bcsp(4): Convert to ttylock/ttyunlock.

(riastradh)

ppp(4): Convert to ttylock/ttyunlock.

(riastradh)

sl(4): Convert to ttylock/ttyunlock.

(riastradh)

cy(4): Convert to ttylock/ttyunlock.

(riastradh)

tty(9): New ttylock, ttyunlock, ttylocked functions.

These are wrappers around the global tty_lock for now (and the
continued existence of the tty_lock variable is why the ttylock
function has no underscore in its name).  They will assist in
converting drivers to per-tty locking later on.

(riastradh)

sys/vnode.h: New home for extern vfs_op_descs.

(Maybe this should be in a more kern-private header file -- it's used
only by vnode_if.c and vfs_init.c -- but this'll do for now.)

(riastradh)

miscfs/fifofs/fifo.h: New home for extern fifo_vnodeop_opv_desc.

Add include guard and fix missing includes while here too.

(riastradh)

miscfs/specfs/specdev.h: New home for extern spec_vnodeop_opv_desc.

Also use it for extern spec_vnodeop_p, which is already there.

(riastradh)

miscfs/deadfs/deadfs.h: New home for deadfs-related externs.

XXX regen sys/kern/vnode_if.c and the others

(riastradh)

sys/mount.h: New home for vfs_timestamp_precision, vfs_magiclinks.

(riastradh)

sys/filedesc.h: New home for extern cwdi0.

(riastradh)

sys/pcu.h: New home for extern pcu_ops_md_defs.

XXX Should split sys/pcu.h up into the part that sys/lwp.h needs,
which triggers rebuild of entire kernel, and the parts needed only by
subr_pcu.c and by MD FP/SIMD state management logic.

(riastradh)

ddb/db_active.h: New home for extern db_active.

This can be included unconditionally, and db_active can then be
queried unconditionally; if DDB is not in the kernel, then db_active
is a constant zero.  Reduces need for #include opt_ddb.h, #ifdef DDB.

(riastradh)

sys/msgbuf.h: New home for extern log_open.

(riastradh)

kern/subr_log.c: log_lock is private; make it static, not extern.

(riastradh)

kern/kern_lock.c: We get start_init_exec from sys/kernel.h now.

(riastradh)

sys/kernel.h: New home for extern start_init_exec.

(riastradh)

kern/kern_turnstile.c: Get turnstile0 from sys/sleeptab.h.

(riastradh)

kgdb(9): Use ddb/db_extern.h instead of copying extern.

(riastradh)

kern/subr_kobj.c: We already get module_base from sys/module.h.

(riastradh)

sys/sleepq.h: Get cold from sys/kernel.h.

(riastradh)

kern/subr_kcov.c: We already get cold from sys/kernel.h.

(riastradh)

sys/sched.h: New home for extern sched_pstats_ticks in kernel.

(riastradh)

sys: Put externs for time_adjtime and time_adjusted in .h files.

time_adjtime: sys/timex.h (defined in ntp code)
time_adjusted: sys/timevar.h (defined in non-ntp code)

(Not really sure this is a valuable distinction to maintain; there's
non-ntp code that uses time_adjtime too.)

(riastradh)

kern/kern_synch.c: Get averunnable from sys/resource.h.

(riastradh)

kern/kern_pax.c: Get maxsmap from sys/resourcevar.h.

(riastradh)

rwlock(9): Nix extern _rw_init in .c; use sys/rwlock.h.

(riastradh)

sys/*: Get module_map consistently from sys/module.h.

(riastradh)

mutex(9): Properly declare _mutex_init in sys/mutex.h.

(riastradh)

kern/kern_hook.c: Get exec_lock from sys/exec.h.

(riastradh)

kern/init_main.c: Get extern lwp0 from sys/lwp.h.

(riastradh)

kern/exec_elf.c: Get emul_netbsd from sys/proc.h.

(riastradh)

vmwgfx(4): Partially adapt rbtree.

(riastradh)

linux asm/vmware.h: Fill this in with hypercall asm.

Not sure if it's necessary to support vmcall or vmmcall -- if so,
need to deal with binary patching inline asm, ugh.

(riastradh)

linux asm/uaccess.h: strncpy_from_user

(which does not actually have strncpy semantics, naturally, from what
I can gather)

(riastradh)

linux/frame.h: STACK_FRAME_NON_STANDARD

(riastradh)

linux/kernel.h: S16_MIN, S32_MIN, S64_MIN

(riastradh)

linux/suspend.h: Stubs for (un)register_pm_notifier.

(riastradh)

linux/pci.h: Stubs for pci_request/release_region(s).

(riastradh)

linux/idr.h: Update ida_* API.

(riastradh)

vmwgfx(4): Hand-cruft threaded irq with a workqueue(9).

(riastradh)

drm: New IRQ_WAKE_THREAD constant.

Not really wired up to anything but helps reduce diffs -- driver is
responsible for making decisions based on it, corresponding to
Linux's built-in `threaded irq'.

(riastradh)

vmwgfx(4): Port fd creation.

