bsd.own.mk: rename GCC_NO_* to CC_WNO_*

Rename compiler-warning-disable variables from
GCC_NO_warning
to
CC_WNO_warning
where warning is the full warning name as used by the compiler.

GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH

Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.

Force at most partial RELRO for rump_server and related libraries

rump_server with -l uses lazy resolution by default and thus cannot be
used with full RELRO/BIND_NOW.

introduce some common variables for use in GCC warning disables:

GCC_NO_FORMAT_TRUNCATION -Wno-format-truncation (GCC 7/8)
GCC_NO_STRINGOP_TRUNCATION -Wno-stringop-truncation (GCC 8)
GCC_NO_STRINGOP_OVERFLOW -Wno-stringop-overflow (GCC 8)
GCC_NO_CAST_FUNCTION_TYPE -Wno-cast-function-type (GCC 8)

use these to turn off warnings for most GCC-8 complaints. many
of these are false positives, most of the real bugs are already
commited, or are yet to come.


we plan to introduce versions of (some?) of these that use the
"-Wno-error=" form, which still displays the warnings but does
not make it an error, and all of the above will be re-considered
as either being "fix me" (warning still displayed) or "warning
is wrong."

branches: 1.14.10;
With the removal of HAVE_REGISTER_T from rumpuser_port.h, _KERNTYPES does not
need to be defined. This allows register_t to be typedef'd to RUMP_REGISTER_T
without conflict, as highlighted in PR kern/52206.

Revert previous change so builds can resume.
_KERNTYPES needs to be defined for NetBSD builds to succeed.
_KERNTYPES must not be defined for buildrum.sh builds to succeed.

Do not define _KERNTYPES as this breaks build with buildrump.sh due to
conflicting types for register_t.
Closes PR kern/52206
Steered in the right direction by christos.

branches: 1.11.6;
Define _KERNTYPES for things that need it.

-I../librumpuser is still required for sp_common.c

use <rump/rumpuser_port.h>

Make it possible for external parties to specify additional dplibs.
This is useful for example on platforms which require -ldl.

branches: 1.7.4; 1.7.10;
need -I${.OBJDIR} now

create srcsys symlink

Remove "NOLINT" setting that was apparently committed by accident and
breaks the build.

Disable string aliasing for rump_syscalls.c. I can't figure out
how to otherwise make the kernel's register_t coreography to work
with the return value here in a MI fashion.

add some excuse of a manpage for librumpclient

branches: 1.2.2;
Install rumpclient to /lib to allow non-/usr users.
pointed out by tron (thanks!)

Add library for rump syscall client stubs.

branches: 1.1.2;
file Version.map was initially added on branch agc-symver.

Standardize Lb argument.

branches: 1.2.4; 1.2.10;
Use more appropriate markup. Fix a typo.

branches: 1.1.2;
add some excuse of a manpage for librumpclient

librump*: Require 10.99.7 or higher for __kevent100

Add epoll(2) from Theodore Preduta as part of GSoC 2023

fix typos in word "successful".

Ignore failed closes (if for example a closed file descriptor is passed as
a starting point). This is how the kernel behaves.

Redo previous by avoiding the casts and using PRIxREGISTER instead

Fix DPRINTF format

Modern Android SDK does not need special cases

Always use kqueue for BSDs in librumpclient

Tested now on the others

Use kqueue in librumpclient for FreeBSD too

pretend to handle the poll return value for -Wunused-but-set

branches: 1.61.2;
Make sure holyfd is -1 when rumpclient_init() is called for
the first time after fork to prevent fd 0 from being closed.

should fix test failures, thanks to martin for the prod

Add Android support for rump kernel.

Reviewed by pooka@

fix build on NetBSD. also, prevent fd leak in error path

On Linux, poll signalfd() when waiting for a kernel response.
This allows the same type of race-free handling of signals as kqueue()
allows on NetBSD. One of the noticeable things is that you can now
interrupt rumprun ping mid-interval on Linux.

per suggestion from Justin Cormack

Use MAP_ANON|MAP_PRIVATE for anonymous memory mapping,
e.g. Linux gets upset if just MAP_ANON.

