nextboot: Permit ZFS boot filesystems mounted at the pool's root

This restores nextboot -k on ZFS setups where /boot is on the root
dataset of a pool.

Reviewed by: jrtc27, glebius
Fixes: 0c3ade2cf13d nextboot: fix nextboot -k on ZFS
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D45306

nextboot: Write nextboot.conf safely

As in the old nextboot.sh script:
- First write everything to a tempfile instead of /boot/nextboot.conf.
- fsync() the tempfile before renaming it to nextboot.conf.

Fixes: fd6d47375a78 ("rescue,nextboot: Install nextboot as a link to reboot, rm nextboot.sh")
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D44572

nextboot: check unlink, but only warn on !ENOENT

Emulate rm -f from the nextboot.sh script: Report all errors, except
ENOENT. This problems show through, except the expected one when
nextboot.conf isn't there.

Sponsored by: Netflix
Reviewed by: rew
Differential Revision: https://reviews.freebsd.org/D44013

reboot: Emulate nextboot -D better

It used to produce no output when the file couldn't be removed. Emulate
that better by unlinking and ignoring errors. It's used at the end of
reboot always, even when the file isn't going to be there.

Sponsored by: Netflix
Fixes: 2c479548119a

nextboot: fix nextboot -k on ZFS

zfsbootcfg(1) expects pool name to operate on, not currently mounted
filesystem name.

Fixes: fd6d47375a78fbf0737012b7cc11180291781e8b

nextboot: fix typo that merged two args into one

Fixes: fd6d47375a78fbf0737012b7cc11180291781e8b

reboot: Move extern for environ

envorin isn't defined in any header, and gcc is cranky with this inside
a function, so move it to global scope. Both clang and gcc are now happy
with this.

Sponsored by: Netflix

reboot: Remove sys/types.h: it's not needed here...

reboot: Use posix_spawn instead of system

Use posix_spawn to avoid having to allocate memory needed for the system
command line.

Sponsored by: Netflix
Reviewed by: jrtc27
Differential Revision: https://reviews.freebsd.org/D43860

reboot: initialize howto

Make static analyzers happy by initialzing howto to 0. Coverity is
cranky that it could be used unused. But it's analysis is incomplete
because the args to getopt when it wasn't initialized preclude it from
being used.

reboot: Allow this to be installed as nextboot

Allow nextboot to be a symlink link to reboot. It does everything reboot
does, except doesn't actually setup the sytem to reboot and reboot. Also,
don't accept the reboot args related to rebooting when in nextboot mode.

Sponsored by: Netflix
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D43830

reboot: Implement -o to set kernel options for next boot

Sponsored by: Netflix
Reviewed by: kevans
Differential Revision: https://reviews.freebsd.org/D43829

reboot: Implement -k in terms of env

kernel isn't special, beyond the sanity checks we do. Add it to the env
rather than pass it into write_nextboot().

Sponsored by: Netflix
Reviewed by: kevans, kib
Differential Revision: https://reviews.freebsd.org/D43828

reboot: Implement -e from nextboot

Implement -e foo=bar to add loader environment variables to
nextboot.conf. bar is enclosed in quotes if it isn't already.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D43827

reboot: Implement zfs support

Implement full support for ZFS -k support. For ZFS, we have to set a
property that gets cleared by the boot loaeder for whether or not to
process nextboot.conf. Do this using system("zfsbootcfg..." rather than
coding the small subset of that program inline to avoid CDDL
contamination of reboot and the complications of disabling CDDL and/or
ZFS. The few bytes needed to implement reboot for systems with zfs is
not worth saving for systems w/o ZFS.

Only set nextboot_enable=YES for UFS filesystems. They are the only one
that need that as the first line. Its presence on ZFS can cause the
kernel to not be oneshot.

Sponsored by: Netflix
Reviewed by: kevans, kib
Differential Revision: https://reviews.freebsd.org/D43824

reboot: Implement -D from nextboot

Implement -D from nextboot.sh which deletes the nextboot.conf file and
exists.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D43822

reboot: Add sanity checking of write to nextboot.conf

Add sanity checking to the write to nextboot. Move to separate function
and allow force to override all errors. If we can't write nextboot.conf,
don't silently fail anymore.

Sponsored by: Netflix
Reviewed by: kevans, kib, markj, jhb
Differential Revision: https://reviews.freebsd.org/D43803

reboot: Don't reboot if the next kernel isn't there

reboot -k garbage won't boot garbage unless /boot/garbage/kernel is
there. Refuse to reboot if it is missing, though allow -f to force
it for special-use cases. This is in keeping with nextboot.sh.

