remove unneeded includes in sys/kern
ok mpi@ miod@

snprintf(9) allows NULL string if size is 0. But doing NULL pointer
arithmetic is undefined behavior. Check that size is positive
before adding to pointer. While there, use NUL char for string
termination.
found by kubsan; joint work with tobhe@; OK millert@

kernel: introduce per-CPU panic(9) message buffers

Add a 512-byte buffer (ci_panicbuf) to each cpu_info struct on each
platform for use by panic(9). The first panic on a given CPU writes
its message to this buffer. Subsequent panics on a given CPU print
the panic message to the console but do not modify the buffer. This
aids debugging in two cases:

- If 2+ CPUs panic simultaneously there is no risk of garbled messages
in the panic buffer.

- If a CPU panics and then the operator causes a second panic while
using ddb(4), the operator can still recall the first failure on
a particular CPU.

Misc. changes to support this bigger change:

- Set panicstr atomically to identify the first CPU to reach panic().

- Tweak db_show_panic_cmd() to print all panic messages across all
CPUs. Prefix the first panic with an asterisk ('*').

- Prefer db_printf() to printf() during a panic if we have it.
Apparently it disturbs less global state.

- On amd64, tweak fault() to write the local panic buffer. This needs
more work.

Prompted by bluhm@ and deraadt@. Mostly written by deraadt@.
Discussed with bluhm@, deraadt@ and kettenis@.

Borne from a discussion on tech@ about making panic(9) more MP-safe:

https://marc.info/?l=openbsd-tech&m=162086462316143&w=2

ok kettenis@, visa@, bluhm@, deraadt@

panic does not require a \n at the end. When one is provided, it looks wrong.

Rather than skipping %[sizearg]n in the kernel, panic when it is encountered.
printf(9) already lacked documentation and needs no change.

Implement BOOT_QUIET option that supresses kernel printf output to the
console. When the kernel panics, print console output is enabled such
that we see those messages. Use this option for the powerpc64 boot
kernel.

ok visa@, deraadt@

fix macro indent

Get rid of `ddb_is_active' instead use `db_active'.

From Christian Ludwig <christian_ludwig at genua dot de>

ok visa@

Add a compile-time option called SPLASSERT_WATCH which changes the
default value of kern.splassert to 3, i.e. enter ddb on splassert()
failure. Will be used during fuzzing.

ok mpi@ visa@

irrelevant part snuck into previous commit; from semarie

Correctly deal with upper level unveil's by keeping track of the covering
unveil for each unveil in the process at unveil() time, and refactoring the
handling of current directory and ISDOTDOT to be much more sensible.
Worked out at ns2k18 with guenther@.
ok deraadt@

Do not call logwakeup(), ending in wakeup_n(), while holding a mutex.

Prevents a lock ordering issue between SCHED_LOCK() and printf(9)'s
mutex. While here protect all kprintf() calls ending on the console
with the mutex.

ok kettenis@, visa@

Do not panic from ddb(4) when a lock requirement isn't fulfilled.

Extend the logic already present for panic() to any DDB-related
operation such that if ddb(4) is entered because of a fault or
other trap it is still possible to call 'boot reboot'.

While here stop printing splassert() messages as well, to not fill
the buffer.

ok visa@, deraadt@

Show uvm_fault and trace when typing show panic on a page fault'd kernel

Currently there is only support for amd64, if this change settles
I will add support for the rest of the architectures.

OK kettenis@.

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

Rename Debugger() into db_enter().

Using a name with the 'db_' prefix makes it invisible from the dynamic
profiler.

ok deraadt@, kettenis@, visa@

Unifdef KGDB.

It doesn't compile und hasn't been working during the last decade.

ok kettenis@, deraadt@

Unifdef KADB.

ok deraadt@

Tweak lock inits to make the system runnable with witness(4)
on amd64 and i386.

Allow sendsyslog(2) with LOG_CONS even when /dev/console has not
been opened during init(8). Only log with cnwrite() if cn_devvp
exists, otherwise use cnputc() as fallback. While there move extern
declarations to dev/cons.h.
input and OK deraadt@

Delete the final, inscrutable NOSTRICT and VARARGS lint comments

ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

Add dmesg -s support, to view the output of rc(8) system startup messages.
Help and feedback by Theo and Miod.
OK deraadt@, manpage-ok jmc@

KASSERTMSG(9): New kernel assertion with message

KASSERT() is annoying as it only prints the expression as a string. If you
(developers) want to know a little more information, you have to do:

#ifdef DIAGNOSTIC
if (bad)
panic(...);
#endif

KASSERTMSG() replaces it into a single line:

KASSERTMSG(!bad, ...);

Taken from NetBSD.

(There is a concern that KASSERT() messages are too long; consume more memory,
and not friendly for small monitors. This have to be considered & revisited
later.)

"Like" from henning@
Man page review & advices from jmc@ and schwarze@

reboot(9): Add MI reboot entry function

Now, for kernel to "reboot" (reboot, halt, or shutdown), MD boot(9) is called
in some places. This change introduces a new MI function reboot(9) which is
simply a wrapper to call MD boot(9).

OK kettenis@ deraadt@

Add db_vprintf(), and then use it in ACPI's db_disprint() instead of
formatting into a local buffer.

ok miod@

disable %n in printf(9); there is no need for it in the kernel besides
making format-string vulnerabilities exploitable; inspired by similar
change made by Kees Cook to Linux; ok deraadt@

After a panic, do not fill up the dmesg with splassert messages.
They scroll away the important information. Disable splassert in
panic().
OK deraadt@ uebayasi@ sthen@

add support for %td for ptrdiff_t in kernel printf

this also adds support in gcc 4.x kprintf format checks

ok kettenis@

do not include machine/cpu.h from a .c file; it is the responsibility of
.h files to pull it in, if needed
ok tedu

Allow kernel printfs to go to console if in ddb instead of being redirected
to xconsole. ok deraadt@ guenther@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

Do not disallow kernel crash dumps on panic if swap encryption is enabled,
as dumpsys() will now clear the sensitive information.

ok djm@ (and dumpsys changes too)

Remove unused variable consintr. ok mbalmer

Introduce %z for printf(9), like %z for printf(3). Used to print
size_t and ssize_t variables.