Translate signal numbers between rump kernel and (POSIX) host.

use <rump/rumpuser_port.h>

Solaris 10 fixes

If the host doesn't support RTLD_NEXT, don't play the dynamic linking game.

attempt to inform user of what the error means

branches: 1.51.2;
Remove unused variable. Approved by pooka.

force-terminate commname

Make librumpclient compile and work on Linux. This is accomplished by:

1) avoid "NetBSD'isms" in the rumpclient sources
2) do not require the knowledge of unnecessary weird_t's in syscallargs.h
for rumpclient

Use C89 function definition

branches: 1.47.2;
Mark rumphijack_dlsym explicitly as weak to prevent optimisations based
on pointer (non-)identity of it and rumpclient__dlsym.

Don't use K&R syntax

branches: 1.45.4;
Save/restore errno in error path in dupgood. Check that n>0 before
accessing banner[n-1].

Approved a while ago by pooka@

don't spam connection errors to stderr by default

* use _exit() instead of exit() in retryconn=die: atexit() handlers
may hang if the server is dead
* consistent use of data

and for my next trick, i'm going to spell ARGSUSED correctly

lint love

Since we ~never have a frame waiting on the initial call to waitresp,
call kevent before readframe. Doesn't really affect performance,
but makes ktraces shorter ;)

Use sendmsg() instead multiple calls to sendto(). It behaves
slightly better in the multithreaded exec case in terms of partial
frames sent. Plus, it's theoretically a little cheaper.

There's still a gray area with partial transfer from sendmsg(),
but I'm not sure I care enough about some academic scenario to
start fixing it (it basically needs an OOB exec signaller).

Take reasonable precautions against init in a parent process
which did a rump-transparent host-only fork().

fix __RCSID

Fix static fallback path.

Make the rumphijack dlsym trampoline call from rumpclient a "real"
function call instead of a call through a function pointer.
Apparently powerpc ld.elf_so gets __hackish_return_address() wrong
if the call is done through a function pointer (digging deeper into
that stuff is beyond my interest).

Thanks to riz for providing access to a macppc for debugging.
Unthanks to the broken toolchain in the default installation which
wasted approximately 4 hours of time last night.

Die with a sensible error message if a symbol cannot be found.

I think I skipped the class where they taught that multiplication
is done before addition...

* set default server connection retry to 0 (no reconnection attempts).
while for some cases attempting retry after server restart works
brilliantly (e.g. firefox), in other cases it's quite disasterous
(sshd doesn't like its file descriptors going missing and does not
attempt to reopen them, leading to a quite catastophic loop of
EBADF once the server does come back)
* rename RUMPHIJACK_RETRY to the slightly more sensible
RUMPHIJACK_RETRYCONNECT

Support vfork. Add rumpclient wrapper for daemon(3).

Push the fiddly tasks for exec and fork from rumphijack to rumpclient.
This makes it possible easily execute those operations also from
non-hijacked rump clients (plus fixes one memory leak in an error
branch).

support HANDSHAKE_EXEC

A bunch of changes which essentially make sshd work with a hijacked
rump tcp/ip stack:

* sshd likes to fork and then re-exec itself
==> trap execve() and augment the env with the current parameters
essential to a rump kernel (kernel communication fd, information
about dup2'd file descriptors)

* sshd likes to play lots of games with pipes, socketpairs and dup{,2}()
==> make sure we do not close essential rump client descriptors:
dup() them to a safe place, except for F_CLOSEM where we
simply leave them alone. also, partially solved by the above,
make sure the process's set of rump kernel descriptors persists
over exec()

* sshd likes to chdir() before exec
==> for unix-style rump_sp(7) sockets save the full path on the
initial exec and use it afterwards. thread the path through
the environment in execve()

The following happens when sending mail with mutt via a rump
TCP/IP stack:

* mutt prepares to exec the smtp client: it forks and closes all
file descriptors
* when the next networking syscall is done, rumpclient detects that
the communication fd returned EBADF and does a reconnect,
gets descriptor 0 for the socket and descriptor 1 for kqueue
* mutt opens the mail file and implicitly assumes it'll get 0-2,
but in fact gets 2-4
* mutt execs the smtp agent which tries to read the mail from
stdin (rumpclient communication socket) and fails

Even if mutt correctly did dup2() things would go south when trying
to communicate with the kernel server the next time, since rumpclient
would actually be talking with some mail body instead (well, it
could work, but in that case you'd need to write *really* weird
mails ;).

Hence, prevent rumpclient from using the special fd's 0-2 for its
purposes.

Should fix mutt problem reported by Alexander Nasonov.

malloc/free aren't async-signal-safe, so avoid calling them when
signals aren't blocked.

this bug made tests/rump/rumpkern/t_sp:sigsafe rarely deadlock

make sure we don't use "fullset" before we init it

Add another connection retry model which simply does exit(1) if
the connection is severed.
(mostly for tests so that everything can be hooked to rump_server's exit)

Make sure to close parent's server communication socket after fork.

Fix some snafus to allow rumphijack to work on -current.

reported by Alexander Nasonov

Pass the value of getprogname() from the client to the server and
record it in p_comm. This is nice for things like sockstat, since
they now display the client command name:

pain-rustique:43:~> rump.sockstat
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root xulrunner- 16 0 tcp 192.168.2.114.65507 204.152.190.12.80
root xulrunner- 16 1 tcp 192.168.2.114.65501 204.152.190.12.80
root xulrunner- 16 2 tcp 192.168.2.114.65500 204.152.190.12.80
root xulrunner- 16 3 tcp 192.168.2.114.65499 204.152.190.12.80
root xulrunner- 16 5 tcp 192.168.2.114.65498 204.152.190.12.80
root xulrunner- 16 6 tcp 192.168.2.114.65497 204.152.190.12.80
root socket 62 0 tcp6 *.http *.*
root socket 62 1 tcp *.http *.*
root socket 63 0 tcp6 *.81 *.*
root socket 63 1 tcp *.81 *.*

Allow to set a timeout for how long the client will attempt to
reconnect in case the connection to the server is lost. Default
to exactly one reattempt. This makes sense and additionally fixes
the dev/raidframe/smalldisk test which currently causes a server
panic when a certain raidctl command is run (without this fix the
test would timeout since the client kept attempting to reconnect).

plug fd leak in reconnect code

Add reconnect code to librumpclient. In case the connection to
the kernel server is lost, the client will now automatically attempt
to reconnect.

Among other things, this makes it possible to "reboot" and restart
the TCP/IP stack from under firefox without any perceivable less
of service. If pages were loading at the time the TCP/IP server
was killed, there may be some broken links, but nothing a ctrl-r
cannot fix.

Forgot to commit this a few days ago: need to make sure we get the
right kqueue/kevent now that rumphijack hijacks them.

branches: 1.16.2;
Add RUMPSP_RAISE: the kernel sends a signal to the client.

A bunch of improvements:

* don't hold spc mutex while sending data
* use send() for the banner to avoid SIGPIPE in case a client
connects and immediately goes away
* fix error path locking
* use kevent() instead of pollts() in the client. Apparently that
is the only sensible way for a library to support both multithreading
and signal-reentrancy in a race-free manner.
(can I catch all signals with one kevent instead of installing
NSIG different ones??)
* mark client comm descriptor non-blocking so that clients have
better signal-interruptibility (we now sleep in signal-accepting
kevent() instead of signal-masked recvfrom())

Separate rw_data and rw_done. Otherwise we don't get wakeups for
requests which have a 0-length response (such as copyin 0/0).

This change makes links(1) work against a rump kernel which contains
rumpnet_local. The presence of unix domain sockets caused links
to select() with 0 fds and a timeout, and because copyin never woke
up in the kernel the application blocked indefinitely.