Sponsored by: Netflix
Reviewed by: kevans, kib, markj, emaste
Differential Revision: https://reviews.freebsd.org/D43802

reboot: convert flags to bools

Convert all the command line flags to bools, since that's how we use
them. Sort the includes while adding stdbool.h.

Sponsored by: Netflix
Reviewed by: kevans, kib, emaste
Differential Revision: https://reviews.freebsd.org/D43801

reboot: Disallow -k and -r, it doesn't make sense.

When we're re-rooting to a new /, there is no next kernel. Error out
rather than leaving a timebomb in /boot/nextboot.conf.

Sponsored by: Netflix
Reviewed by: kevans, kib, emaste
Differential Revision: https://reviews.freebsd.org/D43800

Remove copyright strings ifdef'd out

We've ifdef'd out the copyright strings for some time now. Go ahead and
remove the ifdefs. Plus whatever other detritis was left over from other
recent removals. These copyright strings are present in the comments and
are largely from CSRG's attempt at adding their copyright to every
binary file (which modern interpretations of the license doesn't
require).

Sponsored by: Netflix

sbin: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.

Sponsored by: Netflix

reboot(8): print syscall error on sysctl failure

Noted by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D42561

reboot(8): adapt for vmmeter v_swappgsin expansion to 64bit

Otherwise reboot(8) requires COMPAT_FREEBSD11 kernel config option.

PR: 275048
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D42561

Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

Mark usage function as __dead2 in programs where it does not return

In most cases, usage does not return, so mark them as __dead2. For the
cases where they do return, they have not been marked __dead2.

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/735

boottrace: annotate init and shutdown utilities

Add boottrace annotations to record events in init(8), shutdown(8), and
reboot(8).

Sponsored by: NetApp, Inc.
Sponsored by: Klara, Inc.
X-NetApp-PR: #23
Differential Revision: https://reviews.freebsd.org/D31928

Fix "fasthalt" to halt instead of reboot

fasthalt has behaved like reboot, instead of like halt, since r228408
(2011, 10.0-RELEASE). Fix it. One wonders if anyone will notice.

Approved by: re (kib)
MFC after: 3 days
Sponsored by: Dell EMC Isilon

Exit with usage when extra arguments are on command line
preventing mistakes such as "halt 0p" for "halt -p".
Approved by: bde (mentor), phk (mentor)
MFC after: 1 week

General further adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.

Add -c to the usage statements.

Submitted by: Maxim Konovalov

Add power cycle support to reboot/halt as -c.

When -c is specified, the system will be power cycled if the
underlying hardware supports it. Otherwise the system will be halted
or rebooted depending on which command was used.

Sponsored by: Netflix

Renumber copyright clause 4

Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by: Jan Schaumann <jschauma@stevens.edu>
Pull Request: https://github.com/freebsd/freebsd/pull/96

Add missing parameters -N and -l to reroot and halt usage()

Approved by: bapt
Sponsored by: Rubicon Communications (Netgate)
Differential Revision: https://reviews.freebsd.org/D6173

Fix use of uninitialised Nflag

Initialise Nflag to 0 preventing use of uninitialised value.

Reported by: uqs
MFC after: 1 week
X-MFC-With: r292266
Sponsored by: Multiplay
Differential Revision: https://reviews.freebsd.org/D4449

Add flag to disable inital reboot(8) userland sync

Add -N flag to reboot(8) which bypasses the userland sync(2) during
reboot(8) while still allow the kernel sync during the reboot(2) syscall
to occur.

An example use of this is when rebooting with disconnected iSCSI sessions
which would otherwise cause the reboot to hang on BIOs that will never
complete.

Reviewed by: bjk
MFC after: 2 weeks
Sponsored by: Multiplay
Differential Revision: https://reviews.freebsd.org/D4449

Userspace part of reroot support. This makes it possible to change
the root filesystem without full reboot, using "reboot -r". This can
be used to to eg. boot from a temporary md_image preloaded by loader(8),
setup an iSCSI session, and continue booting from rootfs mounted over
iSCSI.

Reviewed by: kib@, bapt@
MFC after: 1 month
Relnotes: yes
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D3693

Let reboot(8) use getprogname() to compare the program name.

While there, mark the global variable dohalt static, as reboot(8) only
consists of a single C file.

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.

Create the altix project branch. The altix project will add support
for the SGI Altix 350 to FreeBSD/ia64. The hardware used for porting
is a two-module system, consisting of a base compute module and a
CPU expansion module. SGI's NUMAFlex architecture can be an excellent
platform to test CPU affinity and NUMA-aware features in FreeBSD.

Port the remaining apps in sbin/ to utmpx; only reboot(8).

