sys: Use membar_release/acquire around reference drop.

This just goes through my recent reference count membar audit and
changes membar_exit to membar_release and membar_enter to
membar_acquire -- this should make everything cheaper on most CPUs
without hurting correctness, because membar_acquire is generally
cheaper than membar_enter.

(riastradh)

alpha: Omit needless membar in pmap_reference.

If the pmap is published enough for us to obtain a reference to it
then there's no membar needed.  If it's not then something else is
wrong and we can't use pmap_reference here anyway.  Membars are
needed only on the destruction side to make sure all use, by any
thread, happens-before all freeing in the last user thread.

(riastradh)

audio(4): Use membar_acquire, not membar_enter.

Cheaper and adequate to make an atomic_swap into a load-acquire.

(riastradh)

mips/rmixl: Insert appropriate membars around IPIs.

(riastradh)

mips/cavium: Insert appropriate membars around IPIs.

(riastradh)

atomic_loadstore(9): Use membar_acquire/release.

(riastradh)

Introduce membar_acquire/release.  Deprecate membar_enter/exit.

The names membar_enter/exit were unclear, and the documentation of
membar_enter has disagreed with the implementations on sparc,
powerpc, and even x86(!) for the entire time it has been in NetBSD.

The terms `acquire' and `release' are ubiquitous in the literature
today, and have been adopted in the C and C++ standards to mean
load-before-load/store and load/store-before-store, respectively,
which are exactly the orderings required by acquiring and releasing a
mutex, as well as other useful applications like decrementing a
reference count and then freeing the underlying object if it went to
zero.

Originally I proposed changing one word in the documentation for
membar_enter to make it load-before-load/store instead of
store-before-load/store, i.e., to make it an acquire barrier.  I
proposed this on the grounds that

(a) all implementations guarantee load-before-load/store,
(b) some implementations fail to guarantee store-before-load/store,
and
(c) all uses in-tree assume load-before-load/store.

I verified parts (a) and (b) (except, for (a), powerpc didn't even
guarantee load-before-load/store -- isync isn't necessarily enough;
need lwsync in general -- but it _almost_ did, and it certainly didn't
guarantee store-before-load/store).

Part (c) might not be correct, however: under the mistaken assumption
that atomic-r/m/w then membar-w/rw is equivalent to atomic-r/m/w then
membar-r/rw, I only audited the cases of membar_enter that _aren't_
immediately after an atomic-r/m/w.  All of those cases assume
load-before-load/store.  But my assumption was wrong -- there are
cases of atomic-r/m/w then membar-w/rw that would be broken by
changing to atomic-r/m/w then membar-r/rw:

https://mail-index.netbsd.org/tech-kern/2022/03/29/msg028044.html

Furthermore, the name membar_enter has been adopted in other places
like OpenBSD where it actually does follow the documentation and
guarantee store-before-load/store, even if that order is not useful.
So the name membar_enter currently lives in a bad place where it
means either of two things -- r/rw or w/rw.

With this change, we deprecate membar_enter/exit, introduce
membar_acquire/release as better names for the useful pair (r/rw and
rw/w), and make sure the implementation of membar_enter guarantees
both what was documented _and_ what was implemented, making it an
alias for membar_sync.

While here, rework all of the membar_* definitions and aliases.  The
new logic follows a rule to make it easier to audit:

membar_X is defined as an alias for membar_Y iff membar_X is
guaranteed by membar_Y.

The `no stronger than' relation is (the transitive closure of):

- membar_consumer (r/r) is guaranteed by membar_acquire (r/rw)
- membar_producer (w/w) is guaranteed by membar_release (rw/w)
- membar_acquire (r/rw) is guaranteed by membar_sync (rw/rw)
- membar_release (rw/w) is guaranteed by membar_sync (rw/rw)

And, for the deprecated membars:

- membar_enter (whether r/rw, w/rw, or rw/rw) is guaranteed by
  membar_sync (rw/rw)
- membar_exit (rw/w) is guaranteed by membar_release (rw/w)

(membar_exit is identical to membar_release, but the name is
deprecated.)

Finally, while here, annotate some of the instructions with their
semantics.  For powerpc, leave an essay with citations on the
unfortunate but -- as far as I can tell -- necessary decision to use
lwsync, not isync, for membar_acquire and membar_consumer.

Also add membar(3) and atomic(3) man page links.

(riastradh)

riscv/membar_ops: Upgrade membar_enter from W/RW to RW/RW.

