PR/58227: Ricardo Branco: Add support for proc/sysvipc in Linux emulator

PR/58240: Ricardo Branco: Add support for proc/self/limits as used by Linux

Add a hashmap to access all procfs nodes by pid.

branches: 1.229.4;
Add missing permission check

dedup the eofs link/symlink methods

If the calling process is running under linux emulation, make /proc/xxx/fd/
return only symlinks pointing to the original file in the filesystem,
instead of a hard link. This matches the linux behavior, and some
linux programs relies on it (they unconditionally call readlink() on
/proc/xxx/fd/yy and don't deal with it returning EINVAL).
Proposed on tech-kern@ in
http://mail-index.netbsd.org/tech-kern/2022/01/11/msg027877.html

Fix emul and exe DT_ types (from RVP, as was the previous commit)

Put the appropriate DT_ constant in the dirent structure depending on the
file type.

remove redundant error initialization and break earlier. (from rvp)

Use a single "p" variable.

Should fix PR kern/56614: kernel panic on tmux

use a single nc variable.

Fix locking in the error path (from RVP). Centralize unlock code.

s/efficent/efficient/ in comments.

PR/53299: RVP: kernfs and procfs are broken when sysctl security.curtain
is enabled

Abolish all the silly indirection macros for initializing vnode ops tables.

These are things of the form #define foofs_op genfs_op, or #define
foofs_op genfs_eopnotsupp, or similar. They serve no purpose besides
obfuscation, and have gotten cutpasted all over everywhere.

- Add a new vnode op: VOP_PARSEPATH.
- Move namei_getcomponent to genfs_vnops.c and call it genfs_parsepath.
- Add a parsepath entry to every vnode ops table.

VOP_PARSEPATH takes a directory vnode to be searched and a complete
following path and chooses how much of that path to consume. To begin
with, all parsepath calls are genfs_parsepath, which locates the first
'/' as always.

Note that the call doesn't take the whole struct componentname, only
the string. The other bits of struct componentname should not be
needed and there's no reason to cause potential complications by
exposing them.

VOP_BMAP() may be called via ioctl(FIOGETBMAP) on any vnode that applications
can open. change various pseudo-fs *_bmap methods return an error instead of
panic.

Reported-by: syzbot+8289a3eaf2ba60958c87@syzkaller.appspotmail.com

branches: 1.215.6;
Introduce genfs_pathconf() and use it for the default case in all filesystems.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Add ACL support for FFS. From FreeBSD.

If the procfs mount is marked as linux-compat, then allow proc lookup
by any LWP ID in the proc, not just the canonical PID.

Revert the changes made in February to make cwdinfo use mostly lockless,
which relied on taking extra vnode refs.

Having benchmarked various experimental changes over the past few months it
seems that it's better to avoid vnode refs as much as possible. cwdi_lock
as a RW lock already did that to some extent for getcwd() and will permit
the same for namei() too.

branches: 1.210.4;
v_interlock -> vmobjlock

Merge from ad-namecache:

- Have a stab at clustering the members of vnode_t and vnode_impl_t in a
more cache-conscious way. With that done, go back to adjusting v_usecount
with atomics and keep vi_lock directly in vnode_impl_t (saves KVA).

- Allow VOP_LOCK(LK_NONE) for the benefit of VFS_VGET() and VFS_ROOT().
Make sure LK_UPGRADE always comes with LK_NOWAIT.

- Make cwdinfo use mostly lockless.

Load struct filedesc::fd_dt with atomic_load_consume.

Exceptions: when fd_refcnt <= 1, or when holding fd_lock.

While here:

- Restore KASSERT(mutex_owned(&fdp->fd_lock)) in fd_unused.
=> This is used only in fd_close and fd_abort, where it holds.
- Move bounds check assertion in fd_putfile to where it matters.
- Store fd_dt with atomic_store_release.
- Move load of fd_dt under lock in knote_fdclose.
- Omit membar_consumer in fdesc_readdir.
=> atomic_load_consume serves the same purpose now.
=> Was needed only on alpha anyway.

branches: 1.207.2;
Add missing operation VOP_GETPAGES() returning EFAULT.

Without this operation posix_fadvise(..., POSIX_FADV_WILLNEED)
would leave the v_interlock held.

Observed by maxv@

branches: 1.206.4;
add a node for the process resource limits.

remove M_CANFAIL flag for malloc(9) - it was completely ignored, so had
actually no effect

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.203.2;
Lock the target cwdi and take an additional reference to the
vnode we are interested in to prevent it from disappearing
before getcwd_common().

Should fix PR kern/53096 (netbsd-8 crash on heavy disk I/O)

branches: 1.202.2;
Add an environ node

Allow procfs_kqfilter, since we allow poll. "go" does it.

fix locking, remove error(1) comments.

use p->p_path, remove unused code.

Remove the filesystem tracing feature

This is a legacy interface from 4.4BSD, and it was
introduced to overcome shortcomings of ptrace(2) at that time, which are
no longer relevant (performance). Today /proc/#/ctl offers a narrow
subset of ptrace(2) commands and is not applicable for modern
applications use beyond simplistic tracing scenarios.

This removal will simplify kernel internals. Users will still be able to
use all the other /proc files.

This change won't affect other procfs files neither Linux compat
features within mount_procfs(8). /proc/#/ctl isn't available on Linux.

Remove:
- /proc/#/ctl from mount_procfs(8)
- P_FSTRACE note from the documentation of ps(1)
- /proc/#/ctl and filesystem tracing documentation from mount_procfs(8)
- KAUTH_REQ_PROCESS_PROCFS_CTL documentation from kauth(9)
- source code file miscfs/procfs/procfs_ctl.c
- PFSctl and procfs_doctl() from sys/miscfs/procfs/procfs.h
- KAUTH_REQ_PROCESS_PROCFS_CTL from sys/sys/kauth.h
- PSL_FSTRACE (0x00010000) from sys/sys/proc.h
- P_FSTRACE (0x00010000) from sys/sys/sysctl.h

Reduce code complexity after removal of this functionality.

Update TODO.ptrace accordingly: remove two entries about /proc tracing.

Do not keep legacy notes as comments in the headers about removed
PSL_FSTRACE / P_FSTRACE, as this interface had little number of users
(close or equal to zero).

Proposed on tech-kern@.

All filesystem tracing utility users are encouraged to switch to ptrace(2).

Sponsored by <The NetBSD Foundation>

branches: 1.197.2;
Make VOP_RECLAIM do the last unlock of the vnode.

VOP_RECLAIM naturally has exclusive access to the vnode, so having it
locked on entry is not strictly necessary -- but it means if there
are any final operations that must be done on the vnode, such as
ffs_update, requiring exclusive access to it, we can now kassert that
the vnode is locked in those operations.

We can't just have the caller release the last lock because some file
systems don't use genfs_lock, and require the vnode to remain valid
for VOP_UNLOCK to work, notably unionfs.

Make VOP_INACTIVE preserve vnode lock on return.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2017/04/01/msg021751.html

Ride 7.99.68, a bumpy bus of incremental vfs improvements!

add an auxv node.

branches: 1.194.2;
Remove now obsolete operation vcache_remove().

Welcome to 7.99.36

branches: 1.193.2;
Make VOP_LINK return directory still locked and referenced.

Ride 7.99.10 bump.

branches: 1.192.2;
Try not to use f_data, use f_{vnode,socket,pipe,mqueue,kqueue,ksem} to get
a correctly typed pointer.

branches: 1.191.2; 1.191.4; 1.191.8;
Change procfs from hashlist to vcache.
- Key is (type, pid, fd)
- Remove argument "p" from procfs_allocvp(). It is only used
when "type == PFSfd". Lookup the proc with proc_find() when
procfs_loadvnode() needs it.
- Use a vfs_vnode_iterator for procfs_revoke_vnodes().

Add VOP_FALLOCATE and VOP_FDISCARD to every vnode ops table I can
find.

The filesystem ones all call genfs_eopnotsupp - right now I am only
implementing the plumbing and we can implement fallocate and/or
fdiscard for files later.

