usbnet drivers: No need for usbnet_busy in uno_mcast.

This callback always runs with IFNET_LOCK held, and during a task
that usbnet_detach prevents scheduling anew and waits for finishing
before completing the detach, so there is no need to hang onto a
reference count here.

(riastradh)

usbnet drivers: No need for usbnet_busy in uno_init.

This callback always runs with the IFNET_LOCK held, and the interface
cannot be detached until the IFNET_LOCK is released, so there is no
need to hang onto a reference count here.  (None of the usbnet
drivers touch the IFNET_LOCK except to verify it is held sometimes.)

(riastradh)

usbnet: Split multicast filter reprogramming into separate operation.

(riastradh)

usbnet drivers: Stop timeout loops early if device is detaching.

(riastradh)

usbnet: Omit needless locking around usbnet_isdying.

Now that is tested and set with atomic_load/store, there is no need
to hold the lock -- which means we can set it while the core lock is
held during, e.g., a reset sequence, and use that to interrupt the
sequence so it doesn't get stuck waiting to time out when the device
is physically removed.

(riastradh)

usbnet: Use atomic_load/store_relaxed for unp_dying.

This way we don't need to hold the core lock to avoid upsetting
sanitizers (which probably find the current code upsetting), and we
can use it to exit early from timeout loops that run under the core
lock (which is probably not necessary for them to do anyway, but
let's worry about that later).

(riastradh)

usbnet: Print diagnostic about refcnt stragglers.

I don't think there can be any, but this message, if printed, would
falsify my hypothesis!

(riastradh)

usbnet: Enter uno_init with the core lock held.

This reduces code in all drivers except urndis(4) and aue(4).

However, it's still safe for urndis to drop the core lock because the
ifnet is locked, and the ifnet lock covers the DOWN->UP (uno_init)
and UP->DOWN (uno_stop) transitions.

(riastradh)

usbnet: Assert ioctl locking.

(riastradh)

usbnet: Impart blame on whose ifnet is unlocked in uno_init.

(riastradh)

usbnet: Don't waste time calling uno_stop if device is detaching.

The hardware is most likely gone, so trying to write to its registers
(and, in some cases, wait until a timeout for a device to reset) is a
waste of time.  Even if it was detached only in software with drvctl,
reattaching it will reset the device anyway.

(riastradh)

cue(4): Return real error code, not -1, on init when detaching.

(riastradh)

usbnet: Avoid IFNET_LOCK on detach if we never attached the ifp.

(riastradh)

usbnet: Clear watchdog timer before stopping hardware.

No need to take the lock again -- which might not be necessary
because the callout and task have completed, but let's obviate the
need to think about that.

(riastradh)

usbnet: Omit needless locking/busying/testing in usbnet_tick_task.

usbnet_stop waits for the task to complete before resetting the
hardware, and usbnet_detach waits for usbnet_stop to complete before
destroying anything, so there's no need for any of this.

(riastradh)

usbnet: Omit needless tests in usbnet_tick.

It's harmless for us to schedule the tick task even if unp_dying or
unp_stopping is set by now, because usbnet_stop will just wait for it
to finish anyway, and the callout can't be scheduled again until the
interface is done stopping and is brought back up again.

No need for unp == NULL test -- un->un_pri is initialized well before
this callout can be scheduled, and is nulled out only at the end of
usbnet_detach, at which point we have already halted this callout.

(riastradh)

usbnet: Uncomment and fix assertion for ifp->if_flags |= IFF_RUNNING.

We always hold IFNET_LOCK for ioctls that end up here -- the ones
that don't hold it are only SIOCADDMULTI/SIOCDELMULTI, which don't
end up here.  However, urndis(4) throws a spanner in the works by
doing weird device initialization.

(riastradh)

usbnet: Don't issue a detach event if we never issued an attach one.

(riastradh)

usbnet: Make detach order reverse attach order, for unp_stat_ch.

No functional change intended.

(riastradh)

usbnet: Detach interface and mii before waiting for refcnt to drain.

All outstanding software activity under usbnet's control -- which is
all that participates in the refcnting -- should be quiesced by
stopping and detaching everything.

(riastradh)

usbnet: Omit needless callout_halt and usb_rem_task_wait.

The callout and tasks cannot be pending at this point -- it is a bug
if usbnet_if_stop failed to quiesce everything, so turn these into
KASSERTs.

(riastradh)

usbnet: Refuse to bring interfaces back up once dying.

Make this happen uniformly across all usbnet drivers, not on a
per-driver basis.

This ensures new activity on the interface can't happen by the time
we have stopped existing activity and waited for it to complete.

(riastradh)

usbnet: Assert IFNET_LOCKED in usbnet_media_upd.

This ensures, if the device is being initialized or stopped,
usbnet_media_upd will not run until it's done, so the reset sequence
has exclusive access to the device registers used by mii.

(riastradh)

usbnet: Fix ordering of actions in usbnet_stop.

Make sure all software activity is quiescent (callouts and tasks,
including ifmedia and mii callbacks -- anything that might trigger
register access) before asking the driver to stop the hardware.  This
way, the driver uno_stop routine is guaranteed exclusive access to
the registers.

This will also enable us to simplify the callouts and tasks so they
don't have to check the software state -- to be done in a separate
commit.

(riastradh)

usbnet: Remove usbnet_set_dying.

Not necessary for the one caller that did it (url(4)): usbnet_detach
handles failed attach just fine without it.

(riastradh)

axen(4), mue(4), smsc(4): Omit irrelevant cases in ioctl.

SIOCSIFFLAGS and SIOCSETHERCAP always end up in ether_ioctl_reinit,
which triggers the same logic to reprogram the multicast filters
anyway.

(riastradh)

usbnet: Omit needless unp == NULL test in usbnet_tick_task.

The task is never scheduled until after un->un_pri is initialized,
and un->un_pri isn't nulled until after the callout and task are
quiescent.

(riastradh)

usbnet: Don't check if_flags for IFF_RUNNING in usbnet_pipe_intr.

The one user of this interface in tree, aue(4), doesn't care --
if_statinc is safe whether IFF_RUNNING or not.

(riastradh)

usbnet: Don't check if_flags for IFF_RUNNING in usbnet_rxeof.

This can only run after we start the pipes in usbnet_init_rx_tx, and
before we abort the pipes in usbnet_stop, during which time if_flags
& IFF_RUNNING is stably set.

(riastradh)

usbnet: Assert IFNET_LOCKED in usbnet_init_rx_tx, usbnet_stop.

Exception: urndis(4) abuses this API to start this logic before the
ifp is actually initialized.  So for the sake of urndis(4), until
sense can be beaten into it, allow the !unp_ifp_attached case to run
without IFNET_LOCK.