This will be deprecated soon but let's avoid leaving rakes to trip on
with it arising from disagreement over the documentation (W/RW) and
implementation and usage (R/RW).

(riastradh)

x86_64/membar_ops: Upgrade membar_enter from R/RW to RW/RW.

This will be deprecated soon but let's avoid leaving rakes to trip on
with it arising from disagreement over the documentation (W/RW) and
implementation and usage (R/RW).

(riastradh)

i386/membar_ops: Upgrade membar_enter from R/RW to RW/RW.

This will be deprecated soon but let's avoid leaving rakes to trip on
with it arising from disagreement over the documentation (W/RW) and
implementation and usage (R/RW).

(riastradh)

sparc64/membar_ops: Upgrade membar_enter from R/RW to RW/RW.

This will be deprecated soon but let's avoid leaving rakes to trip on
with it arising from disagreement over the documentation (W/RW) and
implementation and usage (R/RW).

(riastradh)

sparc/membar_ops: Upgrade membar_enter from R/RW to RW/RW.

This will be deprecated soon but let's avoid leaving rakes to trip on
with it arising from disagreement over the documentation (W/RW) and
implementation and usage (R/RW).

(riastradh)

lint: ensure that lint itself compiles without lint warnings

It would be a pity if lint didn't even survive its own style checks.

(rillig)

lint: rename dinfo_t.d_offset to d_offset_in_bits

Most often, offsets are measured in bytes, so better embed the unit in
the variable name.

No functional change.

(rillig)

nouveau: Omit needless local patch.

This code probably once called ioread32/iowrite32 or something, but
no longer.

(riastradh)

lint: extract is_member into separate function

No functional change.

(rillig)

lint: disambiguate sym_t.s_value

Having a single variable for 4 different purposes with different types
makes the code unnecessarily hard to follow.

No functional change.

(rillig)

lint: split CTCONST into BOOL_CONST and ENUM_CONST

Having a unified compile-time constant "storage class" made the code
more difficult to understand.

No functional change.

(rillig)

makefs(8): Needs -lm for ceil in udf as a host tool too.

(riastradh)

mips/rmi: Hack to get XLSATX64.MP kernel building again.

Using <mips/asm.h> in a .c file is kinda grody but CALLFRAME_SIZ
doesn't seem to be defined anywhere else.  Not sure how this was ever
supposed to work...

(riastradh)

lint: inline member access macros for sym_t

Having the 'u.' explicitly in the code serves as a reminder that these
members are only defined under certain conditions.

No functional change.

(rillig)

sys/lwp.h: Nix trailing whitespace.

(riastradh)

lint: rename length to length_in_bits

No functional change.

(rillig)

ena: Fix rmb/wmb/mb to match Linux on x86 and aarch64.

This is not right but it's not worse than it was before.

(riastradh)

aarch64/membar_ops: Fix wrong symbol end.

(riastradh)

x86: Add a note on membar_sync and mfence.

(riastradh)

x86: Omit needless store in membar_producer/exit.

On x86, every store is a store-release, so there is no need for any
barrier.  But this wasn't a barrier anyway; it was just a store,
which was redundant with the store of the return address to the stack
implied by CALL even if issuing a store made a difference.

(riastradh)

x86: Every load is a load-acquire, so membar_consumer is a noop.

lfence is only needed for MD logic, such as operations on I/O memory
rather than normal cacheable memory, or special instructions like
RDTSC -- never for MI synchronization between threads/CPUs.  No need
for hot-patching to do lfence here.

(The x86_lfence function might reasonably be patched on i386 to do
lfence for MD logic, but it isn't now and this doesn't change that.)

(riastradh)

sparc64: Fix membar_sync by issuing membar #StoreLoad.

In TSO this is the only memory barrier ever needed, and somehow we
got this wrong and instead issued an unnecessary membar #LoadLoad --
not needed even in PSO let alone in TSO.

XXX Apparently we may run userland programs with PSO or RMO, in which
case all of these membars need fixing:

                        PSO                    RMO
membar_consumer        nop                    membar #LoadLoad
membar_producer        membar #StoreStore      membar #StoreStore
membar_enter            nop                    membar #LoadLoad|LoadStore
membar_exit            membar #StoreStore      membar #LoadStore|StoreStore
membar_sync            membar #StoreLoad|StoreStore
                                                membar #...everything...

But at least this fixes the TSO case in which we run the kernel.
Also I'm not sure there's any non-TSO hardware out there in practice.