The device ones call spec_fallocate (which is also genfs_eopnotsupp)
and spec_fdiscard, which dispatches to the device-level op.

The fifo ones all call vn_fifo_bypass, which also ends up being
EOPNOTSUPP.

branches: 1.189.2;
Change vnode operation lookup to return the resulting vnode *vpp unlocked.
Change cache_lookup() to return an unlocked vnode.

Discussed on tech-kern@

Welcome to 6.99.31

Change vnode operations create, mknod, mkdir and symlink to return
the resulting vnode *vpp unlocked.

Discussed on tech-kern@

Welcome to 6.99.30

Change vnode operations create, mknod, mkdir and symlink to keep the
directory node dvp locked on return.

Discussed on tech-kern@

Welcome to 6.99.29

branches: 1.186.6;
C99 section 6.7.2.3 (Tags) Note 3 states that:

A type specifier of the form

enum identifier

without an enumerator list shall only appear after the type it
specifies is complete.

which means that we cannot pass an "enum vtype" argument to
kauth_access_action() without fully specifying the type first.
Unfortunately there is a complicated include file loop which
makes that difficult, so convert this minimal function into a
macro (and capitalize it).

(ok elad@)

do something reasonable with kernel semaphores.

branches: 1.184.2;
add a task process subdirectory for emul linux

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

branches: 1.182.2; 1.182.6;
PR# kern/45021: Please support /emul/linux/proc/version

Add /proc/version for procfs with -o linux. The version reported depends
on the emulation type of the calling process:

$ cat /proc/version
NetBSD version 5.99.55 (netbsd@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) NetBSD 5.99.55 (GENERIC) #39: Sun Sep 4 09:10:05 EDT 2011

$ /emul/linux/bin/cat /proc/version
Linux version 2.6.18 (linux@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) #0 Wed Mar 3 03:03:03 PST 2010

$ /emul/linux32/bin/cat /proc/version
Linux version 2.6.18 (linux32@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) #0 Wed Mar 3 03:03:03 PST 2010

From Aleksey Cheusov: Don't make it easy for compromised systems to bypass
ASLR protections by providing the mapping addresses of programs to everyone.

Remove pfind() and pgfind(), fix locking in various broken uses of these.
Rename real routines to proc_find() and pgrp_find(), remove PFIND_* flags
and have consistent behaviour. Provide proc_find_raw() for special cases.
Fix memory leak in sysctl_proc_corename().

COMPAT_LINUX: rework ptrace() locking, minimise differences between
different versions per-arch.

Note: while this change adds some formal cosmetics for COMPAT_DARWIN and
COMPAT_IRIX - locking there is utterly broken (for ages).

Fixes PR/43176.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

Procfs_lookup() does not lookup directory descriptors in the fd/
subdirectory. There is no need for recursive vnode locking here.

Ok: Christos Zoulas <christos@netbsd.org>

branches: 1.177.2; 1.177.4;
The VATTR_NULL/VREF/VHOLD/HOLDRELE() macros lost their will to live
years ago when the kernel was modified to not alter ABI based on
DIAGNOSTIC, and now just call the respective function interfaces
(in lowercase). Plenty of mix'n match upper/lowercase has creeped
into the tree since then. Nuke the macros and convert all callsites
to lowercase.

no functional change

Where possible, extract the file-system's access() routine to two internal
functions: the first checking if the operation is possible (regardless of
permissions), the second checking file-system permissions, ACLs, etc.

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005311.html

Move the implementation of vaccess() to genfs_can_access(), in line with
the other routines of the same spirit.

Adjust file-system code to use it.

Keep vaccess() for KPI compatibility and to keep element of least
surprise. A "diagnostic" message warning that vaccess() is deprecated will
be printed when it's used (obviously, only in DIAGNOSTIC kernels).

No objections on tech-kern@:

http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005310.html

More changes to improve kern_descrip.c.

- Avoid atomics in more places.
- Remove the per-descriptor mutex, and just use filedesc_t::fd_lock.
It was only being used to synchronize close, and in any case we needed
to take fd_lock to free the descriptor slot.
- Optimize certain paths for the <NDFDFILE case.
- Sprinkle more comments and assertions.
- Cache more stuff in filedesc_t.
- Fix numerous minor bugs spotted along the way.
- Restructure how the open files array is maintained, for clarity and so
that we can eliminate the membar_consumer() call in fd_getfile(). This is
mostly syntactic sugar; the main functional change is that fd_nfiles now
lives alongside the open file array.

Some measurements with libmicro:

- simple file syscalls are like close() are between 1 to 10% faster.
- some nice improvements, e.g. poll(1000) which is ~50% faster.

branches: 1.173.2;
kill MALLOC and FREE macros.

branches: 1.172.2;
PR/39324 kernel diagnostic assertion "l->l_stat != LSZOMB" failed.

Ignore procs with zero or all LSZOMB LWPs. Get a non-LSZOMB LWP to perform
operations against as part of the deal.

procfs really needs to be updated to support multi-threading fully.
Hi Antti!

ANSIfy

branches: 1.170.2;
Remove proc_representative_lwp(), use a simple LIST_FIRST() instead.
OK by <ad>.

branches: 1.169.2; 1.169.4;
Remove clause 3 and 4 from TNF licenses

branches: 1.168.2;
Merge proc::p_mutex and proc::p_smutex into a single adaptive mutex, since
we no longer need to guard against access from hardware interrupt handlers.

Additionally, if cloning a process with CLONE_SIGHAND, arrange to have the
child process share the parent's lock so that signal state may be kept in
sync. Partially addresses PR kern/37437.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

branches: 1.166.2;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

branches: 1.165.6;
Tons of process scope changes.

- Add a KAUTH_PROCESS_SCHEDULER action, to handle scheduler related
requests, and add specific requests for set/get scheduler policy and
set/get scheduler parameters.

- Add a KAUTH_PROCESS_KEVENT_FILTER action, to handle kevent(2) related
requests.

- Add a KAUTH_DEVICE_TTY_STI action to handle requests to TIOCSTI.

- Add requests for the KAUTH_PROCESS_CANSEE action, indicating what
process information is being looked at (entry itself, args, env,
open files).

- Add requests for the KAUTH_PROCESS_RLIMIT action indicating set/get.

- Add requests for the KAUTH_PROCESS_CORENAME action indicating set/get.

- Make bsd44 secmodel code handle the newly added rqeuests appropriately.

All of the above make it possible to issue finer-grained kauth(9) calls in
many places, removing some KAUTH_GENERIC_ISSUSER requests.

- Remove the "CAN" from KAUTH_PROCESS_CAN{KTRACE,PROCFS,PTRACE,SIGNAL}.

Discussed with christos@ and yamt@.

Merge vmlocking2 to head.

branches: 1.163.2; 1.163.6;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

make the last argument of procfs_dir size_t

Merge from vmlocking:

- pool_cache changes.
- Debugger/procfs locking fixes.
- Other minor changes.

branches: 1.160.2; 1.160.4;
Merge from vmlocking:

- Split vnode::v_flag into three fields, depending on field locking.
- simple_lock -> kmutex in a few places.
- Fix some simple locking problems.

Merge file descriptor locking, cwdi locking and cross-call changes
from the vmlocking branch.

branches: 1.158.4; 1.158.6; 1.158.8; 1.158.10;
Don't allow getcwd() on procfs vnodes and provide "/" as the path
instead of the result from getcwd(). The works around locking
panics caused by namei calling VOP_READLINK while holding on to a
directory lock and getcwd() trying to acquire that lock. The real
fix would be to get rid of getcwd() calls within VOPs (not locking
safe), but that's not a viable option in the netbsd-4 timeframe.

Suggestion for workaround from David Holland.

branches: 1.157.2;
Extend the Linux emulation of /proc to include

/proc/stat
/proc/loadavg and
/proc/<pid>/statm.

These are only present when -o linux is specified as a mount option
to procfs.

Factor out some common code so that it can be used by a number of
functions.

