSI KNF

branches: 1.125.2;
split off thread specific stuff from struct sigacts to struct sigctx, leaving
only signal handler array sharable between threads
move other random signal stuff from struct proc to struct sigctx

This addresses kern/10981 by Matthew Orgass.

Don't allow t_linesw to be NULL.

NBPG -> PAGE_SIZE

add new function sigismasked(), which checks whether passed signal
is ignored or masked by the process, and use it appropriately
instead of directly checking p->p_sigmask and p->p_sigignore

Make line disciplines modular so they can be added or removed dynamically.

remove include of <vm/vm.h>

branches: 1.119.4;
Introduce a new process state distinct from SRUN called SONPROC
which indicates that the process is actually running on a
processor. Test against SONPROC as appropriate rather than
combinations of SRUN and curproc. Update all context switch code
to properly set SONPROC when the process becomes the current
process on the CPU.

Get rid of register declarations.

Cast timeval members to types we know the printf conversions of.

New callout mechanism with two major improvements over the old
timeout()/untimeout() API:
- Clients supply callout handle storage, thus eliminating problems of
resource allocation.
- Insertion and removal of callouts is constant time, important as
this facility is used quite a lot in the kernel.

The old timeout()/untimeout() API has been removed from the kernel.

branches: 1.115.2;
Fix NULL pointer access. Patch supplied by Dave Huang in PR kern/8055.

Rework the process exit path, in preparation for making process exit
and PID allocation MP-safe. A new process state is added: SDEAD. This
state indicates that a process is dead, but not yet a zombie (has not
yet been processed by the process reaper).

SDEAD processes exist on both the zombproc list (via p_list) and deadproc
(via p_hash; the proc has been removed from the pidhash earlier in the exit
path). When the reaper deals with a process, it changes the state to
SZOMB, so that wait4 can process it.

Add a P_ZOMBIE() macro, which treats a proc in SZOMB or SDEAD as a zombie,
and update various parts of the kernel to reflect the new state.

g/c REAL_CLISTS.

branches: 1.112.8;
Substantial signal handling changes:
* Increase the size of sigset_t to accomodate 128 signals -- adding new
versions of sys_setprocmask(), sys_sigaction(), sys_sigpending() and
sys_sigsuspend() to handle the changed arguments.
* Abstract the guts of sys_sigaltstack(), sys_setprocmask(), sys_sigaction(),
sys_sigpending() and sys_sigsuspend() into separate functions, and call them
from all the emulations rather than hard-coding everything. (Avoids uses
the stackgap crap for these system calls.)
* Add a new flag (p_checksig) to indicate that a process may have signals
pending and userret() needs to do the full (slow) check.
* Eliminate SAS_ALTSTACK; it's exactly the inverse of SS_DISABLE.
* Correct emulation bugs with restoring SS_ONSTACK.
* Make the signal mask in the sigcontext always use the emulated mask format.
* Store signals internally in sigaction structures, rather than maintaining a
bunch of little sigsets for each SA_* bit.
* Keep track of where we put the signal trampoline, rather than figuring it out
in *_sendsig().
* Issue a warning when a non-emulated sigaction bit is observed.
* Add missing emulated signals, and a native SIGPWR (currently not used).
* Implement the `not reset when caught' semantics for relevant signals.

Note: Only code touched by the i386 port has been modified. Other ports and
emulations need to be updated.

Use the pool allocator and the "nointr" pool page allocator for tty
structures.

Add some braces to make egcs happy (ambiguous else warning).

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

fix sizeofs so they comply with the KNF style guide. yes, it is pedantic.

branches: 1.107.2;
Move the code to wait for carrier on a tty into a common function, since it
depends only on device-independent state bits.
Implement SunOS-style `dialout' devices.

Replace TS_WOPEN with t_wopen, per mail on tech-kern.

Merge with Lite2 + local changes

Implement TIOCGSID.

Add ONOCR and ONLRET output modes, from XPG4.2.

Fix variable declarations: register -> register int.

Make ttyblock() work as intended and documented in canonical mode.
(operator precedence problem)
closes PR kern/2131 (Matthias Pfaller)

defopt UCONSOLE

branches: 1.99.2;
Count characters even when !OPOST and FLUSHO.
Don't output the \r for ONLCR if FLUSHO.

Make various standard wmesg strings const.

Make wmesg arguments to various functions const.

branches: 1.96.4; 1.96.6;
Add some robustness to ttymodem(), e.g. do not SIGHUP when there hasn't been
an actual carrier transition; from Charles M. Hannum.