(riastradh)

sparc: Fix membar_sync with LDSTUB.

membar_sync is required to be a full sequential consistency barrier,
equivalent to MEMBAR #StoreStore|LoadStore|StoreLoad|LoadLoad on
sparcv9.  LDSTUB and SWAP are the only pre-v9 instructions that do
this and SWAP doesn't exist on all v7 hardware, so use LDSTUB.

Note: I'm having a hard time nailing down a reference for the
ordering implied by LDSTUB and SWAP.  I'm _pretty sure_ SWAP has to
imply store-load ordering since the SPARCv8 manual recommends it for
Dekker's algorithm (which notoriously requires store-load ordering),
and the formal memory model treats LDSTUB and SWAP the same for
ordering.  But the v8 and v9 manuals aren't clear.

GCC issues STBAR and LDSTUB, but (a) I don't see why STBAR is
necessary here, (b) STBAR doesn't exist on v7 so it'd be a pain to
use, and (c) from what I've heard (although again it's hard to nail
down authoritative references here) all actual SPARC hardware is TSO
or SC anyway so STBAR is a noop in all the silicon anyway.

Either way, certainly this is better than what we had before, which
was nothing implying ordering at all, just a store!

(riastradh)

makefs(8): Nix trailing whitespace.

Computed by machine, eyeballed by hand, so to speak.

(riastradh)

fsck_udf(8): Nix trailing whitespace.

No functional change intended.

(riastradh)

newfs_udf(8): Nix trailing whitespace.

No functional change intended.

(riastradh)

fsck_udf(8): Mark vat_length as ignored.

(riastradh)

fsck_udf(8): Sprinkle __printflike and omit self-assignment.

(riastradh)

membar_ops(3): Add some automatic tests.

These tests run two threads for five seconds each to try to trigger
races in the event of broken memory barriers.  They run only on
machines with at least two CPUs; on uniprocessor systems there's no
point -- the membars can correctly just be (instruction barrier)
no-ops.

(riastradh)

rk_v1crypto(4): Fix missing `error =' assignment.

This is not likely to fail, but let's avoid suppressing an unlikely
error.

(riastradh)

etc: Sort NetBSD.dist.tests.

(riastradh)

lint: fix undefined behavior on enum overflow (since 1995)

GCC had optimized the check away, due to the obvious integer overflow 'x
- 1 == INT_MAX'.  To prevent further bugs like this, compile with
-ftrapv.

(rillig)

lint: remove unused message 70, add some more tests

(rillig)

PR/56778: Detlev Casanova: Missing rl_initialize call in rl_copy_text

(christos)

s/postions/positions/

(andvar)

s/postion/position/

(andvar)

fix various typos, mainly in comments, but also log messages, docs, game text.

(andvar)

openssh-9.0 out

(wiz)

ucom(4): Use tty_unit -- save a couple lines of code.

(riastradh)

tty(9): New function tty_unit for struct cdevsw::d_devtounit.

(riastradh)

Do not attempt to trap SIGKILL

(nia)

s/psuedo/pseudo/

(andvar)

fix various typos in comments.

(andvar)

ucom(4): Fix unit numbering for devsw/autoconf cross-wiring.

Should introduce a tty_unit function to use here but this'll do for
now to fix the bug I introduced in ucom(4).

(riastradh)

Note that biosboot without -A clears the PMBR "active" flag.
While here, fix some grammar and make the selection options
for biosboot a little clearer.

Ride nia@'s Dd bump.

(kre)

gpt.8: Clarify that "windows" partition types are also used for FAT32
("msdos" in NetBSD terms), and UDF partitions. Use the same name as
Wikipedia, "Microsoft basic data".

(nia)

sparc64/pmap: Nix trailing whitespace.

(riastradh)

mvxpsec(4): Nix trailing whitespace.

(riastradh)

Nix trailing whitespace in files of membars, atomics, and lock stubs.

Will be touching many of these files soon for functional changes.

No functional change intended.

(riastradh)

udf.c uses math library functions.

(hauke)

revert accidental last commit (except ukbd.c)

(mlelstv)

remove debug printf

(mlelstv)

KNF nits, NFC

(macallan)

we've been using the power key for its intended purpose for yesrs, which
makes breaking into DDB awkward, so let's do what everyone else does and
use Ctrl-Alt-Escape / Cmd-Escape depending on the layout variant

(macallan)

Use PRI macros for uint64_t printf formats, %zu for size_t.

