summaryrefslogtreecommitdiff
path: root/share
AgeCommit message (Collapse)Author
2023-07-09versioningsyscalls(9): markup fixesuwe
While here, fix the pasto for the new ino_t and time_t size.
2023-07-08Document how system call versioning is done. From this summer's compat-linuxchristos
GSoC, by Theodore Preduta.
2023-07-08curcpu_stable(9): New function for asserting curcpu() is stable.riastradh
2023-07-07heartbeat(9): markup fixesuwe
Use .Cd for options. Don't use the usual <space><tab>, which is superfluous in the man page. Paragraph break after the config section of synopsis, before the C API section.
2023-07-07heartbeat(9): Fix grammaro in man page.riastradh
2023-07-07Replace main(9) reference with code locationwiz
2023-07-07Sort SEE ALSOwiz
2023-07-07heartbeat(9): New mechanism to check progress of kernel.riastradh
This uses hard interrupts to check progress of low-priority soft interrupts, and one CPU to check progress of another CPU. If no progress has been made after a configurable number of seconds (kern.heartbeat.max_period, default 15), then the system panics -- preferably on the CPU that is stuck so we get a stack trace in dmesg of where it was stuck, but if the stuckness was detected by another CPU and the stuck CPU doesn't acknowledge the request to panic within one second, the detecting CPU panics instead. This doesn't supplant hardware watchdog timers. It is possible for hard interrupts to be stuck on all CPUs for some reason too; in that case heartbeat(9) has no opportunity to complete. Downside: heartbeat(9) relies on hardclock to run at a reasonably consistent rate, which might cause trouble for the glorious tickless future. However, it could be adapted to take a parameter for an approximate number of units that have elapsed since the last call on the current CPU, rather than treating that as a constant 1. XXX kernel revbump -- changes struct cpu_info layout
2023-07-06+CAC - cryptographic access controljschauma
2023-07-05mk.conf(5): document rump variableslukem
Update mk.conf(5) with the rump variables from - lib/librumpuser/README.compileopts - sys/rump/README.compileopts Add cross-references back to mk.conf(5) in those files. Ensure that the Default: is listed last in a description, for consistency with the convention in this file.
2023-06-30rc.conf(5): Set entropy=wait by default.riastradh
We no longer block indefinitely -- if nothing else, the hardclock timer should yield enough samples to unblock /dev/random on all but the most severely deterministic machines -- so it should be generally safe for availability to set entropy=wait. This doesn't guarantee that HWRNG/seed has been provided before you run ssh-keygen or call getentropy(3) in a user application, but it does raise the security above netbsd<=9. PR security/55659 PR lib/56905 XXX pullup-10
2023-06-30entropy(9): Reintroduce netbsd<=9 time-delta estimator for unblocking.riastradh
The system will (in a subsequent change) by default block for this condition before almost all of userland is running (including /etc/rc.d/sshd key generation). That way, a never-blocking getentropy(3) API will never return any data without at least best-effort entropy like netbsd<=9 did to applications except in single-user mode (where you have to be careful about everything anyway) or in the few processes that run before a seed can even be loaded (where blocking indefinitely, e.g. when generating a stack protector cookie in libc, could pose a severe availability problem that can't be configured away, but where the security impact is low). However, (in another subsequent change) we will continue to use _only_ HWRNG driver estimates and seed estimates, and _not_ time-delta estimator, for _warning_ about security in motd, daily security report, etc. And if HWRNG/seed provides enough entropy before time-delta estimator does, that will unblock /dev/random too. The result is: - Machines with HWRNG or seed won't warn about entropy and will essentially never block -- even on first boot without a seed, it will take only as long as the fastest HWRNG to unblock. - Machines with neither HWRNG nor seed: . will warn about entropy, giving feedback about security; and . will avoid returning anything more predictable than netbsd<=9; but . won't block (much) longer than netbsd<=9 would (and won't block again after blocking once, except with kern.entropy.depletion=1 for testing). (The threshold for unblocking is now somewhat higher than before: 512 samples that pass the time-delta estimator, rather than 80 as it used to be.) And, of course, adding a seed (or HWRNG) will prevent both warnings and blocking. The mechanism is: 1. /dev/random will block until _either_ (a) enough bits of entropy (256) from reliable sources have been added to the pool, _or_ (b) enough samples have been added from any sources (512), passing the old time-delta entropy estimator, that the possible security benefit doesn't justify holding up availability any longer (`best effort'), except on systems with higher security requirements like securelevel=2 which can disable non-HWRNG, non-seed sources with rndctl_flags in rc.conf(5). 