When a background process attempts to TIOC[CS]BRK (a.k.a. tcsendbreak()) or
TIOCSTART (a.k.a tcflow()), send its process group a SIGTTOU.

Rewrote break/parity/framing error handling from spec.

If the pgrp_id argument of TIOCSPGRP (a.k.a. tcsetpgrp()) does not specify
an existing process group, return EINVAL.

When a background process attempts to TIOCDRAIN (a.k.a. tcdrain()), send
its process group a SIGTTOU signal.

Fix printf format botch.

Eliminate vmspace.vm_pmap and all references to it unless
__VM_PMAP_HACK is defined (for temporary compatibility).
The __VM_PMAP_HACK code should be removed after all the
ports that define it have removed all vm_pmap references.

Fix a CRNL/NLCR botch I made after looking this up in the X/Open spec.
Fixes PR 3453; from John Kohl and Enami Tsugutomo.

Add some clarification about the TTBREAKC macro's purpose; suggested by
Chris G. Demetriou.

fix missing parenthesis in TTBREAKC()

If TOSTOP is set, and the process group of the writing process is orphaned,
and the writing process is not ignoring or blocking SIGTTOU, do not signal
the process but return EIO.

Recognize EOL2 as a delimiter/"break" character only if IEXTEN is set.

Remove unintended piece of last change.

Fix several bugs related to MDMBUF. Also, remove the partial handling from
ttymodem(); it's not complete, it's better done in the driver, and only the
com driver ever supported it anyway.

As specified in POSIX.1 (and termios(4)!), when cc[VMIN]==0 a read() shall
be satisfied by any amount of data actually read.

WERASE, REPRINT, STATUS and DSUSP are extensions to the POSIX.1 GTI
set of special characters: recognize them only if IEXTEN is set.

KNF glitch in last commit, pointed out by Chris G. Demetriou.

Implement OCRNL "\r" -> "\n" tty output translation.
Fixes PR standards/3434.

PR/3396: Klaus Klein: If CREAD is not set drop incoming data.

don't thow away char_type's 'const'ness via a cast when passing it to scanc().
(1) that causes -Wcast-qual to be unhappy, and (2) the cast is unnecessary!

backout previous kprintf change

printf -> kprintf, sprintf -> ksprintf

Implement poll(2).

don't tty_detach() in ttyfree(). make the user of ttyfree() do
the tty_detach() as not all ttymalloc()'ed ttys are tty_attach()ed.

add a comment on how to use tty_attach().

a few minor KNF nits

check tty_count first (from cgd).

impliment ttylist stats based on disk stats.

branches: 1.68.4;
Fix another printf format warning.

Fix printf() formats.

More proto fixes

First pass at prototyping

Correct test for ECHONL (from der Mouse; PR#1922).

branches: 1.63.2;
Add hooks for COMPAT_FREEBSD, from Noriyuki Soda.

fix annoying but non-critical rounding but in ttyinfo(). (If
microseconds goes over 10^6 when rounding, increment seconds.)

Close routines take file flags, not I/O flags. Fix two incorrect usages.

Only do software flow control if IXOFF is set. Also fix hardware flow control
case in ttyblock().

Use ISSET() and CLR() in two cases.

Change ttselect() to use a callback to get the tty structure.

Added ifdef COMPAT_SVR4 to the kernel compat code needed.

Change argument list of ttioctl() to match other ioctl functions.

be more careful with types, also pull in headers where necessary.

Fix a bug I introduced in the last commit, regarding a VTIME timeout causing
EWOULDBLOCK to be returned rather than looping again to see if any characters
are pending. Also, fix another bug in the original code; if someone changed
VMIN behind our back, last_cc might be uninitialized when we reference it.

Remove the need for some untimeouts.

fix PR#484 relating to backspacing over a tab.

Convert process, file, and namei lists and hash tables to use queue.h.

Clear t_flags on first open.

branches: 1.49.2;
New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

use u_char's instead of char's; else the TTY_QUOTE bit can get accidentally
be set.

upgrade to 4.4-Lite's tty code. our bug fixes included, some might need GC.

lots of changes: prototype migration, move lots of variables, definitions,
and structure elements around. kill some unnecessary type and macro
definitions. standardize clock handling. More changes than you'd want.

Rename a lot of process flags.

FIONREAD plays with an int, not an off_t.

fix somebody's typo

add hw input flow control support

Don't do TIOCHPCL if !COMPAT_43. In the new world, you use termios.