XXX The values returned in the statm emulation need to be verified.

Unfortunately, missed procfs_proc_unlock() in previous.
Pointed out by pooka@

procfs_readlink: Handle a possible fail of fd_getfile(), also, we
do not need to check for error again.
CID: 4436

branches: 1.154.2; 1.154.4;
- Make the proclist_lock a mutex. The write:read ratio is unfavourable,
and mutexes are cheaper use than RW locks.
- LOCK_ASSERT -> KASSERT in some places.
- Hold proclist_lock/kernel_lock longer in a couple of places.

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Don't prepend rootvnode to the path in non-NULL case for exe links.
It breaks procfs in chroot.

from <christos>, tested by me.

When checking for file validity under pid/, do proper proc->lwp
lookup (fsvo proper) instead of fiddling directly with the lwp
list.

Don't check for validity of p in lookup for root nodes, since it
will always be NULL. Rather, just call pt_valid with NULL directly
and let it decide if we're a linux mount or not.

Change the process/lwp flags seen by userland via sysctl back to the
P_*/L_* naming convention, and rename the in-kernel flags to avoid
conflict. (P_ -> PK_, L_ -> LW_ ). Add back the (now unused) LSDEAD
constant.

Restores source compatibility with pre-newlock2 tools like ps or top.

Reviewed by Andrew Doran.

branches: 1.148.2;
In lookup, when checking for procfs process node validity, target the
process we're trying to get information about through procfs, not
the caller of lookup.

fixes 'ls -l /proc/*/file' panic, which would occur when trying to
lookup "file" for a kernel thread, which doesn't have p->p_textvp.

Need to acquire procp->p_mutex for procfs_dir().

Eliminate a couple of reference count and mutex leaks.

Merge newlock2 to head.

PR/35226: Johann Franz: Problems with permissions in
/usr/pkg/emul/linux/proc .

Okay mlelstv@

a smorgasbord of improvements to vnode locking and path lookup:
- LOCKPARENT is no longer relevant for lookup(), relookup() or VOP_LOOKUP().
these now always return the parent vnode locked. namei() works as before.
lookup() and various other paths no longer acquire vnode locks in the
wrong order via vrele(). fixes PR 32535.
as a nice side effect, path lookup is also up to 25% faster.
- the above allows us to get rid of PDIRUNLOCK.
- also get rid of WANTPARENT (just use LOCKPARENT and unlock it).
- remove an assumption in layer_node_find() that all file systems implement
a recursive VOP_LOCK() (unionfs doesn't).
- require that all file systems supply vfs_vptofh and vfs_fhtovp routines.
fill in eopnotsupp() for file systems that don't support being exported
and remove the checks for NULL. (layerfs calls these without checking.)
- in union_lookup1(), don't change refcounts in the ISDOTDOT case, just
adjust which vnode is locked. fixes PR 33374.
- apply fixes for ufs_rename() from ufs_vnops.c rev. 1.61 to ext2fs_rename().

From Nicolas Joly: restore previous behavior in procfs_validfile_linux, since
readdir passes a NULL lwp.

Move kauth(9) call to where it belongs. Noticed by Nicolas Joly, thanks!

branches: 1.140.2;
Move ktrace, ptrace, systrace, and procfs to use kauth(9).

First, remove process_checkioperm() calls from MD code. Similar checks
using kauth(9) routines (on the process scope, using appropriate action)
are done in the callers.

Add secmodel back-end to handle each subsystem.

Expose the 'exe' symlink to the process realpath in NetBSD as well. An
example user is gdb.

OK'd by christos.

__unused removal on arguments; approved by core.

add an "emul" file node.

1. fix procfs_validfile{,_linux} to test for NULL pointers properly.
2. make "exe" entry be a symlink to the executable, instead of pointing
directly to the vnode of the executable.
3. factor out commonly used code.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

Emulate Linux's /proc/devices

branches: 1.133.6; 1.133.8;
use KAUTH_PROCESS_CANSEE rather than CURTAIN where appropriate.

remove unnecessary arguments from kauth_authorize_process.
ie. make it similar to the one found in apple TN.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.130.2;
integrate kauth.

branches: 1.129.2; 1.129.4; 1.129.6; 1.129.8;
PR/32692: Matthew Mondor: linux compatibility in /proc/self should point
directly to the directory containing the pid instead of pointing to
/proc/curproc, because some programs rely on calling readlink on /proc/self
to get the pid.

branches: 1.128.2; 1.128.4;
merge ktrace-lwp.

merge yamt-vop branch. remove following VOPs.

VOP_BLKATOFF
VOP_VALLOC
VOP_BALLOC
VOP_REALLOCBLKS
VOP_VFREE
VOP_TRUNCATE
VOP_UPDATE

branches: 1.126.2;
Add "cwd" and "root" symlinks to each process's directory. The cwd
link points to the process's current working directory, and the root
link points to the process's root directory. What else would you
expect?

For directories that are out of reach (caller is in a chroot, target
process is in a different chroot, etc), the links point to "/"
instead.

Implement curtain for procfs.

Remove __P()

branches: 1.123.2;
- sprinkle const
- avoid shadowed variables.

PR/29782: Martin Husemann: procfs can not unmount when some process has its
current directory in curproc. Fix from Pedro Martelletto:
We cannot call vgone() from procfs_inactive() if we are coming from
vclean(). that's what's probably causing the deadlock.

nuke trailing whitespace

branches: 1.120.4; 1.120.6;
procfs_readdir:
- return correct cookie when buffer size is small.
- simplify logic.

procfs_readdir: remove a redundant assignment.

procfs_getattr: correct size of /proc/self.

procfs_readdir:
- fix a locking problem, using proclist_foreach_call. PR/27098.
- correct snprintf size argument.

procfs_readdir: fix an offset handling bug after addition of /proc/self.

procfs_readdir: use a list macro.

add 'mounts' file for -o linux, which lists all currently mounted
filesystems; Linux glibc statvfs() uses this to get some of mount flags,
and this file is also useful as /emul/linux/etc/mtab (via symlink)

Removed remaining caddr_t casts we do not need in miscfs. Recompiled
kernel and ran for a day or so. There are still some caddr_t types in
the arguments of some calls, I will do those separately (later) as
they touch a lot more of the system.
Approved by christos@NetBSD.org.

sprintf -> snprintf

unlock the descriptor table simple lock after fd_getfile() call in
procfs_readdir()
fixes procfs locking problems reported on current-users@, problem place
found by enami tsugutomo

Remove some assigned-to but otherwise unused variables.

Changes as discussed with itojun on tech-kern. I have modified the enums
to have KFS or PFS differentiators. Further I have wrapped the enum in
procfs in "#ifdef _KERNEL" as it is done in kernfs.

To see the discussion go to http://mail-index.NetBSD.org/tech-kern/2003/09/
and look for "Mismatched enums in include files" in the list.

remove meaningless line (variable overwritten 2 lines below)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.106.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Undo part of the ktrace/lwp changes. In particular:
* Remove the "lwp *" argument that was added to vget(). Turns out
that nothing actually used it!
* Remove the "lwp *" arguments that were added to VFS_ROOT(), VFS_VGET(),
and VFS_FHTOVP(); all they did was pass it to vget() (which, as noted
above, didn't use it).
* Remove all of the "lwp *" arguments to internal functions that were added
just to appease the above.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Add /proc/<pid>/stat for linux compat. j2sdk1.4.2 depends on it.

Make symlinks for directories that point to the actual directory.
Make symlinks to [kqueue] and [misc] for kqueue and misc fds.

do not show nodes corresponding to directory descriptors for process
in fd/ subdirectory, nor allow lookup/open for the nodes
this fixes PR kern/21187 for good, and also avoids interesting directory
locking issues

procfs_readdir(): in Pfd case, only show descriptors of types we want
how to represent (vnodes, fifo, pipes); also use fd_getfile() et al

this avoids annoying EOPNOTSUPP error messages from ls -F and such

procfs_lookup(): use fd_getfile() et al in Pfd case

use fd_getfile() in procfs_getfp(), and FILE_USE()/FILE_UNUSE() the
returned file descriptor pointer appropriately

make some local arrays/variables static + const

use former genfs_eopnotsupp_rele() as genfs_eopnotsupp(), so that vnodes
are vput()/vrele()d as necessary - some filesystems did use the wrong
one for some ops, and it's just safer to not take the chance

based on suggestion by Bill Studenmund

Remove pointless check against PID_MAX. Let pfind() do the validation.
(The new pid allocation code may decide to allocate pids above PID_MAX.)

