bsd.own.mk: rename GCC_NO_* to CC_WNO_*

Rename compiler-warning-disable variables from
GCC_NO_warning
to
CC_WNO_warning
where warning is the full warning name as used by the compiler.

GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH

Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.

Force at most partial RELRO for rump_server and related libraries

rump_server with -l uses lazy resolution by default and thus cannot be
used with full RELRO/BIND_NOW.

introduce some common variables for use in GCC warning disables:

GCC_NO_FORMAT_TRUNCATION -Wno-format-truncation (GCC 7/8)
GCC_NO_STRINGOP_TRUNCATION -Wno-stringop-truncation (GCC 8)
GCC_NO_STRINGOP_OVERFLOW -Wno-stringop-overflow (GCC 8)
GCC_NO_CAST_FUNCTION_TYPE -Wno-cast-function-type (GCC 8)

use these to turn off warnings for most GCC-8 complaints. many
of these are false positives, most of the real bugs are already
commited, or are yet to come.


we plan to introduce versions of (some?) of these that use the
"-Wno-error=" form, which still displays the warnings but does
not make it an error, and all of the above will be re-considered
as either being "fix me" (warning still displayed) or "warning
is wrong."

branches: 1.27.10;
With the removal of HAVE_REGISTER_T from rumpuser_port.h, _KERNTYPES does not
need to be defined. This allows register_t to be typedef'd to RUMP_REGISTER_T
without conflict, as highlighted in PR kern/52206.

Revert previous change so builds can resume.
_KERNTYPES needs to be defined for NetBSD builds to succeed.
_KERNTYPES must not be defined for buildrum.sh builds to succeed.

Do not define _KERNTYPES as this breaks build with buildrump.sh due to
conflicting types for register_t.
Closes PR kern/52206
Steered in the right direction by christos.

branches: 1.24.6;
Define _KERNTYPES for things that need it.

Move rump kernel man pages from various sources to sys/rump

namely:
* src/lib is used only when building for POSIX'y platforms, but
the man pages have their use for all platforms
* rumpuser.3 is a function of the rump kernel, not one of the of
the POSIX'y implementation hosted in src/lib/librumpuser

no functional change

Don't install rumpuser.h here.

It's already installed by the rump kernel build (sys/rump/include/rump)

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

Add a fiber based implementation of librumpuser in addition to the
default pthreads based version.

Discussed with pooka@

Split out file and memory access in librumpuser

This allows alternate implementations to reuse these parts, and the file
parts will at the next hypercall revision be moved to their own driver.

Discussed with pooka@

Antti objected to including rumpuser_sync_icache. Exclude it from the build.

Implement rumpuser_sync_icache hypercall.

branches: 1.16.2;
Translate signal numbers between rump kernel and (POSIX) host.

Install rumpuser_port.h

also, bsd.own.mk to pick up mk.conf

Make it possible for external parties to specify additional dplibs.
This is useful for example on platforms which require -ldl.

put optional modules on a separate SRCS line

Translate error codes between the hypervisor and rump kernel.

Rework how the bio hypercalls work, part 1/n:

Reduce the set of hypercalls to one: "do block i/o". This not only
eliminates a lot of pseudo-duplicate code, it also gives the
hypervisor a lot more freedom on how to optimize the i/o.

Move the rumpuser_net set of hypercalls to be a private to the sockin
component. This cleans up the generic hypercall interfaces from ones
specific to only one component. They should always have been private,
but the infrastructure to "make it so" didn't exist earlier.

no functional change

Add interfaces that out-of-librumpuser hypercalls can use to unschedule
and reschedule themselves if they plan to block.

limit use of rumpuser.h to where it is meant to be used from

branches: 1.6.2;
These directories default to WARNS?=5

branches: 1.5.6;
Require server to be explicitly initialized with rump_init_server(url).
Also, add rump_daemonize_begin() / rump_daemonize_end() to help
with the "can't daemon() after pthread_create()" problem. Applications
could accomplish the same, but since it's such a common operation,
provide a little help.

add commented-out -D_DIAGNOSTIC

Start rework of system call proxying over socket ("sysproxy").
This incarnation is written in the user namespace as opposed to
the previous one which was done in kernel namespace. Also, rump
does all the handshaking now instead of excepting an application
to come up with the user namespace socket.

There's still a lot to do, including making code "a bit" more
robust, actually running different clients in a different process
inside the kernel and splitting the client side library from librump.
I'm committing this now so that I don't lose it, plus it generally
works as long as you don't use it in unexcepted ways: i've tested
ifconfig(8), route(8), envstat(8) and sysctl(8).

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

branches: 1.1.2;
Install rump libraries and utilities to the base system and remove the
private non-installed build infrastructure from sys/rump.

breakdown of commit:
* install relevant headers into /usr/include/rump
* build sys/rump/librump/rumpuser and sys/rump/librump/rumpkern
from src/lib and install as librumpuser and librump, respectively
+ this retains the ability to test a librump build with just the
kernel sources at hand
* move sys/rump/fs/lib/libukfs and sys/rump/fs/lib/libp2k to src/lib
for general consumption, they are not kernel-space dwellers anyway
* build and install sys/rump/fs/lib/lib$fs as librumpfs_$fs
* add chapter 3 manual pages for rump, rumpuser, ukfs and p2k
* build and install userspace kernel file system daemons if MKPUFFS=yes
is spexified
* retire fsconsole for now, it will make a comeback with an actually
implemented version shortly

mk.conf(5): document rump variables

Update mk.conf(5) with the rump variables from
- lib/librumpuser/README.compileopts
- sys/rump/README.compileopts

Add cross-references back to mk.conf(5) in those files.

Ensure that the Default: is listed last in a description,
for consistency with the convention in this file.

fix typo in README.compileopts text.

Move librumpuser compile-time options into the librumpuser source
directory. Those options apply only for the in-tree implementation.

branches: 1.1.2;
file Version.map was initially added on branch agc-symver.

librumpuser: regen (autoreconf -iv)

branches: 1.6.2;
librumpuser/configure: regen for URL fixes

check for utimensat

check that sys/cdefs.h builds with -Werror (not the case on alpine linux
where it contains an unconditional #warning)

check for clock_gettime from librt too

actually check for clock_nanosleep()

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

librumpuser/configure.ac: check preadv and pwritev

branches: 1.7.2;
librumpuser/configure: fix missing directory warning

Use "build-aux" instead of the non-existant "m4" as the
directory for AC_CONFIG_MACRO_DIR.

Avoids autoreconf warning:
aclocal: warning: couldn't open directory 'm4': No such file or directory

No change to generated files.

fix rump URLs

Link to https://github.com/rumpkernel/ instead of
a site now taken over by an SEO squatter.

Per discussion on github.com/rumpkernel issues with pooka.

PR misc/57501

branches: 1.5.26;
check for utimensat

check that sys/cdefs.h builds with -Werror (not the case on alpine linux
where it contains an unconditional #warning)

check for clock_gettime from librt too

actually check for clock_nanosleep()

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Distinguish spin mutex and adaptive mutex on rump kernels for LOCKDEBUG

Formerly rump kernels treated the two types of mutexes as both adaptive for
LOCKDEBUG for some reasons.

Now we can detect violations of mutex restrictions on rump kernels such as
taking an adaptive mutex with holding a spin mutex as well as normal kernels.

branches: 1.12.8;
Minor fixes to types and includes

Whitespace fixes, no functional change

Fix some return value checks

Just abort on currently unsupported functions.