(martin)

Keep UDF commented out by default

(reinoud)

Add fsck_udf to the debug sets

(reinoud)

Add the fsck_udf(8) tool to the build and release

(reinoud)

UDF has been around for more than a decade in the kernel. Now with a
fsck_udf(8) it is not making sense to keep it calling `experimental'.

(reinoud)

makefs: fix some typos

(wiz)

Added fsck_udf(8) and upgraded newfs_udf/makefs for UDF

(reinoud)

fsck_udf: match usage to man page; fix typos

(wiz)

New sentence, new line. Sort options.

(wiz)

new sentence, new line

(wiz)

Initial commit of the fsck_udf(8) utility that checks and repairs UDF
filesystems on optical media as well as on disc images, harddisc partitions
and wedges.

(reinoud)

Refactor and rewrite of newfs_udf(8) and makefs(8) (-t udf) with a shared
section for fsck_udf(8).

Newfs_udf and makefs support predefined disc image profiles, harddisc
partitions (disklabel and wedges on all generic block devices) and all optical
media types on CD/DVD/BD writers.

Newfs_udf and makefs now also support formatting of UDF 2.50 with a metadata
partition.

(reinoud)

Add a regression test for PR kern/52239, "Changing protections of
already mmap'ed region can fail", based on the test program in the PR.

(gson)

makemandb.c: fail sooner if man page dirs can't be found

There's no point initializing database state if we're then going to
fail to locate any man page sources. Make all the initial state checks
contiguous for simplicity and readability. Also, free the variable
"command" on the error path, and correct the error message.

(gutteridge)

lint: remove unused message 40

I had not been used since 1995, when lint was imported to NetBSD.

(rillig)

tests/lint: add tests for a few early messages

(rillig)

In the mmap_err test case, mmap the address, not the address of the address.
Should fix PR kern/56780.

(gson)

When the t_mmap:mmap_err test fails due to errno not having the expected
value of EINVAL, print the actual value.

(gson)

s/confortable/comfortable/

(andvar)

Sync with new DTS

(skrll)

KNF

(skrll)

fix various typos, mainly in comments.

(andvar)

Avoid signed/unsigned comparision by casting the sizeof expression.

(martin)

Use the original right boundary when calculating the vertical scroll
region so the boundary does not creep left on each subsequent setting.
Thanks to Martin@ for the report.

(blymn)

Fix missing m_reset_rcvif for allocated mbuf

(yamaguchi)

Move input processing of lagg(4) before ether_input
to get rid of dependence.

This implementation is similar with that of bridge(4).

(yamaguchi)

Improve wording to avoid confusion about the return value of {v,}asprintf(3)

(christos)

lint: fix crash after syntax error in array declaration

(rillig)

efi_rtcopy is only used on little endian kernels.

(martin)

tests/lint: make a few tests self-contained, add some others

(rillig)

new ISC dhcp

(christos)

Merge conflicts between dhcp-4.4.2P1 and dhcp-4.4.3

(christos)

lint: fix crash after syntax error in GCC statement expression

Since cgram.y 1.226 from 2021-05-03.

(rillig)

lint: clean up style

Remove outdated ARGSUSED (the one in tree.c had been wrong since 1995),
remove unused argument.

No functional change.

(rillig)

lint: use appropriate alignment on both the host and target platform

(rillig)

lint: remove unreachable message 'compiler takes alignment of function'

(rillig)

lint: try harder to recover after syntax errors

lint: assertion "false" failed in declarator_name at decl.c:1596
    near msg_022.c:22

(rillig)

Don't attach Yubikeys as console keyboard.

(mlelstv)

Avoid integer overflow on systems with 32bit disk addresses.

(mlelstv)

Avoid crashes with invalid or tiny sector sizes.

(mlelstv)

lint: extract type creation into separate functions

No functional change.

(rillig)

lint: inline setcomplete

No functional change.

(rillig)

lint: untangle nested variable assignments

The code is buggy (see decl_direct_abstract.c), so at least make it
readable, making it hopefully easier to fix the bugs.

Before decl.c 1.18 from 2000-07-05, lint crashed when it parsed
'sizeof(int(double))', since that commit it has been hiding the bugs,
working with wrong type information instead.

Fix the logged type in add_function (had been wrong since today).

(rillig)

lint: do not log dinfo_t pointers in debug mode

Before the addition of debug_dinfo from today, this had been the only
way to notice changes to the global 'dcs' variable.  Since the content
of that variable is now logged, the pointer is not needed anymore.