This addresses PR kerm/19989. Thanks to hamajima@nagoya.ydc.co.jp for submitting this patch which enables /proc/uptime for linux emul. Patch reviewed by atatat@netbsd.org and tron@netbsd.org, approved by tron@netbsd.org.

Cast off_t expression to long long to match format even on 64 bit
plattforms.

Shouldn't we introduce a PRIoff_t macro to create such format strings?

add LK_CANRECURSE in the locking of /dev/<pid>/fd/<n> and remove the curproc
kludge. Thanks to fvdl.

Implement /proc/<pid>/fd/<n>. This is work in progress. Questionable things:
- Is it ok to convert DTYPE_PIPE to VFIFO and DTYPE_SOCKET to VSOCK?
- XXX: Avoid locking issue in ls -Rl /proc by avoiding curproc
- Does I/O to pipes work?
- XXX: Are there security implications?

Just use the "time" variable in the *_getattr functions instead of a call
to (the potentially expensive) microtime().

branches: 1.89.2;
Move code shared by procfs and the kernel proper out of procfs and
into the kernel proper (renaming functions from procfs_* to process_*).

Don't hide the real return code with EPERM.

add a VOP_PUTPAGES method for all the filesystems that don't have pages,
just unlock the interlock.

* Allow machine-dependent code to specify hooks for ptrace(2)
(__HAVE_PTRACE_MACHDEP) and procfs (__HAVE_PROCFS_MACHDEP).
These changes will allow platforms like x86 (XMM) and PowerPC
(AltiVec) to export extended register sets in a sane manner.

* Use __HAVE_PTRACE_MACHDEP to export x86 XMM registers (standard
FP + SSE/SSE2) using PT_{GET,SET}XMMREGS (in the machdep
ptrace request space).
* Use __HAVE_PROCFS_MACHDEP to export x86 XMM registers via
/proc/N/xmmregs in procfs.

add RCSIDs

Remove some variables that are set but never used.

branches: 1.83.2; 1.83.4;
map files are zero-length.

branches: 1.82.2;
procfs_bmap() should never be called, make it a "bad op".
let procfs_mmap() use the default error method.

In procfs_readdir(), give /proc/# directories DT_DIR (rather than DT_REG).

Bump va_blocksize for the map files some more, so that programs with
quite a few mappings have a chance of being handled correctly if
st_blksize is looked at.

For -o linux mounts, add some code to emulate /proc/#/maps.
Needs NAMECACHE_ENTER_REVERSE to include filenames.

branches: 1.78.2;
make some more constant arrays 'const'

make filesystem vnodeop, specop, fifoop and vnodeopv_* arrays const

Add a few linux-style files, only enabled when -o linux is specified
for the mount. Currently these are /proc/cpuinfo and /proc/meminfo.
The former only does something on i386 right now.

remove dead code and other misc cleanup.

Only show the "exe" entry to Linux processes, suggested by christos.
Since there are actually three struct emul's for linux, use the e_name
field to determine eligibility with strcmp().

Some versions of Linux libc look for /proc/.../exe instead of /proc/../file.
Add an entry for "exe" that is the same as "file", provided only if
COMPAT_LINUX is set.

MALLOC()/FREE() are not to be used for variable sized allocations.

<vm/vm.h> -> <uvm/uvm_extern.h>

branches: 1.70.4;
Delete duplicate declaration of atopid().

branches: 1.69.2; 1.69.8;
Make /proc/self a symlink to /proc/curproc. I've observed Linux programs
that expect /proc/self/cmdline to exist.

Change variable used for directory offset from "int" to "off_t".
Overkill, but avoids a host of truncation problems.

Fix PR8270:

Problem turned out to be due to improper handling of reads beyond EOF:
they should just return without error with the uio unchanged, and the
caller will recognize this as a zero-byte return (EOF).

The previous fix to protect directory reads against bogus uio_offset
values returned EINVAL, which broke mount -o union, which only
union'ed in the lower directory if the upper directory cleanly
returned EOF.

While we're here, protect kernfs as well.

protect against large uio_offset

Add support for fcntl(2) to generate VOP_FCNTL calls. Any fcntl
call with F_FSCTL set and F_SETFL calls generate calls to a new
fileop fo_fcntl. Add genfs_fcntl() and soo_fcntl() which return 0
for F_SETFL and EOPNOTSUPP otherwise. Have all leaf filesystems
use genfs_fcntl().

Reviewed by: thorpej
Tested by: wrstuden

Add calls to lock the proclist as appropriate.

Fix a paste-o in procfs_lookup() introduced with the vnode locking changes.
Fixes PR #7961, Mario Kemper <magick@bundy.lip.owl.de>.

Bump osrelease to 1.4E. Add layerfs files, remove null_subr.c.

Update coda to new struct lock in struct vnode.

make fdescfs, kernfs, portalfs, and procfs actually lock their vnodes.
It's not that hard.

Make unionfs set v_vnlock = NULL so any overlayed fs will call its
VOP_LOCK.

branches: 1.61.2; 1.61.4;
PR/7143: Jaromir Docelek: Add procfs/cmdline from Linux emulation

Add /proc/#/map. From FreeBSD.

- Use proclists[], rather than checking allproc and zombproc explicitly.
- Add some comments about locking.

Per POSIX, fail with EINVAL if advisory locking is attempted on a file type
that doesn't support it, rather than using a homegrown EBADF or EOPNOTSUPP.

create miscfs/genfs/genfs_vnops.c:genfs_enoioctl and make all the other
filesystems use it instead of a private version.

bzero->memset, bcopy->memcpy, bcmp->memcmp

Recognize _PC_SYNC_IO.

procfs_readdir: in case of error, check if cookies actually have
been allocated before freeing them. From Wolfgang Solfrank.

Merge with Lite2 + local changes

Bump last argument to VOP_READDIR to off_t (from u_long).

Fix a reversed argument which caused procfs_checkioperm() to always return
"OK". Add a few comments to avoid further confusion.

Fix the procfs hole described on current-users, similar to a fix for
FreeBSD by Sean Eric Fagan, but a bit different. This makes the checks
in the same places as sef's FreeBSD patch, but does not hardcode the
"kmem" group into the kernel, and also does a check identical to the
(3) and (4) checks in the NetBSD ptrace(2):

(1) it's not owned by you, or is set-id on exec (unless
you're root), or

(2) it's init, which controls the security level of the
entire system, and the system was not compiled with
permanently insecure mode turned on.

branches: 1.49.4;
Pass the vnode type to vaccess(), and use it when checking VEXEC. Make sure
that the mode bits passed to vaccess() and returned by foo_getattr() contain
only permission bits.

Need stat.h.

Eliminate bogus uses of V{READ,WRITE,EXEC}. Use S_I[RWX]{USR,GRP,OTH} where
appropriate.

Minor code cleanup.

define path name string variables that we should not (and, thankfully, do
not) modify as 'const char *' rather 'char *'.

backout previous kprintf changes

printf -> kprintf, sprintf -> ksprintf

Implement poll(2).

Add a set of generic file system operations that most file systems use.
Also, fix some time stamp bogosities.

Fix printf format follies.

GC *_nullop(). Minor nits.

close PR/2063: procfs_rw prototyped twice with different prototypes

miscfs prototype changes

Fix vop_link, vop_symlink, and vop_remove semantics in several ways:
* Change the argument names to vop_link so they actually make sense.
* Implement vop_link and vop_symlink for all file systems, so they do proper
cleanup.
* Require the file system to decide whether or not linking and unlinking of
directories is allowed, and disable it for all current file systems.