(riastradh)

usbnet: Assert IFNET_LOCKED on if_flags change callbacks.

- if_init
- if_stop
- ethersubr(9) ifflags_cb

(riastradh)

usbnet: Ensure access to unp_timer is protected by unp_txlock.

(riastradh)

usbnet: Ensure ifp->if_softc is initialized _before_ publishing ifp.

Otherwise other parts of the system might start using ifp the moment
we if_register it, and trip over null if_softc.

(riastradh)

usbnet: Take IFNET_LOCK around access to if_flags in usbnet_detach.

This is not stable without IFNET_LOCK.  Extraneous calls to
usbnet_stop arising from this race might be harmless, but let's
render it unnecessary to even think about that.

(riastradh)

usbnet: Set and clear IFF_RUNNING slightly earlier and later.

- Set IFF_RUNNING before any calls to usbnet_rxeof are possible.
- Don't clear IFF_RUNNING until all transfers have been aborted.

(riastradh)

usbnet: Simplify usbnet_isdying.

usbnet_detach (or its caller) stops all users before it returns.

If un->un_pri is null at this point, there's a bug -- something
didn't wait for everything to finish before calling usbnet_detach.

(riastradh)

drm: Fix ACPI crud in ALL kernel build.

(riastradh)

i915: Disable PSR for now.

Something seems to be wrong with it, causing the display to get
stuck.  To be diagnosed -- this is a performance optimization, but
it's better to work than to fail to work even if failing to work
costs a little less energy!

(riastradh)

acpi: Assert acpi_register_notify is not called twice.

(riastradh)

i915: Use new acpidisp_register_notify for ACPI VGA events.

(riastradh)

acpivga(4): Provide hooks for ACPI display notifications.

The Intel i915 graphics driver needs to receive ACPI VGA 0x80
notifications, but with NetBSD's ACPI API, each ACPI node -- such as
the VGA node -- can only have one notifier attached, and acpivga(4)
already uses it.

(riastradh)

mips: Issue a sync plunger at the end of mutex_spin_exit.

Same as mutex_exit.  Relevant only on cnMIPS where the store buffers
get clogged.  Recommended by the Cavium documentation.  No semantic
change, only performance -- this only adds a barrier in some cases
where there was none before, so it can't hurt correctness.

(riastradh)

mips: Redefine LLSCSYNC as empty on non-Octeon MP.

This change deletes memory barriers on non-Octeon MP.  However, all
the appropriate acquire and release barriers are already used in
mutex stubs, and no barriers are needed in atomic_* unless we set
__HAVE_ATOMIC_AS_MEMBAR which we don't on MIPS.  So this should be
safe.

Unclear whether we need this even on Octeon -- don't have a clear
reference on why it's here.

(riastradh)

mips: Redefine BDSYNC as sync on Octeon, not syncw.

BDSYNC is used for membar_sync, which is supposed to be a full
sequential consistency barrier, which is not provided by syncw, so
this is necessary for correctness.

BDSYNC is not used for anything else, so this can't hurt performance,
except where it was necessary for correctness anyway or where the
semantic choice of membar_sync was too strong anyway.

(riastradh)

mips: Omit needless SYNC in mutex_exit.

This change deletes a memory barrier.  However, it should be safe:
The semantic requirement for this is already provided by the SYNC_REL
above, before the ll.  And as currently defined, SYNC_REL is at least
as strong as SYNC, so this change can't hurt correctness on its own
(barring CPU errata, which would apply to other users of SYNC_REL and
can be addressed in the definition of SYNC_REL).

Later, perhaps we can relax SYNC_REL to syncw on Octeon if we prove
that it is correct (e.g., if Octeon follows the SPARCv9 partial store
order semantics).

Nix now-unused SYNC macro in asm.h.

(riastradh)

mips: Membar audit.

This change should be safe because it doesn't remove or weaken any
memory barriers, but does add, clarify, or strengthen barriers.

Goals:

- Make sure mutex_enter/exit and mutex_spin_enter/exit have
  acquire/release semantics.

- New macros make maintenance easier and purpose clearer:

  . SYNC_ACQ is for load-before-load/store barrier, and BDSYNC_ACQ
    for a branch delay slot -- currently defined as plain sync for MP
    and nothing, or nop, for UP; thus it is no weaker than SYNC and
    BDSYNC as currently defined, which is syncw on Octeon, plain sync
    on non-Octeon MP, and nothing/nop on UP.

    It is not clear to me whether load-then-syncw or ll/sc-then-syncw
    or even bare load provides load-acquire semantics on Octeon -- if
    no, this will fix bugs; if yes (like it is on SPARC PSO), we can
    relax SYNC_ACQ to be syncw or nothing later.

  . SYNC_REL is for load/store-before-store barrier -- currently
    defined as plain sync for MP and nothing for UP.

    It is not clear to me whether syncw-then-store is enough for
    store-release on Octeon -- if no, we can leave this as is; if
    yes, we can relax SYNC_REL to be syncw on Octeon.

  . SYNC_PLUNGER is there to flush clogged Cavium store buffers, and
    BDSYNC_PLUNGER for a branch delay slot -- syncw on Octeon,
    nothing or nop on non-Octeon.

    => This is not necessary (or, as far as I'm aware, sufficient)
      for acquire semantics -- it serves only to flush store buffers
      where stores might otherwise linger for hundreds of thousands
      of cycles, which would, e.g., cause spin locks to be held for
      unreasonably long durations.

  Newerish revisions of the MIPS ISA also have finer-grained sync
  variants that could be plopped in here.

Mechanism:

Insert these barriers in the right places, replacing only those where
the definition is currently equivalent, so this change is safe.

- Replace #ifdef _MIPS_ARCH_OCTEONP / syncw / #endif at the end of
  atomic_cas_* by SYNC_PLUNGER, which is `sync 4' (a.k.a. syncw) if
  __OCTEON__ and empty otherwise.

  => From what I can tell, __OCTEON__ is defined in at least as many
    contexts as _MIPS_ARCH_OCTEONP -- i.e., there are some Octeons
    with no _MIPS_ARCH_OCTEONP, but I don't know if any of them are
    relevant to us or ever saw the light of day outside Cavium; we
    seem to buid with `-march=octeonp' so this is unlikely to make a
    difference.  If it turns out that we do care, well, now there's
    a central place to make the distinction for sync instructions.

- Replace post-ll/sc SYNC by SYNC_ACQ in _atomic_cas_*, which are
  internal kernel versions used in sys/arch/mips/include/lock.h where
  it assumes they have load-acquire semantics.  Should move this to
  lock.h later, since we _don't_ define __HAVE_ATOMIC_AS_MEMBAR on
  MIPS and so the extra barrier might be costly.