(riastradh)

vmwgfx(4): Misc porting too.

- inl/outl -> bus_space_read/write
- struct device for DMA stuff -> bus_dma_tag_t
- spin_lock_destroy (and don't hold spin lock across kfree)
- driver load/unload, fops, &c.
- drm_irq_install/uninstall

(riastradh)

vmwgfx(4): Use bus_dma tag, not struct device, for dma_pool shims.

(riastradh)

vmwgfx(4): Convert fence_queue and fifo_queue to drm_waitqueue_t.

(riastradh)

vmwgfx(4): Convert cmdbuf to drm_waitqueue_t.

(riastradh)

linux/spinlock.h: spin_lock_bh, spin_unlock_bh

Nothing special needed here; NetBSD mutex(9) at IPL_* giving spin
locks already blocks `BH' (i.e., softints -- although I'm not sure
softints are relevant to the one use of this in vmwgfx).

(riastradh)

linux asm/io.h: Side-load linux/vmalloc.h like Linux does.

(riastradh)

linux/dmapool.h: Start filling out stubs.

(riastradh)

vmwgfx(4): dma_alloc/free_coherent -> bus_dma_*

(riastradh)

linux/module.h: MODULE_VERSION

(riastradh)

vmwgfx: Set some warning and config flags.  Nix vmwgfx_fb.c for now.

(riastradh)

linux/export.h: Side-load linux/stringify.h.

Expected by some users.

(riastradh)

extattr(9): KNF

No functional change intended.

(riastradh)

extattr(9): Fix uninitialized uio_iovcnt.

(riastradh)

console(4), constty(4): Rip off the kernel lock, take three.

(riastradh)

constty(4): Make MP-safe, take three.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
  only under the new adaptive constty_lock in thread context.  This
  serializes TIOCCONS operations and ensures unlocked readers can
  safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
  allowed in any context -- printf(9) uses this to disable a broken
  constty.

3. Reading constty under constty_lock is allowed with
  atomic_load_relaxed, because while constty_lock is held, it can
  only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
  atomic_load_consume in a pserialize read section -- constty is
  only ever made nonnull with atomic_store_release, in (1).
  ttyclose will wait for all these pserialize read sections to
  complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
  pserialize read section has completed, caller must use tty_acquire
  during the pserialize read section and then tty_release when done.
  ttyclose will wait for all these references to drain before
  returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty.  Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

Changes third time around:
- Initialize ttyref_cv so we don't panic when trying to use it,
  leading to infinite loop when panic tries to take tty_lock to print
  the panic message while we already hold tty_lock.

(riastradh)

iic(4): Use config_detach_children to simplify.

(riastradh)

i2c(9): Nix smbus intr API.

It was introduced in 2007 for some Xbox thing which was removed in
2011.  The API and the threads it spawned have been sitting around
idly for over a decade serving no purpose -- sometimes causing kernel
lock spinouts in the event of panic.

Add ic_tag_private to obviate need for future ABI changes.  Not
currently used, but we can privately allocate memory in iic_tag_init
for the purpose later if need be without changing ABI.

XXX kernel revbump -- changes struct i2c_controller

(riastradh)

midi(4): No need to take lock just for callout_halt.

Lock is relevant only if we're doing something _else_ under the lock
that must be serialized with the callout's own action.

(riastradh)

midi(4): Explain what's about to happen when refcnt drain fails.

This should really be an unconditional cv_wait loop, but for now
let's just give fair warning when the driver is about to puke its
guts out in case the I/O paths I haven't audited yet are buggy.

(riastradh)

midi(4): Wake waiters _before_ waiting for them.

Otherwise we may deadlock waiting for them to give up while they're
waiting for I/O, not knowing they need to give up.

(riastradh)

ugen(4): Make sure opened is initialized in ugenopen.

Otherwise the error branch is based on garbage.

(riastradh)

sys/workqueue.h: Need sys/types.h for pri_t.

(riastradh)

aq(4): Remove incorrect ASSERT_SLEEPABLE introduced in 1.33.

It is true that aq_stop must be sleepable, and that aq_stop_locked
may sleep, but aq_stop_locked will release sc->sc_mutex when it
sleeps, which ASSERT_SLEEPABLE doesn't know about.  Since that is a
spin lock, ASSERT_SLEEPABLE trips over it and crashes.

This is not quite right: aq_stop should really only take the lock
over specific things that need the lock to synchronize with other
threads, like mii_down; aq_init and aq_stop are already serialized by
IFNET_LOCK.  sc->sc_mutex is used for too much and should have its
scope narrowed like I did recently in usbnet(9).  But this small
change will at least remove a source of crashes for now.

(riastradh)

dwiic(4): Don't try processing interrupts before attach completes.

PR kern/57063

(riastradh)

dwiic(4): Don't try to attach children if dwiic_attach failed.

PR kern/57063

(riastradh)

aq(4): Annotate boolean parameters with names for legibility.

No functional change intended.

(riastradh)

aq(4): Unconditionally halt callout in aq_stop.