Use the index number as the cookie, rather than multiplying by UIO_MX.

Add support for cookies, mostly from Greg Hudson.

fix timeval vs. timespec warnings

Return EROFS rather than ENOENT in many cases. Also some cosmetic cleanup.

Format police.

Implement and use a common access checking routine

Remove a_fp.

fixed struct comment

be more careful with types, also pull in headers where necessary.

update for new syscall args description mechanism

Convert process, file, and namei lists and hash tables to use queue.h.

New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

Remove an unneeded test.

Minor update from JSP after merging my changes.

Update to 4.4-Lite fs code, with local changes.

lots of changes: prototype migration, move lots of variables, definitions,
and structure elements around. kill some unnecessary type and macro
definitions. standardize clock handling. More changes than you'd want.

forgot these...

be a bit smarter about determining if files shouldn't be seen by the user.
Also, DON'T allow a lookup to succeed on a file that's not visible!

Undo last change; executables is `file', not `a.out'.

Rename file -> a.out

Don't try to show a file for a process if there is none

make a fpregs file.

Make procfs really work for debugging.
Implement not & notepg files in procfs.

Bug fixes and enhancements:
Make NFS serving work (BUT DON'T USE "attach" TO /proc/*/ctl FOR NOW!!!)
Make `curproc' a symbolic link
Add `.' and `..' entries to the directories.
Return better guesses on the size of the files.

return size of 'reg' from getattr()

make it compile (cleanly) for us

add new procfs code, from Jan-Simon Pendry, jsp@sequent.com.
This is pretty-much "virgin", so that diffs can be done later.

Canonicalize all #includes.

kill volatile warning.

branches: 1.6.2;
Changes to VFS readdir semantics
NFS changes for better cookie support
ISOFS changes for better Rockridge support and support for generation numbers

Implement setattr: mode for process entries; mode + uid/gid for the
PROCFS root directory.
Fixed omission in pfs_root() which came to light as a result of the above:
hold on to vnode for root dir.

Fixed improperly initialized nfsnode in pfs_lookup()

copyright update.

Rcs Id added.

branches: 1.1.1;
Initial version of a proc filesystem.

Add a hashmap to access all procfs nodes by pid.

Add missing permission check

dedup the eofs link/symlink methods

If the calling process is running under linux emulation, make /proc/xxx/fd/
return only symlinks pointing to the original file in the filesystem,
instead of a hard link. This matches the linux behavior, and some
linux programs relies on it (they unconditionally call readlink() on
/proc/xxx/fd/yy and don't deal with it returning EINVAL).
Proposed on tech-kern@ in
http://mail-index.netbsd.org/tech-kern/2022/01/11/msg027877.html

Fix emul and exe DT_ types (from RVP, as was the previous commit)

Put the appropriate DT_ constant in the dirent structure depending on the
file type.

remove redundant error initialization and break earlier. (from rvp)

Use a single "p" variable.

Should fix PR kern/56614: kernel panic on tmux

use a single nc variable.

Fix locking in the error path (from RVP). Centralize unlock code.

s/efficent/efficient/ in comments.

PR/53299: RVP: kernfs and procfs are broken when sysctl security.curtain
is enabled

Abolish all the silly indirection macros for initializing vnode ops tables.

These are things of the form #define foofs_op genfs_op, or #define
foofs_op genfs_eopnotsupp, or similar. They serve no purpose besides
obfuscation, and have gotten cutpasted all over everywhere.

- Add a new vnode op: VOP_PARSEPATH.
- Move namei_getcomponent to genfs_vnops.c and call it genfs_parsepath.
- Add a parsepath entry to every vnode ops table.

VOP_PARSEPATH takes a directory vnode to be searched and a complete
following path and chooses how much of that path to consume. To begin
with, all parsepath calls are genfs_parsepath, which locates the first
'/' as always.

Note that the call doesn't take the whole struct componentname, only
the string. The other bits of struct componentname should not be
needed and there's no reason to cause potential complications by
exposing them.

VOP_BMAP() may be called via ioctl(FIOGETBMAP) on any vnode that applications
can open. change various pseudo-fs *_bmap methods return an error instead of
panic.

Reported-by: syzbot+8289a3eaf2ba60958c87@syzkaller.appspotmail.com

branches: 1.215.6;
Introduce genfs_pathconf() and use it for the default case in all filesystems.

Move proc_lock into the data segment. It was dynamically allocated because
at the time we had mutex_obj_alloc() but not __cacheline_aligned.

Add ACL support for FFS. From FreeBSD.

If the procfs mount is marked as linux-compat, then allow proc lookup
by any LWP ID in the proc, not just the canonical PID.

Revert the changes made in February to make cwdinfo use mostly lockless,
which relied on taking extra vnode refs.

Having benchmarked various experimental changes over the past few months it
seems that it's better to avoid vnode refs as much as possible. cwdi_lock
as a RW lock already did that to some extent for getcwd() and will permit
the same for namei() too.

branches: 1.210.4;
v_interlock -> vmobjlock

Merge from ad-namecache:

- Have a stab at clustering the members of vnode_t and vnode_impl_t in a
more cache-conscious way. With that done, go back to adjusting v_usecount
with atomics and keep vi_lock directly in vnode_impl_t (saves KVA).

- Allow VOP_LOCK(LK_NONE) for the benefit of VFS_VGET() and VFS_ROOT().
Make sure LK_UPGRADE always comes with LK_NOWAIT.

- Make cwdinfo use mostly lockless.

Load struct filedesc::fd_dt with atomic_load_consume.

Exceptions: when fd_refcnt <= 1, or when holding fd_lock.

While here:

- Restore KASSERT(mutex_owned(&fdp->fd_lock)) in fd_unused.
=> This is used only in fd_close and fd_abort, where it holds.
- Move bounds check assertion in fd_putfile to where it matters.
- Store fd_dt with atomic_store_release.
- Move load of fd_dt under lock in knote_fdclose.
- Omit membar_consumer in fdesc_readdir.
=> atomic_load_consume serves the same purpose now.
=> Was needed only on alpha anyway.

branches: 1.207.2;
Add missing operation VOP_GETPAGES() returning EFAULT.

Without this operation posix_fadvise(..., POSIX_FADV_WILLNEED)
would leave the v_interlock held.

Observed by maxv@

branches: 1.206.4;
add a node for the process resource limits.

remove M_CANFAIL flag for malloc(9) - it was completely ignored, so had
actually no effect

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.203.2;
Lock the target cwdi and take an additional reference to the
vnode we are interested in to prevent it from disappearing
before getcwd_common().

Should fix PR kern/53096 (netbsd-8 crash on heavy disk I/O)

branches: 1.202.2;
Add an environ node

Allow procfs_kqfilter, since we allow poll. "go" does it.

fix locking, remove error(1) comments.

use p->p_path, remove unused code.

Remove the filesystem tracing feature

This is a legacy interface from 4.4BSD, and it was
introduced to overcome shortcomings of ptrace(2) at that time, which are
no longer relevant (performance). Today /proc/#/ctl offers a narrow
subset of ptrace(2) commands and is not applicable for modern
applications use beyond simplistic tracing scenarios.

This removal will simplify kernel internals. Users will still be able to
use all the other /proc files.

This change won't affect other procfs files neither Linux compat
features within mount_procfs(8). /proc/#/ctl isn't available on Linux.

Remove:
- /proc/#/ctl from mount_procfs(8)
- P_FSTRACE note from the documentation of ps(1)
- /proc/#/ctl and filesystem tracing documentation from mount_procfs(8)
- KAUTH_REQ_PROCESS_PROCFS_CTL documentation from kauth(9)
- source code file miscfs/procfs/procfs_ctl.c
- PFSctl and procfs_doctl() from sys/miscfs/procfs/procfs.h
- KAUTH_REQ_PROCESS_PROCFS_CTL from sys/sys/kauth.h
- PSL_FSTRACE (0x00010000) from sys/sys/proc.h
- P_FSTRACE (0x00010000) from sys/sys/sysctl.h

Reduce code complexity after removal of this functionality.