2. dmesg will report `entropy: ready' when 1(a) is satisfied, but if 1(b) is satisfied first, it will report `entropy: best effort', so the concise log messages will reflect the timing and whether in any period of time any of the system might be relying on best effort entropy. 3. The sysctl knob kern.entropy.needed (and the ioctl RNDGETPOOLSTAT variable rndpoolstat_t::added) still reflects the number of bits of entropy from reliable sources, so we can still use this to suggest regenerating ssh keys. This matters on platforms that can only be reached, after flashing an installation image, by sshing in over a (private) network, like small network appliances or remote virtual machines without (interactive) serial consoles. If we blocked indefinitely at boot when generating ssh keys, such platforms would be unusable. This way, platforms are usable, but operators can still be advised at login time to regenerate keys as soon as they can actually load entropy onto the system, e.g. with rndctl(8) on a seed file copied from a local machine over the (private) network. 4. On machines without HWRNG, using a seed file still suppresses warnings for users who need more confident security. But it is no longer necessary for availability. This is a compromise between availability and security: - The security mechanism of blocking indefinitely on machines without HWRNG hurts availability too much, as painful experience over the multiple years since I made the mistake of introducing it have shown. (Sorry!) - The other main alternative, not having a blocking path at all (as I pushed for, and as OpenBSD has done for a long time) could potentially reduce security vs netbsd<=9, and would run against the expectations set by many popular operating systems to the severe detriment of public perception of NetBSD security. Even though we can't _confidently_ assess enough entropy from, e.g., sampling interrupt timings, this is the traditional behaviour that most operating systems provide -- and the result here is a net nondecrease in security over netbsd<=9, because all paths from the entropy pool to userland now have at least as high a standard before returning data as they did in netbsd<=9. PR kern/55641 PR pkg/55847 PR kern/57185 https://mail-index.netbsd.org/current-users/2020/09/02/msg039470.html https://mail-index.netbsd.org/current-users/2020/11/21/msg039931.html https://mail-index.netbsd.org/current-users/2020/12/05/msg040019.html XXX pullup-10
2023-06-30Add npflog.4 to setsgutteridge
2023-06-29npflog.4: add and adjust some detailsgutteridge
Add details about the header structure (though the if_npflog.h file is not presently installed and has a _KERNEL guard). Also adjust some sentences (requested by riastradh@), and include the original OpenBSD RCS ID, since much of this content shares that origin.
2023-06-20npflog.4: add a man page for the npflog devicegutteridge
Addresses PR misc/57441 from Taylor R Campbell. (Not yet hooked into source sets, will be done separately.) (Borrows heavily from the equivalent pflog.4 man page already in tree, and so retains the original copyright attribution as well.)
2023-06-18sysctl(7): Note nodev,nosuid requirement for user-mounted fs.riastradh
While here, tidy up language and markup a smidge.
2023-06-15+CNA (CVE Numbering Authority)jschauma
2023-06-15VOP_IOCTL() is a wrapper around spec_ioctl() aka Xdev_ioctl() andhannken
protected with spec_io_enter()/spec_io_exit() so there is no need to force specific vnode locking. Set locking requirement to '= = =' (unchanged, locked or unlocked). PR kern/57450 (unplugging hung USB disk triggers panic via _vstate_assert)
2023-06-14Fix previous. Patch mistakenly applied somehow...rin
2023-06-14Cite src/sys/rump/README.compileopts as a reference for MKRUMP.rin
2023-06-12Add DPDK.alnsn
2023-06-11mk.conf(5): more variables from BUILDING and build.shlukem
Add more variables from build.sh, BUILDING, and various Makefile's documentation: CDEXTRA CONFIGOPTS KERNARCHDIR KERNCONFDIR KERNOBJDIR KERNSRCDIR LOCALTIME Default sentences now consistently end with ".". Consistency tweaks in "otherwise". Editorial tweaks.
2023-06-11+DPAAdholland
2023-06-11mk.conf(5): add remaining vars from BUILDINGlukem
Add more variables from BUILDING: INSTALLBOOT_BOARDS INSTALLWORLDDIR NOCLEANDIR NODISTRIBDIRS NOINCLUDES. Add build.sh related notes (from BUILDING). Clarify "target" as "target architecture" where appropriate (versus a make target where that's obvious from context.) Move all obsolete and deprecated variables to new "OBSOLETE VARIABLES" section at the end. Add some per-variable editorial improvements from BUILDING. Change sub headings to headings; it's easier to read. (I don't know why mdoc doesn't allow blank lines around .Ss)
2023-06-10sets: enhance MAKEVERBOSE supportlukem
Add more messages for various sets operations. Add ${_MKMSG_CREATE} to bsd.own.mk. Enhance maketars to be a bit more verbose even with -q, to make it more obvious why certain operations may be slow. May help debugging PR 47562.