- Insert SYNC_REL before ll/sc, and replace post-ll/sc SYNC by
  SYNC_ACQ, in _ucas_*, which is used without any barriers in futex
  code and doesn't mention barriers in the man page so I have to
  assume it is required to be a release/acquire barrier.

- Change BDSYNC to BDSYNC_ACQ in mutex_enter and mutex_spin_enter.
  This is necessary to provide load-acquire semantics -- unclear if
  it was provided already by syncw on Octeon, but it seems more
  likely that either (a) no sync or syncw is needed at all, or (b)
  syncw is not enough and sync is needed, since syncw is only a
  store-before-store ordering barrier.

- Insert SYNC_REL before ll/sc in mutex_exit and mutex_spin_exit.
  This is currently redundant with the SYNC already there, but
  SYNC_REL more clearly identifies the necessary semantics in case we
  want to define it differently on different systems, and having a
  sync in the middle of an ll/sc is a bit weird and possibly not a
  good idea, so I intend to (carefully) remove the redundant SYNC in
  a later change.

- Change BDSYNC to BDSYNC_PLUNGER at the end of mutex_exit.  This has
  no semantic change right now -- it's syncw on Octeon, sync on
  non-Octeon MP, nop on UP -- but we can relax it later to nop on
  non-Cavium MP.

- Leave LLSCSYNC in for now -- it is apparently there for a Cavium
  erratum, but I'm not sure what the erratum is, exactly, and I have
  no reference for it.  I suspect these can be safely removed, but we
  might have to double up some other syncw instructions -- Linux uses
  it only in store-release sequences, not at the head of every ll/sc.

(riastradh)

mips: Make sure that mutex_spin_exit works even if !DIAGNOSTIC.

The critical store has been under #ifdef DIAGNOSTIC since, uh, 2011.

(riastradh)

drm: Use ACPI_FREE, not kfree, for ACPI_ALLOCATE_BUFFER result.

Most of this code is not currently enabled, but it might be enabled
soon.

(riastradh)

vmem(9): Assert addresses are quantum-aligned.

(riastradh)

amdgpu: Make amdgpu_bios.c ACPI stuff build.

(riastradh)

radeon: Make radeon_bios.c ACPI stuff build.

(riastradh)

linux: Define PCI_CLASS_DISPLAY_OTHER, wanted by radeon/amdgpu.

(riastradh)

linux: Define acpi_size as alias for ACPI_SIZE.

(riastradh)

drm: Move Linux ACPI case aliases to new nbsd-namespace-acpi.h.

(riastradh)

drm: Omit needless conditionals around #include "acpica.h".

(riastradh)

drm: Move acpi_check_dsm &c. from intel_acpi.c to new linux_acpi.c.

(riastradh)

i915: Omit needless ifdefs around ACPI API.

(riastradh)

i915: Use pci_get_segment, not 0.

(riastradh)

drm: Deconditionalize pci_get_segment.

(riastradh)

acpi: Nix conditional pci_get_segment use.

New MI default of 0 serves.

(riastradh)

pci(9): Provide default definition of pci_get_segment, always zero.

pci_machdep.h can define __HAVE_PCI_GET_SEGMENT to provide a nonzero
definition.

(riastradh)

i915: Use new rb_move to relocate the active tree.

(riastradh)

linux: New rb_move(&to, &from) to replace `to = from'.

NetBSD rbtree(3) is not relocatable, so this extra step is needed.
Unfortunately, there's no easy way to automate detection of where we
need to apply this in ported code...

(riastradh)

linux: Actually do post-order tree traversal.

Requires breaking the rbtree(3) abstraction, but this is necessary
because the body of the loop often frees the element, so as is we had
a huge pile of use-after-free going on.

Requires changing struct interval_tree_node's rbnode member to match
the Linux name, since we now use container_of here, and radeon relies
on this.

(riastradh)

alpha: Fix placement of membar for sending ICCB message.

While here, reduce it to membar_exit -- it's obviously not needed for
store-before-load here (although alpha doesn't have anything weaker
than the full sequential consistency `mb'), and although we do need a
store-before-load (and load-before-load) to spin waiting for the CPU
to wake up, that already happens a few lines below with alpha_mb in
the loop anyway.  So no need for membar_sync, which is just `mb'
under the hood -- deleting the membar_sync in this place can't hurt.

The membar_sync had been inserted automatically when converting from
an older style of atomic_ops(3) API.

(riastradh)

pool(9): Membar audit.

- Use atomic_store_release and atomic_load_consume for associating a
  freshly constructed pool_cache with its underlying pool.  The pool
  gets published in various ways before the pool cache is fully
  constructed.

  => Nix membar_sync -- no store-before-load is needed here.

- Take pool_head_lock around sysctl kern.pool TAILQ_FOREACH.  Then take
  a reference count, and drop the lock, around copyout.

  => Otherwise, pools could be partially initialized or freed while
    we're still trying to read from them -- and in the worst case,
    we might see a corrupted view of the tailq.

  => If we kept the lock around copyout, this could deadlock in memory
    allocation.

  => If we didn't take a reference count while releasing the lock, the
    pool could be destroyed while we're trying to traverse the list,
    sending us into oblivion instead of the next element.

(riastradh)

lockstat(4): KNF.  No functional change intended.

(riastradh)

lockstat(4): Membar audit.

- Serialize updates to lockstat_enabled, lockstat_dev_enabled, and
  lockstat_dtrace_enabled with a new __cpu_simple_lock.

- Use xc_barrier to obviate any need for additional membars in
  lockstat_event.

- Use atomic_load/store_* for access that might not be serialized by
  lockstat_lock or lockstat_enabled_lock.

(riastradh)

evbppc/temac(4): Mark unused functions as such.

(riastradh)

drm: Fix membars around dma_buf_put reference count release.

(riastradh)

drm/vmwgfx: First draft.  Passes make depend, doesn't build yet.

(riastradh)

evbppc: fix typo from cfargs rototill.

(riastradh)

powerpc: Sprinkle "memory" clobbers on eieio and nearby asm blocks.

Otherwise the compiler may reorder these around loads and stores,
which mostly defeats the purpose.  `asm volatile' just ensures the
instruction isn't _deleted_; it may still move around.

(riastradh)

powerpc: Implement pv-tracking for unmanaged pages.

Needed for drm.

(riastradh)

powerpc: Implement bus_dmamap_load_raw.

Can probably delete some of the round-trips between bus addresses and
physical addresses -- did these only to copy the logic already in
_bus_dmamap_load_buffer.

(riastradh)

drm: Respect is_console property on main drm device, not fb child.