Fixes panic with callout still running on detach after we destroy the
lock, reported by andvar@:

fatal page fault in supervisor mode
trap type 6 code 0 rip 0xffffffff80dfafec cs 0x8 rflags 0x10286 cr2 0xfffffffffffffff0 ilevel 0x2 rsp 0xffffcd085b291ee0
Skipping crash dump on recursive panic
panic: trap
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
panic() at netbsd:panic+0x3c
trap() at netbsd:trap+0xb27
--- trap (number 6) ---
mutex_oncpu() at netbsd:mutex_oncpu+0x1e
mutex_vector_enter() at netbsd:mutex_vector_enter+0xb7
aq_tick() at netbsd:aq_tick+0x23
callout_softclock() at netbsd:callout_softclock+0xbd
softint_dispatch() at netbsd:softint_dispatch+0xf9
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffcd085b2920f0
Xsoftintr() at netbsd:Xsoftintr+0x4c
--- interrupt ---
fa0b2181724b21c1:
cpu0: End traceback...

(riastradh)

pci_resource(9): Fix whitespace.

(riastradh)

pci_resource(9): vmem_create and vmem_add never fail with VM_SLEEP.

Prune dead error branches.

(riastradh)

virtio(4): Use __BIT, not inline shift.

Reduces need for cast.

(riastradh)

virtio(4): Use howmany from sys/param.h instead of open-coding it.

howmany will divide by VIRTIO_PAGE_SIZE instead of doing &
~(VIRTIO_PAGE_SIZE - 1), but it's a constant 4096 so this should make
no difference in the compiled output except possibly at -O0.

No functional change intended.

(riastradh)

virtio(4): Sprinkle KNF.

No functional change intended.

(riastradh)

kobj(9): Rephrase kobj_load and kobj_affix positively.

Write error cases as branches, normal cases as straight-line code.

Side effect: One fewer call to kobj_jettison in case of error in
kobj_affix, but it already calls kobj_jettison once in the error case
via kobj_unload, which does kobj_jettison itself, and kobj_jettison
is idempotent.

No functional change intended.

(riastradh)

kobj(9): Fix kobj_read_mem error branches.

Rewrite positively to simplify logic: Write errors as branches,
normal case as straight-line code.

In the case where allocate=true but arithmetic overflow occurs, this
avoids trying to kmem_free null, which is forbidden.

(riastradh)

kobj(9): Avoid arithmetic overflow in overflow detection.

(riastradh)

kobj(9): Forbid reading negative offsets.

Shouldn't have any functional change, but let's fail with EINVAL
rather than reading arbitrarily distant memory.

(riastradh)

specfs(9): Attribute blame by stack trace for write to r/o medium.

(riastradh)

i915: Suspend ioctls while device is suspended.

(riastradh)

drm: New mechanism to suspend ioctls during system suspend.

drm drivers must opt into this by calling drm_suspend_ioctl in their
driver suspend routine, and drm_resume_ioctl in their driver resume
routine.

This is a stop-gap measure -- it would be better to fill in the
pm_runtime_* API with new pmf(9) hooks to acquire/release references
to devices for coordinating with suspend/resume, but getting the
details right is tricky, and this stop-gap is enough to get i915
suspend/resume to work reliably on my Kaby Lake laptop.  Rather than
wait until I've got all the details right, let's just go with this
stop-gap for now.

(riastradh)

vmem(9): Clarify possible failure modes.

Note that vmem_alloc and vmem_xalloc have failure modes -- failing
with ENOMEM despite VM_SLEEP, or importing or sleeping forever --
that appear to be bugs when align/phase/nocross/minaddr/maxaddr are
specified.

(riastradh)

amdgpu: Remove an #ifdef __NetBSD__ around drm_waitqueue_t.

No functional change intended.

(riastradh)

UPDATING: More details on bootloader update needed for >=9.99.100.

(riastradh)

com(4): Omit never-used sc_vendor_workaround member.

(riastradh)

Revert "constty(4): Make MP-safe."

Something is still busted and this is interfering with the releng
amd64 testbed.

(riastradh)

Revert "console(4), constty(4): Rip off the kernel lock, take two."

Something is still busted and this is interfering with the releng
amd64 testbed.

(riastradh)

com(4): Add include guards.

(riastradh)

console(4), constty(4): Rip off the kernel lock, take two.

(riastradh)

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
  only under the new adaptive constty_lock in thread context.  This
  serializes TIOCCONS operations and ensures unlocked readers can
  safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
  allowed in any context -- printf(9) uses this to disable a broken
  constty.

3. Reading constty under constty_lock is allowed with
  atomic_load_relaxed, because while constty_lock is held, it can
  only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
  atomic_load_consume in a pserialize read section -- constty is
  only ever made nonnull with atomic_store_release, in (1).
  ttyclose will wait for all these pserialize read sections to
  complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
  pserialize read section has completed, caller must use tty_acquire
  during the pserialize read section and then tty_release when done.
  ttyclose will wait for all these references to drain before
  returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty.  Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

Changes second time around:
- Fix initialization of ok in cons.c cn_redirect.
- Fix reversed sense of conditional in subr_prf.c putone.

