correct indentation

no functional change, found by smatch warnings
ok miod@ bluhm@

remove unneeded includes in sys/kern
ok mpi@ miod@

Since other exported commandnames were increased to 24 and graduated into
proper strings, adapt struct acct's ac_comm similarily. While here increase
ac_mem to 32-bits, increase ac_flag from 8 to 32 bits for future extensions,
add ac_pid for forensics, and reorder the structure to avoid compiler pads.
More work remains in the sa(8) command to use ac_pid better.
This is a flag day for the acct file format, new/old files/tools are incompatible.
ok bluhm millert

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Whitespace.

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

remove unneeded includes in sys/kern
ok mpi@ miod@

Since other exported commandnames were increased to 24 and graduated into
proper strings, adapt struct acct's ac_comm similarily. While here increase
ac_mem to 32-bits, increase ac_flag from 8 to 32 bits for future extensions,
add ac_pid for forensics, and reorder the structure to avoid compiler pads.
More work remains in the sa(8) command to use ac_pid better.
This is a flag day for the acct file format, new/old files/tools are incompatible.
ok bluhm millert

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Whitespace.

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

Since other exported commandnames were increased to 24 and graduated into
proper strings, adapt struct acct's ac_comm similarily. While here increase
ac_mem to 32-bits, increase ac_flag from 8 to 32 bits for future extensions,
add ac_pid for forensics, and reorder the structure to avoid compiler pads.
More work remains in the sa(8) command to use ac_pid better.
This is a flag day for the acct file format, new/old files/tools are incompatible.
ok bluhm millert

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Whitespace.

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

acct(4) ac_tty shouldn't need NODEV from sys/param.h (which is kernel API),
-1 is sufficient to indicate the process had no controlling tty, removing
one more sys/param.h include in our userland
ok millert

Whitespace.

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

Whitespace.

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

Reference unveil(2) in system accounting and daily.8.
Reminder that unveil does not kill from brynet and gsoares.
Wording tweaks from jmc; feedback from deraadt.

ok jmc@, millert@, solene@, "fine with me" deraadt@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.

sweep tree to correct NDIINT op and flags ahead of time. document
the requirement. This allows KERNELPATH to be used to bypass
unveil for crash dumps with nosuidcoredump=2 or 3

ok visa@ deraadt@ florian@

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@

shutdown accounting before shutting down vfs. should prevent some panics.
ok david@ millert@ (iirc)

match syscallargs comments with reality
from Patrick Latifi <patrick.l@hermes.usherb.ca>
ok jason@ tedu@

change arguments to suser. suser now takes the process, and a flags
argument. old cred only calls user suser_ucred. this will allow future
work to more flexibly implement the idea of a root process. looks like
something i saw in freebsd, but a little different.
use of suser_ucred vs suser in file system code should be looked at again,
for the moment semantics remain unchanged.
review and input from art@ testing and further review miod@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Move the accounting disk space watcher into a kernel thread.
Since we do filesystem operations, we need process context.

This should fix accounting on nfs.

Don't set filesize limit to infinity on exit.
This is only needed in accounting and has to be done carefully because
the limit structures are shared between processes.

Found by Denis A. Doroshenko, analysed by Hannah Schroeter.

convert to new timeouts.

branches: 1.7.8;
Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

for acct(), vn_open() with O_APPEND flag so that append-only files work;
problem pointed out by andrew@untraceable.net

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

From NetBSD: 960217 merge

branches: 1.1.1;
Initial revision

Serialize access to the vnode pointers associated with acct(2) system
accounting. Prevents a race where the acct thread and the acct(2)
syscall both tries to close a vnode.

ok visa@

Reported-by: syzbot+bf2ac4d4fa9ee92903b8@syzkaller.appspotmail.com

Add tsleep_nsec(9), msleep_nsec(9), and rwsleep_nsec(9).

Equivalent to their unsuffixed counterparts except that (a) they take
a timeout in terms of nanoseconds, and (b) INFSLP, aka UINT64_MAX (not
zero) indicates that a timeout should not be set.

For now, zero nanoseconds is not a strictly valid invocation: we log a
warning on DIAGNOSTIC kernels if we see such a call. We still sleep
until the next tick in such a case, however. In the future this could
become some sort of poll... TBD.

To facilitate conversions to these interfaces: add inline conversion
functions to sys/time.h for turning your timeout into nanoseconds.

Also do a few easy conversions for warmup and to demonstrate how
further conversions should be done.

Lots of input from mpi@ and ratchov@. Additional input from tedu@,
deraadt@, mortimer@, millert@, and claudio@.

Partly inspired by FreeBSD r247787.

positive feedback from deraadt@, ok mpi@

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Remove almost unused `flags' argument of suser().

The account flag `ASU' will no longer be set but that makes suser()
mpsafe since it no longer mess with a per-process field.

No objection from millert@, ok tedu@, bluhm@

Don't pull in <sys/file.h> just to get fcntl.h

ok deraadt@ krw@

p_comm is the process's command and isn't per thread, so move it from
struct proc to struct process.

ok deraadt@ kettenis@

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Change a bunch of (<blah> *)0 to NULL.

ok beck@ deraadt@

remove stale lint annotations

convert bcopy to memcpy. ok millert

Eliminates struct pcred by moving the real and saved ugids into
struct ucred; struct process then directly links to the ucred

Based on a discussion at c2k10 or so before noting that FreeBSD and
NetBSD did this too.

ok matthew@

Convert some internal APIs to use timespecs instead of timevals

ok matthew@ deraadt@

Use IO_NOLIMIT instead of munging the process's limits

ok beck@

move accounting flags to struct process; idea and ok guenther

Make rusage totals, itimers, and profile settings per-process instead
of per-rthread. Handling of per-thread tick and runtime counters
inspired by how FreeBSD does it.

ok kettenis@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

fix typos in comments, no code changes;
from Brad Tilley <brad at 16systems dot com>;
ok oga@

move p_limit and p_cred into struct process
leave macros behind for now to keep the commit small
ok art beck miod pedro

Retire VOP_LEASE(); It was a bit for NQNFS and has
effectively been a no-op for quite some time now,
without promise for future usage.

ok pedro@
Testing by krw@ (earlier diff)
and Johan Mson Lindman (tybollt@solace.miun.se)

grammar, spelling, and style fixes from bret lambert;
kern_descrip.c change ok deraadt

if a kthread fails to call kthread_exit() but instead returns,
bad things happen. fix acct thread. from art

ansi/deregister.
'go for it' deraadt@

have vn_close() lock the vnode before calling VOP_CLOSE().

fix the acct_*() code so that we always have a proc to lock on.

ok pedro@

This moves access to wall and uptime variables in MI code,
encapsulating all such access into wall-defined functions
that makes sure locking is done as needed.

It also cleans up some uses of wall time vs. uptime some
places, but there is sure to be more of these needed as
well, particularily in MD code. Also, many current calls
to microtime() should probably be changed to getmicrotime(),
or to the {,get}microuptime() versions.

ok art@ deraadt@ aaron@ matthieu@ beck@ sturm@ millert@ others
"Oh, that is not your problem!" from miod@