The MD device enumeration sets the property on, e.g., PCI devices --
not on drm framebuffer children, which are mostly a software
abstraction.  Not sure examining the nouveaufb, intelfb, &c., device
properties is worthwhile at all, but in case it breaks something
let's just leave it in while we're fixing other things.

(riastradh)

macppc: Support *macppc* GENERIC.local, not evbarm GENERIC64.local.

Managed to fumble with a copypasta error of local commits, and
committed the one that didn't work instead of the one that did.

(riastradh)

macppc: Support GENERIC.local.

(riastradh)

sys: Include files.acpica unconditionally.

This way acpica.h always exists unconditionally, so MI code can be
conditional on NACPICA.

It is not great to have such conditionals, but it's better to have

#include "acpica.h"

#ifdef NACPICA > 0

than to have

#if defined(__i386__) || defined(__x86_64__) || defined(__arm__)
#include "acpica.h"
#endif

#ifdef NACPICA > 0

and we can still grep for NACPICA to find places that could be
factored better.

(riastradh)

pmap_pvt.h: Fix bogus include.

(riastradh)

uvm: MI declaration of pmap_pv_protect.

(riastradh)

drm: Use KM_SLEEP to allocate reservation fence arrays.

Except as a fast path in an RCU reader.

The array sizes appear to be reasonably small and not trivially
controlled by userland, from what I can tell, so if my impression is
accurate, it is reasonable to sleep for allocation here.

(riastradh)

membar_ops(3): xref bus_dma, bus_space in SEE ALSO section too

(riastradh)

KERNEL_LOCK(9): New man page for old not-dead-yet hack.

I'm not documenting this to encourage anyone to use it.  I'm only
documenting this to remind myself what the semantics is, because it's
kind of confusing and not at all like mutex(9).

(riastradh)

Revert "i915: Defer final wakeup on active until after retirement."

This reverts i915_active.c 1.11.  ref->retire might free the object,
so touching it is not allowed -- that would use-after-free.  Linux
uses the object only for its address with wake_up_var.

The reason I made this change was that I guessed i915_active_wait has
to wait until after ref->retire finishes -- after all, Linux seems to
defer the wakeup until then.  However, even the Linux code doesn't
guarantee this, because i915_active_wait could be called _during_
ref->retire, and would witness ref->count == 0, and would not wait
until it has completed in that case.  So maybe my guess was wrong,
and it is OK for i915_active_wait to return while ref->retire is
still in flight -- I don't see any logic that obviously requires it
to wait for ref->retire, in any case.

Or maybe something does rely on i915_active_wait to wait for
ref->retire to finish, in which case we need a different mechanism
for i915_active_release itself to wait until i915_active_retire has
woken up, without dereferencing ref since it might be dead after
ref->retire.

(riastradh)

i915: Defer final wakeup on active until after retirement.

Not sure what I was thinking when I moved this earlier!

(riastradh)

linux: Don't skip the last node in rbtree iteration.

(riastradh)

drm/mm: Find nearest geq/leq, not matching, holes in first_hole.

(riastradh)

drm/mm: Allow hole address range queries.

(riastradh)

drm/mm: Assert invariant of another rb lookup.

This one looks a little more questionable.

(riastradh)

drm/mm: Assert invariant of rb lookup.

Just to make sure I didn't get the sense of the lookup reversed,
which is quite likely, because I've done it probably more than once
in this code before...

(riastradh)

drm/ttm: Avoid uninitialized mem in error branch.

Not sure why this error branch is getting hit, but let's not make the
problem worse by choking on stack garbage.

Candidate fix for symptom of PR kern/56565, PR kern/56711.
Underlying problem -- that ttm_bo_mem_space fails with ENOMEM --
remains.

(riastradh)

usbdi(9): Add some missing header include guards.

(riastradh)

usbdi(9): Fix missing includes in usbdi.h.

(riastradh)

hppa: Membar audit in cpu.c.

(riastradh)

drm: Delete mmiowb.

This no longer exists in Linux.

(riastradh)

x86: Membar audit in idt.c.

- idt_vec_free/alloc are obviously supposed to synchronize with a
  happens-before relation, so use release/acquire.

- There is no store-before-load ordering needed, so omit membar_sync.

(riastradh)

rump: Omit unused EIEIO #define, vestige of powerpc bus_dma.c.

(riastradh)

thmap(9): Omit needless fences and use membar_exit for release fence.

It is the caller's responsibility to arrange that thmap_create, and,
if THMAP_SETROOT is set, thmap_root, happen before any use of the
thmap.  No need for them to issue fences internally.

(riastradh)

npf(4): Use atomic_store_release and atomic_load_consume for conn_db.

...or atomic_load_relaxed, when npf->conn_lock is held, for the sake
of C11.

No need for store-before-load implied by membar_sync.

(riastradh)

npf(4): Use atomic_store_release and atomic_load_consume for config.

...or atomic_load_relaxed, when the config is locked.  (Not necessary
to use atomic_* at all in NetBSD, but in C11 it will be cheaper to
say atomic_load_relaxed explicitly so an _Atomic-qualified object
doesn't cause the load to be surrounded by unnecessary membars.)

No need for store-before-load ordering here, so no need to
membar_sync.

(riastradh)

vmx(4): Omit needless membar_sync wrapper.

Nothing uses this, and it is unlikely that any part of this driver
will need store-before-load ordering to synchronize with the host.

(riastradh)

iscsi(4): Fix config_found usage -- needs kernel lock.

Candidate fix for PR kern/56709.

(riastradh)

eqos(4): Nix trailing whitespace.  No functional change.

(riastradh)

eqos(4): membar_* is not appropriate here; use bus_dmamap_sync.

(riastradh)

hppa: __cpu_simple_lock membar audit.

ok skrll

(riastradh)

alpha: __cpu_simple_lock audit.

Add missing "cc" and "memory" asm clobbers to the compiler can't
reorder memory access around these.  The necessary memory barrier
instructions, mb, already appear in all the right places.

(riastradh)

vax: __cpu_simple_lock audit.

Fix missing "memory" asm clobber so the compiler can't reorder memory
access around __cpu_simple_lock/lock_try/unlock.

(riastradh)

or1k: __cpu_simple_lock membar audit.

(riastradh)

sh3: __cpu_simple_unlock needs __insn_barrier.

No multiprocessor support here but the compiler can still reorder
memory access.

(riastradh)

m68k: __cpu_simple_unlock audit.

- Use `cc' clobbers in asm volatile because they touch the condition
  codes.

- Use `memory' clobbers in asm volatile so the compiler doesn't move
  up loads and stores in the critical section at _other_ addresses
  than the lock so they happen before __cpu_simple_lock or
  __cpu_simple_lock_try.