Update TODO.ptrace accordingly: remove two entries about /proc tracing.

Do not keep legacy notes as comments in the headers about removed
PSL_FSTRACE / P_FSTRACE, as this interface had little number of users
(close or equal to zero).

Proposed on tech-kern@.

All filesystem tracing utility users are encouraged to switch to ptrace(2).

Sponsored by <The NetBSD Foundation>

branches: 1.197.2;
Make VOP_RECLAIM do the last unlock of the vnode.

VOP_RECLAIM naturally has exclusive access to the vnode, so having it
locked on entry is not strictly necessary -- but it means if there
are any final operations that must be done on the vnode, such as
ffs_update, requiring exclusive access to it, we can now kassert that
the vnode is locked in those operations.

We can't just have the caller release the last lock because some file
systems don't use genfs_lock, and require the vnode to remain valid
for VOP_UNLOCK to work, notably unionfs.

Make VOP_INACTIVE preserve vnode lock on return.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2017/04/01/msg021751.html

Ride 7.99.68, a bumpy bus of incremental vfs improvements!

add an auxv node.

branches: 1.194.2;
Remove now obsolete operation vcache_remove().

Welcome to 7.99.36

branches: 1.193.2;
Make VOP_LINK return directory still locked and referenced.

Ride 7.99.10 bump.

branches: 1.192.2;
Try not to use f_data, use f_{vnode,socket,pipe,mqueue,kqueue,ksem} to get
a correctly typed pointer.

branches: 1.191.2; 1.191.4; 1.191.8;
Change procfs from hashlist to vcache.
- Key is (type, pid, fd)
- Remove argument "p" from procfs_allocvp(). It is only used
when "type == PFSfd". Lookup the proc with proc_find() when
procfs_loadvnode() needs it.
- Use a vfs_vnode_iterator for procfs_revoke_vnodes().

Add VOP_FALLOCATE and VOP_FDISCARD to every vnode ops table I can
find.

The filesystem ones all call genfs_eopnotsupp - right now I am only
implementing the plumbing and we can implement fallocate and/or
fdiscard for files later.

The device ones call spec_fallocate (which is also genfs_eopnotsupp)
and spec_fdiscard, which dispatches to the device-level op.

The fifo ones all call vn_fifo_bypass, which also ends up being
EOPNOTSUPP.

branches: 1.189.2;
Change vnode operation lookup to return the resulting vnode *vpp unlocked.
Change cache_lookup() to return an unlocked vnode.

Discussed on tech-kern@

Welcome to 6.99.31

Change vnode operations create, mknod, mkdir and symlink to return
the resulting vnode *vpp unlocked.

Discussed on tech-kern@

Welcome to 6.99.30

Change vnode operations create, mknod, mkdir and symlink to keep the
directory node dvp locked on return.

Discussed on tech-kern@

Welcome to 6.99.29

branches: 1.186.6;
C99 section 6.7.2.3 (Tags) Note 3 states that:

A type specifier of the form

enum identifier

without an enumerator list shall only appear after the type it
specifies is complete.

which means that we cannot pass an "enum vtype" argument to
kauth_access_action() without fully specifying the type first.
Unfortunately there is a complicated include file loop which
makes that difficult, so convert this minimal function into a
macro (and capitalize it).

(ok elad@)

do something reasonable with kernel semaphores.

branches: 1.184.2;
add a task process subdirectory for emul linux

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

branches: 1.182.2; 1.182.6;
PR# kern/45021: Please support /emul/linux/proc/version

Add /proc/version for procfs with -o linux. The version reported depends
on the emulation type of the calling process:

$ cat /proc/version
NetBSD version 5.99.55 (netbsd@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) NetBSD 5.99.55 (GENERIC) #39: Sun Sep 4 09:10:05 EDT 2011

$ /emul/linux/bin/cat /proc/version
Linux version 2.6.18 (linux@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) #0 Wed Mar 3 03:03:03 PST 2010

$ /emul/linux32/bin/cat /proc/version
Linux version 2.6.18 (linux32@localhost) (gcc version 4.1.3 20080704 prerelease (NetBSD nb2 20081120)) #0 Wed Mar 3 03:03:03 PST 2010

From Aleksey Cheusov: Don't make it easy for compromised systems to bypass
ASLR protections by providing the mapping addresses of programs to everyone.

Remove pfind() and pgfind(), fix locking in various broken uses of these.
Rename real routines to proc_find() and pgrp_find(), remove PFIND_* flags
and have consistent behaviour. Provide proc_find_raw() for special cases.
Fix memory leak in sysctl_proc_corename().

COMPAT_LINUX: rework ptrace() locking, minimise differences between
different versions per-arch.

Note: while this change adds some formal cosmetics for COMPAT_DARWIN and
COMPAT_IRIX - locking there is utterly broken (for ages).

Fixes PR/43176.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

Procfs_lookup() does not lookup directory descriptors in the fd/
subdirectory. There is no need for recursive vnode locking here.

Ok: Christos Zoulas <christos@netbsd.org>

branches: 1.177.2; 1.177.4;
The VATTR_NULL/VREF/VHOLD/HOLDRELE() macros lost their will to live
years ago when the kernel was modified to not alter ABI based on
DIAGNOSTIC, and now just call the respective function interfaces
(in lowercase). Plenty of mix'n match upper/lowercase has creeped
into the tree since then. Nuke the macros and convert all callsites
to lowercase.

no functional change

Where possible, extract the file-system's access() routine to two internal
functions: the first checking if the operation is possible (regardless of
permissions), the second checking file-system permissions, ACLs, etc.

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005311.html

Move the implementation of vaccess() to genfs_can_access(), in line with
the other routines of the same spirit.

Adjust file-system code to use it.

Keep vaccess() for KPI compatibility and to keep element of least
surprise. A "diagnostic" message warning that vaccess() is deprecated will
be printed when it's used (obviously, only in DIAGNOSTIC kernels).

No objections on tech-kern@:

http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005310.html

More changes to improve kern_descrip.c.

- Avoid atomics in more places.
- Remove the per-descriptor mutex, and just use filedesc_t::fd_lock.
It was only being used to synchronize close, and in any case we needed
to take fd_lock to free the descriptor slot.
- Optimize certain paths for the <NDFDFILE case.
- Sprinkle more comments and assertions.
- Cache more stuff in filedesc_t.
- Fix numerous minor bugs spotted along the way.
- Restructure how the open files array is maintained, for clarity and so
that we can eliminate the membar_consumer() call in fd_getfile(). This is
mostly syntactic sugar; the main functional change is that fd_nfiles now
lives alongside the open file array.

Some measurements with libmicro:

- simple file syscalls are like close() are between 1 to 10% faster.
- some nice improvements, e.g. poll(1000) which is ~50% faster.

branches: 1.173.2;
kill MALLOC and FREE macros.

branches: 1.172.2;
PR/39324 kernel diagnostic assertion "l->l_stat != LSZOMB" failed.

Ignore procs with zero or all LSZOMB LWPs. Get a non-LSZOMB LWP to perform
operations against as part of the deal.

procfs really needs to be updated to support multi-threading fully.
Hi Antti!

ANSIfy

branches: 1.170.2;
Remove proc_representative_lwp(), use a simple LIST_FIRST() instead.
OK by <ad>.

branches: 1.169.2; 1.169.4;
Remove clause 3 and 4 from TNF licenses

branches: 1.168.2;
Merge proc::p_mutex and proc::p_smutex into a single adaptive mutex, since
we no longer need to guard against access from hardware interrupt handlers.

Additionally, if cloning a process with CLONE_SIGHAND, arrange to have the
child process share the parent's lock so that signal state may be kept in
sync. Partially addresses PR kern/37437.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
be sent from a hardware interrupt handler. Signal activity must be
deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

branches: 1.166.2;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

branches: 1.165.6;
Tons of process scope changes.