(riastradh)

Revert "constty(4): Make MP-safe."

Something appears to be wrong with this.

(riastradh)

Revert "console(4), constty(4): Rip off the kernel lock."

Needs more testing.

(riastradh)

com(4): Nix quirky `integrate' macro.

Just use `static inline' like everything else.

(riastradh)

com(4): Omit needless spltty in comstart.

This is called either via tp->t_oproc, which is done with tty_lock
held (thus, at IPL_VM = IPL_TTY), or from comparam which is called at
IPL_TTY, either via comopen or tp->t_param.

(riastradh)

com(4): Nix dead code.

This was introduced in rev. 1.292, whose commit message was...
`Delete dead code.'  I guess December 6, 2009 was Opposite Day?

(riastradh)

com(4): Comment on lock order.

(riastradh)

console(4), constty(4): Rip off the kernel lock.

(riastradh)

constty(4): Make MP-safe.

Access to the global constty variable is coordinated as follows:

1. Setting constty to nonnull, with atomic_store_release, is allowed
  only under the new adaptive constty_lock in thread context.  This
  serializes TIOCCONS operations and ensures unlocked readers can
  safely use a constty pointer read with atomic_load_consume.

2. Changing constty from nonnull to null, with atomic_cas_ptr, is
  allowed in any context -- printf(9) uses this to disable a broken
  constty.

3. Reading constty under constty_lock is allowed with
  atomic_load_relaxed, because while constty_lock is held, it can
  only be made null by some other thread/CPU, never made nonnull.

4. Reading constty outside constty_lock is allowed with
  atomic_load_consume in a pserialize read section -- constty is
  only ever made nonnull with atomic_store_release, in (1).
  ttyclose will wait for all these pserialize read sections to
  complete before flushing the tty.

5. To continue to use a struct tty pointer in (4) after the
  pserialize read section has completed, caller must use tty_acquire
  during the pserialize read section and then tty_release when done.
  ttyclose will wait for all these references to drain before
  returning.

These access rules allow us to serialize TIOCCONS, and safely destroy
ttys, without putting any locks on the access paths like printf(9)
that use constty.  Once we set D_MPSAFE, operations on /dev/console
will contend only with other users of the same tty as constty, which
will be an improvement over contending with all other kernel lock
users in the system.

(riastradh)

com(4): Update confusing comment from decades ago to reflect now.

No functional change.

(riastradh)

cons(9): Check the unit number on close too.

Races between multiple opens, some of which fail, might lead to
closing a bad unit number -- not clear there's a good way to prevent
this.

(riastradh)

cons(9): Serialize open and close.

Kernel lock wasn't enough for this -- cdevvp, vn_lock, or VOP_OPEN
could block, allowing another thread to re-enter open.

(riastradh)

cons(9): New function cn_set_tab.

Increment of progress toward eliminating bare access to cn_tab so we
can make more things MP-safe without the kernel lock (and maybe some
day better formalize console detection and switching).

(riastradh)

swwdog(4): Add to GENERIC kernels.

Plus a handful of others that I'm familiar with.  Lots of special-
purpose kernels should probably have this too but I'm not going
through all the arm, mips, and ppc evaluation board kernels to see
which ones are relevant.

Omitted from systems I know to be very small:
- sun2/GENERIC
- dreamcast/GENERIC
Feel free to remove it from others that need to be kept smaller.

Compile-tested a few of these just in case:
- alpha/GENERIC
- amd64/GENERIC
- evbmips/OCTEON
- i386/GENERIC
- riscv/GENERIC

PR kern/29702

(riastradh)

vmwgfxfb(4): Omit now-needless is_console hack.

This has been resolved in drmfb.

(riastradh)

tilcdc(4): Set is_console on the drm device, not the fb child.

The drm device is represented by a rockchip,display-subsystem node in
the device tree.  The fb child is a purely software abstraction used
by drm.

The is_console property is used by MD firmware logic to mark which
actual device in hardware bus enumeration like PCI or FDT the system
has chosen for the console early at boot, so hanging it on the node
for the real hardware device makes more sense than hanging it on the
software abstraction, and is consistent with recent changes to drmfb
to respect its setting on other platforms for hardware devices.

(riastradh)

sunxidrm: Set is_console on the drm device, not the fb child.

The drm device is represented by a rockchip,display-subsystem node in
the device tree.  The fb child is a purely software abstraction used
by drm.

The is_console property is used by MD firmware logic to mark which
actual device in hardware bus enumeration like PCI or FDT the system
has chosen for the console early at boot, so hanging it on the node
for the real hardware device makes more sense than hanging it on the
software abstraction, and is consistent with recent changes to drmfb
to respect its setting on other platforms for hardware devices.

(riastradh)

rkdrm: Set is_console on the drm device, not the fb child.

The drm device is represented by a rockchip,display-subsystem node in
the device tree.  The fb child is a purely software abstraction used
by drm.