Return a legitimate value from ttylclose().

Don't send SIGINFO if ISIG off.

Some formatting changes.

(Hopefully) do the right thing with VTIME > 0 and select

All ioctl routines take a struct proc * now.

more untimouts needed, from someone at freebsd

undo totally misguided changes from Andrew Chernov in rev. 1.7:
RTS has nothing to do with ttyblock()
also, close a race.

more COMPAT_SUNOS changes.

do the *right* thing with resident set size

really fix the tab code

from Mike Karels <karels@bsdi.com>: clear the PENDIN flag if ICANON
is cleared, and retain the PENDIN flag if set when ICANON is set

print out what we think is the resident set size. very nasty; the field
in the proc's vmspace struct should be updated, but isn't...
Also, if the process is a zombie or infantile, don't print, because
that could cause a null pointer deref.

OXTABS expansion was putting fewer than the required spaces if the clists
became full. we now retry the tab expansion later.

load average changes from magnum

Canonicalize all #includes.

fix from Daniel Harris <daniel@werple.apana.org.au>
VTIME code must untimeout

VMIN/VTIME support from Marc Teitelbaum <marc@vangogh.cs.berkeley.edu>

echo ^V^? correctly as ^?. From Edward Wang <edward@homer.CS.Berkeley.EDU>

branches: 1.22.2;
If ospeed is set to 0, SIGHUP the session leader (if any).

Add RCS identifiers (this time on the correct side of the branch), and
incorporate recent changes in netbsd-0-9 branch.

branches: 1.20.2;
Move flushq() macro into tty.h.

Use flushq() macro instead.

Use ndflush(), not while(getc()).

Change tty code to use clist interface, but with ring buffer implementation.
Also, fix a couple of bugs in tty.c and pccons.c, and some gross kluginess
in the hp300 stuff.

re-add two changes which had been deleted by commit of r1.7

Blasted ftpd!

Fix bugs in rb_write and rb_cwrite, and make tab handling use rb_cwrite.

Fix a situation where we might forget to splx().

* ansifications
* question about whether the "tp->t_state |= TS_ISOPEN" in ttyopen() should
be shifted to the end of the block in which it appears.

Fixed ECHONL.

make getc() and ungetc() be rb{un,}getc(), so getc() and ungetc()
don't conflict w/ansi prototypes...

tty dynamic allocation

make kernel select interface be one-stop shopping & clean it all up.

various 8-bit patches from Andrew Chernov <ache@astral.msk.su>
tty_compat.c is cleaned up, as is STOP+TIOCSTI in tty.c

from Luke Mewburn <zak@rmit.edu.au>:
add TIOCSTAT ioctl to give load average stats if requested (for tcsh)

ring buffer now uses rbchar's (shorts) instead of chars.

Oops. Inserted at the wrong place.

Handle one-word cases in word-erase.

after 0.2.2 "stable" patches applied

branches: 1.1.1;
Initial revision

tty(9): Make ttwrite update uio with only how much it has consumed.

As is, it leaves uio in an inconsistent state. Good enough for the
write(2) return value to be correct for a userland caller to restart
write(2) where it left off, but not good enough for a loop in the
kernel to reuse the same uio.

Reported-by: syzbot+e0f56178d0add0d8be20@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=6290eb02b8fe73361dc15c7bc44e1208601e6af8

Reported-by: syzbot+7caa189e8fccd926357e@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=c0a3b77b4831dfa81fc855857bde81755d246bd3

Reported-by: syzbot+4a1eff91eb4e7c1970b6@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=10523a633a4ad9749f57dc7cf03f9447d518c5b8

Reported-by: syzbot+1d3c280f59099dc82e17@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=8e02ebb0da76a8e286461f33502117a1d30275c6

Reported-by: syzbot+080d51214d0634472b12@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=1f617747db8087e5554d3df1b79a545dee26a650

Reported-by: syzbot+dd50b448e49e5020131a@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=f71c8cef4110b7eeac6eca67b6a4d1f4a8b3e96f

Reported-by: syzbot+26b675ecf0cc9dfd8586@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=57b1901f5b3e090a964d08dd0d729f9909f203be

Reported-by: syzbot+87f0df2c9056313a5c4b@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=67994a3da32d075144e25d1ac314be1d9694ae6e

Reported-by: syzbot+e5bc98e18aa42f0cb25d@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=6374bd286532423c63f2b331748280729134224c

Reported-by: syzbot+7e587f4c5aaaf80e84b3@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=976210ed438d48ac275d77d7ebf4a086e43b5fcb

ttycheckoutq(9): wait=0 always, parameter no longer useful, nix it.