Remove superfluous getcontext()

Move makecontext into function with getcontext for consistency

Fix some error handling cases.

assert that clock_gettime() does not fail

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.3.2; 1.3.6;
Clean up error handling in rumpuser_init()

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

Add a fiber based implementation of librumpuser in addition to the
default pthreads based version.

Discussed with pooka@

Minor fixes to types and includes

Just abort on currently unsupported functions.

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.1.2; 1.1.6;
Add a fiber based implementation of librumpuser in addition to the
default pthreads based version.

Discussed with pooka@

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

lso translate errno in the rumpfiber version

RCS Id police (because we can. or have you heard of git id police?)

Add missing include

branches: 1.1.2; 1.1.6;
Add a fiber based implementation of librumpuser in addition to the
default pthreads based version.

Discussed with pooka@

Minor fixes to types and includes

Just abort on currently unsupported functions.

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.1.2; 1.1.6;
Add a fiber based implementation of librumpuser in addition to the
default pthreads based version.

Discussed with pooka@

Move rump kernel man pages from various sources to sys/rump

namely:
* src/lib is used only when building for POSIX'y platforms, but
the man pages have their use for all platforms
* rumpuser.3 is a function of the rump kernel, not one of the of
the POSIX'y implementation hosted in src/lib/librumpuser

no functional change

* attempt to clarify what "POSIX" means
* link to Platforms page on wiki for a list of known implementation

document rumpuser_kill()

minor clarification: rumpuser_thread_create() is used to create the host
thread context for kernel threads, never for application threads.

per discussion with justin

Use <major>.<minor> for NetBSD version.

branches: 1.15.2;
More markup, less typos.

Improve documentation on the locking order of cv_wait mtx/cpu.

Add a generalized rumpuser_syncfd() call which allows the caller
to request a sync or a barrier for fd.

Pass off_t over the hypercall interface as int64_t to avoid potential
problems in setups where off_t doesn't want to be 64bit.

I'm already excitedly waiting for 128bit off_t and _LARGE_LARGE_FILES

Pass enums over the hypercall interface as ints to avoid some
pathological scenarios from arising in setups where enums might be
of a different size in the rump kernel and hypervisor.

Add RUMPUSER_LWP_CLEAR instead of overloading RUMPUSER_LWP_SET.
This simplifies some alternative hypervisor implementations.

Fix some punctuation nits and bump date for previous.

update for previous change

Push rwlock upgrade and downgrade into the hypervisor where there's
at least a chance to implement them with minimal fuss.

Inform the rump kernel hypervisor of valid thread contexts so
that the implementation can allocate and release storage for them
in an optimal fashion, if necessary.

add HISTORY

expand the intended usage of rumpuser_open()

document the hypercall interface

branches: 1.2.6; 1.2.12;
Join today's manpage mania by updating this to reflect the current
situation a "little" better.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

PR kern/57626: instead of an (arbitrary) FAKE_PAGE_SHIFT (and always
using 4k pages), query the hypervisor for the real page size of the host
kernel and use that for architectures that do not have compile time
constant page sizes.

Fix return value inspection for clock_nanosleep() (not displayed in the
diff, need to look at the entire file for context).

from Robert Millan <rmh@freebsd.org> via rumpkernel-users

Print the "halted\n" from previous commit to stdout, not stderr.

The putchar hypercall writes to stdout, so this change restores
the original "functionality" (which was not intended to change).

from gson, via tests

Since the rump kernel does not know when the container it's running in
actually halts, print "halted" in the hypercall.

check clock_gettime() rv

Clean up error handling in rumpuser_init()

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

Reinstate include of netdb.h, needed on some cross builds

Split out file and memory access in librumpuser

This allows alternate implementations to reuse these parts, and the file
parts will at the next hypercall revision be moved to their own driver.

Discussed with pooka@

branches: 1.59.2;
Always use sysconf() to query host processor count instead of separate
tricks for each platform.

Do not use uninitialized pointer if posix_memalign() fails.

make implementation of rumpuser_kill() match the documentation

Translate signal numbers between rump kernel and (POSIX) host.

librumpuser: add some #ifdef __APPLE__ and missing bits to build it on OS X.
OK pooka@

Change the default value of rump kernels CPUs to 2. It used to be
the number of host cores, but that value is overkill for most uses,
especially with massively multicore hosts. Dozens of useless virtual
CPUs are relatively speaking expensive in terms of bootstrap time and
memory footprint. On the other end of the spectrum, defaulting to 2
might shake out some bugs from the qemu test runs.

Add a generalized rumpuser_syncfd() call which allows the caller
to request a sync or a barrier for fd.

Pass off_t over the hypercall interface as int64_t to avoid potential
problems in setups where off_t doesn't want to be 64bit.

I'm already excitedly waiting for 128bit off_t and _LARGE_LARGE_FILES

Pass enums over the hypercall interface as ints to avoid some
pathological scenarios from arising in setups where enums might be
of a different size in the rump kernel and hypervisor.

Ok, maybe using int64 for nanoseconds in the (sec,nsec) tuple was
a bit too future-proof. I think long is enough there (let's just
hope nobody redefines "nano"). Also, make seconds signed just in
case someone wants their clock to be in 1901.

avoid Wunused on !NetBSD

Flip parameter order in the clock hypercalls to make them consistent
with everything else wrt in/out parameters.

Translate error codes between the hypervisor and rump kernel.

Some systems don't provide preadv/pwritev (hi Solaris!), so implement
that with lseek + readv/writev instead (and avoid rewinding the
pointer with soon-to-be documentation).

Make hypercall calling conventions consistent: iff a hypercall can fail,
it returns an int containing the error value.

Reduce hypercalls related to reading to essentially an amalgamation
of readv and preadv. ditto for writing. Hypercalls are so seldomly
used that it doesn't justify 3x the calls for syntactic sugar.

Replace the various "get info from hypervisor" interfaces with one
unified rumpuser_getparam(), and make it return a plist. The
contents can come e.g. from the env or a config file. Make
identifiers starting with an underscore denote system identifiers
which must be implemented by hypervisor. (yea, j/k about the plist bit)

The fsync hypercall is now used only with close, so get rid of it.
rumpuser_bio() should do the necessary syncing.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

RUMPUSER_OPEN_DIRECT is no longer necessary

changes to bio hypercalls, part 3/n:

retire the filemmap/memsync hypercalls, they're no longer used

Rework how the bio hypercalls work, part 1/n:

Reduce the set of hypercalls to one: "do block i/o". This not only
eliminates a lot of pseudo-duplicate code, it also gives the
hypervisor a lot more freedom on how to optimize the i/o.

don't need event.h here anymore

Improve the time-related hypercalls so that's it's possible to
sleep until an absolute time on the host's monotonic clock (should
something like that be supported).

make the file monitoring hypercalls private to shmif

The ioctl hypercall is used only by the usb host controller driver,
so make it exclusive to that component. I'm happy to see it gone.

make the random hypercall more generic

* treat kern_malloc.c as an unreal allocator (it's so lightweight)
* get rid of the rumpuser_realloc() hypercall
* pass size to rumpuser_free()

rumpuser_poll() is used only by sockin, so make the hypercall
private to that component.

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

Terminate result of readlink(). Makes writefilewatch_setup() work in
cases when the buffer doesn't accidentally contain suitable zeroes.

Thanks to Juan RP who debugged this with me!

Use the /proc way for counting host cores on Cygwin.

.. and make it compile on said platforms.