OK miod and cthulhu.

Remove support for ddb-only %r, %z, and the ddb-specific handling of %n from
the kernel printf. This will allow support for the real %z in the near future.

enable splassert (1) by default; requested and ok many

allow bit 32 to be printed; bug spotted and fix tested by dlg

missing punctuation in comments; from bret lambert

Make the ddb.log sysctl available as an in-ddb variable, $log, for consistency.

the bit shifted should be a type at least as wide as the comparison (u_quad_t)

extend %b support so that it will allow for arguments with more than 32 bits.

tprintf() is now only necessary for NFS, so do not compile it for kernels
which like NFSSERVER and NFSCLIENT.

ansi and deregister. No binary change.

typo in comment: sprintf -> snprintf, ok markus@

Try to start log message buffer on a new line. Helps install scripts avoid
detecting phantom devices when scanning dmesg output.

Suggested by miod@, ok deraadt@.

protect printf with a mutex instead of SIMPLELOCK.

debranch SMP, have fun

put an mi wrapper around stdarg.h/varargs.h. gcc3 moved stdarg/varargs macros
to built-ins, so eventually we will have one version of these files.
Special adjustments for the kernel to cope: machine/stdarg.h -> sys/stdarg.h
and machine/ansi.h needs to have a _BSD_VA_LIST_ for syslog* prototypes.
okay millert@, drahn@, miod@.

Kill non-standard kernel printf %: braindead extension for good.
ok markus@ drahn@

option to log ddb output to kernel message buffer, via sysctl ddb.log
ok deraadt@ henric@ djm@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Add kern.splassert=3. deraadt@ ok.

typos in comments; From: Bengt Wessling <bengt@lemuria.org>, 10x

remove sprintf() and vsprintf(). nothing in the kernel needs it. if
some module does -- tough -- they can rewrite it using the safer versions.

Match vprintf prototype to userland and standards.

deraadt@ ok

ansi and de-register; ok millert

Kill a bunch more commons (very few left =)

warn for strcpy|strcat|sprintf|vsprintf; ok art dhartmei pval, and either henning or pb, i cannot tell which it was

use snprintf

Fix kernel snprintf function(s) to be like
userland in return values.

deraadt@ ok.

Stuff needed for gcc 3.X.

gcc has the nice feature of optimizing various common constructs into
more optimal ones, inlining various calls, etc. The problem with that
is that it assumes that we have a proper libc backing us. We really
don't want to loose all those features by defining -ffreestanding and
right now there is no way to just disable some of them, so we have to
make the kernel more libc-like in some aspects to make it work with
newer gcc.

rename putchar to kputchar because it was nothing like libc putchar (and
only internal to this function). Implement dummy putchar and puts (not
prototyped outside this file).

Add one more level to the kern.splassert sysctl.
0 - do nothing.
1 - small message on error (function name and the levels).
2 - big message on error (function name, levels and traceback (if possible)).
3 - panic.
After suggestion from deraadt@.

dump the stack on splassert failure (XXX - need some kind of
rate limiting).

If ddb.panic is disabled, print the stack trace before dumping.

Implement splassert() for sparc - a tool for finding problems related to
spl handling (already found 3 problems).

Man page in a few seconds.
deraadt@ ok.

Kill #if __STDC__ used to do K&R vs. ANSI varargs/stdarg; just do things
the ANSI way.

First round of __P removal in sys

Allocate rusage, pgrp, ucred and session with pool.

branches: 1.37.2;
remove some XXX comments

remove statics

make sure that va_start() has matching va_end()

use %ll instead of %q

remove old vm

KNF

avoid sign extension for %b

disable automatic crashdump when swap encryption is on

Get rid of leading NULs in /kern/msgbuf. If the msgbuf modified in between
reads at just the right time is is possible to get duplicate output but
in practice this is extremely rare. Joint effort with Theo.

Add an option DDB_SAFE_CONSOLE that defaults db_console to 1.
In many cases, setting db_console in /etc/rc is too late.

enlarge msgbuf, somewhat line netbsd did

branches: 1.26.2;
snprintf in kernel; assar@stacken.kth.se

panic prints a newline for you, don't do it in the panic string

NUL terminate the buffer in vsprintf

default to console ddb off

rename ddb.panic_ddb, and add ddb.console. Now you can stop console ddb entry
with a sysctl. There will be architectures and drivers that lack function,
and I trust the maintainers of those will forget to add the code..

NULL deref

support expanded panicstr; and add vsprintf back

sysctl ddb.panic_ddb; felix@mamba.pond.sub.org

Do not lose the first char in msgbuf

import torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats.

XXX: new kprintf still supports several non-standard '%' formats:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

added 'q' modifier (64-bit integers) in kernel vsprintf/kprintf

-Wcast-qual cleanup

back out bitmask_snprintf()

Commented out a def, only referenced in out-commented code

added bitmap_snprintf

__assert added, impl from netbsd, however put elsewhere. use it instead
of private versions (one even using the userland header) in if_sn.c

fix vsnprintf return val

make printf/addlog return 0, for compat to userland

Fixed NetBSD pr #2633 (douzzer@mit.edu)--Be slightly more reasonable
about something like printf ("bogus format %l");

-Wall & -Wstrict-prototype fixes

expand %d is panicstr

sync syscalls, no sys/cpu.h

partial sync with netbsd 960418, more to come

NetBSD 960317 merge

From NetBSD: Merge with NetBSD 960217

branches: 1.1.1;
Initial revision

snprintf(9) allows NULL string if size is 0. But doing NULL pointer
arithmetic is undefined behavior. Check that size is positive
before adding to pointer. While there, use NUL char for string
termination.
found by kubsan; joint work with tobhe@; OK millert@

kernel: introduce per-CPU panic(9) message buffers

Add a 512-byte buffer (ci_panicbuf) to each cpu_info struct on each
platform for use by panic(9). The first panic on a given CPU writes
its message to this buffer. Subsequent panics on a given CPU print
the panic message to the console but do not modify the buffer. This
aids debugging in two cases:

- If 2+ CPUs panic simultaneously there is no risk of garbled messages
in the panic buffer.