The is_console property is used by MD firmware logic to mark which
actual device in hardware bus enumeration like PCI or FDT the system
has chosen for the console early at boot, so hanging it on the node
for the real hardware device makes more sense than hanging it on the
software abstraction, and is consistent with recent changes to drmfb
to respect its setting on other platforms for hardware devices.

(riastradh)

x86/efi: Print uuids in slightly more standard notation.

Anyone need a spare hyphen?  We had a few extras, apparently.

XXX pullup-8
XXX pullup-9

(riastradh)

uhid(4): Don't wake waiters on changing sc_open.

This is only a diagnostic measure, not part of semantics.

Can probably safely eliminate the diagnostic measure at this point
now.

(riastradh)

efi(4): Fix access to efi_isopen.

- Qualify efi_isopen with volatile.
- Ensure open has acquire ordering and close has release ordering.
- Use atomic_swap, not atomic_cas -- simpler and may be cheaper.
- Use atomic_store, not atomic_swap -- simpler and usually cheaper.

(Could maybe just use __cpu_simple_lock to avoid having to write out
these details.)

(riastradh)

x86/pmap: Convert conditional to assertion.

pmap_kernel should never have va < VM_MAXUSER_ADDRESS entered.

(riastradh)

x86: Support EFI runtime services.

This creates a special pmap, efi_runtime_pmap, which avoids setting
PTE_U but allows mappings to lie in what would normally be user VM --
this way we don't fall afoul of SMAP/SMEP when executing EFI runtime
services from CPL 0.  SVS does not apply to the EFI runtime pmap.

The mechanism is intended to work with either physical addressing or
virtual addressing; currently the bootloader does physical addressing
but in principle it could be modified to do virtual addressing
instead, if it allocated virtual pages, assigned them in the memory
map, and issued RT->SetVirtualAddressMap.

Not sure pmap_activate_sync and pmap_deactivate_sync are correct,
need more review from an x86 wizard.

If this causes fallout, it can be disabled temporarily without
reverting anything by just making efi_runtime_init return immediately
without doing anything, or by removing options EFI_RUNTIME.

amd64-only for now pending type fixes and testing on i386.

(riastradh)

wskbd(4): Add include guards.

No functional change intended.

(riastradh)

wdogctl(8): Minor tweak suggested by a passing umarell.

Plus another wording improvement.

(riastradh)

efi(9): Set correct calling convention for EFI runtime services.

No functional change intended -- this only affects x86, which
currently doesn't support EFI runtime services.

(riastradh)

ichsmb(4): Remove confusing `lpcib_' prefix on register names.

(riastradh)

ichsmb(4): Only rescan i2cbus child if requested.

This will let us rescan tcoichbus later too on devices where the TCO
(Intel platform controller hub watchdog timer) hangs off ichsmb(4)
instead of ichlpcib(4).

(riastradh)

ichsmb(4): Use config_detach_children to simplify.

(riastradh)

ichsmb(4): Attach i2c bus only once.

The child could be detached, e.g. with drvctl, and then the bus
rescanned, at which point it would reinitialize a mutex without
destroying it.

(riastradh)

tco(4): Nix PMC_TCO_BASE offset in TCO register definitions.

This just uses a subregion with PMC_TCO_BASE automatically applied.

No functional change intended.

(riastradh)

tco(4): Use a subregion of the PMC registers for TCO registers.

This is an intermediate step that will let us decouple it from access
via PMBASE.

(riastradh)

ichlpcib(4), tco(4): Rename iot -> pmt, ioh -> pmh.

Makes it clearer that this is specifically about the power management
controller (PMC) registers relative to PMBASE.

(riastradh)

ichlpcib(4), tco(4): Take `lpcib_' off various names.

For PMC-specific ones, change `lpcib_' to `pmc_'.  These are in a
separate PCI device in newer chipsets.

For TCO-specific ones, which may live in different places, whether at
their own base address or as an offset from PMBASE, just leave it as
`tco_' or `tcotimer'.

No functional change intended.

(riastradh)

tco(4): Rename lpcib_tco_attach_args -> tco_attach_args.

No longer hangs off LPC bus, newer devices hang it off SMBus.

(riastradh)

tco(4): Change has_rcba bit into version number.

Will be useful for newer Intel platform controller hubs.

No functional change intended.  Module ABI is unchanged, although older
modules will do something nonseneical when confronted with versions
above 1 -- that will require a revbump (but with any luck, it will make
life easier for versions above 2 easier once we do that).

(riastradh)

crashme(9): Clarify description of kernel_lock_spinout.

(riastradh)

i915: Make sure to call i915_drm_prepare too on suspend.

(riastradh)

umass(4): Reduce timeout for control xfers to standard USB timeout.

This should reduce the timeout for a failed sd@umass transfer from
n*(1min + 5sec) to 1min + n*5sec where n is the number of reset and
clear-stall steps.

(riastradh)

sandpoint: Teach altboot to handle 9.99.100 modules.

Not tested, but something here will be necessary to make it work, and
the same change does work in x86 efiboot.

(riastradh)

wdogctl(8): Rework prose and markup in man page.

No functional change.

(riastradh)

curproc(9): Rework man page.