XXX kernel revbump

ttwrite(9): Assert we mangle uio_resid only if we also return error.

ttycheckoutq(9): wait is always 0. Assert it; prune dead branches.

There appear to have been no callers with wait=1 since NetBSD 1.0
from a cursory search. Let's nix the parameter altogether on the
next kernel revbump. This logic is probably broken anyway in the
presence of ttycancel, which is necessary for, e.g., yanking USB
serial adapters.

tty(9): New ttylock, ttyunlock, ttylocked functions.

These are wrappers around the global tty_lock for now (and the
continued existence of the tty_lock variable is why the ttylock
function has no underscore in its name). They will assist in
converting drivers to per-tty locking later on.

constty(4): Make MP-safe, take three.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Changes third time around:
- Initialize ttyref_cv so we don't panic when trying to use it,
leading to infinite loop when panic tries to take tty_lock to print
the panic message while we already hold tty_lock.

Revert "constty(4): Make MP-safe."

Something is still busted and this is interfering with the releng
amd64 testbed.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Revert "constty(4): Make MP-safe."

Something appears to be wrong with this.

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
only under the new adaptive constty_lock in thread context. This
serializes TIOCCONS operations and ensures unlocked readers can
safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
allowed in any context -- printf(9) uses this to disable a broken
constty.

3. Reading constty under constty_lock is allowed with
atomic_load_relaxed, because while constty_lock is held, it can
only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
atomic_load_consume in a pserialize read section -- constty is
only ever made nonnull with atomic_store_release, in (1).
ttyclose will wait for all these pserialize read sections to
complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
pserialize read section has completed, caller must use tty_acquire
during the pserialize read section and then tty_release when done.
ttyclose will wait for all these references to drain before
returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty. Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

tty(9): New function tty_unit for struct cdevsw::d_devtounit.

tty(9): New ttycancel function.

This causes any current and future ttyopens to fail until ttyclose.

This is necessary for revoke to work reliably for device detach like
ucom(4) removable USB devices. A tty driver for a removable device
needs some way to interrupt a pending .d_open so it returns promptly.
But ttyclose only interrupts ttyopen if it's already sleeping; it
won't cause a concurrent .d_open call which _will call_ but _hasn't
yet called_ ttyopen to avoid sleeping. Using ttycancel in the tty
driver's .d_cancel makes this work.

s/runable/runnable/

ttyread_filtops, ttywrite_filtops, ptcread_filtops, and ptcwrite_filtops
are MPSAFE.

Consistently reference kn->kn_data only within the lock perimeter in
the filtops f_event() callback.

Change the kqueue filterops::f_isfd field to filterops::f_flags, and
define a flag FILTEROP_ISFD that has the meaning of the prior f_isfd.
Field and flag name aligned with OpenBSD.

This does not constitute a functional or ABI change, as the field location
and size, and the value placed in that field, are the same as the previous
code, but we're bumping __NetBSD_Version__ so 3rd-party module source code
can adapt, as needed.

NetBSD 9.99.89

Use sel{record,remove}_knote().

branches: 1.294.2;
remove extra break

remove broken copy of TIOCGSID.

TIOCGSID is used by tcgetsid() so it is not really compat :-)
This should reduce loading the compat module.

tty: Negating INT_MIN will overflow int, bail out with EINVAL

Detected by UBSan

Reported-by: syzbot+92c0fca82b74a9798b78@syzkaller.appspotmail.com

tty: Avoid undefined behaviour (left shift of 1 by 31 places overflows int)

The valid sizes of the tty input and output queues (according to the man page)
are between 1024 and 65536 and input values are converted to a power of two.

The check on the validity of the range is done after the input values are
converted, however, which means that a hostile program can attempt to set
the queue size to a negative value, and cause integer overflow before
the range is validated.

Detected by UBSan

Reported-by: syzbot+521b73969fd233c49e58@syzkaller.appspotmail.com

Add a check to prevent shift by -1. Not really important in this case,
but to appease KUBSAN.

Reported-by: syzbot+4026e8201b6b484b8cb4@syzkaller.appspotmail.com

Don't leak an unused sysctl log. Found by kLSan.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Don't crash if we are on a hippie trail, head full of zombie

branches: 1.285.2;
Appease gcc

ttygetinfo(): avoid crash with zombies. From skrll@, tweaked by me.