(rillig)

lint: rename dinfo_t.d_next to d_enclosing

The name d_next gave the wrong impression that the declaration infos
would be independent of each other, but they are nested.

No functional change.

(rillig)

lint: add debug logging for the declaration stack

To track down the wrong edge cases in decl_direct_abstract.c.

(rillig)

Update to support EFI runtime outside the kernel virtual address space
by creating an EFI RT pmap that can be activated / deactivated when
required.

Adds support for EFI RT to ARM_MMU_EXTENDED (ASID) 32-bit Arm machines.

On Arm64 the usage of pmapboot_enter is reduced and the mappings are
created much later in the boot process -- now in cpu_startup_hook.
Backward compatiblity for KVA mapped RT from old bootaa64.efi is
maintained.

Adding support to other platforms should be easier as a result.

(skrll)

cgd(4): Omit technically-correct-but-broken adiantum dependency again.

It is true that cgd_crypto.c depends on sys/crypto/adiantum now, and
transitively on sys/crypto/aes.

However, there's a problem with the cgd module having a formal
(transitive) module dependency on the aes module.

Yesterday I thought the problem with this was that fpu_kern_enter was
artificially restricted while cold -- to detect, and noisily crash
on, reentrance, it raises the IPL to IPL_VM, asserts that the IPL is
not _higher_ (so it can't be re-entered by an IPL_SCHED or IPL_HIGH
interrupt), and asserts that it's not currently in use on the current
CPU.

Early at boot, the IPL is at IPL_HIGH, and no interrupts are possible
anyway, so the assertions tripped for artificial reasons, which I
fixed in:

https://mail-index.netbsd.org/source-changes/2022/04/01/msg137840.html

However, I had forgotten that there's a deeper problem for the cgd
module dependency on aes.  The ordering of events is:

1. Initialize builtin MODULE_CLASS_DRIVER modules -- including cgd.

2. Run configure -- including detecting CPUs, which on aarch64 is
  where the decision of which AES (and ChaCha) implementation to use
  based on supported CPU features.

3. Initialize builtin MODULE_CLASS_MISC modules -- including aes,
  _if_ there are no driver-class modules that depend on it.

There's a tangle of ordering dependencies here:

- MODULE_CLASS_DRIVER modules providing _autoconf_ drivers generally
  have to be initialized _before_ configure, because you need the
  driver to be initialized before configure can attach its devices.

- configure must run _before_ aes is initialized because the decision
  of which AES implementation to choose depends on CPU features
  detected in configure, and the prospect of dynamically changing the
  AES implementation is too painful to contemplate (it may change the
  key schedule, so it would invalidate any existing key schedules
  precomputed by callers like uvm_swap or configured cgd devices,
  which raises a host of painful concurrency issues to invalidate
  these cached key schedules on all CPUs in all subsystems using
  them).

- cgd doesn't figure into the configure stage of autoconf, but it
  nevertheless has to be MODULE_CLASS_DRIVER because specfs autoloads
  MODULE_CLASS_DRIVER modules in case they provide _devsw_ drivers
  (i.e., /dev nodes), as cgd does.  And we don't have a mechanism for
  identifying `autoconf driver modules' separately from `devsw driver
  modules' because some modules provide both and each module can have
  only one class.

For now, this is breaking boot on several tier I architectures so
let's nix the cgd->adiantum->aes module dependency as a stop-gap
measure.

(riastradh)

lint: add type details to message about 'sizeof(function)'

The code in add_function is severely broken, it mixes up the return type
of the function with the argument types.  For now, at least show the
guessed type in the diagnostic, to allow human readers quickly spot the
bug.

Extend the test cases in decl_direct_abstract.c to show that the
behavior differs unreasonably if the first parameter of the function is
equal to its return type.

(rillig)

lint: improve determination of abstract typename

Still not perfect, but at least a step in the right direction.  See
decl_direct_abstract.c for the missing edge cases.

See PR#22119.

(rillig)

lint: add details to message about illegal return type

(rillig)

Remove floppy installation instructions from sparc documentation.

Floppy generation was disabled before NetBSD 6.0 release due to size
constraints and unlikely to be restored soon or at all. PR port-sparc/56776.
ok martin.

(andvar)

tests/lint: fix comment about backslash-newline

(rillig)

Create a loaable adiantum module, and make cgd require it.

This enablees use of a loadable cgd module, rather thtan requiring
it to be built-in.

Partially resolves kern/56772

(pgoyette)