- If a CPU panics and then the operator causes a second panic while
using ddb(4), the operator can still recall the first failure on
a particular CPU.

Misc. changes to support this bigger change:

- Set panicstr atomically to identify the first CPU to reach panic().

- Tweak db_show_panic_cmd() to print all panic messages across all
CPUs. Prefix the first panic with an asterisk ('*').

- Prefer db_printf() to printf() during a panic if we have it.
Apparently it disturbs less global state.

- On amd64, tweak fault() to write the local panic buffer. This needs
more work.

Prompted by bluhm@ and deraadt@. Mostly written by deraadt@.
Discussed with bluhm@, deraadt@ and kettenis@.

Borne from a discussion on tech@ about making panic(9) more MP-safe:

https://marc.info/?l=openbsd-tech&m=162086462316143&w=2

ok kettenis@, visa@, bluhm@, deraadt@

panic does not require a \n at the end. When one is provided, it looks wrong.

Rather than skipping %[sizearg]n in the kernel, panic when it is encountered.
printf(9) already lacked documentation and needs no change.

Implement BOOT_QUIET option that supresses kernel printf output to the
console. When the kernel panics, print console output is enabled such
that we see those messages. Use this option for the powerpc64 boot
kernel.

ok visa@, deraadt@

fix macro indent

Get rid of `ddb_is_active' instead use `db_active'.

From Christian Ludwig <christian_ludwig at genua dot de>

ok visa@

Add a compile-time option called SPLASSERT_WATCH which changes the
default value of kern.splassert to 3, i.e. enter ddb on splassert()
failure. Will be used during fuzzing.

ok mpi@ visa@

irrelevant part snuck into previous commit; from semarie

Correctly deal with upper level unveil's by keeping track of the covering
unveil for each unveil in the process at unveil() time, and refactoring the
handling of current directory and ISDOTDOT to be much more sensible.
Worked out at ns2k18 with guenther@.
ok deraadt@

Do not call logwakeup(), ending in wakeup_n(), while holding a mutex.

Prevents a lock ordering issue between SCHED_LOCK() and printf(9)'s
mutex. While here protect all kprintf() calls ending on the console
with the mutex.

ok kettenis@, visa@

Do not panic from ddb(4) when a lock requirement isn't fulfilled.

Extend the logic already present for panic() to any DDB-related
operation such that if ddb(4) is entered because of a fault or
other trap it is still possible to call 'boot reboot'.

While here stop printing splassert() messages as well, to not fill
the buffer.

ok visa@, deraadt@

Show uvm_fault and trace when typing show panic on a page fault'd kernel

Currently there is only support for amd64, if this change settles
I will add support for the rest of the architectures.

OK kettenis@.

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

Rename Debugger() into db_enter().

Using a name with the 'db_' prefix makes it invisible from the dynamic
profiler.

ok deraadt@, kettenis@, visa@

Unifdef KGDB.

It doesn't compile und hasn't been working during the last decade.

ok kettenis@, deraadt@

Unifdef KADB.

ok deraadt@

Tweak lock inits to make the system runnable with witness(4)
on amd64 and i386.

Allow sendsyslog(2) with LOG_CONS even when /dev/console has not
been opened during init(8). Only log with cnwrite() if cn_devvp
exists, otherwise use cnputc() as fallback. While there move extern
declarations to dev/cons.h.
input and OK deraadt@

Delete the final, inscrutable NOSTRICT and VARARGS lint comments

ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

Add dmesg -s support, to view the output of rc(8) system startup messages.
Help and feedback by Theo and Miod.
OK deraadt@, manpage-ok jmc@

KASSERTMSG(9): New kernel assertion with message

KASSERT() is annoying as it only prints the expression as a string. If you
(developers) want to know a little more information, you have to do:

#ifdef DIAGNOSTIC
if (bad)
panic(...);
#endif

KASSERTMSG() replaces it into a single line:

KASSERTMSG(!bad, ...);

Taken from NetBSD.

(There is a concern that KASSERT() messages are too long; consume more memory,
and not friendly for small monitors. This have to be considered & revisited
later.)

"Like" from henning@
Man page review & advices from jmc@ and schwarze@

reboot(9): Add MI reboot entry function

Now, for kernel to "reboot" (reboot, halt, or shutdown), MD boot(9) is called
in some places. This change introduces a new MI function reboot(9) which is
simply a wrapper to call MD boot(9).

OK kettenis@ deraadt@

Add db_vprintf(), and then use it in ACPI's db_disprint() instead of
formatting into a local buffer.

ok miod@

disable %n in printf(9); there is no need for it in the kernel besides
making format-string vulnerabilities exploitable; inspired by similar
change made by Kees Cook to Linux; ok deraadt@

After a panic, do not fill up the dmesg with splassert messages.
They scroll away the important information. Disable splassert in
panic().
OK deraadt@ uebayasi@ sthen@

add support for %td for ptrdiff_t in kernel printf

this also adds support in gcc 4.x kprintf format checks

ok kettenis@

do not include machine/cpu.h from a .c file; it is the responsibility of
.h files to pull it in, if needed
ok tedu

Allow kernel printfs to go to console if in ddb instead of being redirected
to xconsole. ok deraadt@ guenther@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

Do not disallow kernel crash dumps on panic if swap encryption is enabled,
as dumpsys() will now clear the sensitive information.

ok djm@ (and dumpsys changes too)

Remove unused variable consintr. ok mbalmer

Introduce %z for printf(9), like %z for printf(3). Used to print
size_t and ssize_t variables.