KNF

Trailing whitespace

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Normalize all the compat hooks' names to the form

<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

- provide a hook for the 43 tty ioctls
- make the 60 tty ioctl hook look the same
- fix the tty code to call both hooks and remove unused lock

Merge the [pgoyette-compat] branch

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.276.2;
correct typo: and and -> and

from chris28.

branches: 1.275.2;
Use C99 initializer for filterops

Mostly done with spatch with touchups for indentation

@@
expression a;
identifier b,c,d;
identifier p;
@@
const struct filterops p =
- { a, b, c, d
+ {
+ .f_isfd = a,
+ .f_attach = b,
+ .f_detach = c,
+ .f_event = d,
};

branches: 1.274.6;
Require exact credential match; this way even if we su to the original user
that created the session, we won't match his credentials.

Weaken the test a bit to still allow non-root to use TIOCSTI; we need to have
the same creds as the session leader process for the tty session.

Only allow root to use TIOCSTI. Don't eat the kauth error number.
It is unexpected for an unprivileged process to gain privs by
typing to root's tty:

$ cat installer
#!/bin/sh
whoami
/usr/sbin/sti /dev/tty whoami\\n

$ su unprivileged -c ./installer
unprivileged
$ whoami
root

branches: 1.271.2;
KNF. Remove extra spaces. No functional change.

Add console-related ioctls.

add the pty ioctls to pass through.

handle the hardware layer tty ioctls directly so that we don't need to load
the compat module for normal operations.

In ttywait_timo(), break out of loop on all errors, not just
EWOULDBLOCK, as ttywait() did prior to 1.265.

to garnish, dust with _KERNEL_OPT

When closing a tty, limit the amount of time spent waiting for the
output to drain to five seconds so that exiting processes with
buffered output for a serial port blocked by flow control or a pty
that is not being read do not hang indefinitely. Should fix PRs
kern/12534 and kern/17171. This is an updated version of the change
of tty.c 1.263.

Revert previous; it broke the lib/libc/ttyio/t_ttyio/ioctl test case.

When closing a tty, limit the amount of time spent waiting for the
output to drain to five seconds so that exiting processes with
buffered output for a serial port blocked by flow control do not
hang indefinitely. Should fix PR kern/12534. OK christos.

branches: 1.262.2;
Don't use catch as a varible name.

Use accessor functions for the tty's table of control characters.
(at least from outside the core tty sources)

Move some xon/xoff code from net/ppp_tty.c to kern/tty.c.

Define TTY_ALLOW_PRIVATE in tty.c, tty_pty.c, and tty_conf.c.

These modules are the core of the tty code that in the long term needs
access to struct tty. (It may be that in the future this can be cut
back to just tty.c; we'll see. For now I'll settle for keeping drivers
out of struct tty.)

branches: 1.259.2;
Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

ttioctl always gets a valid lwp reference. Replace attempt to handle a NULL
reference in only one place with a regular assertion.

branches: 1.257.2;
printflike maintenance.

Add COMPAT_60 versions of the TIOCPTMGET and TIOCPTSNAME ioctls.

Don't call ureadc() with a spinlock held because ureadc() may fault when
writing to userspace.

Provide consistent locking around getc() in ttread(). This is necessary
to prevent crashes in MPSAFE tty drivers like ucom.

branches: 1.253.2;
Better (not racy fix) from Paul Goyette.

Use the queue of the tty not garbage from the stack (Paul Goyette)

PR/46780: Dennis Ferguson: Take the easy way out and return EBUSY when changing
the queue size if the output queue is not empty. Other solutions seemed too
complex/fragile.

PR/41673: Stathis Kamperis: tcsetpgrp returns EINVAL, but should return EPERM.

branches: 1.249.2; 1.249.6; 1.249.8;
extract broken proc_compare. lwp compares against self.

- Introduce a sysctl to control the default tty queue size kern.tty.qsize,
which defaults to 1024 as before.
- Add two ioctls TIOC{G,S}QSIZE to read and adjust the queue size on
individual ptys.

NB: ttys (and ptys) still silently (or beepingly (IMAXBEL)) drop
characters if the queue size is exceeded. I.e. you can appear
to succeed writing to the {p,t}ty, but not all characters will
have made it if the queue overflows. CVS:

Change obsolete CBSIZE constant (48), to a power of two constant (64) that
is close enough to match the original assumptions.

stop using lbolt in tty

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

Rename ttymalloc() to tty_alloc(), and ttyfree() to tty_free() for
consistency. Remove some unnecessary malloc.h inclusions as well.