(riastradh)

usbnet(9): Omit needless miilock around uno_stop.

This time for real!

(riastradh)

aq(4): Don't schedule tick callout on interrupt if stopping.

Make sure to take the lock around access to sc_detect_linkstat too.

(riastradh)

Note bootloader changes needed for 9.99.100.

(riastradh)

efiboot: Handle 9.99.100 by taking four, not two, digits.

We haven't used the revision part of __NetBSD_Version__ = MMmmrrpp00
in almos two decades so we're apparently reclaiming it as MMmmpppp00.

(riastradh)

i386/stand: Handle 9.99.100 by taking four, not two, digits.

We haven't used the revision part of __NetBSD_Version__ = MMmmrrpp00
in almos two decades so we're apparently reclaiming it as MMmmpppp00.

(riastradh)

specfs(9): XXX comment: what if read downgrades lock?

(riastradh)

crashme(9): Fix crashme_add return value to match comment.

XXX Why do this and crashme_remove return -1 instead of an error code
like essentially everything else in the kernel?

(riastradh)

crashme(9): Use sysctl mib numbers, not node pointers.

The node pointers are not stable across insertions of siblings,
because they are pointers into arrays that may be reallocated and
moved elsewhere.

XXX Need to audit the tree for other bugs of this class, or change
sysctl(9) so it returns stable node pointers.

(riastradh)

tco(4): Fix whitespace.  No functional change intended.

(riastradh)

nvmm(4): Add suspend/resume support.

New MD nvmm_impl callbacks:

- .suspend_interrupt forces all VMs on all physical CPUs to exit.
- .vcpu_suspend suspends an individual vCPU on a machine.
- .machine_suspend suspends an individual machine.
- .suspend suspends the whole system.
- .resume resumes the whole system.
- .machine_resume resumes an individual machine.
- .vcpu_resume resumes an indidivudal vCPU on a machine.

Suspending nvmm:

1. causes new VM operations (ioctl and close) to block until resumed,
2. uses .suspend_interrupt to interrupt any concurrent and force them
  to return early, and then
3. uses the various suspend callbacks to suspend all vCPUs, machines,
  and the whole system -- all vCPUs before the machine they're on,
  and all machines before the system.

Resuming nvmm does the reverse of (3) -- resume system, resume each
machine and then the vCPUs on that machine -- and then unblocks
operations.

Implemented only for x86-vmx for now:

- suspend_interrupt triggers a TLB IPI to cause VM exits;
- vcpu_suspend issues VMCLEAR to force any in-CPU state to be written
  to memory;
- machine_suspend does nothing;
- suspend does VMXOFF on all CPUs;
- resume does VMXON on all CPUs;
- machine_resume does nothing; and
- vcpu_resume just marks each vCPU as valid but inactive so
  subsequent use will clear it and load it with vmptrld.

x86-svm left as an exercise for the reader.

(riastradh)

xhci(4): After attach, access to sc_child/2 requires sc_intr_lock.

Serializes access with xhci_intr.

XXX Need to ensure the interrupt handler is quiesced at this point or
else it will trip over the assertion in xhci_intr about having at
least one child.

(riastradh)

usbdi(9): Sprinkle usbhist into usb xfer timeout logic.

(riastradh)

usbdi(9): Fix mistake in usbdi.c 1.244.

Need to clear ux_timeout_set only when we finally actually process
the timeout in usbdi_xfer_timeout_task, not in the callout which
schedules the task which asserts that the timeout is still set on
entry.

Must've exported the wrong version of my change from git.

(riastradh)

ld.elf_so(8): Make fork take a shared, not exclusive, lock.

We only need to ensure that there are no concurrent modifications to
the rtld data structures in flight, since the threads that began
those modifications will not exist in the child and will therefore be
unable to complete them in the child.

A shared lock suffices to ensure there are no such concurrent
modifications in flight; an exclusive lock is not necessary, and can
cause deadlock if fork is executed from a signal handler, which is
explicitly allowed by POSIX (and our own sigaction(2) man page) which
marks fork as async-signal-safe.

PR lib/56979

(riastradh)

pthread_atfork(3): Block signals during the call to pthread_atfork.

This doesn't affect the calls to the atfork handlers -- it only
protects access to the lists of handlers from interruption by a
signal, in case the signal handler calls fork(2).

(riastradh)

xhci(4): Resume commands even if USBSTS.SRE is set.

Commands might not work after this but let's at least not deadlock --
give them an opportunity to time out or fail.

XXX Maybe set sc_dying here to skip the timeout.

(riastradh)

i915: Fix error branches of execbuffer vma pinning.

PR kern/56591

(riastradh)

cgdconfig(8): Restore loop for password re-entry for non-shared keys.

Fixes mistake in previous which changed the semantics in the case
where _no_ keys are shared.

(riastradh)

nvme(4): Don't leak memory for queues on every resume.

(riastradh)

usbdi(9): Rule out possible race to read xfer->ux_status.

I think this might actually be safe, because when it's synchronous,
the xfer can't be reused except by the caller after usbd_transfer
returns.  But let's make it definitely not wrong instead of maybe
actually safe.