OK miod and cthulhu.

Remove support for ddb-only %r, %z, and the ddb-specific handling of %n from
the kernel printf. This will allow support for the real %z in the near future.

enable splassert (1) by default; requested and ok many

allow bit 32 to be printed; bug spotted and fix tested by dlg

missing punctuation in comments; from bret lambert

Make the ddb.log sysctl available as an in-ddb variable, $log, for consistency.

the bit shifted should be a type at least as wide as the comparison (u_quad_t)

extend %b support so that it will allow for arguments with more than 32 bits.

tprintf() is now only necessary for NFS, so do not compile it for kernels
which like NFSSERVER and NFSCLIENT.

ansi and deregister. No binary change.

typo in comment: sprintf -> snprintf, ok markus@

Try to start log message buffer on a new line. Helps install scripts avoid
detecting phantom devices when scanning dmesg output.

Suggested by miod@, ok deraadt@.

protect printf with a mutex instead of SIMPLELOCK.

debranch SMP, have fun

put an mi wrapper around stdarg.h/varargs.h. gcc3 moved stdarg/varargs macros
to built-ins, so eventually we will have one version of these files.
Special adjustments for the kernel to cope: machine/stdarg.h -> sys/stdarg.h
and machine/ansi.h needs to have a _BSD_VA_LIST_ for syslog* prototypes.
okay millert@, drahn@, miod@.

Kill non-standard kernel printf %: braindead extension for good.
ok markus@ drahn@

option to log ddb output to kernel message buffer, via sysctl ddb.log
ok deraadt@ henric@ djm@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Add kern.splassert=3. deraadt@ ok.

typos in comments; From: Bengt Wessling <bengt@lemuria.org>, 10x

remove sprintf() and vsprintf(). nothing in the kernel needs it. if
some module does -- tough -- they can rewrite it using the safer versions.

Match vprintf prototype to userland and standards.

deraadt@ ok

ansi and de-register; ok millert

Kill a bunch more commons (very few left =)

warn for strcpy|strcat|sprintf|vsprintf; ok art dhartmei pval, and either henning or pb, i cannot tell which it was

use snprintf

Fix kernel snprintf function(s) to be like
userland in return values.

deraadt@ ok.

Stuff needed for gcc 3.X.

gcc has the nice feature of optimizing various common constructs into
more optimal ones, inlining various calls, etc. The problem with that
is that it assumes that we have a proper libc backing us. We really
don't want to loose all those features by defining -ffreestanding and
right now there is no way to just disable some of them, so we have to
make the kernel more libc-like in some aspects to make it work with
newer gcc.

rename putchar to kputchar because it was nothing like libc putchar (and
only internal to this function). Implement dummy putchar and puts (not
prototyped outside this file).

Add one more level to the kern.splassert sysctl.
0 - do nothing.
1 - small message on error (function name and the levels).
2 - big message on error (function name, levels and traceback (if possible)).
3 - panic.
After suggestion from deraadt@.

dump the stack on splassert failure (XXX - need some kind of
rate limiting).

If ddb.panic is disabled, print the stack trace before dumping.

Implement splassert() for sparc - a tool for finding problems related to
spl handling (already found 3 problems).

Man page in a few seconds.
deraadt@ ok.

Kill #if __STDC__ used to do K&R vs. ANSI varargs/stdarg; just do things
the ANSI way.

First round of __P removal in sys

Allocate rusage, pgrp, ucred and session with pool.

branches: 1.37.2;
remove some XXX comments

remove statics

make sure that va_start() has matching va_end()

use %ll instead of %q

remove old vm

KNF

avoid sign extension for %b

disable automatic crashdump when swap encryption is on

Get rid of leading NULs in /kern/msgbuf. If the msgbuf modified in between
reads at just the right time is is possible to get duplicate output but
in practice this is extremely rare. Joint effort with Theo.

Add an option DDB_SAFE_CONSOLE that defaults db_console to 1.
In many cases, setting db_console in /etc/rc is too late.

enlarge msgbuf, somewhat line netbsd did

branches: 1.26.2;
snprintf in kernel; assar@stacken.kth.se

panic prints a newline for you, don't do it in the panic string

NUL terminate the buffer in vsprintf

default to console ddb off

rename ddb.panic_ddb, and add ddb.console. Now you can stop console ddb entry
with a sysctl. There will be architectures and drivers that lack function,
and I trust the maintainers of those will forget to add the code..

NULL deref

support expanded panicstr; and add vsprintf back

sysctl ddb.panic_ddb; felix@mamba.pond.sub.org

Do not lose the first char in msgbuf

import torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats.

XXX: new kprintf still supports several non-standard '%' formats:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

added 'q' modifier (64-bit integers) in kernel vsprintf/kprintf

-Wcast-qual cleanup

back out bitmask_snprintf()

Commented out a def, only referenced in out-commented code

added bitmap_snprintf

__assert added, impl from netbsd, however put elsewhere. use it instead
of private versions (one even using the userland header) in if_sn.c

fix vsnprintf return val

make printf/addlog return 0, for compat to userland

Fixed NetBSD pr #2633 (douzzer@mit.edu)--Be slightly more reasonable
about something like printf ("bogus format %l");

-Wall & -Wstrict-prototype fixes

expand %d is panicstr

sync syscalls, no sys/cpu.h

partial sync with netbsd 960418, more to come

NetBSD 960317 merge

From NetBSD: Merge with NetBSD 960217

branches: 1.1.1;
Initial revision

kernel: introduce per-CPU panic(9) message buffers

Add a 512-byte buffer (ci_panicbuf) to each cpu_info struct on each
platform for use by panic(9). The first panic on a given CPU writes
its message to this buffer. Subsequent panics on a given CPU print
the panic message to the console but do not modify the buffer. This
aids debugging in two cases:

- If 2+ CPUs panic simultaneously there is no risk of garbled messages
in the panic buffer.