In ttymalloc() explicitly initialize t_dev to NODEV.
In ptcwakeup() do not bother to wake up a client side if it has not been
opened yet.
The old code would spuriously wakeup the client minor(0) [i.e. ttyp0
typically] or crash the kernel if that wasn't open, see PR kern/40688.
(Old names used to match the PR and test case, adjust names for
/dev/ptm[x] resp. /dev/pts/* accordingly)

fix locking and remove duplicate code.

Cast arguments to vaddr_t when using PRIxVADDR in the printf format string.

Change ^T/SIGINFO to print the PC/CPU# or PC instead of "running"/"runable"
if a port provide LWP_PC.

branches: 1.239.2; 1.239.4;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Update the rest of the kernel to conform to the module subsystem's new
locking protocol.

Remove pfind() and pgfind(), fix locking in various broken uses of these.
Rename real routines to proc_find() and pgrp_find(), remove PFIND_* flags
and have consistent behaviour. Provide proc_find_raw() for special cases.
Fix memory leak in sysctl_proc_corename().

COMPAT_LINUX: rework ptrace() locking, minimise differences between
different versions per-arch.

Note: while this change adds some formal cosmetics for COMPAT_DARWIN and
COMPAT_IRIX - locking there is utterly broken (for ages).

Fixes PR/43176.

update a comment.

Feed dust to a few linkset uses and explicitly call the constructor.

branches: 1.234.2; 1.234.4;
Check for zero length read here - and return zero.
Most times we've come through spec_read() which has already done the test,
but not always (eg pty with ptsfs mounted).
Without this there is a simple local-user panic in ureadc().
Noted Matthew Mondor on tech-kern.

Put the tty opening policy back in the subsystem.

Remove include we don't need from the secmodel code.

Don't return EWOULDBLOCK on an O_NONBLOCK tty file descriptor that has vmin > 0
and vtime > 0. It should be allowed to go to sleep for the sleep interval
indicated in vtime. Reported by der Mouse a long while ago, and this is what
other unixes do.

- Rearrange pg_delete() and pg_remove() (renamed pg_free), thus
proc_enterpgrp() with proc_leavepgrp() to free process group and/or
session without proc_lock held.
- Rename SESSHOLD() and SESSRELE() to to proc_sesshold() and
proc_sessrele(). The later releases proc_lock now.

Quick OK by <ad>.

branches: 1.230.2;
Avoid deadlock in tty code if a terminal emulation responds to
type/status/etc inquiries. (PR kern/37915)
This is clearly a design problem in tty, but we need a cheap fix now.
The problem is that ttyinput() tries to pull a spinlock which
is already held on calls to t_oproc.
The workaround is based on the fact that within wscons code, the
wsdisplay_emulinput() function is only called directly from
wsdisplaystart(). So we can be sure that the tty lock is held,
and use an inofficial entry point in ttc.c which avoids the locking.
These ate certainly more assumptions than needed by the fix
proposed in the PR, but it doesn't affect (and slow down) other
tty drivers.

malloc -> kmem_alloc

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.227.2; 1.227.4;
ttywrite: g/c an unused variable (cnt).

Display t_outcv* channels as "ttyout*", not "ttycan*".

branches: 1.225.2;
- PPWAIT is need only be locked by proc_lock, so move it to proc::p_lflag.
- Remove a few needless lock acquires from exec/fork/exit.
- Sprinkle branch hints.

No functional change.

branches: 1.224.2;
Properly fix the "hanging in tty" bug that was worked around with cv_wakeup()
some time again.

branches: 1.223.2;
use sigismasked. no functional change.

Remove clause 3 and 4 from TNF licenses

branches: 1.221.2;
Merge proc::p_mutex and proc::p_smutex into a single adaptive mutex, since
we no longer need to guard against access from hardware interrupt handlers.

Additionally, if cloning a process with CLONE_SIGHAND, arrange to have the
child process share the parent's lock so that signal state may be kept in
sync. Partially addresses PR kern/37437.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

Give callout_halt() an additional 'kmutex_t *interlock' argument. If there
is a need to block and wait for the callout to complete, and there is an
interlock, it will be dropped while waiting and reacquired before return.

Fix TIOCSIG handling for SIGINFO.

ttygetinfo: fix a locking error in rev.1.215.

ttys are allocated/freed infrequently enough that there is no point having
a seperate pool for them.

Improve ^T / SIGINFO handling:

- Restore code removed during LWPification.
- Don't touch proc state from a hardware interrupt handler.
- Fix the locking.