Provide an implementation of writewatchfile for platforms without kqueue
or inotify (it's a rather simple implementation ;)

FreeBSD and DragonFly also provide hosts cpus via sysctl hw.ncpu.

Apparently MAP_ANON mmap() on Linux requires MAP_PRIVATE to be specified
for the addr parameter to have a sane effect. Make it so.

Fixes for Solarisa.

Check return value of ftruncate(). Some versions of gcc give
warnings if I don't.

Implement the writewatchfile routines for a Linux hypervisor. As a
result, the shmif network driver now works when hosted on Linux.

Do not assume that O_FOO flags have matching values in the rump kernel
and hypervisor.

branches: 1.19.2;
Make librumphijack compile and work on Linux. Do not try to hijack
calls which are not supported on Linux and therefore cannot be
handled by the rump kernel side syscall emulation (not that they'd
be present in the calling binaries anyway).

Once again, make the rump kernel hypercall layer work on Linux.

Update old-style definitions to ANSI, remove a couple of register
definitions along the way. Fixed gcc 4.1 build (thank you vax)

Remove arc4random() and arc4randbytes() from the kernel API. Replace
arc4random() hacks in rump with stubs that call the host arc4random() to
get numbers that are hopefully actually random (arc4random() keyed with
stack junk is not). This should fix some of the currently failing anita
tests -- we should no longer generate duplicate "random" MAC addresses in
the test environment.

branches: 1.15.4;
Support query of the partition size in case underlying device is
a wedge. This still lacks the proplibistic query of the sector
size and just assumes 512. It's good that we make asking a file's
size as simple as requiring one stat(), one open() and three (3)
different ioctls plus some proplist mumbojumbo. I'm surprised it's
available at all by means other than #wish.

code mostly from Taylor R Campbell, rant from me.

happiness is a quiet lint

include pid of rump server in hostname

branches: 1.12.2;
Fix fd leak also in non-NetBSD code path.

Fix fdleak in error case. Found by cppcheck.

Make int *error and optional parameter (i.e. it can be NULL).
Sometimes the caller just doesn't care which errno close() might
throw.

* if kevent() fails with EINTR, try again instead of returning an error
* stuff rumpuser_dprintf to stderr instead of stdout

Version rumpuser ABI with a lightweight mechanism.

Add the ability to specify a preferred address the "map anon memory"
hypercall.

Check return value of posix_memalign ... always helpful to not return
garbage memory in case of failure.

Don't pass "canfail" down to rumpuser_malloc -- there's quite little
we can do with that info way down there. Instead, pass alignment.
Implement rumpuser_malloc() with posix_memalign().

Add rumpuser interface to fetch number of host cpus.

Actually, support rumpuser_kill() only on NetBSD, since signal
numbers may not match on non-NetBSD hosts.

Add rumpuser_kill, which sends a signal to a host process.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Add errno translation for bio operations

Add __RCSID.

branches: 1.7.2; 1.7.6; 1.7.8;
Pass off_t over the hypercall interface as int64_t to avoid potential
problems in setups where off_t doesn't want to be 64bit.

I'm already excitedly waiting for 128bit off_t and _LARGE_LARGE_FILES

include stdint.h before rumpuser.h (on some platforms it doesn't get
there automagically)

Create a kernel thread context for the bio upcalls.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

set default bio mode to threaded

unschedule around blocking i/o

Rework how the bio hypercalls work, part 1/n:

Reduce the set of hypercalls to one: "do block i/o". This not only
eliminates a lot of pseudo-duplicate code, it also gives the
hypervisor a lot more freedom on how to optimize the i/o.

Remove unused file.

Implement rumpuser_sync_icache hypercall.

branches: 1.6.2; 1.6.8;
include stdint.h before rumpuser.h (on some platforms it doesn't get
there automagically)

Translate error codes between the hypervisor and rump kernel.

Give private hypercalls the ability to meddle with kthread contexts too.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

Add interfaces that out-of-librumpuser hypercalls can use to unschedule
and reschedule themselves if they plan to block.

branches: 1.3.2; 1.3.8;
Translate error codes between the hypervisor and rump kernel.

Give private hypercalls the ability to meddle with kthread contexts too.

Add interfaces that out-of-librumpuser hypercalls can use to unschedule
and reschedule themselves if they plan to block.

librumpuser: regen (autoreconf -iv)

branches: 1.4.28;
check for utimensat

check for clock_gettime from librt too

actually check for clock_nanosleep()

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Temporarily make PR t_sp:sigsafe noisier.

This is an attempt to diagnose why it's flaky in the releng testbeds
but not when I run it. This change will be backed out once we get
new testbed output.

rumpuser(3): New RUMP_STDOUT, RUMP_STDERR environment variables.

If set, then when rump daemonizes, it opens the path in RUMP_STDOUT
and redirects fd 1 to that (which mostly gets the kernel console
output), and opens the path in RUMP_STDERR and redirects fd 2 to that
(no idea what this gets but it's probably good to record if it ever
gets anything).

This will allow tests that rely on rump_server daemons to stash the
output for diagnostics in case, e.g., the rump kernel crashes.

PR bin/58112

fix typos in comments and one definition, mainly s/sucket/socket/.

branches: 1.7.26;
Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

include stdint.h before rumpuser.h (on some platforms it doesn't get
there automagically)

Translate error codes between the hypervisor and rump kernel.

Fixes for Solarisa.

branches: 1.3.2;
Once again, make the rump kernel hypercall layer work on Linux.

branches: 1.2.4;
shush lint

branches: 1.1.2;
Require server to be explicitly initialized with rump_init_server(url).
Also, add rump_daemonize_begin() / rump_daemonize_end() to help
with the "can't daemon() after pthread_create()" problem. Applications
could accomplish the same, but since it's such a common operation,
provide a little help.

lib: remove CONSTCOND comment

Since 2021-01-31, lint doesn't need it anymore for the common pattern of
'do ... while (0)'.

Teach rump to process __link_set_evcnts entries. (Second part of
fix for PR kern/55088)

Teach rump how to process __link_set_sysctl_funcs so it can handle
modules the same as a real kernel.

Partly addresses PR kern/55088 - __link_set_evcnts not yet handled
(that will happen later)

s/lenght/length/

branches: 1.30.16;
Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

weak alias removal implication: rumpuser_dl_globalsym() can now sleep
with the fishes.

branches: 1.28.2;
Add Android support for rump kernel.

Reviewed by pooka@

If dlopen returns NULL assume we are statically linked and return,
rather than getting a warning when dlinfo fails.

Do not process linkmaps if there is exactly one link map present
(i.e. there is no ld.so). Makes statically linked rump kernels work on
glibc (at least for me).

based on some discussion with Justin Cormack

Oh, stdint.h isn't written with a comma ...

need to include stdint.h before rump/rumpuser.h

glibc on MIPS uses the same DYN d_ptr variant as NetBSD and musl.

from Justin Cormack

librumpuser: add some #ifdef __APPLE__ and missing bits to build it on OS X.
OK pooka@

comment polish: just musl

Decide ET_DYN behavior based on __GLIBC__ instead of __linux__,
e.g. musl libc doesn't follow glibc behavior.

per discussions with a number of people

FreeBSD does the Solaris-like map->l_addr boogie.

from Ben Gras

Make rumpuser_dl_bootstrap() optional for platforms which don't
provide dynamic linking.

Attempt two for the previous: _ILP32 comes from headers, so don't use
it to decide if we want to muddle with _FILE_OFFSET_BITS.