- If a CPU panics and then the operator causes a second panic while
using ddb(4), the operator can still recall the first failure on
a particular CPU.

Misc. changes to support this bigger change:

- Set panicstr atomically to identify the first CPU to reach panic().

- Tweak db_show_panic_cmd() to print all panic messages across all
CPUs. Prefix the first panic with an asterisk ('*').

- Prefer db_printf() to printf() during a panic if we have it.
Apparently it disturbs less global state.

- On amd64, tweak fault() to write the local panic buffer. This needs
more work.

Prompted by bluhm@ and deraadt@. Mostly written by deraadt@.
Discussed with bluhm@, deraadt@ and kettenis@.

Borne from a discussion on tech@ about making panic(9) more MP-safe:

https://marc.info/?l=openbsd-tech&m=162086462316143&w=2

ok kettenis@, visa@, bluhm@, deraadt@

panic does not require a \n at the end. When one is provided, it looks wrong.

Rather than skipping %[sizearg]n in the kernel, panic when it is encountered.
printf(9) already lacked documentation and needs no change.

Implement BOOT_QUIET option that supresses kernel printf output to the
console. When the kernel panics, print console output is enabled such
that we see those messages. Use this option for the powerpc64 boot
kernel.

ok visa@, deraadt@

fix macro indent

Get rid of `ddb_is_active' instead use `db_active'.

From Christian Ludwig <christian_ludwig at genua dot de>

ok visa@

Add a compile-time option called SPLASSERT_WATCH which changes the
default value of kern.splassert to 3, i.e. enter ddb on splassert()
failure. Will be used during fuzzing.

ok mpi@ visa@

irrelevant part snuck into previous commit; from semarie

Correctly deal with upper level unveil's by keeping track of the covering
unveil for each unveil in the process at unveil() time, and refactoring the
handling of current directory and ISDOTDOT to be much more sensible.
Worked out at ns2k18 with guenther@.
ok deraadt@

Do not call logwakeup(), ending in wakeup_n(), while holding a mutex.

Prevents a lock ordering issue between SCHED_LOCK() and printf(9)'s
mutex. While here protect all kprintf() calls ending on the console
with the mutex.

ok kettenis@, visa@

Do not panic from ddb(4) when a lock requirement isn't fulfilled.

Extend the logic already present for panic() to any DDB-related
operation such that if ddb(4) is entered because of a fault or
other trap it is still possible to call 'boot reboot'.

While here stop printing splassert() messages as well, to not fill
the buffer.

ok visa@, deraadt@

Show uvm_fault and trace when typing show panic on a page fault'd kernel

Currently there is only support for amd64, if this change settles
I will add support for the rest of the architectures.

OK kettenis@.

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

Rename Debugger() into db_enter().

Using a name with the 'db_' prefix makes it invisible from the dynamic
profiler.

ok deraadt@, kettenis@, visa@

Unifdef KGDB.

It doesn't compile und hasn't been working during the last decade.

ok kettenis@, deraadt@

Unifdef KADB.

ok deraadt@

Tweak lock inits to make the system runnable with witness(4)
on amd64 and i386.

Allow sendsyslog(2) with LOG_CONS even when /dev/console has not
been opened during init(8). Only log with cnwrite() if cn_devvp
exists, otherwise use cnputc() as fallback. While there move extern
declarations to dev/cons.h.
input and OK deraadt@

Delete the final, inscrutable NOSTRICT and VARARGS lint comments

ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

Add dmesg -s support, to view the output of rc(8) system startup messages.
Help and feedback by Theo and Miod.
OK deraadt@, manpage-ok jmc@

KASSERTMSG(9): New kernel assertion with message

KASSERT() is annoying as it only prints the expression as a string. If you
(developers) want to know a little more information, you have to do:

#ifdef DIAGNOSTIC
if (bad)
panic(...);
#endif

KASSERTMSG() replaces it into a single line:

KASSERTMSG(!bad, ...);

Taken from NetBSD.

(There is a concern that KASSERT() messages are too long; consume more memory,
and not friendly for small monitors. This have to be considered & revisited
later.)

"Like" from henning@
Man page review & advices from jmc@ and schwarze@

reboot(9): Add MI reboot entry function

Now, for kernel to "reboot" (reboot, halt, or shutdown), MD boot(9) is called
in some places. This change introduces a new MI function reboot(9) which is
simply a wrapper to call MD boot(9).

OK kettenis@ deraadt@

Add db_vprintf(), and then use it in ACPI's db_disprint() instead of
formatting into a local buffer.

ok miod@

disable %n in printf(9); there is no need for it in the kernel besides
making format-string vulnerabilities exploitable; inspired by similar
change made by Kees Cook to Linux; ok deraadt@

After a panic, do not fill up the dmesg with splassert messages.
They scroll away the important information. Disable splassert in
panic().
OK deraadt@ uebayasi@ sthen@

add support for %td for ptrdiff_t in kernel printf

this also adds support in gcc 4.x kprintf format checks

ok kettenis@

do not include machine/cpu.h from a .c file; it is the responsibility of
.h files to pull it in, if needed
ok tedu

Allow kernel printfs to go to console if in ddb instead of being redirected
to xconsole. ok deraadt@ guenther@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

Do not disallow kernel crash dumps on panic if swap encryption is enabled,
as dumpsys() will now clear the sensitive information.

ok djm@ (and dumpsys changes too)

Remove unused variable consintr. ok mbalmer

Introduce %z for printf(9), like %z for printf(3). Used to print
size_t and ssize_t variables.