- Add a KAUTH_PROCESS_SCHEDULER action, to handle scheduler related
requests, and add specific requests for set/get scheduler policy and
set/get scheduler parameters.

- Add a KAUTH_PROCESS_KEVENT_FILTER action, to handle kevent(2) related
requests.

- Add a KAUTH_DEVICE_TTY_STI action to handle requests to TIOCSTI.

- Add requests for the KAUTH_PROCESS_CANSEE action, indicating what
process information is being looked at (entry itself, args, env,
open files).

- Add requests for the KAUTH_PROCESS_RLIMIT action indicating set/get.

- Add requests for the KAUTH_PROCESS_CORENAME action indicating set/get.

- Make bsd44 secmodel code handle the newly added rqeuests appropriately.

All of the above make it possible to issue finer-grained kauth(9) calls in
many places, removing some KAUTH_GENERIC_ISSUSER requests.

- Remove the "CAN" from KAUTH_PROCESS_CAN{KTRACE,PROCFS,PTRACE,SIGNAL}.

Discussed with christos@ and yamt@.

Merge vmlocking2 to head.

branches: 1.163.2; 1.163.6;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

make the last argument of procfs_dir size_t

Merge from vmlocking:

- pool_cache changes.
- Debugger/procfs locking fixes.
- Other minor changes.

branches: 1.160.2; 1.160.4;
Merge from vmlocking:

- Split vnode::v_flag into three fields, depending on field locking.
- simple_lock -> kmutex in a few places.
- Fix some simple locking problems.

Merge file descriptor locking, cwdi locking and cross-call changes
from the vmlocking branch.

branches: 1.158.4; 1.158.6; 1.158.8; 1.158.10;
Don't allow getcwd() on procfs vnodes and provide "/" as the path
instead of the result from getcwd(). The works around locking
panics caused by namei calling VOP_READLINK while holding on to a
directory lock and getcwd() trying to acquire that lock. The real
fix would be to get rid of getcwd() calls within VOPs (not locking
safe), but that's not a viable option in the netbsd-4 timeframe.

Suggestion for workaround from David Holland.

branches: 1.157.2;
Extend the Linux emulation of /proc to include

/proc/stat
/proc/loadavg and
/proc/<pid>/statm.

These are only present when -o linux is specified as a mount option
to procfs.

Factor out some common code so that it can be used by a number of
functions.

XXX The values returned in the statm emulation need to be verified.

Unfortunately, missed procfs_proc_unlock() in previous.
Pointed out by pooka@

procfs_readlink: Handle a possible fail of fd_getfile(), also, we
do not need to check for error again.
CID: 4436

branches: 1.154.2; 1.154.4;
- Make the proclist_lock a mutex. The write:read ratio is unfavourable,
and mutexes are cheaper use than RW locks.
- LOCK_ASSERT -> KASSERT in some places.
- Hold proclist_lock/kernel_lock longer in a couple of places.

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Don't prepend rootvnode to the path in non-NULL case for exe links.
It breaks procfs in chroot.

from <christos>, tested by me.

When checking for file validity under pid/, do proper proc->lwp
lookup (fsvo proper) instead of fiddling directly with the lwp
list.

Don't check for validity of p in lookup for root nodes, since it
will always be NULL. Rather, just call pt_valid with NULL directly
and let it decide if we're a linux mount or not.

Change the process/lwp flags seen by userland via sysctl back to the
P_*/L_* naming convention, and rename the in-kernel flags to avoid
conflict. (P_ -> PK_, L_ -> LW_ ). Add back the (now unused) LSDEAD
constant.

Restores source compatibility with pre-newlock2 tools like ps or top.

Reviewed by Andrew Doran.

branches: 1.148.2;
In lookup, when checking for procfs process node validity, target the
process we're trying to get information about through procfs, not
the caller of lookup.

fixes 'ls -l /proc/*/file' panic, which would occur when trying to
lookup "file" for a kernel thread, which doesn't have p->p_textvp.

Need to acquire procp->p_mutex for procfs_dir().

Eliminate a couple of reference count and mutex leaks.

Merge newlock2 to head.

PR/35226: Johann Franz: Problems with permissions in
/usr/pkg/emul/linux/proc .

Okay mlelstv@

a smorgasbord of improvements to vnode locking and path lookup:
- LOCKPARENT is no longer relevant for lookup(), relookup() or VOP_LOOKUP().
these now always return the parent vnode locked. namei() works as before.
lookup() and various other paths no longer acquire vnode locks in the
wrong order via vrele(). fixes PR 32535.
as a nice side effect, path lookup is also up to 25% faster.
- the above allows us to get rid of PDIRUNLOCK.
- also get rid of WANTPARENT (just use LOCKPARENT and unlock it).
- remove an assumption in layer_node_find() that all file systems implement
a recursive VOP_LOCK() (unionfs doesn't).
- require that all file systems supply vfs_vptofh and vfs_fhtovp routines.
fill in eopnotsupp() for file systems that don't support being exported
and remove the checks for NULL. (layerfs calls these without checking.)
- in union_lookup1(), don't change refcounts in the ISDOTDOT case, just
adjust which vnode is locked. fixes PR 33374.
- apply fixes for ufs_rename() from ufs_vnops.c rev. 1.61 to ext2fs_rename().

From Nicolas Joly: restore previous behavior in procfs_validfile_linux, since
readdir passes a NULL lwp.

Move kauth(9) call to where it belongs. Noticed by Nicolas Joly, thanks!

branches: 1.140.2;
Move ktrace, ptrace, systrace, and procfs to use kauth(9).

First, remove process_checkioperm() calls from MD code. Similar checks
using kauth(9) routines (on the process scope, using appropriate action)
are done in the callers.

Add secmodel back-end to handle each subsystem.

Expose the 'exe' symlink to the process realpath in NetBSD as well. An
example user is gdb.

OK'd by christos.

__unused removal on arguments; approved by core.

add an "emul" file node.

1. fix procfs_validfile{,_linux} to test for NULL pointers properly.
2. make "exe" entry be a symlink to the executable, instead of pointing
directly to the vnode of the executable.
3. factor out commonly used code.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

Emulate Linux's /proc/devices

branches: 1.133.6; 1.133.8;
use KAUTH_PROCESS_CANSEE rather than CURTAIN where appropriate.

remove unnecessary arguments from kauth_authorize_process.
ie. make it similar to the one found in apple TN.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.130.2;
integrate kauth.

branches: 1.129.2; 1.129.4; 1.129.6; 1.129.8;
PR/32692: Matthew Mondor: linux compatibility in /proc/self should point
directly to the directory containing the pid instead of pointing to
/proc/curproc, because some programs rely on calling readlink on /proc/self
to get the pid.

branches: 1.128.2; 1.128.4;
merge ktrace-lwp.

merge yamt-vop branch. remove following VOPs.

VOP_BLKATOFF
VOP_VALLOC
VOP_BALLOC
VOP_REALLOCBLKS
VOP_VFREE
VOP_TRUNCATE
VOP_UPDATE

branches: 1.126.2;
Add "cwd" and "root" symlinks to each process's directory. The cwd
link points to the process's current working directory, and the root
link points to the process's root directory. What else would you
expect?

For directories that are out of reach (caller is in a chroot, target
process is in a different chroot, etc), the links point to "/"
instead.

Implement curtain for procfs.

Remove __P()

branches: 1.123.2;
- sprinkle const
- avoid shadowed variables.

