src/sys/compat/cloudabi, branch releng/12.2

MFC r357512:

2020-02-11T12:14:22Z

Add sys/systm.h to several places that use vm headers.

MFC r343111,343113-343115 (by mckusick):

2020-01-30T16:11:19Z

Create new EINTEGRITY error with message "Integrity check failed". An integrity check such as a check-hash or a cross-correlation failed. The integrity error falls between EINVAL that identifies errors in parameters to a system call and EIO that identifies errors with the underlying storage media. EINTEGRITY is typically raised by intermediate kernel layers such as a filesystem or an in-kernel GEOM subsystem when they detect inconsistencies. Uses include allowing the mount(8) command to return a different exit value to automate the running of fsck(8) during a system boot. These changes make no use of the new error, they just add it. Later commits will be made for the use of the new error number and it will be added to additional manual pages as appropriate. Approved by: mckusick

MFC r350464: kern_shm_open: push O_CLOEXEC into caller control

2019-08-16T21:01:35Z

The motivation for this change is to allow wrappers around shm to be written that don't set CLOEXEC. kern_shm_open currently accepts O_CLOEXEC but sets it unconditionally. kern_shm_open is used by the shm_open(2) syscall, which is mandated by POSIX to set CLOEXEC, and CloudABI's sys_fd_create1(). Presumably O_CLOEXEC is intended in the latter caller, but it's unclear from the context. sys_shm_open() now unconditionally sets O_CLOEXEC to meet POSIX requirements, and a comment has been dropped in to kern_fd_open() to explain the situation and add a pointer to where O_CLOEXEC setting is maintained for shm_open(2) correctness. CloudABI's sys_fd_create1() also unconditionally sets O_CLOEXEC to match previous behavior. This also has the side-effect of making flags correctly reflect the O_CLOEXEC status on this fd for the rest of kern_shm_open(), but a glance-over leads me to believe that it didn't really matter.

Improve handling of control message truncation.

2018-08-07T16:36:48Z

If a recvmsg(2) or recvmmsg(2) caller doesn't provide sufficient space for all control messages, the kernel sets MSG_CTRUNC in the message flags to indicate truncation of the control messages. In the case of SCM_RIGHTS messages, however, we were failing to dispose of the rights that had already been externalized into the recipient's file descriptor table. Add a new function and mbuf type to handle this cleanup task, and use it any time we fail to copy control messages out to the recipient. To simplify cleanup, control message truncation is now only performed at control message boundaries. The change also fixes a few related bugs: - Rights could be leaked to the recipient process if an error occurred while copying out a message's contents. - We failed to set MSG_CTRUNC if the truncation occurred on a control message boundary, e.g., if the caller received two control messages and provided only the exact amount of buffer space needed for the first. PR: 131876 Reviewed by: ed (previous version) MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D16561

Eliminate the overhead of gratuitous repeated reinitialization of cap_rights

2018-05-09T18:47:24Z

- Add macros to allow preinitialization of cap_rights_t. - Convert most commonly used code paths to use preinitialized cap_rights_t. A 3.6% speedup in fstat was measured with this change. Reported by: mjg Reviewed by: oshogbo Approved by: sbruno MFC after: 1 month

sys/cloudabi: Avoid relying on GNU specific extensions

2018-03-07T14:47:43Z

An empty initializer list is not technically valid C grammar. MFC After: 1 week

sys/linux: Fix a few potential infoleaks in cloudabi

2018-03-03T21:50:55Z

Submitted by: Domagoj Stolfa MFC After: 1 month Sponsored by: DARPA/AFRL

Allow timed waits with relative timeouts on locks and condvars.

2018-01-04T21:57:37Z

Even though pthreads doesn't support this, there are various alternative APIs that use this. For example, uv_cond_timedwait() accepts a relative timeout. So does Rust's std::sync::Condvar::wait_timeout(). Though I personally think that relative timeouts are bad (due to imprecision for repeated operations), it does seem that people want this. Extend the existing futex functions to keep track of whether an absolute timeout is used in a boolean flag. MFC after: 1 month

Import the latest CloudABI definitions, version 0.16.

2017-10-18T19:22:53Z

The most important change in this release is the removal of the poll_fd() system call; CloudABI's equivalent of kevent(). Though I think that kqueue is a lot saner than many of its alternatives, our experience is that emulating this system call on other systems accurately isn't easy. It has become a complex API, even though I'm not convinced this complexity is needed. This is why we've decided to take a different approach, by looking one layer up. We're currently adding an event loop to CloudABI's C library that is API compatible with libuv (except when incompatible with Capsicum). Initially, this event loop will be built on top of plain inefficient poll() calls. Only after this is finished, we'll work our way backwards and design a new set of system calls to optimize it. Interesting challenges will include integrating asynchronous I/O into such a system call API. libuv currently doesn't aio(4) on Linux/BSD, due to it being unreliable and having undesired semantics. Obtained from: https://github.com/NuxiNL/cloudabi

Merge pipes and socket pairs.

2017-09-05T07:46:45Z

Now that CloudABI's sockets API has been changed to be addressless and only connected socket instances are used (e.g., socket pairs), they have become fairly similar to pipes. The only differences on CloudABI is that socket pairs additionally support shutdown(), send() and recv(). To simplify the ABI, we've therefore decided to remove pipes as a separate file descriptor type and just let pipe() return a socket pair of type SOCK_STREAM. S_ISFIFO() and S_ISSOCK() are now defined identically.