OK miod and cthulhu.

Remove support for ddb-only %r, %z, and the ddb-specific handling of %n from
the kernel printf. This will allow support for the real %z in the near future.

enable splassert (1) by default; requested and ok many

allow bit 32 to be printed; bug spotted and fix tested by dlg

missing punctuation in comments; from bret lambert

Make the ddb.log sysctl available as an in-ddb variable, $log, for consistency.

the bit shifted should be a type at least as wide as the comparison (u_quad_t)

extend %b support so that it will allow for arguments with more than 32 bits.

tprintf() is now only necessary for NFS, so do not compile it for kernels
which like NFSSERVER and NFSCLIENT.

ansi and deregister. No binary change.

typo in comment: sprintf -> snprintf, ok markus@

Try to start log message buffer on a new line. Helps install scripts avoid
detecting phantom devices when scanning dmesg output.

Suggested by miod@, ok deraadt@.

protect printf with a mutex instead of SIMPLELOCK.

debranch SMP, have fun

put an mi wrapper around stdarg.h/varargs.h. gcc3 moved stdarg/varargs macros
to built-ins, so eventually we will have one version of these files.
Special adjustments for the kernel to cope: machine/stdarg.h -> sys/stdarg.h
and machine/ansi.h needs to have a _BSD_VA_LIST_ for syslog* prototypes.
okay millert@, drahn@, miod@.

Kill non-standard kernel printf %: braindead extension for good.
ok markus@ drahn@

option to log ddb output to kernel message buffer, via sysctl ddb.log
ok deraadt@ henric@ djm@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Add kern.splassert=3. deraadt@ ok.

typos in comments; From: Bengt Wessling <bengt@lemuria.org>, 10x

remove sprintf() and vsprintf(). nothing in the kernel needs it. if
some module does -- tough -- they can rewrite it using the safer versions.

Match vprintf prototype to userland and standards.

deraadt@ ok

ansi and de-register; ok millert

Kill a bunch more commons (very few left =)

warn for strcpy|strcat|sprintf|vsprintf; ok art dhartmei pval, and either henning or pb, i cannot tell which it was

use snprintf

Fix kernel snprintf function(s) to be like
userland in return values.

deraadt@ ok.

Stuff needed for gcc 3.X.

gcc has the nice feature of optimizing various common constructs into
more optimal ones, inlining various calls, etc. The problem with that
is that it assumes that we have a proper libc backing us. We really
don't want to loose all those features by defining -ffreestanding and
right now there is no way to just disable some of them, so we have to
make the kernel more libc-like in some aspects to make it work with
newer gcc.

rename putchar to kputchar because it was nothing like libc putchar (and
only internal to this function). Implement dummy putchar and puts (not
prototyped outside this file).

Add one more level to the kern.splassert sysctl.
0 - do nothing.
1 - small message on error (function name and the levels).
2 - big message on error (function name, levels and traceback (if possible)).
3 - panic.
After suggestion from deraadt@.

dump the stack on splassert failure (XXX - need some kind of
rate limiting).

If ddb.panic is disabled, print the stack trace before dumping.

Implement splassert() for sparc - a tool for finding problems related to
spl handling (already found 3 problems).

Man page in a few seconds.
deraadt@ ok.

Kill #if __STDC__ used to do K&R vs. ANSI varargs/stdarg; just do things
the ANSI way.

First round of __P removal in sys

Allocate rusage, pgrp, ucred and session with pool.

branches: 1.37.2;
remove some XXX comments

remove statics

make sure that va_start() has matching va_end()

use %ll instead of %q

remove old vm

KNF

avoid sign extension for %b

disable automatic crashdump when swap encryption is on

Get rid of leading NULs in /kern/msgbuf. If the msgbuf modified in between
reads at just the right time is is possible to get duplicate output but
in practice this is extremely rare. Joint effort with Theo.

Add an option DDB_SAFE_CONSOLE that defaults db_console to 1.
In many cases, setting db_console in /etc/rc is too late.

enlarge msgbuf, somewhat line netbsd did

branches: 1.26.2;
snprintf in kernel; assar@stacken.kth.se

panic prints a newline for you, don't do it in the panic string

NUL terminate the buffer in vsprintf

default to console ddb off

rename ddb.panic_ddb, and add ddb.console. Now you can stop console ddb entry
with a sysctl. There will be architectures and drivers that lack function,
and I trust the maintainers of those will forget to add the code..

NULL deref

support expanded panicstr; and add vsprintf back

sysctl ddb.panic_ddb; felix@mamba.pond.sub.org

Do not lose the first char in msgbuf

import torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats.

XXX: new kprintf still supports several non-standard '%' formats:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

added 'q' modifier (64-bit integers) in kernel vsprintf/kprintf

-Wcast-qual cleanup

back out bitmask_snprintf()

Commented out a def, only referenced in out-commented code

added bitmap_snprintf

__assert added, impl from netbsd, however put elsewhere. use it instead
of private versions (one even using the userland header) in if_sn.c

fix vsnprintf return val

make printf/addlog return 0, for compat to userland

Fixed NetBSD pr #2633 (douzzer@mit.edu)--Be slightly more reasonable
about something like printf ("bogus format %l");

-Wall & -Wstrict-prototype fixes

expand %d is panicstr

sync syscalls, no sys/cpu.h

partial sync with netbsd 960418, more to come

NetBSD 960317 merge

From NetBSD: Merge with NetBSD 960217

branches: 1.1.1;
Initial revision

panic does not require a \n at the end. When one is provided, it looks wrong.

Rather than skipping %[sizearg]n in the kernel, panic when it is encountered.
printf(9) already lacked documentation and needs no change.