2023-06-05bsd.README: update to reality, sync from mk.conf(5)lukem
Sync user variables from mk.conf(5), sorted. (Arguably this could just refer to mk.conf(5) or share/man/man5/mk.conf.5 and remove the copypasta.) Document NOxxx overrides in own subsection. Unexpand tabs, tweak after.
2023-06-05mk.conf(5): editoriallukem
MKDTB and MKPIE are .YorN. MKX11=yes wants MKINET6=yes. MKLINKLIB deserves a dash list (like bsd.README). Expand per bsd.README: MKSTATICPIC, MKUNPRIVED, MKX11, MKZFS, USE_LIBCSANITIZER, USE_SSP Change the width of the variable lists to 14n (from 15n) so that when the lists are rendered and then left aligned, the column is 16 characters (aka 2 tabs) which makes copypasta to bsd.README easier.
2023-06-04mk.conf(5): add more from BUILDING and bsd.READMElukem
Add from BUILDING or bsd.README: BUILDINFO, BUILDSEED, EXTERNAL_TOOLCHAIN, MKCROSSGDB, MKREPRO_TIMESTAMP, TOOLCHAIN_MISSING, X11SRCDIR Clarify BUILDID. Improve MKDEBUG, MKOBJ, MKX11, NETBSDSRCDIR, USETOOLS, Consistent Note: formatting.
2023-06-03adapt to ${CC_WNO_ADDRESS_OF_PACKED_MEMBER}lukem
Simplify CWARNFLAGS to use ${CC_WNO_ADDRESS_OF_PACKED_MEMBER} which works for both clang and gcc, and remove compiler-specific equivalents.
2023-06-03bsd.*.mk: move MKSTRIPSYM default to bsd.own.mklukem
Add default for MKSTRIPSYM=yes to to bsd.own.mk _MKVARS.no. Test ${MKSTRIPSYM} != "no".
2023-06-03bsd.obj.mk: move MKHOSTOBJ to bsd.own.mklukem
Add default for MKHOSTOBJ=no to to bsd.own.mk _MKVARS.no. Simplify bsd.obj.mk check.
2023-06-03bsd.dep.mk: move MKDEPINCLUDES to bsd.own.mklukem
Add default for MKDEPINCLUDES=no to to bsd.own.mk _MKVARS.no. Simplify bsd.dep.mk check.
2023-06-03bsd.*.mk: move MKCLEAN* to bsd.own.mklukem
Move the defaults for MKCLEANSRC and MKCLEANVERIFY from bsd.clean.mk to bsd.own.mk _MKVARS.yes.
2023-06-03mk.conf: fix the yearlukem
2023-06-03bsd.own.mk: rename GCC_NO_* to CC_WNO_*lukem
Rename compiler-warning-disable variables from GCC_NO_warning to CC_WNO_warning where warning is the full warning name as used by the compiler. GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH Using the convention CC_compilerflag, where compilerflag is based on the full compiler flag name.
2023-06-03bsd.own.mk: rename to CC_WNO_ADDRESS_OF_PACKED_MEMBERlukem
Provide a single variable CC_WNO_ADDRESS_OF_PACKED_MEMBER with options for both clang and gcc, to replace CLANG_NO_ADDR_OF_PACKED_MEMBER CC_NO_ADDR_OF_PACKED_MEMBER GCC_NO_ADDR_OF_PACKED_MEMBER Using the convention CC_compilerflag, where compilerflag is based on the full compiler flag name.
2023-06-02bsd.own.mk: obsolete non-MK variants MANZ UNPRIVED UPDATElukem
Remove support for variables deprecated 20 years ago by their MK* equivalents.
2023-06-02follow the steps of Andrew Doran (ad) commit and fix more s/loose/lose/ typos.andvar
also s/beyound/beyond/ and few others along the way, mainly in comments.