Add forgotten `void' keyword. This function has no arguments.

Let init(8) and reboot(8) use utmpx to log wtmp entries.

logwtmp() gets called with the raw strings that are written to disk. For
regular user entries, this isn't too bad, but when booting/shutting
down, the contents get rather cryptic.

Just call the standardized pututxline().

More rational usage()

Remove and unused variable.

Submitted by: Christoph Mallon christoph.mallon@gmx.de
MFC after: 2 weeks

- Import the HEAD csup code which is the basis for the cvsmode work.

Block a variety of signals which may afffect reboot(8), before killing
init(8), to avoid losing a race to them and dying before being able
to call reboot(2).

PR: bin/64664
Submitted by: maxim
Obtained from: NetBSD
MFC after: 30 days

Block SIGHUP before killing init(8), to avoid a race condition which may
kill the current process and hang the system when attempting reboot.

PR: bin/64664
Reviewed by: ssouhal, phk (historic)
MFC after: 30 days

Truncate nextboot.conf file on creation, so existing garbage will be removed.

Submitted by: Gary Allan <dragonfly@gallan.plus.com>
Obtained from: DragonFlyBSD
MFC after: 3 days

Sync program's usage() with manpage's SYNOPSIS.

Code style tweaks: Use static and const where suitable.

The kernel specified in main() of reboot(8) will be initialized
with -k option and never be used without kflag. This confuses
gcc because we set "kflag" at the same time with "kernel", but
the logic is not that apparant for gcc.

Since we can initialize "kernel" to NULL then know if "k" option
is set through determining whether it is still NULL, don't try
to have gcc to guess why we are connecting "kflag" with "kernel"
and use "kernel" directly in place of kflag.

Bump WARNS?= from 2 to 6

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp

Use __FBSDID() to quiet GCC 3.3 warnings.

When kill(-1) returns ESRCH, it could be because the current process
doesn't have a process group, which can occur if you're working with
a custom init that doesn't set up a full tty context. Rather than
refusing to reboot, ignore ESRCH from the kill attempt in reboot(8).

Set only the RB_POWEROFF flag (not the RB_HALT flag) when
'-p' is used on the reboot(8) command line.

This is intended for use when you want to attempt a power down
action, but you want the system to reboot (not halt) if the
power down action fails.

This is typically useful when the power-off action performed by
the kernel consists in signalling an uninterrupted power supply
that it should shut down its inverter if mains power has not returned.

The behaviour of shutdown(8) and init(8) is not modified;
only the behaviour of invoking 'reboot -p' manually is
modified, and then only in the case when a power-down action
fails.

Sounded reasonable to: phk
Approved by: roberto (mentor)

Correct the file that reboot -k creates so that it works with the new
nextboot functionality.

Reviewed by: jake (mentor)

Rename the file used to specify the nextboot to make it clear that this
is a loader configuration file and can be used for more than just a
kernel name.

Submitted by: Gordon Tetlow <gordont@gnf.org>

Add a -k option to reboot to specify the kernel to boot next time
around. If the kernel boots successfully, the record of this kernel
is erased, it is intended to be a one-shot option for testing
kernels.

This could be improved by having the loader remove the record of
the next kernel to boot, it is currently removed in /etc/rc immediately
after disks are mounted r/w.

I'd like to MFC this before the 4.6 freeze unless there is violent
objection.

Reviewed by: Several on IRC
MFC after: 4 days

Constify and set WARNS=2.

Submitted by: Mike Barcroft <mike@q9media.com>

Include missing header files which define functions for which gcc has
builtins (e.g., exit, strcmp).

Remove the "undocumented" comment in re lflag.

Reboot(8) normally waits 5 seconds after sending SIGTERMs to all
processes and then sends SIGKILLs. If a lot of processes are swapped
out, this delay may not be long enough, so processes such as an X
server may be killed before they have had time to clean up properly.

Make this delay more dynamic by waiting up to 60 seconds for swap
page-in activity to end. While I'm here, ANSIfy and remove a
`register' specifier.

Add a "-d" option which causes the system to generate a crash dump.

$Id$ -> $FreeBSD$

Correct use of .Nm. Add rcsid. -Wall. Add -p flag in usage string (was missing).

Remove lines inside #ifdef 0/#endif.

Use err(3) instead of local copy.

compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.

Add support to halt, to allow it to request that the power be turned off
(the RB_POWEROFF flag)

Install aliases "fasthalt" and "fastboot" for halt and boot respectively.
This is for "backwards compatibility". Documented these aliases in the
manual page.

BSD 4.4 Lite sbin Sources

Note: XNSrouted and routed NOT imported here, they shall be imported with
usr.sbin.