Implement BOOT_QUIET option that supresses kernel printf output to the
console. When the kernel panics, print console output is enabled such
that we see those messages. Use this option for the powerpc64 boot
kernel.

ok visa@, deraadt@

fix macro indent

Get rid of `ddb_is_active' instead use `db_active'.

From Christian Ludwig <christian_ludwig at genua dot de>

ok visa@

Add a compile-time option called SPLASSERT_WATCH which changes the
default value of kern.splassert to 3, i.e. enter ddb on splassert()
failure. Will be used during fuzzing.

ok mpi@ visa@

irrelevant part snuck into previous commit; from semarie

Correctly deal with upper level unveil's by keeping track of the covering
unveil for each unveil in the process at unveil() time, and refactoring the
handling of current directory and ISDOTDOT to be much more sensible.
Worked out at ns2k18 with guenther@.
ok deraadt@

Do not call logwakeup(), ending in wakeup_n(), while holding a mutex.

Prevents a lock ordering issue between SCHED_LOCK() and printf(9)'s
mutex. While here protect all kprintf() calls ending on the console
with the mutex.

ok kettenis@, visa@

Do not panic from ddb(4) when a lock requirement isn't fulfilled.

Extend the logic already present for panic() to any DDB-related
operation such that if ddb(4) is entered because of a fault or
other trap it is still possible to call 'boot reboot'.

While here stop printing splassert() messages as well, to not fill
the buffer.

ok visa@, deraadt@

Show uvm_fault and trace when typing show panic on a page fault'd kernel

Currently there is only support for amd64, if this change settles
I will add support for the rest of the architectures.

OK kettenis@.

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

Rename Debugger() into db_enter().

Using a name with the 'db_' prefix makes it invisible from the dynamic
profiler.

ok deraadt@, kettenis@, visa@

Unifdef KGDB.

It doesn't compile und hasn't been working during the last decade.

ok kettenis@, deraadt@

Unifdef KADB.

ok deraadt@

Tweak lock inits to make the system runnable with witness(4)
on amd64 and i386.

Allow sendsyslog(2) with LOG_CONS even when /dev/console has not
been opened during init(8). Only log with cnwrite() if cn_devvp
exists, otherwise use cnputc() as fallback. While there move extern
declarations to dev/cons.h.
input and OK deraadt@

Delete the final, inscrutable NOSTRICT and VARARGS lint comments

ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

Add dmesg -s support, to view the output of rc(8) system startup messages.
Help and feedback by Theo and Miod.
OK deraadt@, manpage-ok jmc@

KASSERTMSG(9): New kernel assertion with message

KASSERT() is annoying as it only prints the expression as a string. If you
(developers) want to know a little more information, you have to do:

#ifdef DIAGNOSTIC
if (bad)
panic(...);
#endif

KASSERTMSG() replaces it into a single line:

KASSERTMSG(!bad, ...);

Taken from NetBSD.

(There is a concern that KASSERT() messages are too long; consume more memory,
and not friendly for small monitors. This have to be considered & revisited
later.)

"Like" from henning@
Man page review & advices from jmc@ and schwarze@

reboot(9): Add MI reboot entry function

Now, for kernel to "reboot" (reboot, halt, or shutdown), MD boot(9) is called
in some places. This change introduces a new MI function reboot(9) which is
simply a wrapper to call MD boot(9).

OK kettenis@ deraadt@

Add db_vprintf(), and then use it in ACPI's db_disprint() instead of
formatting into a local buffer.

ok miod@

disable %n in printf(9); there is no need for it in the kernel besides
making format-string vulnerabilities exploitable; inspired by similar
change made by Kees Cook to Linux; ok deraadt@

After a panic, do not fill up the dmesg with splassert messages.
They scroll away the important information. Disable splassert in
panic().
OK deraadt@ uebayasi@ sthen@

add support for %td for ptrdiff_t in kernel printf

this also adds support in gcc 4.x kprintf format checks

ok kettenis@

do not include machine/cpu.h from a .c file; it is the responsibility of
.h files to pull it in, if needed
ok tedu

Allow kernel printfs to go to console if in ddb instead of being redirected
to xconsole. ok deraadt@ guenther@

Correct the links between threads, processes, pgrps, and sessions,
so that the process-level stuff is to/from struct process and not
struct proc. This fixes a bunch of problem cases in rthreads.
Based on earlier work by blambert and myself, but mostly written
at c2k10.

Tested by many: deraadt, sthen, krw, ray, and in snapshots

Do not disallow kernel crash dumps on panic if swap encryption is enabled,
as dumpsys() will now clear the sensitive information.

ok djm@ (and dumpsys changes too)

Remove unused variable consintr. ok mbalmer

Introduce %z for printf(9), like %z for printf(3). Used to print
size_t and ssize_t variables.

OK miod and cthulhu.

Remove support for ddb-only %r, %z, and the ddb-specific handling of %n from
the kernel printf. This will allow support for the real %z in the near future.

enable splassert (1) by default; requested and ok many

allow bit 32 to be printed; bug spotted and fix tested by dlg

missing punctuation in comments; from bret lambert

Make the ddb.log sysctl available as an in-ddb variable, $log, for consistency.

the bit shifted should be a type at least as wide as the comparison (u_quad_t)

extend %b support so that it will allow for arguments with more than 32 bits.

tprintf() is now only necessary for NFS, so do not compile it for kernels
which like NFSSERVER and NFSCLIENT.

ansi and deregister. No binary change.

typo in comment: sprintf -> snprintf, ok markus@

Try to start log message buffer on a new line. Helps install scripts avoid
detecting phantom devices when scanning dmesg output.