Use _FILE_OFFSET_BITS=64 on Solaris too (necessary for 32bit builds).

DragonFly is in the Solaris camp in the "how to access ELF DYN at runtime"
valley of joy and love.

Tiny fix for Solaris.

Ensure that rump kernel component constructors from the main object
get processed. This applies to ones which were linked statically.
Unfortunately, that's where it got a bit tricky, since the dlsym()
interface searches the handle and all its dependencies. For the main
object the list of dependencies includes all the dynamic rump kernel
components that were included when the binary is linked. So, a long
story short, make only one pass through the objects to harvest all the
component entries, weed out the dupes, and initialize components from
an in-memory dupe-free list when so requested.

Support Cygwin as a hypervisor.

Support binaries which use DT_GNU_HASH instead of DT_HASH.

Support DragonFly BSD.

const poison is the cure

branches: 1.8.2;
Once again, make the rump kernel hypercall layer work on Linux.

branches: 1.7.4;
make work on nb5 again

Convert hashtab to Elf_Symindx type, and use it directly to get symbol
count. Remove now unused GETVECWORDn macro.

This is needed to make it work on alpha which use non-standard 64bit
values for the symbol hash table section, unlike all other archs.

Allow rump kernel to call dlsym(RTLD_DEFAULT).

Allow loading the symbols from objects which are not directly mapped
into memory, namely the main object (i.e. map->l_addr is NULL).

During bootstrap, process all modinfos in a DSO in one go. Get
rid of dependency tricks, since they are no longer necessary.

Introduce RUMP_COMPONENT. It behaves mostly like a simplified
module which is linked into the kernel and cannot be unloaded.
The main purpose is to get the proper constructors run and create
any /dev nodes necessary for said component. Once more of the
kernel (e.g. networking stack and device drivers) are converted to
MODULE and devfs pops up from somewhere, rump components can be
retired.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

branches: 1.1.2; 1.1.8;
Translate error codes between the hypervisor and rump kernel.

librumpuser: use preadv/pwritev if available

Because Calling lseek then readv/writev is racy.

branches: 1.4.28;
More finegrained disklabel macro checks, for FreeBSD

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.1.2; 1.1.6;
Split out file and memory access in librumpuser

This allows alternate implementations to reuse these parts, and the file
parts will at the next hypercall revision be moved to their own driver.

Discussed with pooka@

lib: remove CONSTCOND comment

Since 2021-01-31, lint doesn't need it anymore for the common pattern of
'do ... while (0)'.

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

branches: 1.9.2;
remember to commit this file too

Translate error codes between the hypervisor and rump kernel.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

Rework how the bio hypercalls work, part 1/n:

Reduce the set of hypercalls to one: "do block i/o". This not only
eliminates a lot of pseudo-duplicate code, it also gives the
hypervisor a lot more freedom on how to optimize the i/o.

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

branches: 1.4.6; 1.4.12;
Make int *error and optional parameter (i.e. it can be NULL).
Sometimes the caller just doesn't care which errno close() might
throw.

Make it possible to use the scheduler lock as the rumpuser condvar
interlock. This is applicable in cases where the actual interlock
is the CPU the currently running thread is scheduled on. Borrowing
the scheduler lock as the mutex mandated by pthread_cond_wait()
does away with need to have an additional mutex. This both optimizes
runtime execution and simplifies code, as the extra lock typically
lead to quite some trickeries to avoid the dungeon collapsing due
to zaps from the wand of deadlock.

Wrap DOCALL and DOCALL_KLOCK in a new block (for easy adding of
debug prints before them.

XXX: can't use the standard do-while0 because lint doesn't like it.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.1.2; 1.1.6;
Split out file and memory access in librumpuser

This allows alternate implementations to reuse these parts, and the file
parts will at the next hypercall revision be moved to their own driver.

Discussed with pooka@

Move the rumpuser_net set of hypercalls to be a private to the sockin
component. This cleans up the generic hypercall interfaces from ones
specific to only one component. They should always have been private,
but the infrastructure to "make it so" didn't exist earlier.

no functional change

branches: 1.3.2;
Once again, make the rump kernel hypercall layer work on Linux.

branches: 1.2.6;
Make int *error and optional parameter (i.e. it can be NULL).
Sometimes the caller just doesn't care which errno close() might
throw.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

librumpuser/rumpuser_port.h: import new flags for NetBSD

branches: 1.53.2;
fix rump URLs

Link to https://github.com/rumpkernel/ instead of
a site now taken over by an SEO squatter.

Per discussion on github.com/rumpkernel issues with pooka.

PR misc/57501

branches: 1.52.2;
lib: remove CONSTCOND comment

Since 2021-01-31, lint doesn't need it anymore for the common pattern of
'do ... while (0)'.

For MIPS N32, register_t needs to be uint64_t as "long" isn't
big enough.

Evil hack to fix the build: provide PRIxREGISTER here.
Sevan, please check and fix correctly ;-)

Update NetBSD values obtained from running configure as instructed in comment.
This paves the way to resolve rump build process using buildrump.sh, where the definition of
HAVE_REGISTER_T caused conflicting definitions of register_t.

branches: 1.48.4;
Don't go redefining system constants, without checking if the system provides
them.

branches: 1.47.2;
Add the C11 function aligned_alloc to libc.

Add more compat defs for code compiled for !NetBSD targets.

At least GNU Hurd lacks MAXHOSTNAMELEN/MAXPATHLEN/PATH_MAX, so make sure
those have some arbitrary semi-sane values.

from Robert Millan in PR misc/50166, with some modifications from myself

Hurd support, part 1

from Robert Millan <rmh@gnu.org> via rumpkernel-users

check for utimensat

Remove no longer required definitions

work around c11 visibility problems on some version(s) of FreeBSD

Just _GNU_SOURCE should be enough to expose everything necessary on Linux

Add some prototypes for Android rump kernel builds

See buildrump.sh #70, some Android versins are missing prototypes for
these libc functions

fix clock_gettime emulation

update for NetBSD-current having clock_nanosleep

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Canonical Minix check as pointed out by Marc

Minix also has getenv_r support

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

Applications are not supposed to and do not need to include <features.h> explicitly

branches: 1.32.2;
Add Android support for rump kernel.

Reviewed by pooka@

fix name of HAVE_PTHREAD_SETNAME_3

use a probe result to decide which pthread_setname_np() to use

emulate printflike properly to avoid fatal error on clang

Do not force _FILE_OFFSET_BITS=64 here. It's no longer strictly speaking
required (rumpuser interface no longer uses off_t) and force-defining
it causes foo() to magically become foo64() on glibc (even on 64bit
platforms).

Make setprogname() a nop where it's not supported.

remove obsolete definitions

do as the comment says and #if defined(every_other) || defined(platform) || ...
===> #if !defined(__NetBSD__)

OpenBSD support

from Justin Cormack via github

remove outdated comment (since quite a few months ago)

librumpuser: add some #ifdef __APPLE__ and missing bits to build it on OS X.
OK pooka@

more platform-specific qualifiers

TIMEVAL_TO_TIMESPEC (for musl)

from Justin Cormack

Fixes when compiling against musl libc.

from Justin Cormack via private email

branches: 1.18.2;
Improve the time-related hypercalls so that's it's possible to
sleep until an absolute time on the host's monotonic clock (should
something like that be supported).

make the random hypercall more generic

Attempt two for the previous: _ILP32 comes from headers, so don't use
it to decide if we want to muddle with _FILE_OFFSET_BITS.