2023-06-01mk.conf(5): update to realitylukem
- Document: MKAMDGPUFIRMWARE, MKARGON2, MKARZERO, MKBSDGREP, MKCOMPATMODULES, MKCOMPATTESTS, MKCOMPATX11, MKCXX, MKDEPINCLUDES, MKDTB, MKDTC, MKFIRMWARE, MKGROFF, MKGROFFHTMLDOC, MKLIBCSANITIZER, MKLIBCXX, MKLIBSTDCXX, MKLLVM, MKLLVMRT, MKMAKEMANDB, MKMANDOC, MKNSD, MKRADEONFIRMWARE, MKRELRO, MKSANITIZER, MKSLJIT, MKSTATICPIE, MKTEGRAFIRMWARE, MKTPM, MKUNBOUND, MKXORG_SERVER, NETBSD_OFFICIAL_RELEASE, USE_LIBCSANITIZER, USE_PIGZGZIP, USE_SANITIZER, USE_XZ_SETS, X11MOTIFPATH - Document obsolete/deprecated: EXTSRCSRCDIR, MKBFD, MKCRYPTO, MKEXTSRC, MKKDEBUG, MKKERBEROS4, MKLLD, MKLLDB, MKMCLINKER, MKPERFUSE, MKTOOLSDEBUG, SHAREDSTRINGS, USE_COMBINE - Fix defaults: MKLINT=no MKPICINSTALL=no USE_SKEY=no - Expand upon defaults that are platform specific. - Sort variable entries. - If a NOxxx variable disables a variable, describe it. - Layout of each variable: supported values, description, any other variables that change this variable, optional note, default value. - Consistent double quotes around default strings (even paths). - Consistent "will be" instead of "is" or "are". - Sort order of internal macro definitions. - Add NODEF and NOVAR macros. - Oxford comma and semi-colons where appropriate. - Fix mandoc -Tlint.
2023-06-01bsd.own.mk: describe recent convention in commentslukem
2023-06-01bsd.own.mk: MKPERFUSE isn't used anywherelukem
perfuse is built unconditionally, and MKPERFUSE isn't tested anywhere.
2023-06-01bsd.own.mk: MKLLD, MKLLDB, MKMCLINKER are obsoletelukem
MKLLD, MKLLDB, MKMCLINKER aren't used in the build, so remove them. These were obsoleted by joerg@ on 2019-11-11 with the update of LLVM to 10.0.0git (01f3a59).
2023-05-31bsd.own.mk: support ${MACHINE} defaults in MK* = yeslukem
For MK* variables (in _MKVARS.yes), default to MK*.${MACHINE} if MK*.${MACHINE_ARCH} isn't defined. Equivalent to _MKVARS.no change by mrg@ in rev 1.1065 on 2018-06-16.
2023-05-31bsd.own.mk: sort lists. whitespace fixeslukem
Create _NOVARS for the list of NO* variables, for consistency with _MKVARS.yes and _MKVARS.no Format _NOVARS, _MKVARS.yes, and _MKVARS.no with one entry per line, and sort the lists. Simplifies review and adding new entries. Per suggestion from riastradh@ Line up some variable assignments more consistently.
2023-05-29sysctl.7: be a little more descriptive about kern.osrevisiongutteridge
It's expressed as an integer, and is also returned as an integer type should one retrieve it via sysctl(3) (as this man page already correctly documents in the table above its description).
2023-05-29bsd.own.mk: rename NO_ADDR_OF_PACKED_MEMBER to CC_NO_ADDR_OF_PACKED_MEMBERlukem
Add "CC_" prefix to NO_ADDR_OF_PACKED_MEMBER. We now have the following convention: GCC_NO_*: Disable specific warnings from GCC. CLANG_NO_*: Disable specific warnings from Clang. CC_NO_*: Disable specific warnings from both Clang and GCC. This reserves "NO_*" Makefile variables to disable other features. Some space->tab fixes.
2023-05-29bsd.own.mk: sort list of NO* variableslukem
List the NO variables in order, leaving enough room to add more entries, not splitting the next letter after "NO" across a line. No functional change; just prettier and easier to review.
2023-05-28bsd.own.mk: deprecate NOCRYPTOlukem
MKCRYPTO was removed by riastradh@ on 2017-05-22, so the NOCRYPTO override is now unnecessary.
2023-05-28share/mk: finish USE_COMBINE, NOCOMBINE deprecationlukem
Remove the leftover remnants of deprecated USE_COMBINE and NOCOMBINE, as gcc -combine has been EOL for many years. Completes the work done by maya@ on 2019-05-10 in bsd.kmodule.mk rev 1.61.
2023-05-26+CRDT conflict-free replicated data typejschauma
+UDS Unix Domain Socket