Make rumpclient impervious to LD_PRELOAD syscall hijacking by using
dlsym(RTLD_NEXT) to lookup a host_syscall() function pointer which
is used instead of syscall() to communicate with the kernel server.

WARNING: popular opinion classifies this as "ugly code". if you
have a weak heart/mind/soul/sole meuniere, read max. 1 line of the
diff per day, preferably with food.

Make rumpclient syscalls safe to call from signal handlers.

Support fork() for rumpclient users.

Have the client and server perform some sort of handshake first.
It's pretty much a placeholder for now. One plan for the future
is to require some sort of authentication for superuser clients.
The code will need a little massage then, though, to prevent DoS
attacks.

Print a banner a connecting client. The banner contains rump sp
protocol version, os name, os revision and machine.

lintsquelch

Change RUMP_SP_CLIENT to RUMP_SERVER. The former was, in addition
to being annoying to write, slightly misguiding, since it contains
the server url.

Remove remaining panic()s from server-side code. Also, allow to
send an out-of-band error. Make the client retry syscall requests
if this error is EAGAIN, fail them otherwise.

*facepalm*, adjust remote copyinstr to work in cases where the end
of the max copyin extends to an unmapped page.

Noticed, as usual, by tests.

update locking proto, use unputwait

Start working on making the syscall proxy code threadsafe. The
basics are there, but a few more tweaks are needed. The reason
I'm committing it now is that the code was mindnumbingly boring to
write (no wonder it took me almost 3 years to get it done), and I
might burn it if it's not in a safe place.

use -1/errno for failure: it's much more convenient for the users

Add library for rump syscall client stubs.

make it the same as rump.h

Don't depend on stars in order to define things.

branches: 1.15.20;
Provide register_t compat on solarisa.
(would be nice to handle register_t compat internally instead, but the
interface was already exposed in a release)

fix the extern "C" stuff

Solaris 10 fixes

branches: 1.12.2;
Make librumpclient compile and work on Linux. This is accomplished by:

1) avoid "NetBSD'isms" in the rumpclient sources
2) do not require the knowledge of unnecessary weird_t's in syscallargs.h
for rumpclient

Request always_inline for rumpclient__dofork, it won't work correctly
for vfork otherwise. Also give it the returns twice attribute to ensure
that the stack tainting is done recursively.

branches: 1.10.4;
Include "sys/null.h" to get the definition of NULL.

fix signature of rumpclient_fork()

Support vfork. Add rumpclient wrapper for daemon(3).

Push the fiddly tasks for exec and fork from rumphijack to rumpclient.
This makes it possible easily execute those operations also from
non-hijacked rump clients (plus fixes one memory leak in an error
branch).

A bunch of changes which essentially make sshd work with a hijacked
rump tcp/ip stack:

* sshd likes to fork and then re-exec itself
==> trap execve() and augment the env with the current parameters
essential to a rump kernel (kernel communication fd, information
about dup2'd file descriptors)

* sshd likes to play lots of games with pipes, socketpairs and dup{,2}()
==> make sure we do not close essential rump client descriptors:
dup() them to a safe place, except for F_CLOSEM where we
simply leave them alone. also, partially solved by the above,
make sure the process's set of rump kernel descriptors persists
over exec()

* sshd likes to chdir() before exec
==> for unix-style rump_sp(7) sockets save the full path on the
initial exec and use it afterwards. thread the path through
the environment in execve()

types.h for time_t

Add another connection retry model which simply does exit(1) if
the connection is severed.
(mostly for tests so that everything can be hooked to rump_server's exit)

Allow to set a timeout for how long the client will attempt to
reconnect in case the connection to the server is lost. Default
to exactly one reattempt. This makes sense and additionally fixes
the dev/raidframe/smalldisk test which currently causes a server
panic when a certain raidctl command is run (without this fix the
test would timeout since the client kept attempting to reconnect).

branches: 1.2.2;
Support fork() for rumpclient users.

Add library for rump syscall client stubs.

Add library for rump syscall client stubs.