(riastradh)

x86/genfb: Re-enable shadowfb by defualt for now.

Something makes radeondrmkmsfb, at at least, extremely slow, and it's
not yet clear what, and shadowfb=true fixes it.  I verified that the
framebuffer pages are correctly getting mapped write-combining, so
the page table entries aren't the problem -- not sure what is the
problem.

(riastradh)

autoconf(9): New diagnostic to detect double-detach.

- Rename dv_detached -> dv_detach_committed.
- Add dv_detach_done, asserted false and then set in config_detach.

dv_detach_done may appear redundant with dv_del_gen, but dv_del_gen
will be used to safely detect config_detach on two valid references
to a device (e.g., a bus detaching its child concurrently with drvctl
detaching the same child), while dv_detach_done is strictly a
diagnostic to detect races in the config_detach API.

Currently the config_detach API itself is unsafe, but we can add a
config_detach_release function that simultaneously releases and
detaches a referenced device_t; this will continue to use dv_del_gen
to safely avoid multiple detach, and dv_detach_done to check for
races in usage.

(riastradh)

autoconf(9): Improve diagnostics for config_detach_enter/commit/exit.

(riastradh)

x86/pmap.h: Need machine/cpufunc.h for invlpg.

(riastradh)

amd64/asan.h, amd64/msan.h: Add include guards.

(riastradh)

usbnet(9): Call mii_down once we've finished with mii_tick.

(riastradh)

kthread(9): Attribute uarea to caller for kmsan.

(riastradh)

vflush(9): Insert `involuntary' preemption point at each vnode.

Currently there is a voluntary yield every 100ms, but that's a long
time.  Should help to avoid hogging the CPU while flushing lots of
data to big disks on systems without kpreemption.

(riastradh)

KERNEL_LOCK(9): Avoid spinning out until 10sec have passed.

This means we'll never spin out if the hardclock timer is stuck.  But
the hardclock timer never runs with the kernel lock held itself, so
it's not immediately clear that's important.

(riastradh)

KERNEL_LOCK(9): Restore backoff while spinning in !LOCKDEBUG case.

When the spinout logic was put under LOCKDEBUG among a series of
other changes that got reverted, the backoff was inadvertently made
LOCKDEBUG-only too.

(riastradh)

vfs(9): For MP-safe mounts, don't kernel lock in mount/unmount.

(riastradh)

vfs_subr.c: Nix trailing whitespace.

(riastradh)

usbdevs(8): Misc KNF.

- Fix whitespace and braces.
- malloc(n * sizeof(...)) -> calloc(n, sizeof(...))

(riastradh)

sys/device_if.h: Need sys/stdint.h for uint64_t.

(riastradh)

usbdi(9): Fix timeout after non-racy xfer resubmission.

Previously we would never clear ux_timeout_set if an xfer timedout,
so resubmission of the same xfer later would fail to schedule a
callout.

(riastradh)

x86: Fix interaction between consinit, device_pci_register, and drm.

Leave an essay on what's going on here in both places with
cross-references.

PR kern/56996

(riastradh)

bpf(4): Reject bogus timeout values before arithmetic overflows.

Reported-by: syzbot+fbd86bdf579944b64a98@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=60d46fd4863952897cbf67c6b1bcc8b20ec7bde6

XXX pullup-8
XXX pullup-9

(riastradh)

dtrace_fbt: Allow tracing names that start with `__'.

This was never relevant on FreeBSD and I don't think it is relevant on
NetBSD either.  The FreeBSD change to lift this restriction had the
following comment:

    r306570 | markj | 2016-10-02 00:35:00 +0000 (Sun, 02 Oct 2016) | 7 lines

    Allow tracing of functions prefixed by "__".

    This restriction was inherited from upstream but is not relevant on FreeBSD.
    Furthermore, it hindered the tracing of locking primitive subroutines.

(riastradh)

cprng_fast(9): Assert not in pserialize read section.

This may sleep to take the global entropy lock in case it needs to be
reseeded.  If that happens we can't be in a pserialize read section.

(riastradh)

nd6: Take ifnet psref around cprng_fast in nd6_slowtimo.

This may sleep on an adpative mutex, the global entropy lock, so
pserialize is forbidden.

(riastradh)

xhci(4): Make sure to destroy sc_rhlock on detach.

(riastradh)

drmfb: Rework console detection and takeover.

While here, simplify logic by removing an unreachable error branch so
we never have to contemplate unwinding claiming of the console.

(riastradh)

drmfb: Take is_console property from parent, not from self.

The parent is the pci or platform device that firmware knows about.
The `drmfb' device is more of a fictitious invention of the drm stack
that exists for the convenience of the genfb abstraction which needs
device_private to be a struct genfb_softc.

Let's see if this does any better than the last attempt to rework the
logic here.

(riastradh)

i915: Stop pretending the GTT size is zero as workaround.

Whatever bug this was I don't know how to reproduce any more.
Convinces Mesa iris_dri.so to work on this kernel.