- Not sure if we have any (or if there even are any?) multicore m68k
  systems out there, but __cpu_simple_unlock needs __insn_barrier
  either way so the compiler doesn't delay loads and stores prior to
  __cpu_simple_unlock so they happen after it.

(riastradh)

acorn32: Partial __cpu_simple_lock membar audit.

For __cpu_simple_unlock, __insn_barrier is absolutely required.
Whether we need a stronger memory barrier, I don't know offhand and
I'm not sure what the right architecture manual to consult is -- it's
not clear why this isn't just using the generic arm lock.h.

(riastradh)

sparc: __cpu_simple_lock membar audit.

No functional change -- comments only, to justify the absence of
barriers with reference to chapter & verse.

(riastradh)

__cpu_simple_lock(9): Omit needless barriers in init.

It is, and always has been, the caller's responsibility to ensure the
lock is initialized before it can be used -- otherwise the memory
could hold garbage; it is nonsensical to even attempt locking
operations on it before initialization.

So there's no need to issue explicit barriers here.  The barrier
seems to have been introduced in sys/arch/alpha/alpha/lock_machdep.c
rev. 1.1 (since moved to inline asm in alpha/include/lock.h) and then
copied & pasted into several other architectures.

(riastradh)

__cpu_simple_lock(9): New man page.

This doesn't mean you should use it!  Mostly it's to document the
semantics to help understand existing uses, which should not
proliferate, and audit definitions.

(riastradh)

mips: Brush up __cpu_simple_lock.

- Eradicate last vestiges of mb_* barriers.

- In __cpu_simple_lock_init, omit needless barrier.  It is the
  caller's responsibility to ensure __cpu_simple_lock_init happens
  before other operations on it anyway, so there was never any need
  for a barrier here.

- In __cpu_simple_lock_try, leave comments about memory ordering
  guarantees of the kernel's _atomic_cas_uint, which are inexplicably
  different from the non-underscored atomic_cas_uint.

- In __cpu_simple_unlock, use membar_exit instead of mb_memory, and do
  it unconditionally.

  This ensures that in __cpu_simple_lock/.../__cpu_simple_unlock, all
  memory operations in the ellipsis happen before the store that
  releases the lock.

  - On Octeon, the barrier was omitted altogether, which is a bug --
    it needs to be there or else there is no happens-before relation
    and whoever takes the lock next might see stale values stored or
    even stomp over the unlocking CPU's delayed loads.

  - On non-Octeon, the mb_memory was sync.  Using membar_exit
    preserves this.

  XXX On Octeon, membar_exit only issues syncw -- this seems wrong,
  only store-before-store and not load/store-before-store, unless the
  CNMIPS architecture guarantees it is sufficient here like
  SPARCv8/v9 PSO (`Partial Store Order').

- Leave an essay with citations about why we have an apparently
  pointless syncw _after_ releasing a lock, to work around a design
  bug^W^Wquirk in cnmips which sometimes buffers stores for hundreds
  of thousands of cycles for fun unless you issue syncw.

(riastradh)

sys: Omit vestigial struct devices in softcs after device_t split.

(riastradh)

hppa: Membar audit in ipifuncs.c.

(riastradh)

libpthread: Move namespacing include to top of .c files.

Stuff like libc's namespace.h, or atomic_op_namespace.h, which does
namespacing tricks like `#define atomic_cas_uint _atomic_cas_uint',
has to go at the top of each .c file.  If it goes in the middle, it
might be too late to affect the declarations, and result in compile
errors.

I tripped over this by including <sys/atomic.h> in mips
<machine/lock.h>.

(Maybe we should create a new pthread_namespace.h file for the
purpose, but this'll do for now.)

(riastradh)

sys: Fix various abuse of struct device internals.

Will help to make struct device opaque later.

(riastradh)

ips(4): Missed a couple spots in device_t/softc split.

(riastradh)

veriexec(4): Omit needless device crud in veriexec.c.

(riastradh)

ips(4): device_t/softc split

(riastradh)

evbppc/wdc(4) at obio: Stop fabricating bogus struct device.

Nothing uses this.

(riastradh)

ts(4): Skip fabricating bogus struct device in tsmatch.

Doesn't appear to be used anywhere in tsmatch.  Let's not invent
bogus autoconf guts here.

(riastradh)

ipi(9): Document memory ordering guarantees.

(riastradh)

sparc64/vnet(4): device_t/softc split

(riastradh)

playstation2: Somewhat belated device_t/softc split.

(riastradh)

arm/samsung: Don't abuse child's dv_private for the parent's uses.

dv_private belongs to the device itself, i.e., the child here.

This overwrote the child's softc pointer, causing all kinds of havoc;
if this worked it was by an amazing accident.

(riastradh)

exyopctl(4): Don't leak a duplicate softc on attach.

(riastradh)

arm/ti: Omit needless dv_private assignment in omap2icu_attach.

(riastradh)

ccd(4): Fix typo in comment.

(riastradh)

acpi(9): No need to test dv_locators.

It is always initialized by config_devalloc before config_devlink
makes it visible to device iteration.  No need to reach into private
autoconf internals.

(riastradh)

driver(9): Correct paragraph about the driver activate function.

(riastradh)

driver(9): Delete outdated info about softc and struct device.

(riastradh)

libpthread: Fix membars around rwlocks.

1. After loading self->pt_rwlocked, membar_enter() must not be
  conditional on PTHREAD__ATOMIC_IS_MEMBAR because there is no
  atomic r/m/w operation here which could imply the acquire barrier.

  (This should maybe just be a load-acquire operation, but we don't
  have atomic_load_acquire in userland at the moment -- TBD.)

2. Before storing thread->pt_rwlocked, must issue membar_exit() so
  that this is a store-release operation -- except if we had just
  done an atomic r/m/w and PTHREAD__ATOMIC_IS_MEMBAR is set, in
  which case it can be elided.

  The second membar_exit() added here might be safely hoisted out of
  the loop but I'm not sure -- needs more analysis to prove that
  would be safe.

(riastradh)

ucas(9): Membar audit.

- Omit needless membar_enter before ipi_trigger_broadcast.  This was
  presumably intended to imply a happens-before relation for the
  following two CPUs:

/* CPU doing ucas */
ucas_critical_enter()
ucas_critical_pausing_cpus = ncpu - 1 (A)
ipi_trigger_broadcast()

/* other CPU walking by whistling innocently */
IPI handler
ucas_critical_cpu_gate()
load ucas_critical_pausing_cpus (B)

  That is, this was presumably meant to ensure (A) happens-before (B).
  This relation is already guaranteed by ipi(9), so there is no need
  for any explicit memory barrier.

