portal: bulk process-tree walk (OSI_PROC_ALL) + syscall_event pid denormalization

[lacraig2]

What

Two additions to the portal OSI/syscall interface, in support of penguin epic B slice 1 (a queryable guest process-tree model — see rehosting/penguin).

1. HYPER_OP_OSI_PROC_ALL — kernel-side bulk process walk

Walks for_each_process under rcu_read_lock and returns a slim osi_proc_node per user process in one paginated transaction:

struct osi_proc_node {
    uint64_t pid, ppid, create_time;   // create_time = task->start_time (identity)
    uint32_t uid, gid, euid, egid;
    char comm[16];                     // inline task->comm, NUL-padded
};                                     // 56 bytes -> ~72 per 4 KB page

Why: to build a process tree the host was issuing one HYPER_OP_OSI_PROC per pid (get_proc_handles + N× get_proc) — 1 + N round-trips over a single-page portal region, and a snapshot that can tear as processes come and go between the per-pid reads. This is one RCU-consistent snapshot in ceil(N/72) transactions.

Safety: comm comes from task->comm (kernel memory only) and !mm tasks (kernel threads) are skipped, so it never calls access_remote_vm and is safe against exiting/stopped contexts. Kernel-thread enumeration is intentionally deferred.

Auto-wired through the portal_op_list.h X-macro (enum + dispatch + prototype); handler mirrors handle_op_osi_proc_handles/handle_op_read_fds.

2. pid / create_time denormalized into struct syscall_event

Set from current at fire time. Host-side syscall consumers (e.g. process-tree exit tracking) can identify the task directly off the event — zero extra round-trips, and no read of a dying task's memory.

Validation

• Compiles clean for 4.10 + 6.13 across armel / arm64 / x86_64.
• osi_proc_node layout (size 56, field offsets) and the new syscall_event fields verified identical in the emitted DWARF on both kernel versions.
• Exercised live in an armel/6.13 guest: OSI_PROC_ALL returns correct pid/ppid/comm with proper genealogy; exit tracking via syscall_event.pid records exits correctly.

Consumer

rehosting/penguin will add osi.get_all_procs() + a processes plugin and bump IGLOO_DRIVER_VERSION to a release carrying this op.