Use _FILE_OFFSET_BITS=64 on Solaris too (necessary for 32bit builds).

Refine previous: sys/sysmacros.h is where MIN/MAX comes from on Solaris,
so it needs to be included unconditionally.

StunOS >= 5.11 has posix_memalign(), so add an additional constraint for
when we need to emulate it with memalign() and when not.

Include sys/sysmacros.h on solaris for MIN/MAX.

Support Cygwin as a hypervisor.

fix previous

One more thing required by DragonFly

FreeBSD fixes.

from philip@freebsd.org

Since SA_SETLEN() is used only for sockaddr_in, convert it to SIN_SETLEN()
to avoid compiler whining on breaking strict aliasing rules.

satisfy the slightly more picky clang

export register_t to rump kernel users on solaris

Fixes for Solarisa.

branches: 1.3.2; 1.3.4;
More fixes for Linux (or glibc, really).

Make librumphijack compile and work on Linux. Do not try to hijack
calls which are not supported on Linux and therefore cannot be
handled by the rump kernel side syscall emulation (not that they'd
be present in the calling binaries anyway).

Once again, make the rump kernel hypercall layer work on Linux.

Revert change related to pthread_setname_np() which has been reverted.

Avoid a "format string is not a literal" warning(error)

Normally I'd simply disable this absurd warning, after determining that
it is not the 1 in a million case where there's actually a potential
bug, but here, simply silencing the warning by using a literal format
string is so simple that it might as well be done this way.

This appeared as a side-effect of the pthread_setname_np() changes.

Distinguish spin mutex and adaptive mutex on rump kernels for LOCKDEBUG

Formerly rump kernels treated the two types of mutexes as both adaptive for
LOCKDEBUG for some reasons.

Now we can detect violations of mutex restrictions on rump kernels such as
taking an adaptive mutex with holding a spin mutex as well as normal kernels.

branches: 1.45.8;
Fix typos to match values from rumpuser_config.h

from Hajime Tazaki via rumpkernel-users

With glibc on ARM kthread_exit() aborts because pthread_exit() fails
to unwind the stack. Add a temporary workaround where we simply don't
allow the thread to exit (a kernel thread exit is a relatively uncommon
event in a rump kernel anyway).

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Hrmph, revert previous pending another fix. I tested it yesterday with
a slightly older tree, and of course it doesn't work anymore ...

Wrap pthread_create(). Shouldn't really have a functional effect,
apart from testing that rumpuser_thread_create() can actually survive
an unschedule/schedule cycle (which may or may not be necessary with
other hypercall implementations).

branches: 1.40.2;
Add Android support for rump kernel.

Reviewed by pooka@

fix braces

use a probe result to decide which pthread_setname_np() to use

set threadname for correct pthread_t

Revert conversion to __thread as breaks on archs without TLS support

Use __thread rather than pthread_getspecific for rumpuser curlwp.
This has better performance and curlwp is a performance bottleneck
in rump kernel code.

librumpuser: add some #ifdef __APPLE__ and missing bits to build it on OS X.
OK pooka@

Give RUMP mutex and rwlock their own cache-line. Also give a separate
cache-line for the rwlock's reader counter.

rumpuser_rwlock: replace internal pthread_spin_lock (for protecting reader
count) with atomic operations. As pthread_spin_lock is not adaptive lock, it
can have hugely negative impact if contended here, especially with priority
inversions. Now contended rwlock(9) no longer falls flat in RUMP kernels.

If pthread_create() fails with EAGAIN, try a few more times with short
sleeps in between. If it helps, good. If it doesn't, oh well, at
least we tried. pthread_create() returning EAGAIN has been observed in
real life at least on Linux (buildrump.sh issue #40)

Pass enums over the hypercall interface as ints to avoid some
pathological scenarios from arising in setups where enums might be
of a different size in the rump kernel and hypervisor.

Add RUMPUSER_LWP_CLEAR instead of overloading RUMPUSER_LWP_SET.
This simplifies some alternative hypervisor implementations.

Initialize rw->downgrade when allocating a rwlock.

should/might/etc fix recent test hangs reported by martin & pgoyette

Support proper rw_downgrade() semantics.

reorder for better locality. no functional change.

Push rwlock upgrade and downgrade into the hypervisor where there's
at least a chance to implement them with minimal fuss.

Retry enabling spin mutexes. We should be able to avoid poking the
scheduler by just making wakeup from cv_wait() honor the same locking
order as when a spin mutex is acquired though mutex_enter().
*fingers crossed*

Inform the rump kernel hypervisor of valid thread contexts so
that the implementation can allocate and release storage for them
in an optimal fashion, if necessary.

Clear rwlock's "writer" field when releasing the lock. Otherwise it might
have been possible for "readers" to reach visibility before "writer"
when another CPU took the lock, thus leading the previous owner to
incorrectly think that it still owned the lock in rw_write_held().

Also, remove duplicate clause from assert().

In kthread_create(), pass the priority and cpu index down to the
rump kernel hypervisor (though the current implementation doesn't take
advantage of them).

Translate error codes between the hypervisor and rump kernel.

Make hypercall calling conventions consistent: iff a hypercall can fail,
it returns an int containing the error value.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

Rework how the bio hypercalls work, part 1/n:

Reduce the set of hypercalls to one: "do block i/o". This not only
eliminates a lot of pseudo-duplicate code, it also gives the
hypervisor a lot more freedom on how to optimize the i/o.

Change rumpuser_cv_timedwait() from absolute time to relative time.
It's then the hypervisor's problem to translate it accordingly.
Now we no longer have to worry about the kernel having to know the
hypervisor's time and vice versa.

roll mutex init hypercalls into one (one of them already took a flag anyway)

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

Try to make sure that the appropriate calls to mutex_enter() takes
a spin mutex (i.e. does not relinquish cpu context while trying to
take the mutex).

Bump the hypercall interface version number. I'll be doing a bunch
of other cleanups to simplify the interface for the benefit of
alternative hypervisor implementations. I'll be riding this bump
and doing a second one only after I'm finished with all of the
changes.

As reported by several people, the signature of pthread_setname_np() varies
from one Linux distro to another (didn't suspect it to be *that* _np).
Comment out the call on Linux pending autoconf support.

Support Cygwin as a hypervisor.

PTHREAD_PROCESS_SHARED private doesn't seem to work on DragonFly, so
init the spin lock _PRIVATE (we don't really care which it is).

call pthread_setname_np() on Linux too.

branches: 1.8.2;
Once again, make the rump kernel hypercall layer work on Linux.

branches: 1.7.4;
fix indent. no functional changes.

branches: 1.6.2;
implement mutex_owner()

Umm, delete recursive mutex interface instead of renaming it.

Track lwp as the rumpuser mutex owner instead of pthread_t (this
is done in rumpuser for simplicity, since on the kernel side things
we assume we have only one pointer of space). As a side-effect,
we can no longer know if the current thread is holding on to a
mutex locked without curlwp context (basically all mutexes inited
outside of mutex_init()). The only thing that called rumpuser_mutex_held()
for a non-kmutex was the giant lock. So, instead implement recursive
locking for the giant lock in the rump kernel and get rid of the
now-unused recursive pthread mutex in the hypercall interface.

Support KTHREAD_JOINABLE/kthread_join(). Also fixes earlier bug
where all pthreads were created non-detached.