- Issue a store-release in ucas_critical_cpu_gate so we have the
  following happens-before relation which was otherwise not guaranteed
  except if __HAVE_ATOMIC_AS_MEMBAR:

/* other CPU walking by whistling innocently */
...other logic touching the target ucas word... (A)
IPI handler
ucas_critical_cpu_gate()
...
atomic_dec_uint(&ucas_critical_pausing_cpus)

  happens-before

/* CPU doing ucas */
ucas_critical_enter() -> ucas_critical_wait();
...touching the word with ufetch/ustore... (B)

  We need to ensure the logic (A) on another CPU touching the target
  ucas word happens-before we actually do the ucas at (B).

  (a) This requires the other CPU to do a store-release on
      ucas_critical_pausing_cpus in ucas_critical_cpu_gate, and

  (b) this requires the ucas CPU to do a load-acquire on
      ucas_critical_pausing_cpus in ucas_critical_wait.

  Without _both_ sides -- store-release and then load-acquire -- there
  is no such happens-before guarantee; another CPU may have a buffered
  store, for instance, that clobbers the ucas.

  For now, do the store-release with membar_exit conditional on
  __HAVE_ATOMIC_AS_MEMBAR and then atomic_dec_uint -- later with the
  C11 API we can dispense with the #ifdef and just use
  atomic_fetch_add_explicit(..., memory_order_release).  The
  load-acquire we can do with atomic_load_acquire.

- Issue a load-acquire in ucas_critical_cpu_gate so we have the
  following happens-before relation which was otherwise not guaranteed:

/* CPU doing ucas */
...ufetch/ustore... (A)
ucas_critical_exit()
ucas_critical_pausing_cpus = -1;

/* other CPU walking by whistling innocently */
IPI handler
ucas_critical_cpu_gate()
...
while (ucas_critical_pausing_cpus != -1)
spin;
...other logic touching the target ucas word... (B)

  We need to ensure the logic (A) to do the ucas happens-before logic
  that might use it on another CPU at (B).

  (a) This requires that the ucas CPU do a store-release on
      ucas_critical_pausing_cpus in ucas_critical_exit, and

  (b) this requires that the other CPU do a load-acquire on
      ucas_critical_pausing_cpus in ucas_critical_cpu_gate.

  Without _both_ sides -- store-release and then load-acquire -- there
  is no such happens-before guarantee; the other CPU might witness a
  cached stale value of the target location but a new value of some
  other location in the wrong order.

- Use atomic_load/store_* to avoid the appearance of races, e.g. for
  sanitizers.

- Document which barriers pair up with which barriers and what they're
  doing.

(riastradh)

playstation2: Fix some pre-device_t/softc-split device private sizes.

Nothing appears to use device_private here, so let's not allocate
anything or ask for sizeof(struct device).

(riastradh)

vax: Remove a vestige from before the device_t/softc split.

Verified MicroVAX 4000/96 still boots.

cpu0 at mainbus0: KA49, NVAX, 10KB L1 cache, 256KB L2 cache

(riastradh)

kern: Mark some functions __diagused to pacify clang.

These functions are called only in KASSERT.  This shouldn't be a
problem since the recent change to make KASSERT compile (but not run)
the expression, via sizeof, so the functions are referenced -- which
I did in order to avoid having #ifdefs and regular build breakage
because someone forgot to build with or without DIAGNOSTIC.  But
apparently clang decided to make it a problem.

Maybe we should just set -Wno-unneeded-internal-declaration -- not
clear it flags any real problems, but it takes effort to research
because apparently clang has no documentation about what else it does
or why anyone decided this is objectionable enough to turn it on by
default.  (The only documentation it seems to have, two example
warning messages with no elaboration at
<https://releases.llvm.org/13.0.0/tools/clang/docs/DiagnosticsReference.html#wunneeded-internal-declaration>,
seems to indicate it is mixed up with warning about static non-inline
functions in header files.)

(riastradh)

kernel: Avoid arithmetic overflow in ntp_adjtime.

Reported-by: syzbot+f4343a1c91ddfe8bbe97@syzkaller.appspotmail.com

(riastradh)

uhub(4): Sprinkle dtrace probes.

(riastradh)

usbnet: Defer hardware multicast filter updates to USB task.

Breaks deadlock:

- usbnet_detach holds usbnet lock, awaits kpause in ure_reset
- callout holds softclock `lock' (sequential softints, blocks kpause
  wakeup), awaits softnet_lock in tcp_timer_keep, frag6_fasttimo, &c.
- soclose holds softnet_lock, awaits usbnet lock in SIOCDELMULTI

This change breaks the deadlock by not passing the SIOCADDMULTI or
SIOCDELMULTI ioctl synchronously to the driver, which typically takes
the usbnet lock.

With this change, the ethernet layer still maintains the list of
multicast addresses synchronously, but we defer the driver logic that
updates the hardware multicast filter to an asynchronous USB task
without softnet_lock held.

This doesn't cause exactly the same ioctl to be sent to the driver --
usbnet just sends SIOCDELMULTI with an all-zero struct ifreq, and
might drop some ioctls if issued in quick succession.  This is OK
because none of the drivers actually distinguish between SIOCADDMULTI
and SIOCDELMULTI, or examine the argument; the drivers just commit
whatever multicast addresses are listed in the ethercom.

Other than the different ioctl submitted, there is no change to the
ABI or locking scheme of usbnet, so this is safe to pull up to
netbsd-9.  This means we unfortunately can't guarantee that if a
process issues SIOCADDMULTI and then sendto, the multicast filter
update will be done by the time of the sendto -- and, more
importantly, the packets received in reply to it.  But failing to
guarantee that is better than deadlocking!  Later changes on HEAD
will restore the synchronous multicast filter updates with much more
extensive ABI changes and API simplifications in usbnet(9).

Proposed on tech-net:
https://mail-index.netbsd.org/tech-net/2021/12/30/msg008164.html

XXX pullup-9

(riastradh)

xhci(4): Fix handling of endpoint reset/stop.

Use the same asynchronous task resetting a stalled/halted endpoint
and stopping a running endpoint -- either way we need to put the
endpoint back into a known state and, if there are transfers waiting
to run, start them up again.

- xhci_abortx must not drop the pipe (bus) lock -- usbdi(9) requires
  this.  So arrange to stop the endpoint and empty the queue
  asynchronously.

- If the xhci softint claims an xfer for completion with
  usbd_xfer_trycomplete, it must call usb_transfer_complete without
  ever releasing the pipe (bus) lock -- it can't claim the xfer and
  then defer the usb_transfer_complete to a task.  So arrange to
  reset the endpoint asynchronously, hold up new transfers until the
  endpoint has been reset, and then do usb_transfer_complete
  immediately.