PR/29782: Martin Husemann: procfs can not unmount when some process has its
current directory in curproc. Fix from Pedro Martelletto:
We cannot call vgone() from procfs_inactive() if we are coming from
vclean(). that's what's probably causing the deadlock.

nuke trailing whitespace

branches: 1.120.4; 1.120.6;
procfs_readdir:
- return correct cookie when buffer size is small.
- simplify logic.

procfs_readdir: remove a redundant assignment.

procfs_getattr: correct size of /proc/self.

procfs_readdir:
- fix a locking problem, using proclist_foreach_call. PR/27098.
- correct snprintf size argument.

procfs_readdir: fix an offset handling bug after addition of /proc/self.

procfs_readdir: use a list macro.

add 'mounts' file for -o linux, which lists all currently mounted
filesystems; Linux glibc statvfs() uses this to get some of mount flags,
and this file is also useful as /emul/linux/etc/mtab (via symlink)

Removed remaining caddr_t casts we do not need in miscfs. Recompiled
kernel and ran for a day or so. There are still some caddr_t types in
the arguments of some calls, I will do those separately (later) as
they touch a lot more of the system.
Approved by christos@NetBSD.org.

sprintf -> snprintf

unlock the descriptor table simple lock after fd_getfile() call in
procfs_readdir()
fixes procfs locking problems reported on current-users@, problem place
found by enami tsugutomo

Remove some assigned-to but otherwise unused variables.

Changes as discussed with itojun on tech-kern. I have modified the enums
to have KFS or PFS differentiators. Further I have wrapped the enum in
procfs in "#ifdef _KERNEL" as it is done in kernfs.

To see the discussion go to http://mail-index.NetBSD.org/tech-kern/2003/09/
and look for "Mismatched enums in include files" in the list.

remove meaningless line (variable overwritten 2 lines below)

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.106.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Undo part of the ktrace/lwp changes. In particular:
* Remove the "lwp *" argument that was added to vget(). Turns out
that nothing actually used it!
* Remove the "lwp *" arguments that were added to VFS_ROOT(), VFS_VGET(),
and VFS_FHTOVP(); all they did was pass it to vget() (which, as noted
above, didn't use it).
* Remove all of the "lwp *" arguments to internal functions that were added
just to appease the above.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

Add /proc/<pid>/stat for linux compat. j2sdk1.4.2 depends on it.

Make symlinks for directories that point to the actual directory.
Make symlinks to [kqueue] and [misc] for kqueue and misc fds.

do not show nodes corresponding to directory descriptors for process
in fd/ subdirectory, nor allow lookup/open for the nodes
this fixes PR kern/21187 for good, and also avoids interesting directory
locking issues

procfs_readdir(): in Pfd case, only show descriptors of types we want
how to represent (vnodes, fifo, pipes); also use fd_getfile() et al

this avoids annoying EOPNOTSUPP error messages from ls -F and such

procfs_lookup(): use fd_getfile() et al in Pfd case

use fd_getfile() in procfs_getfp(), and FILE_USE()/FILE_UNUSE() the
returned file descriptor pointer appropriately

make some local arrays/variables static + const

use former genfs_eopnotsupp_rele() as genfs_eopnotsupp(), so that vnodes
are vput()/vrele()d as necessary - some filesystems did use the wrong
one for some ops, and it's just safer to not take the chance

based on suggestion by Bill Studenmund

Remove pointless check against PID_MAX. Let pfind() do the validation.
(The new pid allocation code may decide to allocate pids above PID_MAX.)

This addresses PR kerm/19989. Thanks to hamajima@nagoya.ydc.co.jp for submitting this patch which enables /proc/uptime for linux emul. Patch reviewed by atatat@netbsd.org and tron@netbsd.org, approved by tron@netbsd.org.

Cast off_t expression to long long to match format even on 64 bit
plattforms.

Shouldn't we introduce a PRIoff_t macro to create such format strings?

add LK_CANRECURSE in the locking of /dev/<pid>/fd/<n> and remove the curproc
kludge. Thanks to fvdl.

Implement /proc/<pid>/fd/<n>. This is work in progress. Questionable things:
- Is it ok to convert DTYPE_PIPE to VFIFO and DTYPE_SOCKET to VSOCK?
- XXX: Avoid locking issue in ls -Rl /proc by avoiding curproc
- Does I/O to pipes work?
- XXX: Are there security implications?

Just use the "time" variable in the *_getattr functions instead of a call
to (the potentially expensive) microtime().

branches: 1.89.2;
Move code shared by procfs and the kernel proper out of procfs and
into the kernel proper (renaming functions from procfs_* to process_*).

Don't hide the real return code with EPERM.

add a VOP_PUTPAGES method for all the filesystems that don't have pages,
just unlock the interlock.

* Allow machine-dependent code to specify hooks for ptrace(2)
(__HAVE_PTRACE_MACHDEP) and procfs (__HAVE_PROCFS_MACHDEP).
These changes will allow platforms like x86 (XMM) and PowerPC
(AltiVec) to export extended register sets in a sane manner.

* Use __HAVE_PTRACE_MACHDEP to export x86 XMM registers (standard
FP + SSE/SSE2) using PT_{GET,SET}XMMREGS (in the machdep
ptrace request space).
* Use __HAVE_PROCFS_MACHDEP to export x86 XMM registers via
/proc/N/xmmregs in procfs.

add RCSIDs

Remove some variables that are set but never used.

branches: 1.83.2; 1.83.4;
map files are zero-length.

branches: 1.82.2;
procfs_bmap() should never be called, make it a "bad op".
let procfs_mmap() use the default error method.

In procfs_readdir(), give /proc/# directories DT_DIR (rather than DT_REG).

Bump va_blocksize for the map files some more, so that programs with
quite a few mappings have a chance of being handled correctly if
st_blksize is looked at.

For -o linux mounts, add some code to emulate /proc/#/maps.
Needs NAMECACHE_ENTER_REVERSE to include filenames.

branches: 1.78.2;
make some more constant arrays 'const'

make filesystem vnodeop, specop, fifoop and vnodeopv_* arrays const

Add a few linux-style files, only enabled when -o linux is specified
for the mount. Currently these are /proc/cpuinfo and /proc/meminfo.
The former only does something on i386 right now.

remove dead code and other misc cleanup.

Only show the "exe" entry to Linux processes, suggested by christos.
Since there are actually three struct emul's for linux, use the e_name
field to determine eligibility with strcmp().

Some versions of Linux libc look for /proc/.../exe instead of /proc/../file.
Add an entry for "exe" that is the same as "file", provided only if
COMPAT_LINUX is set.

MALLOC()/FREE() are not to be used for variable sized allocations.

<vm/vm.h> -> <uvm/uvm_extern.h>

branches: 1.70.4;
Delete duplicate declaration of atopid().

branches: 1.69.2; 1.69.8;
Make /proc/self a symlink to /proc/curproc. I've observed Linux programs
that expect /proc/self/cmdline to exist.

Change variable used for directory offset from "int" to "off_t".
Overkill, but avoids a host of truncation problems.

Fix PR8270:

Problem turned out to be due to improper handling of reads beyond EOF:
they should just return without error with the uio unchanged, and the
caller will recognize this as a zero-byte return (EOF).

The previous fix to protect directory reads against bogus uio_offset
values returned EINVAL, which broke mount -o union, which only
union'ed in the lower directory if the upper directory cleanly
returned EOF.

While we're here, protect kernfs as well.

protect against large uio_offset

Add support for fcntl(2) to generate VOP_FCNTL calls. Any fcntl
call with F_FSCTL set and F_SETFL calls generate calls to a new
fileop fo_fcntl. Add genfs_fcntl() and soo_fcntl() which return 0
for F_SETFL and EOPNOTSUPP otherwise. Have all leaf filesystems
use genfs_fcntl().

Reviewed by: thorpej
Tested by: wrstuden

Add calls to lock the proclist as appropriate.

Fix a paste-o in procfs_lookup() introduced with the vnode locking changes.
Fixes PR #7961, Mario Kemper <magick@bundy.lip.owl.de>.

Bump osrelease to 1.4E. Add layerfs files, remove null_subr.c.

Update coda to new struct lock in struct vnode.

make fdescfs, kernfs, portalfs, and procfs actually lock their vnodes.
It's not that hard.

Make unionfs set v_vnlock = NULL so any overlayed fs will call its
VOP_LOCK.

branches: 1.61.2; 1.61.4;
PR/7143: Jaromir Docelek: Add procfs/cmdline from Linux emulation

Add /proc/#/map. From FreeBSD.

- Use proclists[], rather than checking allproc and zombproc explicitly.
- Add some comments about locking.