Make it possible to use the scheduler lock as the rumpuser condvar
interlock. This is applicable in cases where the actual interlock
is the CPU the currently running thread is scheduled on. Borrowing
the scheduler lock as the mutex mandated by pthread_cond_wait()
does away with need to have an additional mutex. This both optimizes
runtime execution and simplifies code, as the extra lock typically
lead to quite some trickeries to avoid the dungeon collapsing due
to zaps from the wand of deadlock.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

s/flgas/flags/ in rumpuser_mutex_init() second argument name.
No functional changes intended.

Distinguish spin mutex and adaptive mutex on rump kernels for LOCKDEBUG

Formerly rump kernels treated the two types of mutexes as both adaptive for
LOCKDEBUG for some reasons.

Now we can detect violations of mutex restrictions on rump kernels such as
taking an adaptive mutex with holding a spin mutex as well as normal kernels.

branches: 1.17.16;
For consistency with other files in the same directory
don't include <sys/cdefs.h> before __RCSID.

branches: 1.16.4;
Pass enums over the hypercall interface as ints to avoid some
pathological scenarios from arising in setups where enums might be
of a different size in the rump kernel and hypervisor.

need the rw_downgrade/tryupgrade methods too

update to recent interface changes

Inform the rump kernel hypervisor of valid thread contexts so
that the implementation can allocate and release storage for them
in an optimal fashion, if necessary.

make this build/work again

In kthread_create(), pass the priority and cpu index down to the
rump kernel hypervisor (though the current implementation doesn't take
advantage of them).

roll mutex init hypercalls into one (one of them already took a flag anyway)

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

Try to make sure that the appropriate calls to mutex_enter() takes
a spin mutex (i.e. does not relinquish cpu context while trying to
take the mutex).

Bump the hypercall interface version number. I'll be doing a bunch
of other cleanups to simplify the interface for the benefit of
alternative hypervisor implementations. I'll be riding this bump
and doing a second one only after I'm finished with all of the
changes.

Actually define the klock/unlock pointers. Not having the storage
allocated for them created "interesting" effects with one compiler setup.

one more routine

implement mutex_owner()

need rumpuser_mutex_init_kmutex() these days

Start restoring the ability to run rump kernels on non-threading
hypervisors.

Step 1: make this compile again (it's not complete, but
at least it compiles).

branches: 1.2.4; 1.2.10;
Ensure that rumpuser_thread_exit doesn't return.

librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

RCS Id police (because we can. or have you heard of git id police?)

branches: 1.2.2; 1.2.6;
Clean up error handling in rumpuser_init()

Clean up random implementation for librumpuser

Use /dev/urandom for platforms without arc4random, not srandom(),
deduplicate code, do not read excessive random bytes

Reviewed by pooka@

branches: 1.1.4; 1.1.8;
Translate signal numbers between rump kernel and (POSIX) host.

Allocate one more byte so that we are always NUL-terminated, and remove
the extra commented out NUL-terminations. As suggested in:

http://mail-index.netbsd.org/source-changes-d/2020/04/01/msg012470.html

Avoid buffer overflow

Disable the offending code.

OK by kre@

If we're going to loop, pausing and then retrying malloc() after it
has failed, in the hope that some other thread has free'd some memory,
but we want to bound the number of attempts, it helps if we actually
count them - otherwise we never get nearer to the limit.

In practice, malloc() for a reasonable application on a modern system
almost never fails, so the code containing this bug has probably never
been, and never will be, executed, but just in case, someday.

For this, it isn't clear if the intent was to have 10 retries (ie: 11
attempts) or 10 tries, but as the code said "retries > 10", I am
assuming the former (not that it matters, if the malloc() has failed
10 times in a row, with 10 second pauses between, the chances of an
11th succeeding aren't great).

Revert previous

It will be addressed in a better way.

Requested by <kre>

Avoid buffer overflow

Detected with ASan + RUMPKERNEL.

branches: 1.72.14;
Redo previous by avoiding the casts and using PRIxREGISTER instead

Can not print register_t with %d, cast to long and use %ld instead.

Hurd support, part 1

from Robert Millan <rmh@gnu.org> via rumpkernel-users

If binding fails, print URL with which it failed.

Avoid uninitialised variable warning when gcc is feeling lazy

No longer create a special process context to fork remote clients off
of, simply always rfork off of proc1 closing all descriptors, and have
the rump kernel open 0/1/2 if the parent process is "1".

Fixes tests/rump/rumpkernel/t_sp, which was failing since the
abovementioned special process change due to attempting to deliver a
signal to the special process and the special process was not equipped
to handle one.

branches: 1.66.2;
Remove one more symbol reference to librump (missed in previous commit
to this file)

do previous the right way to avoid rumpuser linkage dependency on librump

Create remote clients with standard file descriptors open. Fixes at
least editing a new file with ed in rumpremote (because ed calls
isatty(0) in case a file does not exist).

branches: 1.63.2;
Fix locking SNAFU.

Is someone can explain why the code worked for 3+ years with multiple
different pthread implementations, I'll buy you a banana.

OpenBSD support

from Justin Cormack via github

Workaround a gcc -Wuninitilized whine

github/buildrump.sh issue #44

librumpuser: add some #ifdef __APPLE__ and missing bits to build it on OS X.
OK pooka@

Fix build where compiler can throw an array-bounds error and
code is built with NDEBUG
or
platform's assert is not __dead

branches: 1.58.2;
Translate error codes between the hypervisor and rump kernel.

Make hypercall calling conventions consistent: iff a hypercall can fail,
it returns an int containing the error value.

Make the rump kernel upcalls which were previous available only to
the sysproxy module available for the entire hypervisor.

nuke unused var

make the random hypercall more generic

wrap unportable register_t with a long. should do it in the front
of the house too, but at least this is a start.

* integrate rumpuser_getversion() with the hypervisor initialization
* rename some identifiers to better match reality

Support Cygwin as a hypervisor.

Support DragonFly BSD.

FreeBSD fixes.

from philip@freebsd.org

For the rumpsp protocol, don't assume that the bit representation of
errnos match on the client and server platforms (the syscall subprotocol
errnos are handled by the server compat code).

branches: 1.47.2;
Once again, make the rump kernel hypercall layer work on Linux.

Disable reduced stack for now. It creates fallout I'm not willing to
deal with.

branches: 1.45.4;
Use sendmsg() instead multiple calls to sendto(). It behaves
slightly better in the multithreaded exec case in terms of partial
frames sent. Plus, it's theoretically a little cheaper.

There's still a gray area with partial transfer from sendmsg(),
but I'm not sure I care enough about some academic scenario to
start fixing it (it basically needs an OOB exec signaller).

Nuke all threads belonging to a process calling exec before allowing
the exec handshake to return.

In addition to being The Right Thing To Do, fixes some nasty
conditions for CLOEXEC fd's (or at least does so in theory, I
couldn't create any problems although I tried).

use nwork-adjusted amount of idle workers to decide is they are truly idle.

Cleanup server socket before sending back "ok" for halt. Fixes
some occasionally-seen race conditions in tests which do server
restarts (e.g. the raidframe tests).

support HANDSHAKE_EXEC

Turn the "idle workers available" from a flag into a counter so
that we can finally avoid all races (*knock knock*).

Fix a race condition in the worker thread caching logic: if we got
two or more syscall requests before any worker thread ran, we might
not have enough threads to handle the requests. In some scenarios
this could lead to a deadlock.

