Move p_sleeplocks and p_limit into the "zero on create" section of struct
proc, so they don't need to be explicitly initialized in thread_new()

suggested by anton@
ok kettenis@

Move kcov(4)'s p_kd into the "zero on create" section to simplify fork code

ok anton@

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed severa

struct proc: change ps_start from utc time to uptime

Allows us to determine how long a process has been running, even if the
UTC clock jumps.

With help from bluhm@ and millert@, who squashed several bugs.

ok bluhm@ millert@

show more ...

Move `p_estcpu' to the region copied during fork & kill scheduler_fork_hook().

While here reorder some fields in 'struct proc' to avoid size grow.

ok bluhm@, visa@

Reduce the number of places where `p_priority' and `p_stat' are set.

This refactoring will help future scheduler locking, in particular to
shrink the SCHED_LOCK().

No intended behavior change.

ok

Reduce the number of places where `p_priority' and `p_stat' are set.

This refactoring will help future scheduler locking, in particular to
shrink the SCHED_LOCK().

No intended behavior change.

ok visa@

show more ...

Make resource limit access MP-safe. So far, the copy-on-write sharing
of resource limit structs has been done between processes. By applying
copy-on-write also between threads, threads can read rlimi

Make resource limit access MP-safe. So far, the copy-on-write sharing
of resource limit structs has been done between processes. By applying
copy-on-write also between threads, threads can read rlimits in
a nearly lock-free manner.

Inspired by code in DragonFly BSD and FreeBSD.

OK mpi@, agreement from jmatthew@ and anton@

show more ...

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread shoul

Revert to using the SCHED_LOCK() to protect time accounting.

It currently creates a lock ordering problem because SCHED_LOCK() is taken
by hardclock(). That means the "priorities" of a thread should be moved
out of the SCHED_LOCK() first in order to make progress.

Reported-by: syzbot+8e4863b3dde88eb706dc@syzkaller.appspotmail.com
via anton@ as well as by kettenis@

show more ...

Use a per-process mutex to protect time accounting instead of SCHED_LOCK().

Note that hardclock(9) still increments p_{u,s,i}ticks without holding a
lock.

ok visa@, cheloha@

Rename struct plimit field p_refcnt to pl_refcnt to avoid confusion
with the fields of struct proc. Make pl_refcnt unsigned for upcoming
atomic updating.

OK deraadt@ guenther@

Fix unsafe use of ptsignal() in mi_switch().

ptsignal() has to be called with the kernel lock held. As ensuring the
locking in mi_switch() is not easy, and deferring the signaling using
the task API

Fix unsafe use of ptsignal() in mi_switch().

ptsignal() has to be called with the kernel lock held. As ensuring the
locking in mi_switch() is not easy, and deferring the signaling using
the task API is not possible because of lock order issues in
mi_switch(), move the CPU time checking into a periodic timer where
the kernel can be locked without issues.

With this change, each process has a dedicated resource check timer.
The timer gets activated only when a CPU time limit is set. Because the
checking is not done as frequently as before, some precision is lost.

Use of timers adapted from FreeBSD.

OK tedu@

Reported-by: syzbot+2f5d62256e3280634623@syzkaller.appspotmail.com

show more ...

Add a mechanism for managing asynchronous IO signal registrations.
It centralizes IO signal privilege checking and makes possible to revoke
a registration when the target process or process group is

Add a mechanism for managing asynchronous IO signal registrations.
It centralizes IO signal privilege checking and makes possible to revoke
a registration when the target process or process group is deleted.

Adapted from FreeBSD.

OK kettenis@ mpi@ guenther@

show more ...

Split the system-wide list of all futexes into process-specific lists
of private futexes and a shared list of shared futexes. This speeds up
futex lookups.

Tested by and OK krw@
OK mpi@

Change kcov semantics, kernel code coverage tracing is now enabled on a per
thread basis instead of process. The decision to enable on process made
development easier initially but could lead to non-

Change kcov semantics, kernel code coverage tracing is now enabled on a per
thread basis instead of process. The decision to enable on process made
development easier initially but could lead to non-deterministic results for
processes with more than one thread. This behavior matches the implementation
found on both Linux and FreeBSD.

With help and ok mpi@ visa@

show more ...

Correctly copy across unveil's from parent to child process on fork().

Unveiling unveil(2).
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start usin

Unveiling unveil(2).
This brings unveil into the tree, disabled by default - Currently
this will return EPERM on all attempts to use it until we are
fully certain it is ready for people to start using, but this
now allows for others to do more tweaking and experimentation.

Still needs to send the unveil's across forks and execs before
fully enabling.

Many thanks to robert@ and deraadt@ for extensive testing.
ok deraadt@

show more ...

Move kqueue related fields from struct filedesc to struct kqueue. Solves a panic
in knote_processexit() that can occur when the filedesc belonging to the process
already has been freed.

Similiar wor

Move kqueue related fields from struct filedesc to struct kqueue. Solves a panic
in knote_processexit() that can occur when the filedesc belonging to the process
already has been freed.

Similiar work has been done in:
- FreeBSD (commit bc1805c6e871c178d0b6516c3baa774ffd77224a)
- DragonFlyBSD (commit ccafe911a3aa55fd5262850ecfc5765cd31a56a2)

Thanks to tb@ for testing.

ok kettenis@ mpi@ visa@

show more ...

Delete unnecessary <sys/file.h> includes

ok millert@ krw@

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of

pledge()'s 2nd argument becomes char *execpromises, which becomes the
pledge for a new execve image immediately upon start. Also introduces
"error" which makes violations return -1 ENOSYS instead of killing the
program ("error" may not be handed to a setuid/setgid program, which
may be missing/ignoring syscall return values and would continue with
inconsistant state)
Discussion with many
florian has used this to improve the strictness of a daemon

show more ...

guenther sleep-commited the version without #ifdefs

amd64 needs FS.base values (the TCB pointer) to be validated, as noncanonical
addresses will cause a fault on load by the kernel.

Problem observed by Maxime Villard
ok kettenis@ deraadt@

Remove old deactivated pledge path code. A replacement mechanism is
being brewed.
ok beck

Add a port of witness(4) lock validation tool from FreeBSD.

Go-ahead from kettenis@, guenther@, deraadt@

Provide mips64 with kernel-facing TCB_{GET,SET} macros that store it
in struct mdproc. With that, all archs have those and the __HAVE_MD_TCB
macro can be unifdef'ed as always defined.

ok kettenis@

Provide mips64 with kernel-facing TCB_{GET,SET} macros that store it
in struct mdproc. With that, all archs have those and the __HAVE_MD_TCB
macro can be unifdef'ed as always defined.

ok kettenis@ visa@ jsing@

show more ...

Split up fork1():
- FORK_THREAD handling is a totally separate function, thread_fork(),
that is only used by sys___tfork() and which loses the flags, func,
arg, and newprocp parameters and gai

Split up fork1():
- FORK_THREAD handling is a totally separate function, thread_fork(),
that is only used by sys___tfork() and which loses the flags, func,
arg, and newprocp parameters and gains tcb parameter to guarantee
the new thread's TCB is set before the creating thread returns
- fork1() loses its stack and tidptr parameters
Common bits factor out:
- struct proc allocation and initialization moves to thread_new()
- maxthread handling moves to fork_check_maxthread()
- setting the new thread running moves to fork_thread_start()
The MD cpu_fork() function swaps its unused stacksize parameter for
a tcb parameter.

luna88k testing by aoyama@, alpha testing by dlg@
ok mpi@

show more ...

Delete the obsolete fork/exec/exit emulation hooks.

ok mpi@ dlg@