Update on pinsyscalls(2) progress from Theo de Raadt

In a message to the tech@ mailing list, Theo de Raadt (deraadt@) gave a summary of progress so far, along with a patch for testing what will likely be the next steps in the process.

The message leads in,

List:       openbsd-tech
Subject:    update on pinsyscalls(2)
From:       "Theo de Raadt" <deraadt () openbsd ! org>
Date:       2023-12-30 18:56:35

The pinsyscalls(2) diff is now much smaller, since many pieces it depends
upon have been commmited.

All the DSO containing system call entries have the proper annotations for
kernel and ld.so to do the right thing.

This diff can be applied to a -current system, if people want to play
along:

	cd /usr/src
	make includes   ;; to update sys/proc.h mostly
	build new kernel
	build new libexec/ld.so
	build new bin/ps

ps:
	- for static binaries, ps will show 'l' to indicate the
	  binary's text segment is doing syscall pinning.
	- for dynamic binaries, ps will show 'l' to indicate that
	  ld.so's text segement is doing syscall pinning, and 'L'
	  to indicate libc.so's text segment is doing syscal pinning


There's a long tail with this diff.  Perhaps in a release or two when
all binaries are known to follow the pinsyscalls(2) rules, we'll be able
to turn msyscall() and the less powerful pinsyscall(2) into NOPs, and
eventually remove them.

The more precise pinsyscalls(2) check in syscall_mi.h is O(1) but
slightly more expensive than the msyscall(2) check which also is O(1) in
the general case but has a special case when text msyscall-allowed
segments get crossed (such as when doing ld.so GOT/PLT resolution, or
signal handlers), then uvm locks occur twice.  But we don't need both.

followed by the patch against -current for those who want to help out by testing the code. If you want to test, you can download the full message here, among other places.