Pass the value of getprogname() from the client to the server and
record it in p_comm. This is nice for things like sockstat, since
they now display the client command name:

pain-rustique:43:~> rump.sockstat
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root xulrunner- 16 0 tcp 192.168.2.114.65507 204.152.190.12.80
root xulrunner- 16 1 tcp 192.168.2.114.65501 204.152.190.12.80
root xulrunner- 16 2 tcp 192.168.2.114.65500 204.152.190.12.80
root xulrunner- 16 3 tcp 192.168.2.114.65499 204.152.190.12.80
root xulrunner- 16 5 tcp 192.168.2.114.65498 204.152.190.12.80
root xulrunner- 16 6 tcp 192.168.2.114.65497 204.152.190.12.80
root socket 62 0 tcp6 *.http *.*
root socket 62 1 tcp *.http *.*
root socket 63 0 tcp6 *.81 *.*
root socket 63 1 tcp *.81 *.*

In case sys_reboot() was called by a remote client, put the response
in the socket before we shut down. This way the response to the
syscall travels to the caller and they know things worked correctly
instead of having to just assume.

branches: 1.36.2;
Add RUMPSP_RAISE: the kernel sends a signal to the client.

call procexit when a connection closes

A bunch of improvements:

* don't hold spc mutex while sending data
* use send() for the banner to avoid SIGPIPE in case a client
connects and immediately goes away
* fix error path locking
* use kevent() instead of pollts() in the client. Apparently that
is the only sensible way for a library to support both multithreading
and signal-reentrancy in a race-free manner.
(can I catch all signals with one kevent instead of installing
NSIG different ones??)
* mark client comm descriptor non-blocking so that clients have
better signal-interruptibility (we now sleep in signal-accepting
kevent() instead of signal-masked recvfrom())

g/c code which is unused in the server

Separate rw_data and rw_done. Otherwise we don't get wakeups for
requests which have a 0-length response (such as copyin 0/0).

This change makes links(1) work against a rump kernel which contains
rumpnet_local. The presence of unix domain sockets caused links
to select() with 0 fds and a timeout, and because copyin never woke
up in the kernel the application blocked indefinitely.

Make rumpclient syscalls safe to call from signal handlers.

Release sender lock before zeroing out "wanted" status during
violent disconnect. Fixes some race conditions (maybe the one
occasionally showing up on tests/rump/rumpkern/t_stress).

thanks to schmonz for some discussion

Support fork() for rumpclient users.

rump_lwproc_newproc -> rump_lwproc_rfork

Have the client and server perform some sort of handshake first.
It's pretty much a placeholder for now. One plan for the future
is to require some sort of authentication for superuser clients.
The code will need a little massage then, though, to prevent DoS
attacks.

Print a banner a connecting client. The banner contains rump sp
protocol version, os name, os revision and machine.

Unlink unix socket as part of server exit.
(whatever happened to the code that was supposed to do it automatically
when the binding process exits?)

add rumpuser_sp_fini, which surpringly is the opposite of rumpuser_sp_init

outdated comment

lint care

Remove remaining panic()s from server-side code. Also, allow to
send an out-of-band error. Make the client retry syscall requests
if this error is EAGAIN, fail them otherwise.

Cache syscall worker threads and include some stetson-harrison
limits. This improves syscall throughput about 2x for non-userio
syscalls (no copyin/out, e.g. getpid()) and almost 1.5x even for
things like __sysctl().
(measured for cases where the remote process is on the local machine)

XXX: if the pthread deadqueue sucks for anything which cares about
performance, why does it exist? Nuking it would make supporting
variable stack size easier.

Since we are going to handle syscalls in our threads, limit stacksize.
(unfortunately though, pthread_attr_setstacksize() has no effect on NetBSD)

Fix a few locking problems with multithreaded clients.

TODO: make server deal graciously with out-of-resources conditions

Improve reliability in cases where client disconnects mid-operation.

Plug recently introduced memory leak: release lwp after use instead of
just switching away.

Also, make freeing syscall arguments a little more symmetric.

*facepalm*, adjust remote copyinstr to work in cases where the end
of the max copyin extends to an unmapped page.

Noticed, as usual, by tests.

create pthread attribute only once

Unschedule from CPU for out-of-kernel blocking ops. Otherwise we
might even deadlock if the thread that wakes us up wants a CPU.

improve threadsafety

Sneeze some locking into connect/disconnect.

Support physio for remote processes.
==> add support for remote vmspace vmapbuf/vunmapbuf
==> add proper support for copyin/out_vmspace
==> add support for remote vmspace uvm_io
==> add support for non-curproc rumpuser_sp_copyin/out
==> store remote context in vm_map->pmap instead of
pthread_specificdata

In short, makes read/write of most (all?) block devices work from
a remote rump client via rump syscalls.

squelch the compiler whine

Support multithreaded clients and fix a few bugs.

Start working on making the syscall proxy code threadsafe. The
basics are there, but a few more tweaks are needed. The reason
I'm committing it now is that the code was mindnumbingly boring to
write (no wonder it took me almost 3 years to get it done), and I
might burn it if it's not in a safe place.

free syscall data after use

Refactor the sysproxy code so that rumpuser contains only the server side.

Missed a few symbols in previous ...

Also, reorganize rumpuser header inclusion to make sure problem is
caught already by the compiler.

Make librumpuser linkage once again free of librump.

problem pointed out by <he>

Run different clients (different sockets) in different processes
inside the rump kernel. Now different host processes can no longer
step on each other inside the rump kernel.

Start rework of system call proxying over socket ("sysproxy").
This incarnation is written in the user namespace as opposed to
the previous one which was done in kernel namespace. Also, rump
does all the handshaking now instead of excepting an application
to come up with the user namespace socket.

There's still a lot to do, including making code "a bit" more
robust, actually running different clients in a different process
inside the kernel and splitting the client side library from librump.
I'm committing this now so that I don't lose it, plus it generally
works as long as you don't use it in unexcepted ways: i've tested
ifconfig(8), route(8), envstat(8) and sysctl(8).

Add interfaces that out-of-librumpuser hypercalls can use to unschedule
and reschedule themselves if they plan to block.

branches: 1.1.6; 1.1.12;
librumpuser is not _KERNEL code and does not belong in sys. Move
the source files from src/sys/rump/librump/rumpuser to src/lib/librumpuser
(from where it is already built). Even so, keep rumpuser.h in
sys/rump/include for kernel source tree self-containment.

Revert accidental local test change from previous - the DEBUG define
is passed on the command line already.

librumpuser: New RUMPUSER_DEBUG env var enables debug output.

Use it in t_sp:sigsafe to see if we can get more diagnostics out.

branches: 1.43.4;
In unix_parse(), always allocate memory for the entire struct sockaddr_un
and not just the part used by the present pathname, because the entire
struct will be passed to bind() and an EFAULT can result if not all of
it is a valid allocation. Fixes PR kern/56533.

Fix incompatible function pointer casts

Allocate one more byte so that we are always NUL-terminated, and remove
the extra commented out NUL-terminations. As suggested in:

http://mail-index.netbsd.org/source-changes-d/2020/04/01/msg012470.html

Fix off-by-one

Before accessing array member, check whether it is not out of valid range.

Detected with ASan + RUMPKERNEL.

branches: 1.39.14;
printf functions should be tagged as printf functions. Noticed by
martin, whose build broke for some reason yet to be determined.

OpenBSD support

from Justin Cormack via github

Do not export symbols which don't need to be exported.

via Justin Cormack

Support Cygwin as a hypervisor.