Suggested by miod@, ok deraadt@.

protect printf with a mutex instead of SIMPLELOCK.

debranch SMP, have fun

put an mi wrapper around stdarg.h/varargs.h. gcc3 moved stdarg/varargs macros
to built-ins, so eventually we will have one version of these files.
Special adjustments for the kernel to cope: machine/stdarg.h -> sys/stdarg.h
and machine/ansi.h needs to have a _BSD_VA_LIST_ for syslog* prototypes.
okay millert@, drahn@, miod@.

Kill non-standard kernel printf %: braindead extension for good.
ok markus@ drahn@

option to log ddb output to kernel message buffer, via sysctl ddb.log
ok deraadt@ henric@ djm@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Add kern.splassert=3. deraadt@ ok.

typos in comments; From: Bengt Wessling <bengt@lemuria.org>, 10x

remove sprintf() and vsprintf(). nothing in the kernel needs it. if
some module does -- tough -- they can rewrite it using the safer versions.

Match vprintf prototype to userland and standards.

deraadt@ ok

ansi and de-register; ok millert

Kill a bunch more commons (very few left =)

warn for strcpy|strcat|sprintf|vsprintf; ok art dhartmei pval, and either henning or pb, i cannot tell which it was

use snprintf

Fix kernel snprintf function(s) to be like
userland in return values.

deraadt@ ok.

Stuff needed for gcc 3.X.

gcc has the nice feature of optimizing various common constructs into
more optimal ones, inlining various calls, etc. The problem with that
is that it assumes that we have a proper libc backing us. We really
don't want to loose all those features by defining -ffreestanding and
right now there is no way to just disable some of them, so we have to
make the kernel more libc-like in some aspects to make it work with
newer gcc.

rename putchar to kputchar because it was nothing like libc putchar (and
only internal to this function). Implement dummy putchar and puts (not
prototyped outside this file).

Add one more level to the kern.splassert sysctl.
0 - do nothing.
1 - small message on error (function name and the levels).
2 - big message on error (function name, levels and traceback (if possible)).
3 - panic.
After suggestion from deraadt@.

dump the stack on splassert failure (XXX - need some kind of
rate limiting).

If ddb.panic is disabled, print the stack trace before dumping.

Implement splassert() for sparc - a tool for finding problems related to
spl handling (already found 3 problems).

Man page in a few seconds.
deraadt@ ok.

Kill #if __STDC__ used to do K&R vs. ANSI varargs/stdarg; just do things
the ANSI way.

First round of __P removal in sys

Allocate rusage, pgrp, ucred and session with pool.

branches: 1.37.2;
remove some XXX comments

remove statics

make sure that va_start() has matching va_end()

use %ll instead of %q

remove old vm

KNF

avoid sign extension for %b

disable automatic crashdump when swap encryption is on

Get rid of leading NULs in /kern/msgbuf. If the msgbuf modified in between
reads at just the right time is is possible to get duplicate output but
in practice this is extremely rare. Joint effort with Theo.

Add an option DDB_SAFE_CONSOLE that defaults db_console to 1.
In many cases, setting db_console in /etc/rc is too late.

enlarge msgbuf, somewhat line netbsd did

branches: 1.26.2;
snprintf in kernel; assar@stacken.kth.se

panic prints a newline for you, don't do it in the panic string

NUL terminate the buffer in vsprintf

default to console ddb off

rename ddb.panic_ddb, and add ddb.console. Now you can stop console ddb entry
with a sysctl. There will be architectures and drivers that lack function,
and I trust the maintainers of those will forget to add the code..

NULL deref

support expanded panicstr; and add vsprintf back

sysctl ddb.panic_ddb; felix@mamba.pond.sub.org

Do not lose the first char in msgbuf

import torek's vfprintf() from libc [renamed to kprintf and all
floating point stuff removed].

the new kprintf replaces the 3 different (and buggy) versions of
printf that were in the kernel before (kprintf, sprintf, and db_printf),
thus reducing duplicated code by 2/3's. this fixes (or adds) several
printf formats.

XXX: new kprintf still supports several non-standard '%' formats:
%: - passes an additional format string and argument list recursively
%b - used to decode error registers
%r - int, but print in radix "db_radix" [DDB only]
%z - 'signed hex' [DDB only]
%n - unsigned int, but print in radix "db_radix" [DDB only]

note that DDB's "%n" conflicts with standard "%n" which takes the
number of characters written so far and stores it into the integer
indicated by the "int *" pointer arg. yuck!

while here, add comments for each function explaining what it is
supposed to do.

added 'q' modifier (64-bit integers) in kernel vsprintf/kprintf

-Wcast-qual cleanup

back out bitmask_snprintf()

Commented out a def, only referenced in out-commented code

added bitmap_snprintf

__assert added, impl from netbsd, however put elsewhere. use it instead
of private versions (one even using the userland header) in if_sn.c

fix vsnprintf return val

make printf/addlog return 0, for compat to userland

Fixed NetBSD pr #2633 (douzzer@mit.edu)--Be slightly more reasonable
about something like printf ("bogus format %l");

-Wall & -Wstrict-prototype fixes

expand %d is panicstr

sync syscalls, no sys/cpu.h

partial sync with netbsd 960418, more to come

NetBSD 960317 merge

From NetBSD: Merge with NetBSD 960217

branches: 1.1.1;
Initial revision

Rather than skipping %[sizearg]n in the kernel, panic when it is encountered.
printf(9) already lacked documentation and needs no change.

Implement BOOT_QUIET option that supresses kernel printf output to the
console. When the kernel panics, print console output is enabled such
that we see those messages. Use this option for the powerpc64 boot
kernel.

ok visa@, deraadt@

fix macro indent

Get rid of `ddb_is_active' instead use `db_active'.

From Christian Ludwig <christian_ludwig at genua dot de>

ok visa@

Add a compile-time option called SPLASSERT_WATCH which changes the
default value of kern.splassert to 3, i.e. enter ddb on splassert()
failure. Will be used during fuzzing.

ok mpi@ visa@

irrelevant part snuck into previous commit; from semarie