(riastradh)

drm_mm: Give up on trying to phrase find_hole with public rbtree API.

Firefox works with WebGL on Mesa iris_dri.so now.

(riastradh)

drm: Fix dma fence stub fix so the lock is actually initialized.

Tested but forgot to amend change before exporting to CVS again.

(riastradh)

drm: Fix dma fence stub so it works with locking operations.

(riastradh)

drm_mm: Match __drm_mm_interval_first semantics.

- Use the right search criterion.
- Return &mm->head_node, not NULL, if not found.

(riastradh)

dtrace_sdt: Fix bug in builtin module reference counting.

Don't module_hold(NULL)!  This mistake was introduced in my attempt
to get dtrace working for sdt probes defined in non-builtin modules
like zfs.

(riastradh)

reallocarr(3): Touch up xrefs.

(riastradh)

reallocarr(3): Bump date.  Note overflow is handled internally.

(riastradh)

reallocarr(3): Clarify semantics.

(riastradh)

crashme(9): New debug.crashme.mutex_recursion method.

Takes a lock twice.  Set it to 1 for adaptive lock, 2 for spin lock.

(riastradh)

lockdebug(9): Try to show symbol names if possible.

Also print the possible owner in ddb/crash `show lock' even if the
kernel is built without LOCKDEBUG.

Output may not be as pretty before with two neatly aligned columns,
but that can be changed; for now the value of having the symbols
printed instead of just obscure hex addresses (which one's an lwp
address and which one's a code pointer? can never remember!) should
outweigh the prettiness temporarily lost.

(riastradh)

ddb(9): Make db_symstr safe to use concurrently with pserialize(9).

(riastradh)

ddb(4): Use db_num_to_strbuf in db_symstr.

Simplifies it and will make safer to use.

(riastradh)

ddb(9): New db_num_to_strbuf.

Like db_num_to_str, but writes to caller-provided buffer instead of
returning pointer to static storage.

(riastradh)

/etc/ssh: Install ssh_known_hosts with mode 644.

Makes it agree with the mtree and more convenient for admin to edit.

XXX pullup-8
XXX pullup-9

(riastradh)

etc: Fix permissions of various editable configuration files.

This way they match the mtree and make sense and don't cause editors
to ask to override read-only files when editing them.

Exception: Not sure /etc/bluetooth/protocols makes as much sense to
edit, but the mtree says 644, so if you want to change it, make sure
to change it in both places -- Makefile and mtree.

XXX pullup-8
XXX pullup-9

(riastradh)

/root: Install .cshrc and .profile links with the same mode.

Previously we would:

1. Install /root/.cshrc and /root/.profile with mode FILESMODE=644 as
  requested in src/etc/root/Makefile and as echoed in
  /etc/mtree/special.

2. Create hard links at /.cshrc and /.profile through CONFIGLINKS.

3. Because LINKSMODE was unset and defaults to NOBINMODE=444, change
  the mode to 444.

This scenario is confusing, and mtree objects to it, which is bad for
warning fatigue in a security-relevant mechanism.  (There are also
several other files mtree objects to out of the box -- we should fix
those too.)

With this change we install the links with the same mode as the
original files, in agreement with the mtree.  The files, .cshrc and
.profile, are intended to be editable configuration files, so 644
makes sense while 444 makes no sense and gets in the way of editors
like vi.

Discussed on tech-userlevel:
https://mail-index.netbsd.org/tech-userlevel/2022/08/29/msg013498.html

XXX pullup-8
XXX pullup-9

(riastradh)

x86: Rename x86/efi.c -> x86/efi_machdep.c.

Avoid collision with dev/efi.c.

(riastradh)

cgdconfig(8): Gracefully handle failed verification with shared keys.

The first time each key is verified, if verification fails, we chuck
the failed key and try again with passphrase re-entry.

But if a key has already been verified, and verification fails,
assume something is wrong with the disk and fail.

(riastradh)

nvme(4): Actually check if bp is null as commented previously.

I had tested this change, but forgot to amend the commit before
exporting to CVS.

(riastradh)

nvme(4): If bp is null or bp->b_ci is not assigned, use curcpu().

curcpu() might be stale by the time we're done, but it's still safe
to pass it to cpu_index, and this is just used as a best-effort
mechanism to keep I/O on queues handled by the same CPU.

bp is not always provided, and bp->b_ci is not always assigned,
e.g. when dumping.  (If bp->b_ci is supposed to be always assigned,
then we need to audit all the paths into it to assign it in those
where it's not.)

Fixes dump on nvme.

(riastradh)

libm: Fix some whitespace issues in recent sincos additions.

(riastradh)

options(4): Clarify MSGBUFSIZE units: bytes.

(riastradh)

sys/disklabel_gpt.h: Fix description of name encoding.

The encoding is UCS-2 from Unicode 2.1 or ISO/IEC 10646.  This is not
to be confused with UTF-16, which encodes code points outside the BMP
(Basic Multilingual Plane, ~16-bit space) with pairs of surrogate
code points.

(riastradh)

devsw(9): Clarify to match loop condition.  NFCI.

(riastradh)