Since SA_SETLEN() is used only for sockaddr_in, convert it to SIN_SETLEN()
to avoid compiler whining on breaking strict aliasing rules.

Fixes for Solarisa.

For the rumpsp protocol, don't assume that the bit representation of
errnos match on the client and server platforms (the syscall subprotocol
errnos are handled by the server compat code).

branches: 1.32.2;
Once again, make the rump kernel hypercall layer work on Linux.

branches: 1.31.4;
Use sendmsg() instead multiple calls to sendto(). It behaves
slightly better in the multithreaded exec case in terms of partial
frames sent. Plus, it's theoretically a little cheaper.

There's still a gray area with partial transfer from sendmsg(),
but I'm not sure I care enough about some academic scenario to
start fixing it (it basically needs an OOB exec signaller).

Nuke all threads belonging to a process calling exec before allowing
the exec handshake to return.

In addition to being The Right Thing To Do, fixes some nasty
conditions for CLOEXEC fd's (or at least does so in theory, I
couldn't create any problems although I tried).

return correct value when reading a short frame

support HANDSHAKE_EXEC

A bunch of changes which essentially make sshd work with a hijacked
rump tcp/ip stack:

* sshd likes to fork and then re-exec itself
==> trap execve() and augment the env with the current parameters
essential to a rump kernel (kernel communication fd, information
about dup2'd file descriptors)

* sshd likes to play lots of games with pipes, socketpairs and dup{,2}()
==> make sure we do not close essential rump client descriptors:
dup() them to a safe place, except for F_CLOSEM where we
simply leave them alone. also, partially solved by the above,
make sure the process's set of rump kernel descriptors persists
over exec()

* sshd likes to chdir() before exec
==> for unix-style rump_sp(7) sockets save the full path on the
initial exec and use it afterwards. thread the path through
the environment in execve()

Add reconnect code to librumpclient. In case the connection to
the kernel server is lost, the client will now automatically attempt
to reconnect.

Among other things, this makes it possible to "reboot" and restart
the TCP/IP stack from under firefox without any perceivable less
of service. If pages were loading at the time the TCP/IP server
was killed, there may be some broken links, but nothing a ctrl-r
cannot fix.

In case sys_reboot() was called by a remote client, put the response
in the socket before we shut down. This way the response to the
syscall travels to the caller and they know things worked correctly
instead of having to just assume.

branches: 1.24.2;
Add RUMPSP_RAISE: the kernel sends a signal to the client.

A bunch of improvements:

* don't hold spc mutex while sending data
* use send() for the banner to avoid SIGPIPE in case a client
connects and immediately goes away
* fix error path locking
* use kevent() instead of pollts() in the client. Apparently that
is the only sensible way for a library to support both multithreading
and signal-reentrancy in a race-free manner.
(can I catch all signals with one kevent instead of installing
NSIG different ones??)
* mark client comm descriptor non-blocking so that clients have
better signal-interruptibility (we now sleep in signal-accepting
kevent() instead of signal-masked recvfrom())

g/c code which is unused in the server

Separate rw_data and rw_done. Otherwise we don't get wakeups for
requests which have a 0-length response (such as copyin 0/0).

This change makes links(1) work against a rump kernel which contains
rumpnet_local. The presence of unix domain sockets caused links
to select() with 0 fds and a timeout, and because copyin never woke
up in the kernel the application blocked indefinitely.

Make rumpclient impervious to LD_PRELOAD syscall hijacking by using
dlsym(RTLD_NEXT) to lookup a host_syscall() function pointer which
is used instead of syscall() to communicate with the kernel server.

WARNING: popular opinion classifies this as "ugly code". if you
have a weak heart/mind/soul/sole meuniere, read max. 1 line of the
diff per day, preferably with food.

Make rumpclient syscalls safe to call from signal handlers.

Support fork() for rumpclient users.

Have the client and server perform some sort of handshake first.
It's pretty much a placeholder for now. One plan for the future
is to require some sort of authentication for superuser clients.
The code will need a little massage then, though, to prevent DoS
attacks.

Print a banner a connecting client. The banner contains rump sp
protocol version, os name, os revision and machine.

Unlink unix socket as part of server exit.
(whatever happened to the code that was supposed to do it automatically
when the binding process exits?)

Hands off of stuff we need to keep hands off of.

Remove remaining panic()s from server-side code. Also, allow to
send an out-of-band error. Make the client retry syscall requests
if this error is EAGAIN, fail them otherwise.

Fix a few locking problems with multithreaded clients.

TODO: make server deal graciously with out-of-resources conditions

Improve reliability in cases where client disconnects mid-operation.

*facepalm*, adjust remote copyinstr to work in cases where the end
of the max copyin extends to an unmapped page.

Noticed, as usual, by tests.

unsnafu previous

Unschedule from CPU for out-of-kernel blocking ops. Otherwise we
might even deadlock if the thread that wakes us up wants a CPU.

missed part of earlier commit

Support multithreaded clients and fix a few bugs.

delint

Start working on making the syscall proxy code threadsafe. The
basics are there, but a few more tweaks are needed. The reason
I'm committing it now is that the code was mindnumbingly boring to
write (no wonder it took me almost 3 years to get it done), and I
might burn it if it's not in a safe place.

Don't puff sigpipe if the connection has been severed. May happen
e.g. when a client executes a blocking call such a poll() and
decides to exit before the result is ready.

Implement support for unix domain sockets (important especially
for testing since we don't want to depend on global resources such
as tcp ports).

Refactor the sysproxy code so that rumpuser contains only the server side.

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Support aarch64eb in */config.guess.

Cherry-picked from upstream:
https://git.savannah.gnu.org/gitweb/?p=config.git;a=commit;h=1c4398015583eb77bc043234f5734be055e64bea

Everything except external/apache2/llvm/dist/llvm/cmake/config.guess
is patched, which is under vendor tag and cannot be modified. I expect
that this file is not actually used as we use hand-crafted version of
configure script instead of cmake for building LLVM.

Note that external/apache2/llvm/autoconf/autoconf/config.guess has
already been committed on Oct. 20, but commit message disappeared as
cvs aborted due to "permission denied" when trying to modify the file
mentioned above. Sorry for confusing you.

Also note that GMP uses its own config.guess Patch for
external/lgpl3/gmp/dist/config.guess is provided by ryo@. Thanks!

Update supporting files for components which rely on autoconf to allow systems
introducing since release of software to be recognised. This should hopefully
allow the builds to progress a littles further on systems such as the POWER8
which features a little endian 64-bit PowerPC CPU identified as ppc64le.

branches: 1.1.2; 1.1.4;
Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Update supporting files for components which rely on autoconf to allow systems
introducing since release of software to be recognised. This should hopefully
allow the builds to progress a littles further on systems such as the POWER8
which features a little endian 64-bit PowerPC CPU identified as ppc64le.

branches: 1.2.2; 1.2.4;
be happy with netbsd*-* to recognize arm--netbsdelf-eabi

from pkg/48126, simplified

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

fix various typos in comments and messages.

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Revert previous. it shouldn't have an effect.
$$ should make it sufficiently unique.

use mktemp instead of $RANDOM for tmpdir

..$RANDOM won't work with our /bin/sh.

unsure if this script is used, but it is wrong.
might help the spurious build failures that occasionally
show up on autobuilds.

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)

Use autoconf for rump kernel posix hypercall layer.

This gets rid of homegrown hacks and puts all probes in one place.

Tested for NetBSD (build.sh + anita) and Linux (buildrump.sh)