(riastradh)

pmf(9): Conditionalize pmflock_debug output on PMFLOCK_DEBUG.

This is really only helpful for debugging the software logic to
handle the trees of devices for suspend/resume, not for debugging the
drivers, which is most of what we need to do.  If anyone still finds
this useful they can make a sysctl knob for it or something, but for
now this substantially reduces the amount of debug output that's
getting in my way.

(riastradh)

tpm(4): Nix TPM_BE16/TPM_BE32.  Just use sys/endian.h.

(riastradh)

wg(4): Limit the size of ifdrv requests.

Avoids potential integer overflow or kernel memory exhaustion.

Reported by Thomas Leroy a while back.

(riastradh)

xhci(4): Fix citation in comment.

4.15.2.1 is device-initiated resume, but we are doing host-initiated.

No functional change.

(riastradh)

xhci(4): Fix copypasto in resume error message.

(riastradh)

tpm(4): Fix suspend and rework I/O transaction lock.

Use sc->sc_lock over individual I/O transactions, not open/close of
the whole device.  This way there is a bounded time before the tpm is
unbusied even if userland is getting at it, so userland can't hold up
suspend indefinitely.  Of course, the tpm might be suspended and
resumed in the middle of the user's session this way -- tough.

This limits the response buffer to 1024 bytes -- which is already a
bit hefty to have on the stack (but it's probably not very deep on
the stack from userland so maybe not a big deal).  If it turns out we
need more, we can use kmem to allocate a buffer on the heap, with the
caveat that it might fail.  This is necessary so that suspend doesn't
block indefinitely on uiomove in tpmread.

(riastradh)

dk(4): Omit redundant microoptimization around cv_broadcast.

cv_broadcast already has a fast path for the no-waiter case.

(riastradh)

sys/fs/fdesc: Delete silly vnop #define aliases.

(riastradh)

ihidev(4): Prohibit closing an unopened ihidev.

(riastradh)

ihidev(4): Avoid reference count overflow.

(riastradh)

ims(4): Sprinkle KERNEL_LOCKED_P assertions.

Access to the softc and hidms state is currently kernel-locked.

(riastradh)

ihidev(4): Take the lock for ihidev_open, ihidev_close.

Need this to serialize access to sc_state, sc_refcnt.

XXX Should harmonize this with uhidev(4) and tighten assertions.

(riastradh)

ihidev(4): Check kmem_alloc(..., KM_NOSLEEP) for failure.

(riastradh)

ihidev(4): Allocate report buffer with KM_SLEEP.

Limited to 64k and only happens on attach anyway.  Let's not leave a
rake to trip on here.

(riastradh)

ihidev(4): Fix locking and interrupt handler.

- Can't run iic_exec in softint because it does cv_wait, at least on
  some i2c controllers -- defer to workqueue instead.

- Fix violations of locking rules:
  . Do not take a lock at higher IPL than it is defined at!
  . Do not sleep under a lock!
  . Definitely do not sleep under a spin lock!
  In this case, sc_intr_lock was defined at IPL_VM but used at IPL_TTY,
  and i2c transactions -- possibly causing sleep for cv_wait -- were
  issued under it.

  But in this case, the interrupt handler needs only a single bit to
  mark whether the work is pending, so just use atomic_swap for that.

- Use an adaptive lock (IPL_NONE) for i2c transactions.

- Detach children, and do so before freeing anything.

(riastradh)

genfs(9): Prune dead branch.

(riastradh)

ihidev(4): Add missing includes and header guard.

Mark the sections that are conventionally separate files for hardware
interface (*reg.h) versus software state (*var.h).

(riastradh)

lagg(4): Need to take IFNET_LOCK around if_init.

This should really just avoid dropping IFNET_LOCK before it's done
changing the port interface's configuration, but this stop-gap change
will serve provisionally to reduce crashes until we can confirm that
there's no deadlock lurking in the time this logic drops IFNET_LOCK.

(riastradh)

uvideo(4): Fix USB interface numbering.

Don't try to be clever and count -- just use bInterfaceNumber.

The previous logic to count interface descriptors failed to consider
interfaces with alternate settings, which led it to pass an invalid
interface number to usbd_device2interface_handle.

It is simpler to just use the recorded bInterfaceNumber, which is
guaranteed by the USB spec to be zero-indexed and below
bNumInterfaces as we need.

(riastradh)

urlphy(4): Fix missing mii locking in urlphy_attach.

(riastradh)

ukbd(4): Fix previous change to initial LED flashing.

Without this change the LEDs would get stuck on until the first
keypress.  (This also seemed to trigger a crash in heavy load on
bringing aue(4) up and down over and over again while unplugging, but
I'm not sure why and I hope it's not actually related...)

(riastradh)

acpibat(4): Fix race in detach with AcpiOsExecute deferred call.

(riastradh)

lagg(4): Take lock as required around if ioctl.

Note: There are some calls to SIOCADDMULTI/SIOCDELMULTI that take the
lock when they don't need it, but it's not clear it's harmful either
unless they come via a caller that holds softnet_lock.

candidate fix for
https://mail-index.netbsd.org/current-users/2021/12/31/msg041876.html

ok yamaguchi

(riastradh)

arm: Remove #ifdef DIAGNOSTIC now wrong after KASSERT change.

Objects in question aren't volatile here so access is flushable.

(riastradh)

arm: No #if DIAGNOSTIC needed any more.

Compiler can (and gcc does) flush call to strlen when the result is
unused, so no performance impact here.

(riastradh)

drm: Reduce default debug level to driver-specific messages.

Let's make a liiiiittle less log spew by default with `boot -x'.

(riastradh)

thinkpad(4): Omit workaround for acpiec_bus_read.

acpiec_bus_read now initializes the whole ACPI_INTEGER like its
signature suggests, so we don't need to pick out the low bits of the
result or carefully avoid undefined behaviour from uninitialized
stack garbage.

(riastradh)

acpiec(4): Make sure to fully initialize an ACPI_INTEGER on read.

Write as essay about what this is supposed to do, as far as I can
tell from reading acpica and the commit history and the relevant PR.

(riastradh)

acpi(9): Return full 64-bit object to caller in PCI config read.

The value of the object will be as small as requested, but the whole
uint64_t object will be written as the caller of a space handler
expects, instead of just part of it.

(riastradh)

sysmon(9): Document lock order.

(riastradh)

drm: Convert noisy flush_workqueue message to dtrace probe.

(riastradh)

sysmon(9): Fix callout/thread synchronization.

Callout may ONLY take sme_work_mtx, at IPL_SOFTCLOCK; MUST NOT touch
sme_mtx at IPL_NONE.  All state the callout needs is serialized by
sme_work_mtx now:

- calls to sme_schedule_callout
- calls to sme_schedule_halt
- struct sysmon_envsys::sme_events_timeout
- struct sysmon_envsys::sme_events_list
- struct sysmon_envsys::sme_callout_state
- struct envsys_data::flags
  => yes, this is a little silly -- used for ENVSYS_FNEED_REFRESH
  => should maybe separate the static driver-defined features from
    the state flags needed by sysmon_envsys but not important now

Sleeping under sme_work_mtx (except on other adaptive locks at
IPL_SOFTCLOCK) is forbidden.  Calling out to the driver under
sme_work_mtx is forbidden.

This should properly fix:

https://mail-index.netbsd.org/tech-kern/2015/10/14/msg019511.html
PR kern/56592

(riastradh)

sysmon(9): Fix mistake in sysmon_task_queue_barrier.

Need to allocate the task structure with malloc(9), not on the stack;
the task thread will free it with free(9).  Forgot to squash this
into previous commit.

(riastradh)

sys/net: Document if_mcast_op with comment and refuse other commands.

Meant only for multicast addition/deletion operations, nothing else.

(riastradh)

sys/net: Document if_flags_set with a comment.

(riastradh)

ethersubr(9): Assert IFNET_LOCKED in ether_ioctl_reinit.

Changes to if_flags are nontrivial configuration changes that require
the long-term ioctl lock.

(riastradh)

sys/net: Assert IFNET_LOCKED in if_ioctl, if_init, and if_stop.

Exception: Not for SIOCADDMULTI/SIOCDELMULTI, for which it is the
driver's responsibility to take internal locks.  Typically this is
already done via struct ethercom::ec_lock.

(riastradh)

altq(9): Fix missing IFNET_LOCK around if_ioctl.

(riastradh)

sys: Use if_init wrapper function.

Exception: Not in kern_pmf.c, for the kind of silly reason that it
avoids having kern_pmf.c refer to symbols defined only in net; this
avoids a pain in the rump.

(riastradh)

sys: Use if_ioctl wrapper function.

(riastradh)

sys: Use if_stop wrapper function.

Exception: Not in kern_pmf.c, for the kind of silly reason that it
avoids having kern_pmf.c refer to symbols defined only in net; this
avoids a pain in the rump.

(riastradh)

sys/net: New functions if_ioctl, if_init, and if_stop.

These are wrappers, suitable for inserting appropriate kasserts
regarding the API's locking contract, for the corresponding functions
in struct ifnet.

Since these are intended to commit configuration changes to the
interface, which may involve resetting the device, the caller should
hold IFNET_LOCK.  However, I can't straightforwardly prove that all
callers do yet, so the assertion is disabled for now.

(riastradh)

umass(4): Omit needless reference counting.

autoconf never detaches before attach has completed, so there is no
longer any need for this mechanism.

(riastradh)

ukbd(4): Avoid races in LED setting on attach.

- Don't reuse sc_delay for LED task -- a keyboard interrupt shortly
  after attach might reset sc_delay so that the LEDs never get turned
  back off.

- Don't turn the LEDs back off after attach if something else has
  already changed them by the time the callout fires.

(And make sure to callout_halt before done this time!)

(riastradh)

acpi(9): Fix memory ordering and completion bugs in notifiers.

1. Guarantee everything which happened before acpi_register_notify
  has also happened before the notifier is actually called.

2. On acpi_deregister_notify, don't return until the notifier is
  definitely not running any more on any CPU, using
  AcpiOsWaitEventsComplete.

(riastradh)

acpi(9): Implement AcpiOsWaitEventsComplete.

(riastradh)

sysmon(9): New sysmon_task_queue_barrier(pri) function.

This waits for the completion of all tasks at priority pri or lower
that are currently queued at the time of the call.

(riastradh)

acpibat(4): Print ACPI error when _STA fails.

(riastradh)

acpibat(4): Delete excessive blank lines.

Makes it hard to follow when there is a big gap between everything
even when there is a tight logical coupling, like setting and testing
an error code.

(riastradh)

acpibat(4): Fix attach and detach ordering.

On attach: Don't register acpibat_resume handler with pmf or
acpibat_notify_handler with acpi until it is safe to call
acpibat_update_info and acpibat_update_status.
=> This requires the sc->sc_sensor array to be allocated, so allocate
  that first.
=> This requires sc->sc_sme to be created, so defer them to
  config_interrupts after sysmon_envsys_register.
=> Make sure to register the notify handler before initially polling
  the info and status.

On detach: Deregister pmf handler and acpi notifier before we destroy
anything.

(riastradh)

libkern: Make KASSERT verify expression is valid if !DIAGNOSTIC.

This way it is no longer necessary to mark variables __diagused if
they are used in KASSERT conditions.

Fix fallout from this by removing now-unnecessary and `#ifdef
DIAGNOSTIC'.

Don't do the same for KDASSERT if !DEBUG -- unlike KASSERT and
DIAGNOSTIC, variables needed by KDASSERT and DEBUG are likely to be
expensive to compute (and potentially difficult for a compiler to
prove flushable), so we don't want to require them under !DEBUG.

(riastradh)

sysmon: Delete trailing whitespace.  No functional change intended.

(riastradh)

doc: Update TODO.smpnet to reflect invention of ETHER_F_ALLMULTI.

(riastradh)

acpiout(4): Work around firmware that doesn't like some brightnesses.

Instead of just asking for cur - 5 or cur + 5, repeatedly ask for
that increment, check whether we actually made progress in that
direction, and if not keep going with another increment, until we hit
the bounds of brightness levels.

I can't find anything in the ACPI spec about this, but my laptop
seems to have trouble with certain levels: 15, 75, 85, 95.  It goes
in all other increments of 5 from 5 to 100, just not those ones --
acts as if the change just never happened, so with the old logic the
brightness up/down would get stuck unable to move in either
direction.

This should have no impact on machines where the first increment
actually takes.

(riastradh)

drm: Restore hw.drm2.debug sysctl knob, previously lost in merge.

(riastradh)

zfs: Expose hostid to zfs, as in gethostid/sethostid(3).

If set to nonzero, the hostid is recorded in the metadata of a zpool,
and checked by `zpool import' when the pool has not been explicitly
exported.  After reboot, zpool import will not need `-f' to reimport
the pool.

Setting the hostid must be done explicitly through sysctl (or the
sethostid(3) library call) on all ports except acorn32, amiga,
mvme68k, newsmips, sparc, sparc64, sun2, and sun3.  So for most users
this change will have no immediate effect.  But you can obviate the
need for `zpool import -f' by adding `kern.hostid=123456789' to
/etc/sysctl.conf and importing the pool one last time with `-f'.

(riastradh)